(&self, pccs_url: Option<&str>, quote: &[u8])
| 1125 | } |
| 1126 | |
| 1127 | async fn verify_tdx(&self, pccs_url: Option<&str>, quote: &[u8]) -> Result<TdxVerifiedReport> { |
| 1128 | let mut pccs_url = Cow::Borrowed(pccs_url.unwrap_or_default()); |
| 1129 | if pccs_url.is_empty() { |
| 1130 | // try to read from PCCS_URL env var |
| 1131 | pccs_url = match std::env::var("PCCS_URL") { |
| 1132 | Ok(url) => Cow::Owned(url), |
| 1133 | Err(_) => Cow::Borrowed(""), |
| 1134 | }; |
| 1135 | } |
| 1136 | let tdx_report = |
| 1137 | dcap_qvl::collateral::get_collateral_and_verify(quote, Some(pccs_url.as_ref())) |
| 1138 | .await |
| 1139 | .context("Failed to get collateral")?; |
| 1140 | validate_tcb(&tdx_report)?; |
| 1141 | |
| 1142 | let td_report = tdx_report.report.as_td10().context("no td report")?; |
| 1143 | let replayed_rtmr = self.replay_runtime_events::<Sha384>(None); |
| 1144 | if replayed_rtmr != td_report.rt_mr3 { |
| 1145 | bail!( |
| 1146 | "RTMR3 mismatch, quoted: {}, replayed: {}", |
| 1147 | hex::encode(td_report.rt_mr3), |
| 1148 | hex::encode(replayed_rtmr) |
| 1149 | ); |
| 1150 | } |
| 1151 | |
| 1152 | if td_report.report_data != self.report_data[..] { |
| 1153 | bail!("tdx report_data mismatch"); |
| 1154 | } |
| 1155 | Ok(tdx_report) |
| 1156 | } |
| 1157 | } |
| 1158 | |
| 1159 | /// Validate the TCB attributes |
no test coverage detected