Add identity counter to Status data structures. (#155)

* Add identity counter to witness status data structures. * Move identity counter out of WitnessStatus.
transparency-dev · Feb 1, 2024 · 6dcbc3c · 6dcbc3c
1 parent 74b2181
commit 6dcbc3c
Show file tree

Hide file tree

Showing 4 changed files with 115 additions and 102 deletions.
diff --git a/api/api.go b/api/api.go
@@ -92,17 +92,18 @@ func (p *Status) Print() string {
 	var status bytes.Buffer
 
 	status.WriteString("----------------------------------------------------------- Trusted OS ----\n")
-	status.WriteString(fmt.Sprintf("Serial number ..........: %s\n", p.Serial))
-	status.WriteString(fmt.Sprintf("Secure Boot ............: %v\n", p.HAB))
-	status.WriteString(fmt.Sprintf("Revision ...............: %s\n", p.Revision))
-	status.WriteString(fmt.Sprintf("Version ................: %d (%s)\n", p.Version, time.Unix(int64(p.Version), 0)))
-	status.WriteString(fmt.Sprintf("Runtime ................: %s\n", p.Runtime))
-	status.WriteString(fmt.Sprintf("Link ...................: %v\n", p.Link))
+	status.WriteString(fmt.Sprintf("Serial number ..............: %s\n", p.Serial))
+	status.WriteString(fmt.Sprintf("Secure Boot ................: %v\n", p.HAB))
+	status.WriteString(fmt.Sprintf("Revision ...................: %s\n", p.Revision))
+	status.WriteString(fmt.Sprintf("Version ....................: %d (%s)\n", p.Version, time.Unix(int64(p.Version), 0)))
+	status.WriteString(fmt.Sprintf("Runtime ....................: %s\n", p.Runtime))
+	status.WriteString(fmt.Sprintf("Link .......................: %v\n", p.Link))
+	status.WriteString(fmt.Sprintf("IdentityCounter ............: %d", p.IdentityCounter))
 	if p.Witness != nil {
-		status.WriteString(fmt.Sprintf("Witness/Identity .......: %v\n", p.Witness.Identity))
-		status.WriteString(fmt.Sprintf("Witness/IP .............: %v", p.Witness.IP))
+		status.WriteString(fmt.Sprintf("Witness/Identity ...........: %v\n", p.Witness.Identity))
+		status.WriteString(fmt.Sprintf("Witness/IP .................: %v", p.Witness.IP))
 	} else {
-		status.WriteString(fmt.Sprint("Witness ................: <no status>"))
+		status.WriteString(fmt.Sprint("Witness ....................: <no status>"))
 	}
 
 	return status.String()

diff --git a/api/api.pb.go b/api/api.pb.go
diff --git a/api/api.proto b/api/api.proto
@@ -16,10 +16,10 @@
 
 syntax = "proto3";
 
-option go_package = "./;api";
-
 package api;
 
+option go_package = "./;api";
+
 /*
 
 Trusted Applet updates are supported with a sequence that splits the applet
@@ -79,15 +79,14 @@ The `TotalChunks` value indicates the total number of chunks for the update,
 
 */
 message AppletUpdate {
-	uint32 Total = 1;
-	uint32 Seq   = 2;
-	oneof Payload {
-		bytes  Data  = 3;
-		AppletUpdateHeader Header = 4;
-	};
+  uint32 Total = 1;
+  uint32 Seq = 2;
+  oneof Payload {
+    bytes Data = 3;
+    AppletUpdateHeader Header = 4;
+  }
 }
 
-
 /*
 
 AppletUpdateHeader
@@ -99,16 +98,18 @@ It's sent in the zero-th `AppletUpdate` message during an OTA.
 */
 
 message AppletUpdateHeader {
-	// Signature holds the signature over the applet.
-	bytes  Signature  = 1;
-	// Checkpoint contains a note-formatted Log Checkpoint.
-	bytes  Checkpoint = 2;
-	// Manifest is metadata about the applet, which has been logged to a firmware transparency log.
-	bytes  Manifest = 3;
-	// InclusionProof is a log inclusion proof for Manifest committed to by Checkpoint.
-	repeated bytes InclusionProof = 4;
-	// LogIndex is the index of Manifest in the firmware transparency log.
-	uint64	LogIndex = 5; 
+  // Signature holds the signature over the applet.
+  bytes Signature = 1;
+  // Checkpoint contains a note-formatted Log Checkpoint.
+  bytes Checkpoint = 2;
+  // Manifest is metadata about the applet, which has been logged to a firmware
+  // transparency log.
+  bytes Manifest = 3;
+  // InclusionProof is a log inclusion proof for Manifest committed to by
+  // Checkpoint.
+  repeated bytes InclusionProof = 4;
+  // LogIndex is the index of Manifest in the firmware transparency log.
+  uint64 LogIndex = 5;
 }
 
 /*
@@ -120,14 +121,17 @@ The status information format is returned on any message sent with the
 
 */
 message Status {
-	string Serial         = 1;
-	bool   HAB            = 2;
-	string Revision       = 3;
-	string Build          = 4;
-	uint32 Version        = 5;
-	string Runtime        = 6;
-	bool   Link           = 7;
-	WitnessStatus Witness = 8;
+  string Serial = 1;
+  bool HAB = 2;
+  string Revision = 3;
+  string Build = 4;
+  uint32 Version = 5;
+  string Runtime = 6;
+  bool Link = 7;
+  WitnessStatus Witness = 8;
+  // IdentityCounter is incremented when the device is recovered and the device
+  // needs a new witness identity.
+  uint32 IdentityCounter = 9;
 }
 
 /*
@@ -139,11 +143,11 @@ this information to the OS.
 
 */
 message WitnessStatus {
-	// Identity is the note-formatted public key which can be used to verify
-	// checkpoints cosigned by this witness.
-	string Identity  = 1;
-	// IP is a string representation of the witness applet's current IP address.
-	string IP        = 2;
+  // Identity is the note-formatted public key which can be used to verify
+  // checkpoints cosigned by this witness.
+  string Identity = 1;
+  // IP is a string representation of the witness applet's current IP address.
+  string IP = 2;
 }
 
 /*
@@ -159,23 +163,23 @@ command.
 */
 
 message Configuration {
-	bool   DHCP      = 1;
-	string IP        = 2;
-	string Netmask   = 3;
-	string Gateway   = 4;
-	string Resolver  = 5;
-	string NTPServer = 6;
+  bool DHCP = 1;
+  string IP = 2;
+  string Netmask = 3;
+  string Gateway = 4;
+  string Resolver = 5;
+  string NTPServer = 6;
 }
 
 message Response {
-	ErrorCode Error   = 1;
-	bytes     Payload = 2;
+  ErrorCode Error = 1;
+  bytes Payload = 2;
 }
 
 enum ErrorCode {
-	NONE = 0;
+  NONE = 0;
 
-	// GENERIC_ERROR is returned in case of a generic error, in this case
-	// Payload might contain the error string.
-	GENERIC_ERROR = 1;
+  // GENERIC_ERROR is returned in case of a generic error, in this case
+  // Payload might contain the error string.
+  GENERIC_ERROR = 1;
 }
diff --git a/trusted_os/ctl.go b/trusted_os/ctl.go
@@ -61,6 +61,7 @@ func getStatus() (s *api.Status) {
 		Build:    Build,
 		Version:  version,
 		Runtime:  fmt.Sprintf("%s %s/%s", runtime.Version(), runtime.GOOS, runtime.GOARCH),
+		// TODO(jayhou): set IdentityCounter here.
 	}
 	if witnessStatus != nil {
 		s.Witness = &api.WitnessStatus{