Support dynamic measurement policies via CLI option

Cargo.toml

@@ -43,7 +43,6 @@ pkcs1 = "0.7.5"
 pkcs8 = "0.10.2"
 rcgen = "0.14.5"
 pin-project-lite = "0.2.16"
-pccs = { git = "https://github.com/flashbots/attested-tls", branch = "main" }
 
 [dev-dependencies]
 tempfile = "3.23.0"

README.md

@@ -37,27 +37,65 @@ Details and examples of the measurements file format are [in the `attestation` c
 
 Exactly one verification policy must be provided: either `--measurements-file` or `--allowed-remote-attestation-type`. The latter may be `none` for cases where the remote party is not running in a CVM, but that must be explicitly specified.
 
+When `--dynamic-measurement-policy` is enabled, the policy is reloaded from the path or URL supplied via `--measurements-file` after a measurement mismatch. This option requires `--measurements-file`.
+
 As an alternative to specifying measurement values, OS image hashes can be specified. See [portable measurement policies](https://github.com/flashbots/attested-tls/tree/main/crates/attestation#portable-measurement-policies) for details.
 
 ### Measurement Headers
 
-When attestation is validated successfully, the following headers are injected into the HTTP request / response making them available to the source client and/or target service.
-
-These aim to match the header formatting used by `cvm-reverse-proxy`.
+When the remote party satisfies the configured measurement policy, the following headers are injected into the HTTP request / response, making the matched policy values available to the source client and/or target service.
 
 Header name: `X-Flashbots-Measurement`
 
-Header value:
+The value is compact, self-describing JSON containing the expected measurements from the matching policy record, rather than the measurements reported by the remote party. Hashes are lowercase hexadecimal strings. DCAP and Azure register values are arrays because a policy can accept multiple values for each register.
+
+For DCAP measurements, keys `"0"` through `"4"` represent MRTD and RTMR0 through RTMR3 respectively:
+
 ```json
 {
-  "0": "48 byte MRTD value encoded as hex",
-  "1": "48 byte RTMR0 value encoded as hex",
-  "2": "48 byte RTMR1 value encoded as hex",
-  "3": "48 byte RTMR2 value encoded as hex",
-  "4": "48 byte RTMR3 value encoded as hex"
+  "type": "dcap",
+  "measurements": {
+    "0": ["<96 hex characters>"],
+    "3": ["<96 hex characters>", "<96 hex characters>"]
+  }
 }
 ```
 
+For Azure measurements, each key is a PCR index:
+
+```json
+{
+  "type": "azure",
+  "measurements": {
+    "4": ["<64 hex characters>"],
+    "11": ["<64 hex characters>"]
+  }
+}
+```
+
+Portable image-hash policies produce:
+
+```json
+{
+  "type": "image",
+  "measurements": {
+    "uki_authenticode": "<96 hex characters>",
+    "kernel_authenticode": "<96 hex characters>",
+    "cmdline_hash": "<96 hex characters>",
+    "initrd_hash": "<96 hex characters>",
+    "gpt_disk_guid_hash": "<96 hex characters>"
+  }
+}
+```
+
+When the matching policy permits no attestation, the value is:
+
+```json
+{"type":"no_attestation"}
+```
+
+The actual HTTP header value is serialized as compact JSON on one line.
+
 Header name: `X-Flashbots-Attestation-Type`
 
 Header value: an attestation type given as a string as described below.
@@ -77,7 +115,7 @@ These are the attestation type names used in the HTTP headers, and the measureme
 - `--pccs-url` selects the PCCS used to retrieve collateral when verifying DCAP attestations. It defaults to Intel PCS.
 - `client`, `get-tls-cert`, and `attested-get` accept `--allow-self-signed` to permit a self-signed remote TLS certificate.
 - `client` and `server` accept `--listen-addr-healthcheck` to start a separate HTTP health-check listener.
-- `get-tls-cert --out-measurements <PATH>` writes the verified remote measurements as JSON in addition to writing the certificate chain to standard output.
+- `get-tls-cert --out-measurements <PATH>` writes the matched expected measurements as JSON in addition to writing the certificate chain to standard output.
 - If `server` is started without `--tls-private-key-path` and `--tls-certificate-path`, it generates a self-signed certificate for its listening IP address.
 
 ## Protocol Specification
@@ -92,7 +130,7 @@ Immediately after the TLS handshake, an attestation exchange is made. Details of
 
 Following a successful attestation exchange, the client can make HTTP requests, and the server will forward them to the target service.
 
-As described above, the server will inject measurement data into the request headers before forwarding them to the target service, and the client will inject measurement data into the response headers before forwarding them to the source client.
+As described above, the server will inject matched expected measurement data into the request headers before forwarding them to the target service, and the client will inject the same kind of data into the response headers before forwarding them to the source client.
 
 The proxy client and proxy server support HTTP/2 and HTTP/1.1 over their attested-TLS channel, with HTTP/2 preferred. The HTTP protocol is combined with the attested-TLS protocol version in ALPN, producing `flashbots-ratls/1+h2` or `flashbots-ratls/1+http/1.1`. A negotiated `flashbots-ratls/1` value without an HTTP suffix falls back to HTTP/1.1.
 

attested-tls/Cargo.toml

@@ -18,7 +18,7 @@ http = "1.3.1"
 serde_json = "1.0.145"
 tracing = "0.1.41"
 parity-scale-codec = "3.7.5"
-attestation = { git = "https://github.com/flashbots/attested-tls", branch = "main" }
+attestation = { git = "https://github.com/flashbots/attested-tls", branch = "peg/verifier-returns-expected-measurements" }
 
 # Used for websocket support
 tokio-tungstenite = { version = "0.28.0", optional = true }
@@ -40,7 +40,7 @@ rcgen = { version = "0.14.5", optional = true }
 [dev-dependencies]
 rcgen = "0.14.5"
 tempfile = "3.23.0"
-attestation = { git = "https://github.com/flashbots/attested-tls", branch = "main", features = ["mock"] }
+attestation = { git = "https://github.com/flashbots/attested-tls", branch = "peg/verifier-returns-expected-measurements", features = ["mock"] }
 
 [features]
 default = ["ws", "rpc"]

attested-tls/src/attested_rpc.rs

@@ -1,6 +1,7 @@
 //! Provides an attested JSON RPC client based on [alloy_rpc_client::RpcClient]
 use alloy_rpc_client::RpcClient;
 use alloy_transport_http::{Http, HyperClient};
+use attestation::measurements::ExpectedMeasurements;
 use hyper::{Request, Response, client::conn};
 use hyper_util::rt::TokioIo;
 use std::{
@@ -12,10 +13,7 @@ use std::{
 use thiserror::Error;
 use tower_service::Service;
 
-use crate::{
-    AttestedTlsClient, AttestedTlsError,
-    attestation::{AttestationType, measurements::MultiMeasurements},
-};
+use crate::{AttestedTlsClient, AttestedTlsError, attestation::AttestationType};
 
 /// Supported HTTP versions for RPC connection bootstrapping
 pub enum HttpVersion {
@@ -54,7 +52,7 @@ impl AttestedRpcClient {
         &self,
         server: &str,
         is_local: bool,
-    ) -> Result<(RpcClient, Option<MultiMeasurements>, AttestationType), AttestedRpcError> {
+    ) -> Result<(RpcClient, ExpectedMeasurements, AttestationType), AttestedRpcError> {
         let (stream, measurements, attestation_type) = self.inner.connect_tcp(server).await?;
         let io = TokioIo::new(stream);
 

attested-tls/src/lib.rs

@@ -12,7 +12,7 @@ pub use attestation;
 
 use attestation::{
     AttestationError, AttestationExchangeMessage, AttestationGenerator, AttestationType,
-    AttestationVerifier, measurements::MultiMeasurements,
+    AttestationVerifier, measurements::ExpectedMeasurements,
 };
 use parity_scale_codec::{Decode, Encode};
 use sha2::{Digest, Sha256};
@@ -137,7 +137,7 @@ impl AttestedTlsServer {
     ) -> Result<
         (
             tokio_rustls::server::TlsStream<IO>,
-            Option<MultiMeasurements>,
+            ExpectedMeasurements,
             AttestationType,
         ),
         AttestedTlsError,
@@ -197,15 +197,15 @@ impl AttestedTlsServer {
         let remote_attestation_message = AttestationExchangeMessage::decode(&mut &buf[..])?;
         let remote_attestation_type = remote_attestation_message.attestation_type();
 
-        // If we expect an attestaion from the client, verify it and get measurements
+        // If we expect an attestation from the client, verify it and get measurements
         let measurements = if self.attestation_verifier.has_remote_attestation() {
             let remote_input_data = compute_report_input(remote_cert_chain.as_deref(), exporter)?;
 
             self.attestation_verifier
                 .verify_attestation(remote_attestation_message, remote_input_data)
                 .await?
         } else {
-            None
+            ExpectedMeasurements::NoAttestation
         };
 
         Ok((tls_stream, measurements, remote_attestation_type))
@@ -330,7 +330,7 @@ impl AttestedTlsClient {
     ) -> Result<
         (
             tokio_rustls::client::TlsStream<IO>,
-            Option<MultiMeasurements>,
+            ExpectedMeasurements,
             AttestationType,
         ),
         AttestedTlsError,
@@ -414,7 +414,7 @@ impl AttestedTlsClient {
     ) -> Result<
         (
             tokio_rustls::client::TlsStream<tokio::net::TcpStream>,
-            Option<MultiMeasurements>,
+            ExpectedMeasurements,
             AttestationType,
         ),
         AttestedTlsError,
@@ -427,7 +427,7 @@ impl AttestedTlsClient {
     pub async fn get_tls_cert(
         &self,
         server_name: &str,
-    ) -> Result<(Vec<CertificateDer<'static>>, Option<MultiMeasurements>), AttestedTlsError> {
+    ) -> Result<(Vec<CertificateDer<'static>>, ExpectedMeasurements), AttestedTlsError> {
         let (mut tls_stream, measurements, _attestation_type) =
             self.connect_tcp(server_name).await?;
 
@@ -449,7 +449,7 @@ pub async fn get_tls_cert(
     server_name: String,
     attestation_verifier: AttestationVerifier,
     remote_certificate: Option<CertificateDer<'static>>,
-) -> Result<(Vec<CertificateDer<'static>>, Option<MultiMeasurements>), AttestedTlsError> {
+) -> Result<(Vec<CertificateDer<'static>>, ExpectedMeasurements), AttestedTlsError> {
     tracing::debug!("Getting remote TLS cert");
     let attested_tls_client = AttestedTlsClient::new(
         None,
@@ -467,7 +467,7 @@ pub async fn get_tls_cert_with_config(
     server_name: &str,
     attestation_verifier: AttestationVerifier,
     client_config: ClientConfig,
-) -> Result<(Vec<CertificateDer<'static>>, Option<MultiMeasurements>), AttestedTlsError> {
+) -> Result<(Vec<CertificateDer<'static>>, ExpectedMeasurements), AttestedTlsError> {
     let attested_tls_client = AttestedTlsClient::new_with_tls_config(
         client_config,
         AttestationGenerator::with_no_attestation(),
@@ -752,8 +752,9 @@ mod tests {
         )
         .unwrap();
 
-        let mut attestation_verifier = AttestationVerifier::mock();
-        attestation_verifier.measurement_policy = measurement_policy;
+        let attestation_verifier = AttestationVerifier::builder(measurement_policy)
+            .with_no_internal_pccs()
+            .build();
 
         let client = AttestedTlsClient::new_with_tls_config(
             client_config,