go: Per-role quote policies

go/common/node/sgx.go

@@ -111,14 +111,20 @@ func (sc *SGXConstraints) ValidateBasic(cfg *TEEFeatures, isFeatureVersion242 bo
 		return fmt.Errorf("unsupported SGX constraints version: %d", sc.V)
 	}
 
-	// Check for TDX enablement.
-	if !cfg.SGX.TDX && sc.Policy.PCS != nil && sc.Policy.PCS.TDX != nil {
-		return fmt.Errorf("TDX policy not supported")
+	validatePolicy := func(policy *quote.Policy) error {
+		// Check for TDX enablement.
+		if !cfg.SGX.TDX && policy.PCS != nil && policy.PCS.TDX != nil {
+			return fmt.Errorf("TDX policy not supported")
+		}
+		if err := policy.Validate(isFeatureVersion242); err != nil {
+			return fmt.Errorf("invalid policy: %w", err)
+		}
+		return nil
 	}
 
-	// Check that policy is compliant with the current feature version.
+	// Check default policy.
 	if sc.Policy != nil {
-		if err := sc.Policy.Validate(isFeatureVersion242); err != nil {
+		if err := validatePolicy(sc.Policy); err != nil {
 			return fmt.Errorf("invalid policy: %w", err)
 		}
 	}

go/common/node/tee.go

@@ -34,18 +34,7 @@ type TEEFeaturesSGX struct {
 
 // ApplyDefaultConstraints applies configured SGX constraint defaults to the given structure.
 func (fs *TEEFeaturesSGX) ApplyDefaultConstraints(sc *SGXConstraints) {
-	// Default policy.
-	if fs.DefaultPolicy != nil {
-		if sc.Policy == nil {
-			sc.Policy = &quote.Policy{}
-		}
-		if sc.Policy.IAS == nil {
-			sc.Policy.IAS = fs.DefaultPolicy.IAS
-		}
-		if sc.Policy.PCS == nil && fs.PCS {
-			sc.Policy.PCS = fs.DefaultPolicy.PCS
-		}
-	}
+	sc.Policy = sc.Policy.ApplyDefault(fs.DefaultPolicy, fs.PCS)
 
 	// Default maximum attestation age.
 	if sc.MaxAttestationAge == 0 {

go/common/sgx/quote/quote.go

@@ -81,3 +81,22 @@ func (p *Policy) Validate(isFeatureVersion242 bool) error {
 
 	return fmt.Errorf("fmspc whitelist should be empty")
 }
+
+func (p *Policy) ApplyDefault(d *Policy, pcsEnabled bool) *Policy {
+	if d == nil {
+		return p
+	}
+
+	if p == nil {
+		p = &Policy{}
+	}
+
+	if p.IAS == nil {
+		p.IAS = d.IAS
+	}
+	if p.PCS == nil && pcsEnabled {
+		p.PCS = d.PCS
+	}
+
+	return p
+}