admin/intel-linux-sgx
1
0
Fork 0
mirror of https://github.com/intel/linux-sgx synced 2026-06-08 14:49:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updates for SGX 2.17 reproducible build.

Browse Source 
Signed-off-by: Zhang Lili <lili.z.zhang@intel.com>
This commit is contained in:
Zhang Lili
2022-06-15 11:49:48 +08:00
parent 0f61c27a40
commit 1deb73848a
119 changed files with 2122 additions and 880 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SampleCode/SampleAttestedTLS/common/enclave.edl
+3 -3
View File
@@ -38,7 +38,7 @@ enclave {
*/
untrusted {
void ocall_print_string([in, string] const char *str);
int ocall_close(int fd);
void ocall_get_current_time([out] uint64_t *p_current_time);
};
int ocall_close(int fd);
void ocall_get_current_time([out] uint64_t *p_current_time);
};
};
SampleCode/SampleAttestedTLS/common/openssl_utility.cpp
+21 -22
View File
@@ -29,7 +29,7 @@
sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
{
quote3_error_t qresult = SGX_QL_SUCCESS;
sgx_status_t result = SGX_ERROR_UNEXPECTED;
sgx_status_t result = SGX_ERROR_UNEXPECTED;
uint8_t* output_certificate = NULL;
size_t output_certificate_size = 0;
uint8_t* private_key_buffer = nullptr;
@@ -38,15 +38,15 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
size_t public_key_buffer_size = 0;
const unsigned char* certificate_buffer_ptr = nullptr;
BIO* mem = nullptr;
int key_type = RSA_TYPE;
int key_type = RSA_TYPE;
if (key_type) {
t_print(" generating keys by EC P-384\n");
}
else
{
t_print(" generating keys by RSA 3072\n");
}
if (key_type) {
t_print(" generating keys by EC P-384\n");
}
else
{
t_print(" generating keys by RSA 3072\n");
}
result = generate_key_pair(
key_type, &public_key_buffer,
&public_key_buffer_size,
@@ -73,8 +73,8 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
if (qresult != SGX_QL_SUCCESS || output_certificate == nullptr)
{
if (output_certificate == nullptr)
t_print(" null certificate\n");
if (output_certificate == nullptr)
t_print(" null certificate\n");
p_sgx_tls_qe_err_msg(qresult);
goto done;
}
@@ -84,7 +84,7 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
// data. sending certificate_buffer_ptr as argument will keep
// output_certificate pointer undisturbed.
certificate_buffer_ptr = output_certificate;
certificate_buffer_ptr = output_certificate;
if ((certificate = d2i_X509(
nullptr,
@@ -108,11 +108,10 @@ sgx_status_t generate_certificate_and_pkey(X509*& certificate, EVP_PKEY*& pkey)
result = SGX_SUCCESS;
done:
if (private_key_buffer)
free(private_key_buffer);
if (public_key_buffer)
free(public_key_buffer);
free(private_key_buffer);
if (public_key_buffer)
free(public_key_buffer);
certificate_buffer_ptr = nullptr;
if (mem)
@@ -135,11 +134,11 @@ sgx_status_t load_tls_certificates_and_keys(
goto exit;
}
if (certificate == nullptr)
{
t_print("null cert\n");
goto exit;
}
if (certificate == nullptr)
{
t_print("null cert\n");
goto exit;
}
if (!SSL_CTX_use_certificate(ctx, certificate))
{
@@ -249,7 +248,7 @@ int read_from_session_peer(
int bytes_read = 0;
do
{
int len = sizeof(buffer) - 1;
unsigned int len = sizeof(buffer) - 1;
memset(buffer, 0, sizeof(buffer));
bytes_read = SSL_read(ssl_session, buffer, (size_t)len);
SampleCode/SampleAttestedTLS/common/tcommon.cpp
+1 -1
View File
@@ -53,5 +53,5 @@ void t_print(const char *fmt, ...)
void t_time(time_t *current_t)
{
ocall_get_current_time((uint64_t*)current_t);
ocall_get_current_time((uint64_t*)current_t);
}
SampleCode/SampleAttestedTLS/common/ucommon.cpp
+2 -2
View File
@@ -40,7 +40,7 @@
int ocall_close(int fd)
{
return close(fd);
return close(fd);
}
void ocall_get_current_time(uint64_t *p_current_time)
@@ -56,5 +56,5 @@ void ocall_get_current_time(uint64_t *p_current_time)
void ocall_print_string(const char *str)
{
printf("%s", str);
printf("%s", str);
}
SampleCode/SampleAttestedTLS/common/utility.cpp
+103 -82
View File
@@ -28,8 +28,8 @@
//
// Generate_Key_Pair function:
// type1: RSA
// type2: EC-P384
// type1: RSA
// type2: EC-P384
// currently all hardware independant
//
#include <openssl/bio.h>
@@ -45,26 +45,29 @@
int get_pkey_by_rsa(EVP_PKEY *pk)
{
int res = -1;
RSA* rsa = nullptr;
int res = -1;
RSA* rsa = nullptr;
BIGNUM* e = nullptr;
e = BN_new();
if (!e)
e = BN_new();
if (!e) {
t_print("BN_new failed\n");
return res;
}
res = BN_set_word(e, (BN_ULONG)RSA_F4);
if (!res) {
if (!res) {
t_print("BN_set_word failed (%d)\n", res);
return res;
}
}
rsa = RSA_new();
if (!rsa) {
t_print("RSA_new failed\n");
res = -1;
return res;
}
}
res = RSA_generate_key_ex(
rsa,
@@ -73,16 +76,16 @@ int get_pkey_by_rsa(EVP_PKEY *pk)
nullptr /* callback argument - not needed in this case */
);
if (!res)
{
if (!res)
{
t_print("RSA_generate_key failed (%d)\n", res);
return res;
}
// Assign RSA key to EVP_PKEY structure
}
// Assign RSA key to EVP_PKEY structure
EVP_PKEY_assign_RSA(pk, rsa);
return res;
return res;
}
int get_pkey_by_ec(EVP_PKEY *pk)
@@ -93,15 +96,29 @@ int get_pkey_by_ec(EVP_PKEY *pk)
ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL);
if (ctx == NULL)
return res;
if (EVP_PKEY_keygen_init(ctx) <= 0)
res = EVP_PKEY_keygen_init(ctx);
if (res <= 0)
{
t_print("EC_generate_key failed (%d)\n", res);
return res;
if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, NID_secp384r1) <= 0)
}
res = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, NID_secp384r1);
if (res <= 0)
{
t_print("EC_generate_key failed (%d)\n", res);
return res;
}
/* Generate key */
if (EVP_PKEY_keygen(ctx, &pk) <= 0)
res = EVP_PKEY_keygen(ctx, &pk);
if (res <= 0)
{
t_print("EC_generate_key failed (%d)\n", res);
return res;
return 0;
}
return res;
}
@@ -121,110 +138,112 @@ sgx_status_t generate_key_pair(
EVP_PKEY* pkey = nullptr;
BIO* bio = nullptr;
pkey = EVP_PKEY_new();
pkey = EVP_PKEY_new();
if (!pkey)
{
t_print("EVP_PKEY_new failed\n");
result = SGX_ERROR_UNEXPECTED;
goto done;
}
if (type != RSA_TYPE || type != EC_TYPE)
if (type != RSA_TYPE && type != EC_TYPE)
{
type = RSA_TYPE; // by default, we use RSA_TYPE
}
switch(type)
{
case RSA_TYPE:
res = get_pkey_by_rsa(pkey);
break;
case EC_TYPE:
res = get_pkey_by_ec(pkey);
break;
}
switch(type)
{
case RSA_TYPE:
res = get_pkey_by_rsa(pkey);
break;
case EC_TYPE:
res = get_pkey_by_ec(pkey);
break;
}
if (!res)
{
if (res <= 0)
{
t_print("get_pkey failed (%d)\n", res);
result = SGX_ERROR_UNEXPECTED;
goto done;
}
}
// Allocate memory
local_public_key = (uint8_t*)malloc(RSA_3072_PUBLIC_KEY_SIZE);
memset(local_public_key, 0x00, RSA_3072_PUBLIC_KEY_SIZE);
if (!local_public_key)
{
t_print("out-of-memory:calloc(local_public_key failed\n");
result = SGX_ERROR_UNEXPECTED;
goto done;
}
if (!local_public_key)
{
t_print("out-of-memory:calloc(local_public_key failed\n");
result = SGX_ERROR_OUT_OF_EPC;
goto done;
}
memset(local_public_key, 0x00, RSA_3072_PUBLIC_KEY_SIZE);
local_private_key = (uint8_t*)malloc(RSA_3072_PRIVATE_KEY_SIZE);
memset(local_private_key, 0x00, RSA_3072_PRIVATE_KEY_SIZE);
local_private_key = (uint8_t*)malloc(RSA_3072_PRIVATE_KEY_SIZE);
if (!local_private_key)
{
t_print("out-of-memory: calloc(local_private_key) failed\n");
result = SGX_ERROR_UNEXPECTED;
goto done;
}
{
t_print("out-of-memory: calloc(local_private_key) failed\n");
result = SGX_ERROR_OUT_OF_EPC;
goto done;
}
memset(local_private_key, 0x00, RSA_3072_PRIVATE_KEY_SIZE);
// Write out the public/private key in PEM format for exchange with
// other enclaves.
bio = BIO_new(BIO_s_mem());
if (!bio)
{
bio = BIO_new(BIO_s_mem());
if (!bio)
{
t_print("BIO_new for local_public_key failed\n");
goto done;
}
}
res = PEM_write_bio_PUBKEY(bio, pkey);
if (!res)
{
t_print("PEM_write_bio_PUBKEY failed (%d)\n", res);
goto done;
}
{
t_print("PEM_write_bio_PUBKEY failed (%d)\n", res);
goto done;
}
res = BIO_read(bio, local_public_key, RSA_3072_PUBLIC_KEY_SIZE);
if (!res)
{
t_print("BIO_read public key failed (%d)\n", res);
goto done;
}
{
t_print("BIO_read public key failed (%d)\n", res);
goto done;
}
BIO_free(bio);
bio = nullptr;
bio = BIO_new(BIO_s_mem());
if (!bio)
{
t_print("BIO_new for local_public_key failed\n");
goto done;
}
{
t_print("BIO_new for local_public_key failed\n");
goto done;
}
res = PEM_write_bio_PrivateKey(
bio, pkey, nullptr, nullptr, 0, nullptr, nullptr);
if (!res)
{
t_print("PEM_write_bio_PrivateKey failed (%d)\n", res);
goto done;
}
{
t_print("PEM_write_bio_PrivateKey failed (%d)\n", res);
goto done;
}
res = BIO_read(bio, local_private_key, RSA_3072_PRIVATE_KEY_SIZE);
if (!res)
{
t_print("BIO_read private key failed (%d)\n", res);
goto done;
}
{
t_print("BIO_read private key failed (%d)\n", res);
goto done;
}
BIO_free(bio);
BIO_free(bio);
bio = nullptr;
*public_key = local_public_key;
//*public_key_size = RSA_3072_PUBLIC_KEY_SIZE;
*private_key = local_private_key;
// *private_key_size = RSA_3072_PRIVATE_KEY_SIZE;
*public_key_size = strlen(reinterpret_cast<const char *>(local_public_key)) + 1;
*public_key_size = strlen(reinterpret_cast<const char *>(local_public_key)) + 1;
*private_key_size = strlen(reinterpret_cast<const char *>(local_private_key)) + 1;
t_print("public_key_size %d, private_key_size %d\n", *public_key_size, *private_key_size);
t_print("public_key_size %d, private_key_size %d\n", *public_key_size, *private_key_size);
result = SGX_SUCCESS;
done:
@@ -232,10 +251,12 @@ done:
BIO_free(bio);
if (pkey)
EVP_PKEY_free(pkey); // When this is called, rsa is also freed
if (result != SGX_SUCCESS)
if (result != SGX_SUCCESS)
{
free(local_public_key);
free(local_private_key);
}
if (local_public_key)
free(local_public_key);
if (local_private_key)
free(local_private_key);
}
return result;
}
SampleCode/SampleAttestedTLS/common/verify_callback.cpp
+9 -9
View File
@@ -80,12 +80,12 @@ int verify_callback(int preverify_ok, X509_STORE_CTX* ctx)
// convert a cert into a buffer in DER format
der_len = i2d_X509(crt, nullptr);
if (der_len <= 0) {
PRINT(TLS_CLIENT "i2d_X509 failed(der_len=%d)\n", der_len);
if (der_len <= 0) {
PRINT(TLS_CLIENT "i2d_X509 failed(der_len=%d)\n", der_len);
goto done;
}
}
buff = (unsigned char*)malloc(der_len);
buff = (unsigned char*)malloc(der_len);
if (buff == nullptr)
{
PRINT(TLS_CLIENT "malloc failed (der_len=%d)\n", der_len);
@@ -115,11 +115,11 @@ int verify_callback(int preverify_ok, X509_STORE_CTX* ctx)
GETCURRTIME(&current_time);
// verify tls certificate
result = VERIFY_CALLBACK(
der, der_len, current_time, &qv_result, &sup_data, (uint32_t *)&sup_data_len);
result = VERIFY_CALLBACK(
der, der_len, current_time, &qv_result, &sup_data, (uint32_t *)&sup_data_len);
// result != SGX_QL_SUCCESS means critical error
if (result != SGX_QL_SUCCESS)
if (result != SGX_QL_SUCCESS)
{
PRINT(TLS_CLIENT "Quote Verification Failed with result(%x) - \n", result);
p_sgx_tls_qe_err_msg(result);
@@ -136,10 +136,10 @@ int verify_callback(int preverify_ok, X509_STORE_CTX* ctx)
}
}
FREE_SUPDATA(sup_data);
FREE_SUPDATA(sup_data);
PRINT(" verifying certificate end\n");
ret = 1;
ret = 1;
done:
if (der)