Updates for SGX 2.20 reproducible build.

Signed-off-by: Zhang Lili <lili.z.zhang@intel.com>

SampleCode/SampleAttestedTLS/README.md

@@ -122,6 +122,7 @@ Note:
     running in this sample.
     The project has a pre-preparation script - prepare_sgxssl.sh to prepare the SgxSSL libraries and link to them in
     the Makefile.
+    Note that script "prepare_sgxssl.sh" requires git installed and configured.
   - Limitation: No Simulation mode is supported.
 
 ### Running attested TLS server in loop

SampleCode/SampleAttestedTLS/common/utility.cpp

@@ -53,20 +53,20 @@ int get_pkey_by_rsa(EVP_PKEY *pk)
     e = BN_new();
     if (!e) {
         PRINT("BN_new failed\n");
-        return res;
+		goto done;
     }
 
     res = BN_set_word(e, (BN_ULONG)RSA_F4);
     if (!res) {
         PRINT("BN_set_word failed (%d)\n", res);
-		return res;
+		goto done;
     }
 
     rsa = RSA_new();
     if (!rsa) {
         PRINT("RSA_new failed\n");
         res = -1;
-		return res;
+		goto done;
     }
 
     res = RSA_generate_key_ex(
@@ -79,12 +79,15 @@ int get_pkey_by_rsa(EVP_PKEY *pk)
     if (!res)
     {
         PRINT("RSA_generate_key failed (%d)\n", res);
-		return res;
+		goto done;
     }
 
     // Assign RSA key to EVP_PKEY structure
     EVP_PKEY_assign_RSA(pk, rsa);
 
+done:
+    if (e)
+	    BN_clear_free(e);
     return res;
 }
 
@@ -100,14 +103,14 @@ int get_pkey_by_ec(EVP_PKEY *pk)
     if (res <= 0)
     {
         PRINT("EC_generate_key failed (%d)\n", res);
-        return res;
+        goto done;
     }
 
     res = EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, NID_secp384r1);
     if (res <= 0)
     {
         PRINT("EC_generate_key failed (%d)\n", res);
-        return res;
+        goto done;
     }
 
     /* Generate key */
@@ -115,9 +118,13 @@ int get_pkey_by_ec(EVP_PKEY *pk)
     if (res <= 0)
     {
         PRINT("EC_generate_key failed (%d)\n", res);
-        return res;
+        goto done;
     }
 
+done:
+	if (ctx)
+		EVP_PKEY_CTX_free(ctx);
+
     return res;
 }
 

SampleCode/SampleAttestedTLS/prepare_sgxssl.sh

@@ -35,9 +35,9 @@ project_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 echo "project_dir is $project_dir"
 sgxssl_dir=$project_dir/sgxssl
 openssl_out_dir=$sgxssl_dir/openssl_source
-openssl_ver_name=openssl-1.1.1q
-sgxssl_github_archive=https://github.com/01org/intel-sgx-ssl/archive
-sgxssl_file_name=support_tls_lin_1.1.1q
+openssl_ver_name=openssl-1.1.1t
+intel_sgx_ssl_url=https://github.com/intel/intel-sgx-ssl
+support_tls_branch=support_tls
 build_script=$sgxssl_dir/Linux/build_openssl.sh
 server_url_path=https://www.openssl.org/source
 full_openssl_url=$server_url_path/$openssl_ver_name.tar.gz
@@ -56,22 +56,10 @@ if [ $debug == true ] ; then
 	read -n 1 -p "download souce code only, because we need to build ourselves"
 fi
 
-openssl_chksum=d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca
-sgxssl_chksum=0ab6f62bda33e760422d502ba4812d058e50516ebb82e6c7713c78f580a7d622
-rm -f check_sum_openssl.txt check_sum_sgxssl.txt
+openssl_chksum=8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b
+rm -f check_sum_openssl.txt
 if [ ! -f $build_script ]; then
-    wget $sgxssl_github_archive/$sgxssl_file_name.zip -P $sgxssl_dir/ || exit 1
-    sha256sum $sgxssl_dir/$sgxssl_file_name.zip > $sgxssl_dir/check_sum_sgxssl.txt
-    grep $sgxssl_chksum $sgxssl_dir/check_sum_sgxssl.txt
-    if [ $? -ne 0 ]; then
-        echo "File $sgxssl_dir/$sgxssl_file_name.zip checksum failure"
-        rm -f $sgxssl_dir/$sgxssl_file_name.zip
-        exit -1
-    fi
-    unzip -qq $sgxssl_dir/$sgxssl_file_name.zip -d $sgxssl_dir/ || exit 1
-    mv $sgxssl_dir/intel-sgx-ssl-$sgxssl_file_name/* $sgxssl_dir/ || exit 1
-    rm $sgxssl_dir/$sgxssl_file_name.zip || exit 1
-    rm -rf $sgxssl_dir/intel-sgx-ssl-$sgxssl_file_name || exit 1
+    git clone $intel_sgx_ssl_url -b $support_tls_branch $sgxssl_dir || exit 1  
 fi
 
 if [ ! -f $openssl_out_dir/$openssl_ver_name.tar.gz ]; then

SampleCode/SampleAttestedTLS/server_tdx/Makefile

@@ -0,0 +1,41 @@
+#
+# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+#   * Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer.
+#   * Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in
+#     the documentation and/or other materials provided with the
+#     distribution.
+#   * Neither the name of Intel Corporation nor the names of its
+#     contributors may be used to endorse or promote products derived
+#     from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+#
+
+include ../sgxenv.mk
+
+all: server
+
+server:
+	$(CXX) -c -DTDX_ENV -DCLIENT_USE_QVL $(App_Cpp_Flags) server.cpp openssl_server.cpp ../common/verify_callback.cpp ../common/utility.cpp ../common/openssl_utility.cpp ../common/err_msg.cpp
+	$(CXX) -o tls_server server.o openssl_server.o verify_callback.o utility.o openssl_utility.o err_msg.o $(App_Link_Flags) -lssl -ltdx_tls -lsgx_dcap_quoteverify -l:libtdx_attest.so.1
+
+clean:
+	rm -f tls_server *.o

SampleCode/SampleAttestedTLS/server_tdx/openssl_server.cpp

@@ -0,0 +1,238 @@
+/**
+*
+* MIT License
+*
+* Copyright (c) Open Enclave SDK contributors.
+*
+* Permission is hereby granted, free of charge, to any person obtaining a copy
+* of this software and associated documentation files (the "Software"), to deal
+* in the Software without restriction, including without limitation the rights
+* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+* copies of the Software, and to permit persons to whom the Software is
+* furnished to do so, subject to the following conditions:
+*
+* The above copyright notice and this permission notice shall be included in all
+* copies or substantial portions of the Software.
+*
+* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+* SOFTWARE
+*
+*/
+
+#include <openssl/evp.h>
+#include <openssl/ssl.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <unistd.h>
+#include "../common/openssl_utility.h"
+
+int set_up_tls_server(char* server_port, bool keep_server_up);
+
+int verify_callback(int preverify_ok, X509_STORE_CTX* ctx);
+
+int create_listener_socket(int port, int& server_socket)
+{
+    int ret = -1;
+    const int reuse = 1;
+    struct sockaddr_in addr;
+    addr.sin_family = AF_INET;
+    addr.sin_port = htons(port);
+    addr.sin_addr.s_addr = htonl(INADDR_ANY);
+
+    server_socket = socket(AF_INET, SOCK_STREAM, 0);
+    if (server_socket < 0)
+    {
+        PRINT(TLS_SERVER "socket creation failed\n");
+        goto exit;
+    }
+
+    if (setsockopt(
+            server_socket,
+            SOL_SOCKET,
+            SO_REUSEADDR,
+            (const void*)&reuse,
+            sizeof(reuse)) < 0)
+    {
+        PRINT(TLS_SERVER "setsocket failed \n");
+        goto exit;
+    }
+
+    if (bind(server_socket, (struct sockaddr*)&addr, sizeof(addr)) < 0)
+    {
+        PRINT(TLS_SERVER "Unable to bind socket to the port\n");
+        goto exit;
+    }
+
+    if (listen(server_socket, 20) < 0)
+    {
+        PRINT(TLS_SERVER "Unable to open socket for listening\n");
+        goto exit;
+    }
+    ret = 0;
+exit:
+    return ret;
+}
+
+int handle_communication_until_done(
+    int& server_socket_fd,
+    int& client_socket_fd,
+    SSL_CTX*& ssl_server_ctx,
+    SSL*& ssl_session,
+    bool keep_server_up)
+{
+    int ret = -1;
+	int  test_error = 1;
+waiting_for_connection_request:
+	
+    struct sockaddr_in addr;
+    uint len = sizeof(addr);
+
+    // reset ssl_session and client_socket_fd to prepare for the new TLS
+    // connection
+    if (client_socket_fd > 0) 
+    {
+        ret = close(client_socket_fd);
+        if (ret != 0) {
+            PRINT(TLS_SERVER "error closing client socket before starting a new TLS session.\n");
+            goto exit;
+        }
+    }
+    SSL_free(ssl_session);
+    PRINT(TLS_SERVER " waiting for client connection\n");
+
+    client_socket_fd = accept(server_socket_fd, (struct sockaddr*)&addr, &len);
+
+    if (client_socket_fd < 0)
+    {
+        PRINT(TLS_SERVER "Unable to accept the client request\n");
+        goto exit;
+    }
+
+    // create a new SSL structure for a connection
+    if ((ssl_session = SSL_new(ssl_server_ctx)) == nullptr)
+    {
+        PRINT(TLS_SERVER
+               "Unable to create a new SSL connection state object\n");
+        goto exit;
+    }
+
+    SSL_set_fd(ssl_session, client_socket_fd);
+
+    // wait for a TLS/SSL client to initiate a TLS/SSL handshake
+
+    PRINT(TLS_SERVER "initiating a passive connect SSL_accept\n");
+    test_error = SSL_accept(ssl_session);
+    if (test_error <= 0)
+    {
+        PRINT(TLS_SERVER " SSL handshake failed, error(%d)(%d)\n",
+					test_error, SSL_get_error(ssl_session, test_error));
+        goto exit;
+    }
+
+    PRINT(TLS_SERVER "<---- Read from client:\n");
+    if (read_from_session_peer(
+            ssl_session, CLIENT_PAYLOAD, CLIENT_PAYLOAD_SIZE) != 0)
+    {
+        PRINT(TLS_SERVER " Read from client failed\n");
+        goto exit;
+    }
+
+    PRINT(TLS_SERVER "<---- Write to client:\n");
+    if (write_to_session_peer(
+            ssl_session, SERVER_PAYLOAD, strlen(SERVER_PAYLOAD)) != 0)
+    {
+        PRINT(TLS_SERVER " Write to client failed\n");
+        goto exit;
+    }
+
+    if (keep_server_up)
+        goto waiting_for_connection_request;
+
+    ret = 0;
+exit:
+    return ret;
+}
+
+int set_up_tls_server(char* server_port, bool keep_server_up)
+{
+    int ret = 0;
+    int server_socket_fd;
+    int client_socket_fd = -1;
+    unsigned int server_port_number;
+
+    X509* certificate = nullptr;
+    EVP_PKEY* pkey = nullptr;
+    SSL_CONF_CTX* ssl_confctx = SSL_CONF_CTX_new();
+
+    SSL_CTX* ssl_server_ctx = nullptr;
+    SSL* ssl_session = nullptr;
+    if ((ssl_server_ctx = SSL_CTX_new(TLS_server_method())) == nullptr)
+    {
+        PRINT(TLS_SERVER "unable to create a new SSL context\n");
+        goto exit;
+    }
+
+    if (initalize_ssl_context(ssl_confctx, ssl_server_ctx) != SGX_SUCCESS)
+    {
+        PRINT(TLS_SERVER "unable to create a initialize SSL context\n ");
+        goto exit;
+    }
+    SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER, &verify_callback);
+    
+    if (load_tls_certificates_and_keys(ssl_server_ctx, certificate, pkey) != 0)
+    {
+        PRINT(TLS_SERVER
+               " unable to load certificate and private key on the server\n ");
+        goto exit;
+    }
+	
+    server_port_number = (unsigned int)atoi(server_port); // convert to char* to int
+    if (create_listener_socket(server_port_number, server_socket_fd) != 0)
+    {
+        PRINT(TLS_SERVER " unable to create listener socket on the server\n ");
+        goto exit;
+    }
+
+    // handle communication
+    ret = handle_communication_until_done(
+        server_socket_fd,
+        client_socket_fd,
+        ssl_server_ctx,
+        ssl_session,
+        keep_server_up);
+    if (ret != 0)
+    {
+        PRINT(TLS_SERVER "server communication error %d\n", ret);
+        goto exit;
+    }
+
+exit:
+    ret = close(client_socket_fd); // close the socket connections
+    if (ret != 0)
+        PRINT(TLS_SERVER "error closing client socket\n");
+    ret = close(server_socket_fd);
+    if (ret != 0)
+        PRINT(TLS_SERVER "error closing server socket\n");
+
+    if (ssl_session)
+    {
+        SSL_shutdown(ssl_session);
+        SSL_free(ssl_session);
+    }
+    if (ssl_server_ctx)
+        SSL_CTX_free(ssl_server_ctx);
+    if (ssl_confctx)
+        SSL_CONF_CTX_free(ssl_confctx);
+    if (certificate)
+        X509_free(certificate);
+    if (pkey)
+        EVP_PKEY_free(pkey);
+    return (ret);
+}

SampleCode/SampleAttestedTLS/server_tdx/server.cpp

@@ -0,0 +1,92 @@
+/**
+*
+* MIT License
+*
+* Copyright (c) Open Enclave SDK contributors.
+*
+* Permission is hereby granted, free of charge, to any person obtaining a copy
+* of this software and associated documentation files (the "Software"), to deal
+* in the Software without restriction, including without limitation the rights
+* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+* copies of the Software, and to permit persons to whom the Software is
+* furnished to do so, subject to the following conditions:
+*
+* The above copyright notice and this permission notice shall be included in all
+* copies or substantial portions of the Software.
+*
+* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+* SOFTWARE
+*
+*/
+
+#include <stdio.h>
+#include <string.h>
+
+#define LOOP_OPTION "-server-in-loop"
+
+int set_up_tls_server(char* server_port, bool keep_server_up);
+
+int main(int argc, const char* argv[])
+{
+    int ret = 1;
+    char* server_port = NULL;
+    int keep_server_up = 0; // should be bool type, 0 false, 1 true
+
+    /* Check argument count */
+    if (argc != 2)
+    {
+        if (argc == 3)
+        {
+            if (strcmp(argv[2], LOOP_OPTION) != 0)
+            {
+                goto print_usage;
+            }
+            else
+            {
+                keep_server_up = 1;
+                goto read_port;
+            }
+        }
+    print_usage:
+        printf(
+            "Usage: %s -port:<port> [%s]\n",
+            argv[0],
+            LOOP_OPTION);
+        return 1;
+    }
+
+read_port:
+    // read port parameter
+    {
+        char* option = (char*)"-port:";
+        size_t param_len = 0;
+        param_len = strlen(option);
+        if (strncmp(argv[1], option, param_len) == 0)
+        {
+            server_port = (char*)(argv[1] + param_len);
+        }
+        else
+        {
+            fprintf(stderr, "Unknown option %s\n", argv[1]);
+            goto print_usage;
+        }
+    }
+    printf("server port = %s\n", server_port);
+
+    printf("Host: calling setup_tls_server\n");
+    ret = set_up_tls_server(server_port, keep_server_up);
+    if (ret != 0)
+    {
+        printf("Host: setup_tls_server failed\n");
+        goto exit;
+    }
+
+exit:
+    printf("Host:  %s \n", (ret == 0) ? "succeeded" : "failed");
+    return ret;
+}