admin/intel-linux-sgx
1
0
Fork 0
mirror of https://github.com/intel/linux-sgx synced 2026-06-08 14:49:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updates for SGX 2.20 reproducible build.

Browse Source 
Signed-off-by: Zhang Lili <lili.z.zhang@intel.com>
This commit is contained in:
Zhang Lili
2023-07-21 11:09:05 +08:00
parent cf62e6557c
commit 20bed6e2bb
685 changed files with 17835 additions and 17339 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SampleCode/SampleAttestedTLS/server_tdx/Makefile
+41
View File
@@ -0,0 +1,41 @@
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
include ../sgxenv.mk
all: server
server:
$(CXX) -c -DTDX_ENV -DCLIENT_USE_QVL $(App_Cpp_Flags) server.cpp openssl_server.cpp ../common/verify_callback.cpp ../common/utility.cpp ../common/openssl_utility.cpp ../common/err_msg.cpp
$(CXX) -o tls_server server.o openssl_server.o verify_callback.o utility.o openssl_utility.o err_msg.o $(App_Link_Flags) -lssl -ltdx_tls -lsgx_dcap_quoteverify -l:libtdx_attest.so.1
clean:
rm -f tls_server *.o
SampleCode/SampleAttestedTLS/server_tdx/openssl_server.cpp
+238
View File
@@ -0,0 +1,238 @@
/**
*
* MIT License
*
* Copyright (c) Open Enclave SDK contributors.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE
*
*/
#include <openssl/evp.h>
#include <openssl/ssl.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include "../common/openssl_utility.h"
int set_up_tls_server(char* server_port, bool keep_server_up);
int verify_callback(int preverify_ok, X509_STORE_CTX* ctx);
int create_listener_socket(int port, int& server_socket)
{
int ret = -1;
const int reuse = 1;
struct sockaddr_in addr;
addr.sin_family = AF_INET;
addr.sin_port = htons(port);
addr.sin_addr.s_addr = htonl(INADDR_ANY);
server_socket = socket(AF_INET, SOCK_STREAM, 0);
if (server_socket < 0)
{
PRINT(TLS_SERVER "socket creation failed\n");
goto exit;
}
if (setsockopt(
server_socket,
SOL_SOCKET,
SO_REUSEADDR,
(const void*)&reuse,
sizeof(reuse)) < 0)
{
PRINT(TLS_SERVER "setsocket failed \n");
goto exit;
}
if (bind(server_socket, (struct sockaddr*)&addr, sizeof(addr)) < 0)
{
PRINT(TLS_SERVER "Unable to bind socket to the port\n");
goto exit;
}
if (listen(server_socket, 20) < 0)
{
PRINT(TLS_SERVER "Unable to open socket for listening\n");
goto exit;
}
ret = 0;
exit:
return ret;
}
int handle_communication_until_done(
int& server_socket_fd,
int& client_socket_fd,
SSL_CTX*& ssl_server_ctx,
SSL*& ssl_session,
bool keep_server_up)
{
int ret = -1;
int test_error = 1;
waiting_for_connection_request:
struct sockaddr_in addr;
uint len = sizeof(addr);
// reset ssl_session and client_socket_fd to prepare for the new TLS
// connection
if (client_socket_fd > 0)
{
ret = close(client_socket_fd);
if (ret != 0) {
PRINT(TLS_SERVER "error closing client socket before starting a new TLS session.\n");
goto exit;
}
}
SSL_free(ssl_session);
PRINT(TLS_SERVER " waiting for client connection\n");
client_socket_fd = accept(server_socket_fd, (struct sockaddr*)&addr, &len);
if (client_socket_fd < 0)
{
PRINT(TLS_SERVER "Unable to accept the client request\n");
goto exit;
}
// create a new SSL structure for a connection
if ((ssl_session = SSL_new(ssl_server_ctx)) == nullptr)
{
PRINT(TLS_SERVER
"Unable to create a new SSL connection state object\n");
goto exit;
}
SSL_set_fd(ssl_session, client_socket_fd);
// wait for a TLS/SSL client to initiate a TLS/SSL handshake
PRINT(TLS_SERVER "initiating a passive connect SSL_accept\n");
test_error = SSL_accept(ssl_session);
if (test_error <= 0)
{
PRINT(TLS_SERVER " SSL handshake failed, error(%d)(%d)\n",
test_error, SSL_get_error(ssl_session, test_error));
goto exit;
}
PRINT(TLS_SERVER "<---- Read from client:\n");
if (read_from_session_peer(
ssl_session, CLIENT_PAYLOAD, CLIENT_PAYLOAD_SIZE) != 0)
{
PRINT(TLS_SERVER " Read from client failed\n");
goto exit;
}
PRINT(TLS_SERVER "<---- Write to client:\n");
if (write_to_session_peer(
ssl_session, SERVER_PAYLOAD, strlen(SERVER_PAYLOAD)) != 0)
{
PRINT(TLS_SERVER " Write to client failed\n");
goto exit;
}
if (keep_server_up)
goto waiting_for_connection_request;
ret = 0;
exit:
return ret;
}
int set_up_tls_server(char* server_port, bool keep_server_up)
{
int ret = 0;
int server_socket_fd;
int client_socket_fd = -1;
unsigned int server_port_number;
X509* certificate = nullptr;
EVP_PKEY* pkey = nullptr;
SSL_CONF_CTX* ssl_confctx = SSL_CONF_CTX_new();
SSL_CTX* ssl_server_ctx = nullptr;
SSL* ssl_session = nullptr;
if ((ssl_server_ctx = SSL_CTX_new(TLS_server_method())) == nullptr)
{
PRINT(TLS_SERVER "unable to create a new SSL context\n");
goto exit;
}
if (initalize_ssl_context(ssl_confctx, ssl_server_ctx) != SGX_SUCCESS)
{
PRINT(TLS_SERVER "unable to create a initialize SSL context\n ");
goto exit;
}
SSL_CTX_set_verify(ssl_server_ctx, SSL_VERIFY_PEER, &verify_callback);
if (load_tls_certificates_and_keys(ssl_server_ctx, certificate, pkey) != 0)
{
PRINT(TLS_SERVER
" unable to load certificate and private key on the server\n ");
goto exit;
}
server_port_number = (unsigned int)atoi(server_port); // convert to char* to int
if (create_listener_socket(server_port_number, server_socket_fd) != 0)
{
PRINT(TLS_SERVER " unable to create listener socket on the server\n ");
goto exit;
}
// handle communication
ret = handle_communication_until_done(
server_socket_fd,
client_socket_fd,
ssl_server_ctx,
ssl_session,
keep_server_up);
if (ret != 0)
{
PRINT(TLS_SERVER "server communication error %d\n", ret);
goto exit;
}
exit:
ret = close(client_socket_fd); // close the socket connections
if (ret != 0)
PRINT(TLS_SERVER "error closing client socket\n");
ret = close(server_socket_fd);
if (ret != 0)
PRINT(TLS_SERVER "error closing server socket\n");
if (ssl_session)
{
SSL_shutdown(ssl_session);
SSL_free(ssl_session);
}
if (ssl_server_ctx)
SSL_CTX_free(ssl_server_ctx);
if (ssl_confctx)
SSL_CONF_CTX_free(ssl_confctx);
if (certificate)
X509_free(certificate);
if (pkey)
EVP_PKEY_free(pkey);
return (ret);
}
SampleCode/SampleAttestedTLS/server_tdx/server.cpp
+92
View File
@@ -0,0 +1,92 @@
/**
*
* MIT License
*
* Copyright (c) Open Enclave SDK contributors.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all
* copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
* SOFTWARE
*
*/
#include <stdio.h>
#include <string.h>
#define LOOP_OPTION "-server-in-loop"
int set_up_tls_server(char* server_port, bool keep_server_up);
int main(int argc, const char* argv[])
{
int ret = 1;
char* server_port = NULL;
int keep_server_up = 0; // should be bool type, 0 false, 1 true
/* Check argument count */
if (argc != 2)
{
if (argc == 3)
{
if (strcmp(argv[2], LOOP_OPTION) != 0)
{
goto print_usage;
}
else
{
keep_server_up = 1;
goto read_port;
}
}
print_usage:
printf(
"Usage: %s -port:<port> [%s]\n",
argv[0],
LOOP_OPTION);
return 1;
}
read_port:
// read port parameter
{
char* option = (char*)"-port:";
size_t param_len = 0;
param_len = strlen(option);
if (strncmp(argv[1], option, param_len) == 0)
{
server_port = (char*)(argv[1] + param_len);
}
else
{
fprintf(stderr, "Unknown option %s\n", argv[1]);
goto print_usage;
}
}
printf("server port = %s\n", server_port);
printf("Host: calling setup_tls_server\n");
ret = set_up_tls_server(server_port, keep_server_up);
if (ret != 0)
{
printf("Host: setup_tls_server failed\n");
goto exit;
}
exit:
printf("Host: %s \n", (ret == 0) ? "succeeded" : "failed");
return ret;
}