admin/intel-linux-sgx
1
0
Fork 0
mirror of https://github.com/intel/linux-sgx synced 2026-06-08 14:49:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removes the deprecated Launch Enclave mechanism from the Intel SGX Linux SDK codebase

Browse Source 
Removed reference Launch Enclave implementation and related tools
Removed Launch Enclave service bundle from AESM
Updated build system to remove LE-related compilation flags and targets
Removed LE-related packages from installer scripts

---------

Signed-off-by: Krzysztof1 Wisniewski <krzysztof1.wisniewski@intel.com>
This commit is contained in:
krzyszt1
2026-01-23 07:50:18 +01:00
committed by GitHub
parent 1aa2bf8de6
commit 590856d0c7
98 changed files with 37 additions and 5084 deletions
Download Patch File Download Diff File Expand all files Collapse all files
License.txt
+1 -1
View File
@@ -37,7 +37,7 @@ http://www.eclipse.org/legal/epl-v10.html
==============================================================
libsgx_le.signed.so, libsgx_pce.signed.so, libsgx_pse_pr.signed.so, libsgx_pse_pr_2.signed.so and libsgx_pse_op.signed.so are licensed under 3-Clause BSD License.
libsgx_pce.signed.so is licensed under 3-Clause BSD License.
===========================================================================================================================================================
Makefile
-49
View File
@@ -203,10 +203,6 @@ deb_libsgx_pce_logic: psw
deb_sgx_aesm_service: psw deb_libsgx_pce_logic
./linux/installer/deb/sgx-aesm-service/build.sh
.PHONY: deb_libsgx_launch
deb_libsgx_launch: psw
./linux/installer/deb/libsgx-launch/build.sh
.PHONY: deb_libsgx_quote_ex
deb_libsgx_quote_ex: psw
./linux/installer/deb/libsgx-quote-ex/build.sh
@@ -227,23 +223,6 @@ deb_libsgx_urts: psw
deb_libsgx_headers_pkg:
./linux/installer/deb/libsgx-headers/build.sh
ifeq ($(CC_BELOW_5_2), 1)
.PHONY: deb_psw_pkg
deb_psw_pkg: deb_libsgx_headers_pkg \
deb_libsgx_qe3_logic \
deb_libsgx_pce_logic \
deb_sgx_aesm_service \
deb_libsgx_launch \
deb_libsgx_quote_ex \
deb_libsgx_uae_service \
deb_libsgx_enclave_common \
deb_libsgx_urts \
deb_libsgx_ae_qe3 \
deb_libsgx_ae_tdqe \
deb_libsgx_ae_id_enclave \
deb_libsgx_tdx_logic \
deb_tdx_qgs deb_tdx_attest
else
.PHONY: deb_libsgx_dcap_default_qpl
deb_libsgx_dcap_default_qpl:
$(MAKE) -C external/dcap_source/QuoteGeneration deb_sgx_dcap_default_qpl_pkg
@@ -303,7 +282,6 @@ deb_psw_pkg: deb_libsgx_headers_pkg \
deb_libsgx_qe3_logic \
deb_libsgx_pce_logic \
deb_sgx_aesm_service \
deb_libsgx_launch \
deb_libsgx_quote_ex \
deb_libsgx_uae_service \
deb_libsgx_enclave_common \
@@ -324,7 +302,6 @@ deb_psw_pkg: deb_libsgx_headers_pkg \
deb_tdx_attest \
deb_tee_appraisal_tool \
deb_pcs_client_tool
endif
.PHONY: deb_local_repo
deb_local_repo: deb_psw_pkg
@@ -383,10 +360,6 @@ rpm_libsgx_qe3_logic: psw
rpm_sgx_aesm_service: psw
./linux/installer/rpm/sgx-aesm-service/build.sh
.PHONY: rpm_libsgx_launch
rpm_libsgx_launch: psw
./linux/installer/rpm/libsgx-launch/build.sh
.PHONY: rpm_libsgx_quote_ex
rpm_libsgx_quote_ex: psw
./linux/installer/rpm/libsgx-quote-ex/build.sh
@@ -411,24 +384,6 @@ rpm_sdk_pkg: sdk
rpm_libsgx_headers_pkg:
./linux/installer/rpm/libsgx-headers/build.sh
ifeq ($(CC_BELOW_5_2), 1)
.PHONY: rpm_psw_pkg
rpm_psw_pkg: rpm_libsgx_headers_pkg \
rpm_libsgx_pce_logic \
rpm_libsgx_qe3_logic \
rpm_sgx_aesm_service \
rpm_libsgx_launch \
rpm_libsgx_quote_ex \
rpm_libsgx_uae_service \
rpm_libsgx_enclave_common \
rpm_libsgx_urts \
rpm_libsgx_ae_qe3 \
rpm_libsgx_ae_tdqe \
rpm_libsgx_ae_id_enclave \
rpm_libsgx_tdx_logic \
rpm_tdx_qgs \
rpm_tdx_attest
else
.PHONY: rpm_libsgx_dcap_default_qpl
rpm_libsgx_dcap_default_qpl:
$(MAKE) -C external/dcap_source/QuoteGeneration rpm_sgx_dcap_default_qpl_pkg
@@ -488,7 +443,6 @@ rpm_psw_pkg: rpm_libsgx_headers_pkg \
rpm_libsgx_pce_logic \
rpm_libsgx_qe3_logic \
rpm_sgx_aesm_service \
rpm_libsgx_launch \
rpm_libsgx_quote_ex \
rpm_libsgx_uae_service \
rpm_libsgx_enclave_common \
@@ -509,7 +463,6 @@ rpm_psw_pkg: rpm_libsgx_headers_pkg \
rpm_tdx_attest \
rpm_tee_appraisal_tool \
rpm_pcs_client_tool
endif
.PHONY: rpm_local_repo
rpm_local_repo: rpm_psw_pkg
@@ -522,7 +475,6 @@ clean:
@$(RM) -r linux/installer/bin/install-sgx-*.bin*.withLicense
@$(RM) -r linux/installer/bin/sgx_linux*.bin
./linux/installer/deb/sgx-aesm-service/clean.sh
./linux/installer/deb/libsgx-launch/clean.sh
./linux/installer/deb/libsgx-quote-ex/clean.sh
./linux/installer/deb/libsgx-uae-service/clean.sh
./linux/installer/deb/libsgx-enclave-common/clean.sh
@@ -530,7 +482,6 @@ clean:
./linux/installer/deb/libsgx-headers/clean.sh
./linux/installer/common/local_repo_builder/local_repo_builder.sh debian clean
./linux/installer/rpm/sgx-aesm-service/clean.sh
./linux/installer/rpm/libsgx-launch/clean.sh
./linux/installer/rpm/libsgx-quote-ex/clean.sh
./linux/installer/rpm/libsgx-uae-service/clean.sh
./linux/installer/rpm/libsgx-enclave-common/clean.sh
README.md
+3 -6
View File
@@ -45,9 +45,6 @@ The [intel-device-plugins-for-kubernetes](https://github.com/intel/intel-device-
The [intel-sgx-ssl](https://github.com/intel/intel-sgx-ssl) project provides a full-strength general purpose cryptography library for Intel(R) SGX enclave applications. It is based on the underlying OpenSSL* Open Source project. Intel(R) SGX provides a build combination to build out a SGXSSL based SDK as [below](#build-the-intelr-sgx-sdk-and-intelr-sgx-sdk-installer). Users could also utilize this cryptography library in SGX enclave applications seperately.
This repository provides a reference implementation of a Launch Enclave for 'Flexible Launch Control' under [psw/ae/ref_le](psw/ae/ref_le). The reference LE implementation can be used as a basis for enforcing different launch control policy by the platform developer or owner. To build and try it by yourself, please refer to the [ref_le.md](psw/ae/ref_le/ref_le.md) for details.
**NOTE**: The reference LE is only workable with [linux-sgx-driver](https://github.com/intel/linux-sgx-driver) and is planned to be deprecated starting from Intel(R) SGX release 2.20.
License
-------
See [License.txt](License.txt) for details.
@@ -248,7 +245,7 @@ You can find the tools and libraries generated in the `build/linux` directory.
```
$ make deb_psw_pkg
```
You can find the generated Intel(R) SGX PSW installers located under `linux/installer/deb/libsgx-urts`, `linux/installer/deb/libsgx-enclave-common`, `linux/installer/deb/libsgx-uae-service`, `linux/installer/deb/libsgx-launch`, `linux/installer/deb/libsgx-quote-ex` and `linux/installer/deb/sgx-aesm-service` respectively.
You can find the generated Intel(R) SGX PSW installers located under `linux/installer/deb/libsgx-urts`, `linux/installer/deb/libsgx-enclave-common`, `linux/installer/deb/libsgx-uae-service`, `linux/installer/deb/libsgx-quote-ex` and `linux/installer/deb/sgx-aesm-service` respectively.
**Note**: Besides the Intel(R) SGX PSW installer, the above command generates another debug symbol package named ``package-name-dbgsym_${version}-${revision}_amd64.ddeb`` for debug purpose.
**Note**: Starting with the 2.10 release, besides the Intel(R) SGX PSW installer, the above command generates [SGXDataCenterAttestationPrimitives](https://github.com/intel/SGXDataCenterAttestationPrimitives/) installers as well.
@@ -261,7 +258,7 @@ You can find the tools and libraries generated in the `build/linux` directory.
```
$ make rpm_psw_pkg
```
You can find the generated Intel(R) SGX PSW installers located under `linux/installer/rpm/libsgx-urts`, `linux/installer/rpm/libsgx-enclave-common`, `linux/installer/rpm/libsgx-uae-service`, `linux/installer/rpm/libsgx-launch`, `linux/installer/rpm/libsgx-quote-ex` and `linux/installer/rpm/sgx-aesm-service` respectively.
You can find the generated Intel(R) SGX PSW installers located under `linux/installer/rpm/libsgx-urts`, `linux/installer/rpm/libsgx-enclave-common`, `linux/installer/rpm/libsgx-uae-service`, `linux/installer/rpm/libsgx-quote-ex` and `linux/installer/rpm/sgx-aesm-service` respectively.
**Note**: The above command builds the Intel(R) SGX PSW with default configuration firstly and then generates the target PSW Installer. To build the Intel(R) SGX PSW Installer with debug information kept in the tools and libraries, enter the following command:
```
@@ -469,7 +466,7 @@ The SGX PSW provides 3 services: launch, EPID-based attestation, and algorithm a
| |Ubuntu 22.04, Ubuntu 24.04, Debian 10 and Debian 12|Red Hat Enterprise Linux 9.4, CentOS Stream 9, Anolis OS 8.10, and Azure Linux 3.0| SUSE Linux Enterprise Server 15|
| ------------ | ------------ | ------------ | ------------ |
|launch service |apt-get install libsgx-launch libsgx-urts|yum install libsgx-launch libsgx-urts|zypper install libsgx-launch libsgx-urts|
|launch service |apt-get install libsgx-urts|yum install libsgx-urts|zypper install libsgx-urts|
|algorithm agnostic attestation service|apt-get install libsgx-quote-ex libsgx-urts|yum install libsgx-quote-ex libsgx-urts|zypper install libsgx-quote-ex libsgx-urts|
|DCAP ECDSA-based service |apt-get install libsgx-dcap-ql|yum install libsgx-dcap-ql|zypper install libsgx-dcap-ql|
SampleCode/LocalAttestation/EnclaveInitiator/Makefile
+1 -7
View File
@@ -84,13 +84,7 @@ SGX_COMMON_CXXFLAGS := $(SGX_COMMON_FLAGS) -Wnon-virtual-dtor -std=c++11
Enclave_Include_Paths := -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx -I../Include
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_C_Flags += -fstack-protector
else
Enclave_C_Flags += -fstack-protector-strong
endif
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong
Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++
ifeq ($(LAv2), 1)
SampleCode/LocalAttestation/EnclaveResponder/Makefile
+1 -7
View File
@@ -84,13 +84,7 @@ SGX_COMMON_CXXFLAGS := $(SGX_COMMON_FLAGS) -Wnon-virtual-dtor -std=c++11
Enclave_Include_Paths := -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx -I../Include
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_C_Flags += -fstack-protector
else
Enclave_C_Flags += -fstack-protector-strong
endif
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong
Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++
Enclave_Cpp_Files := $(wildcard *.cpp)
SampleCode/PowerTransition/Makefile
+1 -7
View File
@@ -123,13 +123,7 @@ Enclave_Cpp_Files := $(wildcard Enclave/*.cpp)
Enclave_Include_Paths := -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx -I./Common
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_Compile_CFlags := -fstack-protector
else
Enclave_Compile_CFlags := -fstack-protector-strong
endif
Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths)
Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong $(Enclave_Include_Paths)
Enclave_Compile_CXXFlags := -nostdinc++ $(Enclave_Compile_CFlags)
# Enable the security flags
linux/installer/deb/libsgx-launch/libsgx-launch-1.0/debian/docs → SampleCode/RemoteAttestation/Makefile
View File
SampleCode/SampleAEXNotify/Makefile
+1 -8
View File
@@ -117,14 +117,7 @@ Crypto_Library_Name := sgx_tcrypto
Enclave_Cpp_Files := Enclave/Enclave.cpp
Enclave_Include_Paths := -IInclude -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(MITIGATION_CFLAGS)
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_C_Flags += -fstack-protector
else
Enclave_C_Flags += -fstack-protector-strong
endif
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong $(MITIGATION_CFLAGS)
Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++
# Enable the security flags
SampleCode/SampleAttestedTLS/sgxenv.mk
+2 -8
View File
@@ -116,14 +116,8 @@ Enclave_Include_Paths := -IInclude -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/i
Enclave_Include_Paths += -I$(SGXSSL_PKG_PATH)/include
Enclave_Include_Paths += -I$(SOCKET_DIR)/include
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_C_Flags := $(SGX_COMMON_CFLAGS) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector
else
Enclave_C_Flags := $(SGX_COMMON_CFLAGS) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong
endif
Enclave_C_Flags += $(Enclave_Include_Paths)
Enclave_C_Flags := $(SGX_COMMON_CFLAGS) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong
Enclave_C_Flags += $(Enclave_Include_Paths)
Enclave_Cpp_Flags := $(Enclave_C_Flags) -std=c++11 -nostdinc++
SgxSSL_Link_Libraries := -L$(SGXSSL_PKG_PATH)/lib64 -Wl,--whole-archive -l$(SGXSSL_Library_Name) -Wl,--no-whole-archive \
SampleCode/SampleDNNL/Makefile
+1 -7
View File
@@ -119,13 +119,7 @@ Enclave_Include_Paths := -I$(SGX_SDK)/include
Enclave_Include_Paths += -I$(SGX_SDK)/include/tlibc
Enclave_Include_Paths += -I$(SGX_SDK)/include/libcxx
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_Compile_CFlags := -fstack-protector
else
Enclave_Compile_CFlags := -fstack-protector-strong
endif
Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths) -fomit-frame-pointer -fno-builtin-printf
Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths) -fomit-frame-pointer -fno-builtin-printf -fstack-protector-strong
Enclave_Compile_CXXFlags := -nostdinc++ $(Enclave_Compile_CFlags) -fomit-frame-pointer
# Enable the security flags
SampleCode/SampleEnclave/Makefile
+1 -8
View File
@@ -122,14 +122,7 @@ Enclave_Cpp_Files := Enclave/Enclave.cpp $(wildcard Enclave/Edger8rSyntax/*.cpp)
Enclave_Include_Paths := -IInclude -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(MITIGATION_CFLAGS)
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_C_Flags += -fstack-protector
else
Enclave_C_Flags += -fstack-protector-strong
endif
Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++
Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++ -fstack-protector-strong
# Enable the security flags
Enclave_Security_Link_Flags := -Wl,-z,relro,-z,now,-z,noexecstack
SampleCode/SampleEnclaveGMIPP/Makefile
+1 -7
View File
@@ -121,13 +121,7 @@ Crypto_Library_Name := sgx_tcrypto
Enclave_Cpp_Files := Enclave/Enclave.cpp
Enclave_Include_Paths := -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx -I$(SGX_SDK)/include/ipp
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(MITIGATION_CFLAGS)
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_C_Flags += -fstack-protector
else
Enclave_C_Flags += -fstack-protector-strong
endif
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong $(MITIGATION_CFLAGS)
Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++
SampleCode/SampleEnclavePCL/Makefile
+1 -7
View File
@@ -131,13 +131,7 @@ Crypto_Library_Name := sgx_tcrypto
Enclave_Cpp_Files := Enclave/Enclave.cpp $(wildcard Enclave/Edger8rSyntax/*.cpp) $(wildcard Enclave/TrustedLibrary/*.cpp)
Enclave_Include_Paths := -IInclude -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector
else
Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong
endif
Enclave_C_Flags := -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections -fstack-protector-strong
Enclave_C_Flags += $(Enclave_Include_Paths)
Enclave_Cpp_Flags := $(Enclave_C_Flags) $(SGX_COMMON_CXXFLAGS) -nostdinc++
Enclave_C_Flags += $(SGX_COMMON_CFLAGS)
SampleCode/SealUnseal/Makefile
+1 -7
View File
@@ -123,13 +123,7 @@ endif
Crypto_Library_Name := sgx_tcrypto
Enclave_Include_Paths := -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_Compile_CFlags := -fstack-protector
else
Enclave_Compile_CFlags := -fstack-protector-strong
endif
Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths)
Enclave_Compile_CFlags += -nostdinc -ffreestanding -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(Enclave_Include_Paths) -fstack-protector-strong
Enclave_Compile_CXXFlags := -nostdinc++ -std=c++11 $(Enclave_Compile_CFlags)
# Enable the security flags
buildenv.mk
+1 -16
View File
@@ -107,16 +107,9 @@ CUR_DIR := $(realpath $(call parent-dir,$(lastword $(wordlist 2,$(words $(MAKEFI
CC_VERSION := $(shell $(CC) -dumpversion)
CC_VERSION_MAJOR := $(shell echo $(CC_VERSION) | cut -f1 -d.)
CC_VERSION_MINOR := $(shell echo $(CC_VERSION) | cut -f2 -d.)
CC_BELOW_4_9 := $(shell [ $(CC_VERSION_MAJOR) -lt 4 -o \( $(CC_VERSION_MAJOR) -eq 4 -a $(CC_VERSION_MINOR) -le 9 \) ] && echo 1)
CC_BELOW_5_2 := $(shell [ $(CC_VERSION_MAJOR) -lt 5 -o \( $(CC_VERSION_MAJOR) -eq 5 -a $(CC_VERSION_MINOR) -le 2 \) ] && echo 1)
CC_NO_LESS_THAN_8 := $(shell expr $(CC_VERSION) \>\= "8")
# turn on stack protector for SDK
ifeq ($(CC_BELOW_4_9), 1)
COMMON_FLAGS += -fstack-protector
else
COMMON_FLAGS += -fstack-protector-strong
endif
COMMON_FLAGS += -fstack-protector-strong
ifdef DEBUG
COMMON_FLAGS += -O0 -ggdb -DDEBUG -UNDEBUG
@@ -129,14 +122,6 @@ ifdef SE_SIM
COMMON_FLAGS += -DSE_SIM
endif
# Disable ref-LE build by default.
# Users could enable the ref-LE build
# by explicitly specifying 'BUILD_REF_LE=1'
BUILD_REF_LE ?= 0
ifeq ($(BUILD_REF_LE), 1)
COMMON_FLAGS += -DREF_LE
endif
ifdef SERVTD_ATTEST
COMMON_FLAGS += -DSERVTD_ATTEST
endif
docker/build/Dockerfile
+1 -1
View File
@@ -100,7 +100,7 @@ WORKDIR /deb_local_repo
COPY --from=builder /linux-sgx/linux/installer/deb/sgx_debian_local_repo/ ./
RUN echo "deb [trusted=yes arch=amd64] file:///deb_local_repo jammy main">>/etc/apt/sources.list
RUN apt-get update
RUN apt-get install -y libsgx-aesm-launch-plugin libsgx-aesm-quote-ex-plugin
RUN apt-get install -y libsgx-aesm-quote-ex-plugin
WORKDIR /opt/intel/sgx-aesm-service/aesm/
ENV LD_LIBRARY_PATH=.
external/sgx-emm/api_tests/Makefile
Vendored
+1 -8
View File
@@ -121,14 +121,7 @@ Crypto_Library_Name := sgx_tcrypto
Enclave_Cpp_Files := Enclave/Enclave.cpp
Enclave_Include_Paths := -IEnclave -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/libcxx
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(MITIGATION_CFLAGS)
CC_BELOW_4_9 := $(shell expr "`$(CC) -dumpversion`" \< "4.9")
ifeq ($(CC_BELOW_4_9), 1)
Enclave_C_Flags += -fstack-protector
else
Enclave_C_Flags += -fstack-protector-strong
endif
Enclave_C_Flags := $(Enclave_Include_Paths) -nostdinc -fvisibility=hidden -fpie -ffunction-sections -fdata-sections $(MITIGATION_CFLAGS) -fstack-protector-strong
Enclave_Cpp_Flags := $(Enclave_C_Flags) -nostdinc++
# Enable the security flags
linux/installer/common/libsgx-launch/BOMs/libsgx-launch-dev.txt
-2
View File
@@ -1,2 +0,0 @@
DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/common/inc/sgx_uae_launch.h <installdir>/include/sgx_uae_launch.h 0 main STP
linux/installer/common/libsgx-launch/BOMs/libsgx-launch-package.txt
-3
View File
@@ -1,3 +0,0 @@
DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/linux/installer/common/libsgx-launch/installConfig <installdir>/installConfig 0 main STP
<deliverydir>/linux/installer/common/libsgx-launch/Makefile <installdir>/Makefile 0 main STP
linux/installer/common/libsgx-launch/BOMs/libsgx-launch.txt
-2
View File
@@ -1,2 +0,0 @@
DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/build/linux/libsgx_launch.so <installdir>/lib/libsgx_launch.so 0 main STP
linux/installer/common/libsgx-launch/Makefile
-60
View File
@@ -1,60 +0,0 @@
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
include installConfig
PACKAGE_ROOT_FOLDER=pkgroot
PACKAGES=$(notdir $(wildcard $(PACKAGE_ROOT_FOLDER)/*))
USR_LIB_PATH=/usr/$(notdir $(shell gcc -print-multi-os-directory))/$(shell dpkg-architecture -qDEB_HOST_MULTIARCH 2> /dev/null)
USR_INC_PATH=/usr/$(INC_DIR)
LAUNCH_VER=1.0.0
SPLIT_VERSION=$(word $2,$(subst ., ,$1))
default:
install: $(PACKAGES)
cd $(shell readlink -m $(DESTDIR)/$(LAUNCH_PACKAGE_NAME)/$(USR_LIB_PATH)) && \
mv libsgx_launch.so libsgx_launch.so.$(LAUNCH_VER) && \
ln -fs libsgx_launch.so.$(LAUNCH_VER) libsgx_launch.so.$(call SPLIT_VERSION,$(LAUNCH_VER),1)
cd $(shell readlink -m $(DESTDIR)/$(LAUNCH_DEV_PACKAGE_NAME)/$(USR_LIB_PATH)) && \
ln -fs libsgx_launch.so.$(call SPLIT_VERSION,$(LAUNCH_VER),1) libsgx_launch.so
$(PACKAGES):
install -d $(shell readlink -m $(DESTDIR)/$@)
$(if $(wildcard $(PACKAGE_ROOT_FOLDER)/$@/$(LIB_DIR)/.*), \
install -d $(shell readlink -m $(DESTDIR)/$@/$(USR_LIB_PATH)) && \
mv $(PACKAGE_ROOT_FOLDER)/$@/$(LIB_DIR)/*.so $(DESTDIR)/$@/$(USR_LIB_PATH))
$(if $(wildcard $(PACKAGE_ROOT_FOLDER)/$@/$(INC_DIR)/.*), \
install -d $(shell readlink -m $(DESTDIR)/$@/$(USR_INC_PATH)) && \
install -d $(shell readlink -m $(DESTDIR)/$@/$(USR_LIB_PATH)) && \
mv $(PACKAGE_ROOT_FOLDER)/$@/$(INC_DIR)/* $(DESTDIR)/$@/$(USR_INC_PATH))
linux/installer/common/libsgx-launch/createTarball.sh
-63
View File
@@ -1,63 +0,0 @@
#!/usr/bin/env bash
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
set -e
SCRIPT_DIR=$(dirname "$0")
ROOT_DIR="${SCRIPT_DIR}/../../../../"
LINUX_INSTALLER_DIR="${ROOT_DIR}/linux/installer"
LINUX_INSTALLER_COMMON_DIR="${LINUX_INSTALLER_DIR}/common"
INSTALL_PATH=${SCRIPT_DIR}/output
# Cleanup
rm -fr ${INSTALL_PATH}
# Get the configuration for this package
source ${SCRIPT_DIR}/installConfig
# Fetch the gen_source script
cp ${LINUX_INSTALLER_COMMON_DIR}/gen_source/gen_source.py ${SCRIPT_DIR}
# Copy the files according to the BOM
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/libsgx-launch.txt --installdir=pkgroot/libsgx-launch
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/libsgx-launch-dev.txt --cleanup=false --installdir=pkgroot/libsgx-launch-dev
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/libsgx-launch-package.txt --cleanup=false
python ${SCRIPT_DIR}/gen_source.py --bom=../licenses/BOM_license.txt --cleanup=false
# Create the tarball
LAUNCH_VER=$(awk '/LAUNCH_VERSION/ {print $3}' ${ROOT_DIR}/common/inc/internal/se_version.h|sed 's/^\"\(.*\)\"$/\1/')
pushd ${INSTALL_PATH} &> /dev/null
sed -i "s/\(LAUNCH_VER=\).*/\1${LAUNCH_VER}/" Makefile
tar -zcvf ${TARBALL_NAME} *
popd &> /dev/null
linux/installer/common/libsgx-launch/installConfig
-8
View File
@@ -1,8 +0,0 @@
LAUNCH_VERSION="1.0"
TARBALL_NAME=libsgx-launch_1.0.orig.tar.gz
LAUNCH_PACKAGE_NAME=libsgx-launch
LAUNCH_DEV_PACKAGE_NAME=libsgx-launch-dev
LIB_DIR=lib
INC_DIR=include
linux/installer/common/psw-dcap/BOM_install/libsgx-ae-le.txt
-3
View File
@@ -1,3 +0,0 @@
DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/build/linux/libsgx_le.signed.so <installdir>/aesm/libsgx_le.signed.so 0 main STP
<deliverydir>/build/linux/le_prod_css.bin <installdir>/aesm/le_prod_css.bin 0 main STP
linux/installer/common/psw-dcap/BOM_install/libsgx-aesm-launch-plugin.txt
-3
View File
@@ -1,3 +0,0 @@
DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/build/linux/bundles/lible_launch_service_bundle.so <installdir>/aesm/bundles/lible_launch_service_bundle.so 0 main STP
<deliverydir>/psw/ae/aesm_service/data/white_list_cert_to_be_verify.bin <installdir>/aesm/data/white_list_cert_to_be_verify.bin 0 main STP
linux/installer/common/psw-dcap/BOM_install/libsgx-launch-devel.txt
-2
View File
@@ -1,2 +0,0 @@
DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/common/inc/sgx_uae_launch.h <installdir>/include/sgx_uae_launch.h 0 main STP
linux/installer/common/psw-dcap/BOM_install/libsgx-launch.txt
-2
View File
@@ -1,2 +0,0 @@
DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/build/linux/libsgx_launch.so <installdir>/lib/libsgx_launch.so 0 main STP
linux/installer/common/psw-dcap/Makefile
+1 -14
View File
@@ -146,21 +146,17 @@ endef
AESM_SERVICE_PKGS:= $(AESM_PCE_PACKAGE) \
$(AESM_ECDSA_PACKAGE) \
$(AESM_LAUNCH_PACKAGE) \
$(AESM_QUOTE_EX_PACKAGE) \
$(AESM_SERVICE_PACKAGE) \
$(QE3_LOGIC_PACKAGE) \
$(PCE_LOGIC_PACKAGE)
AE_PKGS:= $(AE_IDE_PACKAGE) \
$(AE_LE_PACKAGE) \
$(AE_PCE_PACKAGE) \
$(AE_QE3_PACKAGE) \
$(AE_QVE_PACKAGE)
DEV_LIB_PKGS:= $(LAUNCH_PACKAGE) \
$(LAUNCH_DEV_PACKAGE) \
$(QUOTE_EX_PACKAGE) \
DEV_LIB_PKGS:= $(QUOTE_EX_PACKAGE) \
$(QUOTE_EX_DEV_PACKAGE) \
$(ENCLAVE_COMMON_PACKAGE) \
$(ENCLAVE_COMMON_DEV_PACKAGE) \
@@ -247,10 +243,6 @@ install_$(PCK_ID_RETRIEVAL_TOOL_PACKAGE): pre_$(PCK_ID_RETRIEVAL_TOOL_PACKAGE) |
PHONY+=install_ae
install_ae: $(foreach PKG,$(AE_PKGS),post_$(PKG))
cd $(shell readlink -m $(DESTDIR)/$(AE_LE_PACKAGE)/$(SGX_INSTALL_PATH)/$(AESM_SERVICE_PACKAGE)/aesm) && \
mv libsgx_le.signed.so libsgx_le.signed.so.$(LE_FULL_VER) && \
ln -fs libsgx_le.signed.so.$(LE_FULL_VER) libsgx_le.signed.so.$(LE_MAJOR_VER) && \
ln -fs libsgx_le.signed.so.$(LE_MAJOR_VER) libsgx_le.signed.so
cd $(shell readlink -m $(DESTDIR)/$(AE_PCE_PACKAGE)/$(USR_LIB_PATH)) && \
mv libsgx_pce.signed.so libsgx_pce.signed.so.$(PCE_FULL_VER) && \
ln -fs libsgx_pce.signed.so.$(PCE_FULL_VER) libsgx_pce.signed.so.$(PCE_MAJOR_VER) && \
@@ -274,11 +266,6 @@ install_ae: $(foreach PKG,$(AE_PKGS),post_$(PKG))
PHONY+=install_dev_lib
install_dev_lib: $(foreach PKG,$(DEV_LIB_PKGS),post_$(PKG))
rm -fr $(shell readlink -m $(DESTDIR)/$(SGX_HEADERS_PACKAGE)/$(USR_LIB_PATH))
cd $(shell readlink -m $(DESTDIR)/$(LAUNCH_PACKAGE)/$(USR_LIB_PATH)) && \
mv libsgx_launch.so libsgx_launch.so.$(LAUNCH_FULL_VER) && \
ln -fs libsgx_launch.so.$(LAUNCH_FULL_VER) libsgx_launch.so.$(LAUNCH_MAJOR_VER)
cd $(shell readlink -m $(DESTDIR)/$(LAUNCH_DEV_PACKAGE)/$(USR_LIB_PATH)) && \
ln -fs libsgx_launch.so.$(LAUNCH_MAJOR_VER) libsgx_launch.so
cd $(shell readlink -m $(DESTDIR)/$(QUOTE_EX_PACKAGE)/$(USR_LIB_PATH)) && \
mv libsgx_quote_ex.so libsgx_quote_ex.so.$(QUOTE_EX_FULL_VER) && \
ln -fs libsgx_quote_ex.so.$(QUOTE_EX_FULL_VER) libsgx_quote_ex.so.$(QUOTE_EX_MAJOR_VER)
linux/installer/common/psw-dcap/installConfig
-4
View File
@@ -2,15 +2,11 @@ SGX_HEADERS_PACKAGE=libsgx-headers
URTS_PACKAGE=libsgx-urts
ENCLAVE_COMMON_PACKAGE=libsgx-enclave-common
ENCLAVE_COMMON_DEV_PACKAGE=libsgx-enclave-common-devel
LAUNCH_PACKAGE=libsgx-launch
LAUNCH_DEV_PACKAGE=libsgx-launch-devel
QUOTE_EX_PACKAGE=libsgx-quote-ex
QUOTE_EX_DEV_PACKAGE=libsgx-quote-ex-devel
UAE_SERVICE_PACKAGE=libsgx-uae-service
AE_LE_PACKAGE=libsgx-ae-le
AE_PCE_PACKAGE=libsgx-ae-pce
AESM_ECDSA_PACKAGE=libsgx-aesm-ecdsa-plugin
AESM_LAUNCH_PACKAGE=libsgx-aesm-launch-plugin
AESM_PCE_PACKAGE=libsgx-aesm-pce-plugin
AESM_QUOTE_EX_PACKAGE=libsgx-aesm-quote-ex-plugin
AESM_SERVICE_PACKAGE=sgx-aesm-service
linux/installer/common/psw/BOMs/psw_base.txt
-4
View File
@@ -11,20 +11,16 @@ DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/build/linux/libCppMicroServices.so.4.0.0 <installdir>/package/aesm/libCppMicroServices.so.4.0.0 0 main STP
<deliverydir>/external/dcap_source/QuoteGeneration/build/linux/libsgx_pce_logic.so <installdir>/package/aesm/libsgx_pce_logic.so.1 0 main STP
<deliverydir>/external/dcap_source/QuoteGeneration/build/linux/libsgx_qe3_logic.so <installdir>/package/aesm/libsgx_qe3_logic.so.1 0 main STP
<deliverydir>/build/linux/bundles/lible_launch_service_bundle.so <installdir>/package/aesm/bundles/lible_launch_service_bundle.so 0 main STP
<deliverydir>/build/linux/bundles/liblinux_network_service_bundle.so <installdir>/package/aesm/bundles/liblinux_network_service_bundle.so 0 main STP
<deliverydir>/build/linux/bundles/libpce_service_bundle.so <installdir>/package/aesm/bundles/libpce_service_bundle.so 0 main STP
<deliverydir>/build/linux/bundles/libecdsa_quote_service_bundle.so <installdir>/package/aesm/bundles/libecdsa_quote_service_bundle.so 0 main STP
<deliverydir>/build/linux/bundles/libquote_ex_service_bundle.so <installdir>/package/aesm/bundles/libquote_ex_service_bundle.so 0 main STP
<deliverydir>/build/linux/le_prod_css.bin <installdir>/package/aesm/le_prod_css.bin 0 main STP
<deliverydir>/build/linux/libsgx_le.signed.so <installdir>/package/aesm/libsgx_le.signed.so.1 0 main STP
<deliverydir>/build/linux/libsgx_pce.signed.so <installdir>/package/aesm/libsgx_pce.signed.so.1 0 main STP
<deliverydir>/external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/libsgx_qe3.signed.so <installdir>/package/aesm/libsgx_qe3.signed.so.1 0 main STP
<deliverydir>/external/dcap_source/QuoteGeneration/psw/ae/data/prebuilt/libsgx_id_enclave.signed.so <installdir>/package/aesm/libsgx_id_enclave.signed.so.1 0 main STP
<deliverydir>/linux/installer/common/psw/install.sh <installdir>/scripts/install.sh 0 main STP
<deliverydir>/linux/installer/common/psw/Makefile <installdir>/Makefile 0 main STP
<deliverydir>/psw/ae/aesm_service/config/network/aesmd.conf <installdir>/package/aesm/conf/aesmd.conf 0 main STP
<deliverydir>/psw/ae/aesm_service/data/white_list_cert_to_be_verify.bin <installdir>/package/aesm/data/white_list_cert_to_be_verify.bin 0 main STP
<deliverydir>/linux/installer/common/libsgx-enclave-common/remount-dev-exec.service <installdir>/package/remount-dev-exec.service 0 main STP
<deliverydir>/linux/installer/common/libsgx-enclave-common/91-sgx-enclave.rules <installdir>/package/udev/rules.d/91-sgx-enclave.rules 0 main STP
<deliverydir>/linux/installer/common/sgx-aesm-service/92-sgx-provision.rules <installdir>/package/udev/rules.d/92-sgx-provision.rules 0 main STP
linux/installer/common/psw/install.sh
-5
View File
@@ -41,7 +41,6 @@ AESM_PATH=$PSW_DST_PATH/aesm
# Install the AESM service
mkdir -p /var/opt/aesmd
cp -rf $AESM_PATH/data /var/opt/aesmd/
rm -rf $AESM_PATH/data
cp -rf $AESM_PATH/conf/aesmd.conf /etc/aesmd.conf
rm -rf $AESM_PATH/conf
@@ -185,14 +184,10 @@ rm -fr /var/run/aesmd
rm -f /usr/{lib,lib64}/libsgx_uae_service.so
rm -f /usr/{lib,lib64}/libsgx_urts.so
rm -f /usr/{lib,lib64}/libsgx_enclave_common.so*
rm -f /usr/{lib,lib64}/libsgx_epid.so*
rm -f /usr/{lib,lib64}/libsgx_launch.so*
rm -f /usr/{lib,lib64}/libsgx_quote_ex.so*
rm -f /usr/lib/i386-linux-gnu/libsgx_uae_service.so
rm -f /usr/lib/i386-linux-gnu/libsgx_urts.so
rm -f /usr/lib/i386-linux-gnu/libsgx_enclave_common.so*
rm -f /usr/lib/i386-linux-gnu/libsgx_epid.so*
rm -f /usr/lib/i386-linux-gnu/libsgx_launch.so*
rm -f /usr/lib/i386-linux-gnu/libsgx_quote_ex.so*
# Removing the assistance scripts
linux/installer/common/sgx-aesm-service/BOMs/libsgx-ae-le.txt
-3
View File
@@ -1,3 +0,0 @@
DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/build/linux/libsgx_le.signed.so <installdir>/aesm/libsgx_le.signed.so 0 main STP
<deliverydir>/build/linux/le_prod_css.bin <installdir>/aesm/le_prod_css.bin 0 main STP
linux/installer/common/sgx-aesm-service/BOMs/libsgx-aesm-launch-plugin.txt
-3
View File
@@ -1,3 +0,0 @@
DeliveryName InstallName FileCheckSum FileFeature FileOwner
<deliverydir>/build/linux/bundles/lible_launch_service_bundle.so <installdir>/aesm/bundles/lible_launch_service_bundle.so 0 main STP
<deliverydir>/psw/ae/aesm_service/data/white_list_cert_to_be_verify.bin <installdir>/aesm/data/white_list_cert_to_be_verify.bin 0 main STP
linux/installer/common/sgx-aesm-service/Makefile
-4
View File
@@ -82,10 +82,6 @@ install: $(PACKAGES)
mv libsgx_pce.signed.so libsgx_pce.signed.so.$(PCE_VER) && \
ln -fs libsgx_pce.signed.so.$(PCE_VER) libsgx_pce.signed.so.$(call SPLIT_VERSION,$(PCE_VER),1) && \
ln -fs libsgx_pce.signed.so.$(call SPLIT_VERSION,$(PCE_VER),1) libsgx_pce.signed.so
cd $(shell readlink -m $(DESTDIR)/$(AE_LE_PACKAGE_NAME)/$(AESM_SERVICE_PACKAGE_PATH)/$(AESM_SERVICE_PACKAGE_NAME)/aesm) && \
mv libsgx_le.signed.so libsgx_le.signed.so.$(LE_VER) && \
ln -fs libsgx_le.signed.so.$(LE_VER) libsgx_le.signed.so.$(call SPLIT_VERSION,$(LE_VER),1) && \
ln -fs libsgx_le.signed.so.$(call SPLIT_VERSION,$(LE_VER),1) libsgx_le.signed.so
cd $(shell readlink -m $(DESTDIR)/$(AESM_ECDSA_PACKAGE_NAME)/$(AESM_SERVICE_PACKAGE_PATH)/$(AESM_SERVICE_PACKAGE_NAME)/aesm) && \
ln -fs $(USR_LIB_PATH)/libsgx_qe3.signed.so.$(call SPLIT_VERSION,$(QE3_VER),1) && \
ln -fs $(USR_LIB_PATH)/libsgx_qe3.signed.so && \
linux/installer/common/sgx-aesm-service/createTarball.sh
-2
View File
@@ -50,10 +50,8 @@ source ${SCRIPT_DIR}/installConfig
cp ${LINUX_INSTALLER_COMMON_DIR}/gen_source/gen_source.py ${SCRIPT_DIR}
# Copy the files according to the BOM
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/libsgx-ae-le.txt --cleanup=false --installdir=pkgroot/libsgx-ae-le
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/libsgx-ae-pce.txt --cleanup=false --installdir=pkgroot/libsgx-ae-pce
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/libsgx-aesm-ecdsa-plugin.txt --cleanup=false --installdir=pkgroot/libsgx-aesm-ecdsa-plugin
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/libsgx-aesm-launch-plugin.txt --cleanup=false --installdir=pkgroot/libsgx-aesm-launch-plugin
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/libsgx-aesm-pce-plugin.txt --cleanup=false --installdir=pkgroot/libsgx-aesm-pce-plugin
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/libsgx-aesm-quote-ex-plugin.txt --cleanup=false --installdir=pkgroot/libsgx-aesm-quote-ex-plugin
python ${SCRIPT_DIR}/gen_source.py --bom=BOMs/sgx-aesm-service.txt --cleanup=false --installdir=pkgroot/sgx-aesm-service
linux/installer/common/sgx-aesm-service/installConfig
-5
View File
@@ -3,15 +3,10 @@ TARBALL_NAME=sgx-aesm-service_1.0.orig.tar.gz
AESM_SERVICE_PACKAGE_PATH=/opt/intel
AESM_SERVICE_PACKAGE_NAME=sgx-aesm-service
AE_LE_PACKAGE_NAME=libsgx-ae-le
AE_PCE_PACKAGE_NAME=libsgx-ae-pce
AE_PSE_PACKAGE_NAME=libsgx-ae-pse
AESM_ECDSA_PACKAGE_NAME=libsgx-aesm-ecdsa-plugin
AESM_LAUNCH_PACKAGE_NAME=libsgx-aesm-launch-plugin
AESM_PCE_PACKAGE_NAME=libsgx-aesm-pce-plugin
AESM_PLATFORM_PACKAGE_NAME=libsgx-aesm-platform-plugin
AESM_QUOTE_EX_PACKAGE_NAME=libsgx-aesm-quote-ex-plugin
PSDA_PACKAGE_NAME=libsgx-psda
LIB_DIR=lib
ETC_DIR=etc
linux/installer/deb/libsgx-enclave-common/libsgx-enclave-common-1.0/debian/control
-1
View File
@@ -9,7 +9,6 @@ Homepage: https://github.com/intel/linux-sgx
Package: libsgx-enclave-common
Architecture: amd64
Depends: ${shlibs:Depends}, ${misc:Depends}
Recommends: libsgx-launch (>= @dep_version@)
Description: Intel(R) Software Guard Extensions Enclave Common Loader
Package: libsgx-enclave-common-dev
linux/installer/deb/libsgx-launch/build.sh
-124
View File
@@ -1,124 +0,0 @@
#!/usr/bin/env bash
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
set -e
SCRIPT_DIR=$(dirname "$0")
ROOT_DIR="${SCRIPT_DIR}/../../../../"
LINUX_INSTALLER_DIR="${ROOT_DIR}/linux/installer"
LINUX_INSTALLER_COMMON_DIR="${LINUX_INSTALLER_DIR}/common"
LINUX_INSTALLER_COMMON_LAUNCH_DIR="${LINUX_INSTALLER_COMMON_DIR}/libsgx-launch"
source ${LINUX_INSTALLER_COMMON_LAUNCH_DIR}/installConfig
DEB_FOLDER=${LAUNCH_PACKAGE_NAME}-${LAUNCH_VERSION}
SGX_VERSION=$(awk '/STRFILEVER/ {print $3}' ${ROOT_DIR}/common/inc/internal/se_version.h|sed 's/^\"\(.*\)\"$/\1/')
DEB_BUILD_FOLDER=${LAUNCH_PACKAGE_NAME}-${SGX_VERSION}
main() {
pre_build
create_upstream_tarball
unpack_upstream_tarball
generate_install
generate_copyright
update_version
rename_tarball
build_deb_package
post_build
}
pre_build() {
rm -fR ${SCRIPT_DIR}/${DEB_BUILD_FOLDER}
cp -fR ${SCRIPT_DIR}/${DEB_FOLDER} ${SCRIPT_DIR}/${DEB_BUILD_FOLDER}
}
post_build() {
rm -fR ${SCRIPT_DIR}/${DEB_BUILD_FOLDER}
}
create_upstream_tarball() {
${LINUX_INSTALLER_COMMON_LAUNCH_DIR}/createTarball.sh
cp ${LINUX_INSTALLER_COMMON_LAUNCH_DIR}/output/${TARBALL_NAME} ${SCRIPT_DIR}
}
unpack_upstream_tarball() {
pushd ${SCRIPT_DIR}/${DEB_BUILD_FOLDER}
cp ../${TARBALL_NAME} .
tar xvf ${TARBALL_NAME}
rm -f ${TARBALL_NAME}
popd
}
generate_install() {
echo "debian/tmp/${LAUNCH_PACKAGE_NAME}/* ." > ${SCRIPT_DIR}/${DEB_BUILD_FOLDER}/debian/${LAUNCH_PACKAGE_NAME}.install
echo "debian/tmp/${LAUNCH_DEV_PACKAGE_NAME}/* ." > ${SCRIPT_DIR}/${DEB_BUILD_FOLDER}/debian/${LAUNCH_DEV_PACKAGE_NAME}.install
}
generate_copyright() {
pushd ${SCRIPT_DIR}/${DEB_BUILD_FOLDER}
rm -f debian/copyright
find package/licenses/ -type f -print0 | xargs -0 -n1 cat >> debian/copyright
popd
}
get_os_code() {
OS_CODE=$(lsb_release -cs 2> /dev/null)
if [ -z ${OS_CODE} ]; then
OS_CODE=$(grep "VERSION_CODENAME" /etc/os-release 2> /dev/null | cut -d= -f2)
fi
echo ${OS_CODE}
}
update_version() {
pushd ${SCRIPT_DIR}/${DEB_BUILD_FOLDER}
INS_VERSION=$(echo $(dpkg-parsechangelog |grep "Version" | cut -d: -f2))
DEB_VERSION=$(echo $INS_VERSION | cut -d- -f2)
FULL_VERSION=${SGX_VERSION}-$(get_os_code)${DEB_VERSION}
sed -i "s/${INS_VERSION}/${FULL_VERSION}/" debian/changelog
sed -i "s/@dep_version@/${FULL_VERSION}/g" debian/control
popd
}
rename_tarball() {
TARBALL_NAME_NEW_VERSION=$(echo ${TARBALL_NAME} | sed "s/${LAUNCH_VERSION}/${SGX_VERSION}/")
mv ${SCRIPT_DIR}/${TARBALL_NAME} ${SCRIPT_DIR}/${TARBALL_NAME_NEW_VERSION}
}
build_deb_package() {
pushd ${SCRIPT_DIR}/${DEB_BUILD_FOLDER}
SOURCE_DATE_EPOCH="$(date +%s)" dpkg-buildpackage -us -uc
popd
}
main $@
linux/installer/deb/libsgx-launch/clean.sh
-47
View File
@@ -1,47 +0,0 @@
#!/usr/bin/env bash
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
set -e
SCRIPT_DIR=$(dirname "$0")
COMMON_DIR="${SCRIPT_DIR}/../../common/libsgx-launch"
rm -f ${SCRIPT_DIR}/libsgx-launch*.deb
rm -f ${SCRIPT_DIR}/libsgx-launch-dbgsym*.ddeb
rm -f ${SCRIPT_DIR}/libsgx-launch*.tar.gz
rm -f ${SCRIPT_DIR}/libsgx-launch*.tar.xz
rm -f ${SCRIPT_DIR}/libsgx-launch*.dsc
rm -f ${SCRIPT_DIR}/libsgx-launch*.changes
rm -f ${SCRIPT_DIR}/libsgx-launch*.buildinfo
rm -f ${COMMON_DIR}/gen_source.py
rm -rf ${COMMON_DIR}/output
linux/installer/deb/libsgx-launch/libsgx-launch-1.0/debian/changelog
-5
View File
@@ -1,5 +0,0 @@
libsgx-launch (1.0-1) unstable; urgency=low
* Initial Release
-- Xiangquan Liu <xiangquan.liu@intel.com> Mon, 29 Jul 2019 15:23:51 +0800
linux/installer/deb/libsgx-launch/libsgx-launch-1.0/debian/compat
-1
View File
@@ -1 +0,0 @@
9
linux/installer/deb/libsgx-launch/libsgx-launch-1.0/debian/control
-19
View File
@@ -1,19 +0,0 @@
Source: libsgx-launch
Section: libs
Priority: optional
Maintainer: <xiangquan.liu@intel.com>
Build-Depends: debhelper (>= 8.0.0)
Standards-Version: 3.9.4
Homepage: https://github.com/intel/linux-sgx
Package: libsgx-launch
Architecture: amd64
Depends: ${shlibs:Depends}, ${misc:Depends}
Recommends: libsgx-aesm-launch-plugin (>= @dep_version@)
Description: Intel(R) Software Guard Extensions Launch Service
Package: libsgx-launch-dev
Section: devel
Architecture: amd64
Depends: libsgx-launch (= @dep_version@), libsgx-headers (>= @dep_version@)
Description: Intel(R) Software Guard Extensions Launch Service for Developers
linux/installer/deb/libsgx-launch/libsgx-launch-1.0/debian/rules
-8
View File
@@ -1,8 +0,0 @@
#!/usr/bin/make -f
# -*- makefile -*-
# Uncomment this to turn on verbose mode.
#export DH_VERBOSE=1
%:
dh $@
linux/installer/deb/libsgx-launch/libsgx-launch-1.0/debian/source/format
-1
View File
@@ -1 +0,0 @@
3.0 (quilt)
linux/installer/deb/libsgx-uae-service/libsgx-uae-service-1.0/debian/control
+1 -1
View File
@@ -8,5 +8,5 @@ Homepage: https://github.com/intel/linux-sgx
Package: libsgx-uae-service
Architecture: amd64
Depends: ${shlibs:Depends}, ${misc:Depends}, libsgx-launch (>= @dep_version@), libsgx-quote-ex (>= @dep_version@)
Depends: ${shlibs:Depends}, ${misc:Depends}, libsgx-quote-ex (>= @dep_version@)
Description: Intel(R) Software Guard Extensions Untrusted AE Service
linux/installer/deb/sgx-aesm-service/build.sh
+4 -6
View File
@@ -47,12 +47,10 @@ SGX_VERSION=$(awk '/STRFILEVER/ {print $3}' ${ROOT_DIR}/common/inc/internal/se_v
DEB_BUILD_FOLDER=${AESM_SERVICE_PACKAGE_NAME}-${SGX_VERSION}
PACKAGE_NAMES[0]=${AESM_SERVICE_PACKAGE_NAME}
PACKAGE_NAMES[1]=${AE_LE_PACKAGE_NAME}
PACKAGE_NAMES[2]=${AE_PCE_PACKAGE_NAME}
PACKAGE_NAMES[3]=${AESM_ECDSA_PACKAGE_NAME}
PACKAGE_NAMES[4]=${AESM_LAUNCH_PACKAGE_NAME}
PACKAGE_NAMES[5]=${AESM_PCE_PACKAGE_NAME}
PACKAGE_NAMES[6]=${AESM_QUOTE_EX_PACKAGE_NAME}
PACKAGE_NAMES[1]=${AE_PCE_PACKAGE_NAME}
PACKAGE_NAMES[2]=${AESM_ECDSA_PACKAGE_NAME}
PACKAGE_NAMES[3]=${AESM_PCE_PACKAGE_NAME}
PACKAGE_NAMES[4]=${AESM_QUOTE_EX_PACKAGE_NAME}
main() {
pre_build
linux/installer/deb/sgx-aesm-service/sgx-aesm-service-1.0/debian/control
-9
View File
@@ -11,15 +11,6 @@ Architecture: amd64
Depends: ${shlibs:Depends}, ${misc:Depends}
Description: Intel(R) Software Guard Extensions AESM Service
Package: libsgx-aesm-launch-plugin
Architecture: amd64
Depends: ${shlibs:Depends}, ${misc:Depends}, sgx-aesm-service(>= @dep_version@), libsgx-ae-le(>= @dep_version@)
Description: Launch Plugin for Intel(R) Software Guard Extensions AESM Service
Package: libsgx-ae-le
Architecture: amd64
Description: Intel(R) Software Guard Extensions LE
Package: libsgx-aesm-quote-ex-plugin
Architecture: amd64
Depends: ${shlibs:Depends}, ${misc:Depends}, sgx-aesm-service(>= @dep_version@), libsgx-aesm-ecdsa-plugin(>= @dep_version@)
linux/installer/docker/Dockerfile
+3 -3
View File
@@ -57,7 +57,7 @@ RUN apt-get install -y \
# No AESM daemon, only AESM client side API support for launch.
# For applications requiring attestation, add libsgx-quote-ex
RUN apt-get install -y --no-install-recommends libsgx-launch libsgx-urts
RUN apt-get install -y --no-install-recommends libsgx-urts
COPY --from=sgx_sample_builder /opt/intel/sgxsdk/SampleCode/SampleEnclave/app .
COPY --from=sgx_sample_builder /opt/intel/sgxsdk/SampleCode/SampleEnclave/enclave.signed.so .
@@ -73,8 +73,8 @@ RUN apt-get install -y \
libssl-dev \
make
# More aesm plugins, e.g libsgx-aesm-quote-ex-plugin, are needed if application requires attestation. See installation guide.
RUN apt-get install -y libsgx-aesm-launch-plugin
# More aesm plugins are needed if application requires attestation. See installation guide.
RUN apt-get install -y libsgx-aesm-quote-ex-plugin
WORKDIR /opt/intel/sgx-aesm-service/aesm
ENV LD_LIBRARY_PATH=.
linux/installer/rpm/libsgx-enclave-common/libsgx-enclave-common.spec
-1
View File
@@ -41,7 +41,6 @@ BuildRequires: libsystemd0
%else
BuildRequires: systemd-libs
%endif
Recommends: libsgx-launch >= %{version}-%{release}
License: BSD License
URL: https://github.com/intel/linux-sgx
linux/installer/rpm/libsgx-launch/build.sh
-95
View File
@@ -1,95 +0,0 @@
#!/usr/bin/env bash
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
set -e
SCRIPT_DIR=$(dirname "$0")
ROOT_DIR="${SCRIPT_DIR}/../../../../"
LINUX_INSTALLER_DIR="${ROOT_DIR}/linux/installer"
LINUX_INSTALLER_COMMON_DIR="${LINUX_INSTALLER_DIR}/common"
LINUX_INSTALLER_COMMON_LAUNCH_DIR="${LINUX_INSTALLER_COMMON_DIR}/libsgx-launch"
source ${LINUX_INSTALLER_COMMON_LAUNCH_DIR}/installConfig
SGX_VERSION=$(awk '/STRFILEVER/ {print $3}' ${ROOT_DIR}/common/inc/internal/se_version.h|sed 's/^\"\(.*\)\"$/\1/')
RPM_BUILD_FOLDER=${LAUNCH_PACKAGE_NAME}-${SGX_VERSION}
main() {
pre_build
update_spec
create_upstream_tarball
build_rpm_package
post_build
}
pre_build() {
rm -fR ${SCRIPT_DIR}/${RPM_BUILD_FOLDER}
mkdir -p ${SCRIPT_DIR}/${RPM_BUILD_FOLDER}/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
cp -f ${SCRIPT_DIR}/${LAUNCH_PACKAGE_NAME}.spec ${SCRIPT_DIR}/${RPM_BUILD_FOLDER}/SPECS
}
post_build() {
for FILE in $(find ${SCRIPT_DIR}/${RPM_BUILD_FOLDER} -name "*.rpm" 2> /dev/null); do
cp "${FILE}" ${SCRIPT_DIR}
done
rm -fR ${SCRIPT_DIR}/${RPM_BUILD_FOLDER}
}
update_spec() {
min_version="4.12"
rpm_version=$(rpmbuild --version 2> /dev/null | awk '{print $NF}')
cur_version=$(echo -e "${rpm_version}\n${min_version}" | sort -V | head -n 1)
pushd ${SCRIPT_DIR}/${RPM_BUILD_FOLDER}
sed -i "s/@version@/${SGX_VERSION}/" SPECS/${LAUNCH_PACKAGE_NAME}.spec
if [ "${min_version}" != "${cur_version}" ]; then
sed -i "s/^Recommends:/Requires: /" SPECS/${LAUNCH_PACKAGE_NAME}.spec
fi
popd
}
create_upstream_tarball() {
${LINUX_INSTALLER_COMMON_LAUNCH_DIR}/createTarball.sh
tar -xvf ${LINUX_INSTALLER_COMMON_LAUNCH_DIR}/output/${TARBALL_NAME} -C ${SCRIPT_DIR}/${RPM_BUILD_FOLDER}/SOURCES
pushd ${SCRIPT_DIR}/${RPM_BUILD_FOLDER}/SOURCES
tar -zcvf ${RPM_BUILD_FOLDER}$(echo ${TARBALL_NAME}|awk -F'.' '{print "."$(NF-1)"."$(NF)}') *
popd
}
build_rpm_package() {
pushd ${SCRIPT_DIR}/${RPM_BUILD_FOLDER}
rpmbuild --define="_topdir `pwd`" --define='_debugsource_template %{nil}' -ba SPECS/${LAUNCH_PACKAGE_NAME}.spec
popd
}
main $@
linux/installer/rpm/libsgx-launch/clean.sh
-41
View File
@@ -1,41 +0,0 @@
#!/usr/bin/env bash
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
set -e
SCRIPT_DIR=$(dirname "$0")
COMMON_DIR="${SCRIPT_DIR}/../../common/libsgx-launch"
rm -f ${SCRIPT_DIR}/libsgx-launch*.rpm
rm -f ${COMMON_DIR}/gen_source.py
rm -rf ${COMMON_DIR}/output
linux/installer/rpm/libsgx-launch/libsgx-launch.spec
-84
View File
@@ -1,84 +0,0 @@
#
# Copyright (C) 2011-2019 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
%define _license_file COPYING
Name: libsgx-launch
Version: @version@
Release: 1%{?dist}
Summary: Intel(R) Software Guard Extensions Launch Service
Group: Development/Libraries
Recommends: libsgx-aesm-launch-plugin >= %{version}-%{release}
License: BSD License
URL: https://github.com/intel/linux-sgx
Source0: %{name}-%{version}.tar.gz
%description
Intel(R) Software Guard Extensions Launch Service
%package devel
Summary: Intel(R) Software Guard Extensions Launch Service for Developers
Group: Development/Libraries
Requires: %{name} = %{version}-%{release} libsgx-headers >= %{version}-%{release}
%description devel
Intel(R) Software Guard Extensions Launch Service for Developers
%prep
%setup -qc
%install
make DESTDIR=%{?buildroot} install
install -d %{?buildroot}/%{name}%{_docdir}/%{name}
find %{?_sourcedir}/package/licenses/ -type f -print0 | xargs -0 -n1 cat >> %{?buildroot}/%{name}%{_docdir}/%{name}/%{_license_file}
rm -f %{_specdir}/list-%{name}
for f in $(find %{?buildroot}/%{name} -type f -o -type l); do
echo $f | sed -e "s#%{?buildroot}/%{name}##" >> %{_specdir}/list-%{name}
done
cp -r %{?buildroot}/%{name}/* %{?buildroot}/
rm -fr %{?buildroot}/%{name}
rm -f %{_specdir}/list-%{name}-devel
for f in $(find %{?buildroot}/%{name}-dev -type f -o -type l); do
echo $f | sed -e "s#%{?buildroot}/%{name}-dev##" >> %{_specdir}/list-%{name}-devel
done
cp -r %{?buildroot}/%{name}-dev/* %{?buildroot}/
rm -fr %{?buildroot}/%{name}-dev
%files -f %{_specdir}/list-%{name}
%files devel -f %{_specdir}/list-%{name}-devel
%debug_package
%changelog
* Mon Jul 29 2019 SGX Team
- Initial Release
linux/installer/rpm/libsgx-uae-service/libsgx-uae-service.spec
+1 -1
View File
@@ -36,7 +36,7 @@ Version: @version@
Release: 1%{?dist}
Summary: Intel(R) Software Guard Extensions Untrusted AE Service
Group: Development/Libraries
Requires: libsgx-launch >= %{version}-%{release} libsgx-quote-ex >= %{version}-%{release}
Requires: libsgx-quote-ex >= %{version}-%{release}
License: BSD License
URL: https://github.com/intel/linux-sgx
linux/installer/rpm/psw-dcap/psw-dcap.spec.tmpl
+1 -37
View File
@@ -69,13 +69,6 @@ BuildRequires: nasm
%description
Intel(R) Software Guard Extensions AESM Service
%package -n libsgx-ae-le
Version: %{_psw_version}
Summary: Intel(R) Software Guard Extensions LE
%description -n libsgx-ae-le
Intel(R) Software Guard Extensions LE
%package -n libsgx-ae-pce
Version: %{_psw_version}
Summary: Intel(R) Software Guard Extensions PCE
@@ -91,14 +84,6 @@ Requires: %{name} >= %{version}-%{release} libsgx-qe3-logic >= %{_dcap_vers
%description -n libsgx-aesm-ecdsa-plugin
ECDSA Quote Plugin for Intel(R) Software Guard Extensions AESM Service
%package -n libsgx-aesm-launch-plugin
Version: %{_psw_version}
Summary: Launch Plugin for Intel(R) Software Guard Extensions AESM Service
Requires: %{name} >= %{version}-%{release} libsgx-ae-le >= %{version}-%{release}
%description -n libsgx-aesm-launch-plugin
Launch Plugin for Intel(R) Software Guard Extensions AESM Service
%package -n libsgx-aesm-pce-plugin
Version: %{_psw_version}
Summary: PCE Plugin for Intel(R) Software Guard Extensions AESM Service
@@ -115,22 +100,6 @@ Requires: %{name} >= %{version}-%{release} libsgx-aesm-ecdsa-plugin >= %{ve
%description -n libsgx-aesm-quote-ex-plugin
Unified Quote Plugin for Intel(R) Software Guard Extensions AESM Service
%package -n libsgx-launch
Version: %{_psw_version}
Summary: Intel(R) Software Guard Extensions Launch Service
Recommends: libsgx-aesm-launch-plugin >= %{version}-%{release}
%description -n libsgx-launch
Intel(R) Software Guard Extensions Launch Service
%package -n libsgx-launch-devel
Version: %{_psw_version}
Summary: Intel(R) Software Guard Extensions Launch Service for Developers
Requires: libsgx-launch = %{version}-%{release} libsgx-headers >= %{version}-%{release}
%description -n libsgx-launch-devel
Intel(R) Software Guard Extensions Launch Service for Developers
%package -n libsgx-quote-ex
Version: %{_psw_version}
Summary: Intel(R) Software Guard Extensions Unified Quote Service
@@ -165,7 +134,7 @@ Intel(R) Software Guard Extensions uRTS
%package -n libsgx-uae-service
Version: %{_psw_version}
Summary: Intel(R) Software Guard Extensions Untrusted AE Service
Requires: libsgx-launch >= %{version}-%{release} libsgx-quote-ex >= %{version}-%{release}
Requires: libsgx-quote-ex >= %{version}-%{release}
%description -n libsgx-uae-service
Intel(R) Software Guard Extensions Untrusted AE Service
@@ -173,7 +142,6 @@ Intel(R) Software Guard Extensions Untrusted AE Service
%package -n libsgx-enclave-common
Version: %{_psw_version}
Summary: Intel(R) Software Guard Extensions Enclave Common Loader
Recommends: libsgx-launch >= %{version}-%{release}
%description -n libsgx-enclave-common
Intel(R) Software Guard Extensions Enclave Common Loader
@@ -371,14 +339,10 @@ rm -fr %{?buildroot}/license
make clean
%files -f %{_specdir}/list-%{name}
%files -n libsgx-ae-le -f %{_specdir}/list-libsgx-ae-le
%files -n libsgx-ae-pce -f %{_specdir}/list-libsgx-ae-pce
%files -n libsgx-aesm-ecdsa-plugin -f %{_specdir}/list-libsgx-aesm-ecdsa-plugin
%files -n libsgx-aesm-launch-plugin -f %{_specdir}/list-libsgx-aesm-launch-plugin
%files -n libsgx-aesm-pce-plugin -f %{_specdir}/list-libsgx-aesm-pce-plugin
%files -n libsgx-aesm-quote-ex-plugin -f %{_specdir}/list-libsgx-aesm-quote-ex-plugin
%files -n libsgx-launch -f %{_specdir}/list-libsgx-launch
%files -n libsgx-launch-devel -f %{_specdir}/list-libsgx-launch-devel
%files -n libsgx-quote-ex -f %{_specdir}/list-libsgx-quote-ex
%files -n libsgx-quote-ex-devel -f %{_specdir}/list-libsgx-quote-ex-devel
%files -n libsgx-headers -f %{_specdir}/list-libsgx-headers
linux/installer/rpm/psw-tdx/psw-tdx.spec.tmpl
-1
View File
@@ -94,7 +94,6 @@ Intel(R) Software Guard Extensions uRTS
%package -n libsgx-enclave-common
Version: %{_psw_version}
Summary: Intel(R) Software Guard Extensions Enclave Common Loader
Recommends: libsgx-launch >= %{version}-%{release}
%description -n libsgx-enclave-common
Intel(R) Software Guard Extensions Enclave Common Loader
linux/installer/rpm/sgx-aesm-service/build.sh
+4 -6
View File
@@ -47,12 +47,10 @@ fi
SGX_VERSION=$(awk '/STRFILEVER/ {print $3}' ${ROOT_DIR}/common/inc/internal/se_version.h|sed 's/^\"\(.*\)\"$/\1/')
PACKAGE_NAMES[0]=${AESM_SERVICE_PACKAGE_NAME}
PACKAGE_NAMES[1]=${AE_LE_PACKAGE_NAME}
PACKAGE_NAMES[2]=${AE_PCE_PACKAGE_NAME}
PACKAGE_NAMES[3]=${AESM_ECDSA_PACKAGE_NAME}
PACKAGE_NAMES[4]=${AESM_LAUNCH_PACKAGE_NAME}
PACKAGE_NAMES[5]=${AESM_PCE_PACKAGE_NAME}
PACKAGE_NAMES[6]=${AESM_QUOTE_EX_PACKAGE_NAME}
PACKAGE_NAMES[1]=${AE_PCE_PACKAGE_NAME}
PACKAGE_NAMES[2]=${AESM_ECDSA_PACKAGE_NAME}
PACKAGE_NAMES[3]=${AESM_PCE_PACKAGE_NAME}
PACKAGE_NAMES[4]=${AESM_QUOTE_EX_PACKAGE_NAME}
main() {
pre_build
linux/installer/rpm/sgx-aesm-service/libsgx-ae-le.spec
-46
View File
@@ -1,46 +0,0 @@
#
# Copyright(c) 2011-2025 Intel Corporation
#
# SPDX-License-Identifier: BSD-3-Clause
#
%define _install_path @install_path@
%define _license_file COPYING
Name: libsgx-ae-le
Version: @version@
Release: 1%{?dist}
Summary: Intel(R) Software Guard Extensions LE
Group: Development/System
License: BSD License
URL: https://github.com/intel/linux-sgx
Source0: %{name}-%{version}.tar.gz
%description
Intel(R) Software Guard Extensions LE
%prep
%setup -qc
%install
make DESTDIR=%{?buildroot} install
OLDDIR=$(pwd)
cd %{?buildroot}
rm -fr $(ls | grep -xv "%{name}")
install -d %{name}%{_docdir}/%{name}
find %{?_sourcedir}/package/licenses/ -type f -print0 | xargs -0 -n1 cat >> %{name}%{_docdir}/%{name}/%{_license_file}
cd "$OLDDIR"
echo "%{_install_path}" > %{_specdir}/list-%{name}
find %{?buildroot}/%{name} | sort | \
awk '$0 !~ last "/" {print last} {last=$0} END {print last}' | \
sed -e "s#^%{?buildroot}/%{name}##" | \
grep -v "^%{_install_path}" >> %{_specdir}/list-%{name} || :
cp -r %{?buildroot}/%{name}/* %{?buildroot}/
rm -fr %{?buildroot}/%{name}
%files -f %{_specdir}/list-%{name}
%changelog
* Mon Jul 29 2019 SGX Team
- Initial Release
linux/installer/rpm/sgx-aesm-service/libsgx-aesm-launch-plugin.spec
-49
View File
@@ -1,49 +0,0 @@
#
# Copyright(c) 2011-2025 Intel Corporation
#
# SPDX-License-Identifier: BSD-3-Clause
#
%define _install_path @install_path@
%define _license_file COPYING
Name: libsgx-aesm-launch-plugin
Version: @version@
Release: 1%{?dist}
Summary: Launch Plugin for Intel(R) Software Guard Extensions AESM Service
Group: Development/System
Requires: sgx-aesm-service >= %{version}-%{release} libsgx-ae-le >= %{version}-%{release}
License: BSD License
URL: https://github.com/intel/linux-sgx
Source0: %{name}-%{version}.tar.gz
%description
Launch Plugin for Intel(R) Software Guard Extensions AESM Service
%prep
%setup -qc
%install
make DESTDIR=%{?buildroot} install
OLDDIR=$(pwd)
cd %{?buildroot}
rm -fr $(ls | grep -xv "%{name}")
install -d %{name}%{_docdir}/%{name}
find %{?_sourcedir}/package/licenses/ -type f -print0 | xargs -0 -n1 cat >> %{name}%{_docdir}/%{name}/%{_license_file}
cd "$OLDDIR"
echo "%{_install_path}" > %{_specdir}/list-%{name}
find %{?buildroot}/%{name} | sort | \
awk '$0 !~ last "/" {print last} {last=$0} END {print last}' | \
sed -e "s#^%{?buildroot}/%{name}##" | \
grep -v "^%{_install_path}" >> %{_specdir}/list-%{name} || :
cp -r %{?buildroot}/%{name}/* %{?buildroot}/
rm -fr %{?buildroot}/%{name}
%files -f %{_specdir}/list-%{name}
%debug_package
%changelog
* Mon Jul 29 2019 SGX Team
- Initial Release
psw/ae/Makefile
+1 -10
View File
@@ -40,16 +40,12 @@ else
endif
CHECK_PREBUILT :=
ifeq ("$(wildcard data/prebuilt/libsgx_le.signed.so)", "")
ifeq ("$(wildcard data/prebuilt/libsgx_pce.signed.so)", "")
CHECK_PREBUILT := prebuilt_check_fail
endif
.PHONY: all
ifeq ($(BUILD_REF_LE), 1)
all: $(CMAKE_RESULT) AESM REF_LE COPY_AES| $(BUILD_DIR)
else
all: $(CMAKE_RESULT) AESM COPY_AES| $(BUILD_DIR)
endif #($(BUILD_REF_LE), 1)
# COPY_AES: currently copy le, pce, qe3
.PHONY: COPY_AES
@@ -62,17 +58,12 @@ AESM: | $(BUILD_DIR)
$(CP) aesm_service/config/aesmd_service/aesmd.conf $(BUILD_DIR)
$(CP) aesm_service/config/aesmd_service/aesmd.service $(BUILD_DIR)
.PHONY: REF_LE
REF_LE:
$(MAKE) -C ref_le
$(BUILD_DIR):
@$(MKDIR) $@
.PHONY: clean
clean:
$(MAKE) -C aesm_service/ clean
$(MAKE) -C ref_le clean
.PHONY: rebuild
rebuild:
psw/ae/aesm_service/Makefile
+1 -10
View File
@@ -42,10 +42,6 @@ else
AESM_CONFIG += -DCMAKE_BUILD_TYPE=Release
endif
ifeq ($(BUILD_REF_LE), 1)
AESM_CONFIG += -DREF_LE=ON
endif
ifeq ($(ARCH), x86)
SQLITECFLAGS += -m32
else
@@ -61,20 +57,15 @@ CXXFLAGS += -fpie
CFLAGS += -fpie
CFLAGS := $(filter-out -Werror, $(CFLAGS))
WHITE_LIST_FILE := $(LINUX_PSW_DIR)/ae/data/prebuilt/white_list_cert_to_be_verify.bin
APPNAME := source/build/bin/aesm_service
CPPMICROSERVICES:= $(CPPMICROSERVICES_DIR)/build/lib/libCppMicroServices.so.4.0.0
RDRAND_LIBDIR :=$(LINUX_EXTERNAL_DIR)/rdrand/src
RDRAND_MAKEFILE := $(RDRAND_LIBDIR)/Makefile
.PHONY: all
all: $(APPNAME) $(APPNAME_DEBUG) copy_data_file | $(BUILD_DIR)
all: $(APPNAME) $(APPNAME_DEBUG) | $(BUILD_DIR)
$(CP) -r source/build/bin/* $|
copy_data_file:
@$(MKDIR) -p data
@$(CP) $(WHITE_LIST_FILE) data/white_list_cert_to_be_verify.bin
$(APPNAME): $(CPPMICROSERVICES) source/build/CMakeCache.txt urts RDRAND
$(MAKE) -C source/build
$(CP) $(CPPMICROSERVICES) source/build/bin/
psw/ae/aesm_service/source/CMakeLists.txt
-4
View File
@@ -56,10 +56,6 @@ else()
message (FATAL_ERROR "Cannot find CppMicroServices")
endif()
if(REF_LE)
add_definitions("-DREF_LE")
endif()
set(CMAKE_CXX_STANDARD_REQUIRED 1)
set(CMAKE_CXX_STANDARD 17)
set(CMAKE_SKIP_BUILD_RPATH true)
psw/ae/aesm_service/source/bundles/le_launch_service_bundle/CMakeLists.txt
-61
View File
@@ -1,61 +0,0 @@
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
if(REF_LE)
set(Edger8rOutputLE "${CMAKE_CURRENT_BINARY_DIR}/ref_le_u.c")
set(Edger8rEDLLE "${PROJECT_SOURCE_DIR}/../../ref_le/ref_le.edl")
else()
set(Edger8rOutputLE "${CMAKE_CURRENT_BINARY_DIR}/launch_enclave_u.c")
set(Edger8rEDLLE "${PROJECT_SOURCE_DIR}/../../le/launch_enclave.edl")
endif()
get_filename_component(bundle ${CMAKE_CURRENT_SOURCE_DIR} NAME)
aux_source_directory(. _srcs)
link_directories(${CMAKE_SOURCE_DIR}/../../../urts/linux)
CreateBundle(${bundle} ${_srcs} ${Edger8rOutputLE})
target_include_directories(${bundle} PRIVATE
${PROJECT_SOURCE_DIR}/common
${SGX_HEADER_DIR}
${PROJECT_SOURCE_DIR}/../../../../common/inc
${PROJECT_SOURCE_DIR}/../../../../common/inc/internal
${PROJECT_SOURCE_DIR}/../../inc
${PROJECT_SOURCE_DIR}/../../inc/internal
)
add_custom_command(
OUTPUT ${Edger8rOutputLE}
COMMAND ${EDGER8R} --untrusted --untrusted-dir ${CMAKE_CURRENT_BINARY_DIR} ${Edger8rEDLLE} --search-path ${SGX_HEADER_DIR}
WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
)
target_link_libraries(${bundle} oal utils urts_internal)
set_property(TARGET ${bundle} APPEND_STRING PROPERTY LINK_FLAGS " -Wl,-z,defs")
psw/ae/aesm_service/source/bundles/le_launch_service_bundle/LEClass.cpp
-400
View File
@@ -1,400 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#include <assert.h>
#include <memory>
#include "LEClass.h"
#include "aeerror.h"
#include "arch.h"
#include "util.h"
#include "service_enclave_mrsigner.hh"
#include "aesm_long_lived_thread.h"
#include "aesm_config.h"
#ifdef REF_LE
#include "ref_le_u.h"
#else
#include "launch_enclave_u.h"
extern "C" sgx_status_t sgx_create_le(const char *file_name, const char *prd_css_file_name, const int debug, sgx_launch_token_t *launch_token, int *launch_token_updated, sgx_enclave_id_t *enclave_id, sgx_misc_attribute_t *misc_attr, int *production_loaded);
extern "C" bool is_launch_token_required();
#endif
extern AESMLogicMutex _le_mutex;
extern std::shared_ptr<INetworkService> g_network_service;
ThreadStatus white_list_thread;
class WhiteListIOCache :public BaseThreadIOCache{
//no input to be cached for white list pulling
protected:
WhiteListIOCache(void){
}
virtual ae_error_t entry(void);
virtual ThreadStatus& get_thread();
friend ae_error_t start_white_list_thread(unsigned long timeout);
public:
virtual bool operator==(const BaseThreadIOCache& oc)const{
const WhiteListIOCache *p = dynamic_cast<const WhiteListIOCache*>(&oc);
if (p == NULL) return false;
return true;
}
};
ThreadStatus& WhiteListIOCache::get_thread()
{
return white_list_thread;
}
ae_error_t WhiteListIOCache::entry()
{
return ae_ret = AE_SUCCESS;
}
ae_error_t start_white_list_thread(unsigned long timeout)
{
INIT_THREAD(WhiteListIOCache, timeout, ())
FINI_THREAD()
}
int CLEClass::white_list_register(
const uint8_t *white_list_cert,
uint32_t white_list_cert_size,
bool save_to_persistent_storage)
{
sgx_status_t ret = SGX_SUCCESS;
int retry = 0;
uint32_t status = 0;
AESMLogicLock locker(_le_mutex);
assert(m_enclave_id);
#ifdef REF_LE
if (white_list_cert_size < sizeof(ref_le_white_list_t))
{
AESM_DBG_WARN("white list size is smaller than the expected minimum");
return AE_INVALID_PARAMETER;
}
ref_le_white_list_t *p_white_list = (ref_le_white_list_t*)white_list_cert;
uint32_t entries_count = _ntohs(p_white_list->entries_count);
uint32_t white_list_size = REF_LE_WL_SIZE(entries_count);
if ((white_list_size + sizeof(sgx_rsa3072_signature_t)) > white_list_cert_size)
{
AESM_DBG_WARN("white list size for %d recornds - expected: %d + %d = %d, actual: %d", entries_count,
white_list_size, sizeof(sgx_rsa3072_signature_t), white_list_size + sizeof(sgx_rsa3072_signature_t), white_list_cert_size);
return AE_INVALID_PARAMETER;
}
sgx_rsa3072_signature_t* p_white_list_sig = (sgx_rsa3072_signature_t*)((uint64_t)white_list_cert + white_list_size);
ret = ref_le_init_white_list(m_enclave_id, (int*)&status, p_white_list, white_list_size, p_white_list_sig);
#else
if (white_list_cert_size < sizeof(wl_cert_chain_t)) {
return LE_INVALID_PARAMETER;
}
ret = le_init_white_list_wrapper(m_enclave_id, &status,
const_cast<uint8_t*>(white_list_cert),
white_list_cert_size);
#endif // REF_LE
for(; ret == SGX_ERROR_ENCLAVE_LOST && retry < AESM_RETRY_COUNT; retry++)
{
unload_enclave();
if(AE_SUCCESS != load_enclave_only())
return AE_FAILURE;
#ifdef REF_LE
ret = ref_le_init_white_list(m_enclave_id, (int*)&status, p_white_list, white_list_size, p_white_list_sig);
#else
ret = le_init_white_list_wrapper(m_enclave_id, &status,
const_cast<uint8_t*>(white_list_cert),
white_list_cert_size);
#endif // REF_LE
}
if(SGX_SUCCESS!=ret)
return sgx_error_to_ae_error(ret);
AESM_DBG_TRACE("le_init_white_list_wrapper return %d",status);
if(AE_SUCCESS == status&&save_to_persistent_storage){//successfully register the white list cert
if(AE_SUCCESS != aesm_write_data(FT_PERSISTENT_STORAGE,AESM_WHITE_LIST_CERT_FID,white_list_cert, white_list_cert_size)){//ignore error if failed to save in persistent storage
AESM_DBG_WARN("Fail to save white list cert in persistent storage");
}
}
if (LE_WHITE_LIST_ALREADY_UPDATED == status) {
status = AE_SUCCESS;
}
return status;
}
void CLEClass::load_white_cert_list()
{
load_verified_white_cert_list();
load_white_cert_list_to_be_verify();//If this version is older than previous one, it will not be loaded
}
#include <time.h>
#include "stdint.h"
ae_error_t CLEClass::load_verified_white_cert_list()
{
ae_error_t ae_err;
uint32_t white_cert_size=0;
ae_err = aesm_query_data_size(FT_PERSISTENT_STORAGE, AESM_WHITE_LIST_CERT_FID, &white_cert_size);
if(AE_SUCCESS == ae_err && white_cert_size ==0){//file not existing or 0 size
AESM_DBG_TRACE("no white cert list available in persistent storage");
return AE_SUCCESS;
}
if(AE_SUCCESS != ae_err)
return ae_err;
uint8_t *p = (uint8_t *)malloc(white_cert_size);
if(NULL == p){
AESM_DBG_ERROR("out of memory");
return AE_OUT_OF_MEMORY_ERROR;
}
ae_err = aesm_read_data(FT_PERSISTENT_STORAGE, AESM_WHITE_LIST_CERT_FID, p, &white_cert_size);
if(AE_SUCCESS != ae_err){
AESM_DBG_WARN("Fail to read white cert list file");
free(p);
return ae_err;
}
ae_err = (ae_error_t)white_list_register(p, white_cert_size,false);//Need not save the data to file again
if(AE_SUCCESS!=ae_err){
AESM_DBG_WARN("fail to register white cert list file in persistent storage");
}
free(p);
return ae_err;
}
//This function must be called after white list cert has been verified and the file may overwrite the original one
ae_error_t CLEClass::load_white_cert_list_to_be_verify()
{
ae_error_t ae_err;
uint32_t white_cert_size=0;
ae_err = aesm_query_data_size(FT_PERSISTENT_STORAGE, AESM_WHITE_LIST_CERT_TO_BE_VERIFY_FID, &white_cert_size);
if(AE_SUCCESS != ae_err || white_cert_size ==0){//file not existing or 0 size
AESM_DBG_TRACE("no white cert list to be verify in persistent storage");
return AE_SUCCESS;
}
uint8_t *p = (uint8_t *)malloc(white_cert_size);
if(NULL == p){
AESM_DBG_ERROR("out of memory");
return AE_OUT_OF_MEMORY_ERROR;
}
ae_err = aesm_read_data(FT_PERSISTENT_STORAGE, AESM_WHITE_LIST_CERT_TO_BE_VERIFY_FID, p, &white_cert_size);
if(AE_SUCCESS != ae_err){
AESM_DBG_WARN("Fail to read white cert list file");
free(p);
return ae_err;
}
ae_err = (ae_error_t)white_list_register(p, white_cert_size,true);//We need to overwrite the original white list file if the file is passed
if(AE_SUCCESS!=ae_err){
AESM_DBG_WARN("fail to register white cert list file in persistent storage");
}
{//Always remove the file now. If it is not verified, the file has problem and remove it; otherwise, it has been saved as the AESM_WHITE_LIST_CERT_FID
char white_list_to_be_verify_path_name[MAX_PATH];
ae_err = aesm_get_pathname(FT_PERSISTENT_STORAGE, AESM_WHITE_LIST_CERT_TO_BE_VERIFY_FID, white_list_to_be_verify_path_name, MAX_PATH);
if(AE_SUCCESS == ae_err){
se_delete_tfile(white_list_to_be_verify_path_name);
}
}
free(p);
return ae_err;
}
ae_error_t CLEClass::load_enclave_only()
{
before_enclave_load();
assert(m_enclave_id==0);
sgx_status_t ret;
ae_error_t ae_err;
char prod_css_path[MAX_PATH]={0};
char enclave_path[MAX_PATH]= {0};
char *p_prod_css_path = prod_css_path;
int production_le_loaded = 0;
if((ae_err = aesm_get_pathname(FT_PERSISTENT_STORAGE, LE_PROD_SIG_STRUCT_FID, prod_css_path, MAX_PATH))!=AE_SUCCESS){
AESM_DBG_WARN("fail to get production sig struction of LE");
p_prod_css_path = NULL;
}
if((ae_err = aesm_get_pathname(FT_ENCLAVE_NAME, get_enclave_fid(), enclave_path,//get non-production signed LE pathname
MAX_PATH))
!=AE_SUCCESS){
AESM_DBG_ERROR("fail to get LE pathname");
return ae_err;
}
int launch_token_update;
// in the ref LE we do not support loading non-production signed LE, as it should used with LCP a developer may
// load a non-production launch enclave by setting the non-production provider to the IA32_SGXLEPUBKEYHASH0..3 MSRs.
#if defined(AESM_SIM) || defined(REF_LE)
UNUSED(p_prod_css_path);
UNUSED(production_le_loaded);
ret = sgx_create_enclave(enclave_path, get_debug_flag(), &m_launch_token,
&launch_token_update, &m_enclave_id,
&m_attributes);//simulation or ref_le mode has no sgx_create_le function. Use sgx_create_enclave
if(ret != SGX_SUCCESS){
AESM_DBG_ERROR("Fail to load LE");
return AE_FAILURE;
}
#ifdef REF_LE
AESM_DBG_DEBUG("ref_le loaded succesfully");
#endif
m_ufd = false;
#else
ret = sgx_create_le(enclave_path, p_prod_css_path, get_debug_flag(), &m_launch_token,
&launch_token_update, &m_enclave_id,
&m_attributes, &production_le_loaded);
if (ret == SGX_ERROR_NO_DEVICE){
AESM_DBG_ERROR("AE SERVER NOT AVAILABLE in load non-production signed LE: %s",enclave_path);
return AESM_AE_NO_DEVICE;
}
if(ret == SGX_ERROR_OUT_OF_EPC)
{
AESM_DBG_ERROR("Loading LE failed due to out of epc");
return AESM_AE_OUT_OF_EPC;
}
if (ret != SGX_SUCCESS){
AESM_DBG_ERROR("Loading LE failed:%d",ret);
return AE_SERVER_NOT_AVAILABLE;
}else if(production_le_loaded!=0){//production signed LE loaded
m_ufd = false;
AESM_DBG_INFO("Production signed LE loaded, try loading white list now");
}else{
m_ufd = true;
AESM_DBG_INFO("Debug signed LE loaded");
}
#endif
return AE_SUCCESS;
}
ae_error_t CLEClass::load_enclave()
{
if(m_enclave_id){//LE has been loaded before
return AE_SUCCESS;
}
#ifndef REF_LE
if (!is_launch_token_required())
{
AESM_DBG_INFO("InKernel LE loaded");
return AE_SUCCESS;
}
#endif
ae_error_t ae_err = load_enclave_only();
if( AE_SUCCESS == ae_err){
load_white_cert_list();
}
return ae_err;
}
int CLEClass::get_launch_token_internal(
uint8_t * mrenclave, uint32_t mrenclave_size,
uint8_t *public_key, uint32_t public_key_size,
uint8_t *se_attributes, uint32_t se_attributes_size,
uint8_t * lictoken, uint32_t lictoken_size,
uint32_t *ae_mrsigner_index
)
{
sgx_status_t ret = SGX_SUCCESS;
int retry = 0;
int status = 0;
assert(m_enclave_id);
sgx_measurement_t mrsigner;
if(mrenclave_size !=sizeof(sgx_measurement_t) ||
SE_KEY_SIZE != public_key_size ||
se_attributes_size != sizeof(sgx_attributes_t) ||
lictoken_size < sizeof(token_t) ||
lictoken == NULL)
return LE_INVALID_PARAMETER;
//set mrsigner based on the hash of isv pub key from enclave signature
if(sgx_sha256_msg(reinterpret_cast<const uint8_t *>(public_key), public_key_size, reinterpret_cast<sgx_sha256_hash_t *>(&mrsigner)) != SGX_SUCCESS)
{
return AE_FAILURE;
}
if(ae_mrsigner_index!=NULL){
*ae_mrsigner_index = UINT32_MAX;
for(uint32_t i=0;i<sizeof(G_SERVICE_ENCLAVE_MRSIGNER)/sizeof(G_SERVICE_ENCLAVE_MRSIGNER[0]);i++){
if(memcmp(&G_SERVICE_ENCLAVE_MRSIGNER[i], &mrsigner, sizeof(mrsigner))==0){
*ae_mrsigner_index=i;
break;
}
}
}
#ifdef DBG_LOG
char mrsigner_info[256];
sgx_attributes_t *attr = (sgx_attributes_t *)se_attributes;
aesm_dbg_format_hex((uint8_t *)&mrsigner, sizeof(mrsigner), mrsigner_info, 256);
AESM_DBG_INFO("try to load Enclave with mrsigner:%s , attr %llx, xfrm %llx", mrsigner_info, attr->flags, attr->xfrm);
#endif
// the interface of the get token API is identical, only the name is different
#ifdef REF_LE
#define le_get_launch_token_wrapper ref_le_get_launch_token
#endif // REF_LE
//get launch token by ecall into LE
ret = le_get_launch_token_wrapper(m_enclave_id, &status,
reinterpret_cast<sgx_measurement_t*>(mrenclave),
&mrsigner,
reinterpret_cast<sgx_attributes_t*>(se_attributes),
reinterpret_cast<token_t*>(lictoken));
for(; ret == SGX_ERROR_ENCLAVE_LOST && retry < AESM_RETRY_COUNT; retry++)
{
unload_enclave();
if(AE_SUCCESS != load_enclave())
return AE_FAILURE;
ret = le_get_launch_token_wrapper(m_enclave_id, &status,
reinterpret_cast<sgx_measurement_t*>(mrenclave),
&mrsigner,
reinterpret_cast<sgx_attributes_t*>(se_attributes),
reinterpret_cast<token_t*>(lictoken));
}
AESM_DBG_INFO("token request returned with ret = %d, status = %d", ret, status);
if(SGX_SUCCESS!=ret)
return sgx_error_to_ae_error(ret);
if (status == LE_WHITELIST_UNINITIALIZED_ERROR || status == LE_INVALID_PRIVILEGE_ERROR){
start_white_list_thread(0);//try to query white list unblocking
}
if(is_ufd()){
reinterpret_cast<token_t*>(lictoken)->body.valid = 0;
}
return status;
}
psw/ae/aesm_service/source/bundles/le_launch_service_bundle/LEClass.h
-70
View File
@@ -1,70 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef _LE_CLASS_H_
#define _LE_CLASS_H_
#include "arch.h"
#include "AEClass.h"
#include "ae_debug_flag.hh"
#include "network_service.h"
class CLEClass: public SingletonEnclave<CLEClass>
{
friend class Singleton<CLEClass>;
friend class SingletonEnclave<CLEClass>;
static aesm_enclave_id_t get_enclave_fid(){return LE_ENCLAVE_FID;}
protected:
CLEClass(){};
~CLEClass(){};
virtual int get_debug_flag() { return LE_DEBUG_FLAG;}
void load_white_cert_list();
ae_error_t load_enclave_only();/*protected function to load Enclave only without loading white list*/
ae_error_t load_verified_white_cert_list();
ae_error_t load_white_cert_list_to_be_verify();
bool m_ufd; // if LEClass considers the platform ufd
public:
virtual ae_error_t load_enclave();/*overload LE load enclave function since i) we have two different LE SigStruct now, ii) we need load white list*/
int get_launch_token_internal(
uint8_t * mrenclave, uint32_t mrenclave_size,
uint8_t *mrsigner, uint32_t mrsigner_size,
uint8_t *se_attributes, uint32_t se_attributes_size,
uint8_t * lictoken, uint32_t lictoken_size,
uint32_t *ae_mrsigner_value=NULL
);
int white_list_register(
const uint8_t *white_list_cert,
uint32_t white_list_cert_size,
bool save_to_persistent_storage=true);
bool is_ufd() { return m_ufd; }
};
#endif
psw/ae/aesm_service/source/bundles/le_launch_service_bundle/le_launch_service_bundle.cpp
-525
View File
@@ -1,525 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#include <launch_service.h>
#include "pce_cert.h"
#include "byte_order.h"
#include "uae_service_internal.h"
#include "aesm_logic.h"
#include "service_enclave_mrsigner.hh"
#include "LEClass.h"
#include "aesm_long_lived_thread.h"
#include <cppmicroservices/BundleActivator.h>
#include "cppmicroservices/BundleContext.h"
#include <cppmicroservices/GetBundleContext.h>
#include "cppmicroservices_util.h"
using namespace cppmicroservices;
AESMLogicMutex _le_mutex;
std::shared_ptr<INetworkService> g_network_service;
std::shared_ptr<ILaunchService> g_launch_service;
extern "C" bool is_launch_token_required();
extern ae_error_t start_white_list_thread(unsigned long timeout=THREAD_TIMEOUT);
extern ThreadStatus white_list_thread;
extern "C" void init_get_launch_token(const func_get_launch_token_t func);
extern "C" sgx_status_t get_launch_token(const enclave_css_t *signature,
const sgx_attributes_t *attribute,
sgx_launch_token_t *launch_token)
{
return g_launch_service->get_launch_token(signature, attribute, launch_token);
}
class LeLaunchServiceImp : public ILaunchService
{
private:
bool _is_qe_psvn_set;
bool _is_pse_psvn_set;
bool _is_pce_psvn_set;
psvn_t _qe_psvn;
psvn_t _pce_psvn;
psvn_t _pse_psvn;
bool initialized;
ae_error_t save_unverified_white_list(const uint8_t *white_list_cert, uint32_t white_list_cert_size)
{
wl_cert_chain_t old_cert;
const wl_cert_chain_t *p_new_cert = reinterpret_cast<const wl_cert_chain_t *>(white_list_cert);
uint32_t old_cert_size = sizeof(old_cert);
memset(&old_cert, 0, sizeof(old_cert));
if((aesm_read_data(FT_PERSISTENT_STORAGE, AESM_WHITE_LIST_CERT_TO_BE_VERIFY_FID, reinterpret_cast<uint8_t *>(&old_cert), &old_cert_size) == AE_SUCCESS)
&& (old_cert_size == sizeof(old_cert)) && (white_list_cert_size >= sizeof(wl_cert_chain_t)))
{
if(_ntohl(p_new_cert->wl_cert.wl_version) <= _ntohl(old_cert.wl_cert.wl_version))
{
AESM_DBG_WARN("White list version downgraded! current version is %d, new version is %d",
_ntohl(old_cert.wl_cert.wl_version), _ntohl(p_new_cert->wl_cert.wl_version));
return OAL_PARAMETER_ERROR; // OAL_PARAMETER_ERROR used here is to indicate the white list is incorrect
}
}
return aesm_write_data(FT_PERSISTENT_STORAGE, AESM_WHITE_LIST_CERT_TO_BE_VERIFY_FID, white_list_cert, white_list_cert_size);
}
ae_error_t set_psvn(uint16_t prod_id, uint16_t isv_svn, sgx_cpu_svn_t cpu_svn, uint32_t mrsigner_index)
{
if(prod_id == QE_PROD_ID){
if(mrsigner_index == AE_MR_SIGNER){
if(_is_qe_psvn_set){
if(0!=memcmp(&_qe_psvn.isv_svn, &isv_svn, sizeof(isv_svn))||
0!=memcmp(&_qe_psvn.cpu_svn, &cpu_svn, sizeof(sgx_cpu_svn_t))){
AESM_DBG_ERROR("PSVN unmatched for QE/PVE");
return AE_PSVN_UNMATCHED_ERROR;
}
}else{
if(0!=memcpy_s(&_qe_psvn.isv_svn, sizeof(_qe_psvn.isv_svn), &isv_svn, sizeof(isv_svn))||
0!=memcpy_s(&_qe_psvn.cpu_svn, sizeof(_qe_psvn.cpu_svn), &cpu_svn, sizeof(sgx_cpu_svn_t))){
AESM_DBG_ERROR("memcpy failed");
return AE_FAILURE;
}
AESM_DBG_TRACE("get QE or PvE isv_svn=%d",(int)isv_svn);
_is_qe_psvn_set = true;
return AE_SUCCESS;
}
}else if(mrsigner_index==PCE_MR_SIGNER){
if(_is_pce_psvn_set){
if(0!=memcmp(&_pce_psvn.isv_svn, &isv_svn, sizeof(isv_svn))||
0!=memcmp(&_pce_psvn.cpu_svn, &cpu_svn, sizeof(sgx_cpu_svn_t))){
AESM_DBG_ERROR("PSVN unmatched for PCE");
return AE_PSVN_UNMATCHED_ERROR;
}
}else{
if(0!=memcpy_s(&_pce_psvn.isv_svn, sizeof(_pce_psvn.isv_svn), &isv_svn, sizeof(isv_svn))||
0!=memcpy_s(&_pce_psvn.cpu_svn, sizeof(_pce_psvn.cpu_svn), &cpu_svn, sizeof(sgx_cpu_svn_t))){
AESM_DBG_ERROR("memcpy failed");
return AE_FAILURE;
}
AESM_DBG_TRACE("get PCE isv_svn=%d", (int)isv_svn);
_is_pce_psvn_set = true;
return AE_SUCCESS;
}
}
}else if(prod_id == PSE_PROD_ID){
if(mrsigner_index == AE_MR_SIGNER){
if(_is_pse_psvn_set){
if(0!=memcmp(&_pse_psvn.isv_svn, &isv_svn, sizeof(isv_svn))||
0!=memcmp(&_pse_psvn.cpu_svn, &cpu_svn, sizeof(sgx_cpu_svn_t))){
AESM_DBG_ERROR("PSVN unmatched for PSE");
return AE_PSVN_UNMATCHED_ERROR;
}
}else{
if(0!=memcpy_s(&_pse_psvn.isv_svn, sizeof(_pse_psvn.isv_svn), &isv_svn, sizeof(isv_svn))||
0!=memcpy_s(&_pse_psvn.cpu_svn, sizeof(_pse_psvn.cpu_svn), &cpu_svn, sizeof(sgx_cpu_svn_t))){
AESM_DBG_ERROR("memcpy failed");
return AE_FAILURE;
}
AESM_DBG_TRACE("get PSE isv_svn=%d", (int)isv_svn);
_is_pse_psvn_set = true;
return AE_SUCCESS;
}
}
}
return AE_SUCCESS;
}
ae_error_t get_white_list_size_without_lock(uint32_t *white_list_cert_size)
{
uint32_t white_cert_size = 0;
ae_error_t ae_ret = aesm_query_data_size(FT_PERSISTENT_STORAGE, AESM_WHITE_LIST_CERT_FID, &white_cert_size);
if (AE_SUCCESS == ae_ret)
{
if (white_cert_size != 0)
{ //file existing and not 0 size
*white_list_cert_size = white_cert_size;
return AE_SUCCESS;
}
else
return AE_FAILURE;
}
else
{
return ae_ret;
}
}
public:
LeLaunchServiceImp()
: _is_qe_psvn_set(false),
_is_pse_psvn_set(false),
_is_pce_psvn_set(false),
_qe_psvn({0}),
_pce_psvn({0}),
_pse_psvn({0}),
initialized(false)
{
}
ae_error_t start()
{
AESMLogicLock lock(_le_mutex);
ae_error_t ae_ret = AE_SUCCESS;
if (initialized == true)
{
AESM_DBG_INFO("le bundle has been started");
return AE_SUCCESS;
}
AESM_DBG_INFO("Starting le bundle");
ae_ret = CLEClass::instance().load_enclave();
if(AE_SUCCESS != ae_ret)
{
AESM_DBG_INFO("fail to load LE: %d", ae_ret);
AESM_LOG_FATAL("%s", g_event_string_table[SGX_EVENT_SERVICE_UNAVAILABLE]);
return ae_ret;
}
auto context = cppmicroservices::GetBundleContext();
get_service_wrapper(g_network_service, context);
get_service_wrapper(g_launch_service, context);
init_get_launch_token(::get_launch_token);
start_white_list_thread(0);
initialized = true;
AESM_DBG_INFO("le bundle started");
return AE_SUCCESS;
}
void stop()
{
uint64_t stop_tick_count = se_get_tick_count()+500/1000;
white_list_thread.stop_thread(stop_tick_count);
CLEClass::instance().unload_enclave();
initialized = false;
AESM_DBG_INFO("le bundle stopped");
}
aesm_error_t get_launch_token(
const uint8_t *mrenclave, uint32_t mrenclave_size,
const uint8_t *public_key, uint32_t public_key_size,
const uint8_t *se_attributes, uint32_t se_attributes_size,
uint8_t *lictoken, uint32_t lictoken_size)
{
AESM_DBG_INFO("enter function");
if (initialized == false)
return AESM_SERVICE_UNAVAILABLE;
AESMLogicLock lock(_le_mutex);
ae_error_t ret_le = AE_SUCCESS;
if (NULL == mrenclave ||
NULL == public_key ||
NULL == se_attributes ||
NULL == lictoken)
{
// Sizes are checked in get_launch_token_internal()
AESM_DBG_TRACE("Invalid parameter");
return AESM_PARAMETER_ERROR;
}
if (!is_launch_token_required())
{
//Should not be called
AESM_LOG_ERROR("InKernel LE loaded");
return AESM_SERVICE_UNAVAILABLE;
}
ae_error_t ae_ret = CLEClass::instance().load_enclave();
if(ae_ret == AE_SERVER_NOT_AVAILABLE)
{
AESM_LOG_ERROR("%s", g_event_string_table[SGX_EVENT_SERVICE_UNAVAILABLE]);
AESM_DBG_FATAL("LE not loaded due to AE_SERVER_NOT_AVAILABLE, possible SGX Env Not Ready");
return AESM_NO_DEVICE_ERROR;
}
else if(ae_ret == AESM_AE_OUT_OF_EPC)
{
AESM_DBG_ERROR("LE not loaded due to out of EPC");
return AESM_OUT_OF_EPC;
}
else if(AE_FAILED(ae_ret))
{
AESM_DBG_ERROR("LE not loaded:%d", ae_ret);
return AESM_SERVICE_UNAVAILABLE;
}
ret_le = static_cast<ae_error_t>(CLEClass::instance().get_launch_token_internal(
const_cast<uint8_t *>(mrenclave), mrenclave_size,
const_cast<uint8_t *>(public_key), public_key_size,
const_cast<uint8_t *>(se_attributes), se_attributes_size,
lictoken, lictoken_size));
switch (ret_le)
{
case AE_SUCCESS:
return AESM_SUCCESS;
case LE_INVALID_PARAMETER:
AESM_DBG_TRACE("Invalid parameter");
return AESM_PARAMETER_ERROR;
case LE_INVALID_ATTRIBUTE:
case LE_INVALID_PRIVILEGE_ERROR:
AESM_DBG_TRACE("Launch token error");
return AESM_GET_LICENSETOKEN_ERROR;
case LE_WHITELIST_UNINITIALIZED_ERROR:
AESM_DBG_TRACE("LE whitelist uninitialized error");
return AESM_UNEXPECTED_ERROR;
default:
AESM_DBG_WARN("unexpeted error (ae %d)", ret_le);
return AESM_UNEXPECTED_ERROR;
}
}
sgx_status_t get_launch_token(const enclave_css_t* signature,
const sgx_attributes_t* attribute,
sgx_launch_token_t* launch_token)
{
AESM_DBG_INFO("enter function");
if (initialized == false)
return SGX_ERROR_SERVICE_UNAVAILABLE;
AESMLogicLock lock(_le_mutex);
ae_error_t ret_le = AE_SUCCESS;
uint32_t mrsigner_index = UINT32_MAX;
if (!is_launch_token_required())
{
//Should not be called
AESM_LOG_ERROR("InKernel LE loaded");
return SGX_ERROR_SERVICE_UNAVAILABLE;
}
// load LE to get launch token
if((ret_le=CLEClass::instance().load_enclave()) != AE_SUCCESS)
{
if(ret_le == AESM_AE_NO_DEVICE)
{
AESM_LOG_FATAL("LE not loaded due to no SGX device available, possible SGX Env Not Ready");
return SGX_ERROR_NO_DEVICE;
}
else if(ret_le == AESM_AE_OUT_OF_EPC)
{
AESM_LOG_FATAL("LE not loaded due to out of EPC");
return SGX_ERROR_OUT_OF_EPC;
}
else
{
AESM_LOG_FATAL("fail to load LE:%d",ret_le);
return SGX_ERROR_SERVICE_UNAVAILABLE;
}
}
ret_le = static_cast<ae_error_t>(CLEClass::instance().get_launch_token_internal(
const_cast<uint8_t*>(reinterpret_cast<const uint8_t *>(&signature->body.enclave_hash)),
sizeof(sgx_measurement_t),
const_cast<uint8_t*>(reinterpret_cast<const uint8_t *>(&signature->key.modulus)),
sizeof(signature->key.modulus),
const_cast<uint8_t*>(reinterpret_cast<const uint8_t *>(attribute)),
sizeof(sgx_attributes_t),
reinterpret_cast<uint8_t*>(launch_token),
sizeof(token_t),
&mrsigner_index));
switch (ret_le)
{
case AE_SUCCESS:
break;
case LE_INVALID_PARAMETER:
AESM_DBG_TRACE("Invalid parameter");
return SGX_ERROR_INVALID_PARAMETER;
case LE_INVALID_ATTRIBUTE:
case LE_INVALID_PRIVILEGE_ERROR:
AESM_DBG_TRACE("Launch token error");
return SGX_ERROR_SERVICE_INVALID_PRIVILEGE;
case LE_WHITELIST_UNINITIALIZED_ERROR:
AESM_DBG_TRACE("LE whitelist uninitialized error");
return SGX_ERROR_UNEXPECTED;
default:
AESM_DBG_WARN("unexpected error (ae%d)", ret_le);
return SGX_ERROR_UNEXPECTED;
}
token_t *lt = reinterpret_cast<token_t *>(launch_token);
ret_le = set_psvn(signature->body.isv_prod_id, signature->body.isv_svn, lt->cpu_svn_le, mrsigner_index);
if(AE_PSVN_UNMATCHED_ERROR == ret_le)
{
//QE or PSE has been changed, but AESM doesn't restart. Will not provide service.
return SGX_ERROR_SERVICE_UNAVAILABLE;
}else if(AE_SUCCESS != ret_le) {
AESM_DBG_ERROR("fail to save psvn:(ae%d)", ret_le);
return SGX_ERROR_UNEXPECTED;
}
return SGX_SUCCESS;
}
aesm_error_t get_white_list(
uint8_t *white_list_cert, uint32_t buf_size)
{
uint32_t white_cert_size = 0;
if (initialized == false)
return AESM_SERVICE_UNAVAILABLE;
if (NULL == white_list_cert)
return AESM_PARAMETER_ERROR;
AESMLogicLock lock(_le_mutex);
if (!is_launch_token_required())
{
AESM_LOG_INFO("InKernel LE loaded");
return AESM_SERVICE_UNAVAILABLE;
}
ae_error_t ae_ret = get_white_list_size_without_lock(&white_cert_size);
if (AE_SUCCESS != ae_ret)
return AESM_UNEXPECTED_ERROR;
if (white_cert_size != buf_size)
{
return AESM_PARAMETER_ERROR;
}
ae_ret = aesm_read_data(FT_PERSISTENT_STORAGE, AESM_WHITE_LIST_CERT_FID, white_list_cert, &white_cert_size);
if (AE_SUCCESS != ae_ret)
{
AESM_DBG_WARN("Fail to read white cert list file");
return AESM_UNEXPECTED_ERROR;
}
return AESM_SUCCESS;
}
aesm_error_t get_white_list_size(
uint32_t *white_list_cert_size)
{
if (initialized == false)
return AESM_SERVICE_UNAVAILABLE;
if (NULL == white_list_cert_size)
return AESM_PARAMETER_ERROR;
AESMLogicLock lock(_le_mutex);
if (!is_launch_token_required())
{
AESM_LOG_INFO("InKernel LE loaded");
return AESM_SERVICE_UNAVAILABLE;
}
ae_error_t ae_ret = get_white_list_size_without_lock(white_list_cert_size);
if (AE_SUCCESS == ae_ret)
return AESM_SUCCESS;
else
return AESM_UNEXPECTED_ERROR;
}
aesm_error_t white_list_register(
const uint8_t *white_list_cert,
uint32_t white_list_cert_size)
{
AESM_DBG_INFO("enter function");
if (initialized == false)
return AESM_SERVICE_UNAVAILABLE;
AESM_LOG_INFO_ADMIN("%s", g_admin_event_string_table[SGX_ADMIN_EVENT_WL_UPDATE_START]);
AESMLogicLock lock(_le_mutex);
ae_error_t ret_le = AE_SUCCESS;
aesm_error_t ret = AESM_UNEXPECTED_ERROR;
if (NULL == white_list_cert || 0 == white_list_cert_size)
{
AESM_DBG_TRACE("Invalid parameter");
AESM_LOG_ERROR_ADMIN("%s", g_admin_event_string_table[SGX_ADMIN_EVENT_WL_UPDATE_FAIL]);
return AESM_PARAMETER_ERROR;
}
if (!is_launch_token_required())
{
AESM_DBG_INFO("InKernel LE loaded");
return AESM_SERVICE_UNAVAILABLE;
}
ae_error_t ae_ret = CLEClass::instance().load_enclave();
if (AE_FAILED(ae_ret))
{
switch (ae_ret)
{
case AE_SERVER_NOT_AVAILABLE:
AESM_DBG_WARN("LE not loaded due to AE_SERVER_NOT_AVAILABLE, possible SGX Env Not Ready");
ret_le = save_unverified_white_list(white_list_cert, white_list_cert_size);
break;
case AESM_AE_OUT_OF_EPC:
AESM_DBG_WARN("LE not loaded due to out of EPC");
ret = AESM_OUT_OF_EPC;
goto exit;
default:
AESM_DBG_ERROR("LE not loaded:(ae%d)", ae_ret);
ret = AESM_UNEXPECTED_ERROR;
goto exit;
}
}
else
{
ret_le = static_cast<ae_error_t>(CLEClass::instance().white_list_register(
white_list_cert, white_list_cert_size, true));
}
switch (ret_le)
{
case AE_SUCCESS:
ret = AESM_SUCCESS;
break;
case LE_INVALID_PARAMETER:
AESM_DBG_TRACE("Invalid parameter");
ret = AESM_PARAMETER_ERROR;
break;
default:
AESM_DBG_WARN("unexpeted error (ae %d)", ret_le);
ret = AESM_UNEXPECTED_ERROR;
break;
}
exit:
// Always log success or failure to the Admin log before returning
if (AE_FAILED(ae_ret) || AE_FAILED(ret_le))
{
AESM_LOG_ERROR_ADMIN("%s", g_admin_event_string_table[SGX_ADMIN_EVENT_WL_UPDATE_FAIL]);
} else {
const wl_cert_chain_t* wl = reinterpret_cast<const wl_cert_chain_t*>(white_list_cert);
AESM_LOG_INFO_ADMIN("%s for Version: %d", g_admin_event_string_table[SGX_ADMIN_EVENT_WL_UPDATE_SUCCESS],
_ntohl(wl->wl_cert.wl_version));
}
return ret;
}
};
class Activator : public BundleActivator
{
void Start(BundleContext ctx)
{
auto service = std::make_shared<LeLaunchServiceImp>();
ctx.RegisterService<ILaunchService>(service);
}
void Stop(BundleContext)
{
// Nothing to do
}
};
CPPMICROSERVICES_EXPORT_BUNDLE_ACTIVATOR(Activator)
// [no-cmake]
// The code below is required if the CMake
// helper functions are not used.
#ifdef NO_CMAKE
CPPMICROSERVICES_INITIALIZE_BUNDLE(le_launch_service_bundle_name)
#endif
psw/ae/aesm_service/source/bundles/le_launch_service_bundle/manifest.json
-7
View File
@@ -1,7 +0,0 @@
{
"bundle.symbolic_name" : "le_launch_service_symbolic_name",
"bundle.activator" : true,
"bundle.name" : "LE Launch Service",
"bundle.description" : "This bundle provide LE launch Service",
"bundle.version" : "2.0.0"
}
psw/ae/aesm_service/source/common/aesm_quoting_type.h
+1 -1
View File
@@ -31,7 +31,7 @@
#ifndef __AESM_QUOTING_TYPE_H__
#define __AESM_QUOTING_TYPE_H__
#define AESM_QUOTING_TYPE_ECDSA256 2 // Should has same value as SGX_QL_ALG_ECDSA_P256
#define AESM_QUOTING_TYPE_ECDSA256 0 // There is only one entry in quoting_type_name list now
#define AESM_QUOTING_DEFAULT_VALUE AESM_QUOTING_TYPE_ECDSA256
#endif
psw/ae/aesm_service/source/common/oal/aesm_persistent_storage.h
-8
View File
@@ -49,14 +49,8 @@ typedef enum _aesm_data_type_t{
/*please refer to persistent_storage_table.cpp for more detail information about persistent storages*/
typedef enum _aesm_data_id_t{
/*first encalve files*/
LE_ENCLAVE_FID,
PCE_ENCLAVE_FID,
LE_PROD_SIG_STRUCT_FID,
/*some special files where pathname could be used directly inside AESM*/
VMC_DATABASE_FID,
VMC_DATABASE_BK_FID,
VMC_DATABASE_PREBUILD_FID,
PSDA_FID,
NETWORK_SETTING_FID,
#ifdef DBG_LOG
AESM_DBG_LOG_FID,
@@ -65,8 +59,6 @@ typedef enum _aesm_data_id_t{
#ifdef _PROFILE_
AESM_PERF_DATA_FID,
#endif
AESM_WHITE_LIST_CERT_FID,
AESM_WHITE_LIST_CERT_TO_BE_VERIFY_FID,
NUMBER_OF_FIDS
} aesm_data_id_t;
psw/ae/aesm_service/source/core/AESMLogicWrapper.cpp
-1
View File
@@ -597,6 +597,5 @@ void AESMLogicWrapper::service_stop()
#if !defined(US_BUILD_SHARED_LIBS)
CPPMICROSERVICES_IMPORT_BUNDLE(pce_service_bundle_name)
CPPMICROSERVICES_IMPORT_BUNDLE(ecdsa_quote_service_bundle_name)
CPPMICROSERVICES_IMPORT_BUNDLE(le_launch_service_bundle_name)
CPPMICROSERVICES_IMPORT_BUNDLE(linux_network_service_bundle_name)
#endif
psw/ae/aesm_service/source/oal/linux/persistent_storage_table.cpp
-16
View File
@@ -35,17 +35,7 @@
//The ordering of the array must be same as the enumerartion aesm_data_id_t
static const persistent_storage_info_t psinfos[]={
#ifdef REF_LE
{ FT_ENCLAVE_NAME, AESM_LOCATION_EXE_FOLDER, AESM_FILE_ACCESS_PATH_ONLY, "libsgx_ref_le.signed.so" },//LE_ENCLAVE_FID
#else
{ FT_ENCLAVE_NAME, AESM_LOCATION_EXE_FOLDER, AESM_FILE_ACCESS_PATH_ONLY, "libsgx_le.signed.so." LE_VERSION },//LE_ENCLAVE_FID
#endif // REF_LE
{FT_ENCLAVE_NAME, AESM_LOCATION_EXE_FOLDER, AESM_FILE_ACCESS_PATH_ONLY, "libsgx_pce.signed.so." PCE_VERSION}, //PCE_ENCLAVE_FID
{FT_PERSISTENT_STORAGE, AESM_LOCATION_EXE_FOLDER, AESM_FILE_ACCESS_PATH_ONLY, "le_prod_css.bin"},//LE_PROD_SIG_STRUCT_FID
{FT_PERSISTENT_STORAGE, AESM_LOCATION_DATA, AESM_FILE_ACCESS_PATH_ONLY, "pse_vmc.db"},//VMC_DATABASE_FID
{FT_PERSISTENT_STORAGE, AESM_LOCATION_DATA, AESM_FILE_ACCESS_PATH_ONLY, "backup_pse_vmc.db"},//VMC_DATABASE_BK_FID
{FT_PERSISTENT_STORAGE, AESM_LOCATION_DATA, AESM_FILE_ACCESS_PATH_ONLY, "prebuild_pse_vmc.db"},//VMC_DATABASE_PREBUILD_FID
{FT_PERSISTENT_STORAGE, AESM_LOCATION_EXE_FOLDER, AESM_FILE_ACCESS_PATH_ONLY, "PSDA.dalp"}, //PSDA_FID, path only information?
{FT_PERSISTENT_STORAGE, AESM_LOCATION_DATA, AESM_FILE_ACCESS_ALL, "aesm_network_setting.blob"},//NETWORK_SETTING_FID
#ifdef DBG_LOG
{FT_PERSISTENT_STORAGE, AESM_LOCATION_DATA, AESM_FILE_ACCESS_ALL, "internal_log.txt"}, //AESM_DBG_LOG_FID
@@ -54,12 +44,6 @@ static const persistent_storage_info_t psinfos[]={
#ifdef _PROFILE_
{FT_PERSISTENT_STORAGE, AESM_LOCATION_DATA, AESM_FILE_ACCESS_ALL, "perf_time.csv"}, //AESM_PERF_DATA_FID
#endif
#ifdef REF_LE
{ FT_PERSISTENT_STORAGE, AESM_LOCATION_DATA, AESM_FILE_ACCESS_ALL, "ref_white_list.bin" },//AESM_WHITE_LIST_CERT_FID
#else
{FT_PERSISTENT_STORAGE, AESM_LOCATION_DATA, AESM_FILE_ACCESS_ALL, "white_list_cert.bin"},//AESM_WHITE_LIST_CERT_FID
#endif // REF_LE
{FT_PERSISTENT_STORAGE, AESM_LOCATION_DATA, AESM_FILE_ACCESS_ALL, "white_list_cert_to_be_verify.bin"},//AESM_WHITE_LIST_CERT_TO_BE_VERIFY_FID
};
se_static_assert(sizeof(psinfos)/sizeof(persistent_storage_info_t) == NUMBER_OF_FIDS);
psw/ae/data/constants/linux/launch_enclave_mrsigner.hh
-46
View File
@@ -1,46 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef _LANCH_ENCLAVE_MRSIGNER_HH_
#define _LANCH_ENCLAVE_MRSIGNER_HH_
const sgx_measurement_t g_le_mrsigner[] =
{
{
{
/* SHA256 of SGXLaunchEnclave release signing key*/
0xac, 0xb7, 0x70, 0x12, 0x05, 0x3e, 0x05, 0xa6,
0x3d, 0x41, 0x3b, 0x8b, 0xba, 0xe8, 0xfb, 0x6c,
0x5d, 0x73, 0xb3, 0xf2, 0x99, 0x6d, 0x91, 0xc4,
0x3b, 0xbb, 0xf9, 0x09, 0x59, 0xc0, 0xf8, 0xd4
}
}
};
#endif
psw/ae/data/prebuilt/le_prod_css.bin
BIN
View File
Binary file not shown.
psw/ae/data/prebuilt/white_list_cert_to_be_verify.bin
BIN
View File
Binary file not shown.
psw/ae/inc/internal/ref_le.h
-65
View File
@@ -1,65 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef _REF_LE_H_
#define _REF_LE_H_
#include "aeerror.h"
#include "arch.h"
#include "sgx_tcrypto.h"
// calculate the white list size
#define REF_LE_WL_SIZE(entries) ((uint32_t)(sizeof(ref_le_white_list_t) + entries * sizeof(ref_le_white_list_entry_t)))
/* All fields are big endian */
#pragma pack(push, 1)
typedef struct _ref_le_white_list_entry_t
{
uint8_t provision_key;
uint8_t match_mr_enclave;
uint8_t reserved[6]; // align the measurment on 64 bits
sgx_measurement_t mr_signer;
sgx_measurement_t mr_enclave;
} ref_le_white_list_entry_t;
typedef struct _ref_le_white_list_t
{
uint16_t version;
uint32_t wl_version;
uint16_t entries_count;
sgx_rsa3072_public_key_t signer_pubkey;
ref_le_white_list_entry_t wl_entries[];
} ref_le_white_list_t;
#pragma pack(pop)
#endif
psw/ae/le/Makefile
-76
View File
@@ -1,76 +0,0 @@
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
TOP_DIR := ../../..
include ../buildenv.mk
AENAME = launch_enclave
CFLAGS += -Werror
CXXFLAGS += -Werror
INCLUDE += -I$(LINUX_PSW_DIR)/ae/common
INCLUDE += -I$(LINUX_PSW_DIR)/ae/data/constants/linux
INCLUDE += -I$(SGX_HEADER_DIR)/libcxx
SRC := $(wildcard *.cpp)
OBJ := $(SRC:.cpp=.o)
OBJS := $(sort $(OBJ) version.o)
AENAME_OUT := $(SONAME) #generate $(SONAME) only but do not sign it
.PHONY: all
all: $(AENAME_OUT)
$(SONAME): $(OBJS)
$(CXX) $(CXXFLAGS) -o $@ $(OBJS) -nostdlib -nodefaultlibs -nostartfiles -Wl,-soname=libsgx_$(AENAME).signed.so.$(call get_major_version,LE_VERSION) $(LDTFLAGS)
$(STRIP) --strip-unneeded --remove-section=.comment --remove-section=.note $(SONAME)
$(OBJ):$(AENAME)_t.c
$(OBJ): %.o:%.cpp
$(CXX) $(CXXFLAGS) -fno-exceptions -fno-rtti $(INCLUDE) $(DEFINES) -c $< -o $@
$(AENAME)_t.c: $(EDLFILE)
@$(EDGER8R) --trusted $< --search-path $(SGX_HEADER_DIR)
$(BUILD_DIR):
@$(MKDIR) $@
.PHONY: clean
clean:
@$(RM) *.o
@$(RM) *.so
@$(RM) *.map
@$(RM) *_t.*
.PHONY: rebuild
rebuild:
$(MAKE) clean
$(MAKE) all
psw/ae/le/config.xml
-18
View File
@@ -1,18 +0,0 @@
<EnclaveConfiguration>
<IntelSigned>1</IntelSigned>
<ProvisionKey>0</ProvisionKey>
<LaunchKey>1</LaunchKey>
<ProdID>0x20</ProdID>
<ISVSVN>7</ISVSVN>
<TCSNum>1</TCSNum>
<TCSMinPool>0</TCSMinPool>
<TCSPolicy>1</TCSPolicy>
<StackMaxSize>0x3000</StackMaxSize>
<StackMinSize>0x3000</StackMinSize>
<HeapMaxSize>0x20000</HeapMaxSize>
<HeapMinSize>0x20000</HeapMinSize>
<HW>0x02</HW>
<DisableDebug>1</DisableDebug>
<ReleaseType>1</ReleaseType>
<EnableIPPFIPS>1</EnableIPPFIPS>
</EnclaveConfiguration>
psw/ae/le/config_prod.xml
-17
View File
@@ -1,17 +0,0 @@
<EnclaveConfiguration>
<IntelSigned>1</IntelSigned>
<ProvisionKey>0</ProvisionKey>
<LaunchKey>1</LaunchKey>
<ProdID>0x20</ProdID>
<ISVSVN>7</ISVSVN>
<TCSNum>1</TCSNum>
<TCSMinPool>0</TCSMinPool>
<TCSPolicy>1</TCSPolicy>
<StackMaxSize>0x3000</StackMaxSize>
<StackMinSize>0x3000</StackMinSize>
<HeapMaxSize>0x20000</HeapMaxSize>
<HeapMinSize>0x20000</HeapMinSize>
<HW>0x10</HW>
<DisableDebug>1</DisableDebug>
<EnableIPPFIPS>1</EnableIPPFIPS>
</EnclaveConfiguration>
psw/ae/le/launch_enclave.cpp
-611
View File
@@ -1,611 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#include <sgx_secure_align.h>
#include <stdlib.h>
#include "launch_enclave.h"
#include "byte_order.h"
#include "sgx_utils.h"
#include "launch_enclave_t.c"
#include "wl_pub.hh"
#include "launch_enclave_mrsigner.hh"
#include "service_enclave_mrsigner.hh"
#include "tseal_migration_attr.h"
#if !defined(SWAP_ENDIAN_DW)
#define SWAP_ENDIAN_DW(dw) ((((dw) & 0x000000ff) << 24) \
| (((dw) & 0x0000ff00) << 8) \
| (((dw) & 0x00ff0000) >> 8) \
| (((dw) & 0xff000000) >> 24))
#endif
#if !defined(SWAP_ENDIAN_32B)
#define SWAP_ENDIAN_8X32B(ptr) \
{ \
uint32_t temp = 0; \
temp = SWAP_ENDIAN_DW(((uint32_t*)(ptr))[0]); \
((uint32_t*)(ptr))[0] = SWAP_ENDIAN_DW(((uint32_t*)(ptr))[7]); \
((uint32_t*)(ptr))[7] = temp; \
temp = SWAP_ENDIAN_DW(((uint32_t*)(ptr))[1]); \
((uint32_t*)(ptr))[1] = SWAP_ENDIAN_DW(((uint32_t*)(ptr))[6]); \
((uint32_t*)(ptr))[6] = temp; \
temp = SWAP_ENDIAN_DW(((uint32_t*)(ptr))[2]); \
((uint32_t*)(ptr))[2] = SWAP_ENDIAN_DW(((uint32_t*)(ptr))[5]); \
((uint32_t*)(ptr))[5] = temp; \
temp = SWAP_ENDIAN_DW(((uint32_t*)(ptr))[3]); \
((uint32_t*)(ptr))[3] = SWAP_ENDIAN_DW(((uint32_t*)(ptr))[4]); \
((uint32_t*)(ptr))[4] = temp; \
}
#endif
#define LE_MAX_MRSIGNER_NUMBER 2048
// Macro used to get mac wl cert size, signature is not included
#define LE_MAX_WL_CERT_SIZE (sizeof(wl_cert_t) + LE_MAX_MRSIGNER_NUMBER \
* sizeof(sgx_measurement_t))
#define WL_CERT_VERSION 0x0100
#define WL_CERT_TYPE 0x0100
#define WL_CERT_PROVIDER_ID 0
#define WL_PROVIDER_CERT_VERSION 0x0100
#define WL_PROVIDER_CERT_TYPE 0
#define WL_PROVIDER_CERT_PROVIDER_ID 0
#define WL_PROVIDER_CERT_ROOT_ID 0
static uint8_t g_wl_cert_buf[LE_MAX_WL_CERT_SIZE] = {0};
static void reverse_byte_array(uint8_t *array, size_t size)
{
size_t i = 0;
for(i = 0; i < size / 2; i++)
{
uint8_t temp = array[i];
array[i] = array[size - i - 1];
array[size - i - 1] = temp;
}
}
//calculate launch token. key_id, attributes_le and then mac is updated.
//return AE_SUCCESS on success
static ae_error_t le_calc_lic_token(token_t* lictoken)
{
//calculate launch token
sgx_key_request_t key_request;
//
// securely align launch key
//
// sgx_key_128bit_t launch_key;
sgx::custom_alignment_aligned<sgx_key_128bit_t, sizeof(sgx_key_128bit_t), 0, sizeof(sgx_key_128bit_t)> olaunch_key;
sgx_key_128bit_t& launch_key = olaunch_key.v;
if(SGX_SUCCESS != sgx_read_rand((uint8_t*)&lictoken->key_id,
sizeof(sgx_key_id_t)))
{
return LE_UNEXPECTED_ERROR;
}
// Create Key Request
memset(&key_request, 0, sizeof(key_request));
//setup key_request parameters to derive launch key
key_request.key_name = SGX_KEYSELECT_EINITTOKEN;
memcpy(&key_request.key_id, &lictoken->key_id,
sizeof(key_request.key_id));
memcpy(&key_request.cpu_svn, &(lictoken->cpu_svn_le),
sizeof(key_request.cpu_svn));
memcpy(&key_request.isv_svn, &(lictoken->isv_svn_le),
sizeof(key_request.isv_svn));
key_request.attribute_mask.xfrm = 0;
//0xFFFFFFFFFFFFFFFB: ~SGX_FLAGS_MODE64BIT
key_request.attribute_mask.flags = ~SGX_FLAGS_MODE64BIT;
key_request.misc_mask = 0xFFFFFFFF;
lictoken->masked_misc_select_le &= key_request.misc_mask;
lictoken->attributes_le.flags = (lictoken->attributes_le.flags)
& (key_request.attribute_mask.flags);
lictoken->attributes_le.xfrm = (lictoken->attributes_le.xfrm)
& (key_request.attribute_mask.xfrm);
// EGETKEY
sgx_status_t sgx_ret = sgx_get_key(&key_request,&launch_key);
if(SGX_SUCCESS != sgx_ret)
{
return LE_GET_EINITTOKEN_KEY_ERROR;
}
sgx_cmac_state_handle_t p_cmac_handle = NULL;
do{
sgx_ret = sgx_cmac128_init(&launch_key, &p_cmac_handle);
if(SGX_SUCCESS != sgx_ret)
{
break;
}
sgx_ret = sgx_cmac128_update((uint8_t*)&lictoken->body,
sizeof(lictoken->body),
p_cmac_handle);
if(SGX_SUCCESS != sgx_ret)
{
break;
}
sgx_ret = sgx_cmac128_final(p_cmac_handle,
(sgx_cmac_128bit_tag_t*)&lictoken->mac);
}while(0);
if (p_cmac_handle != NULL)
{
sgx_cmac128_close(p_cmac_handle);
}
//clear launch_key after being used
memset_s(launch_key,sizeof(launch_key), 0, sizeof(launch_key));
if (SGX_SUCCESS != sgx_ret)
{
return AE_FAILURE;
}
return AE_SUCCESS;
}
ae_error_t le_generate_launch_token(
const sgx_measurement_t* mrenclave,
const sgx_measurement_t* mrsigner,
const sgx_attributes_t* se_attributes,
token_t* lictoken)
{
uint32_t i = 0;
bool is_production = false;
sgx_status_t sgx_ret = SGX_ERROR_UNEXPECTED;
ae_error_t ae_ret = AE_FAILURE;
wl_cert_t *p_wl_cert_cache = (wl_cert_t *)g_wl_cert_buf;
sgx_measurement_t empty_mrsigner;
sgx_report_t report;
// Check the reserved bits which have security implications.
if((se_attributes->flags) & FLAGS_SECURITY_BITS_RESERVED)
{
return LE_INVALID_ATTRIBUTE;
}
memset(&report, 0, sizeof(report));
// Create report to get current cpu_svn and isv_svn.
sgx_ret = sgx_create_report(NULL, NULL, &report);
if(SGX_SUCCESS != sgx_ret)
{
return LE_UNEXPECTED_ERROR;
}
for(i = 0; i < (sizeof(g_le_mrsigner) / sizeof(g_le_mrsigner[0])); i++)
{
if(0 == memcmp(&(g_le_mrsigner[i]), &(report.body.mr_signer),
sizeof(g_le_mrsigner[0])))
{
is_production = true;
break;
}
}
if(true == is_production)
{
// Only Provision Enclave is allowed to be EINITed with the privilege
// to access the PROVISIONKEY, which is signed with fixed signing key
if((se_attributes->flags & SGX_FLAGS_PROVISION_KEY))
{
for(i = 0; i < (sizeof(G_SERVICE_ENCLAVE_MRSIGNER) / sizeof(G_SERVICE_ENCLAVE_MRSIGNER[0]));
i++)
{
if(0 == memcmp(&G_SERVICE_ENCLAVE_MRSIGNER[i], mrsigner,
sizeof(G_SERVICE_ENCLAVE_MRSIGNER[0])))
{
break;
}
}
if(i == sizeof(G_SERVICE_ENCLAVE_MRSIGNER) / sizeof(G_SERVICE_ENCLAVE_MRSIGNER[0]))
{
return LE_INVALID_ATTRIBUTE;
}
}
}
// on "production" system, enclaves to be launched in "non-enclave-debug"
// mode are subjected to Enclave Signing Key White Listing control.
if(((se_attributes->flags & SGX_FLAGS_DEBUG) == 0)
&& (true == is_production))
{
// Check whether the wl is initialized
if(p_wl_cert_cache->version == 0)
{
return LE_WHITELIST_UNINITIALIZED_ERROR;
}
// Create an empty mrsigner
memset(&empty_mrsigner, 0, sizeof(empty_mrsigner));
// Check if p_wl_cert_cache->mr_signer_list[0] is empty.
// If mr_signer_list[0] = 0, a "wild card" white list cert is in-use,
// meant to allow any enclave to launch.
if(0 != memcmp(&(p_wl_cert_cache->mr_signer_list[0]), &empty_mrsigner,
sizeof(p_wl_cert_cache->mr_signer_list[0])))
{
for(i = 0; i < p_wl_cert_cache->entry_number; i++)
{
if(0 == memcmp(&(p_wl_cert_cache->mr_signer_list[i]),
mrsigner,
sizeof(p_wl_cert_cache->mr_signer_list[i])))
{
break;
}
}
if(i == p_wl_cert_cache->entry_number)
{
return LE_INVALID_PRIVILEGE_ERROR;
}
}
}
//initial EINIT Token and set 0 for all reserved area
memset(lictoken, 0, sizeof(*lictoken));
//set the EINIT Token valid
lictoken->body.valid = 1;
//set EINIT Token mrenclave
memcpy(&lictoken->body.mr_enclave, mrenclave,
sizeof(lictoken->body.mr_enclave));
//set EINIT Token mrsigner
memcpy(&lictoken->body.mr_signer, mrsigner,
sizeof(lictoken->body.mr_signer));
//set EINIT Token attributes
memcpy(&lictoken->body.attributes, se_attributes,
sizeof(lictoken->body.attributes));
//set EINIT Token with platform information from ereport of LE
memcpy(&lictoken->cpu_svn_le, &report.body.cpu_svn, sizeof(sgx_cpu_svn_t));
lictoken->isv_svn_le = report.body.isv_svn;
lictoken->isv_prod_id_le = report.body.isv_prod_id;
//will mask attributes in le_calc_lic_token
memcpy(&lictoken->attributes_le, &report.body.attributes,
sizeof(lictoken->attributes_le));
//will mask misc_select_le in le_calc_lic_token
lictoken->masked_misc_select_le = report.body.misc_select;
//calculate EINIT Token
ae_ret = le_calc_lic_token(lictoken);
//if failure, clear EINIT Token
if (ae_ret != AE_SUCCESS)
{
memset_s(lictoken,sizeof(*lictoken), 0, sizeof(*lictoken));
}
return ae_ret;
}
int le_get_launch_token_wrapper(
const sgx_measurement_t* mrenclave,
const sgx_measurement_t* mrsigner,
const sgx_attributes_t* se_attributes,
token_t* lictoken)
{
// Security assumption is that the edgr8r generated trusted bridge code
// makes sure mrenclave, mrsigner, se_attributes, lictoken buffers are all
// inside enclave. check all input and output pointers, defense in depth
if (NULL == mrenclave ||
NULL == mrsigner ||
NULL == se_attributes ||
NULL == lictoken)
{
return LE_INVALID_PARAMETER;
}
return le_generate_launch_token(mrenclave, mrsigner, se_attributes,
lictoken);
}
/*
* Internal function used to init white list. It will check the content of the
* cert chain, and verify the signature of input cert chains. If no problem,
* it will cache the input white list into EPC.
*
* @param p_wl_cert_chain[in] Pointer to the white list cert chain.
* @param entry_number[in] The entry number within the white list.
* @param wl_cert_chain_size[in] The size of white list cert chain, in bytes.
* @return uint32_t AE_SUCCESS for success, otherwise for errors.
*/
uint32_t le_init_white_list(
const wl_cert_chain_t *p_wl_cert_chain,
uint32_t entry_number,
uint32_t wl_cert_chain_size)
{
sgx_status_t sgx_ret = SGX_SUCCESS;
uint32_t ret = AE_SUCCESS;
uint32_t new_wl_version = 0;
uint8_t verify_result = 0;
int valid = 0;
const uint8_t *buf = NULL;
uint32_t buf_size = 0;
sgx_prod_id_t wl_prod_id = 0;
sgx_ecc_state_handle_t ecc_handle = NULL;
wl_cert_t *p_wl_cert_cache = (wl_cert_t *)g_wl_cert_buf;
sgx_report_t report;
sgx_ec256_signature_t wl_signature;
sgx_ec256_public_t wl_pubkey;
// Check fields of provider cert
// Format version should be 1 (big endian)
if(p_wl_cert_chain->wl_provider_cert.version != WL_PROVIDER_CERT_VERSION)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// For Enclave Signing Key White List Cert, must be 0
if(p_wl_cert_chain->wl_provider_cert.cert_type != WL_PROVIDER_CERT_TYPE)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// only one White List Provider is approved:
// WLProviderID: ISecG = 0
if(p_wl_cert_chain->wl_provider_cert.provider_id != WL_PROVIDER_CERT_PROVIDER_ID)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// only one WLRootID is valid: WLRootID-iKGF-Key-0 = 0
if(p_wl_cert_chain->wl_provider_cert.root_id != WL_PROVIDER_CERT_ROOT_ID)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// Check fields of wl cert
// only valid version is 1
if(p_wl_cert_chain->wl_cert.version != WL_CERT_VERSION)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// For Enclave Signing Key White List Cert, must be 1
if(p_wl_cert_chain->wl_cert.cert_type != WL_CERT_TYPE)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// only one White List Provider is approved:
// WLProviderID: ISecG = 0
if(p_wl_cert_chain->wl_cert.provider_id != WL_CERT_PROVIDER_ID)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// If cache exists
new_wl_version = p_wl_cert_chain->wl_cert.wl_version;
new_wl_version = _ntohl(new_wl_version);
if(p_wl_cert_cache->version != 0)
{
// the logic will be needed to support more than
// one providers in the future.
//if(p_wl_cert_chain->wl_cert.provider_id
// != p_wl_cert_cache->provider_id)
//{
// ret = LE_INVALID_PARAMETER;
// goto CLEANUP;
//}
if(new_wl_version <= p_wl_cert_cache->wl_version)
{
ret = LE_WHITE_LIST_ALREADY_UPDATED;
goto CLEANUP;
}
}
sgx_ret = sgx_ecc256_open_context(&ecc_handle);
if (SGX_SUCCESS != sgx_ret)
{
ret = LE_UNEXPECTED_ERROR;
goto CLEANUP;
}
memset(&wl_signature, 0, sizeof(wl_signature));
// Convert the signature of provider cert into little endian
memcpy(&wl_signature,
&(p_wl_cert_chain->wl_provider_cert.signature),
sizeof(wl_signature));
SWAP_ENDIAN_8X32B(wl_signature.x);
SWAP_ENDIAN_8X32B(wl_signature.y);
// Verify the wl provider cert
buf = (const uint8_t *)&(p_wl_cert_chain->wl_provider_cert);
buf_size = static_cast<uint32_t>(sizeof(p_wl_cert_chain->wl_provider_cert)
- sizeof(p_wl_cert_chain->wl_provider_cert.signature));
sgx_ret = sgx_ecdsa_verify(buf, buf_size,
&g_wl_root_pubkey,
&wl_signature,
&verify_result,
ecc_handle);
if (SGX_SUCCESS != sgx_ret)
{
ret = LE_UNEXPECTED_ERROR;
goto CLEANUP;
}
if(SGX_EC_VALID != verify_result)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// Convert the signature of wl cert into little endian
buf = (const uint8_t *)p_wl_cert_chain + wl_cert_chain_size
- sizeof(wl_signature);
memcpy(&wl_signature, buf, sizeof(wl_signature));
SWAP_ENDIAN_8X32B(wl_signature.x);
SWAP_ENDIAN_8X32B(wl_signature.y);
// Convert the pubkey into little endian
memset(&wl_pubkey, 0, sizeof(wl_pubkey));
memcpy(&wl_pubkey,
&(p_wl_cert_chain->wl_provider_cert.pub_key),
sizeof(wl_pubkey));
reverse_byte_array(wl_pubkey.gx, sizeof(wl_pubkey.gx));
reverse_byte_array(wl_pubkey.gy, sizeof(wl_pubkey.gy));
// Check whether the pubkey is valid first.
sgx_ret = sgx_ecc256_check_point(&wl_pubkey, ecc_handle, &valid);
if(SGX_SUCCESS != sgx_ret)
{
ret = LE_UNEXPECTED_ERROR;
goto CLEANUP;
}
if(!valid)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// Verify the wl_cert
buf = (const uint8_t *)&(p_wl_cert_chain->wl_cert);
buf_size = wl_cert_chain_size - static_cast<uint32_t>(sizeof(wl_provider_cert_t) + sizeof(sgx_ec256_signature_t));
sgx_ret = sgx_ecdsa_verify(buf, buf_size,
&wl_pubkey,
&wl_signature,
&verify_result,
ecc_handle);
if (SGX_SUCCESS != sgx_ret)
{
ret = LE_UNEXPECTED_ERROR;
goto CLEANUP;
}
if(SGX_EC_VALID != verify_result)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
memset(&report, 0, sizeof(report));
// Create report to get current mrsigner.
sgx_ret = sgx_create_report(NULL, NULL, &report);
if(SGX_SUCCESS != sgx_ret)
{
ret = LE_UNEXPECTED_ERROR;
goto CLEANUP;
}
// Convert the big endian prod id to little endian.
wl_prod_id = p_wl_cert_chain->wl_cert.le_prod_id;
wl_prod_id = _ntohs(wl_prod_id);
if(report.body.isv_prod_id != wl_prod_id)
{
ret = LE_INVALID_PARAMETER;
goto CLEANUP;
}
// Cache the wl cert
memset(g_wl_cert_buf, 0, sizeof(g_wl_cert_buf));
memcpy(g_wl_cert_buf, &(p_wl_cert_chain->wl_cert), buf_size);
// Change entry_number and wl_version to little endian, so we don't need to
// convert them next time.
p_wl_cert_cache->entry_number = entry_number;
p_wl_cert_cache->wl_version = new_wl_version;
CLEANUP:
if(ecc_handle != NULL)
{
sgx_ecc256_close_context(ecc_handle);
}
return ret;
}
/*
* External function used to init white list. It will check whether the input
* buffer is correctly copied into EPC, and check the size of the buffer.
*
* @param wl_cert_chain[in] Pointer to the white list cert chain.
* @param wl_cert_chain_size[in] The size of white list cert chain, in bytes.
* @return uint32_t AE_SUCCESS for success, otherwise for errors.
*/
uint32_t le_init_white_list_wrapper(
const uint8_t *wl_cert_chain,
uint32_t wl_cert_chain_size)
{
const wl_cert_chain_t *p_wl_cert_chain = NULL;
uint32_t entry_number = 0;
uint32_t temp_size = 0;
if(wl_cert_chain == NULL)
{
return LE_INVALID_PARAMETER;
}
if(!sgx_is_within_enclave(wl_cert_chain, wl_cert_chain_size))
return LE_INVALID_PARAMETER;
p_wl_cert_chain = (const wl_cert_chain_t *)wl_cert_chain;
// First compare wl_cert_chain_size with the minimal size of cert chain.
// It should have at least one entry of mrsigner.
if(wl_cert_chain_size < sizeof(wl_cert_chain_t)
+ sizeof(sgx_measurement_t)
+ sizeof(sgx_ec256_signature_t))
{
return LE_INVALID_PARAMETER;
}
entry_number = p_wl_cert_chain->wl_cert.entry_number;
entry_number = _ntohl(entry_number);
// limits max MRSIGNER entry number in
// WL Cert to be <= 2048
if(entry_number > LE_MAX_MRSIGNER_NUMBER)
{
return LE_INVALID_PARAMETER;
}
temp_size = static_cast<uint32_t>(sizeof(wl_cert_chain_t)
+ sizeof(sgx_ec256_signature_t)
+ (sizeof(sgx_measurement_t) * entry_number));
if(wl_cert_chain_size != temp_size)
{
return LE_INVALID_PARAMETER;
}
return le_init_white_list(p_wl_cert_chain, entry_number, wl_cert_chain_size);
}
psw/ae/le/launch_enclave.edl
-52
View File
@@ -1,52 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
enclave {
include "arch.h"
include "sgx_report.h"
from "sgx_tstdc.edl" import *;
trusted {
public int le_get_launch_token_wrapper(
[in] const sgx_measurement_t *mrenclave,
[in] const sgx_measurement_t *mrsigner,
[in] const sgx_attributes_t *se_attributes,
[out] token_t * lictoken
);
public uint32_t le_init_white_list_wrapper(
[size = wl_cert_chain_size, in] const uint8_t *wl_cert_chain,
uint32_t wl_cert_chain_size
);
};
};
psw/ae/le/launch_enclave.h
-34
View File
@@ -1,34 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#include "aeerror.h"
#include "arch.h"
#include "sgx_tcrypto.h"
psw/ae/ref_le/Makefile
-96
View File
@@ -1,96 +0,0 @@
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
TOP_DIR := ../../..
include ../buildenv.mk
SIGNED_NAME = libsgx_$(AENAME).signed.so
KEYS_DIR = ./ref_keys
LE_PRIVATE_KEY = le_private_test_key.pem
WL_CFG_FILE = wl_cfg.csv
WHITE_LIST_NAME = ref_white_list.bin
REF_WL_GEN_NAME = ref_wl_gen
REF_WL_GEN_DIR = ./ref_wl_gen
WL_VERSION = 1
CFLAGS += -Werror
CXXFLAGS += -Werror
INCLUDE += -I$(LINUX_PSW_DIR)/ae/common
INCLUDE += -I$(LINUX_PSW_DIR)/ae/data/constants/linux
INCLUDE += -I$(LINUX_PSW_DIR)/ae/inc/internal
SRC := $(wildcard *.cpp)
OBJ := $(SRC:.cpp=.o)
OBJS = $(sort $(OBJ) version.o)
CONFIG := config_linux.xml
.PHONY: all
all: $(SONAME) REF_WL_GEN | $(BUILD_DIR)
@$(SGXSIGN) sign -key $(KEYS_DIR)/$(LE_PRIVATE_KEY) -enclave $(SONAME) -out $(BUILD_DIR)/$(SIGNED_NAME) -config $(CONFIG)
@$(REF_WL_GEN_DIR)/$(REF_WL_GEN_NAME) gen-wl -out $(BUILD_DIR)/$(WHITE_LIST_NAME) -cfg $(KEYS_DIR)/$(WL_CFG_FILE) -key $(KEYS_DIR)/$(LE_PRIVATE_KEY) -ver $(WL_VERSION)
.PHONY: REF_WL_GEN
REF_WL_GEN:
$(MAKE) -C $(REF_WL_GEN_DIR)
$(SONAME): $(AENAME)_t.o $(OBJ)
$(CXX) $(CXXFLAGS) -o $@ $(OBJ) $(AENAME)_t.o -nostdlib -nodefaultlibs -nostartfiles -Wl,-soname=${SIGNED_NAME}.$(call SPLIT_VERSION,$(LE_VER),1) $(LDTFLAGS)
$(OBJ): %.o:%.cpp
$(CXX) $(CXXFLAGS) -fno-exceptions -fno-rtti $(INCLUDE) $(DEFINES) -c $< -o $@
$(AENAME)_t.c: $(EDLFILE)
@$(EDGER8R) --trusted $<
$(AENAME)_t.o: $(AENAME)_t.c
$(CC) $(filter-out -O2,$(CFLAGS)) -fPIC -O1 $(INCLUDE) -c $< -o $@
$(BUILD_DIR):
@$(MKDIR) $@
.PHONY: clean
clean:
@$(RM) *.o
@$(RM) *.so
@$(RM) *.map
@$(RM) *_t.*
@$(MAKE) clean -C $(REF_WL_GEN_DIR)
@$(RM) $(BUILD_DIR)/$(SIGNED_NAME)
@$(RM) $(BUILD_DIR)/$(WHITE_LIST_NAME)
.PHONY: rebuild
rebuild:
$(MAKE) clean
$(MAKE) all
psw/ae/ref_le/config_linux.xml
-15
View File
@@ -1,15 +0,0 @@
<EnclaveConfiguration>
<IntelSigned>0</IntelSigned>
<ProvisionKey>0</ProvisionKey>
<LaunchKey>1</LaunchKey>
<ProdID>0x20</ProdID>
<ISVSVN>1</ISVSVN>
<TCSNum>1</TCSNum>
<TCSMinPool>0</TCSMinPool>
<TCSPolicy>1</TCSPolicy>
<StackMaxSize>0x3000</StackMaxSize>
<HeapMaxSize>0xb000</HeapMaxSize>
<HeapMinSize>0xb000</HeapMinSize>
<HW>0x1</HW>
<DisableDebug>1</DisableDebug>
</EnclaveConfiguration>
psw/ae/ref_le/ref_keys/enclave_private_test_key.pem
-39
View File
@@ -1,39 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
MIIG4wIBAAKCAYEAw+JGMsf8yNmS90AydekuDvhmIE5KORCgIaNVM7nnbuxDZngS
FrtMJyWcmjUj/71pVXaY66Ko1zffeklGcDExDfvLa23V8iEX1/mvWRHLIou4iYLJ
55sJprtX8FfButC+sQMFbhN/SIk7QAmdSOz1mJ/XD5M8Kzpb9eu+7RGfEj28T64r
t2Ilnns3/bVqBOBupfP9HAGAhlGQe4A3tG5c3YE7RiMB8E20DeZUPrQeBAKrXSfP
cwKxXtuNMC9GlxPK/F1ajHvmvccGQZvDe59rKHI4W15gOHmGXHjRJ+2chQA+J2Dc
DDJBs6TntepYKhl3lH/qvmzO8QO3DMmJToAqnkR1zgziT4L1Rl7S8FxmrvoQqBnR
vNN03nxxjG4uBB7qfsI6sfdyBVhhVe1VDvIFFX5VaGyfDOJdTSoCqPU8ACLWBZ0N
oyG56AXr64AfgALn6MJTM3Wek76skv0r6VNPSWqrt4r3ToSTVHMnGJlFuHq7/xfn
8fblgP74IgIPxLHtAgEDAoIBgQCCltl3L/3bO7dPgCGj8MlfUEQViYbQtcAWbON3
0UT0nYJEUAwPJ4gaGRMReMKqfkY4+btHwcXkz+pRhi71diCz/TJHno6ha2U6pnTm
C9zBsnsGVzFFEgZvJ4/1j9Z8iynLV1j0DP+FsNIqsROF805lv+S1DNLHfD1OnSnz
YRS209LfyXJ6QW5pp3qpI5wDQEnD9/4Sq6sENmBSVXp4SZM+VieEF1agM81emY1/
Ir6tVxzoxTT3VyDp57N1dNm6DTDSH7o2T253WrAMML5qtOmZ5gEPisdSO5Odxcqa
P4C+k6KkeB31gOc7sKEsKx43Zx+o2mSJeRKcEip/1f7cTCj/INat4U9MFopsvlje
D+rAdg5AlcKhmOWwoM2/gxKl0nqVLaj4X+A6vxTReViQV7z7OyE/7JxLHAzPryiu
yJBaE+H7njI6ORB8mSEO19GZmntHmox3TcP9eyoIFnejjeNCRKWNdeo0XMaIIJ6N
tf512161geOkkj0M8gYg5KoKWWsCgcEA8b06isCiKAwq6gYWAp6LmyGB9Fsr2Btp
EY55uUMFyeI8VNpvX0n9sdpLTEW9lS1Yc4aL4DEywrEfe2/Dw11aE2VgRC7wPPIh
5QkcACvTjoPHVMsTOE8K7ifgNESnHobdZp1uVGi/hzGjfSarKyjQCkcQx8Sl8dTm
91QE8KYuaDorLmQnDZ9/oL0Ci5+IrIAUaM4UILe7jwOUxWPDMkzmOwE/dPRkm+uG
V1JdmFxAQGiW1GbJKNZDUd0rh44pvhYJAoHBAM9wiLBEHuKy00VMj9jxgSZ3tM+z
CWUEv95Bp4dLVZ1AjdvSP7ym6ShBqqdj7UHRb6OxyBAGAEQ3V9GYx0Cwkwwt04UL
+yBvA744MaMYsv/FM/JuGpIfEWdjXLjk6uzcVThgTuj+4iYIHp6QpQtFmZJeksDF
DqpjYx5PQLIiNRDK193Lmz4soYxjN8mc3G0bGpSMbF/JPQiCWMF3tUGxlCsCc+5l
s2QN4zDv26usB8dJFxpuSVJFRpu2w2kc5vcVxQKBwQChKNGx1cFwCBycBA6sabJn
a6v4PMflZ5thCaZ7ggPb7Cg4kZ+U2/52kYeILn5jc5BNBF1AIMyBy2pSSoKCPjwM
7kAtdKAooWvuBhKqx+JfAoTjMgzQNLH0GpV4LcS/BJOZvkmNmypaIReoxHIcxeAG
2gsv2G6hOJn6OANLGXRFfBzJmBoJFP/AfgGyalsdqrhF3rgVz9JfV7iDl9d23e7S
ANT4ou29R67k4ZO66CrVmw84RIYbOYI2k3JaXsZ+uVsCgcEAiksFytgUlyHiLjMK
kKEAxE/N38yw7gMqlCvFBNzjvisJPTbVKG9GGtZxxO1I1oufwnaFYAQALXo6i7sv
gHW3XXPiWLKnavStKXrLwhB3VS4ioZ68YWoLmkI90Jicneg40EA0m1SWxAVpvwsY
si5mYZRh1di0cZeXaYorIWwjYIc6k90SKXMWXZd6hmiS82dnDbLy6oYosFbl1k/O
K8u4HKxNSZkiQrPsy0qScnKv2jC6EZ7bjC4vEnnXm2iZ+g6DAoHAbSl+kVwyReMX
XFWIylO1XpUIr4N45qnTg83sM9Ktl3Qn5kelIBKwDF2S1VlwNC6Ec1xIqfixtQEc
0C0tkYA0gTkLiN+PeFGUo5+vPSp4aBdRkG2sKC5b5teSwv8acJbjCGW7zCP7hXj3
RX6ky3KoQSECIu0kzlYiI4S9Zh0ewg5UJEp00/EEs3HlHeDIBk1wV13RC3ZhnZb3
Gddwi2AR/3pS2qivnVR04zKbpS9lJR26vpFI1Sh61ZWOWpoj8xw8
-----END RSA PRIVATE KEY-----
psw/ae/ref_le/ref_keys/enclave_public_test_key.pem
-11
View File
@@ -1,11 +0,0 @@
-----BEGIN PUBLIC KEY-----
MIIBoDANBgkqhkiG9w0BAQEFAAOCAY0AMIIBiAKCAYEAw+JGMsf8yNmS90Aydeku
DvhmIE5KORCgIaNVM7nnbuxDZngSFrtMJyWcmjUj/71pVXaY66Ko1zffeklGcDEx
DfvLa23V8iEX1/mvWRHLIou4iYLJ55sJprtX8FfButC+sQMFbhN/SIk7QAmdSOz1
mJ/XD5M8Kzpb9eu+7RGfEj28T64rt2Ilnns3/bVqBOBupfP9HAGAhlGQe4A3tG5c
3YE7RiMB8E20DeZUPrQeBAKrXSfPcwKxXtuNMC9GlxPK/F1ajHvmvccGQZvDe59r
KHI4W15gOHmGXHjRJ+2chQA+J2DcDDJBs6TntepYKhl3lH/qvmzO8QO3DMmJToAq
nkR1zgziT4L1Rl7S8FxmrvoQqBnRvNN03nxxjG4uBB7qfsI6sfdyBVhhVe1VDvIF
FX5VaGyfDOJdTSoCqPU8ACLWBZ0NoyG56AXr64AfgALn6MJTM3Wek76skv0r6VNP
SWqrt4r3ToSTVHMnGJlFuHq7/xfn8fblgP74IgIPxLHtAgED
-----END PUBLIC KEY-----
psw/ae/ref_le/ref_keys/le_private_test_key.pem
-39
View File
@@ -1,39 +0,0 @@
-----BEGIN RSA PRIVATE KEY-----
MIIG5AIBAAKCAYEA4ZfF+IVLUmS5jneT2SG3GpjltZZ0CzKwewMyu4pxqB+uHF4C
lI3YJq9Qlc5UJyyykdv3sYt6aCL87mYtmdGn8yy2livCEQrVknA7oHgVfy8t089m
5xGVuHIuErs3uk3wG5fZLMCZaaDIWl/F158j/up8aJGf/0MPIAqlyIdezhExfbt8
pOahVdvx5SZm2wJhTHC6cEfBruYzHpq4b+5mAcD7biwq2jWAich6kJwkP6YN4ZYr
l1mLh0I90t6vjBRLsmTVw4yROhwo/q+T/7B9ntGKaLsJDm2j+qM3MSdnee5FT6kA
SI4D0Spvy6Dn5FwxlVWnNvbliUzb/9VSdlhYMdsXZ5PjPmPGiiHrvmJvuWzvMYDv
geTeJLd8yxkCj7+sqGlpgkkh2clqZqVUF5P8bACF1JwIVYpgpit3ThwGz6riBvip
yl2BST2bcr5DYNpDO3G2Yr1EhJvIP0W+PqmUvHahbkLfi0bV/QkK7fnvhMPfbbFo
zakVMWzTJXCgdoKhAgEDAoIBgQCWZS6lrjI27dEJpQ07a89nEJkjuaKyIcr8rMx9
BvZwFR69lAG4XpAZyjW5NDgaHcxhPU/LslGawf30RB5mi8VMyHm5coFgseO29X0V
pWOqH3PiikSaC7kloXQMfM/RiUq9D+Yd1bubwIWRlS6Pv21UnFLwYRVU119qscPb
BOnetiD+fP3DRGuOkqFDbu88rEDdoHxK2oEfRCIUZyWf9EQBK1JJcsc8I6sGhacL
EsLVGV6WZB0PkQevgX6MlHUIDYaLPHV6ieOE8OyZxS9VO6qU1OAzsw2UAdNR0rsu
U42bsXHNuSydw4nF6E6/ruZ3/nmlGYW8Vkz7J5QOIZ+fRPGxdmUbe9cGYNTI12us
BLnmfxCewDCttbB9ojUti6CuUj6LKjlTlDSqo9FUSiS1RyRag0oIKvw7gK9RosEW
5wE5TZtT1ldzyQfY0Mg2agMjnoqOOIxOZpkyqY7WvPD6w750vkmHS3ALRXn+r5DY
7z7h2SSLbVqdjoHcbNaeJyKDKWMCgcEA/4u+S3lreRDf8JO+sJLwr5YF7oCdLj41
9VIpwboMHWMqFIXLdfEJsqJFY/EoEvE/F664XnoJYNqHxFl1OInkIJHSmBSpM9hB
vqyf5fcHRgKPFngwJBYNqY5BQfkkDQsUKflucpR+b70khH+Z1KHq7yYoLep8w6RQ
ecVbqa6y/dnPrfUxQUPgj/jSMlfnB3ydsKPr5wAm38N9XqyIWT4tiq2/RStAoVdR
VCo9Jg7o4sWfvMozDFagdqb1QcEOkHdrAoHBAOH+Z0BEUHmh5id0Dk9EDQ/8NCyt
14IssQqU9KnwBvMA8IaNceX3q3WrtEgpZh1tPAYApj37aK+29iZJbc7nCYcXrSZF
d4D6RZ4yKlZkUZmrxyzodlk+R76168TObX05Oq2wpRJWVGoWi+O2gzMHWvUVbppx
ETilCTHx+gIS0fvcqVtB9VtsFPQLnO7HV6Pv1bV4+AYjN9jZ9J59zG1FyYKrc94m
dtkHTarXdIKEKE84iN/DLdT8sfAim/Z03iFNIwKBwQCqXSmHpkemCz/1t9R1t0sf
uVlJqxN0KXlONsaBJrK+QhwNroej9gZ3FtjtS3AMoNS6dHrpprDrPFqC5k4lsULA
YTcQDcYikCvUcxVD+gTZVwoO+srCuV5xCYDWphgIsg1xUPRMYv71KMMC/7vjFpyf
bsVz8aiCbYr72OfGdHdT5opz+MuA1+sKpeF25USvqGkgbUfvVW8/16jpyFrmKXOx
ySouHNXA5ODixtNutJtB2RUohsyy5Gr5xKOBK18K+kcCgcEAlqmaKtg1pmvuxPgJ
ii1eCqgiyHPlAXMgsbijG/VZ91X1rwj2mU/Ho8fNhXDuvkjSrqsZfqebH89OxDDz
30SxBLpzbtj6VfwuaXbG5ELhER0vc0WkO37afyPygzRI/iYnHnXDYY7i8WRdQnms
zK+R+Lj0ZvYLexiwy/amrAyL/T3GPNajkkgN+Ae99ITlF/U5I6X6rsIlOzv4aaky
84PbrHJNPsRPO1ozxzpNrFga33sF6oIejf3L9Wxn+aM+wN4XAoHBAIF8398o/UH6
03CN4JtAAdOqYyvt6cFxh6uGKPXmPcWq9g/0JSZFuGKaw1sP22h6COR/1qnCQxbP
Nn1uQBrt/dJa43fYlGbjrGAbPB2rGELnTWjv1UZl4Dj59J4vtACHf4Iu8xQCNXV4
ea1ibdP1rQuwxtGzjSWyW30HHhAGhBO3ctMufgK1AIwGaj7A/AaQXzog5AVxU4cX
+IU8vgHuc3/gwX75kZyaAjpgFyZvBMCKvx+mvP1WWLoBvjhuiBuTCw==
-----END RSA PRIVATE KEY-----
psw/ae/ref_le/ref_keys/le_public_test_key.pem
-11
View File
@@ -1,11 +0,0 @@
-----BEGIN PUBLIC KEY-----
MIIBoDANBgkqhkiG9w0BAQEFAAOCAY0AMIIBiAKCAYEA4ZfF+IVLUmS5jneT2SG3
GpjltZZ0CzKwewMyu4pxqB+uHF4ClI3YJq9Qlc5UJyyykdv3sYt6aCL87mYtmdGn
8yy2livCEQrVknA7oHgVfy8t089m5xGVuHIuErs3uk3wG5fZLMCZaaDIWl/F158j
/up8aJGf/0MPIAqlyIdezhExfbt8pOahVdvx5SZm2wJhTHC6cEfBruYzHpq4b+5m
AcD7biwq2jWAich6kJwkP6YN4ZYrl1mLh0I90t6vjBRLsmTVw4yROhwo/q+T/7B9
ntGKaLsJDm2j+qM3MSdnee5FT6kASI4D0Spvy6Dn5FwxlVWnNvbliUzb/9VSdlhY
MdsXZ5PjPmPGiiHrvmJvuWzvMYDvgeTeJLd8yxkCj7+sqGlpgkkh2clqZqVUF5P8
bACF1JwIVYpgpit3ThwGz6riBvipyl2BST2bcr5DYNpDO3G2Yr1EhJvIP0W+PqmU
vHahbkLfi0bV/QkK7fnvhMPfbbFozakVMWzTJXCgdoKhAgED
-----END PUBLIC KEY-----
psw/ae/ref_le/ref_keys/wl_cfg.csv
-2
View File
@@ -1,2 +0,0 @@
true, false, C5 4A 62 F2 BE 9E F7 6E FB 1F 39 30 AD 81 EA 7F 60 DE FC 1F 5F 25 E0 9B 7C 06 7A 81 5A E0 C6 CB, , , , PCE
false, false, , ./ref_keys/enclave_public_test_key.pem, , , arbitrary enclave
1 true false C5 4A 62 F2 BE 9E F7 6E FB 1F 39 30 AD 81 EA 7F 60 DE FC 1F 5F 25 E0 9B 7C 06 7A 81 5A E0 C6 CB PCE
2 false false ./ref_keys/enclave_public_test_key.pem arbitrary enclave
psw/ae/ref_le/ref_le.cpp
-351
View File
@@ -1,351 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#include "ref_le.h"
#include "byte_order.h"
#include "sgx_utils.h"
#include "sgx_trts.h"
#include "metadata.h"
#include "se_memcpy.h"
#include "ref_le_t.h"
#include <stdlib.h> /* for malloc/free etc */
#define REF_LE_WL_MAX_NUM_OF_RECORDS 512
#define REF_LE_WL_CURRENT_VERSION 0x0100 /*big endian*/
// staticly allocate the white list cache - all the values in the cache are in little endian
static uint8_t g_buffer[REF_LE_WL_SIZE(REF_LE_WL_MAX_NUM_OF_RECORDS)] = { 0 };
static ref_le_white_list_t *g_ref_le_white_list_cache = (ref_le_white_list_t*)g_buffer;
static void copy_reversed_byte_array(uint8_t *dst, const uint8_t *src, size_t size)
{
for (size_t i = 0; i < size; i++)
{
dst[i] = src[size - i - 1];
}
}
// calculate the white list expected size based on entry count
static size_t ref_le_get_white_list_size(const ref_le_white_list_t* val)
{
if (val == NULL) {
return 0;
}
uint16_t entries_count = _ntohs(val->entries_count);
if (entries_count > REF_LE_WL_MAX_NUM_OF_RECORDS || entries_count == 0) {
// list cannot be empty nor can be larget than max records
return 0;
}
return REF_LE_WL_SIZE(entries_count);
}
// this function gets a white list and signature, verifies the correctness and signature of the
// white list and updates the white list cache in case of success
int ref_le_init_white_list(const ref_le_white_list_t* p_ref_le_white_list, uint32_t ref_le_white_list_size, const sgx_rsa3072_signature_t* p_ref_le_white_list_signature)
{
sgx_status_t sgx_stat = SGX_SUCCESS;
if (p_ref_le_white_list == NULL || ref_le_white_list_size < (uint32_t)sizeof(ref_le_white_list_t) || p_ref_le_white_list_signature == NULL)
{
return LE_INVALID_PARAMETER;
}
uint32_t data_size = (uint32_t)ref_le_get_white_list_size(p_ref_le_white_list);
if (data_size == 0 || data_size != ref_le_white_list_size ||
data_size > REF_LE_WL_SIZE(REF_LE_WL_MAX_NUM_OF_RECORDS))
{
// calculated size must match the declared one and 0 is illegal
// also checking that it is no more than the max size as a defence in depth
return LE_INVALID_PARAMETER;
}
if (!sgx_is_within_enclave(p_ref_le_white_list, ref_le_white_list_size) ||
!sgx_is_within_enclave(p_ref_le_white_list_signature, sizeof(sgx_rsa3072_signature_t)))
{
return LE_INVALID_PARAMETER;
}
// Format version should be 1 (big endian)
if (p_ref_le_white_list->version != REF_LE_WL_CURRENT_VERSION)
{
return LE_INVALID_PARAMETER;
}
// ===== version checking =====
uint32_t wl_version = _ntohl(p_ref_le_white_list->wl_version);
if (g_ref_le_white_list_cache->wl_version >= wl_version)
{
// white list version must be newer or equal to the existing
return LE_WHITE_LIST_ALREADY_UPDATED;
}
// ===== verify list signer =====
sgx_rsa3072_public_key_t temp_public_key;
copy_reversed_byte_array((uint8_t*)&(temp_public_key.exp), (const uint8_t*)&(p_ref_le_white_list->signer_pubkey.exp), sizeof(temp_public_key.exp));
copy_reversed_byte_array((uint8_t*)&(temp_public_key.mod), (const uint8_t*)&(p_ref_le_white_list->signer_pubkey.mod), sizeof(temp_public_key.mod));
// calculate the hash of the provided public key
sgx_sha256_hash_t signer_hash;
sgx_stat = sgx_sha256_msg(temp_public_key.mod, SGX_RSA3072_KEY_SIZE, &signer_hash);
if (sgx_stat != SGX_SUCCESS)
{
return LE_UNEXPECTED_ERROR;
}
// get self report - signer pubkey must match the self signing key aquired in report
sgx_report_t report;
sgx_stat = sgx_create_report(NULL, NULL, &report);
if (sgx_stat != SGX_SUCCESS)
{
return LE_UNEXPECTED_ERROR;
}
// compare the signer of the LE acquired from the report to the one provided in the list
if (memcmp(&(report.body.mr_signer), &signer_hash, sizeof(signer_hash)) != 0)
{
return LE_INVALID_PARAMETER;
}
// ===== verify signature =====
// create a little-endian copy of the signature
sgx_rsa3072_signature_t temp_signature;
copy_reversed_byte_array((uint8_t*)&temp_signature, (const uint8_t*)p_ref_le_white_list_signature, sizeof(*p_ref_le_white_list_signature));
// verify the signed white list
sgx_rsa_result_t verify_result = SGX_RSA_INVALID_SIGNATURE;
sgx_stat = sgx_rsa3072_verify((const uint8_t *)p_ref_le_white_list, data_size, &temp_public_key, &temp_signature, &verify_result);
if (sgx_stat != SGX_SUCCESS)
{
return LE_UNEXPECTED_ERROR;
}
if (verify_result != SGX_RSA_VALID)
{
return LE_INVALID_PARAMETER;
}
// ===== update the white list cache =====
// clear the existing records
memset(g_ref_le_white_list_cache, 0, REF_LE_WL_SIZE(REF_LE_WL_MAX_NUM_OF_RECORDS));
// copy white list as little endian to the cache
// the count was verified earilier in this function when verified the size
uint16_t entries_count = _ntohs(p_ref_le_white_list->entries_count);
for (uint32_t i = 0; i < entries_count; ++i)
{
(g_ref_le_white_list_cache->wl_entries[i]).provision_key = ((p_ref_le_white_list->wl_entries[i]).provision_key) ? 1 : 0;
(g_ref_le_white_list_cache->wl_entries[i]).match_mr_enclave = ((p_ref_le_white_list->wl_entries[i]).match_mr_enclave) ? 1 : 0;
copy_reversed_byte_array((uint8_t*)&((g_ref_le_white_list_cache->wl_entries[i]).mr_signer),
(const uint8_t*)&((p_ref_le_white_list->wl_entries[i]).mr_signer),
sizeof((g_ref_le_white_list_cache->wl_entries[i]).mr_signer));
if ((g_ref_le_white_list_cache->wl_entries[i]).match_mr_enclave)
{
copy_reversed_byte_array((uint8_t*)&((g_ref_le_white_list_cache->wl_entries[i]).mr_enclave),
(const uint8_t*)&((p_ref_le_white_list->wl_entries[i]).mr_enclave),
sizeof((g_ref_le_white_list_cache->wl_entries[i]).mr_enclave));
}
}
g_ref_le_white_list_cache->entries_count = entries_count;
g_ref_le_white_list_cache->wl_version = wl_version;
return AE_SUCCESS;
}
// this function gets the enclave information and provides token if priviledge is valid
int ref_le_get_launch_token(const sgx_measurement_t* mrenclave, const sgx_measurement_t* mrsigner, const sgx_attributes_t* se_attributes, token_t* lictoken)
{
int result = AE_SUCCESS;
if (NULL == mrenclave || NULL == mrsigner || NULL == se_attributes || NULL == lictoken)
{
return LE_INVALID_PARAMETER;
}
if (!sgx_is_within_enclave(mrenclave, sizeof(sgx_measurement_t)) ||
!sgx_is_within_enclave(mrsigner, sizeof(sgx_measurement_t)) ||
!sgx_is_within_enclave(se_attributes, sizeof(sgx_attributes_t)) ||
!sgx_is_within_enclave(lictoken, sizeof(token_t)))
{
return LE_INVALID_PARAMETER;
}
// ===== verify priviledge =====
// lookup for launch priviledges
bool valid_priviledge = false;
uint8_t provision = (se_attributes->flags & SGX_FLAGS_PROVISION_KEY) ? 1 : 0;
for (uint16_t i = 0; i < g_ref_le_white_list_cache->entries_count; ++i)
{
ref_le_white_list_entry_t *current_entry = &(g_ref_le_white_list_cache->wl_entries[i]);
if ((current_entry->provision_key || !provision) &&
(memcmp(&(current_entry->mr_signer), mrsigner, sizeof(sgx_measurement_t)) == 0) &&
(!current_entry->match_mr_enclave ||
(memcmp(&(current_entry->mr_enclave), mrenclave, sizeof(sgx_measurement_t)) == 0))
)
{
valid_priviledge = true;
break;
}
}
if (!valid_priviledge)
{
return LE_INVALID_PRIVILEGE_ERROR;
}
// ===== init EINIT token values =====
// initial EINIT Token and set 0 for all reserved area
memset(lictoken, 0, sizeof(*lictoken));
// set EINIT Token valid
lictoken->body.valid = 1;
// set EINIT Token mrenclave
memcpy(&lictoken->body.mr_enclave, mrenclave, sizeof(lictoken->body.mr_enclave));
// set EINIT Token mrsigner
memcpy(&lictoken->body.mr_signer, mrsigner, sizeof(lictoken->body.mr_signer));
// set EINIT Token attributes
memcpy(&lictoken->body.attributes, se_attributes, sizeof(lictoken->body.attributes));
// set EINIT Token with platform information from EREPORT
// create report to get current cpu_svn and isv_svn.
sgx_report_t report;
memset(&report, 0, sizeof(report));
sgx_status_t sgx_stat = sgx_create_report(NULL, NULL, &report);
if (sgx_stat != SGX_SUCCESS)
{
return LE_UNEXPECTED_ERROR;
}
memcpy(&lictoken->cpu_svn_le, &(report.body.cpu_svn), sizeof(lictoken->cpu_svn_le));
lictoken->isv_svn_le = report.body.isv_svn;
lictoken->isv_prod_id_le = report.body.isv_prod_id;
lictoken->masked_misc_select_le = report.body.misc_select & DEFAULT_MISC_MASK;
lictoken->attributes_le.flags = report.body.attributes.flags & ~SGX_FLAGS_MODE64BIT;
lictoken->attributes_le.xfrm = 0;
// equire random
sgx_stat = sgx_read_rand((uint8_t*)&lictoken->key_id, sizeof(sgx_key_id_t));
if (sgx_stat != SGX_SUCCESS)
{
memset_s(lictoken, sizeof(token_t), 0, sizeof(*lictoken));
return LE_UNEXPECTED_ERROR;
}
// Create key request
sgx_key_request_t key_request;
memset(&key_request, 0, sizeof(key_request));
key_request.key_name = SGX_KEYSELECT_EINITTOKEN;
key_request.attribute_mask.xfrm = 0;
key_request.attribute_mask.flags = ~SGX_FLAGS_MODE64BIT;
key_request.misc_mask = DEFAULT_MISC_MASK;
key_request.isv_svn = lictoken->isv_svn_le;
memcpy(&key_request.key_id, &lictoken->key_id, sizeof(key_request.key_id));
memcpy(&key_request.cpu_svn, &(lictoken->cpu_svn_le), sizeof(key_request.cpu_svn));
sgx_cmac_state_handle_t p_cmac_handle = NULL;
sgx_key_128bit_t launch_key;
// ===== calculate the EINIT token =====
do
{
// call EGETKEY
sgx_stat = sgx_get_key(&key_request, &launch_key);
if (sgx_stat != SGX_SUCCESS)
{
result = LE_GET_EINITTOKEN_KEY_ERROR;
break;
}
// generate MAC for the token with the aquired key
sgx_stat = sgx_cmac128_init(&launch_key, &p_cmac_handle);
if (sgx_stat != SGX_SUCCESS)
{
result = AE_FAILURE;
break;
}
sgx_stat = sgx_cmac128_update((uint8_t*)&lictoken->body, sizeof(lictoken->body), p_cmac_handle);
if (sgx_stat != SGX_SUCCESS)
{
result = AE_FAILURE;
break;
}
sgx_stat = sgx_cmac128_final(p_cmac_handle, (sgx_cmac_128bit_tag_t*)&lictoken->mac);
if (sgx_stat != SGX_SUCCESS)
{
result = AE_FAILURE;
break;
}
} while (0);
// ===== wrap up =====
// clear launch_key after being used
memset_s(&launch_key, sizeof(sgx_key_128bit_t), 0, sizeof(launch_key));
// close CMAC handle
if (p_cmac_handle != NULL)
{
sgx_cmac128_close(p_cmac_handle);
}
// on failure, clear the EINIT token
if (result != AE_SUCCESS)
{
memset_s(lictoken, sizeof(token_t), 0, sizeof(*lictoken));
}
return result;
}
psw/ae/ref_le/ref_le.edl
-56
View File
@@ -1,56 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
enclave {
include "arch.h"
include "sgx_report.h"
include "ref_le.h"
trusted {
public int ref_le_get_launch_token(
[in] const sgx_measurement_t *mrenclave,
[in] const sgx_measurement_t *mrsigner,
[in] const sgx_attributes_t *se_attributes,
[out] token_t * lictoken
);
public int ref_le_init_white_list(
[in, size = ref_le_white_list_size] const ref_le_white_list_t *p_ref_le_white_list,
uint32_t ref_le_white_list_size,
[in] const sgx_rsa3072_signature_t *p_ref_le_white_list_signature
);
};
};
psw/ae/ref_le/ref_le.md
-117
View File
@@ -1,117 +0,0 @@
# Intel(R) SGX Reference Launch Enclave
**NOTE**: The reference LE is only workable with [linux-sgx-driver](https://github.com/intel/linux-sgx-driver) and is planned to be deprecated starting from Intel(R) SGX release 2.20.
## Introduction
A Launch Enclave (LE) is a special type of enclave, generates a Launch Token for other enclave to be initialized. The generated Launch Token is used by the Platform Software as part of the data passed to the driver on EINIT flow.
The Launch Enclave role is divided to two parts:
1. Determining whether the enclave may be launched on the platform
2. Generation of Launch Token embedding the security data provided
The default Launch Control in the Intel(R) SGX PSW is signed by Intel and generates tokens based on a control policy defined by Intel.
The Reference Launch Enclave (ref-LE) is a reference implementation of a Launch Enclave that can be used as a basis for enforcing different launch control policy by the platform developer or owner.
## Flexible Launch Control
In the Intel(R) SGX architecture, LE must be signed by the Launch Control Policy Provider of the platform in order to be loaded as LE and in order to accept Launch Tokens generated by it.
To define a Launch Control Policy Provider, other than the default Intel, the SHA256 value of the enclave signer public key modulus must be written to the IA32_SGXPUBKEYHASH0..3 MSRs.
To write to these MSRs the platform must support the Flexible Launch Control (FLC) feature and the BIOS must enable it in one of the possible modes:
1. Unlocked mode - Enabling a ring-0 software to configure the IA32_SGXPUBKEYHASH0..3 MSRs values
2. Locked mode - Only the BIOS may set the IA32_SGXPUBKEYHASH0..3 MSRs values
In order to use any LE other than the Intel signed one, the target platform must support the FLC feature and the hash value of the enclave signer must be configured into the IA32_SGXPUBKEYHASH0..3 MSRs.
## White List
The ref-LE launch policy is based on a white list of enclave signer (MR_SIGNER) and may also limit to a specific enclave hash (MR_ENCLAVE).
The white list record includes the following items:
* MR_SIGNER - approved enclave signer hash
* MR_ENCLAVE (optional) - a specific approved enclave hash
* Match MR_ENCLAVE - whether the optional MR_ENCLAVE should be used
* Provision Key - whether to allow the enclave to be launched with provision key attribute
The white key must be RSA 3072 signed by the signer of the ref-LE.
## The ref-LE Directory Structure
The ref-LE is part of the PSW source tree and located in the ref-le directory, including the following content:
~~~
|- ref_le [DIR] - Top level ref-LE directory
|- Makefile - A make file for the ref-LE enclave and white list generation
|- config_linux.xml - The enclave configuration XML, defines the LaunchKey property in order to be loaded as LE
|- ref_le.cpp - The ref-LE implementation (ref-le.h is located in psw/ae/inc/internal)
|- ref_le.edl - The ref-LE EDL file, defining the enclave interface
|- ref_wl_gen [DIR] - A reference tool for white list generation
|- ref_wl.cpp - The tool main function calling the generator class
|- ref_wl_gen.h/cpp - A white list generation class
|- ref_keys [DIR] - Contains a set of testing keys used by default in the build process
|- wl_cfg.csv - A sample CSV file to define the white list
|- le_private/public_test_key.pem - RSA 3072 key pair used for signing the ref-LE and white list
|- encalve_private/public_test_key.pem - RSA 3072 key pair included in the white list and enables signing of an arbitrary enclave
|- sgx_pubkey_hash_gen - A tool to generate SHA256 value of the enclave signer public key modulus
~~~
**Note**: the ref_keys directory is meant only for testing purposes and **must not** be used on a production build
## Build and Installation
The ref-LE build is part of the Intel(R) SGX PSW build and is conditioned by setting the build flag "BUILD_REF_LE=1" to the make line.
### Prerequisites:
Refer to the [README.md](../../../README.md) in the top of the repository for the Prerequisites of building and installing the Intel(R) SGX PSW.
### To build and install the Intel(R) SGX PSW of ref-LE build:
1. Build the Intel(R) SGX PSW installer with ref-LE support with the following commands:
```
$ make clean
$ make psw_install_pkg BUILD_REF_LE=1
```
2. Install the Intel(R) SGX PSW by invoking the installer with root privilege:
```
$ cd ${top_dir}/linux/installer/bin
$ sudo ./sgx_linux_x64_psw_${version}.bin
```
3. Copy the built-out ref-LE binary and the white list file to the PSW installation folders with root privilege:
```
$ sudo cp ${top_dir}/build/linux/libsgx_ref_le.signed.so /opt/intel/sgxpsw/aesm/
$ sudo cp ${top_dir}/build/linux/ref_white_list.bin /var/opt/aesmd/data
```
See the later topic, *Generating a White List*, for information on how to generate a white list file.
4. Restart aesmd service with root privilege:
```
$ sudo service aesmd restart
```
**Note**: Building with ref-LE is replacing the standard LE in both the build process and also in the aesm_service, the aesm_service will load and configure only the ref-LE if the PSW is built with the flag BUILD_REF_LE=1. And the BUILD_REF_LE=1 is also building the LE shared object (ref_le.so), the ref-LE white list generation tool and a sample white list created with the tool and the test keys.
## Usage
### Generating a White List
~~~
ref_wl_gen <Command> <Options>
Command:
gen-wl: Generate a white-list file based on the information provided in the config file.
Options:
-out <file-name>: The output file name for the white-list.
-cfg <file-name>: A CSV configuration file with the list of hash values or keys to sign.
-key <file-name>: The private key to sign the white-list with.
-ver <version>: An integer value of the white-list version.
-verbose: Print extended report while generating the white-list.
CSV file columns:
allow provision key, mr_enclave valid, mr_signer hash, mr_signer file, mr_enclave hash, mr_enclave file, comments (ignored)
Notes:
* Column 1 and 2 should be true or false.
* If mr_enclave valid is false the mr_enclave columns will be ignored.
* If mr_signer/mr_enclave hash is not empty the mr_signer/mr_enclave file will be ignored.
* mr_signer file should be key file (pem), mr_enclave file should be sigstruct (bin).
* Key hash representation should be in little endian, i.e. LSB byte first.
Example:
ref_wl_gen gen-wl -out wl.bin -cfg cfg.csv -key private.pem
~~~
### Using the ref-LE
The ref-LE exposes two functions for the platform software:
* ref_le_get_launch_token() - receives MR_ENCLAVE, MR_SIGNER and attributes and generates Launch Token if permitted
* ref_le_init_white_list() - receives a white list file and stores it for future usage if verified
### Defining a Launch Control Policy Provider
Generate SHA256 value of the enclave signer public key modulus of ref_LE to be written to the IA32_SGXPUBKEYHASH0..3 MSRs in order from hash0 to hash3.
~~~
sgx_pubkey_hash_gen [PUBLIC_KEY_FILE]
Example:
./sgx_pubkey_hash_gen ref_keys/le_public_test_key.pem
~~~
psw/ae/ref_le/ref_wl_gen/Makefile
-97
View File
@@ -1,97 +0,0 @@
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
export BUILD := LINUX
include ../../../../buildenv.mk
TOOL_NAME := ref_wl_gen
CPPFLAGS += -I$(SGX_HEADER_DIR) \
-I$(COMMON_DIR)/inc/internal \
-I$(LINUX_PSW_DIR)/ae/data/constants/linux \
-I$(LINUX_PSW_DIR)/ae/inc/internal \
-I$(LINUX_PSW_DIR)/ae/inc \
-I$(LINUX_SDK_DIR)/sign_tool/SignTool/ \
-I$(LINUX_EXTERNAL_DIR)/rdrand
CXXFLAGS += -Werror
CFLAGS += -Werror
RDRAND_LIBDIR := $(LINUX_EXTERNAL_DIR)/rdrand/src
RDRAND_MAKEFILE := $(RDRAND_LIBDIR)/Makefile
EXTERNAL_LIB += -L$(RDRAND_LIBDIR) -lrdrand -L$(SGX_LIB_DIR) -lsgx_tcrypto
LOCAL_OBJS := ref_wl.o ref_wl_gen.o parse_key_file.o
COMMON_OBJS := sgx_memset_s.o sgx_read_rand.o
C_OBJS := se_trace.o
OBJS := $(LOCAL_OBJS) $(COMMON_OBJS) $(C_OBJS)
vpath %.cpp ./ $(COMMON_DIR)/src/
vpath %.c $(COMMON_DIR)/src/
.PHONY: all
all: $(OBJS) rdrand | $(BUILD_DIR)
$(CXX) $(CXXFLAGS) $(OBJS) $(EXTERNAL_LIB) -o $(TOOL_NAME)
@$(CP) $(TOOL_NAME) $|
$(BUILD_DIR):
@$(MKDIR) $@
.PHONY: rdrand
rdrand: $(RDRAND_MAKEFILE)
$(MAKE) -C $(RDRAND_LIBDIR)
$(RDRAND_MAKEFILE):
ifeq ($(ARCH), x86)
@cd $(RDRAND_LIBDIR);./configure
else
@cd $(RDRAND_LIBDIR);./configure CFLAGS=-fPIC
endif
%.o: %.cpp
$(CXX) $(CXXFLAGS) $(CPPFLAGS) -c $< -o $@
%.o: %.c
$(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
.PHONY: clean
clean:
@$(RM) *~ *.o $(TOOL_NAME) $(BUILD_DIR)/$(TOOL_NAME)
ifeq ($(RDRAND_MAKEFILE), $(wildcard $(RDRAND_MAKEFILE)))
@$(MAKE) distclean -C $(RDRAND_LIBDIR)
endif
.PHONY: rebuild
rebuild:
$(MAKE) clean
$(MAKE) all
psw/ae/ref_le/ref_wl_gen/parse_key_file.cpp
-553
View File
@@ -1,553 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
/**
* File:
* parse_key_file.cpp
* Description:
* Parse the RSA key file that user inputs
* to get the key type and rsa structure.
*/
#include "parse_key_file.h"
#include "se_trace.h"
#include "arch.h"
#include "util_st.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <assert.h>
#include <limits.h>
#include <string>
#include <algorithm>
#include <fstream>
//N_SIZE+E_SIZE+D_SIZE+P_SIZE+Q_SIZE+DMP1_SIZE+DMQ1_SIZE+sizeof(inverseQ)
#define PRI_COMPONENTS_SIZE (N_SIZE_IN_BYTES + E_SIZE_IN_BYTES + D_SIZE_IN_BYTES + P_SIZE_IN_BYTES *5)
#define PUB_CONPONENTS_SIZE (N_SIZE_IN_BYTES + E_SIZE_IN_BYTES) //N_SIZE+E_SIZE
#define SEQUENCE_TAG_VALUE 0x30
#define INTEGER_TAG_VALUE 0x02
#define BIT_STRING_TAG_VALUE 0x03
#define NULL_TAG_VALUE 0x05
#define OID_TAG_VALUE 0x06
#define CHECK_RETRUN(value) {if(0 == (value)) return 0;}
//base64Decode
// to decode the base64 string and put it to the result.
//Parameters
// [IN] aSrc: the source string coded in base64
// srcLen: length of the source string
// [OUT] result: point to the decoded string
//Return Value
// int---The length of the decoded string
static int base64_decode(const unsigned char* aSrc, size_t srcLen, unsigned char* result)
{ //two reasons will cause the function return 0: 1- The input parameters are wrong, 2- srcLen<4
static char index_64[256] = {
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 62, 64, 64, 64, 63,
52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 64, 64, 64, 64, 64, 64,
64, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 64, 64, 64, 64, 64,
64, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64
};
CHECK_RETRUN(aSrc);
CHECK_RETRUN(srcLen);
CHECK_RETRUN(result);
unsigned char ch1 = 0, ch2 = 0, ch3 = 0, ch4 = 0;
unsigned char *ptr = result;
for (unsigned int i = 0; i < srcLen; ++i)
{
ch1 = index_64[aSrc[i]];
if(ch1 == 64)
continue;
ch2 = index_64[aSrc[++i]];
if(ch2 == 64)
continue;
*(ptr++) = (unsigned char)(ch1<<2 | ch2>>4);
ch3 = index_64[aSrc[++i]];
if(aSrc[i] == '=' || ch3 == 64)
continue;
*(ptr++) = (unsigned char)(ch2<<4 | ch3>>2);
ch4 = index_64[aSrc[++i]];
if(aSrc[i] == '=' || ch4 == 64)
continue;
*(ptr++) = (unsigned char)(ch3<<6 | ch4);
}
return (int)(ptr - result);
}
static void convert_string(unsigned char *str, int len)
{
assert(str != NULL&&len>0);
char temp = 0;
for(int i=0; i<len/2; i++)
{
temp = str[i];
str[i] = str[len-1-i];
str[len-1-i] = temp;
}
}
static bool parse_tag_and_length(const unsigned char *begin, const unsigned char *end, uint8_t expect_tag, size_t *len_bytes, size_t *value_bytes)
{
assert(NULL != begin && NULL != end && NULL != len_bytes && NULL != value_bytes);
if (begin[0] != expect_tag)
return false;
size_t tvb = 0, tlb = 0; // 'temporary value bytes' and 'temporary length bytes'
const unsigned char *lbegin = begin + 1;
if (!(lbegin[0] & 0x80))
{
// Value bytes <= 127
tvb = lbegin[0];
tlb += 1; // length is only one bytes
}
else if (lbegin[0] == 0x81)
{
tlb += (lbegin[0] & 0x7F) + 1; // + 1byte Length + 1byte to contain the value bytes
if (tlb != 2)
return false;
tvb = lbegin[1];
}
else if (lbegin[0] == 0x82)
{
tlb += (lbegin[0] & 0x7F) + 1; // + 1byte Length + 2bytes to contain the value bytes
if (tlb != 3)
return false;
tvb = (lbegin[1] << 8) + lbegin[2];
}
else
{
// Only the 3072bits RSA key is acceptable, for which we only need 2bytes to store the value bytes.
// Therefore, return failure if the length of the value bytes is greater than 2bytes.
return false;
}
if ((tlb < UINT_MAX - tvb) && (size_t)(lbegin + tvb + tlb) > tvb + tlb)
{
// In the input begin/end, the key_header/end has been removed.
// Therefore, we should not check the entire key length.
if (expect_tag != SEQUENCE_TAG_VALUE && lbegin + tvb + tlb > end)
return false;
else
{
*value_bytes = tvb;
*len_bytes = tlb + 1; // + size of tag
return true;
}
}
return false;
}
static bool parse_tlv_integer(const unsigned char **begin, const unsigned char *end, unsigned int *values, size_t values_length)
{
assert(NULL != begin && NULL != *begin && NULL != end && NULL != values && values_length > 0);
size_t value_bytes = 0, len_bytes = 0;
const unsigned char *psrc = *begin;
if (parse_tag_and_length(psrc, end, INTEGER_TAG_VALUE, &len_bytes, &value_bytes) == false)
return false;
psrc += len_bytes;
if (value_bytes < values_length)
return false;
else if (value_bytes > values_length)
{
for (unsigned int i = 0; i < value_bytes - values_length; i++)
{
if (*(psrc + i) != 0x00)
return false;
}
// There are some padding 0x00s which need to skip
psrc += value_bytes - values_length;
}
if (values != NULL)
{
memcpy_s(values, values_length, psrc, values_length);
}
psrc += values_length;
*begin = psrc;
return true;
}
static bool convert_from_pri_key(const unsigned char *psrc, unsigned int slen, rsa_params_t *rsa)
{
assert(NULL != psrc && NULL != rsa);
if(slen<PRI_COMPONENTS_SIZE)
{
return false;
}
size_t value_bytes = 0, len_bytes = 0;
const unsigned char *end = psrc + slen;
if (parse_tag_and_length(psrc, end, SEQUENCE_TAG_VALUE, &len_bytes, &value_bytes) == false)
{
return false;
}
psrc += len_bytes;
// Version
if (parse_tag_and_length(psrc, end, INTEGER_TAG_VALUE, &len_bytes, &value_bytes) == false)
{
return false;
}
psrc += len_bytes;
if (value_bytes != 0x01 || *psrc != 0x00) // Version should be 0x00
{
return false;
}
psrc += value_bytes;
memset(rsa, 0, sizeof(rsa_params_t));
// N
if (parse_tlv_integer(&psrc, end, rsa->n, N_SIZE_IN_BYTES) == false)
{
return false;
}
convert_string((unsigned char *)rsa->n, sizeof(rsa->n));
// E
if (parse_tlv_integer(&psrc, end, rsa->e, E_SIZE_IN_UINT) == false)
{
return false;
}
if (rsa->e[0] != 0x03)
{
se_trace(SE_TRACE_ERROR, "Only '3' is accepted as the Exponent value.\n");
return false;
}
// D
if (parse_tlv_integer(&psrc, end, rsa->d, D_SIZE_IN_BYTES) == false)
{
return false;
}
convert_string((unsigned char *)rsa->d, sizeof(rsa->d));
// P
if (parse_tlv_integer(&psrc, end, rsa->p, P_SIZE_IN_BYTES) == false)
{
return false;
}
convert_string((unsigned char *)rsa->p, sizeof(rsa->p));
// Q
if (parse_tlv_integer(&psrc, end, rsa->q, Q_SIZE_IN_BYTES) == false)
{
return false;
}
convert_string((unsigned char *)rsa->q, sizeof(rsa->q));
// DMP1
if (parse_tlv_integer(&psrc, end, rsa->dmp1, DMP1_SIZE_IN_BYTES) == false)
{
return false;
}
convert_string((unsigned char *)rsa->dmp1, sizeof(rsa->dmp1));
// DMQ1
if (parse_tlv_integer(&psrc, end, rsa->dmq1, DMQ1_SIZE_IN_BYTES) == false)
{
return false;
}
convert_string((unsigned char *)rsa->dmq1, sizeof(rsa->dmq1));
// IQMP
if (parse_tlv_integer(&psrc, end, rsa->iqmp, IQMP_SIZE_IN_BYTES) == false)
{
return false;
}
convert_string((unsigned char *)rsa->iqmp, sizeof(rsa->iqmp));
return true;
}
static bool convert_from_pub_key(const unsigned char *psrc, unsigned int slen, rsa_params_t *rsa)
{
assert(NULL != psrc && NULL != rsa);
if(slen<PUB_CONPONENTS_SIZE)
{
return false;
}
const unsigned char *end = psrc + slen;
size_t len_bytes = 0, value_bytes = 0;
unsigned char OID_str[] = { 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01 };
// SEQUENCE
if (parse_tag_and_length(psrc, end, SEQUENCE_TAG_VALUE, &len_bytes, &value_bytes) == false)
{
return false;
}
psrc += len_bytes;
// SEQUENCE
if (parse_tag_and_length(psrc, end, SEQUENCE_TAG_VALUE, &len_bytes, &value_bytes) == false)
return false;
psrc += len_bytes;
// OBJECT_ID
if (parse_tag_and_length(psrc, end, OID_TAG_VALUE, &len_bytes, &value_bytes) == false)
return false;
psrc += len_bytes;
if (value_bytes != sizeof(OID_str) || memcmp(psrc, OID_str, sizeof(OID_str)) != 0)
return false;
psrc += value_bytes;
// NULL
if (parse_tag_and_length(psrc, end, NULL_TAG_VALUE, &len_bytes, &value_bytes) == false || value_bytes != 0)
return false;
psrc += len_bytes;
// BIT STRING
if (parse_tag_and_length(psrc, end, BIT_STRING_TAG_VALUE, &len_bytes, &value_bytes) == false)
return false;
psrc += len_bytes;
if (*psrc == 0) // Specifies the number of unused bits that exist in the last content byte
psrc++;
// SEQUENCE
if (parse_tag_and_length(psrc, end, SEQUENCE_TAG_VALUE, &len_bytes, &value_bytes) == false)
return false;
psrc += len_bytes;
memset(rsa, 0, sizeof(rsa_params_t));
// N
if (parse_tlv_integer(&psrc, end, rsa->n, N_SIZE_IN_BYTES) == false)
{
return false;
}
convert_string((unsigned char *)rsa->n, sizeof(rsa->n));
// E
if (parse_tlv_integer(&psrc, end, rsa->e, E_SIZE_IN_UINT) == false)
{
return false;
}
if (rsa->e[0] != 0x03)
{
se_trace(SE_TRACE_ERROR, "Only '3' is accepted as the Exponent value.\n");
return false;
}
return true;
}
static unsigned char* decode_key_body(unsigned char *buffer, size_t slen, int *key_type, int *rlen)
{
assert(buffer!=NULL && key_type!=NULL && rlen!=NULL);
const char pri_key_header[] = "-----BEGINRSAPRIVATEKEY-----" ;
const char pri_key_end[] = "-----ENDRSAPRIVATEKEY-----\n";
const char pub_key_header[] = "-----BEGINPUBLICKEY-----";
const char pub_key_end[] = "-----ENDPUBLICKEY-----\n";
int ktype = UNIDENTIFIABLE_KEY;
int offset_pri = (int)(slen - strlen(pri_key_end));
int offset_pub = (int)(slen - strlen(pub_key_end));
if(offset_pub<=0 || offset_pri<=0)
{
se_trace(SE_TRACE_ERROR, KEY_FORMAT_ERROR);
*key_type = UNIDENTIFIABLE_KEY;
return NULL;
}
//check the file header and footer to get the key type
if(!strncmp((const char *)buffer, pri_key_header, strlen(pri_key_header)))
{
//make sure the key file isn't an emcrypted PEM private key file.
if((!strncmp((const char *)(buffer+offset_pri), pri_key_end, strlen(pri_key_end))) &&
!strstr((const char *)buffer, "Proc-Type: 4, ENCRYPTED"))
{
*(buffer+offset_pri-1) = '\0'; //remove the pri_key_end string
ktype = PRIVATE_KEY;
}
else
{
ktype = UNIDENTIFIABLE_KEY;
}
}
else if(!strncmp((const char *)buffer, pub_key_header, strlen(pub_key_header)))
{
if(!strncmp((const char *)(buffer+offset_pub), pub_key_end, strlen(pub_key_end)))
{
*(buffer + offset_pub-1) = '\0';
ktype = PUBLIC_KEY;
}
else
{
ktype = UNIDENTIFIABLE_KEY;
}
}
else
{
ktype = UNIDENTIFIABLE_KEY;
}
//get the body contents of the key file
size_t body_size = 0, body_offset = 0;
if(ktype == PRIVATE_KEY)
{
body_size = strlen((const char *)buffer) - strlen(pri_key_header);
body_offset = strlen(pri_key_header)+1;
}
else if(ktype == PUBLIC_KEY)
{
body_size = strlen((const char *)buffer) - strlen(pub_key_header);
body_offset = strlen(pub_key_header)+1;
}
else
{
se_trace(SE_TRACE_ERROR, KEY_FORMAT_ERROR);
*key_type = ktype;
return NULL;
}
unsigned char *decoded_string = (unsigned char *)malloc(sizeof(char)*body_size);
if(!decoded_string)
{
se_trace(SE_TRACE_ERROR, NO_MEMORY_ERROR);
*key_type = ktype;
return NULL;
}
memset(decoded_string, 0, body_size);
int retlen = base64_decode(buffer+body_offset, body_size, decoded_string);
if(retlen == 0)
{
se_trace(SE_TRACE_ERROR, KEY_FORMAT_ERROR);
*key_type = ktype;
free(decoded_string);
return NULL;
}
*key_type = ktype;
*rlen = retlen;
return decoded_string;
}
//read_key_file
// read the input file line by line and trim the blank characters for each line
//Parameters
// [IN] key_path: the file required to be read
static std::string read_key_file(const char *key_path)
{
assert(key_path != NULL);
std::ifstream ifs(key_path, std::ios::in | std::ios::binary);
if(!ifs.good())
{
se_trace(SE_TRACE_ERROR, READ_FILE_ERROR, key_path);
return "";
}
std::string file_content;
std::string str;
while(std::getline(ifs, str))
{
str.erase(std::remove_if(str.begin(), str.end(), ::isspace), str.end());
if(str.length() != 0)
{
file_content += str;
file_content += "\n"; // Add '\n' for each line
}
}
ifs.close();
return file_content;
}
//parse_key_file():
// parse the RSA key file
//Parameters:
// [IN] key_path: the key file name user inputs
// [OUT] prsa: the rsa structure parsed from the key file
// pkey_type: the key type
//Return Value:
// true: success
// false: fail
bool parse_key_file(const char *key_path, rsa_params_t *prsa, int *pkey_type)
{
assert(prsa != NULL && pkey_type != NULL);
if(key_path == NULL)
{
*pkey_type = NO_KEY;
return false;
}
//read and trim the file content
std::string file_content = read_key_file(key_path);
if(file_content.empty() == true)
{
*pkey_type = UNIDENTIFIABLE_KEY;
return false;
}
const unsigned char *buffer = (const unsigned char *)file_content.c_str();
//decode the buffer to decoded_string
size_t result = strlen((const char *)buffer);
int retlen = 0;
int key_type = UNIDENTIFIABLE_KEY;
unsigned char *decoded_string = decode_key_body(const_cast<unsigned char*>(buffer), result, &key_type, &retlen);
if(!decoded_string)
{
*pkey_type = key_type;
return false;
}
//get RSA from the decoded string
bool ret = false;
if(key_type == PRIVATE_KEY)
{
ret = convert_from_pri_key(decoded_string, retlen, prsa);
}
else
{
ret = convert_from_pub_key(decoded_string, retlen, prsa);
}
if(ret == false)
{
se_trace(SE_TRACE_ERROR, KEY_FORMAT_ERROR);
free(decoded_string);
*pkey_type = key_type;
return false;
}
else
{
se_trace(SE_TRACE_DEBUG, "Parsing key file is OK.\n");
}
*pkey_type = key_type;
free(decoded_string);
return true;
}
psw/ae/ref_le/ref_wl_gen/parse_key_file.h
-50
View File
@@ -1,50 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef _PARSE_KEY_FILE_H_
#define _PARSE_KEY_FILE_H_
#include "sgx_tcrypto.h"
typedef enum _key_type_t
{
UNIDENTIFIABLE_KEY = -1,
NO_KEY = 0,
PRIVATE_KEY,
PUBLIC_KEY
} key_type_t;
bool parse_key_file(const char *key_path, rsa_params_t *prsa, int *pkey_type);
#endif
psw/ae/ref_le/ref_wl_gen/ref_wl.cpp
-50
View File
@@ -1,50 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#pragma weak ippcpInit
#include "ref_wl_gen.h"
#include "ippcp.h"
int main(int argc, char* argv[])
{
if (ippcpInit != NULL)
{
ippcpInit();
}
CRefWLGen ref_le_gen;
if (ref_le_gen.run(argc, argv) == false)
return -1;
return 0;
}
psw/ae/ref_le/ref_wl_gen/ref_wl_gen.cpp
-508
View File
@@ -1,508 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#include "ref_wl_gen.h"
#include "arch.h"
#include "parse_key_file.h"
#include "ref_le.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <stdarg.h>
#define USAGE \
"ref_wl_gen <Command> <Options>\n" \
"Command:\n"\
" gen-wl: Generate a white-list file based on the information provided in the config file. \n" \
"Options:\n" \
" -out <file-name>: The output file name for the white-list. \n" \
" -cfg <file-name>: A CSV configuration file with the list of hash values or keys to sign. \n" \
" -key <file-name>: The private key to sign the white-list with. \n" \
" -ver <version>: An integer value of the white-list version. \n" \
" -verbose: Print extended report while generating the white-list. \n" \
"CSV file columns: \n" \
" allow provision key, mr_enclave valid, mr_signer hash, mr_signer file, mr_enclave hash, mr_enclave file, comments (ignored) \n" \
"Notes: \n" \
" * Column 1 and 2 should be true or false. \n" \
" * If mr_enclave valid is false the mr_enclave columns will be ignored. \n" \
" * If mr_signer/mr_enclave hash is not empty the mr_signer/mr_enclave file will be ignored. \n" \
" * mr_signer file should be key file (pem), mr_enclave file should be sigstruct (bin). \n" \
" * Key hash representation should be in little endian, i.e. LSB byte first. \n" \
"Example:\n" \
" ref_wl_gen gen-wl -out wl.bin -cfg cfg.csv -key private.pem \n"
#define LINE_LEN 1024
#define MAX_NUM_OF_RECORDS 512
#define WL_FILE_VERSION 1
CRefWLGen::CRefWLGen() : m_cfgfile(NULL), m_outfile(NULL), m_keyfile(NULL), m_version(0), m_verbose(false)
{
}
CRefWLGen::~CRefWLGen()
{
}
void CRefWLGen::print_line(bool always_print, const char* format, ...)
{
if (!always_print && !m_verbose)
{
return;
}
va_list args;
va_start(args, format);
vprintf(format, args);
va_end(args);
}
void CRefWLGen::print_byte_array(bool always_print, const uint8_t *array, size_t size, const char *line_prefix, int line_len)
{
if (!always_print && !m_verbose)
{
return;
}
for (size_t i = 0; i < size; ++i)
{
if (i % line_len == 0)
{
print_line(always_print, "\n%s", line_prefix);
}
print_line(always_print, "%02X ", array[i]);
}
print_line(always_print, "\n");
}
void CRefWLGen::reverse_byte_array(uint8_t *array, size_t size)
{
for (size_t i = 0; i < size / 2; i++)
{
uint8_t temp = array[i];
array[i] = array[size - i - 1];
array[size - i - 1] = temp;
}
}
gen_wl_cmd_t CRefWLGen::parse_cmd(int argc, char **argv)
{
gen_wl_cmd_t cmd = UNKNOWN;
argc--;
argv++;
if (argc <= 0 || argv == NULL)
{
return cmd;
}
if (strcmp(*argv, "gen-wl") == 0)
cmd = GEN_WL;
argc--;
argv++;
while (argc >= 1)
{
if (strcmp(*argv, "-out") == 0)
{
if (--argc < 1) { return UNKNOWN; }
m_outfile = *(++argv);
}
else if (strcmp(*argv, "-cfg") == 0)
{
if (--argc < 1) { return UNKNOWN; }
m_cfgfile = *(++argv);
}
else if (strcmp(*argv, "-key") == 0)
{
if (--argc < 1) { return UNKNOWN; }
m_keyfile = *(++argv);
}
else if (strcmp(*argv, "-ver") == 0)
{
if (--argc < 1) { return UNKNOWN; }
m_version = atoi(*(++argv));
}
else if (strcmp(*argv, "-verbose") == 0)
{
m_verbose = true;
}
else
{
return UNKNOWN;
}
argc--;
argv++;
}
return cmd;
}
char* CRefWLGen::clean_start(char *str)
{
if (str == NULL)
{
return NULL;
}
while (isspace(*str))
{
str++;
}
return str;
}
bool CRefWLGen::get_hash_from_pubkey_file(const char* pubkey_file, sgx_measurement_t* p_hash)
{
if (pubkey_file == NULL || p_hash == NULL || *pubkey_file == 0)
{
return false;
}
rsa_params_t rsa_params;
int key_type;
if (!parse_key_file(pubkey_file, &rsa_params, &key_type))
{
return false;
}
if (sgx_sha256_msg((uint8_t*)&(rsa_params.n), sizeof(rsa_params.n), (sgx_sha256_hash_t*)p_hash) != SGX_SUCCESS)
{
return false;
}
return true;
}
bool CRefWLGen::get_hash_from_string(char* hash_str, sgx_measurement_t* p_hash)
{
if (hash_str == NULL || p_hash == NULL)
{
return false;
}
char* ptr = clean_start(hash_str);
for (size_t count = 0; count < sizeof(sgx_measurement_t); ++count)
{
ptr = clean_start(ptr);
if (*ptr == 0)
{
return false;
}
p_hash->m[count] = (char)strtol(ptr, &ptr, 16);
}
return true;
}
bool CRefWLGen::get_hash_from_sigstruct_file(const char* sig_file, sgx_measurement_t* p_hash)
{
if (sig_file == NULL || p_hash == NULL || *sig_file == 0)
{
return false;
}
FILE *p_sig_file = fopen(sig_file, "rb");
if (!p_sig_file)
{
print_line(true, "Failed to open the input file '%s'.\n", sig_file);
return false;
}
fseek(p_sig_file, 0, SEEK_END);
size_t length = ftell(p_sig_file);
rewind(p_sig_file);
if (length < sizeof(enclave_css_t))
{
fclose(p_sig_file);
return false;
}
enclave_css_t sigstruct;
length = fread((&sigstruct), 1, sizeof(enclave_css_t), p_sig_file);
fclose(p_sig_file);
if (length < sizeof(enclave_css_t))
{
return false;
}
memcpy((char*)p_hash, &(sigstruct.body.enclave_hash), sizeof(sgx_measurement_t));
return true;
}
bool CRefWLGen::process_line(char *line, ref_le_white_list_entry_t *entry)
{
char *item = strtok(line, ",");
// parse item: allow provision key
item = clean_start(item);
if (strncmp(item, "true", 4) == 0)
{
entry->provision_key = 1;
}
else
{
entry->provision_key = 0;
}
print_line(false, " provision_key: %d\n", entry->provision_key);
// parse item: mr_enclave valid
item = strtok(NULL, ",");
item = clean_start(item);
if (strncmp(item, "true", 4) == 0)
{
entry->match_mr_enclave = 1;
}
else
{
entry->match_mr_enclave = 0;
}
print_line(false, " match_mr_enclave: %d\n", entry->match_mr_enclave);
// parse item: mr_signer hash/file
item = strtok(NULL, ",");
item = clean_start(item);
if (*item != 0)
{ // hash
if (get_hash_from_string(item, &(entry->mr_signer)) == false)
{
return false;
}
item = strtok(NULL, ","); // skip the next item
}
else
{ // file
item = strtok(NULL, ",");
item = clean_start(item);
if (get_hash_from_pubkey_file(item, &(entry->mr_signer)) == false)
{
return false;
}
}
print_line(false, " mr_signer: ");
print_byte_array(false, (uint8_t*)&(entry->mr_signer), sizeof(sgx_measurement_t), " ");
reverse_byte_array((uint8_t*)&(entry->mr_signer), sizeof(entry->mr_signer));
// parse item: mr_enclave hash/file
if (entry->match_mr_enclave == 1)
{
item = strtok(NULL, ",");
item = clean_start(item);
if (*item != 0)
{ // hash
if (get_hash_from_string(item, &(entry->mr_enclave)) == false)
{
return false;
}
item = strtok(NULL, ","); // skip the next item
}
else
{ // file
item = strtok(NULL, ",");
item = clean_start(item);
if (get_hash_from_sigstruct_file(item, &(entry->mr_enclave)) == false)
{
return false;
}
}
print_line(false, " mr_enclave: ");
print_byte_array(false, (uint8_t*)&(entry->mr_enclave), sizeof(sgx_measurement_t), " ");
reverse_byte_array((uint8_t*)&(entry->mr_enclave), sizeof(entry->mr_enclave));
}
print_line(false, " Full entry (big endian): ");
print_byte_array(false, (uint8_t*)entry, sizeof(ref_le_white_list_entry_t), " ");
return true;
}
bool CRefWLGen::set_key_and_sign(const char* prikey_file, ref_le_white_list_t *p_wl, uint16_t wl_count, sgx_rsa3072_signature_t* p_signature)
{
rsa_params_t rsa_params;
int key_type;
if (!parse_key_file(prikey_file, &rsa_params, &key_type))
{
return false;
}
rsa_params.e[0] = 3;
sgx_rsa3072_key_t rsa_key;
memcpy(&(rsa_key.mod), &(rsa_params.n), sizeof(rsa_key.mod));
memcpy(&(rsa_key.d), &(rsa_params.d), sizeof(rsa_key.d));
memcpy(&(rsa_key.e), &(rsa_params.e), sizeof(rsa_key.e));
memcpy(&(p_wl->signer_pubkey.mod), &(rsa_params.n), sizeof(p_wl->signer_pubkey.mod));
memcpy(&(p_wl->signer_pubkey.exp), &(rsa_params.e), sizeof(p_wl->signer_pubkey.exp));
print_line(false, " Signer public key modolus: ");
print_byte_array(false, (uint8_t*)&(p_wl->signer_pubkey.mod), sizeof(p_wl->signer_pubkey.mod), " ");
print_line(false, " Signer public key exponent: %d\n", p_wl->signer_pubkey.exp);
reverse_byte_array((uint8_t*)&(p_wl->signer_pubkey.mod), sizeof(p_wl->signer_pubkey.mod));
reverse_byte_array((uint8_t*)&(p_wl->signer_pubkey.exp), sizeof(p_wl->signer_pubkey.exp));
int len = REF_LE_WL_SIZE(wl_count);
sgx_status_t res = sgx_rsa3072_sign((const uint8_t*) p_wl, len, &rsa_key, p_signature);
if (res != SGX_SUCCESS)
{
return false;
}
return true;
}
bool CRefWLGen::generate_wl()
{
print_line(true, "Building white list...\n");
ref_le_white_list_t* wl = (ref_le_white_list_t*)malloc(REF_LE_WL_SIZE(MAX_NUM_OF_RECORDS));
memset(wl, 0, REF_LE_WL_SIZE(MAX_NUM_OF_RECORDS));
// Init values of white-list
print_line(true, "While list format version: %d\n", WL_FILE_VERSION);
wl->version = WL_FILE_VERSION;
print_line(true, "While list instance version: %d\n", m_version);
wl->wl_version = m_version;
// Read configuration information
print_line(true, "Reading configuration file: %s\n", m_cfgfile);
FILE *cfgfile = fopen(m_cfgfile, "r");
if (!cfgfile)
{
print_line(true, "Failed to open the configuration file '%s'.\n", m_cfgfile);
free(wl);
return false;
}
char line[LINE_LEN];
// TODO: what if line len is not enough?
while (fgets(line, LINE_LEN, cfgfile) != NULL)
{
char* start = clean_start(line);
if (*start == 0)
{
continue;
}
print_line(false, "Entry #%d:\n", wl->entries_count);
if (process_line(line, &(wl->wl_entries[wl->entries_count])) == false)
{
print_line(true, "Failed to process the configuration line.\n");
fclose(cfgfile);
free(wl);
return false;
}
wl->entries_count++;
}
fclose(cfgfile);
print_line(false, "Parsed entries count: %d\n", wl->entries_count);
uint16_t wl_count = wl->entries_count;
reverse_byte_array((uint8_t*)&(wl->version), sizeof(wl->version));
reverse_byte_array((uint8_t*)&(wl->wl_version), sizeof(wl->wl_version));
reverse_byte_array((uint8_t*)&(wl->entries_count), sizeof(wl->entries_count));
print_line(true, "Signing using key file: %s\n", m_keyfile);
sgx_rsa3072_signature_t sig;
if (!set_key_and_sign(m_keyfile, wl, wl_count, &sig))
{
free(wl);
return false;
}
reverse_byte_array((uint8_t*)&sig, sizeof(sgx_rsa3072_signature_t));
print_line(false, "Complete white list (big endian): ");
print_byte_array(false, (uint8_t*)wl, REF_LE_WL_SIZE(wl_count), " ");
print_line(false, "Signature (big endian): ");
print_byte_array(false, (uint8_t*)&sig, sizeof(sgx_rsa3072_signature_t), " ");
print_line(true, "Writing output file: %s\n", m_outfile);
FILE *pOut = fopen(m_outfile, "wb");
size_t written = fwrite(wl, 1, REF_LE_WL_SIZE(wl_count), pOut);
written += fwrite(&sig, 1, sizeof(sgx_rsa3072_signature_t), pOut);
fclose(pOut);
free(wl);
if (written != REF_LE_WL_SIZE(wl_count) + sizeof(sgx_rsa3072_signature_t))
{
return false;
}
print_line(true, "White list generation completed successfully. \n");
return true;
}
bool CRefWLGen::run(int argc, char **argv)
{
gen_wl_cmd_t cmd = parse_cmd(argc, argv);
switch (cmd)
{
case GEN_WL:
if (m_cfgfile == NULL || m_outfile == NULL || m_keyfile == NULL)
{
print_line(true, "Mising parameters. \n%s", USAGE);
return false;
}
if (generate_wl() == false)
{
print_line(true, "Failed to generate white-list.\n");
return false;
}
break;
default:
print_line(true, "Command line is not correct. \n%s", USAGE);
return false;
}
return true;
}
psw/ae/ref_le/ref_wl_gen/ref_wl_gen.h
-74
View File
@@ -1,74 +0,0 @@
/*
* Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* * Neither the name of Intel Corporation nor the names of its
* contributors may be used to endorse or promote products derived
* from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#ifndef _REF_WL_GEN_H_
#define _REF_WL_GEN_H_
#include "ref_le.h"
#include "se_types.h"
typedef enum
{
UNKNOWN = 0,
GEN_WL
} gen_wl_cmd_t;
class CRefWLGen
{
public:
CRefWLGen();
~CRefWLGen();
bool run(int argc, char* argv[]);
private:
gen_wl_cmd_t parse_cmd(int argc, char **argv);
bool generate_wl();
bool process_line(char *line, ref_le_white_list_entry_t *entry);
bool get_hash_from_pubkey_file(const char* pubkey_file, sgx_measurement_t* p_hash);
bool get_hash_from_sigstruct_file(const char* sig_file, sgx_measurement_t* p_hash);
bool get_hash_from_string(char* hash_str, sgx_measurement_t* p_hash);
bool set_key_and_sign(const char* prikey_file, ref_le_white_list_t *p_wl, uint16_t wl_count, sgx_rsa3072_signature_t* p_signature);
void print_byte_array(bool always_print, const uint8_t *array, size_t size, const char *line_prefix, int line_len = 32);
void print_line(bool always_print, const char* format, ...);
void reverse_byte_array(uint8_t *array, size_t size);
char* clean_start(char *str);
char *m_cfgfile;
char *m_outfile;
char *m_keyfile;
uint32_t m_version;
bool m_verbose;
};
#endif // _REF_WL_GEN_H_
psw/ae/ref_le/sgx_pubkey_hash_gen
-45
View File
@@ -1,45 +0,0 @@
#!/usr/bin/env bash
#
# Copyright (C) 2011-2021 Intel Corporation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in
# the documentation and/or other materials provided with the
# distribution.
# * Neither the name of Intel Corporation nor the names of its
# contributors may be used to endorse or promote products derived
# from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
#
if test $# -eq 1 && test -f $1; then
(openssl version) >/dev/null 2>&1 || (echo "Error: openssl not found." && exit 1)
(xxd -v) >/dev/null 2>&1 || (echo "Error: xxd not found." && exit 1)
(perl -v) >/dev/null 2>&1 || (echo "Error: perl not found." && exit 1)
PUBKEY=$(openssl rsa -pubin -in $1 -modulus -noout)
test $? -ne 0 && echo "Error: Invalid public key file." && exit 1
echo $PUBKEY | cut -d= -f2 | xxd -r -p | perl -0777 -F -ape '$_=reverse@F' | openssl sha256 -binary | perl -0777 -F -ape '$_=reverse@F' | xxd -g8 -c8 -u | awk '{print $2}' | tac
else
echo "Usage: $0 [PUBLIC_KEY_FILE]"
echo ""
echo "Generate SHA256 value of the enclave signer public key modulus to be written to the IA32_SGXPUBKEYHASH0..3 MSRs in order from hash0 to hash3."
fi
sdk/debugger_interface/linux/Makefile
+1 -6
View File
@@ -37,12 +37,7 @@ CFLAGS :=
CPPFLAGS += -I$(COMMON_DIR)/inc/ \
-I$(COMMON_DIR)/inc/internal/
CFLAGS += -W -Wall -Werror -D_GNU_SOURCE -fpic
ifeq ($(CC_BELOW_4_9), 1)
CFLAGS += -fstack-protector
else
CFLAGS += -fstack-protector-strong
endif
CFLAGS += -W -Wall -Werror -D_GNU_SOURCE -fpic -fstack-protector-strong
LDLIBS += -ldl
ifdef DEBUG