Follow-up of upstream DCAP repo change which added `intel-tee-pcs-client-tool-*{.deb|.rpm}` packages.
Adds corresponding build targets to the top-level `Makefile` (the package is now included in the "local repo" archive).
---------
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
Bumped C++ standard from 14 to 17 in the CMake configuration to enable newer OSes
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Ubuntu should be able to build RPM packages without depending on a RHEL/CentOS using rpm tools
---------
Signed-off-by: Sankaranarayanan Venkatasubramanian <sankaranarayanan.venkatasubramanian@intel.com>
Updates the DCAP submodule to a new commit after separating PCCS Admin Tool (into PCCS Admin Tool and PCS Client Tool), moving PCCS related files to a new repository and linking that repository to DCAP repo via submodule.
---------
Signed-off-by: Pawel Krzysztof Blajer <pawel.krzysztof.blajer@intel.com>
Removes `SGX_WHITE_LIST_FILE` enum value and associated URL handling
Eliminates white list configuration parsing and storage
Removes the `update_white_list_by_url()` function and related network operations
---------
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
* Bumped C++ standard from 14 to 17 in the CMake configuration
* Updated DCAP source submodule to a newer commit with -lpthread flag for GTEST
---------
Signed-off-by: GracjanX Klodkowski <gracjanx.klodkowski@intel.com>
In recent changes to DCAP submodule PCCS paths have been changed. This PR updates to newest submodule and adjusts paths.
---------
Signed-off-by: Pawel Krzysztof Blajer <pawel.krzysztof.blajer@intel.com>
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
Adds a cross-platform filename extraction macro that works with both Unix and Windows path separators
Updates production logging to use the cleaner filename format instead of full file paths
Updates the dcap_source submodule to a newer commit
---------
Signed-off-by: Krzysztof Sandowicz <krzysztof.sandowicz@intel.com>
Configure the dcap_source submodule to track the same branch as the current repository instead of being pinned to the main branch
---------
Signed-off-by: Bartosz Gotowalski <bartosz.gotowalski@intel.com>
The workflow is dormant (skipped) by default (due to env var setting),
but can be enabled on select forks, allowing to intercept branch events
and run additional CI/CD tasks which are external to this repository.
Signed-off-by: Mateusz Bronk <mateusz.bronk@intel.com>
Several updates in DCAP submodule:
* Removing strip operation as debug info is later stripped while creating deb/rpm prod, dev and debug packages
* Bump brace-expansion from 1.1.11 to 1.1.12 in /QuoteGeneration/pccs
* Bump on-headers and morgan in /QuoteGeneration/pccs
* Bump tar-fs from 2.1.2 to 2.1.3 in /QuoteGeneration/pccs
* Update dcap components nuget License.txt to match Intel Simplified Software License (Version October 2022)
* Fix to ensure safe path buffer operations.
* Platform Manifest buffer limited to 256KB for PCKRetrievalTool
* Fixed paths to WDK
* Added fixes to building sgxssl.cmd
* Admin tools inf packaging process updated. Switched to latest prebuilt AE.
* Added path to libsgx_usgxssl
Signed-off-by: Gotowalski, Bartosz <bartosz.gotowalski@intel.com>
Intel® Software Guard Extensions (Intel® SGX) for Linux OS includes the following changes in version 2.26:
- Upgraded to OpenSSL 3.1.6.
- Removed support for the MbedTLS Trusted Library.
- Added support for Red Hat Enterprise Linux Server 9.4 (for x86_64) and SUSE Linux Enterprise Server 15.6 64-bits.
- Added support for the FIPS 140-3 Certifiable OpenSSL Provider as an experimental feature.
- Bug fixes.
Signed-off-by: Gotowalski, Bartosz <bartosz.gotowalski@intel.com>
Upgraded to OpenSSL 3.0.14.
Upgraded Intel(R) Integrated Performance Primitives (IPP) Cryptography library to version
2021.12.1.
Supported FIPS 140-3 Certifiable IPP Crypto based Trusted Library.
Upgraded Intel SGX Architecture Enclaves based on new IPP crypto library.
Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.14.
Removed Intel DCAP PCCS from repository.
Added Ubuntu* 24.04 LTS 64-bit Server support.
Fixed bug.
Note that PCCS is not available from this release. Please follow DCAP installation guide to use
`PCCSAdminTool` to retrieve the attestation collaterals or use old version PCCS.
Signed-off-by: Li, Xun <xun.li@intel.com>
Current macros emit an ENDBR instruction between the function label and
corresponding cfi_start, which confuses binary analysis tools like llvm-bolt.
Also add missing cfi_start/end directives for other assembly functions.
See also: https://sourceware.org/binutils/docs/as/CFI-directives.html
Signed-off-by: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
Upgraded to OpenSSL 3.0.13.
Upgraded to Intel(R) Integrated Performance Primitives (IPP) Cryptography library
version 2021.11.
Upgraded to Protobuf 3.23.2.
Upgraded MbedTLS to 3.5.2.
Upgraded Intel DCAP Ring3 Abstraction Layer (R3AAL) library to support ConfigFS-TSM
as communication channel between host and guest for TDX remote attestation.
Upgraded Intel DCAP Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.13.
Upgraded new TDX attestation result “TD_RELAUNCH_ADVISED” in Intel DCAP Quote
Verification Library (QVL) and Appraisal Engine.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Upgraded to OpenSSL 3.0.10.
Added interoperable RA-TLS support which follows CCC design.
Enhanced Protect File System performance and added additional dependency
`libsgx_pthread.a`.
Added the Constant Time instruction Decoder (CTD) into the default AEX-Notify
mitigation handler in order to prevent the introduction of any additional
subtle sidechannel leakages within the default handler.
Added Mistletoe 3 mitigations to the IPP Cryptography Library to the AES-ECB,
AESGCM, and AES-CMAC algorithms. These have been incorporated transparently
into the `sgx_tcrypto` library.
Resigned all Intel® SGX Architecture Enclaves.
Upgraded Intel SGX Quote Verification Enclave to integrate OpenSSL/SgxSSL 3.0.10.
Added Attestation Library support for Intel(R) TDX Migration TD.
Added Rust wrapper for low-level Quote Generation APIs.
Enabled `SE_TRACE` log in release binary.
Updated Rust QVL wrapper to use native Rust structure for quote verification
collateral.
Added a limitation in the DCAP QVL to only allow the user to set the QvE load
policy once.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Added a constant-time instruction decoder to supplement the default AEX-Notify mitigation.
Signed-off-by: Scott Constable <scott.d.constable@intel.com>
Ownership of the parser is transferred from measure_enclave() to load_enclave(). load_enclave() passes the parser by reference to the CLoader constructor. CLoader cannot be responsible for deleting the parser. The parser must be deleted at the end of load_enclave().
Signed-off-by: Michael Spiegel <michael.m.spiegel@gmail.com>
Global object initialization (init_global_object) happens before
g_uswitchless_handle is initialized (via sl_init_switchless).
Some ctors invoke syscalls via switchless ocalls. This causes
init_tswitchless_ocall_mngr to be invoked with sl_call_once
prematurely, returning -1. Subsequent invokations will always return -1, such
that switchless ocalls never happen. A simple solution is to fallback
to traditional ocalls until g_uswitchless_handle has been
initialized.
Supported the AEX (Asynchronous Enclave Exit) Notify feature.
Supported Mbed-TLS Cryptography library (excluding SSL/TLS portion) in Enclave.
Applied patches to OpenSSL 1.1.1t, fixed CVE-2023-1255, CVE-2023-0465 and
CVE-2023-0466.
Upgraded to Intel(R) Integrated Performance Primitives (IPP) Cryptography
library version 2021.7.
Upgraded Intel SGX Quote Verification Enclave to integrate updated SgxSSL.
Enhanced the attestation local cache functionality by giving users the option
to provide their own cache file.
Enabled QPL/QCNL log in DCAP samples.
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Supported the Key Separation and Sharing (KSS) feature in Simulation mode.
Upgraded to OpenSSL 1.1.1t.
Upgraded Intel(R) SGX Quote Verification Enclave to integrate SgxSSL/OpenSSL
version 1.1.1t.
Added new API in quote verification library to extract FMSPC
(Family-Model-SteppingPlatform-CustomSKU) value from ECDSA quote.
Added Rust support for SGX ECDSA quote generation.
Added Linux kernel 5.19 support in TDX R3AAL (Ring 3 Attestation Abstraction Layer).
Removed Protobuf in TDX QGS (Quote Generation Service) and R3AAL (Ring 3
Attestation Abstraction Layer).
Fixed bugs.
Signed-off-by: Li, Xun <xun.li@intel.com>
Mateusz Bronk