Skip to content
This repository was archived by the owner on May 9, 2022. It is now read-only.

Commit ed57679

Browse files
PiDelportPiDelport
committed
WIP: save_access_key ECALL plumbing
1 parent 0bd520c commit ed57679

File tree

16 files changed

+417
-71
lines changed

16 files changed

+417
-71
lines changed

‎codegen/auth_enclave/bindings.h

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,26 @@
1212
*/
1313
#define DATA_UPLOAD_RESPONSE_LEN (16 + (24 + 16))
1414

15+
#define REQUEST_SIZE 40
16+
17+
#define RESPONSE_SIZE 1
18+
19+
typedef uint8_t RecommendedAesGcmIv[12];
20+
21+
typedef struct EncryptedResponse {
22+
sgx_aes_gcm_128bit_tag_t tag;
23+
uint8_t ciphertext[RESPONSE_SIZE];
24+
uint8_t aad[0];
25+
RecommendedAesGcmIv nonce;
26+
} EncryptedResponse;
27+
28+
typedef struct EncryptedRequest {
29+
sgx_aes_gcm_128bit_tag_t tag;
30+
uint8_t ciphertext[REQUEST_SIZE];
31+
uint8_t aad[0];
32+
RecommendedAesGcmIv nonce;
33+
} EncryptedRequest;
34+
1535
/**
1636
* FFI safe result type that can be converted to and from a rust result.
1737
*/

‎codegen/auth_enclave/rtc_auth_t.c

Lines changed: 90 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,11 @@ typedef struct ms_enclave_create_report_t {
3434
sgx_report_t* ms_p_report;
3535
} ms_enclave_create_report_t;
3636

37+
typedef struct ms_save_access_key_t {
38+
EncryptedResponse ms_retval;
39+
EncryptedRequest ms_encrypted_request;
40+
} ms_save_access_key_t;
41+
3742
typedef struct ms_t_global_init_ecall_t {
3843
uint64_t ms_id;
3944
const uint8_t* ms_path;
@@ -580,6 +585,24 @@ static sgx_status_t SGX_CDECL sgx_enclave_create_report(void* pms)
580585
return status;
581586
}
582587

588+
static sgx_status_t SGX_CDECL sgx_save_access_key(void* pms)
589+
{
590+
CHECK_REF_POINTER(pms, sizeof(ms_save_access_key_t));
591+
//
592+
// fence after pointer checks
593+
//
594+
sgx_lfence();
595+
ms_save_access_key_t* ms = SGX_CAST(ms_save_access_key_t*, pms);
596+
sgx_status_t status = SGX_SUCCESS;
597+
598+
599+
600+
ms->ms_retval = save_access_key(ms->ms_encrypted_request);
601+
602+
603+
return status;
604+
}
605+
583606
static sgx_status_t SGX_CDECL sgx_t_global_init_ecall(void* pms)
584607
{
585608
CHECK_REF_POINTER(pms, sizeof(ms_t_global_init_ecall_t));
@@ -714,11 +737,12 @@ static sgx_status_t SGX_CDECL sgx_end_session(void* pms)
714737

715738
SGX_EXTERNC const struct {
716739
size_t nr_ecall;
717-
struct {void* ecall_addr; uint8_t is_priv; uint8_t is_switchless;} ecall_table[6];
740+
struct {void* ecall_addr; uint8_t is_priv; uint8_t is_switchless;} ecall_table[7];
718741
} g_ecall_table = {
719-
6,
742+
7,
720743
{
721744
{(void*)(uintptr_t)sgx_enclave_create_report, 0, 0},
745+
{(void*)(uintptr_t)sgx_save_access_key, 0, 0},
722746
{(void*)(uintptr_t)sgx_t_global_init_ecall, 0, 0},
723747
{(void*)(uintptr_t)sgx_t_global_exit_ecall, 0, 0},
724748
{(void*)(uintptr_t)sgx_session_request, 0, 0},
@@ -729,73 +753,73 @@ SGX_EXTERNC const struct {
729753

730754
SGX_EXTERNC const struct {
731755
size_t nr_ocall;
732-
uint8_t entry_table[63][6];
756+
uint8_t entry_table[63][7];
733757
} g_dyn_entry_table = {
734758
63,
735759
{
736-
{0, 0, 0, 0, 0, 0, },
737-
{0, 0, 0, 0, 0, 0, },
738-
{0, 0, 0, 0, 0, 0, },
739-
{0, 0, 0, 0, 0, 0, },
740-
{0, 0, 0, 0, 0, 0, },
741-
{0, 0, 0, 0, 0, 0, },
742-
{0, 0, 0, 0, 0, 0, },
743-
{0, 0, 0, 0, 0, 0, },
744-
{0, 0, 0, 0, 0, 0, },
745-
{0, 0, 0, 0, 0, 0, },
746-
{0, 0, 0, 0, 0, 0, },
747-
{0, 0, 0, 0, 0, 0, },
748-
{0, 0, 0, 0, 0, 0, },
749-
{0, 0, 0, 0, 0, 0, },
750-
{0, 0, 0, 0, 0, 0, },
751-
{0, 0, 0, 0, 0, 0, },
752-
{0, 0, 0, 0, 0, 0, },
753-
{0, 0, 0, 0, 0, 0, },
754-
{0, 0, 0, 0, 0, 0, },
755-
{0, 0, 0, 0, 0, 0, },
756-
{0, 0, 0, 0, 0, 0, },
757-
{0, 0, 0, 0, 0, 0, },
758-
{0, 0, 0, 0, 0, 0, },
759-
{0, 0, 0, 0, 0, 0, },
760-
{0, 0, 0, 0, 0, 0, },
761-
{0, 0, 0, 0, 0, 0, },
762-
{0, 0, 0, 0, 0, 0, },
763-
{0, 0, 0, 0, 0, 0, },
764-
{0, 0, 0, 0, 0, 0, },
765-
{0, 0, 0, 0, 0, 0, },
766-
{0, 0, 0, 0, 0, 0, },
767-
{0, 0, 0, 0, 0, 0, },
768-
{0, 0, 0, 0, 0, 0, },
769-
{0, 0, 0, 0, 0, 0, },
770-
{0, 0, 0, 0, 0, 0, },
771-
{0, 0, 0, 0, 0, 0, },
772-
{0, 0, 0, 0, 0, 0, },
773-
{0, 0, 0, 0, 0, 0, },
774-
{0, 0, 0, 0, 0, 0, },
775-
{0, 0, 0, 0, 0, 0, },
776-
{0, 0, 0, 0, 0, 0, },
777-
{0, 0, 0, 0, 0, 0, },
778-
{0, 0, 0, 0, 0, 0, },
779-
{0, 0, 0, 0, 0, 0, },
780-
{0, 0, 0, 0, 0, 0, },
781-
{0, 0, 0, 0, 0, 0, },
782-
{0, 0, 0, 0, 0, 0, },
783-
{0, 0, 0, 0, 0, 0, },
784-
{0, 0, 0, 0, 0, 0, },
785-
{0, 0, 0, 0, 0, 0, },
786-
{0, 0, 0, 0, 0, 0, },
787-
{0, 0, 0, 0, 0, 0, },
788-
{0, 0, 0, 0, 0, 0, },
789-
{0, 0, 0, 0, 0, 0, },
790-
{0, 0, 0, 0, 0, 0, },
791-
{0, 0, 0, 0, 0, 0, },
792-
{0, 0, 0, 0, 0, 0, },
793-
{0, 0, 0, 0, 0, 0, },
794-
{0, 0, 0, 0, 0, 0, },
795-
{0, 0, 0, 0, 0, 0, },
796-
{0, 0, 0, 0, 0, 0, },
797-
{0, 0, 0, 0, 0, 0, },
798-
{0, 0, 0, 0, 0, 0, },
760+
{0, 0, 0, 0, 0, 0, 0, },
761+
{0, 0, 0, 0, 0, 0, 0, },
762+
{0, 0, 0, 0, 0, 0, 0, },
763+
{0, 0, 0, 0, 0, 0, 0, },
764+
{0, 0, 0, 0, 0, 0, 0, },
765+
{0, 0, 0, 0, 0, 0, 0, },
766+
{0, 0, 0, 0, 0, 0, 0, },
767+
{0, 0, 0, 0, 0, 0, 0, },
768+
{0, 0, 0, 0, 0, 0, 0, },
769+
{0, 0, 0, 0, 0, 0, 0, },
770+
{0, 0, 0, 0, 0, 0, 0, },
771+
{0, 0, 0, 0, 0, 0, 0, },
772+
{0, 0, 0, 0, 0, 0, 0, },
773+
{0, 0, 0, 0, 0, 0, 0, },
774+
{0, 0, 0, 0, 0, 0, 0, },
775+
{0, 0, 0, 0, 0, 0, 0, },
776+
{0, 0, 0, 0, 0, 0, 0, },
777+
{0, 0, 0, 0, 0, 0, 0, },
778+
{0, 0, 0, 0, 0, 0, 0, },
779+
{0, 0, 0, 0, 0, 0, 0, },
780+
{0, 0, 0, 0, 0, 0, 0, },
781+
{0, 0, 0, 0, 0, 0, 0, },
782+
{0, 0, 0, 0, 0, 0, 0, },
783+
{0, 0, 0, 0, 0, 0, 0, },
784+
{0, 0, 0, 0, 0, 0, 0, },
785+
{0, 0, 0, 0, 0, 0, 0, },
786+
{0, 0, 0, 0, 0, 0, 0, },
787+
{0, 0, 0, 0, 0, 0, 0, },
788+
{0, 0, 0, 0, 0, 0, 0, },
789+
{0, 0, 0, 0, 0, 0, 0, },
790+
{0, 0, 0, 0, 0, 0, 0, },
791+
{0, 0, 0, 0, 0, 0, 0, },
792+
{0, 0, 0, 0, 0, 0, 0, },
793+
{0, 0, 0, 0, 0, 0, 0, },
794+
{0, 0, 0, 0, 0, 0, 0, },
795+
{0, 0, 0, 0, 0, 0, 0, },
796+
{0, 0, 0, 0, 0, 0, 0, },
797+
{0, 0, 0, 0, 0, 0, 0, },
798+
{0, 0, 0, 0, 0, 0, 0, },
799+
{0, 0, 0, 0, 0, 0, 0, },
800+
{0, 0, 0, 0, 0, 0, 0, },
801+
{0, 0, 0, 0, 0, 0, 0, },
802+
{0, 0, 0, 0, 0, 0, 0, },
803+
{0, 0, 0, 0, 0, 0, 0, },
804+
{0, 0, 0, 0, 0, 0, 0, },
805+
{0, 0, 0, 0, 0, 0, 0, },
806+
{0, 0, 0, 0, 0, 0, 0, },
807+
{0, 0, 0, 0, 0, 0, 0, },
808+
{0, 0, 0, 0, 0, 0, 0, },
809+
{0, 0, 0, 0, 0, 0, 0, },
810+
{0, 0, 0, 0, 0, 0, 0, },
811+
{0, 0, 0, 0, 0, 0, 0, },
812+
{0, 0, 0, 0, 0, 0, 0, },
813+
{0, 0, 0, 0, 0, 0, 0, },
814+
{0, 0, 0, 0, 0, 0, 0, },
815+
{0, 0, 0, 0, 0, 0, 0, },
816+
{0, 0, 0, 0, 0, 0, 0, },
817+
{0, 0, 0, 0, 0, 0, 0, },
818+
{0, 0, 0, 0, 0, 0, 0, },
819+
{0, 0, 0, 0, 0, 0, 0, },
820+
{0, 0, 0, 0, 0, 0, 0, },
821+
{0, 0, 0, 0, 0, 0, 0, },
822+
{0, 0, 0, 0, 0, 0, 0, },
799823
}
800824
};
801825

‎codegen/auth_enclave/rtc_auth_t.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ extern "C" {
2626
#endif
2727

2828
CreateReportResult enclave_create_report(const sgx_target_info_t* p_qe3_target, EnclaveHeldData enclave_data, sgx_report_t* p_report);
29+
EncryptedResponse save_access_key(EncryptedRequest encrypted_request);
2930
void t_global_init_ecall(uint64_t id, const uint8_t* path, size_t len);
3031
void t_global_exit_ecall(void);
3132
SessionRequestResult session_request(sgx_enclave_id_t src_enclave_id);

‎codegen/auth_enclave/rtc_auth_u.c

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@ typedef struct ms_enclave_create_report_t {
88
sgx_report_t* ms_p_report;
99
} ms_enclave_create_report_t;
1010

11+
typedef struct ms_save_access_key_t {
12+
EncryptedResponse ms_retval;
13+
EncryptedRequest ms_encrypted_request;
14+
} ms_save_access_key_t;
15+
1116
typedef struct ms_t_global_init_ecall_t {
1217
uint64_t ms_id;
1318
const uint8_t* ms_path;
@@ -1062,21 +1067,31 @@ sgx_status_t rtc_auth_enclave_create_report(sgx_enclave_id_t eid, CreateReportRe
10621067
return status;
10631068
}
10641069

1070+
sgx_status_t rtc_auth_save_access_key(sgx_enclave_id_t eid, EncryptedResponse* retval, EncryptedRequest encrypted_request)
1071+
{
1072+
sgx_status_t status;
1073+
ms_save_access_key_t ms;
1074+
ms.ms_encrypted_request = encrypted_request;
1075+
status = sgx_ecall(eid, 1, &ocall_table_rtc_auth, &ms);
1076+
if (status == SGX_SUCCESS && retval) *retval = ms.ms_retval;
1077+
return status;
1078+
}
1079+
10651080
sgx_status_t rtc_auth_t_global_init_ecall(sgx_enclave_id_t eid, uint64_t id, const uint8_t* path, size_t len)
10661081
{
10671082
sgx_status_t status;
10681083
ms_t_global_init_ecall_t ms;
10691084
ms.ms_id = id;
10701085
ms.ms_path = path;
10711086
ms.ms_len = len;
1072-
status = sgx_ecall(eid, 1, &ocall_table_rtc_auth, &ms);
1087+
status = sgx_ecall(eid, 2, &ocall_table_rtc_auth, &ms);
10731088
return status;
10741089
}
10751090

10761091
sgx_status_t rtc_auth_t_global_exit_ecall(sgx_enclave_id_t eid)
10771092
{
10781093
sgx_status_t status;
1079-
status = sgx_ecall(eid, 2, &ocall_table_rtc_auth, NULL);
1094+
status = sgx_ecall(eid, 3, &ocall_table_rtc_auth, NULL);
10801095
return status;
10811096
}
10821097

@@ -1085,7 +1100,7 @@ sgx_status_t rtc_auth_session_request(sgx_enclave_id_t eid, SessionRequestResult
10851100
sgx_status_t status;
10861101
ms_session_request_t ms;
10871102
ms.ms_src_enclave_id = src_enclave_id;
1088-
status = sgx_ecall(eid, 3, &ocall_table_rtc_auth, &ms);
1103+
status = sgx_ecall(eid, 4, &ocall_table_rtc_auth, &ms);
10891104
if (status == SGX_SUCCESS && retval) *retval = ms.ms_retval;
10901105
return status;
10911106
}
@@ -1096,7 +1111,7 @@ sgx_status_t rtc_auth_exchange_report(sgx_enclave_id_t eid, ExchangeReportResult
10961111
ms_exchange_report_t ms;
10971112
ms.ms_src_enclave_id = src_enclave_id;
10981113
ms.ms_dh_msg2 = dh_msg2;
1099-
status = sgx_ecall(eid, 4, &ocall_table_rtc_auth, &ms);
1114+
status = sgx_ecall(eid, 5, &ocall_table_rtc_auth, &ms);
11001115
if (status == SGX_SUCCESS && retval) *retval = ms.ms_retval;
11011116
return status;
11021117
}
@@ -1106,7 +1121,7 @@ sgx_status_t rtc_auth_end_session(sgx_enclave_id_t eid, sgx_status_t* retval, sg
11061121
sgx_status_t status;
11071122
ms_end_session_t ms;
11081123
ms.ms_src_enclave_id = src_enclave_id;
1109-
status = sgx_ecall(eid, 5, &ocall_table_rtc_auth, &ms);
1124+
status = sgx_ecall(eid, 6, &ocall_table_rtc_auth, &ms);
11101125
if (status == SGX_SUCCESS && retval) *retval = ms.ms_retval;
11111126
return status;
11121127
}

‎codegen/auth_enclave/rtc_auth_u.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,7 @@ int SGX_UBRIDGE(SGX_CDECL, sgx_thread_set_multiple_untrusted_events_ocall, (cons
280280
#endif
281281

282282
sgx_status_t rtc_auth_enclave_create_report(sgx_enclave_id_t eid, CreateReportResult* retval, const sgx_target_info_t* p_qe3_target, EnclaveHeldData enclave_data, sgx_report_t* p_report);
283+
sgx_status_t rtc_auth_save_access_key(sgx_enclave_id_t eid, EncryptedResponse* retval, EncryptedRequest encrypted_request);
283284
sgx_status_t rtc_auth_t_global_init_ecall(sgx_enclave_id_t eid, uint64_t id, const uint8_t* path, size_t len);
284285
sgx_status_t rtc_auth_t_global_exit_ecall(sgx_enclave_id_t eid);
285286
sgx_status_t rtc_auth_session_request(sgx_enclave_id_t eid, SessionRequestResult* retval, sgx_enclave_id_t src_enclave_id);

‎codegen/data_enclave/bindings.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@
1212
*/
1313
#define DATA_UPLOAD_RESPONSE_LEN (16 + (24 + 16))
1414

15+
#define REQUEST_SIZE 40
16+
17+
#define RESPONSE_SIZE 1
18+
1519
typedef struct DataUploadResponse {
1620
uint8_t ciphertext[DATA_UPLOAD_RESPONSE_LEN];
1721
uint8_t nonce[24];

‎codegen/exec_enclave/bindings.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@
1212
*/
1313
#define DATA_UPLOAD_RESPONSE_LEN (16 + (24 + 16))
1414

15+
#define REQUEST_SIZE 40
16+
17+
#define RESPONSE_SIZE 1
18+
1519
/**
1620
* FFI safe result type that can be converted to and from a rust result.
1721
*/

‎rtc_auth_enclave/rtc_auth.edl

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,7 @@ enclave {
1212
public CreateReportResult enclave_create_report([in]const sgx_target_info_t* p_qe3_target,
1313
[out, isary]EnclaveHeldData enclave_data,
1414
[out]sgx_report_t* p_report);
15+
16+
public EncryptedResponse save_access_key(EncryptedRequest encrypted_request);
1517
};
1618
};

‎rtc_auth_enclave/src/ecalls/mod.rs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
//! ECALL definitions
2+
3+
mod save_access_key;
4+
5+
pub use save_access_key::save_access_key;

‎rtc_auth_enclave/src/ecalls/save_access_key.rs

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
//! ECALL definition: [`save_access_key`]
2+
3+
use rtc_types::enclave_messages::ng_set_access_key;
4+
use rtc_types::enclave_messages::set_access_key::{EncryptedRequest, EncryptedResponse};
5+
6+
/// FFI wrapper for [`save_access_key_impl`].
7+
///
8+
/// This takes care of converting the [`ng_set_access_key`] types.
9+
#[no_mangle]
10+
pub extern "C" fn save_access_key(
11+
encrypted_request: ng_set_access_key::EncryptedRequest,
12+
) -> ng_set_access_key::EncryptedResponse {
13+
let encrypted_request: EncryptedRequest = encrypted_request.into();
14+
let encrypted_response: EncryptedResponse = save_access_key_impl(encrypted_request);
15+
encrypted_response.into()
16+
}
17+
18+
/// Implementation for [`save_access_key`].
19+
fn save_access_key_impl(encrypted_request: EncryptedRequest) -> EncryptedResponse {
20+
dbg!(
21+
encrypted_request.tag,
22+
encrypted_request.ciphertext,
23+
encrypted_request.aad,
24+
encrypted_request.nonce,
25+
);
26+
EncryptedResponse {
27+
tag: Default::default(),
28+
ciphertext: Default::default(),
29+
aad: Default::default(),
30+
nonce: Default::default(),
31+
}
32+
}

‎rtc_auth_enclave/src/lib.rs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,13 @@
44
#![deny(clippy::mem_forget)]
55

66
#[cfg(not(target_env = "sgx"))]
7+
#[macro_use]
78
extern crate sgx_tstd as std;
89

10+
pub mod ecalls;
11+
912
pub use rtc_tenclave::dh::*;
1013
#[allow(unused_imports)] // for ECALL linking
1114
use rtc_tenclave::enclave::enclave_create_report;
15+
16+
pub use ecalls::*;

0 commit comments

Comments
 (0)