Skip to content

Commit 819f054

Browse files
valdokvaldok
authored
Merge pull request #1629 from scrtlabs/dcap-04
Dcap 04
2 parents c3f10b1 + 4092b28 commit 819f054

File tree

46 files changed

+1829
-156
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+1829
-156
lines changed

‎.github/workflows/ci.yaml

+25
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,31 @@ jobs:
161161
cp libgo_cosmwasm.so ./go-cosmwasm/api/libgo_cosmwasm.so
162162
cp librust_cosmwasm_enclave.signed.so ./go-cosmwasm/librust_cosmwasm_enclave.signed.so
163163
find "$(pwd)" -name \*.wasm
164+
- name: Install Quote library SDK
165+
run: |
166+
curl -fsSL https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -
167+
sudo add-apt-repository "deb https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main"
168+
DCAP_VERSION=1.17.100.4-focal1
169+
PSW_VERSION=2.20.100.4-focal1
170+
sudo apt-get update
171+
sudo apt-get install -y \
172+
libsgx-aesm-launch-plugin=$PSW_VERSION \
173+
libsgx-enclave-common=$PSW_VERSION \
174+
libsgx-epid=$PSW_VERSION \
175+
libsgx-launch=$PSW_VERSION \
176+
libsgx-quote-ex=$PSW_VERSION \
177+
libsgx-uae-service=$PSW_VERSION \
178+
libsgx-qe3-logic=$DCAP_VERSION \
179+
libsgx-pce-logic=$DCAP_VERSION \
180+
libsgx-aesm-ecdsa-plugin=$PSW_VERSION \
181+
libsgx-aesm-pce-plugin=$PSW_VERSION \
182+
libsgx-dcap-ql=$DCAP_VERSION \
183+
libsgx-dcap-quote-verify=$DCAP_VERSION \
184+
libsgx-dcap-default-qpl=$DCAP_VERSION \
185+
libsgx-urts=$PSW_VERSION
186+
LIB_PATH=/usr/lib/x86_64-linux-gnu
187+
sudo ln -s $LIB_PATH/libsgx_dcap_ql.so.1 $LIB_PATH/libsgx_dcap_ql.so
188+
sudo ln -s $LIB_PATH/libsgx_dcap_quoteverify.so.1 $LIB_PATH/libsgx_dcap_quoteverify.so
164189
- name: Test x/registration
165190
run: |
166191
source "$HOME/.sgxsdk/sgxsdk/environment"

‎app/app.go

+2
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ import (
3535
v1_10 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.10"
3636
v1_11 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.11"
3737
v1_12 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.12"
38+
v1_13 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.13"
3839
v1_3 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.3"
3940
v1_4 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.4"
4041
v1_5 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.5"
@@ -107,6 +108,7 @@ var (
107108
v1_10.Upgrade,
108109
v1_11.Upgrade,
109110
v1_12.Upgrade,
111+
v1_13.Upgrade,
110112
}
111113
)
112114

‎app/upgrades/v1.13/upgrade.go

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
package v1_13
2+
3+
import (
4+
"fmt"
5+
6+
store "github.com/cosmos/cosmos-sdk/store/types"
7+
sdk "github.com/cosmos/cosmos-sdk/types"
8+
"github.com/cosmos/cosmos-sdk/types/module"
9+
upgradetypes "github.com/cosmos/cosmos-sdk/x/upgrade/types"
10+
"github.com/scrtlabs/SecretNetwork/app/keepers"
11+
"github.com/scrtlabs/SecretNetwork/app/upgrades"
12+
"github.com/scrtlabs/SecretNetwork/go-cosmwasm/api"
13+
)
14+
15+
const upgradeName = "v1.13"
16+
17+
var Upgrade = upgrades.Upgrade{
18+
UpgradeName: upgradeName,
19+
CreateUpgradeHandler: createUpgradeHandler,
20+
StoreUpgrades: store.StoreUpgrades{},
21+
}
22+
23+
func createUpgradeHandler(mm *module.Manager, _ *keepers.SecretAppKeepers, configurator module.Configurator,
24+
) upgradetypes.UpgradeHandler {
25+
return func(ctx sdk.Context, _ upgradetypes.Plan, vm module.VersionMap) (module.VersionMap, error) {
26+
ctx.Logger().Info(` _ _ _____ _____ _____ _____ ______ `)
27+
ctx.Logger().Info(`| | | | __ \ / ____| __ \ /\ | __ \| ____|`)
28+
ctx.Logger().Info(`| | | | |__) | | __| |__) | / \ | | | | |__ `)
29+
ctx.Logger().Info(`| | | | ___/| | |_ | _ / / /\ \ | | | | __| `)
30+
ctx.Logger().Info(`| |__| | | | |__| | | \ \ / ____ \| |__| | |____ `)
31+
ctx.Logger().Info(` \____/|_| \_____|_| \_\/_/ \_\_____/|______|`)
32+
33+
// WASM Hooks doesn't require any initialization code:
34+
// https://github.com/osmosis-labs/osmosis/blob/8b4c62a26/app/upgrades/v14/upgrades.go#L12-L21
35+
36+
ctx.Logger().Info(fmt.Sprintf("Running module migrations for %s...", upgradeName))
37+
38+
_, err := api.MigrateSealing()
39+
if err != nil {
40+
return nil, err
41+
}
42+
43+
return mm.RunMigrations(ctx, configurator, vm)
44+
}
45+
}

‎check-hw/src/enclave_api.rs

+53-3
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ use enclave_ffi_types::{
88
};
99
use sgx_types::{
1010
c_int, sgx_calc_quote_size, sgx_enclave_id_t, sgx_epid_group_id_t, sgx_get_quote,
11-
sgx_init_quote, sgx_platform_info_t, sgx_quote_nonce_t, sgx_quote_sign_type_t, sgx_quote_t,
12-
sgx_report_attestation_status, sgx_report_t, sgx_spid_t, sgx_status_t, sgx_target_info_t,
13-
sgx_update_info_bit_t,
11+
sgx_init_quote, sgx_platform_info_t, sgx_ql_qe_report_info_t, sgx_ql_qv_result_t,
12+
sgx_quote_nonce_t, sgx_quote_sign_type_t, sgx_quote_t, sgx_report_attestation_status,
13+
sgx_report_t, sgx_spid_t, sgx_status_t, sgx_target_info_t, sgx_update_info_bit_t,
1414
};
1515

1616
// ecalls
@@ -186,3 +186,53 @@ pub extern "C" fn ocall_read_db(
186186
pub extern "C" fn ocall_allocate(_buffer: *const u8, _length: usize) -> UserSpaceBuffer {
187187
unimplemented!()
188188
}
189+
190+
#[no_mangle]
191+
pub extern "C" fn ocall_get_quote_ecdsa_params(
192+
ret_val: *mut sgx_status_t,
193+
p_qe_info: *mut sgx_target_info_t,
194+
p_quote_size: *mut u32,
195+
) -> sgx_status_t {
196+
unimplemented!()
197+
}
198+
#[no_mangle]
199+
pub extern "C" fn ocall_get_quote_ecdsa(
200+
ret_val: *mut sgx_status_t,
201+
p_report: *const sgx_report_t,
202+
p_quote: *mut u8,
203+
n_quote: u32,
204+
) -> sgx_status_t {
205+
unimplemented!()
206+
}
207+
208+
#[no_mangle]
209+
pub extern "C" fn ocall_get_quote_ecdsa_collateral(
210+
ret_val: *mut sgx_status_t,
211+
p_quote: *const u8,
212+
n_quote: u32,
213+
p_col: *mut u8,
214+
n_col: u32,
215+
p_col_out: *mut u32,
216+
) -> sgx_status_t {
217+
unimplemented!()
218+
}
219+
220+
#[no_mangle]
221+
pub extern "C" fn ocall_verify_quote_ecdsa(
222+
ret_val: *mut sgx_status_t,
223+
p_quote: *const u8,
224+
n_quote: u32,
225+
p_col: *const u8,
226+
n_col: u32,
227+
p_target_info: *const sgx_target_info_t,
228+
time_s: i64,
229+
p_qve_report_info: *mut sgx_ql_qe_report_info_t,
230+
p_supp_data: *mut u8,
231+
n_supp_data: u32,
232+
p_supp_data_size: *mut u32,
233+
p_time_s: *mut i64,
234+
p_collateral_expiration_status: *mut u32,
235+
p_qv_result: *mut sgx_ql_qv_result_t,
236+
) -> sgx_status_t {
237+
unimplemented!()
238+
}

‎cmd/secretd/attestation.go

+56-2
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ const (
3030
flagReset = "reset"
3131
flagPulsar = "pulsar"
3232
flagCustomRegistrationService = "registration-service"
33+
flag_no_epid = "no-epid"
34+
flag_no_dcap = "no-dcap"
3335
)
3436

3537
const (
@@ -95,14 +97,19 @@ blockchain. Writes the certificate in DER format to ~/attestation_cert
9597
return fmt.Errorf("failed to initialize enclave: %w", err)
9698
}
9799

98-
_, err = api.CreateAttestationReport(apiKeyFile)
100+
no_epid, _ := cmd.Flags().GetBool(flag_no_epid)
101+
no_dcap, _ := cmd.Flags().GetBool(flag_no_dcap)
102+
103+
_, err = api.CreateAttestationReport(apiKeyFile, no_epid, no_dcap)
99104
if err != nil {
100105
return fmt.Errorf("failed to create attestation report: %w", err)
101106
}
102107
return nil
103108
},
104109
}
105110
cmd.Flags().Bool(flagReset, false, "Optional flag to regenerate the enclave registration key")
111+
cmd.Flags().Bool(flag_no_epid, false, "Optional flag to disable EPID attestation")
112+
cmd.Flags().Bool(flag_no_dcap, false, "Optional flag to disable DCAP attestation")
106113

107114
return cmd
108115
}
@@ -247,6 +254,47 @@ func ParseCert() *cobra.Command {
247254
return cmd
248255
}
249256

257+
func DumpBin() *cobra.Command {
258+
cmd := &cobra.Command{
259+
Use: "dump [binary file]",
260+
Short: "Dump a binary file",
261+
Long: "Helper to display the contents of a binary file, and extract the public key of the secret node, which is used to" +
262+
"register the node, during node initialization",
263+
Args: cobra.ExactArgs(1),
264+
RunE: func(cmd *cobra.Command, args []string) error {
265+
data, err := os.ReadFile(args[0])
266+
if err != nil {
267+
return err
268+
}
269+
270+
fmt.Printf("%s\n", hex.EncodeToString(data))
271+
return nil
272+
},
273+
}
274+
275+
return cmd
276+
}
277+
278+
func MigrateSealings() *cobra.Command {
279+
cmd := &cobra.Command{
280+
Use: "migrate_sealing",
281+
Short: "Migrate sealed files to the current format",
282+
Long: "Re-create SGX-sealed files according to the current format",
283+
Args: cobra.ExactArgs(0),
284+
RunE: func(cmd *cobra.Command, args []string) error {
285+
_, err := api.MigrateSealing()
286+
if err != nil {
287+
return fmt.Errorf("failed to start enclave. Enclave returned: %s", err)
288+
}
289+
290+
fmt.Printf("Migration succeeded\n")
291+
return nil
292+
},
293+
}
294+
295+
return cmd
296+
}
297+
250298
func ConfigureSecret() *cobra.Command {
251299
cmd := &cobra.Command{
252300
Use: "configure-secret [master-key] [seed]",
@@ -436,7 +484,10 @@ Please report any issues with this command
436484
return fmt.Errorf("failed to initialize enclave: %w", err)
437485
}
438486

439-
_, err = api.CreateAttestationReport(apiKeyFile)
487+
no_epid, _ := cmd.Flags().GetBool(flag_no_epid)
488+
no_dcap, _ := cmd.Flags().GetBool(flag_no_dcap)
489+
490+
_, err = api.CreateAttestationReport(apiKeyFile, no_epid, no_dcap)
440491
if err != nil {
441492
return fmt.Errorf("failed to create attestation report: %w", err)
442493
}
@@ -582,5 +633,8 @@ Please report any issues with this command
582633
cmd.Flags().String(flagLegacyBootstrapNode, "", "DEPRECATED: This flag is no longer required or in use")
583634
cmd.Flags().String(flagLegacyRegistrationNode, "", "DEPRECATED: This flag is no longer required or in use")
584635

636+
cmd.Flags().Bool(flag_no_epid, false, "Optional flag to disable EPID attestation")
637+
cmd.Flags().Bool(flag_no_dcap, false, "Optional flag to disable DCAP attestation")
638+
585639
return cmd
586640
}

‎cmd/secretd/cli_attestation.go

+31
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,37 @@ func ParseCert() *cobra.Command {
6262
return cmd
6363
}
6464

65+
func DumpBin() *cobra.Command {
66+
cmd := &cobra.Command{
67+
Use: "dump [binary file]",
68+
Short: "Dump a binary file",
69+
Long: "Helper to display the contents of a binary file, and extract the public key of the secret node, which is used to" +
70+
"register the node, during node initialization",
71+
Args: cobra.ExactArgs(1),
72+
RunE: func(cmd *cobra.Command, args []string) error {
73+
println("This is a secretd only function, yo")
74+
return nil
75+
},
76+
}
77+
78+
return cmd
79+
}
80+
81+
func MigrateSealings() *cobra.Command {
82+
cmd := &cobra.Command{
83+
Use: "migrate_sealing",
84+
Short: "Migrate sealed files to the current format",
85+
Long: "Re-create SGX-sealed files according to the current format",
86+
Args: cobra.ExactArgs(0),
87+
RunE: func(cmd *cobra.Command, args []string) error {
88+
println("This is a secretd only function, yo")
89+
return nil
90+
},
91+
}
92+
93+
return cmd
94+
}
95+
6596
func ConfigureSecret() *cobra.Command {
6697
cmd := &cobra.Command{
6798
Use: "configure-secret [master-key] [seed]",

‎cmd/secretd/root.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,6 @@ func NewRootCmd() (*cobra.Command, app.EncodingConfig) {
109109
return err
110110
}
111111
initClientCtx, err = clientconfig.ReadFromClientConfig(initClientCtx)
112-
113112
if err != nil {
114113
return err
115114
}
@@ -179,6 +178,8 @@ func initRootCmd(rootCmd *cobra.Command, encodingConfig app.EncodingConfig) {
179178
InitAttestation(),
180179
InitBootstrapCmd(),
181180
ParseCert(),
181+
DumpBin(),
182+
MigrateSealings(),
182183
ConfigureSecret(),
183184
HealthCheck(),
184185
ResetEnclave(),

‎cosmwasm/enclaves/execute/Enclave.edl

+42-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ enclave {
55
from "sgx_net.edl" import *;
66
from "sgx_time.edl" import *;
77
include "sgx_quote.h"
8+
include "sgx_ql_quote.h"
9+
include "sgx_qve_header.h"
810
from "sgx_backtrace.edl" import *;
911
from "sgx_tstdc.edl" import *;
1012
from "sgx_tprotected_fs.edl" import *;
@@ -32,9 +34,13 @@ enclave {
3234
[out, count=32] uint8_t* public_key
3335
);
3436

37+
public sgx_status_t ecall_migrate_sealing(
38+
);
39+
3540
public sgx_status_t ecall_get_attestation_report(
3641
[in, count=api_key_len] const uint8_t* api_key,
37-
uint32_t api_key_len
42+
uint32_t api_key_len,
43+
uint32_t flags
3844
);
3945

4046
public NodeAuthResult ecall_authenticate_new_node(
@@ -235,6 +241,41 @@ enclave {
235241
[out] uint32_t* p_quote_len
236242
);
237243

244+
sgx_status_t ocall_get_quote_ecdsa_params(
245+
[out] sgx_target_info_t* p_qe_info,
246+
[out] uint32_t* p_quote_size
247+
);
248+
249+
sgx_status_t ocall_get_quote_ecdsa(
250+
[in] const sgx_report_t* p_report,
251+
[out, size=n_quote] uint8_t* p_quote,
252+
uint32_t n_quote
253+
);
254+
255+
sgx_status_t ocall_get_quote_ecdsa_collateral(
256+
[in, size=n_quote] const uint8_t* p_quote,
257+
uint32_t n_quote,
258+
[out, size=n_col] uint8_t* p_col,
259+
uint32_t n_col,
260+
[out] uint32_t* p_col_out
261+
);
262+
263+
sgx_status_t ocall_verify_quote_ecdsa(
264+
[in, size=n_quote] const uint8_t* p_quote,
265+
uint32_t n_quote,
266+
[in, size=n_col] const uint8_t* p_col,
267+
uint32_t n_col,
268+
[in] const sgx_target_info_t* p_target_info,
269+
int64_t time_s,
270+
[out] sgx_ql_qe_report_info_t* p_qve_report_info,
271+
[out, size=n_supp_data] uint8_t* p_supp_data,
272+
uint32_t n_supp_data,
273+
[out] uint32_t* p_supp_data_size,
274+
[out] int64_t* p_time_s,
275+
[out] uint32_t* p_collateral_expiration_status,
276+
[out] sgx_ql_qv_result_t* p_qv_result
277+
);
278+
238279
sgx_status_t ocall_get_update_info(
239280
[in] sgx_platform_info_t * platformBlob,
240281
int32_t enclaveTrusted,

‎cosmwasm/enclaves/execute/Makefile

+2-2
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,8 @@ RustEnclave_Link_Libs := -L$(CUSTOM_LIBRARY_PATH) -lenclave
9191
RustEnclave_Compile_Flags := $(SGX_COMMON_CFLAGS) $(ENCLAVE_CFLAGS) $(RustEnclave_Include_Paths)
9292
RustEnclave_Link_Flags := -Wl,--no-undefined -nostdlib -nodefaultlibs -nostartfiles -L$(SGX_LIBRARY_PATH) \
9393
-Wl,--whole-archive -l$(Trts_Library_Name) -Wl,--no-whole-archive \
94-
-Wl,--start-group -lsgx_tstdc -lsgx_tcxx -l$(Crypto_Library_Name) -l$(Service_Library_Name) -l$(ProtectedFs_Library_Name) $(RustEnclave_Link_Libs) -Wl,--end-group \
95-
-Wl,--version-script=Enclave.lds \
94+
-Wl,--start-group -lsgx_tstdc -lsgx_tcxx -lsgx_dcap_tvl -l$(Crypto_Library_Name) -l$(Service_Library_Name) -l$(ProtectedFs_Library_Name) $(RustEnclave_Link_Libs) -Wl,--end-group \
95+
-Wl,--version-script=Enclave.lds -lsgx_pthread \
9696
$(ENCLAVE_LDFLAGS)
9797

9898

0 commit comments

Comments
 (0)