diff --git a/.cargo/config.toml b/.cargo/config.toml new file mode 100644 index 0000000..f732b52 --- /dev/null +++ b/.cargo/config.toml @@ -0,0 +1,7 @@ +# remove once teaclave has moved to Rust v1.68, +# which stabilizes "sparse" protocol +registries.crates-io.protocol = "git" + +# does not play well with sccache, +# perhaps due to using a much different compiler version +build.rustc-wrapper = "" diff --git a/.gitignore b/.gitignore index 4eb0a2b..7175a27 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ **/build +**/bin **/enclave/target **/app/target **/app/.python-version diff --git a/utils/.gitignore b/utils/.gitignore new file mode 100644 index 0000000..adebdc6 --- /dev/null +++ b/utils/.gitignore @@ -0,0 +1,10 @@ +app/Enclave_u.c +app/Enclave_u.h +enclave/Enclave_private.pem +enclave/Enclave_public.pem +enclave/Enclave_t.c +enclave/Enclave_t.h +lib/libEnclave_u.a +lib/libenclave.a +obj/Enclave_t.o +obj/Enclave_u.o diff --git a/utils/Makefile b/utils/Makefile new file mode 100644 index 0000000..1955bdd --- /dev/null +++ b/utils/Makefile @@ -0,0 +1,46 @@ +# Dummy makefile, will call the host and enclave makefile when requested. + +SRC_U = app/ +SRC_T = enclave/ + +# Compilation process, will call the appropriate makefiles. + +all: host enclave + +host: + @echo "\033[32mRequest to compile the host part...\033[0m" + @make -C $(SRC_U) + +enclave: + @echo "\033[32mRequest to compile the enclave part...\033[0m" + @make -C $(SRC_T) + +clean: + @make -C $(SRC_U) clean + @make -C $(SRC_T) clean + +fclean: + @make -C $(SRC_U) fclean + @make -C $(SRC_T) fclean + +clean_host: + @make -C $(SRC_U) clean + +clean_enclave: + @make -C $(SRC_T) clean + +fclean_host: + @make -C $(SRC_U) fclean + +fclean_enclave: + @make -C $(SRC_T) fclean + +re_host: fclean_host host + +re_enclave: fclean_enclave enclave + +re: fclean all + +# Dummy rules to let make know that those rules are not files. + +.PHONY: host enclave clean clean_host clean_enclave fclean_host fclean_enclave fclean re re_host re_enclave \ No newline at end of file diff --git a/utils/app/Cargo.lock b/utils/app/Cargo.lock new file mode 100644 index 0000000..80eb4be --- /dev/null +++ b/utils/app/Cargo.lock @@ -0,0 +1,325 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 3 + +[[package]] +name = "app" +version = "0.0.0" +dependencies = [ + "dotenvy_macro", + "pyo3", + "sgx_types", + "sgx_urts", +] + +[[package]] +name = "autocfg" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa" + +[[package]] +name = "bitflags" +version = "1.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" + +[[package]] +name = "cfg-if" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" + +[[package]] +name = "dotenvy" +version = "0.15.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "03d8c417d7a8cb362e0c37e5d815f5eb7c37f79ff93707329d5a194e42e54ca0" + +[[package]] +name = "dotenvy_codegen_impl" +version = "0.15.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e05611d49f33180c6989e426b1d63a5ac0651307f0459321b67b38cd9861d050" +dependencies = [ + "dotenvy", + "proc-macro-hack", + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "dotenvy_macro" +version = "0.15.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f559fff643c8f40279ab9bc50dd3734c22efc1f386972995f52892fe414722a7" +dependencies = [ + "dotenvy_codegen_impl", + "proc-macro-hack", +] + +[[package]] +name = "indoc" +version = "1.0.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bfa799dd5ed20a7e349f3b4639aa80d74549c81716d9ec4f994c9b5815598306" + +[[package]] +name = "libc" +version = "0.2.139" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79" + +[[package]] +name = "lock_api" +version = "0.4.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df" +dependencies = [ + "autocfg", + "scopeguard", +] + +[[package]] +name = "memoffset" +version = "0.6.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce" +dependencies = [ + "autocfg", +] + +[[package]] +name = "once_cell" +version = "1.17.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66" + +[[package]] +name = "parking_lot" +version = "0.12.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f" +dependencies = [ + "lock_api", + "parking_lot_core", +] + +[[package]] +name = "parking_lot_core" +version = "0.9.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ba1ef8814b5c993410bb3adfad7a5ed269563e4a2f90c41f5d85be7fb47133bf" +dependencies = [ + "cfg-if", + "libc", + "redox_syscall", + "smallvec", + "windows-sys", +] + +[[package]] +name = "proc-macro-hack" +version = "0.5.20+deprecated" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068" + +[[package]] +name = "proc-macro2" +version = "1.0.50" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6ef7d57beacfaf2d8aee5937dab7b7f28de3cb8b1828479bb5de2a7106f2bae2" +dependencies = [ + "unicode-ident", +] + +[[package]] +name = "pyo3" +version = "0.17.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "268be0c73583c183f2b14052337465768c07726936a260f480f0857cb95ba543" +dependencies = [ + "cfg-if", + "indoc", + "libc", + "memoffset", + "parking_lot", + "pyo3-build-config", + "pyo3-ffi", + "pyo3-macros", + "unindent", +] + +[[package]] +name = "pyo3-build-config" +version = "0.17.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "28fcd1e73f06ec85bf3280c48c67e731d8290ad3d730f8be9dc07946923005c8" +dependencies = [ + "once_cell", + "target-lexicon", +] + +[[package]] +name = "pyo3-ffi" +version = "0.17.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0f6cb136e222e49115b3c51c32792886defbfb0adead26a688142b346a0b9ffc" +dependencies = [ + "libc", + "pyo3-build-config", +] + +[[package]] +name = "pyo3-macros" +version = "0.17.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "94144a1266e236b1c932682136dc35a9dee8d3589728f68130c7c3861ef96b28" +dependencies = [ + "proc-macro2", + "pyo3-macros-backend", + "quote", + "syn", +] + +[[package]] +name = "pyo3-macros-backend" +version = "0.17.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c8df9be978a2d2f0cdebabb03206ed73b11314701a5bfe71b0d753b81997777f" +dependencies = [ + "proc-macro2", + "quote", + "syn", +] + +[[package]] +name = "quote" +version = "1.0.23" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b" +dependencies = [ + "proc-macro2", +] + +[[package]] +name = "redox_syscall" +version = "0.2.16" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a" +dependencies = [ + "bitflags", +] + +[[package]] +name = "scopeguard" +version = "1.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd" + +[[package]] +name = "sgx_types" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" + +[[package]] +name = "sgx_urts" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" +dependencies = [ + "libc", + "sgx_types", +] + +[[package]] +name = "smallvec" +version = "1.10.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0" + +[[package]] +name = "syn" +version = "1.0.107" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1f4064b5b16e03ae50984a5a8ed5d4f8803e6bc1fd170a3cda91a1be4b18e3f5" +dependencies = [ + "proc-macro2", + "quote", + "unicode-ident", +] + +[[package]] +name = "target-lexicon" +version = "0.12.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9410d0f6853b1d94f0e519fb95df60f29d2c1eff2d921ffdf01a4c8a3b54f12d" + +[[package]] +name = "unicode-ident" +version = "1.0.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc" + +[[package]] +name = "unindent" +version = "0.1.11" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e1766d682d402817b5ac4490b3c3002d91dfa0d22812f341609f97b08757359c" + +[[package]] +name = "windows-sys" +version = "0.42.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7" +dependencies = [ + "windows_aarch64_gnullvm", + "windows_aarch64_msvc", + "windows_i686_gnu", + "windows_i686_msvc", + "windows_x86_64_gnu", + "windows_x86_64_gnullvm", + "windows_x86_64_msvc", +] + +[[package]] +name = "windows_aarch64_gnullvm" +version = "0.42.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8c9864e83243fdec7fc9c5444389dcbbfd258f745e7853198f365e3c4968a608" + +[[package]] +name = "windows_aarch64_msvc" +version = "0.42.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4c8b1b673ffc16c47a9ff48570a9d85e25d265735c503681332589af6253c6c7" + +[[package]] +name = "windows_i686_gnu" +version = "0.42.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "de3887528ad530ba7bdbb1faa8275ec7a1155a45ffa57c37993960277145d640" + +[[package]] +name = "windows_i686_msvc" +version = "0.42.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bf4d1122317eddd6ff351aa852118a2418ad4214e6613a50e0191f7004372605" + +[[package]] +name = "windows_x86_64_gnu" +version = "0.42.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c1040f221285e17ebccbc2591ffdc2d44ee1f9186324dd3e84e99ac68d699c45" + +[[package]] +name = "windows_x86_64_gnullvm" +version = "0.42.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "628bfdf232daa22b0d64fdb62b09fcc36bb01f05a3939e20ab73aaf9470d0463" + +[[package]] +name = "windows_x86_64_msvc" +version = "0.42.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd" diff --git a/utils/app/Cargo.toml b/utils/app/Cargo.toml new file mode 100644 index 0000000..03b8a19 --- /dev/null +++ b/utils/app/Cargo.toml @@ -0,0 +1,25 @@ +[package] +name = "app" +version = "0.0.0" +build = "build.rs" +license = "AGPL-3.0-only" +edition = "2021" + +[lib] +name = "utils" +crate-type = ["cdylib"] + +[dependencies] +dotenvy_macro = "0.15" + +[dependencies.pyo3] +version = "0.17" +features = ["extension-module"] + +[dependencies.sgx_types] +git = "https://github.com/apache/teaclave-sgx-sdk" +tag = "v1.1.6" + +[dependencies.sgx_urts] +git = "https://github.com/apache/teaclave-sgx-sdk" +tag = "v1.1.6" diff --git a/utils/app/Makefile b/utils/app/Makefile new file mode 100644 index 0000000..30647f1 --- /dev/null +++ b/utils/app/Makefile @@ -0,0 +1,119 @@ +# Makefile settings - Host part + +LIB = ../lib/ +BIN = ../bin/ +SRC_RST = ./src/ +APP_U = app +APP_T = enclave.so +NAME_U = libEnclave_u.a +SRC_U = ./ +SRC_T = ../enclave/ +OBJ_U = ../obj/ +SGX_SDK ?= /opt/sgxsdk +FLAGS = -Wall -Wextra +GCC_STEP1_U = -I $(SRC_U) -I./include -I$(SGX_SDK)/include -I$(CUSTOM_EDL_PATH) -fPIC -Wno-attributes $(SGX_COMMON_CFLAGS) +FILES_U = Enclave_u.c +FILES_U_H = Enclave_u.h +BUILD_RS = build.rs +TOML = Cargo.toml +SGX_ARCH = x64 +TRTS_LIB = sgx_trts +SERVICE_LIB = sgx_tservice +# Addprefix dependant variables, no need to change those +OUTPUT_U = $(FILES_U:.c=.o) +BIN_U = $(addprefix $(BIN), $(APP_U)) +NAME_U_D = $(addprefix $(LIB), $(NAME_U)) +FILES_U_F=$(addprefix $(SRC_U), $(FILES_U)) +OUTPUT_W_FU=$(addprefix $(OBJ_U), $(OUTPUT_U)) +FILES_RUST_F= $(wildcard $(SRC_RST)*.rs) # Wildcard function used, no need to specify the rust files. Safe as we don't compile the rust files with the makefile. + +# Contains compilation rules for the enclave part + +include ../buildenv.mk + +# Custom libraries, EDL paths. Needs to be specified with make (CUSTOM_EDL_PATH) (CUSTOM_COMMON_PATH) + +# Directly imported from the original Intel SGX samples, helpful to detect the system architecture + +ifeq ($(shell getconf LONG_BIT), 32) + SGX_ARCH := x86 +else ifeq ($(findstring -m32, $(CXXFLAGS)), -m32) + SGX_ARCH := x86 +endif + +ifeq ($(SGX_ARCH), x86) + SGX_COMMON_CFLAGS := -m32 + SGX_LIBRARY_PATH := $(SGX_SDK)/lib + SGX_ENCLAVE_SIGNER := $(SGX_SDK)/bin/x86/sgx_sign + SGX_EDGER8R := $(SGX_SDK)/bin/x86/sgx_edger8r +else + SGX_COMMON_CFLAGS := -m64 + SGX_LIBRARY_PATH := $(SGX_SDK)/lib64 + SGX_ENCLAVE_SIGNER := $(SGX_SDK)/bin/x64/sgx_sign + SGX_EDGER8R := $(SGX_SDK)/bin/x64/sgx_edger8r +endif + +# If specified, software / simulation mode. Otherwise, hardware mode no matter what. + +ifeq ($(SGX_MODE), SW) + TRTS_LIB := sgx_trts_sim + SERVICE_LIB := sgx_tservice_sim +endif + +# If debug mode, we can set up extra options such as the debug flags + +ifeq ($(SGX_DEBUG), 1) + SGX_COMMON_CFLAGS += -O0 -g +else + SGX_COMMON_CFLAGS += -O2 +endif + +# Compilation process, we set up all the dependencies needed to have the correct order of build, and avoid relink + +all: $(BIN_U) + +$(FILES_U_F): $(SGX_EDGER8R) $(SRC_T)/Enclave.edl + @echo "\033[32mGenerating untrusted SGX C edl files...\033[0m" + @$(SGX_EDGER8R) --untrusted $(SRC_T)/Enclave.edl --search-path $(SGX_SDK)/include --search-path $(CUSTOM_EDL_PATH) --untrusted-dir $(SRC_U) + +$(NAME_U_D): $(FILES_U_F) $(OUTPUT_W_FU) + @echo "\033[32mBuilding untrusted C edl static library...\033[0m" + @mkdir -p $(LIB) + @$(AR) rcsD $@ $(OUTPUT_W_FU) + +$(OBJ_U)%.o:$(SRC_U)%.c + @mkdir -p $(OBJ_U) + @echo "\033[32m$?: Build in progress...\033[0m" + @$(CC) $(FLAGS) $(GCC_STEP1_U) -o $@ -c $? + +# We print the compilation mode we're in (hardware/software mode), just as a reminder. + +$(BIN_U): $(NAME_U_D) $(FILES_RUST_F) $(FILES_U_H) $(BUILD_RS) $(TOML) # We added as a reference the rust files, along with the build.rs file and the cargo.toml file, so Make can detect if any change was made +ifeq ($(SGX_MODE), SW) + @echo "\033[32mSoftware / Simulation mode\033[0m" +else + @echo "\033[32mHardware mode\033[0m" +endif + @echo "\033[32mStarting cargo to build the host...\033[0m" + @cd $(SRC_U) && SGX_SDK=$(SGX_SDK) cargo build --release + +clean: c_clean + @rm -rf $(OBJ_U) + @echo "\033[32mObject files deleted\033[0m" + +fclean: clean fclean_host + +fclean_host: + @echo "\033[32mBinary file $(BIN_U) deleted\033[0m" + @rm -f $(BIN_U) + @rm -f $(NAME_U_D) + @cargo clean && rm -f Cargo.lock + +c_clean: + @echo "\033[32mC edl generated files deleted\033[0m" + @rm -rf $(FILES_U_F) + @rm -rf $(FILES_U_H) + +re: fclean all + +.PHONY: all clean c_clean fclean re fclean_host diff --git a/utils/app/build.rs b/utils/app/build.rs new file mode 100644 index 0000000..76c1d87 --- /dev/null +++ b/utils/app/build.rs @@ -0,0 +1,33 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License.. + +use std::env; + +fn main() { + let sdk_dir = env::var("SGX_SDK").unwrap_or_else(|_| "/opt/sgxsdk".to_string()); + let is_sim = env::var("SGX_MODE").unwrap_or_else(|_| "HW".to_string()); + + println!("cargo:rustc-link-search=native=../lib"); + println!("cargo:rustc-link-lib=static=Enclave_u"); + + println!("cargo:rustc-link-search=native={}/lib64", sdk_dir); + match is_sim.as_ref() { + "SW" => println!("cargo:rustc-link-lib=dylib=sgx_urts_sim"), + "HW" => println!("cargo:rustc-link-lib=dylib=sgx_urts"), + _ => println!("cargo:rustc-link-lib=dylib=sgx_urts"), // Treat undefined as HW + } +} diff --git a/utils/app/poetry.lock b/utils/app/poetry.lock new file mode 100644 index 0000000..9b0a33c --- /dev/null +++ b/utils/app/poetry.lock @@ -0,0 +1,68 @@ +# This file is automatically @generated by Poetry and should not be changed by hand. + +[[package]] +name = "maturin" +version = "0.14.12" +description = "Build and publish crates with pyo3, rust-cpython and cffi bindings as well as rust binaries as python packages" +category = "dev" +optional = false +python-versions = ">=3.7" +files = [ + {file = "maturin-0.14.12-py3-none-linux_armv6l.whl", hash = "sha256:daf895c987170bee8bf38706d306743b7b0bba54f0870a00ba3dc4b6677396fe"}, + {file = "maturin-0.14.12-py3-none-macosx_10_7_x86_64.whl", hash = "sha256:a2ba25fce913271cb765d656e2cf4640a355190130c19cee85672af9a6f96839"}, + {file = "maturin-0.14.12-py3-none-macosx_10_9_x86_64.macosx_11_0_arm64.macosx_10_9_universal2.whl", hash = "sha256:e5c5192ec8ebb9f8e4e5f26d2f02171fcfab3f666b66292fe0680980c13706b3"}, + {file = "maturin-0.14.12-py3-none-manylinux_2_12_i686.manylinux2010_i686.musllinux_1_1_i686.whl", hash = "sha256:fd4ac0c5591f30732a3ddab13f9d2a6f32d0fe4424e3f0c3612356ad95acb5e5"}, + {file = "maturin-0.14.12-py3-none-manylinux_2_12_x86_64.manylinux2010_x86_64.musllinux_1_1_x86_64.whl", hash = "sha256:3f555fb042b94f74995e6733a6406fb5afd6604828608968aebd4aa191180a2d"}, + {file = "maturin-0.14.12-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:fcc75fa7bf98326ef9b3e648b9107be6afdbb0cac4dd861f0040ad6a3d410a69"}, + {file = "maturin-0.14.12-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.musllinux_1_1_armv7l.whl", hash = "sha256:bfe98543b0f72c10dc46add16a09c5561d7028878a1b8440aa880de0a16f3ebc"}, + {file = "maturin-0.14.12-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.musllinux_1_1_ppc64le.whl", hash = "sha256:5989a92903e86a37428b4ebf1df44b08023e8efb695fb549f9dab0ac9cc5bae3"}, + {file = "maturin-0.14.12-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:16a81196ada94bc4b6ee1df6a4fa2e2dd3a2b51c9dd41e3561f59f796fdad92f"}, + {file = "maturin-0.14.12-py3-none-win32.whl", hash = "sha256:5af3a8545b66793ed04db8bb4750e7272f1724369ad792912c0e7be829f9e08b"}, + {file = "maturin-0.14.12-py3-none-win_amd64.whl", hash = "sha256:795c284b1ece7e6be720516ca0b0cdaf0ec8a399db5742fc9f45dd4c2e732fba"}, + {file = "maturin-0.14.12-py3-none-win_arm64.whl", hash = "sha256:bc63aa5b4717f1eb37cea39d450e90bc4050061def8e159228ec5e7c036481ec"}, + {file = "maturin-0.14.12.tar.gz", hash = "sha256:b8f6a39d5393f83b5fbb90bc4d99b45b62e9749293518640aba910c840311c57"}, +] + +[package.dependencies] +patchelf = {version = "*", optional = true, markers = "extra == \"patchelf\""} +tomli = {version = ">=1.1.0", markers = "python_version < \"3.11\""} + +[package.extras] +patchelf = ["patchelf"] +zig = ["ziglang (>=0.10.0,<0.11.0)"] + +[[package]] +name = "patchelf" +version = "0.17.2.0" +description = "A small utility to modify the dynamic linker and RPATH of ELF executables." +category = "dev" +optional = false +python-versions = "*" +files = [ + {file = "patchelf-0.17.2.0-py2.py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:b8d86f32e1414d6964d5d166ddd2cf829d156fba0d28d32a3bd0192f987f4529"}, + {file = "patchelf-0.17.2.0-py2.py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.musllinux_1_1_ppc64le.whl", hash = "sha256:9233a0f2fc73820c5bd468f27507bdf0c9ac543f07c7f9888bb7cf910b1be22f"}, + {file = "patchelf-0.17.2.0-py2.py3-none-manylinux_2_17_s390x.manylinux2014_s390x.musllinux_1_1_s390x.whl", hash = "sha256:6601d7d831508bcdd3d8ebfa6435c2379bf11e41af2409ae7b88de572926841c"}, + {file = "patchelf-0.17.2.0-py2.py3-none-manylinux_2_5_i686.manylinux1_i686.musllinux_1_1_i686.whl", hash = "sha256:c62a34f0c25e6c2d6ae44389f819a00ccdf3f292ad1b814fbe1cc23cb27023ce"}, + {file = "patchelf-0.17.2.0-py2.py3-none-manylinux_2_5_x86_64.manylinux1_x86_64.musllinux_1_1_x86_64.whl", hash = "sha256:1b9fd14f300341dc020ae05c49274dd1fa6727eabb4e61dd7fb6fb3600acd26e"}, + {file = "patchelf-0.17.2.0.tar.gz", hash = "sha256:dedf987a83d7f6d6f5512269e57f5feeec36719bd59567173b6d9beabe019efe"}, +] + +[package.extras] +test = ["importlib-metadata", "pytest"] + +[[package]] +name = "tomli" +version = "2.0.1" +description = "A lil' TOML parser" +category = "dev" +optional = false +python-versions = ">=3.7" +files = [ + {file = "tomli-2.0.1-py3-none-any.whl", hash = "sha256:939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc"}, + {file = "tomli-2.0.1.tar.gz", hash = "sha256:de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f"}, +] + +[metadata] +lock-version = "2.0" +python-versions = "^3.10" +content-hash = "6cf0aa69e59a3196bbfedbbfd1a95a48b982bd3d4fa97d2032119701f22c125f" diff --git a/utils/app/pyproject.toml b/utils/app/pyproject.toml new file mode 100644 index 0000000..75aacc3 --- /dev/null +++ b/utils/app/pyproject.toml @@ -0,0 +1,16 @@ +[tool.poetry] +name = "utils" +version = "0.0.0" +description = "" +authors = ["Nautilus"] +license = "AGPL-3.0" + +[tool.poetry.dependencies] +python = "^3.10" + +[tool.poetry.group.dev.dependencies] +maturin = {extras = ["patchelf"], version = "^0.14.10"} + +[build-system] +requires = ["poetry-core"] +build-backend = "poetry.core.masonry.api" diff --git a/utils/app/src/lib.rs b/utils/app/src/lib.rs new file mode 100644 index 0000000..2ca2021 --- /dev/null +++ b/utils/app/src/lib.rs @@ -0,0 +1,159 @@ +use std::slice; +use std::str::FromStr; + +use dotenvy_macro::dotenv; +use pyo3::exceptions::PyValueError; +use pyo3::prelude::*; +use sgx_types::*; +use sgx_urts::SgxEnclave; + +static ENCLAVE_FILE: &str = dotenv!("ENCLAVE_SHARED_OBJECT"); +static DATASET_SIZE_LIMIT_IN_BYTES: usize = 1024 * 1024; + +extern "C" { + fn row_counter_ecall( + eid: sgx_enclave_id_t, + retval: *mut sgx_status_t, + some_string: *const u8, + len: usize, + count: *mut uint64_t, + ) -> sgx_status_t; + + fn dataset_hashing_ecall( + eid: sgx_enclave_id_t, + retval: *mut sgx_status_t, + some_string: *const u8, + len: usize, + hash: *mut u8, + ) -> sgx_status_t; + + fn dataset_append_ecall( + eid: sgx_enclave_id_t, + retval: *mut sgx_status_t, + original_data: *const u8, + original_data_len: usize, + new_data: *const u8, + new_data_len: usize, + complete_data: *mut u8, + complete_data_len: *mut usize, + ) -> sgx_status_t; +} + +fn init_enclave() -> SgxResult { + let mut launch_token: sgx_launch_token_t = [0; 1024]; + let mut launch_token_updated: i32 = 0; + // call sgx_create_enclave to initialize an enclave instance + // Debug Support: set 2nd parameter to 1 + let debug = i32::from_str(dotenv!("SGX_DEBUG_MODE")).unwrap_or(1); + let mut misc_attr = sgx_misc_attribute_t { + secs_attr: sgx_attributes_t { flags: 0, xfrm: 0 }, + misc_select: 0, + }; + SgxEnclave::create( + ENCLAVE_FILE, + debug, + &mut launch_token, + &mut launch_token_updated, + &mut misc_attr, + ) +} + +#[pymodule] +fn utils(_py: Python, module: &PyModule) -> PyResult<()> { + module.add_function(wrap_pyfunction!(row_counter, module)?)?; + module.add_function(wrap_pyfunction!(dataset_hashing, module)?)?; + module.add_function(wrap_pyfunction!(dataset_append, module)?)?; + Ok(()) +} + +#[pyfunction] +pub fn row_counter(content: &str) -> PyResult { + let enclave = match init_enclave() { + Ok(enclave) => enclave, + Err(why) => { + let message = format!("initialising enclave failed: {why}!"); + return Err(PyValueError::new_err(message)); + } + }; + let mut retval = sgx_status_t::SGX_SUCCESS; + let mut count = 0; + let result = unsafe { + row_counter_ecall( + enclave.geteid(), + &mut retval, + content.as_ptr(), + content.len(), + &mut count, + ) + }; + if result != sgx_status_t::SGX_SUCCESS { + let message = format!("enclave ECALL failed: {result}!"); + return Err(PyValueError::new_err(message)); + } + enclave.destroy(); + Ok(count) +} + +#[pyfunction] +pub fn dataset_hashing(content: &str) -> PyResult { + let enclave = match init_enclave() { + Ok(enclave) => enclave, + Err(why) => { + let message = format!("initialising enclave failed: {why}!"); + return Err(PyValueError::new_err(message)); + } + }; + let mut retval = sgx_status_t::SGX_SUCCESS; + let mut result_vec: Vec = vec![0; 64]; + let hash = &mut result_vec[..]; + let result = unsafe { + dataset_hashing_ecall( + enclave.geteid(), + &mut retval, + content.as_ptr(), + content.len(), + hash.as_mut_ptr(), + ) + }; + if result != sgx_status_t::SGX_SUCCESS { + let message = format!("enclave ECALL failed: {result}!"); + return Err(PyValueError::new_err(message)); + } + enclave.destroy(); + let hash = String::from_utf8_lossy(hash); + Ok(hash.into()) +} + +#[pyfunction] +pub fn dataset_append(original_data: &str, new_data: &str) -> PyResult { + let enclave = match init_enclave() { + Ok(enclave) => enclave, + Err(why) => { + let message = format!("initialising enclave failed: {why}!"); + return Err(PyValueError::new_err(message)); + } + }; + let mut retval = sgx_status_t::SGX_SUCCESS; + let mut complete_data: Vec = Vec::with_capacity(DATASET_SIZE_LIMIT_IN_BYTES); + let mut complete_data_len = 0; + let result = unsafe { + dataset_append_ecall( + enclave.geteid(), + &mut retval, + original_data.as_ptr(), + original_data.len(), + new_data.as_ptr(), + new_data.len(), + complete_data.as_mut_ptr(), + &mut complete_data_len, + ) + }; + if result != sgx_status_t::SGX_SUCCESS { + let message = format!("enclave ECALL failed: {result}!"); + return Err(PyValueError::new_err(message)); + } + let data = unsafe { slice::from_raw_parts(complete_data.as_ptr(), complete_data_len.into()) }; + let data = String::from_utf8_lossy(&data); + enclave.destroy(); + Ok(data.into()) +} diff --git a/utils/buildenv.mk b/utils/buildenv.mk new file mode 100644 index 0000000..a86675e --- /dev/null +++ b/utils/buildenv.mk @@ -0,0 +1,167 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License.. +# +# + +CP := /bin/cp -f +MKDIR := mkdir -p +STRIP := strip +OBJCOPY := objcopy + +# clean the content of 'INCLUDE' - this variable will be set by vcvars32.bat +# thus it will cause build error when this variable is used by our Makefile, +# when compiling the code under Cygwin tainted by MSVC environment settings. +INCLUDE := + +# turn on stack protector for SDK +COMMON_FLAGS += -fstack-protector + +ifdef DEBUG + COMMON_FLAGS += -O0 -g -DDEBUG -UNDEBUG +else + COMMON_FLAGS += -O2 -D_FORTIFY_SOURCE=2 -UDEBUG -DNDEBUG +endif + +# turn on compiler warnings as much as possible +COMMON_FLAGS += -Wall -Wextra -Winit-self -Wpointer-arith -Wreturn-type \ + -Waddress -Wsequence-point -Wformat-security \ + -Wmissing-include-dirs -Wfloat-equal -Wundef -Wshadow \ + -Wcast-align -Wconversion -Wredundant-decls + +# additional warnings flags for C +CFLAGS += -Wjump-misses-init -Wstrict-prototypes -Wunsuffixed-float-constants + +# additional warnings flags for C++ +CXXFLAGS += -Wnon-virtual-dtor + +# for static_assert() +CXXFLAGS += -std=c++0x + +.DEFAULT_GOAL := all +# this turns off the RCS / SCCS implicit rules of GNU Make +% : RCS/%,v +% : RCS/% +% : %,v +% : s.% +% : SCCS/s.% + +# If a rule fails, delete $@. +.DELETE_ON_ERROR: + +HOST_FILE_PROGRAM := file + +UNAME := $(shell uname -m) +ifneq (,$(findstring 86,$(UNAME))) + HOST_ARCH := x86 + ifneq (,$(shell $(HOST_FILE_PROGRAM) -L $(SHELL) | grep 'x86[_-]64')) + HOST_ARCH := x86_64 + endif +else + $(info Unknown host CPU arhitecture $(UNAME)) + $(error Aborting) +endif + + +ifeq "$(findstring __INTEL_COMPILER, $(shell $(CC) -E -dM -xc /dev/null))" "__INTEL_COMPILER" + ifeq ($(shell test -f /usr/bin/dpkg; echo $$?), 0) + ADDED_INC := -I /usr/include/$(shell dpkg-architecture -qDEB_BUILD_MULTIARCH) + endif +endif + +ARCH := $(HOST_ARCH) +ifeq "$(findstring -m32, $(CXXFLAGS))" "-m32" + ARCH := x86 +endif + +ifeq ($(ARCH), x86) +COMMON_FLAGS += -DITT_ARCH_IA32 +else +COMMON_FLAGS += -DITT_ARCH_IA64 +endif + +CFLAGS += $(COMMON_FLAGS) +CXXFLAGS += $(COMMON_FLAGS) + +# Enable the security flags +COMMON_LDFLAGS := -Wl,-z,relro,-z,now,-z,noexecstack + +# mitigation options +MITIGATION_INDIRECT ?= 0 +MITIGATION_RET ?= 0 +MITIGATION_C ?= 0 +MITIGATION_ASM ?= 0 +MITIGATION_AFTERLOAD ?= 0 +MITIGATION_LIB_PATH := + +ifeq ($(MITIGATION-CVE-2020-0551), LOAD) + MITIGATION_C := 1 + MITIGATION_ASM := 1 + MITIGATION_INDIRECT := 1 + MITIGATION_RET := 1 + MITIGATION_AFTERLOAD := 1 + MITIGATION_LIB_PATH := cve_2020_0551_load +else ifeq ($(MITIGATION-CVE-2020-0551), CF) + MITIGATION_C := 1 + MITIGATION_ASM := 1 + MITIGATION_INDIRECT := 1 + MITIGATION_RET := 1 + MITIGATION_AFTERLOAD := 0 + MITIGATION_LIB_PATH := cve_2020_0551_cf +endif + +MITIGATION_CFLAGS := +MITIGATION_ASFLAGS := +ifeq ($(MITIGATION_C), 1) +ifeq ($(MITIGATION_INDIRECT), 1) + MITIGATION_CFLAGS += -mindirect-branch-register +endif +ifeq ($(MITIGATION_RET), 1) + MITIGATION_CFLAGS += -mfunction-return=thunk-extern +endif +endif + +ifeq ($(MITIGATION_ASM), 1) + MITIGATION_ASFLAGS += -fno-plt +ifeq ($(MITIGATION_AFTERLOAD), 1) + MITIGATION_ASFLAGS += -Wa,-mlfence-after-load=yes +else + MITIGATION_ASFLAGS += -Wa,-mlfence-before-indirect-branch=register +endif +ifeq ($(MITIGATION_RET), 1) + MITIGATION_ASFLAGS += -Wa,-mlfence-before-ret=not +endif +endif + +MITIGATION_CFLAGS += $(MITIGATION_ASFLAGS) + +# Compiler and linker options for an Enclave +# +# We are using '--export-dynamic' so that `g_global_data_sim' etc. +# will be exported to dynamic symbol table. +# +# When `pie' is enabled, the linker (both BFD and Gold) under Ubuntu 14.04 +# will hide all symbols from dynamic symbol table even if they are marked +# as `global' in the LD version script. +ENCLAVE_CFLAGS = -ffreestanding -nostdinc -fvisibility=hidden -fpie -fno-strict-overflow -fno-delete-null-pointer-checks +ENCLAVE_CXXFLAGS = $(ENCLAVE_CFLAGS) -nostdinc++ +ENCLAVE_LDFLAGS = $(COMMON_LDFLAGS) -Wl,-Bstatic -Wl,-Bsymbolic -Wl,--no-undefined \ + -Wl,-pie,-eenclave_entry -Wl,--export-dynamic \ + -Wl,--gc-sections \ + -Wl,--defsym,__ImageBase=0 + +ENCLAVE_CFLAGS += $(MITIGATION_CFLAGS) +ENCLAVE_ASFLAGS = $(MITIGATION_ASFLAGS) \ No newline at end of file diff --git a/utils/enclave/Cargo.lock b/utils/enclave/Cargo.lock new file mode 100644 index 0000000..4d5a71f --- /dev/null +++ b/utils/enclave/Cargo.lock @@ -0,0 +1,170 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 3 + +[[package]] +name = "arrayref" +version = "0.3.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544" + +[[package]] +name = "arrayvec" +version = "0.7.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6" + +[[package]] +name = "blake3" +version = "1.3.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "42ae2468a89544a466886840aa467a25b766499f4f04bf7d9fcd10ecee9fccef" +dependencies = [ + "arrayref", + "arrayvec", + "cc", + "cfg-if", + "constant_time_eq", +] + +[[package]] +name = "cc" +version = "1.0.78" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a20104e2335ce8a659d6dd92a51a767a0c062599c73b343fd152cb401e828c3d" + +[[package]] +name = "cfg-if" +version = "1.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd" + +[[package]] +name = "constant_time_eq" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f3ad85c1f65dc7b37604eb0e89748faf0b9653065f2a8ef69f96a687ec1e9279" + +[[package]] +name = "hashbrown_tstd" +version = "0.12.0" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" + +[[package]] +name = "itoa" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fad582f4b9e86b6caa621cabeb0963332d92eea04729ab12892c2533951e6440" + +[[package]] +name = "ryu" +version = "1.0.12" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7b4b9743ed687d4b4bcedf9ff5eaa7398495ae14e61cba0a295704edbc7decde" + +[[package]] +name = "serde" +version = "1.0.152" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bb7d1f0d3021d347a83e556fc4683dea2ea09d87bccdf88ff5c12545d89d5efb" + +[[package]] +name = "serde_json" +version = "1.0.91" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "877c235533714907a8c2464236f5c4b2a17262ef1bd71f38f35ea592c8da6883" +dependencies = [ + "itoa", + "ryu", + "serde", +] + +[[package]] +name = "sgx_alloc" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" + +[[package]] +name = "sgx_backtrace_sys" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" +dependencies = [ + "cc", + "sgx_build_helper", + "sgx_libc", +] + +[[package]] +name = "sgx_build_helper" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" + +[[package]] +name = "sgx_demangle" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" + +[[package]] +name = "sgx_libc" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" +dependencies = [ + "sgx_types", +] + +[[package]] +name = "sgx_tprotected_fs" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" +dependencies = [ + "sgx_trts", + "sgx_types", +] + +[[package]] +name = "sgx_trts" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" +dependencies = [ + "sgx_libc", + "sgx_types", +] + +[[package]] +name = "sgx_tstd" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" +dependencies = [ + "hashbrown_tstd", + "sgx_alloc", + "sgx_backtrace_sys", + "sgx_demangle", + "sgx_libc", + "sgx_tprotected_fs", + "sgx_trts", + "sgx_types", + "sgx_unwind", +] + +[[package]] +name = "sgx_types" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" + +[[package]] +name = "sgx_unwind" +version = "1.1.6" +source = "git+https://github.com/apache/teaclave-sgx-sdk?tag=v1.1.6#c3d82372dff81e5bafb07f71bc8ad532d06b504e" +dependencies = [ + "sgx_build_helper", +] + +[[package]] +name = "trusted" +version = "0.0.0" +dependencies = [ + "blake3", + "serde_json", + "sgx_tstd", + "sgx_types", +] diff --git a/utils/enclave/Cargo.toml b/utils/enclave/Cargo.toml new file mode 100644 index 0000000..e1e9b95 --- /dev/null +++ b/utils/enclave/Cargo.toml @@ -0,0 +1,25 @@ +[package] +name = "trusted" +version = "0.0.0" +edition = "2021" + +[lib] +name = "trusted" # Library name. If you change this, please reflect those changes in the Makefile on the variable ENCLAVE_CARGO_LIB +crate-type = ["staticlib"] + +[dependencies.blake3] +version = "1" +default-features = false + +[dependencies.sgx_tstd] +git = "https://github.com/apache/teaclave-sgx-sdk" +tag = "v1.1.6" + +[dependencies.sgx_types] +git = "https://github.com/apache/teaclave-sgx-sdk" +tag = "v1.1.6" + +[dependencies.serde_json] +version = "1" +default-features = false +features = ["alloc"] diff --git a/utils/enclave/Enclave.config.xml b/utils/enclave/Enclave.config.xml new file mode 100644 index 0000000..ee4c3f7 --- /dev/null +++ b/utils/enclave/Enclave.config.xml @@ -0,0 +1,12 @@ + + + 0 + 0 + 0x40000 + 0x100000 + 1 + 1 + 0 + 0 + 0xFFFFFFFF + diff --git a/utils/enclave/Enclave.edl b/utils/enclave/Enclave.edl new file mode 100644 index 0000000..3e1ad5f --- /dev/null +++ b/utils/enclave/Enclave.edl @@ -0,0 +1,27 @@ +enclave { + from "sgx_tstd.edl" import *; + from "sgx_backtrace.edl" import *; + trusted + { + public sgx_status_t row_counter_ecall( + [in, size=len] const uint8_t* some_string, + size_t len, + [out] uint64_t* count + ); + + public sgx_status_t dataset_hashing_ecall( + [in, size=len] const uint8_t* some_string, + size_t len, + [out, size=64] uint8_t* hash + ); + + public sgx_status_t dataset_append_ecall( + [in, size=original_data_len] const uint8_t* original_data, + size_t original_data_len, + [in, size=new_data_len] const uint8_t* new_data, + size_t new_data_len, + [user_check] uint8_t* complete_data, + [out] size_t* complete_data_len + ); + }; +}; diff --git a/utils/enclave/Enclave.lds b/utils/enclave/Enclave.lds new file mode 100644 index 0000000..e3d9d0e --- /dev/null +++ b/utils/enclave/Enclave.lds @@ -0,0 +1,9 @@ +enclave.so +{ + global: + g_global_data_sim; + g_global_data; + enclave_entry; + local: + *; +}; diff --git a/utils/enclave/Makefile b/utils/enclave/Makefile new file mode 100644 index 0000000..2efff65 --- /dev/null +++ b/utils/enclave/Makefile @@ -0,0 +1,146 @@ +# Makefile settings + +APP_T_SIGNED = enclave.signed.so +LIB = ../lib/ +BIN = ../bin/ +SRC_RST = ./src/ +APP_T = enclave.so +NAME_T = libenclave.a +SRC_U = ../app/ +SRC_T = ./ +OBJ_T = ../obj/ +SGX_SDK ?= /opt/sgxsdk +FLAGS = -Wall -Wextra +GCC_STEP1_T = -fstack-protector -I$(CUSTOM_COMMON_PATH)/inc -I$(CUSTOM_EDL_PATH) -I$(SGX_SDK)/include \ + -I$(SGX_SDK)/include/tlibc -I$(SGX_SDK)/include/stlport -I$(SGX_SDK)/include/epid -I $(SRC_T) \ + -L$(LIB) $(ENCLAVE_CFLAGS) $(SGX_COMMON_CFLAGS) +GCC_STEP2_T = -Wl,--no-undefined -nostdlib -nodefaultlibs -nostartfiles -L$(SGX_LIBRARY_PATH) \ + -Wl,--whole-archive -l$(TRTS_LIB) -Wl,--no-whole-archive \ + -Wl,--start-group -lsgx_tstdc -l$(SERVICE_LIB) -lsgx_tcrypto -L$(LIB) -lenclave -Wl,--end-group \ + -Wl,--version-script=$(SRC_T)Enclave.lds $(ENCLAVE_LDFLAGS) +FILES_T = Enclave_t.c +FILES_T_H = Enclave_t.h +EDL_FILE = Enclave.edl +TOML = Cargo.toml +ENCLAVE_CONFIG = Enclave.config.xml +SGX_ARCH = x64 +TRTS_LIB = sgx_trts +SERVICE_LIB = sgx_tservice +ENCLAVE_CARGO_LIB=libtrusted.a # This is the name of the enclave static library compiled by Cargo/Xargo. You will have to change it, depending of your project. +# Addprefix dependant variables, no need to change those +OUTPUT_T = $(FILES_T:.c=.o) +NAME = $(addprefix $(BIN), $(APP_T_SIGNED)) +BIN_T = $(addprefix $(BIN), $(APP_T)) +NAME_T_D = $(addprefix $(LIB), $(NAME_T)) +OUTPUT_W_FU=$(addprefix $(OBJ_U), $(OUTPUT_U)) +FILES_T_F=$(addprefix $(SRC_T), $(FILES_T)) +FILES_T_F_RUST=$(addprefix $(SRC_T), $(FILES_T_RUST)) +OUTPUT_W_FT=$(addprefix $(OBJ_T), $(OUTPUT_T)) +FILES_RUST_F= $(wildcard $(SRC_RST)*.rs) # Wildcard function used, no need to specify the rust files. Safe as we don't compile the rust files with the makefile. + +# Contains compilation rules for the enclave part + +include ../buildenv.mk + +# Custom header files and EDL paths needs to be specified with make (CUSTOM_EDL_PATH) (CUSTOM_COMMON_PATH) Same goes for Xargo location (XARGO_PATH) + +# Directly imported from the original Intel SGX samples, helpful to detect the system architecture + +ifeq ($(shell getconf LONG_BIT), 32) + SGX_ARCH := x86 +else ifeq ($(findstring -m32, $(CXXFLAGS)), -m32) + SGX_ARCH := x86 +endif + +ifeq ($(SGX_ARCH), x86) + SGX_COMMON_CFLAGS := -m32 + SGX_LIBRARY_PATH := $(SGX_SDK)/lib + SGX_ENCLAVE_SIGNER := $(SGX_SDK)/bin/x86/sgx_sign + SGX_EDGER8R := $(SGX_SDK)/bin/x86/sgx_edger8r +else + SGX_COMMON_CFLAGS := -m64 + SGX_LIBRARY_PATH := $(SGX_SDK)/lib64 + SGX_ENCLAVE_SIGNER := $(SGX_SDK)/bin/x64/sgx_sign + SGX_EDGER8R := $(SGX_SDK)/bin/x64/sgx_edger8r +endif + +ifeq ($(MITIGATION-CVE-2020-0551), LOAD) +export MITIGATION_CVE_2020_0551=LOAD +else ifeq ($(MITIGATION-CVE-2020-0551), CF) +export MITIGATION_CVE_2020_0551=CF +endif + +# If specified, software / simulation mode. Otherwise, hardware mode no matter what. + +ifeq ($(SGX_MODE), SW) + TRTS_LIB := sgx_trts_sim + SERVICE_LIB := sgx_tservice_sim +endif + +# If debug mode, we can set up extra options such as the debug flags + +ifeq ($(SGX_DEBUG), 1) + SGX_COMMON_CFLAGS += -O0 -g +else + SGX_COMMON_CFLAGS += -O2 +endif + +# Compilation process, we set up all the dependencies needed to have the correct order of build, and avoid relink + +all: $(NAME) + +# We print the compilation mode we're in (hardware/software mode), just as a reminder. + +$(NAME): $(BIN_T) +ifeq ($(SGX_MODE), SW) + @echo "\033[32mSoftware / Simulation mode\033[0m" +else + @echo "\033[32mHardware mode\033[0m" +endif + @echo "\033[32mGenerating keys and signing the enclave...\033[0m" + @mkdir -p $(BIN) + @openssl genrsa -out Enclave_private.pem -3 3072 + @openssl rsa -in Enclave_private.pem -pubout -out Enclave_public.pem + @$(SGX_ENCLAVE_SIGNER) sign -key $(SRC_T)Enclave_private.pem -enclave $(BIN_T) -out $@ -config $(SRC_T)Enclave.config.xml + +$(BIN_T): $(NAME_T_D) + @echo "\033[32mBuilding the enclave...\033[0m" + mkdir -p $(BIN) + @$(CXX) $(OUTPUT_W_FT) -o $@ $(GCC_STEP2_T) + +$(NAME_T_D): $(FILES_T_F) $(OUTPUT_W_FT) $(FILES_RUST_F) $(EDL_FILE) $(ENCLAVE_CONFIG) $(TOML) # We added as a reference the rust files, along with the EDL, the XML config file and the cargo.toml file, so Make can detect if any change was made + @echo "\033[32mBuilding enclave static library with Cargo...\033[0m" + @cargo build --release + mkdir -p $(LIB) + @cp ./target/release/$(ENCLAVE_CARGO_LIB) $(LIB)libenclave.a + +$(FILES_T_F): $(SGX_EDGER8R) $(SRC_T)/Enclave.edl + @echo "\033[32mGenerating trusted SGX C edl files...\033[0m" + @$(SGX_EDGER8R) --trusted $(SRC_T)/Enclave.edl --search-path $(SGX_SDK)/include --search-path $(CUSTOM_EDL_PATH) --trusted-dir $(SRC_T) + +$(OBJ_T)%.o:$(SRC_T)%.c + @mkdir -p $(OBJ_T) + @echo "\033[32m$?: Build in progress...\033[0m" + @$(CC) $(FLAGS) $(GCC_STEP1_T) -o $@ -c $? + +clean: c_clean + @rm -rf $(OBJ_T) + @echo "\033[32mObject files deleted\033[0m" + +fclean: clean fclean_enclave + +fclean_enclave: + @echo "\033[32mBinary file $(NAME) deleted\033[0m" + @rm -f $(NAME) + @rm -f $(BIN_T) + @rm -f $(LIB)libenclave.a + @cargo clean && rm -f Cargo.lock + +c_clean: + @echo "\033[32mC edl generated files deleted\033[0m" + @rm -rf $(FILES_T_F) + @rm -f $(FILES_T_H) + +re: fclean all + +.PHONY: all clean c_clean fclean re fclean_enclave diff --git a/utils/enclave/src/lib.rs b/utils/enclave/src/lib.rs new file mode 100644 index 0000000..35638ae --- /dev/null +++ b/utils/enclave/src/lib.rs @@ -0,0 +1,84 @@ +#![cfg_attr(not(target_env = "sgx"), no_std)] +#![deny(unsafe_op_in_unsafe_fn)] + +use std::vec::Vec; +use std::{eprintln, ptr, slice}; + +use sgx_tstd as std; +use sgx_types::*; + +#[no_mangle] +pub unsafe extern "C" fn row_counter_ecall( + some_string: *const u8, + some_len: usize, + count: &mut usize, +) -> sgx_status_t { + let str_slice = unsafe { slice::from_raw_parts(some_string, some_len) }; + + let value = if let Ok(value) = serde_json::from_slice::>(str_slice) { + value + } else { + return sgx_status_t::SGX_ERROR_UNEXPECTED; + }; + *count = value.len(); + + sgx_status_t::SGX_SUCCESS +} + +#[no_mangle] +pub unsafe extern "C" fn dataset_hashing_ecall( + some_string: *const u8, + some_len: usize, + hash: &mut u8, +) -> sgx_status_t { + let str_slice = unsafe { slice::from_raw_parts(some_string, some_len) }; + let hash_bytes = blake3::hash(str_slice).to_hex(); + unsafe { ptr::copy_nonoverlapping(hash_bytes.as_ptr(), hash, 64) }; + sgx_status_t::SGX_SUCCESS +} + +#[no_mangle] +pub unsafe extern "C" fn dataset_append_ecall( + original_data: *const u8, + original_data_len: usize, + new_data: *const u8, + new_data_len: usize, + complete_data: &mut u8, + complete_data_len: &mut usize, +) -> sgx_status_t { + let original_data = unsafe { slice::from_raw_parts(original_data, original_data_len) }; + let new_data = unsafe { slice::from_raw_parts(new_data, new_data_len) }; + + let data: Result, serde_json::Error> = + serde_json::from_slice(original_data); + let mut data = match data { + Ok(value) => value, + Err(why) => { + eprintln!("{why}"); + return sgx_status_t::SGX_ERROR_UNEXPECTED; + } + }; + + let new_data: Result, serde_json::Error> = + serde_json::from_slice(new_data); + match new_data { + Ok(value) => data.extend(value), + Err(why) => { + eprintln!("{why}"); + return sgx_status_t::SGX_ERROR_UNEXPECTED; + } + }; + + let data = match serde_json::to_string(&data) { + Ok(data) => data, + Err(why) => { + eprintln!("{why}"); + return sgx_status_t::SGX_ERROR_UNEXPECTED; + } + }; + + *complete_data_len = data.len(); + unsafe { ptr::copy_nonoverlapping(data.as_ptr(), complete_data, *complete_data_len) }; + + sgx_status_t::SGX_SUCCESS +} diff --git a/utils/sample.json b/utils/sample.json new file mode 100644 index 0000000..55bb9a9 --- /dev/null +++ b/utils/sample.json @@ -0,0 +1 @@ +[{"name":"John Smith","gpa":3.5,"age":25,"salary":50000},{"name":"Jane Doe","gpa":3.2,"age":22,"salary":45000},{"name":"Bob Johnson","gpa":3.8,"age":30,"salary":55000},{"name":"Sara Lee","gpa":3.0,"age":27,"salary":40000},{"name":"Tom Brown","gpa":3.7,"age":32,"salary":60000},{"name":"Emily Davis","gpa":3.4,"age":23,"salary":42000},{"name":"Michael Miller","gpa":3.9,"age":28,"salary":65000},{"name":"Jessica Wilson","gpa":3.1,"age":24,"salary":46000},{"name":"Matthew Anderson","gpa":3.6,"age":29,"salary":58000},{"name":"Nicholas Thompson","gpa":3.3,"age":26,"salary":49000},{"name":"Ashley Moore","gpa":3.8,"age":35,"salary":62000},{"name":"David Taylor","gpa":3.0,"age":31,"salary":52000},{"name":"Joseph Hernandez","gpa":3.7,"age":33,"salary":57000},{"name":"Brian Martinez","gpa":3.4,"age":30,"salary":50000},{"name":"Brandon Lee","gpa":3.9,"age":25,"salary":60000},{"name":"Adam Clark","gpa":3.1,"age":22,"salary":45000},{"name":"Natalie Rodriguez","gpa":3.6,"age":27,"salary":48000},{"name":"Justin Green","gpa":3.3,"age":32,"salary":55000}]