Enclave2.cpp 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339
  1. /*
  2. * Copyright (C) 2011-2017 Intel Corporation. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * * Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * * Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in
  12. * the documentation and/or other materials provided with the
  13. * distribution.
  14. * * Neither the name of Intel Corporation nor the names of its
  15. * contributors may be used to endorse or promote products derived
  16. * from this software without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. *
  30. */
  31. // Enclave2.cpp : Defines the exported functions for the DLL application
  32. #include "sgx_eid.h"
  33. #include "Enclave2_t.h"
  34. #include "EnclaveMessageExchange.h"
  35. #include "error_codes.h"
  36. #include "Utility_E2.h"
  37. #include "sgx_thread.h"
  38. #include "sgx_dh.h"
  39. #include <map>
  40. #define UNUSED(val) (void)(val)
  41. std::map<sgx_enclave_id_t, dh_session_t>g_src_session_info_map;
  42. static uint32_t e2_foo1_wrapper(ms_in_msg_exchange_t *ms, size_t param_lenth, char** resp_buffer, size_t* resp_length);
  43. //Function pointer table containing the list of functions that the enclave exposes
  44. const struct {
  45. size_t num_funcs;
  46. const void* table[1];
  47. } func_table = {
  48. 1,
  49. {
  50. (const void*)e2_foo1_wrapper,
  51. }
  52. };
  53. //Makes use of the sample code function to establish a secure channel with the destination enclave
  54. uint32_t test_create_session(sgx_enclave_id_t src_enclave_id,
  55. sgx_enclave_id_t dest_enclave_id)
  56. {
  57. ATTESTATION_STATUS ke_status = SUCCESS;
  58. dh_session_t dest_session_info;
  59. //Core reference code function for creating a session
  60. ke_status = create_session(src_enclave_id, dest_enclave_id,&dest_session_info);
  61. if(ke_status == SUCCESS)
  62. {
  63. //Insert the session information into the map under the corresponding destination enclave id
  64. g_src_session_info_map.insert(std::pair<sgx_enclave_id_t, dh_session_t>(dest_enclave_id, dest_session_info));
  65. }
  66. memset(&dest_session_info, 0, sizeof(dh_session_t));
  67. return ke_status;
  68. }
  69. //Makes use of the sample code function to do an enclave to enclave call (Test Vector)
  70. uint32_t test_enclave_to_enclave_call(sgx_enclave_id_t src_enclave_id,
  71. sgx_enclave_id_t dest_enclave_id)
  72. {
  73. ATTESTATION_STATUS ke_status = SUCCESS;
  74. param_struct_t *p_struct_var, struct_var;
  75. uint32_t target_fn_id, msg_type;
  76. char* marshalled_inp_buff;
  77. size_t marshalled_inp_buff_len;
  78. char* out_buff;
  79. size_t out_buff_len;
  80. dh_session_t *dest_session_info;
  81. size_t max_out_buff_size;
  82. char* retval;
  83. max_out_buff_size = 50;
  84. target_fn_id = 0;
  85. msg_type = ENCLAVE_TO_ENCLAVE_CALL;
  86. struct_var.var1 = 0x3;
  87. struct_var.var2 = 0x4;
  88. p_struct_var = &struct_var;
  89. //Marshals the input parameters for calling function foo1 in Enclave3 into a input buffer
  90. ke_status = marshal_input_parameters_e3_foo1(target_fn_id, msg_type, p_struct_var, &marshalled_inp_buff, &marshalled_inp_buff_len);
  91. if(ke_status != SUCCESS)
  92. {
  93. return ke_status;
  94. }
  95. //Search the map for the session information associated with the destination enclave id passed in
  96. std::map<sgx_enclave_id_t, dh_session_t>::iterator it = g_src_session_info_map.find(dest_enclave_id);
  97. if(it != g_src_session_info_map.end())
  98. {
  99. dest_session_info = &it->second;
  100. }
  101. else
  102. {
  103. SAFE_FREE(marshalled_inp_buff);
  104. return INVALID_SESSION;
  105. }
  106. //Core Reference Code function
  107. ke_status = send_request_receive_response(src_enclave_id, dest_enclave_id, dest_session_info, marshalled_inp_buff,
  108. marshalled_inp_buff_len, max_out_buff_size, &out_buff, &out_buff_len);
  109. if(ke_status != SUCCESS)
  110. {
  111. SAFE_FREE(marshalled_inp_buff);
  112. SAFE_FREE(out_buff);
  113. return ke_status;
  114. }
  115. //Un-marshal the return value and output parameters from foo1 of Enclave3
  116. ke_status = unmarshal_retval_and_output_parameters_e3_foo1(out_buff, p_struct_var, &retval);
  117. if(ke_status != SUCCESS)
  118. {
  119. SAFE_FREE(marshalled_inp_buff);
  120. SAFE_FREE(out_buff);
  121. return ke_status;
  122. }
  123. SAFE_FREE(marshalled_inp_buff);
  124. SAFE_FREE(out_buff);
  125. SAFE_FREE(retval);
  126. return SUCCESS;
  127. }
  128. //Makes use of the sample code function to do a generic secret message exchange (Test Vector)
  129. uint32_t test_message_exchange(sgx_enclave_id_t src_enclave_id,
  130. sgx_enclave_id_t dest_enclave_id)
  131. {
  132. ATTESTATION_STATUS ke_status = SUCCESS;
  133. uint32_t target_fn_id, msg_type;
  134. char* marshalled_inp_buff;
  135. size_t marshalled_inp_buff_len;
  136. char* out_buff;
  137. size_t out_buff_len;
  138. dh_session_t *dest_session_info;
  139. size_t max_out_buff_size;
  140. char* secret_response;
  141. uint32_t secret_data;
  142. target_fn_id = 0;
  143. msg_type = MESSAGE_EXCHANGE;
  144. max_out_buff_size = 50;
  145. secret_data = 0x12345678; //Secret Data here is shown only for purpose of demonstration.
  146. //Marshals the secret data into a buffer
  147. ke_status = marshal_message_exchange_request(target_fn_id, msg_type, secret_data, &marshalled_inp_buff, &marshalled_inp_buff_len);
  148. if(ke_status != SUCCESS)
  149. {
  150. return ke_status;
  151. }
  152. //Search the map for the session information associated with the destination enclave id passed in
  153. std::map<sgx_enclave_id_t, dh_session_t>::iterator it = g_src_session_info_map.find(dest_enclave_id);
  154. if(it != g_src_session_info_map.end())
  155. {
  156. dest_session_info = &it->second;
  157. }
  158. else
  159. {
  160. SAFE_FREE(marshalled_inp_buff);
  161. return INVALID_SESSION;
  162. }
  163. //Core Reference Code function
  164. ke_status = send_request_receive_response(src_enclave_id, dest_enclave_id, dest_session_info, marshalled_inp_buff,
  165. marshalled_inp_buff_len, max_out_buff_size, &out_buff, &out_buff_len);
  166. if(ke_status != SUCCESS)
  167. {
  168. SAFE_FREE(marshalled_inp_buff);
  169. SAFE_FREE(out_buff);
  170. return ke_status;
  171. }
  172. //Un-marshal the secret response data
  173. ke_status = umarshal_message_exchange_response(out_buff, &secret_response);
  174. if(ke_status != SUCCESS)
  175. {
  176. SAFE_FREE(marshalled_inp_buff);
  177. SAFE_FREE(out_buff);
  178. return ke_status;
  179. }
  180. SAFE_FREE(marshalled_inp_buff);
  181. SAFE_FREE(out_buff);
  182. SAFE_FREE(secret_response);
  183. return SUCCESS;
  184. }
  185. //Makes use of the sample code function to close a current session
  186. uint32_t test_close_session(sgx_enclave_id_t src_enclave_id,
  187. sgx_enclave_id_t dest_enclave_id)
  188. {
  189. dh_session_t dest_session_info;
  190. ATTESTATION_STATUS ke_status = SUCCESS;
  191. //Search the map for the session information associated with the destination enclave id passed in
  192. std::map<sgx_enclave_id_t, dh_session_t>::iterator it = g_src_session_info_map.find(dest_enclave_id);
  193. if(it != g_src_session_info_map.end())
  194. {
  195. dest_session_info = it->second;
  196. }
  197. else
  198. {
  199. return NULL;
  200. }
  201. //Core reference code function for closing a session
  202. ke_status = close_session(src_enclave_id, dest_enclave_id);
  203. //Erase the session information associated with the destination enclave id
  204. g_src_session_info_map.erase(dest_enclave_id);
  205. return ke_status;
  206. }
  207. //Function that is used to verify the trust of the other enclave
  208. //Each enclave can have its own way verifying the peer enclave identity
  209. extern "C" uint32_t verify_peer_enclave_trust(sgx_dh_session_enclave_identity_t* peer_enclave_identity)
  210. {
  211. if(!peer_enclave_identity)
  212. {
  213. return INVALID_PARAMETER_ERROR;
  214. }
  215. if(peer_enclave_identity->isv_prod_id != 0 || !(peer_enclave_identity->attributes.flags & SGX_FLAGS_INITTED))
  216. // || peer_enclave_identity->attributes.xfrm !=3)// || peer_enclave_identity->mr_signer != xx //TODO: To be hardcoded with values to check
  217. {
  218. return ENCLAVE_TRUST_ERROR;
  219. }
  220. else
  221. {
  222. return SUCCESS;
  223. }
  224. }
  225. //Dispatch function that calls the approriate enclave function based on the function id
  226. //Each enclave can have its own way of dispatching the calls from other enclave
  227. extern "C" uint32_t enclave_to_enclave_call_dispatcher(char* decrypted_data,
  228. size_t decrypted_data_length,
  229. char** resp_buffer,
  230. size_t* resp_length)
  231. {
  232. ms_in_msg_exchange_t *ms;
  233. uint32_t (*fn1)(ms_in_msg_exchange_t *ms, size_t, char**, size_t*);
  234. if(!decrypted_data || !resp_length)
  235. {
  236. return INVALID_PARAMETER_ERROR;
  237. }
  238. ms = (ms_in_msg_exchange_t *)decrypted_data;
  239. if(ms->target_fn_id >= func_table.num_funcs)
  240. {
  241. return INVALID_PARAMETER_ERROR;
  242. }
  243. fn1 = (uint32_t (*)(ms_in_msg_exchange_t*, size_t, char**, size_t*))func_table.table[ms->target_fn_id];
  244. return fn1(ms, decrypted_data_length, resp_buffer, resp_length);
  245. }
  246. //Operates on the input secret and generates the output secret
  247. uint32_t get_message_exchange_response(uint32_t inp_secret_data)
  248. {
  249. uint32_t secret_response;
  250. //User should use more complex encryption method to protect their secret, below is just a simple example
  251. secret_response = inp_secret_data & 0x11111111;
  252. return secret_response;
  253. }
  254. //Generates the response from the request message
  255. extern "C" uint32_t message_exchange_response_generator(char* decrypted_data,
  256. char** resp_buffer,
  257. size_t* resp_length)
  258. {
  259. ms_in_msg_exchange_t *ms;
  260. uint32_t inp_secret_data;
  261. uint32_t out_secret_data;
  262. if(!decrypted_data || !resp_length)
  263. {
  264. return INVALID_PARAMETER_ERROR;
  265. }
  266. ms = (ms_in_msg_exchange_t *)decrypted_data;
  267. if(umarshal_message_exchange_request(&inp_secret_data,ms) != SUCCESS)
  268. return ATTESTATION_ERROR;
  269. out_secret_data = get_message_exchange_response(inp_secret_data);
  270. if(marshal_message_exchange_response(resp_buffer, resp_length, out_secret_data) != SUCCESS)
  271. return MALLOC_ERROR;
  272. return SUCCESS;
  273. }
  274. static uint32_t e2_foo1(uint32_t var1, uint32_t var2)
  275. {
  276. return(var1 + var2);
  277. }
  278. //Function which is executed on request from the source enclave
  279. static uint32_t e2_foo1_wrapper(ms_in_msg_exchange_t *ms,
  280. size_t param_lenth,
  281. char** resp_buffer,
  282. size_t* resp_length)
  283. {
  284. UNUSED(param_lenth);
  285. uint32_t var1,var2,ret;
  286. if(!ms || !resp_length)
  287. {
  288. return INVALID_PARAMETER_ERROR;
  289. }
  290. if(unmarshal_input_parameters_e2_foo1(&var1, &var2, ms) != SUCCESS)
  291. return ATTESTATION_ERROR;
  292. ret = e2_foo1(var1, var2);
  293. if(marshal_retval_and_output_parameters_e2_foo1(resp_buffer, resp_length, ret) != SUCCESS )
  294. return MALLOC_ERROR; //can set resp buffer to null here
  295. return SUCCESS;
  296. }