Enclave3.cpp 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366
  1. /*
  2. * Copyright (C) 2011-2017 Intel Corporation. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * * Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * * Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in
  12. * the documentation and/or other materials provided with the
  13. * distribution.
  14. * * Neither the name of Intel Corporation nor the names of its
  15. * contributors may be used to endorse or promote products derived
  16. * from this software without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. *
  30. */
  31. // Enclave3.cpp : Defines the exported functions for the DLL application
  32. #include "sgx_eid.h"
  33. #include "Enclave3_t.h"
  34. #include "EnclaveMessageExchange.h"
  35. #include "error_codes.h"
  36. #include "Utility_E3.h"
  37. #include "sgx_thread.h"
  38. #include "sgx_dh.h"
  39. #include <map>
  40. #define UNUSED(val) (void)(val)
  41. std::map<sgx_enclave_id_t, dh_session_t>g_src_session_info_map;
  42. static uint32_t e3_foo1_wrapper(ms_in_msg_exchange_t *ms, size_t param_lenth, char** resp_buffer, size_t* resp_length);
  43. //Function pointer table containing the list of functions that the enclave exposes
  44. const struct {
  45. size_t num_funcs;
  46. const void* table[1];
  47. } func_table = {
  48. 1,
  49. {
  50. (const void*)e3_foo1_wrapper,
  51. }
  52. };
  53. //Makes use of the sample code function to establish a secure channel with the destination enclave
  54. uint32_t test_create_session(sgx_enclave_id_t src_enclave_id,
  55. sgx_enclave_id_t dest_enclave_id)
  56. {
  57. ATTESTATION_STATUS ke_status = SUCCESS;
  58. dh_session_t dest_session_info;
  59. //Core reference code function for creating a session
  60. ke_status = create_session(src_enclave_id, dest_enclave_id,&dest_session_info);
  61. if(ke_status == SUCCESS)
  62. {
  63. //Insert the session information into the map under the corresponding destination enclave id
  64. g_src_session_info_map.insert(std::pair<sgx_enclave_id_t, dh_session_t>(dest_enclave_id, dest_session_info));
  65. }
  66. memset(&dest_session_info, 0, sizeof(dh_session_t));
  67. return ke_status;
  68. }
  69. //Makes use of the sample code function to do an enclave to enclave call (Test Vector)
  70. uint32_t test_enclave_to_enclave_call(sgx_enclave_id_t src_enclave_id,
  71. sgx_enclave_id_t dest_enclave_id)
  72. {
  73. ATTESTATION_STATUS ke_status = SUCCESS;
  74. external_param_struct_t *p_struct_var, struct_var;
  75. internal_param_struct_t internal_struct_var;
  76. uint32_t target_fn_id, msg_type;
  77. char* marshalled_inp_buff;
  78. size_t marshalled_inp_buff_len;
  79. char* out_buff;
  80. size_t out_buff_len;
  81. dh_session_t *dest_session_info;
  82. size_t max_out_buff_size;
  83. char* retval;
  84. max_out_buff_size = 50;
  85. msg_type = ENCLAVE_TO_ENCLAVE_CALL;
  86. target_fn_id = 0;
  87. internal_struct_var.ivar1 = 0x5;
  88. internal_struct_var.ivar2 = 0x6;
  89. struct_var.var1 = 0x3;
  90. struct_var.var2 = 0x4;
  91. struct_var.p_internal_struct = &internal_struct_var;
  92. p_struct_var = &struct_var;
  93. size_t len_data = sizeof(struct_var) - sizeof(struct_var.p_internal_struct);
  94. size_t len_ptr_data = sizeof(internal_struct_var);
  95. //Marshals the input parameters for calling function foo1 in Enclave1 into a input buffer
  96. ke_status = marshal_input_parameters_e1_foo1(target_fn_id, msg_type, p_struct_var, len_data,
  97. len_ptr_data, &marshalled_inp_buff, &marshalled_inp_buff_len);
  98. if(ke_status != SUCCESS)
  99. {
  100. return ke_status;
  101. }
  102. //Search the map for the session information associated with the destination enclave id passed in
  103. std::map<sgx_enclave_id_t, dh_session_t>::iterator it = g_src_session_info_map.find(dest_enclave_id);
  104. if(it != g_src_session_info_map.end())
  105. {
  106. dest_session_info = &it->second;
  107. }
  108. else
  109. {
  110. SAFE_FREE(marshalled_inp_buff);
  111. return INVALID_SESSION;
  112. }
  113. //Core Reference Code function
  114. ke_status = send_request_receive_response(src_enclave_id, dest_enclave_id, dest_session_info,
  115. marshalled_inp_buff, marshalled_inp_buff_len, max_out_buff_size, &out_buff, &out_buff_len);
  116. if(ke_status != SUCCESS)
  117. {
  118. SAFE_FREE(marshalled_inp_buff);
  119. SAFE_FREE(out_buff);
  120. return ke_status;
  121. }
  122. ////Un-marshal the return value and output parameters from foo1 of Enclave1
  123. ke_status = unmarshal_retval_and_output_parameters_e1_foo1(out_buff, p_struct_var, &retval);
  124. if(ke_status != SUCCESS)
  125. {
  126. SAFE_FREE(marshalled_inp_buff);
  127. SAFE_FREE(out_buff);
  128. return ke_status;
  129. }
  130. SAFE_FREE(marshalled_inp_buff);
  131. SAFE_FREE(out_buff);
  132. SAFE_FREE(retval);
  133. return SUCCESS;
  134. }
  135. //Makes use of the sample code function to do a generic secret message exchange (Test Vector)
  136. uint32_t test_message_exchange(sgx_enclave_id_t src_enclave_id,
  137. sgx_enclave_id_t dest_enclave_id)
  138. {
  139. ATTESTATION_STATUS ke_status = SUCCESS;
  140. uint32_t target_fn_id, msg_type;
  141. char* marshalled_inp_buff;
  142. size_t marshalled_inp_buff_len;
  143. char* out_buff;
  144. size_t out_buff_len;
  145. dh_session_t *dest_session_info;
  146. size_t max_out_buff_size;
  147. char* secret_response;
  148. uint32_t secret_data;
  149. target_fn_id = 0;
  150. msg_type = MESSAGE_EXCHANGE;
  151. max_out_buff_size = 50;
  152. secret_data = 0x12345678; //Secret Data here is shown only for purpose of demonstration.
  153. //Marshals the parameters into a buffer
  154. ke_status = marshal_message_exchange_request(target_fn_id, msg_type, secret_data, &marshalled_inp_buff, &marshalled_inp_buff_len);
  155. if(ke_status != SUCCESS)
  156. {
  157. return ke_status;
  158. }
  159. //Search the map for the session information associated with the destination enclave id passed in
  160. std::map<sgx_enclave_id_t, dh_session_t>::iterator it = g_src_session_info_map.find(dest_enclave_id);
  161. if(it != g_src_session_info_map.end())
  162. {
  163. dest_session_info = &it->second;
  164. }
  165. else
  166. {
  167. SAFE_FREE(marshalled_inp_buff);
  168. return INVALID_SESSION;
  169. }
  170. //Core Reference Code function
  171. ke_status = send_request_receive_response(src_enclave_id, dest_enclave_id, dest_session_info, marshalled_inp_buff,
  172. marshalled_inp_buff_len, max_out_buff_size, &out_buff, &out_buff_len);
  173. if(ke_status != SUCCESS)
  174. {
  175. SAFE_FREE(marshalled_inp_buff);
  176. SAFE_FREE(out_buff);
  177. return ke_status;
  178. }
  179. //Un-marshal the secret response data
  180. ke_status = umarshal_message_exchange_response(out_buff, &secret_response);
  181. if(ke_status != SUCCESS)
  182. {
  183. SAFE_FREE(marshalled_inp_buff);
  184. SAFE_FREE(out_buff);
  185. return ke_status;
  186. }
  187. SAFE_FREE(marshalled_inp_buff);
  188. SAFE_FREE(out_buff);
  189. SAFE_FREE(secret_response);
  190. return SUCCESS;
  191. }
  192. //Makes use of the sample code function to close a current session
  193. uint32_t test_close_session(sgx_enclave_id_t src_enclave_id,
  194. sgx_enclave_id_t dest_enclave_id)
  195. {
  196. dh_session_t dest_session_info;
  197. ATTESTATION_STATUS ke_status = SUCCESS;
  198. //Search the map for the session information associated with the destination enclave id passed in
  199. std::map<sgx_enclave_id_t, dh_session_t>::iterator it = g_src_session_info_map.find(dest_enclave_id);
  200. if(it != g_src_session_info_map.end())
  201. {
  202. dest_session_info = it->second;
  203. }
  204. else
  205. {
  206. return NULL;
  207. }
  208. //Core reference code function for closing a session
  209. ke_status = close_session(src_enclave_id, dest_enclave_id);
  210. //Erase the session information associated with the destination enclave id
  211. g_src_session_info_map.erase(dest_enclave_id);
  212. return ke_status;
  213. }
  214. //Function that is used to verify the trust of the other enclave
  215. //Each enclave can have its own way verifying the peer enclave identity
  216. extern "C" uint32_t verify_peer_enclave_trust(sgx_dh_session_enclave_identity_t* peer_enclave_identity)
  217. {
  218. if(!peer_enclave_identity)
  219. {
  220. return INVALID_PARAMETER_ERROR;
  221. }
  222. if(peer_enclave_identity->isv_prod_id != 0 || !(peer_enclave_identity->attributes.flags & SGX_FLAGS_INITTED))
  223. // || peer_enclave_identity->attributes.xfrm !=3)// || peer_enclave_identity->mr_signer != xx //TODO: To be hardcoded with values to check
  224. {
  225. return ENCLAVE_TRUST_ERROR;
  226. }
  227. else
  228. {
  229. return SUCCESS;
  230. }
  231. }
  232. //Dispatch function that calls the approriate enclave function based on the function id
  233. //Each enclave can have its own way of dispatching the calls from other enclave
  234. extern "C" uint32_t enclave_to_enclave_call_dispatcher(char* decrypted_data,
  235. size_t decrypted_data_length,
  236. char** resp_buffer,
  237. size_t* resp_length)
  238. {
  239. ms_in_msg_exchange_t *ms;
  240. uint32_t (*fn1)(ms_in_msg_exchange_t *ms, size_t, char**, size_t*);
  241. if(!decrypted_data || !resp_length)
  242. {
  243. return INVALID_PARAMETER_ERROR;
  244. }
  245. ms = (ms_in_msg_exchange_t *)decrypted_data;
  246. if(ms->target_fn_id >= func_table.num_funcs)
  247. {
  248. return INVALID_PARAMETER_ERROR;
  249. }
  250. fn1 = (uint32_t (*)(ms_in_msg_exchange_t*, size_t, char**, size_t*))func_table.table[ms->target_fn_id];
  251. return fn1(ms, decrypted_data_length, resp_buffer, resp_length);
  252. }
  253. //Operates on the input secret and generates the output secret
  254. uint32_t get_message_exchange_response(uint32_t inp_secret_data)
  255. {
  256. uint32_t secret_response;
  257. //User should use more complex encryption method to protect their secret, below is just a simple example
  258. secret_response = inp_secret_data & 0x11111111;
  259. return secret_response;
  260. }
  261. //Generates the response from the request message
  262. extern "C" uint32_t message_exchange_response_generator(char* decrypted_data,
  263. char** resp_buffer,
  264. size_t* resp_length)
  265. {
  266. ms_in_msg_exchange_t *ms;
  267. uint32_t inp_secret_data;
  268. uint32_t out_secret_data;
  269. if(!decrypted_data || !resp_length)
  270. {
  271. return INVALID_PARAMETER_ERROR;
  272. }
  273. ms = (ms_in_msg_exchange_t *)decrypted_data;
  274. if(umarshal_message_exchange_request(&inp_secret_data,ms) != SUCCESS)
  275. return ATTESTATION_ERROR;
  276. out_secret_data = get_message_exchange_response(inp_secret_data);
  277. if(marshal_message_exchange_response(resp_buffer, resp_length, out_secret_data) != SUCCESS)
  278. return MALLOC_ERROR;
  279. return SUCCESS;
  280. }
  281. static uint32_t e3_foo1(param_struct_t *p_struct_var)
  282. {
  283. if(!p_struct_var)
  284. {
  285. return INVALID_PARAMETER_ERROR;
  286. }
  287. p_struct_var->var1++;
  288. p_struct_var->var2++;
  289. return(p_struct_var->var1 * p_struct_var->var2);
  290. }
  291. //Function which is executed on request from the source enclave
  292. static uint32_t e3_foo1_wrapper(ms_in_msg_exchange_t *ms,
  293. size_t param_lenth,
  294. char** resp_buffer,
  295. size_t* resp_length)
  296. {
  297. UNUSED(param_lenth);
  298. uint32_t ret;
  299. param_struct_t *p_struct_var;
  300. if(!ms || !resp_length)
  301. {
  302. return INVALID_PARAMETER_ERROR;
  303. }
  304. p_struct_var = (param_struct_t*)malloc(sizeof(param_struct_t));
  305. if(!p_struct_var)
  306. return MALLOC_ERROR;
  307. if(unmarshal_input_parameters_e3_foo1(p_struct_var, ms) != SUCCESS)
  308. {
  309. SAFE_FREE(p_struct_var);
  310. return ATTESTATION_ERROR;
  311. }
  312. ret = e3_foo1(p_struct_var);
  313. if(marshal_retval_and_output_parameters_e3_foo1(resp_buffer, resp_length, ret, p_struct_var) != SUCCESS)
  314. {
  315. SAFE_FREE(p_struct_var);
  316. return MALLOC_ERROR;
  317. }
  318. SAFE_FREE(p_struct_var);
  319. return SUCCESS;
  320. }