file_other.cpp 9.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395
  1. /*
  2. * Copyright (C) 2011-2017 Intel Corporation. All rights reserved.
  3. *
  4. * Redistribution and use in source and binary forms, with or without
  5. * modification, are permitted provided that the following conditions
  6. * are met:
  7. *
  8. * * Redistributions of source code must retain the above copyright
  9. * notice, this list of conditions and the following disclaimer.
  10. * * Redistributions in binary form must reproduce the above copyright
  11. * notice, this list of conditions and the following disclaimer in
  12. * the documentation and/or other materials provided with the
  13. * distribution.
  14. * * Neither the name of Intel Corporation nor the names of its
  15. * contributors may be used to endorse or promote products derived
  16. * from this software without specific prior written permission.
  17. *
  18. * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19. * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  20. * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  21. * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  22. * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  23. * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  24. * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25. * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26. * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27. * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  28. * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29. *
  30. */
  31. #include "sgx_tprotected_fs.h"
  32. #include "sgx_tprotected_fs_t.h"
  33. #include "protected_fs_file.h"
  34. #include <sgx_utils.h>
  35. //#include <sgx_trts.h>
  36. #include <errno.h>
  37. // this function returns 0 only if the specified file existed and it was actually deleted
  38. // before we do that, we try to see if the file contained a monotonic counter, and if it did, we delete it from the system
  39. int32_t protected_fs_file::remove(const char* filename)
  40. {
  41. sgx_status_t status;
  42. int32_t result32 = 0;
  43. /*
  44. void* file = NULL;
  45. int64_t real_file_size = 0;
  46. if (filename == NULL)
  47. return 1;
  48. meta_data_node_t* file_meta_data = NULL;
  49. meta_data_encrypted_t* encrypted_part_plain = NULL;
  50. // if we have a problem in any of the stages, we simply jump to the end and try to remove the file...
  51. do {
  52. status = u_sgxprotectedfs_check_if_file_exists(&result, filename);
  53. if (status != SGX_SUCCESS)
  54. break;
  55. if (result == 0)
  56. {
  57. errno = EINVAL;
  58. return 1; // no such file, or file locked so we can't delete it anyways
  59. }
  60. try {
  61. file_meta_data = new meta_data_node_t;
  62. encrypted_part_plain = new meta_data_encrypted_t;
  63. }
  64. catch (std::bad_alloc e) {
  65. break;
  66. }
  67. status = u_sgxprotectedfs_exclusive_file_open(&file, filename, 1, &real_file_size, &result32);
  68. if (status != SGX_SUCCESS || file == NULL)
  69. break;
  70. if (real_file_size == 0 || real_file_size % NODE_SIZE != 0)
  71. break; // empty file or not an SGX protected FS file
  72. // might be an SGX protected FS file
  73. status = u_sgxprotectedfs_fread_node(&result32, file, 0, (uint8_t*)file_meta_data, NODE_SIZE);
  74. if (status != SGX_SUCCESS || result32 != 0)
  75. break;
  76. if (file_meta_data->plain_part.major_version != SGX_FILE_MAJOR_VERSION)
  77. break;
  78. sgx_aes_gcm_128bit_key_t zero_key_id = {0};
  79. sgx_aes_gcm_128bit_key_t key = {0};
  80. if (consttime_memequal(&file_meta_data->plain_part.key_id, &zero_key_id, sizeof(sgx_aes_gcm_128bit_key_t)) == 1)
  81. break; // shared file - no monotonic counter
  82. sgx_key_request_t key_request = {0};
  83. key_request.key_name = SGX_KEYSELECT_SEAL;
  84. key_request.key_policy = SGX_KEYPOLICY_MRENCLAVE;
  85. memcpy(&key_request.key_id, &file_meta_data->plain_part.key_id, sizeof(sgx_key_id_t));
  86. status = sgx_get_key(&key_request, &key);
  87. if (status != SGX_SUCCESS)
  88. break;
  89. status = sgx_rijndael128GCM_decrypt(&key,
  90. file_meta_data->encrypted_part, sizeof(meta_data_encrypted_blob_t),
  91. (uint8_t*)encrypted_part_plain,
  92. file_meta_data->plain_part.meta_data_iv, SGX_AESGCM_IV_SIZE,
  93. NULL, 0,
  94. &file_meta_data->plain_part.meta_data_gmac);
  95. if (status != SGX_SUCCESS)
  96. break;
  97. sgx_mc_uuid_t empty_mc_uuid = {0};
  98. if (consttime_memequal(&empty_mc_uuid, &encrypted_part_plain->mc_uuid, sizeof(sgx_mc_uuid_t)) == 0)
  99. {
  100. status = sgx_destroy_monotonic_counter(&encrypted_part_plain->mc_uuid);
  101. if (status != SGX_SUCCESS)
  102. break;
  103. // monotonic counter was deleted, mission accomplished!!
  104. }
  105. }
  106. while (0);
  107. // cleanup
  108. if (file_meta_data != NULL)
  109. delete file_meta_data;
  110. if (encrypted_part_plain != NULL)
  111. {
  112. // scrub the encrypted part
  113. memset_s(encrypted_part_plain, sizeof(meta_data_encrypted_t), 0, sizeof(meta_data_encrypted_t));
  114. delete encrypted_part_plain;
  115. }
  116. if (file != NULL)
  117. u_sgxprotectedfs_fclose(&result32, file);
  118. */
  119. // do the actual file removal
  120. status = u_sgxprotectedfs_remove(&result32, filename);
  121. if (status != SGX_SUCCESS)
  122. {
  123. errno = status;
  124. return 1;
  125. }
  126. if (result32 != 0)
  127. {
  128. if (result32 == -1) // no external errno value
  129. errno = EPERM;
  130. else
  131. errno = result32;
  132. return 1;
  133. }
  134. return 0;
  135. }
  136. int64_t protected_fs_file::tell()
  137. {
  138. int64_t result;
  139. sgx_thread_mutex_lock(&mutex);
  140. if (file_status != SGX_FILE_STATUS_OK)
  141. {
  142. errno = EPERM;
  143. last_error = SGX_ERROR_FILE_BAD_STATUS;
  144. sgx_thread_mutex_unlock(&mutex);
  145. return -1;
  146. }
  147. result = offset;
  148. sgx_thread_mutex_unlock(&mutex);
  149. return result;
  150. }
  151. // we don't support sparse files, fseek beyond the current file size will fail
  152. int protected_fs_file::seek(int64_t new_offset, int origin)
  153. {
  154. sgx_thread_mutex_lock(&mutex);
  155. if (file_status != SGX_FILE_STATUS_OK)
  156. {
  157. last_error = SGX_ERROR_FILE_BAD_STATUS;
  158. sgx_thread_mutex_unlock(&mutex);
  159. return -1;
  160. }
  161. //if (open_mode.binary == 0 && origin != SEEK_SET)
  162. //{
  163. // last_error = EINVAL;
  164. // sgx_thread_mutex_unlock(&mutex);
  165. // return -1;
  166. //}
  167. int result = -1;
  168. switch (origin)
  169. {
  170. case SEEK_SET:
  171. if (new_offset >= 0 && new_offset <= encrypted_part_plain.size)
  172. {
  173. offset = new_offset;
  174. result = 0;
  175. }
  176. break;
  177. case SEEK_CUR:
  178. if ((offset + new_offset) >= 0 && (offset + new_offset) <= encrypted_part_plain.size)
  179. {
  180. offset += new_offset;
  181. result = 0;
  182. }
  183. break;
  184. case SEEK_END:
  185. if (new_offset <= 0 && new_offset >= (0 - encrypted_part_plain.size))
  186. {
  187. offset = encrypted_part_plain.size + new_offset;
  188. result = 0;
  189. }
  190. break;
  191. default:
  192. break;
  193. }
  194. if (result == 0)
  195. end_of_file = false;
  196. else
  197. last_error = EINVAL;
  198. sgx_thread_mutex_unlock(&mutex);
  199. return result;
  200. }
  201. uint32_t protected_fs_file::get_error()
  202. {
  203. uint32_t result = SGX_SUCCESS;
  204. sgx_thread_mutex_lock(&mutex);
  205. if (last_error != SGX_SUCCESS)
  206. result = last_error;
  207. else if (file_status != SGX_FILE_STATUS_OK)
  208. result = SGX_ERROR_FILE_BAD_STATUS;
  209. sgx_thread_mutex_unlock(&mutex);
  210. return result;
  211. }
  212. bool protected_fs_file::get_eof()
  213. {
  214. return end_of_file;
  215. }
  216. void protected_fs_file::clear_error()
  217. {
  218. sgx_thread_mutex_lock(&mutex);
  219. if (file_status == SGX_FILE_STATUS_NOT_INITIALIZED ||
  220. file_status == SGX_FILE_STATUS_CLOSED ||
  221. file_status == SGX_FILE_STATUS_CRYPTO_ERROR ||
  222. file_status == SGX_FILE_STATUS_CORRUPTED ||
  223. file_status == SGX_FILE_STATUS_MEMORY_CORRUPTED) // can't fix these...
  224. {
  225. sgx_thread_mutex_unlock(&mutex);
  226. return;
  227. }
  228. if (file_status == SGX_FILE_STATUS_FLUSH_ERROR)
  229. {
  230. if (internal_flush(/*false,*/ true) == true)
  231. file_status = SGX_FILE_STATUS_OK;
  232. }
  233. if (file_status == SGX_FILE_STATUS_WRITE_TO_DISK_FAILED)
  234. {
  235. if (write_all_changes_to_disk(true) == true)
  236. {
  237. need_writing = false;
  238. file_status = SGX_FILE_STATUS_OK;
  239. }
  240. }
  241. /*
  242. if (file_status == SGX_FILE_STATUS_WRITE_TO_DISK_FAILED_NEED_MC)
  243. {
  244. if (write_all_changes_to_disk(true) == true)
  245. {
  246. need_writing = false;
  247. file_status = SGX_FILE_STATUS_MC_NOT_INCREMENTED; // fall through...next 'if' should take care of this one
  248. }
  249. }
  250. if ((file_status == SGX_FILE_STATUS_MC_NOT_INCREMENTED) &&
  251. (encrypted_part_plain.mc_value <= (UINT_MAX-2)))
  252. {
  253. uint32_t mc_value;
  254. sgx_status_t status = sgx_increment_monotonic_counter(&encrypted_part_plain.mc_uuid, &mc_value);
  255. if (status == SGX_SUCCESS)
  256. {
  257. assert(mc_value == encrypted_part_plain.mc_value);
  258. file_status = SGX_FILE_STATUS_OK;
  259. }
  260. else
  261. {
  262. last_error = status;
  263. }
  264. }
  265. */
  266. if (file_status == SGX_FILE_STATUS_OK)
  267. {
  268. last_error = SGX_SUCCESS;
  269. end_of_file = false;
  270. }
  271. sgx_thread_mutex_unlock(&mutex);
  272. }
  273. // clears the cache with all the plain data that was in it
  274. // doesn't clear the meta-data and first node, which are part of the 'main' structure
  275. int32_t protected_fs_file::clear_cache()
  276. {
  277. sgx_thread_mutex_lock(&mutex);
  278. if (file_status != SGX_FILE_STATUS_OK)
  279. {
  280. sgx_thread_mutex_unlock(&mutex);
  281. clear_error(); // attempt to fix the file, will also flush it
  282. sgx_thread_mutex_lock(&mutex);
  283. }
  284. else // file_status == SGX_FILE_STATUS_OK
  285. {
  286. internal_flush(/*false,*/ true);
  287. }
  288. if (file_status != SGX_FILE_STATUS_OK) // clearing the cache might lead to losing un-saved data
  289. {
  290. sgx_thread_mutex_unlock(&mutex);
  291. return 1;
  292. }
  293. while (cache.size() > 0)
  294. {
  295. void* data = cache.get_last();
  296. assert(data != NULL);
  297. assert(((file_data_node_t*)data)->need_writing == false); // need_writing is in the same offset in both node types
  298. // for production -
  299. if (data == NULL || ((file_data_node_t*)data)->need_writing == true)
  300. {
  301. sgx_thread_mutex_unlock(&mutex);
  302. return 1;
  303. }
  304. cache.remove_last();
  305. // before deleting the memory, need to scrub the plain secrets
  306. if (((file_data_node_t*)data)->type == FILE_DATA_NODE_TYPE) // type is in the same offset in both node types
  307. {
  308. file_data_node_t* file_data_node = (file_data_node_t*)data;
  309. memset_s(&file_data_node->plain, sizeof(data_node_t), 0, sizeof(data_node_t));
  310. delete file_data_node;
  311. }
  312. else
  313. {
  314. file_mht_node_t* file_mht_node = (file_mht_node_t*)data;
  315. memset_s(&file_mht_node->plain, sizeof(mht_node_t), 0, sizeof(mht_node_t));
  316. delete file_mht_node;
  317. }
  318. }
  319. sgx_thread_mutex_unlock(&mutex);
  320. return 0;
  321. }