Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make SGX registration a bit more robust #480

Merged
merged 2 commits into from
Apr 9, 2024
Merged

Make SGX registration a bit more robust #480

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
215ec34
Harden SGX-mode registration
Mar 15, 2024
9300a3f
Minor changes
Apr 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion common/crypto/verify_ias_report/fetch_ias_certificates.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@
# -----------------------------------------------------------------
# -----------------------------------------------------------------
source ${PDO_SOURCE_ROOT}/bin/lib/common.sh
check_pdo_build_env

IAS_CERTIFICATE_URL=$1

Expand Down
4 changes: 2 additions & 2 deletions eservice/bin/register-with-ledger.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,15 +54,15 @@ function Store {
yell PDO_FORCE_IAS_PROXY is true
NO_PROXY='' no_proxy='' try eservice-enclave-info \
--save ${eservice_enclave_info_file} \
--loglevel info \
--loglevel ${PDO_LOG_LEVEL} \
--logfile __screen__ \
--identity ${ESERVICE_IDENTITY} \
--config ${ESERVICE_TOML} \
--config-dir ${ETCDIR}
else
try eservice-enclave-info \
--save ${eservice_enclave_info_file} \
--loglevel info \
--loglevel ${PDO_LOG_LEVEL} \
--logfile __screen__ \
--identity ${ESERVICE_IDENTITY} \
--config ${ESERVICE_TOML} \
Expand Down
2 changes: 2 additions & 0 deletions eservice/pdo/eservice/pdo_enclave.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -309,6 +309,8 @@ def create_signup_info(originator_public_key_hash, nonce):
logger.warning("Quote has GROUP_OUT_OF_DATE status (update your BIOS/microcode!!!) keep going")
elif _ias.last_verification_error() == "SW_HARDENING_NEEDED":
logger.warning("Quote has SW_HARDENING_NEEDED status (update your platform!!!) keep going")
elif _ias.last_verification_error() == "CONFIGURATION_AND_SW_HARDENING_NEEDED":
logger.warning("Quote has CONFIGURATION_AND_SW_HARDENING_NEEDED status (update your platform!!!) keep going")
else:
logger.error("invalid report fields")
return None
Expand Down
6 changes: 4 additions & 2 deletions ledgers/ccf/transaction_processor/pdo_tp.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,8 +293,10 @@ namespace ccfapp
// Verify the verification report enclave quote status
transform(verification_report.isvEnclaveQuoteStatus.begin(), verification_report.isvEnclaveQuoteStatus.end(),
verification_report.isvEnclaveQuoteStatus.begin(), ::toupper);
if ((verification_report.isvEnclaveQuoteStatus != OK_QUOTE_STATUS) && (verification_report.isvEnclaveQuoteStatus != GROUP_OUT_OF_DATE_QUOTE_STATUS) &&
(verification_report.isvEnclaveQuoteStatus != SW_HARDENING_NEEDED_QUOTE_STATUS)) {
if ((verification_report.isvEnclaveQuoteStatus != OK_QUOTE_STATUS) &&
(verification_report.isvEnclaveQuoteStatus != GROUP_OUT_OF_DATE_QUOTE_STATUS) &&
(verification_report.isvEnclaveQuoteStatus != SW_HARDENING_NEEDED_QUOTE_STATUS) &&
(verification_report.isvEnclaveQuoteStatus != CONFIGURATION_AND_SW_HARDENING_NEEDED_QUOTE_STATUS)) {
return ccf::make_error(
HTTP_STATUS_BAD_REQUEST, ccf::errors::InvalidInput, "Enclave attestation report verification Failed. Invalid quote status");
}
Expand Down
1 change: 1 addition & 0 deletions ledgers/ccf/transaction_processor/pdo_tp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ namespace ccfapp
const string OK_QUOTE_STATUS{"OK"};
const string GROUP_OUT_OF_DATE_QUOTE_STATUS{"GROUP_OUT_OF_DATE"};
const string SW_HARDENING_NEEDED_QUOTE_STATUS{"SW_HARDENING_NEEDED"};
const string CONFIGURATION_AND_SW_HARDENING_NEEDED_QUOTE_STATUS{"CONFIGURATION_AND_SW_HARDENING_NEEDED"};
const int BASENAME_SIZE{32};
const int ORIGINATOR_KEY_HASH_SIZE{64};

Expand Down
2 changes: 1 addition & 1 deletion pservice/lib/libpdo_enclave/secret_enclave.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -613,7 +613,7 @@ pdo_err_t VerifyEnclaveInfo(const std::string& enclaveInfo,
int r;
// verify quote (group-of-date is considered ok)
r = verify_enclave_quote_status(verificationReport.c_str(), verificationReport.length(),
QSF_ACCEPT_GROUP_OUT_OF_DATE | QSF_ACCEPT_SW_HARDENING_NEEDED);
QSF_ACCEPT_GROUP_OUT_OF_DATE | QSF_ACCEPT_SW_HARDENING_NEEDED | QSF_ACCEPT_CONFIGURATION_AND_SW_HARDENING_NEEDED);
pdo::error::ThrowIf<pdo::error::ValueError>(
r!=VERIFY_SUCCESS, "Invalid Enclave Quote");

Expand Down
Loading