Merge branch 'brave:master' into master

.github/renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>brave/renovate-config"
+  ]
+}

.github/workflows/codeql-analysis.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@928ff8c822d966a999092a6a35e32177899afb7c # v2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@928ff8c822d966a999092a6a35e32177899afb7c # v2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,4 +69,4 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@928ff8c822d966a999092a6a35e32177899afb7c # v2

.github/workflows/golangci-lint.yml

@@ -16,12 +16,12 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3
         with:
           go-version: 1.19
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
           version: latest

.github/workflows/security-action.yml

@@ -17,7 +17,7 @@ jobs:
       matrix:
         language: [ 'generic', 'javascript', 'python', 'ruby', 'go' ]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
         with:
           fetch-depth: 0
       - uses: brave/security-action@main

Makefile

@@ -3,6 +3,8 @@ godeps = *.go go.mod go.sum
 cover_out = cover.out
 cover_html = cover.html
 
+ARCH ?= amd64
+
 all: lint test $(binary)
 
 .PHONY: lint
@@ -24,7 +26,7 @@ $(cover_html): $(cover_out)
 	go tool cover -html=$(cover_out) -o $(cover_html)
 
 $(binary): $(godeps)
-	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -buildvcs=false -o $(binary)
+	CGO_ENABLED=0 GOOS=linux GOARCH=$(ARCH) go build -trimpath -ldflags="-s -w" -buildvcs=false -o $(binary)
 
 .PHONY: clean
 clean:

attestation.go

@@ -10,17 +10,19 @@ import (
 )
 
 const (
-	hashPrefix    = "sha256:"
-	hashSeparator = ";"
+	nonceNumDigits = nonceLen * 2 // The number of hex digits in a nonce.
 )
 
 var (
 	errBadForm           = errors.New("failed to parse POST form data")
 	errNoNonce           = errors.New("could not find nonce in URL query parameters")
-	errBadNonceFormat    = fmt.Errorf("unexpected nonce format; must be %d-digit hex string", nonceLen*2)
+	errBadNonceFormat    = fmt.Errorf("unexpected nonce format; must be %d-digit hex string", nonceNumDigits)
 	errFailedAttestation = errors.New("failed to obtain attestation document from hypervisor")
 	errProfilingSet      = errors.New("attestation disabled because profiling is enabled")
 
+	// Multihash prefix marks the hash type and digest size
+	hashPrefix = []byte{0x12, sha256.Size}
+
 	// getPCRValues is a variable pointing to a function that returns PCR
 	// values.  Using a variable allows us to easily mock the function in our
 	// unit tests.
@@ -34,17 +36,14 @@ type AttestationHashes struct {
 	appKeyHash [sha256.Size]byte // Sometimes set, depending on application.
 }
 
-// Serialize returns a byte slice that contains our concatenated hashes.  Note
-// that all hashes are always present.  If a hash was not initialized, it's set
-// to 0-bytes.
+// Serialize returns a byte slice that contains our concatenated hashes.
+// hashPrefix defines the hash type and length.  Note that all hashes are
+// always present.  If a hash was not initialized, it's set to 0-bytes.
 func (a *AttestationHashes) Serialize() []byte {
-	str := fmt.Sprintf("%s%s%s%s%s",
-		hashPrefix,
-		a.tlsKeyHash,
-		hashSeparator,
-		hashPrefix,
-		a.appKeyHash)
-	return []byte(str)
+	ser := []byte{}
+	ser = append(ser, append(hashPrefix, a.tlsKeyHash[:]...)...)
+	ser = append(ser, append(hashPrefix, a.appKeyHash[:]...)...)
+	return ser
 }
 
 // _getPCRValues returns the enclave's platform configuration register (PCR)

attestation_test.go

@@ -58,7 +58,7 @@ func TestAttestationHashes(t *testing.T) {
 	e.intSrv.Handler.ServeHTTP(rec, req)
 
 	s := e.hashes.Serialize()
-	expectedLen := sha256.Size*2 + len(hashPrefix)*2 + len(hashSeparator)
+	expectedLen := sha256.Size*2 + len(hashPrefix)*2
 	if len(s) != expectedLen {
 		t.Fatalf("Expected serialized hashes to be of length %d but got %d.",
 			expectedLen, len(s))
@@ -71,8 +71,7 @@ func TestAttestationHashes(t *testing.T) {
 	}
 
 	// Make sure that our previously-set hash is as expected.
-	expected := []byte(hashSeparator)
-	expected = append(expected, []byte(hashPrefix)...)
+	expected := []byte(hashPrefix)
 	expected = append(expected, appKeyHash[:]...)
 	offset := len(hashPrefix) + sha256.Size
 	if !bytes.Equal(s[offset:], expected) {

example/Dockerfile

@@ -6,7 +6,8 @@ WORKDIR /
 
 # Clone the repository and build the stand-alone nitriding executable.
 RUN git clone https://github.com/brave/nitriding-daemon.git
-RUN make -C nitriding-daemon/ nitriding
+ARG TARGETARCH
+RUN ARCH=${TARGETARCH} make -C nitriding-daemon/ nitriding
 
 # Use the intermediate builder image to add our files.  This is necessary to
 # avoid intermediate layers that contain inconsistent file permissions.

example/Makefile

@@ -4,6 +4,14 @@ image_tag := $(prog):$(version)
 image_tar := $(prog)-$(version)-kaniko.tar
 image_eif := $(image_tar:%.tar=%.eif)
 
+ARCH ?= $(shell uname -m)
+ifeq ($(ARCH),aarch64)
+	override ARCH=arm64
+endif
+ifeq ($(ARCH),x86_64)
+	override ARCH=amd64
+endif
+
 .PHONY: all
 all: run
 
@@ -18,7 +26,10 @@ $(image_tar): Dockerfile service.py start.sh
 		--no-push \
 		--tarPath $(image_tar) \
 		--destination $(image_tag) \
-		--custom-platform linux/amd64
+		--build-arg TARGETPLATFORM=linux/$(ARCH) \
+		--build-arg TARGETOS=linux \
+		--build-arg TARGETARCH=$(ARCH) \
+		--custom-platform linux/$(ARCH)
 
 $(image_eif): $(image_tar)
 	docker load -i $<

example/run-enclave.sh

@@ -27,4 +27,4 @@ nitro-cli run-enclave \
 	--attach-console
 
 echo "[ec2] Stopping gvproxy."
-sudo pkill -INT -P "$pid"
+sudo kill -INT "$pid"

example/start.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-nitriding -fqdn example.com -extport 443 -intport 8080 &
+nitriding -fqdn example.com -ext-pub-port 443 -intport 8080 -wait-for-app &
 echo "[sh] Started nitriding."
 
 sleep 1

go.mod

@@ -13,8 +13,8 @@ require (
 	github.com/prometheus/client_golang v1.15.1
 	github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8
 	github.com/vishvananda/netlink v1.2.1-beta.2
-	golang.org/x/crypto v0.6.0
-	golang.org/x/sys v0.7.0
+	golang.org/x/crypto v0.17.0
+	golang.org/x/sys v0.15.0
 )
 
 require (
@@ -33,8 +33,8 @@ require (
 	github.com/prometheus/procfs v0.9.0 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	golang.org/x/net v0.9.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
 	golang.org/x/sync v0.1.0 // indirect
-	golang.org/x/text v0.9.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
 )

go.sum

@@ -59,16 +59,16 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
-golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
+golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
 golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
-golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -79,12 +79,12 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.9.0 h1:2sjJmO8cDvYveuX97RDLsxlyUxLl+GHoLxBiRdHllBE=
-golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=