Skip to content

Commit

Permalink
teerex: add target: TEEREX for easier disambiguation
Browse files Browse the repository at this point in the history
  • Loading branch information
@OverOrion
OverOrion committed Jul 4, 2023
1 parent 727a6b6 commit f384c41
Show file tree
Hide file tree
Showing 4 changed files with 58 additions and 40 deletions.
13 changes: 8 additions & 5 deletions primitives/teerex/src/lib.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@ use scale_info::TypeInfo;
use sp_core::H256;
use sp_std::prelude::*;

pub const TEEREX: &str = "TEEREX";

#[derive(Encode, Decode, Copy, Clone, PartialEq, Eq, sp_core::RuntimeDebug, TypeInfo)]
pub enum SgxBuildMode {
Debug,
Expand Down Expand Up @@ -143,13 +145,14 @@ impl TcbVersionStatus {

pub fn verify_examinee(&self, examinee: &TcbVersionStatus) -> bool {
for (v, r) in self.cpusvn.iter().zip(examinee.cpusvn.iter()) {
log::debug!("teerex: verify_examinee: v={:#?},r={:#?}", v, r);
log::debug!(target: TEEREX, "verify_examinee: v={:#?},r={:#?}", v, r);
if *v > *r {
return false
}
}
log::debug!(
"teerex: verify_examinee: self.pcesvn={:#?},examinee.pcesvn={:#?}",
target: TEEREX,
"verify_examinee: self.pcesvn={:#?},examinee.pcesvn={:#?}",
&self.pcesvn,
&examinee.pcesvn
);
Expand All @@ -174,10 +177,10 @@ impl TcbInfoOnChain {
}

pub fn verify_examinee(&self, examinee: &TcbVersionStatus) -> bool {
log::debug!("teerex: TcbInfoOnChain::verify_examinee: self={:#?}", &self,);
log::debug!("teerex: TcbInfoOnChain::verify_examinee: examinee={:#?}", &examinee,);
log::debug!(target: TEEREX, "TcbInfoOnChain::verify_examinee: self={:#?}", &self,);
log::debug!(target: TEEREX, "TcbInfoOnChain::verify_examinee: examinee={:#?}", &examinee,);
for tb in &self.tcb_levels {
log::debug!("teerex: TcbInfoOnChain::verify_examinee: tb={:#?}", &tb,);
log::debug!(target: TEEREX, "TcbInfoOnChain::verify_examinee: tb={:#?}", &tb,);
if tb.verify_examinee(examinee) {
return true
}
Expand Down
10 changes: 7 additions & 3 deletions teerex/sgx-verify/src/collateral.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ use chrono::prelude::{DateTime, Utc};
use serde::{de::Error, Deserialize, Deserializer, Serialize, Serializer};
use sp_std::prelude::*;
use teerex_primitives::{
Fmspc, MrSigner, Pcesvn, QeTcb, QuotingEnclave, TcbInfoOnChain, TcbVersionStatus,
Fmspc, MrSigner, Pcesvn, QeTcb, QuotingEnclave, TcbInfoOnChain, TcbVersionStatus, TEEREX,
};

/// The data structures in here are designed such that they can be used to serialize/deserialize
Expand Down Expand Up @@ -230,8 +230,12 @@ impl TcbInfo {
}

pub fn is_valid(&self, timestamp_millis: i64) -> bool {
log::debug!("teerex: called into runtime call register_tcb_info(), inside Self::is_valid, self is: {:#?}" , &self);
log::debug!("teerex: called into runtime call register_tcb_info(), inside Self::is_valid, timestamp_millis: {:#?}" , &timestamp_millis);
log::debug!(
target: TEEREX,
"Called into runtime call register_tcb_info(), inside Self::is_valid, self is: {:#?}",
&self
);
log::debug!(target: TEEREX, "Called into runtime call register_tcb_info(), inside Self::is_valid, timestamp_millis: {:#?}" , &timestamp_millis);
self.id == "SGX" &&
self.version == 3 &&
self.issue_date.timestamp_millis() < timestamp_millis &&
Expand Down
19 changes: 11 additions & 8 deletions teerex/sgx-verify/src/lib.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,7 @@ use sp_std::{
};
use teerex_primitives::{
Cpusvn, Fmspc, MrEnclave, MrSigner, Pcesvn, QuotingEnclave, SgxBuildMode, TcbVersionStatus,
TEEREX,
};
use webpki::SignatureAlgorithm;
use x509_cert::Certificate;
Expand Down Expand Up @@ -479,23 +480,24 @@ pub fn deserialize_tcb_info(
certificate: &webpki::EndEntityCert,
) -> Result<TcbInfo, &'static str> {
log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info."
target: TEEREX,
"Called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info."
);
let signature = encode_as_der(signature)?;
log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info, signature is: {:#?}", &signature
target: TEEREX, "Called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info, signature is: {:#?}", &signature
);

log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info, data is: {:#?}", &data
target: TEEREX, "Called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info, data is: {:#?}", &data
);
verify_signature(certificate, data, &signature, &webpki::ECDSA_P256_SHA256)?;
log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info, verify_signature succeded"
target: TEEREX, "Called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info, verify_signature succeded"
);
let res = serde_json::from_slice(data);
log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info, serde_json::from_slice is {:#?}", &res
target: TEEREX, "Called into runtime call register_tcb_info(), inside Self::deserialize_tcb_info, serde_json::from_slice is {:#?}", &res
);
res.map_err(|_| "Deserialization failed")
}
Expand All @@ -521,20 +523,21 @@ pub fn verify_certificate_chain<'a>(
verification_time: u64,
) -> Result<webpki::EndEntityCert<'a>, &'static str> {
log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::verify_certificate_chain."
target: TEEREX,
"Called into runtime call register_tcb_info(), inside Self::verify_certificate_chain."
);
let leaf_cert: webpki::EndEntityCert =
webpki::EndEntityCert::from(leaf_cert).map_err(|_| "Failed to parse leaf certificate")?;
log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::verify_certificate_chain, leaf cert parsed."
target: TEEREX, "Called into runtime call register_tcb_info(), inside Self::verify_certificate_chain, leaf cert parsed."
);
let time = webpki::Time::from_seconds_since_unix_epoch(verification_time / 1000);
let sig_algs = &[&webpki::ECDSA_P256_SHA256];
leaf_cert
.verify_is_valid_tls_server_cert(sig_algs, &DCAP_SERVER_ROOTS, intermediate_certs, time)
.map_err(|_| "Invalid certificate chain")?;
log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::verify_certificate_chain, is valid tls server cert."
target: TEEREX, "Called into runtime call register_tcb_info(), inside Self::verify_certificate_chain, is valid tls server cert."
);
Ok(leaf_cert)
}
Expand Down
56 changes: 32 additions & 24 deletions teerex/src/lib.rs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -168,11 +168,11 @@ pub mod pallet {
ra_report: Vec<u8>,
worker_url: Vec<u8>,
) -> DispatchResultWithPostInfo {
log::info!("teerex: called into runtime call register_ias_enclave()");
log::info!(target: TEEREX, "Called into runtime call register_ias_enclave()");
let sender = ensure_signed(origin)?;
ensure!(ra_report.len() <= MAX_RA_REPORT_LEN, <Error<T>>::RaReportTooLong);
ensure!(worker_url.len() <= MAX_URL_LEN, <Error<T>>::EnclaveUrlTooLong);
log::info!("teerex: parameter length ok");
log::info!(target: TEEREX, "parameter length ok");

#[cfg(not(feature = "skip-ias-check"))]
let (enclave, report) = Self::verify_report(&sender, ra_report).map(|report| {
Expand Down Expand Up @@ -230,7 +230,7 @@ pub mod pallet {
#[pallet::call_index(1)]
#[pallet::weight((<T as Config>::WeightInfo::unregister_enclave(), DispatchClass::Normal, Pays::Yes))]
pub fn unregister_enclave(origin: OriginFor<T>) -> DispatchResultWithPostInfo {
log::info!("teerex: called into runtime call unregister_enclave()");
log::info!(target: TEEREX, "Called into runtime call unregister_enclave()");
let sender = ensure_signed(origin)?;

Self::remove_enclave(&sender)?;
Expand Down Expand Up @@ -338,11 +338,11 @@ pub mod pallet {
dcap_quote: Vec<u8>,
worker_url: Vec<u8>,
) -> DispatchResultWithPostInfo {
log::info!("teerex: called into runtime call register_dcap_enclave()");
log::info!(target: TEEREX, "Called into runtime call register_dcap_enclave()");
let sender = ensure_signed(origin)?;
ensure!(dcap_quote.len() <= MAX_DCAP_QUOTE_LEN, <Error<T>>::RaReportTooLong);
ensure!(worker_url.len() <= MAX_URL_LEN, <Error<T>>::EnclaveUrlTooLong);
log::info!("teerex: parameter length ok");
log::info!(target: TEEREX, "parameter length ok");

#[cfg(not(feature = "skip-ias-check"))]
let (enclave, report) = Self::verify_dcap_quote(&sender, dcap_quote).map(|report| {
Expand Down Expand Up @@ -394,7 +394,7 @@ pub mod pallet {
tcb_status: None,
attestation_method: AttestationMethod::Skip,
});
log::info!("teerex: added enclave: ok");
log::info!(target: TEEREX, "added enclave: ok");
Ok(().into())
}

Expand All @@ -406,7 +406,7 @@ pub mod pallet {
signature: Vec<u8>,
certificate_chain: Vec<u8>,
) -> DispatchResultWithPostInfo {
log::info!("teerex: called into runtime call register_quoting_enclave()");
log::info!(target: TEEREX, "Called into runtime call register_quoting_enclave()");
// Quoting enclaves are registered globally and not for a specific sender
let _sender = ensure_signed(origin)?;
let quoting_enclave = Self::verify_quoting_enclave(
Expand All @@ -427,15 +427,21 @@ pub mod pallet {
signature: Vec<u8>,
certificate_chain: Vec<u8>,
) -> DispatchResultWithPostInfo {
log::info!("teerex: called into runtime call register_tcb_info()");
log::info!(target: TEEREX, "Called into runtime call register_tcb_info()");
// TCB info is registered globally and not for a specific sender
let _sender = ensure_signed(origin)?;
log::info!("teerex: called into runtime call register_tcb_info(), origin is ensured to be signed");
log::info!(
target: TEEREX,
"Called into runtime call register_tcb_info(), origin is ensured to be signed"
);
let (fmspc, on_chain_info) =
Self::verify_tcb_info(tcb_info, signature, certificate_chain)?;
<TcbInfo<T>>::insert(fmspc, &on_chain_info);
Self::deposit_event(Event::TcbInfoRegistered { fmspc, on_chain_info });
log::info!("teerex: called into runtime call register_tcb_info(), Self::verify_tcb_info succeded.");
log::info!(
target: TEEREX,
"Called into runtime call register_tcb_info(), Self::verify_tcb_info succeded."
);
Ok(().into())
}

Expand Down Expand Up @@ -611,7 +617,7 @@ impl<T: Config> Pallet<T> {
) -> Result<sgx_verify::SgxReport, DispatchErrorWithPostInfo> {
let report = sgx_verify::verify_ias_report(&ra_report)
.map_err(|_| <Error<T>>::RemoteAttestationVerificationFailed)?;
log::info!("teerex: IAS report successfully verified");
log::info!(target: TEEREX, "IAS report successfully verified");

let enclave_signer = T::AccountId::decode(&mut &report.pubkey[..])
.map_err(|_| <Error<T>>::EnclaveSignerDecodeError)?;
Expand All @@ -620,7 +626,7 @@ impl<T: Config> Pallet<T> {
// TODO: activate state checks as soon as we've fixed our setup #83
// ensure!((report.status == SgxStatus::Ok) | (report.status == SgxStatus::ConfigurationNeeded),
// "RA status is insufficient");
// log::info!("teerex: status is acceptable");
// log::info!(target: TEEREX, "status is acceptable");

Self::ensure_timestamp_within_24_hours(report.timestamp)?;
Ok(report)
Expand All @@ -641,29 +647,29 @@ impl<T: Config> Pallet<T> {
<Error<T>>::RemoteAttestationVerificationFailed
})?;

log::info!("teerex: DCAP quote verified. FMSPC from quote: {:?}", fmspc);
log::info!(target: TEEREX, "DCAP quote verified. FMSPC from quote: {:?}", fmspc);
let tcb_info_on_chain = <TcbInfo<T>>::get(fmspc);
log::info!("teerex: TCB Info verification...");
log::info!("teerex: tcb_info_on_chain is: {:#?}", &tcb_info_on_chain);
log::info!(target: TEEREX, "TCB Info verification...");
log::info!(target: TEEREX, "tcb_info_on_chain is: {:#?}", &tcb_info_on_chain);
let res = tcb_info_on_chain.verify_examinee(&tcb_info);
log::info!("teerex: TCB Info verification done, result is: {:#?}", &res);
log::info!(target: TEEREX, "TCB Info verification done, result is: {:#?}", &res);
// TODO reenable check
//ensure!(res, "tcb_info is outdated");

log::info!("teerex: DCAP quote ensured. tcbinfo: {:?}", &tcb_info);
log::info!(target: TEEREX, "DCAP quote ensured. tcbinfo: {:?}", &tcb_info);

let enclave_signer = T::AccountId::decode(&mut &report.pubkey[..])
.map_err(|_| <Error<T>>::EnclaveSignerDecodeError)?;
// ensure!(sender == &enclave_signer, <Error<T>>::SenderIsNotAttestedEnclave);
log::info!("teerex: DCAP quote ensure sender: {:#?}", sender);
log::info!("teerex: DCAP quote ensure enclave_signer: {:#?}", &enclave_signer);
log::info!(target: TEEREX, "DCAP quote ensure sender: {:#?}", sender);
log::info!(target: TEEREX, "DCAP quote ensure enclave_signer: {:#?}", &enclave_signer);

// TODO: activate state checks as soon as we've fixed our setup #83
// ensure!((report.status == SgxStatus::Ok) | (report.status == SgxStatus::ConfigurationNeeded),
// "RA status is insufficient");
// log::info!("teerex: status is acceptable");
// log::info!(target: TEEREX, "status is acceptable");

log::info!("teerex: DCAP report is: {:?}", &report);
log::info!(target: TEEREX, "DCAP report is: {:?}", &report);
Ok(report)
}

Expand Down Expand Up @@ -694,20 +700,22 @@ impl<T: Config> Pallet<T> {
certificate_chain: Vec<u8>,
) -> Result<(Fmspc, TcbInfoOnChain), DispatchErrorWithPostInfo> {
log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::verify_tcb_info."
target: TEEREX,
"Called into runtime call register_tcb_info(), inside Self::verify_tcb_info."
);
let verification_time: u64 = <timestamp::Pallet<T>>::get().saturated_into();
let certs = extract_certs(&certificate_chain);
ensure!(certs.len() >= 2, "Certificate chain must have at least two certificates");
log::info!(
"teerex: called into runtime call register_tcb_info(), inside Self::verify_tcb_info, certs len is >= 2."
target: TEEREX, "Called into runtime call register_tcb_info(), inside Self::verify_tcb_info, certs len is >= 2."
);
let intermediate_slices: Vec<&[u8]> = certs[1..].iter().map(Vec::as_slice).collect();
let leaf_cert =
verify_certificate_chain(&certs[0], &intermediate_slices, verification_time)?;
let tcb_info = deserialize_tcb_info(&tcb_info, &signature, &leaf_cert)?;
log::info!(
"teerex: called into runtime call register_tcb_info(), Self::deserialize_tcb_info succeded."
target: TEEREX,
"Called into runtime call register_tcb_info(), Self::deserialize_tcb_info succeded."
);
if tcb_info.is_valid(verification_time.try_into().unwrap()) {
Ok(tcb_info.to_chain_tcb_info())
Expand Down

0 comments on commit f384c41

Please sign in to comment.