-
Notifications
You must be signed in to change notification settings - Fork 112
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This makes it easier to test various features even when SGX hardware is not available.
- Loading branch information
Showing
29 changed files
with
421 additions
and
155 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| #! /bin/bash | ||
|
|
||
| ############################################### | ||
| # Download common E2E build artifacts and make | ||
| # sure they are in the correct directories for | ||
| # E2E tests to run, etc, etc. | ||
| ############################################### | ||
|
|
||
| # Helpful tips on writing build scripts: | ||
| # https://buildkite.com/docs/pipelines/writing-build-scripts | ||
| set -euxo pipefail | ||
|
|
||
| source .buildkite/scripts/common.sh | ||
|
|
||
| # Randomize beginning of downloads to increase hits in CI pipeline cache | ||
| sleep $((RANDOM % 5)) | ||
|
|
||
| # Oasis node, test runner and runtime loader. | ||
| download_artifact oasis-node go/oasis-node 755 | ||
| download_artifact oasis-node.test go/oasis-node 755 | ||
| download_artifact oasis-test-runner go/oasis-test-runner 755 | ||
| download_artifact oasis-test-runner.test go/oasis-test-runner 755 | ||
|
|
||
| # Runtime loader. | ||
| download_artifact oasis-core-runtime-loader target/default/release 755 | ||
|
|
||
| # Simple key manager runtime. | ||
| download_artifact simple-keymanager.mocksgx target/default/release 755 | ||
| mv target/default/release/simple-keymanager.mocksgx target/default/release/simple-keymanager | ||
| download_artifact simple-keymanager.sgxs target/sgx/x86_64-fortanix-unknown-sgx/release 755 | ||
|
|
||
| # Test simple-keyvalue runtime. | ||
| download_artifact simple-keyvalue.mocksgx target/default/release 755 | ||
| mv target/default/release/simple-keyvalue.mocksgx target/default/release/simple-keyvalue | ||
| download_artifact simple-keyvalue.sgxs target/sgx/x86_64-fortanix-unknown-sgx/release 755 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| Add support for mock SGX builds | ||
|
|
||
| This makes it easier to test various features even when SGX hardware is | ||
| not available. |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| package sgx | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "time" | ||
|
|
||
| "github.com/oasisprotocol/oasis-core/go/common" | ||
| "github.com/oasisprotocol/oasis-core/go/common/cbor" | ||
| "github.com/oasisprotocol/oasis-core/go/common/node" | ||
| "github.com/oasisprotocol/oasis-core/go/common/sgx/pcs" | ||
| sgxQuote "github.com/oasisprotocol/oasis-core/go/common/sgx/quote" | ||
| "github.com/oasisprotocol/oasis-core/go/common/version" | ||
| consensus "github.com/oasisprotocol/oasis-core/go/consensus/api" | ||
| "github.com/oasisprotocol/oasis-core/go/runtime/host/protocol" | ||
| ) | ||
|
|
||
| type teeStateMock struct{} | ||
|
|
||
| func (ec *teeStateMock) Init(ctx context.Context, sp *sgxProvisioner, _ common.Namespace, _ version.Version) ([]byte, error) { | ||
| // Check whether the consensus layer even supports ECDSA attestations. | ||
| regParams, err := sp.consensus.Registry().ConsensusParameters(ctx, consensus.HeightLatest) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("unable to determine registry consensus parameters: %w", err) | ||
| } | ||
| if regParams.TEEFeatures == nil || !regParams.TEEFeatures.SGX.PCS { | ||
| return nil, fmt.Errorf("ECDSA not supported by the registry") | ||
| } | ||
|
|
||
| // Generate mock QE target info. | ||
| var targetInfo [512]byte | ||
|
|
||
| return targetInfo[:], nil | ||
| } | ||
|
|
||
| func (ec *teeStateMock) Update(ctx context.Context, sp *sgxProvisioner, conn protocol.Connection, report []byte, _ string) ([]byte, error) { | ||
| rawQuote, err := pcs.NewMockQuote(report) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to get quote: %w", err) | ||
| } | ||
|
|
||
| var quote pcs.Quote | ||
| if err = quote.UnmarshalBinary(rawQuote); err != nil { | ||
| return nil, fmt.Errorf("failed to parse quote: %w", err) | ||
| } | ||
|
|
||
| // Check what information we need to retrieve based on what is in the quote. | ||
| qs, ok := quote.Signature.(*pcs.QuoteSignatureECDSA_P256) | ||
| if !ok { | ||
| return nil, fmt.Errorf("unsupported attestation key type: %s", quote.Signature.AttestationKeyType()) | ||
| } | ||
|
|
||
| // Verify PCK certificate and extract the information required to get the TCB bundle. | ||
| pckInfo, err := qs.VerifyPCK(time.Now()) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("PCK verification failed: %w", err) | ||
| } | ||
|
|
||
| tcbBundle, err := sp.pcs.GetTCBBundle(ctx, pckInfo.FMSPC, pcs.UpdateStandard) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| // Prepare quote structure. | ||
| q := sgxQuote.Quote{ | ||
| PCS: &pcs.QuoteBundle{ | ||
| Quote: rawQuote, | ||
| TCB: *tcbBundle, | ||
| }, | ||
| } | ||
|
|
||
| // Call the runtime with the quote and TCB bundle. | ||
| rspBody, err := conn.Call( | ||
| ctx, | ||
| &protocol.Body{ | ||
| RuntimeCapabilityTEERakQuoteRequest: &protocol.RuntimeCapabilityTEERakQuoteRequest{ | ||
| Quote: q, | ||
| }, | ||
| }, | ||
| ) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("error while configuring quote: %w", err) | ||
| } | ||
| rsp := rspBody.RuntimeCapabilityTEERakQuoteResponse | ||
| if rsp == nil { | ||
| return nil, fmt.Errorf("unexpected response from runtime") | ||
| } | ||
|
|
||
| return cbor.Marshal(node.SGXAttestation{ | ||
| Versioned: cbor.NewVersioned(node.LatestSGXAttestationVersion), | ||
| Quote: q, | ||
| Height: rsp.Height, | ||
| Signature: rsp.Signature, | ||
| }), nil | ||
| } |
Oops, something went wrong.