From ada83ece3a26a0b7b7a84f5676e857c2de1297e1 Mon Sep 17 00:00:00 2001 From: Valentyn Faychuk Date: Sat, 24 Aug 2024 06:11:39 +0200 Subject: [PATCH] prettified scripts, docs and code --- README.md | 30 ++++++++-- build_client.sh | 29 ++++++++-- build_server.sh | 29 ++++++++-- client.yaml | 2 +- examples/mratls_grpcs_client.rs | 9 +-- examples/mratls_grpcs_server.rs | 4 +- examples/mratls_https_client.rs | 12 ++-- examples/mratls_https_server.rs | 25 +++------ examples/signing_key.pem | 40 ++++++++++++++ src/http/mod.rs | 3 +- src/http/tonic.rs | 1 + src/http/tonic_server.rs | 97 --------------------------------- 12 files changed, 137 insertions(+), 144 deletions(-) create mode 100644 examples/signing_key.pem create mode 100644 src/http/tonic.rs delete mode 100644 src/http/tonic_server.rs diff --git a/README.md b/README.md index 517bdc4..e56f2e1 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,32 @@ # Occlum SGX Remote Attestation integrated in TLS connection -Steps to test the project: +The MRSIGNER of the `example/signing_key.pem` is hardcoded in the enclave code: ``` -occlum-cargo build --example server --features="occlum,actix-web" -strip -s target/x86_64-unknown-linux-musl/debug/examples/server -./build_server.sh +6871A831CED408CD99F0ED31587CC2B5C728C99D4A0A1ADF2F0C5574EBBB00DC +``` -occlum-cargo build --example client --features="occlum,reqwest" -strip -s target/x86_64-unknown-linux-musl/debug/examples/client +You can generate your own signing key. Just use the following command: + +``` +openssl genrsa -3 -out signing_key.pem 3072 +``` + +To get the MRSIGNER of the key, compile [this project](https://github.com/intel/sgx-ra-sample) +and use the following command: + +``` +./mrsigner signing_key.pem +``` + +## Running Examples + +Before running make sure you have installed the Occlum and the SGX driver. +You should also have the Occlum Rust toolchain installed to get `occlum-cargo`. +To test the project just run client and server scripts in different terminals: + +``` +./build_server.sh ./build_client.sh ``` diff --git a/build_client.sh b/build_client.sh index 420c91c..73eb678 100755 --- a/build_client.sh +++ b/build_client.sh @@ -1,12 +1,33 @@ #!/bin/bash set -e -# initialize occlum workspace -rm -rf client_instance && mkdir client_instance && cd client_instance +SCRIPT=$0 +EXAMPLE=$1 +if [ $# -eq 0 ] || [ "$EXAMPLE" != "https" ] && [ "$EXAMPLE" != "grpcs" ]; then + echo "usage: $SCRIPT https|grpcs" + exit 1 +fi + +FEATURES=$(if [ "$EXAMPLE" == "https" ]; then echo "reqwest,occlum"; else echo "tonic,occlum"; fi) + +occlum-cargo build --example mratls_"${EXAMPLE}"_client --features="$FEATURES" +strip target/x86_64-unknown-linux-musl/debug/examples/mratls_"${EXAMPLE}"_client + +cat > client.yaml < server.yaml < Result<(), Box> { - let mrsigner_hex = "83D719E77DEACA1470F6BAF62A4D774303C899DB69020F9C70EE1DFC08C7CE9E"; + env_logger::init_from_env(env_logger::Env::default().default_filter_or("trace")); + + let mrsigner_hex = "6871A831CED408CD99F0ED31587CC2B5C728C99D4A0A1ADF2F0C5574EBBB00DC"; let mut mrsigner = [0u8; 32]; hex::decode_to_slice(mrsigner_hex, &mut mrsigner).expect("mrsigner decoding failed"); @@ -39,16 +41,11 @@ async fn main() -> Result<(), Box> { .enable_http2() .wrap_connector(s) }) - // Since our cert is signed with `example.com` but we actually want to connect - // to a local server we will override the Uri passed from the `HttpsConnector` - // and map it to the correct `Uri` that will connect us directly to the local server. .map_request(|_| Uri::from_static("https://[::1]:50051")) .service(http); let client = hyper_util::client::legacy::Client::builder(TokioExecutor::new()).build(connector); - // Using `with_origin` will let the codegenerated client set the `scheme` and - // `authority` from the provided `Uri`. let uri = Uri::from_static("https://example.com"); let mut client = EchoClient::with_origin(client, uri); diff --git a/examples/mratls_grpcs_server.rs b/examples/mratls_grpcs_server.rs index 9ef4c52..71622dd 100644 --- a/examples/mratls_grpcs_server.rs +++ b/examples/mratls_grpcs_server.rs @@ -23,7 +23,9 @@ use occlum_ratls::RaTlsConfigBuilder; #[tokio::main] async fn main() -> Result<(), Box> { - let mrsigner_hex = "83D719E77DEACA1470F6BAF62A4D774303C899DB69020F9C70EE1DFC08C7CE9E"; + env_logger::init_from_env(env_logger::Env::default().default_filter_or("trace")); + + let mrsigner_hex = "6871A831CED408CD99F0ED31587CC2B5C728C99D4A0A1ADF2F0C5574EBBB00DC"; let mut mrsigner = [0u8; 32]; hex::decode_to_slice(mrsigner_hex, &mut mrsigner).expect("mrsigner decoding failed"); diff --git a/examples/mratls_https_client.rs b/examples/mratls_https_client.rs index e318b77..7dfbd20 100644 --- a/examples/mratls_https_client.rs +++ b/examples/mratls_https_client.rs @@ -5,18 +5,14 @@ use reqwest::ClientBuilder; async fn main() -> Result<(), Box> { env_logger::init_from_env(env_logger::Env::default().default_filter_or("trace")); - let mrsigner_hex = "83D719E77DEACA1470F6BAF62A4D774303C899DB69020F9C70EE1DFC08C7CE9E"; + let mrsigner_hex = "6871A831CED408CD99F0ED31587CC2B5C728C99D4A0A1ADF2F0C5574EBBB00DC"; let mut mrsigner = [0u8; 32]; hex::decode_to_slice(mrsigner_hex, &mut mrsigner)?; let client = ClientBuilder::new() - .use_ratls( - RaTlsConfig::new().allow_instance_measurement( - InstanceMeasurement::new() - .with_mrsigners(vec![SGXMeasurement::new(mrsigner)]) - .with_product_ids(vec![0]), - ), - ) + .use_ratls(RaTlsConfig::new().allow_instance_measurement( + InstanceMeasurement::new().with_mrsigners(vec![SGXMeasurement::new(mrsigner)]), + )) .build()?; let res = client.get("https://127.0.0.1:8000").send().await?; let data = res.text().await?; diff --git a/examples/mratls_https_server.rs b/examples/mratls_https_server.rs index 28130df..e837bce 100644 --- a/examples/mratls_https_server.rs +++ b/examples/mratls_https_server.rs @@ -8,30 +8,23 @@ async fn index() -> String { } #[actix_web::main] -async fn main() -> std::io::Result<()> { +async fn main() -> Result<(), Box> { env_logger::init_from_env(env_logger::Env::default().default_filter_or("trace")); - let mrsigner_hex = "83D719E77DEACA1470F6BAF62A4D774303C899DB69020F9C70EE1DFC08C7CE9E"; + let mrsigner_hex = "6871A831CED408CD99F0ED31587CC2B5C728C99D4A0A1ADF2F0C5574EBBB00DC"; let mut mrsigner = [0u8; 32]; - hex::decode_to_slice(mrsigner_hex, &mut mrsigner).expect("mrsigner decoding failed"); + hex::decode_to_slice(mrsigner_hex, &mut mrsigner)?; HttpServer::new(|| App::new().service(index)) .bind_ratls( SocketAddr::from(([127, 0, 0, 1], 8000)), - RaTlsConfig::new() - .allow_instance_measurement( - InstanceMeasurement::new().with_mrsigners(vec![SGXMeasurement::new(mrsigner)]), - ) - .allow_instance_measurement( - InstanceMeasurement::new() - .with_mrenclaves(vec![ - SGXMeasurement::new([0u8; 32]), - SGXMeasurement::new([1u8; 32]), - ]) - .with_product_ids(vec![0, 2]), - ), + RaTlsConfig::new().allow_instance_measurement( + InstanceMeasurement::new().with_mrsigners(vec![SGXMeasurement::new(mrsigner)]), + ), ) .unwrap() .run() - .await + .await?; + + Ok(()) } diff --git a/examples/signing_key.pem b/examples/signing_key.pem new file mode 100644 index 0000000..c23a936 --- /dev/null +++ b/examples/signing_key.pem @@ -0,0 +1,40 @@ +-----BEGIN PRIVATE KEY----- +MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQCwkW9VPSw/1TBy +zueoRDz+D+Cxw+2ODbQ1MEpT28Ikyqi8zu00KocYRDX4yiaznnXO/FrBDHB4QJ/F +cBaLnjl/lr4CZu8KIeCVhc/lSUGd4azLyR5ZpcmNqlkpkVhLmEtuYGHth+AR84zj +GOPJx3mR1CUsaWfFVogoyDNQBhQFZxWkbcGbzPDiUbqUImwMH2rf8HXhXLt41xn7 +GdgNtR8qPKjzDwCvL4KE0QkNNedDv5xBY4f8bpy2Y4wkvCNXpIYazATZhgu/QSPm +/BGFxHrwaU2sfKNOD26EmlLaEdXgjd0wdabDRjjZo4afCqc6bmQkm4NjPLvxw/cC +Sd9ovukqktehtTsB7Xb5d5yiBnM7PGXe034tDHjbtR+YVYN8rNBdgKSm1Eqghdn8 +cchei+cK8ChGFcOqkrHIuXbol3ypqeVme01e5cz9VSrzdncEWZqEyd3x7tZmAOjR +/n35xg/OvLwSsJKCobeZgJxZESrjRYZHmBGqxkZn5pzC0wgKP08CAQMCggGAC8Vt +0nuLe7jhGLh12ASMmXiGckBDCXhhWOEWBZcvE4T6Lrh2Nq2AeRWdMrgktqQp/Lt9 +hFYpoZ3ohKESkddZKqOmRG1DIs8O+ObJl9GvCoaC/ITf49faPKT04KNKJyxJS6AG +h01TNGWR7QGoyS9ugTBGvrGxlbBvei964zOa70sjk37Io/yYl58McEaPvIqguZiQ +ZFuD9v1F/6xjvKWsvoyTy+/u+pzEb0EivJ0xjQzGJn4aIeU9pcJerR2b9Mazfu+h +RNVBObUwCjKB8kLG0LmZjIqsVK2LeV84ajW5U3iBHHgIMhdFDD3ndqVR+vsUzdWm +/c18tkuxkRZ5HwClDv72GhG0kUsEymMAQt2VGeCGr4AoWg8GgxkFhhEu2Bn/y82n +WnOEwiZZkyRySaHbM0DIU5rd6uKK/uj6RD3C1EZ3/s6XxgzGD2o8oWH88NTflSTH +Vvge3EyaTHB8wC4y1tIoAWKmNvQTL1+SAuXHuLhdmcMBAUrhGDFIm3wfjlUzAoHB +AMM/B/kamtzBKP0h1f1q2dB9X+YHDcU5cM2BgozOcmfncJkJMdNQC7jGhihYtdha +vkr9eB+FhfMwc8dJz08Qp1m1RLFXMNC0QEa3ShWiNE4kM9esOJj7bkr0hzQ/1W5z +Ug0VHQS/G8pYbgqsX6qbwz6L68EBU115IH5ar0In9jtqizwuPZ1PaH+ACeObxtEm ++NsHoVpHv4QEdV9io7nN7XsoCqvohCddb089Ia2WmXq2BavA4yh7ye8B2sg10joI +iwKBwQDngonX7J6A4ipQ5J5Wb/rlC+6KVXySqtGahIIUHYeUltvsY/oAmSFpPHCD +AiOtXW3KGUJkrOdQJBu6rvdIpJXv7SdpVHWt0+7W806haIJo8E2+pOhNL6jiSUWJ +E+9ks4FfXrlVUGd17ixSorZjdEvLmH+fAW+J02xauB2m0Rv+HlI8Mism1smWm5Ob +HN4WuYfsmo5/HUf5f2j4BIr9Qye9RFlSAFEi9yiDqeyAA92VwgSZah9u50wOAYDe +V1x5OM0CgcEAgioFULxnPdYbU2vj/kc74FOVRASz2ND13lZXCImhmppLELDL4jVd +JdmuxZB5Oucph1OlalkD93WihNvfigsaO84ty4914Hgq2c+GuRbNiW135R17EKee +3KMEzX/jnveMCLi+AyoShuWescg/xxKCKbKdK1Y3k6YVqZHKLBqkJ5xc0sl+aN+a +/6qxQmfZ4MSl51prkYUqWAL46kHCe96eUhqxx/BYGj5KNNNryQ8Q/HlZHStCGv0x +SgE8hXk20VsHAoHBAJpXBo/zFFXsHDXtvuRKp0NdSbGOUwxx4RGtrA1pBQ255/Lt +UVW7a5t9oFdWwnOTnoa7gZhzROAYEnx0pNsYY/VIxPDi+R6NSeSiNGubAZtK3n8Y +mt4fxeww2QYNSkMiVj+Ue441mk6eyDcXJEJNh90QVRSrn7E3nZHQE8SLZ/6+4X12 +x28527m9DRITPrnRBUhnCaoThVD/m1ADB1OCGn4tkOFVi2ykxa0b8wACk7ksAxDx +aknviAlWVemPkvt7MwKBwQCM934CRatNfHOlvzb21jm34Egk2LMp0uPjFzqW2JOQ +NM67966EjGCuR8i3n+tTRvGuYIUQvF2NhymZHQdpOWbc4wPXw4jM1j9BLREH45tS +TEeh41OgEuyF1ZjCDdukG/TUAoY3xlb7+pA9sD6dv0KxTmvdUcvtze2nBHgkyxul +wUhjowJS8WsDR72P6Lub1wIT1yI/6UNkx7RaY7pmNUh96D0Hkhh/vZ9/F7/1+Gnu +9DTouKJTmbNzsk375oViTww= +-----END PRIVATE KEY----- diff --git a/src/http/mod.rs b/src/http/mod.rs index 1f29384..ef80a03 100644 --- a/src/http/mod.rs +++ b/src/http/mod.rs @@ -2,4 +2,5 @@ pub mod actix_web; #[cfg(feature = "reqwest")] pub mod reqwest; -//mod tonic_server; +#[cfg(feature = "tonic")] +pub mod tonic; diff --git a/src/http/tonic.rs b/src/http/tonic.rs new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/src/http/tonic.rs @@ -0,0 +1 @@ + diff --git a/src/http/tonic_server.rs b/src/http/tonic_server.rs deleted file mode 100644 index a1f0bf6..0000000 --- a/src/http/tonic_server.rs +++ /dev/null @@ -1,97 +0,0 @@ -use hyper::server::conn::http2::Builder; -use hyper_util::{ - rt::{TokioExecutor, TokioIo}, - service::TowerToHyperService, -}; -use std::sync::Arc; -use tokio::net::TcpListener; -use tokio_rustls::{ - rustls::{pki_types::CertificateDer, ServerConfig}, - TlsAcceptor, -}; -use tonic::transport::server::TcpIncoming; -use tonic::{body::boxed, service::Routes, Request, Response, Status}; -use tower::ServiceExt; -use tower_http::ServiceBuilderExt; - -use crate::{config::RaTlsConfig, RaTlsConfigBuilder}; - -fn bind_ratls(config: RaTlsConfig) -> Result<(), std::io::Error> { - let config = ServerConfig::from_ratls_config(config) - .map_err(|e| std::io::Error::new(std::io::ErrorKind::Other, format!("{}", e)))?; - let tls_acceptor = TlsAcceptor::from(Arc::new(config)); - - // add tls_acceptor to the server - let incoming = TcpIncoming::new("[::1]:50051".parse().unwrap(), true, None)?; - - let svc = tower::ServiceBuilder::new() - .add_extension(Arc::new(ConnInfo { addr, certificates })) - .service(svc); - - self.bind_rustls_0_23(addr, config) -} -async fn main() -> Result<(), Box> { - let listener = TcpListener::bind("[::1]:50051").await?; - let tls_acceptor = TlsAcceptor::from(Arc::new(tls)); - - loop { - let (conn, addr) = match listener.accept().await { - Ok(incoming) => incoming, - Err(e) => { - eprintln!("Error accepting connection: {}", e); - continue; - } - }; - - let http = http.clone(); - let tls_acceptor = tls_acceptor.clone(); - let svc = svc.clone(); - - tokio::spawn(async move { - let mut certificates = Vec::new(); - - let conn = tls_acceptor - .accept_with(conn, |info| { - if let Some(certs) = info.peer_certificates() { - for cert in certs { - certificates.push(cert.clone()); - } - } - }) - .await - .unwrap(); - - http.serve_connection( - TokioIo::new(conn), - TowerToHyperService::new(svc.map_request(|req: http::Request<_>| req.map(boxed))), - ) - .await - .unwrap(); - }); - } -} - -#[derive(Debug)] -struct ConnInfo { - addr: std::net::SocketAddr, - certificates: Vec>, -} - -type EchoResult = Result, Status>; - -#[derive(Default)] -pub struct EchoServer {} - -#[tonic::async_trait] -impl pb::echo_server::Echo for EchoServer { - async fn unary_echo(&self, request: Request) -> EchoResult { - let conn_info = request.extensions().get::>().unwrap(); - println!( - "Got a request from: {:?} with certs: {:?}", - conn_info.addr, conn_info.certificates - ); - - let message = request.into_inner().message; - Ok(Response::new(EchoResponse { message })) - } -}