general/occlum
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[demos] Update GRPC RATLS exported APIs names

Browse Source
This commit is contained in:
Zheng, Qi 2022-03-15 17:07:41 +08:00 committed by Zongmin.Gu
parent 4909a4f7fb
commit f334374a43
13 changed files with 49 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
demos/ra_tls/README.md
View File

@ -18,7 +18,7 @@
* Server
```
int gr_start_server(
int grpc_ratls_start_server(
const char *server_addr, // grpc server address+port, such as "localhost:50051"
const char *config_json, // ratls handshake config json file
const char *secret_json // secret config json file
@ -27,7 +27,7 @@ int gr_start_server(
* Client
```
int gr_client_get_secret(
int grpc_ratls_get_secret(
const char *server_addr, // grpc server address+port, such as "localhost:50051"
const char *config_json, // ratls handshake config json file
const char *name, // secret name to be requested

14
demos/ra_tls/grpc/v1.38.1/examples/cpp/ratls/client.cc
View File

@ -24,17 +24,17 @@
int main(int argc, char** argv) {
// Parse arguments
if (argc < 3) {
printf("[ERROR] At least one argument must be provided\n\n");
printf("Usage: client [<request_name>] [<secret_file_to_be_saved>]\n");
if (argc < 4) {
printf("[ERROR] Three arguments must be provided\n\n");
printf("Usage: client <grpc-server addr> <request_name> <secret_file_to_be_saved>\n");
return -1;
}
gr_client_get_secret(
"localhost:50051",
"dynamic_config.json",
grpc_ratls_get_secret(
argv[1],
argv[2]
"dynamic_config.json",
argv[2],
argv[3]
);
return 0;

2
demos/ra_tls/grpc/v1.38.1/examples/cpp/ratls/grpc_ratls_client.cc
View File

@ -115,7 +115,7 @@ void base64_decode(const char *b64input, unsigned char *dest, size_t dest_len) {
}
}
int gr_client_get_secret(
int grpc_ratls_get_secret(
const char *server_addr,
const char *config_json,
const char *name,

2
demos/ra_tls/grpc/v1.38.1/examples/cpp/ratls/grpc_ratls_client.h
View File

@ -6,7 +6,7 @@ extern "C" {
#endif
// client get secret
extern int gr_client_get_secret(
extern int grpc_ratls_get_secret(
const char *server_addr, // grpc server address+port, such as "localhost:50051"
const char *config_json, // ratls handshake config json file
const char *name, // secret name to be requested

2
demos/ra_tls/grpc/v1.38.1/examples/cpp/ratls/grpc_ratls_server.cc
View File

@ -68,7 +68,7 @@ class GrSecretServiceImpl final: public GrSecret::Service {
};
int gr_start_server(
int grpc_ratls_start_server(
const char *server_addr,
const char *config_json,
const char *secret_json

2
demos/ra_tls/grpc/v1.38.1/examples/cpp/ratls/grpc_ratls_server.h
View File

@ -6,7 +6,7 @@ extern "C" {
#endif
// start server
extern int gr_start_server(
extern int grpc_ratls_start_server(
const char *server_addr, // grpc server address+port, such as "localhost:50051"
const char *config_json, // ratls handshake config json file
const char *secret_json // secret config json file

12
demos/ra_tls/grpc/v1.38.1/examples/cpp/ratls/server.cc
View File

@ -15,12 +15,20 @@
* limitations under the License.
*
*/
#include <stdio.h>
#include <stdlib.h>
#include "../grpc_ratls_server.h"
int main(int argc, char** argv) {
gr_start_server(
"localhost:50051",
if (argc < 2) {
printf("[ERROR] One argument must be provided\n\n");
printf("Usage: server <grpc-server addr>\n");
return -1;
}
grpc_ratls_start_server(
argv[1],
"dynamic_config.json",
"secret_config.json"
);

17
demos/ra_tls/run.sh
View File

@ -5,13 +5,20 @@ postfix=$1
request=$2
file=${3:-/host/secret}
if [ "$postfix" != "server" ] && [ "$postfix" != "client" ]; then
GRPC_ADDR="localhost:50051"
if [ "$postfix" == "server" ]; then
pushd occlum_server
occlum run /bin/server ${GRPC_ADDR}
popd
elif [ "$postfix" == "client" ]; then
pushd occlum_client
occlum run /bin/client ${GRPC_ADDR} ${request} ${file}
popd
else
echo "input error args, it should be:"
echo "./run.sh server"
echo "./run.sh client"
echo "./run.sh client request_secret"
exit 1
fi
pushd occlum_$postfix
occlum run /bin/$postfix ${request} ${file}
popd

4
demos/remote_attestation/init_ra_flow/README.md
View File

@ -55,7 +55,7 @@ The `RA Verify Config` JSON records the secrets. Each secret has a name and its
* Starts the Flask-TLS-Infer demo. For every Occlum built application, it starts `init` process first, then starts the real application in RootFS. The default [`init`](../../../tools/init/) process just run RootFS integrity check and then load the RootFS where the real application is located.
For this demo, a modified [`init`](./init_ra/) is used. Besides the general `init` operation, it embeds the `GRPC-RATLS` client API `gr_client_get_secret`, gets the secrets(base64 encoded) from the `GRPC-RATLS server`, does base64 decoding, acquires the real secrets. The `image_key` is used to decrypt the RootFS image. The other two are saved to RootFS. In this example, they are `/etc/flask.crt` and `/etc/flask.key`. Finally, when the Flask-TLS app is running, all secrets are securely obtained already in `init` thus the app runs successfully without RA involvement in this stage.
For this demo, a modified [`init`](./init_ra/) is used. Besides the general `init` operation, it embeds the `GRPC-RATLS` client API `grpc_ratls_get_secret`, gets the secrets(base64 encoded) from the `GRPC-RATLS server`, does base64 decoding, acquires the real secrets. The `image_key` is used to decrypt the RootFS image. The other two are saved to RootFS. In this example, they are `/etc/flask.crt` and `/etc/flask.key`. Finally, when the Flask-TLS app is running, all secrets are securely obtained already in `init` thus the app runs successfully without RA involvement in this stage.
## How-to build the demo
@ -72,7 +72,7 @@ occlum_server
* Starts the GRPC-RATLS server in background.
```
cd occlum_server
occlum run /bin/server &
occlum run /bin/server localhost:50051 &
```
* Starts the Flask-TLS web portal in backgroud.

2
demos/remote_attestation/init_ra_flow/build_content.sh
View File

@ -61,7 +61,7 @@ function build_client_instance()
# Get server mrsigner.
# Here client and server use the same signer-key thus using client mrsigner directly.
jq ' .verify_mr_enclave = "off" |
.verify_mr_signer = "off" |
.verify_mr_signer = "on" |
.verify_isv_prod_id = "off" |
.verify_isv_svn = "off" |
.verify_enclave_debuggable = "on" |

14
demos/remote_attestation/init_ra_flow/init_ra/src/main.rs
View File

@ -15,7 +15,7 @@ use std::os::raw::{c_int, c_char};
#[link(name = "grpc_ratls_client")]
extern "C" {
fn gr_client_get_secret(
fn grpc_ratls_get_secret(
server_addr: *const c_char, // grpc server address+port, such as "localhost:50051"
config_json: *const c_char, // ratls handshake config json file
name: *const c_char, // secret name to be requested
@ -48,7 +48,7 @@ fn main() -> Result<(), Box<dyn Error>> {
let filename = CString::new("/etc/image_key").unwrap();
let ret = unsafe {
gr_client_get_secret(
grpc_ratls_get_secret(
server_addr.as_ptr(),
config_json.as_ptr(),
secret.as_ptr(),
@ -56,7 +56,7 @@ fn main() -> Result<(), Box<dyn Error>> {
};
if ret != 0 {
println!("gr_client_get_secret failed return {}", ret);
println!("grpc_ratls_get_secret failed return {}", ret);
return Err(Box::new(std::io::Error::last_os_error()));
}
@ -79,7 +79,7 @@ fn main() -> Result<(), Box<dyn Error>> {
let filename = CString::new("cert_file").unwrap();
let ret = unsafe {
gr_client_get_secret(
grpc_ratls_get_secret(
server_addr.as_ptr(),
config_json.as_ptr(),
secret.as_ptr(),
@ -87,7 +87,7 @@ fn main() -> Result<(), Box<dyn Error>> {
};
if ret != 0 {
println!("gr_client_get_secret failed return {}", ret);
println!("grpc_ratls_get_secret failed return {}", ret);
return Err(Box::new(std::io::Error::last_os_error()));
}
@ -99,7 +99,7 @@ fn main() -> Result<(), Box<dyn Error>> {
let filename = CString::new("key_file").unwrap();
let ret = unsafe {
gr_client_get_secret(
grpc_ratls_get_secret(
server_addr.as_ptr(),
config_json.as_ptr(),
secret.as_ptr(),
@ -107,7 +107,7 @@ fn main() -> Result<(), Box<dyn Error>> {
};
if ret != 0 {
println!("gr_client_get_secret failed return {}", ret);
println!("grpc_ratls_get_secret failed return {}", ret);
return Err(Box::new(std::io::Error::last_os_error()));
}

4
demos/remote_attestation/init_ra_flow/run.sh
View File

@ -1,10 +1,12 @@
#!/bin/bash
set -e
GRPC_ADDR="localhost:50051"
echo "Start GRPC server on backgound ..."
pushd occlum_server
occlum run /bin/server &
occlum run /bin/server ${GRPC_ADDR} &
popd
sleep 3

2
demos/remote_attestation/init_ra_flow/run_till_ready.sh
View File

@ -9,7 +9,7 @@ FLASK_SERVER_PORT=4996
echo "Start GRPC server on backgound ..."
pushd occlum_server
occlum run /bin/server &
occlum run /bin/server "${GRPC_SERVER_IP}:${GRPC_SERVER_PORT}" &
popd
while ! nc -z $GRPC_SERVER_IP $GRPC_SERVER_PORT; do