Merge pull request #98 from datachainlab/misbehaviour

Light Client Misbehaviour support

Signed-off-by: Jun Kimura <jun.kimura@datachain.jp>

Author: bluele

Cargo.lock

@@ -2,7 +2,7 @@ use crate::enclave_manage::errors::Error;
 use crate::prelude::*;
 use attestation_report::verify_report;
 use crypto::{EnclaveKey, SealingKey};
-use ecall_commands::{CommandContext, IASRemoteAttestationInput, IASRemoteAttestationResult};
+use ecall_commands::{CommandContext, IASRemoteAttestationInput, IASRemoteAttestationResponse};
 use enclave_remote_attestation::{
     attestation::create_attestation_report, report::validate_quote_status,
 };
@@ -11,7 +11,7 @@ use sgx_types::{sgx_quote_sign_type_t, sgx_spid_t};
 pub(crate) fn ias_remote_attestation(
     cctx: CommandContext,
     input: IASRemoteAttestationInput,
-) -> Result<IASRemoteAttestationResult, Error> {
+) -> Result<IASRemoteAttestationResponse, Error> {
     input.validate()?;
     let pub_key =
         EnclaveKey::unseal(&cctx.sealed_ek.ok_or(Error::enclave_key_not_found())?)?.get_pubkey();
@@ -27,14 +27,14 @@ pub(crate) fn ias_remote_attestation(
         report
     };
     validate_quote_status(cctx.current_timestamp, &report.get_avr()?)?;
-    Ok(IASRemoteAttestationResult { report })
+    Ok(IASRemoteAttestationResponse { report })
 }
 
 #[cfg(feature = "sgx-sw")]
 pub(crate) fn simulate_remote_attestation(
     cctx: CommandContext,
     input: ecall_commands::SimulateRemoteAttestationInput,
-) -> Result<ecall_commands::SimulateRemoteAttestationResult, Error> {
+) -> Result<ecall_commands::SimulateRemoteAttestationResponse, Error> {
     input.validate()?;
     let pub_key =
         EnclaveKey::unseal(&cctx.sealed_ek.ok_or(Error::enclave_key_not_found())?)?.get_pubkey();
@@ -45,7 +45,7 @@ pub(crate) fn simulate_remote_attestation(
         input.isv_enclave_quote_status,
     )?;
     validate_quote_status(cctx.current_timestamp, &avr)?;
-    Ok(ecall_commands::SimulateRemoteAttestationResult { avr })
+    Ok(ecall_commands::SimulateRemoteAttestationResponse { avr })
 }
 
 // CONTRACT: `hex` length must be 32

enclave-modules/ecall-handler/src/enclave_manage/attestation.rs

@@ -1,14 +1,14 @@
 use crate::enclave_manage::Error;
 use crate::prelude::*;
 use crypto::{EnclaveKey, SealingKey};
-use ecall_commands::{GenerateEnclaveKeyInput, GenerateEnclaveKeyResult};
+use ecall_commands::{GenerateEnclaveKeyInput, GenerateEnclaveKeyResponse};
 
 pub(crate) fn generate_enclave_key(
     _: GenerateEnclaveKeyInput,
-) -> Result<GenerateEnclaveKeyResult, Error> {
+) -> Result<GenerateEnclaveKeyResponse, Error> {
     let ek = EnclaveKey::new()?;
     let sealed_ek = ek.seal()?;
-    Ok(GenerateEnclaveKeyResult {
+    Ok(GenerateEnclaveKeyResponse {
         pub_key: ek.get_pubkey(),
         sealed_ek,
     })

enclave-modules/ecall-handler/src/enclave_manage/enclave.rs

@@ -2,24 +2,26 @@ use crate::enclave_manage::{
     attestation::ias_remote_attestation, enclave::generate_enclave_key, Error,
 };
 use crate::prelude::*;
-use ecall_commands::{CommandContext, CommandResult, EnclaveManageCommand, EnclaveManageResult};
+use ecall_commands::{
+    CommandContext, CommandResponse, EnclaveManageCommand, EnclaveManageResponse,
+};
 
 pub fn dispatch(
     cctx: CommandContext,
     command: EnclaveManageCommand,
-) -> Result<CommandResult, Error> {
+) -> Result<CommandResponse, Error> {
     use EnclaveManageCommand::*;
 
     let res = match command {
-        GenerateEnclaveKey(input) => CommandResult::EnclaveManage(
-            EnclaveManageResult::GenerateEnclaveKey(generate_enclave_key(input)?),
+        GenerateEnclaveKey(input) => CommandResponse::EnclaveManage(
+            EnclaveManageResponse::GenerateEnclaveKey(generate_enclave_key(input)?),
         ),
-        IASRemoteAttestation(input) => CommandResult::EnclaveManage(
-            EnclaveManageResult::IASRemoteAttestation(ias_remote_attestation(cctx, input)?),
+        IASRemoteAttestation(input) => CommandResponse::EnclaveManage(
+            EnclaveManageResponse::IASRemoteAttestation(ias_remote_attestation(cctx, input)?),
         ),
         #[cfg(feature = "sgx-sw")]
         SimulateRemoteAttestation(input) => {
-            CommandResult::EnclaveManage(EnclaveManageResult::SimulateRemoteAttestation(
+            CommandResponse::EnclaveManage(EnclaveManageResponse::SimulateRemoteAttestation(
                 crate::enclave_manage::attestation::simulate_remote_attestation(cctx, input)?,
             ))
         }

enclave-modules/ecall-handler/src/enclave_manage/router.rs

@@ -2,17 +2,17 @@ use crate::light_client::Error;
 use crate::prelude::*;
 use context::Context;
 use crypto::{EnclavePublicKey, Signer, Verifier};
-use ecall_commands::{AggregateMessagesInput, AggregateMessagesResult, LightClientResult};
+use ecall_commands::{AggregateMessagesInput, AggregateMessagesResponse, LightClientResponse};
 use light_client::{
-    commitments::{self, prove_commitment, Message, UpdateClientMessage},
+    commitments::{self, prove_commitment, ProxyMessage, UpdateStateProxyMessage},
     HostContext, LightClientResolver,
 };
 use store::KVStore;
 
 pub fn aggregate_messages<R: LightClientResolver, S: KVStore, K: Signer>(
     ctx: &mut Context<R, S, K>,
     input: AggregateMessagesInput,
-) -> Result<LightClientResult, Error> {
+) -> Result<LightClientResponse, Error> {
     ctx.set_timestamp(input.current_timestamp);
 
     if input.messages.len() < 2 {
@@ -32,31 +32,31 @@ pub fn aggregate_messages<R: LightClientResolver, S: KVStore, K: Signer>(
     let messages = input
         .messages
         .into_iter()
-        .map(|c| Message::from_bytes(&c)?.try_into())
+        .map(|m| ProxyMessage::from_bytes(&m)?.try_into())
         .collect::<Result<Vec<_>, _>>()?
         .into_iter()
         .zip(input.signatures.iter())
-        .map(|(c, s)| -> Result<_, Error> {
-            verify_commitment(&pk, &c, s)?;
-            c.context.validate(ctx.host_timestamp())?;
-            Ok(c)
+        .map(|(m, s)| -> Result<_, Error> {
+            verify_message(&pk, &m, s)?;
+            m.context.validate(ctx.host_timestamp())?;
+            Ok(m)
         })
         .collect::<Result<Vec<_>, _>>()?;
 
-    let message = Message::from(commitments::aggregate_messages(messages)?);
+    let message = ProxyMessage::from(commitments::aggregate_messages(messages)?);
     let proof = prove_commitment(ek, input.signer, message)?;
 
-    Ok(LightClientResult::AggregateMessages(
-        AggregateMessagesResult(proof),
+    Ok(LightClientResponse::AggregateMessages(
+        AggregateMessagesResponse(proof),
     ))
 }
 
-fn verify_commitment(
+fn verify_message(
     verifier: &EnclavePublicKey,
-    commitment: &UpdateClientMessage,
+    message: &UpdateStateProxyMessage,
     signature: &[u8],
 ) -> Result<(), Error> {
-    let message_bytes = Message::UpdateClient(commitment.clone()).to_bytes();
+    let message_bytes = ProxyMessage::UpdateState(message.clone()).to_bytes();
     verifier
         .verify(&message_bytes, signature)
         .map_err(Error::crypto)?;

enclave-modules/ecall-handler/src/light_client/aggregate_messages.rs

@@ -3,7 +3,7 @@ use crate::prelude::*;
 use context::Context;
 use core::str::FromStr;
 use crypto::Signer;
-use ecall_commands::{InitClientInput, InitClientResult, LightClientResult};
+use ecall_commands::{InitClientInput, InitClientResponse, LightClientResponse};
 use lcp_types::{Any, ClientId};
 use light_client::commitments::{prove_commitment, CommitmentProof};
 use light_client::{ClientKeeper, ClientReader, LightClientResolver};
@@ -12,7 +12,7 @@ use store::KVStore;
 pub fn init_client<R: LightClientResolver, S: KVStore, K: Signer>(
     ctx: &mut Context<R, S, K>,
     input: InitClientInput,
-) -> Result<LightClientResult, Error> {
+) -> Result<LightClientResponse, Error> {
     ctx.set_timestamp(input.current_timestamp);
 
     let any_client_state: Any = input.any_client_state.into();
@@ -33,7 +33,7 @@ pub fn init_client<R: LightClientResolver, S: KVStore, K: Signer>(
     } else {
         CommitmentProof::new_with_no_signature(res.message.to_bytes())
     };
-    Ok(LightClientResult::InitClient(InitClientResult {
+    Ok(LightClientResponse::InitClient(InitClientResponse {
         client_id,
         proof,
     }))

enclave-modules/ecall-handler/src/light_client/init_client.rs

@@ -2,20 +2,20 @@ use super::registry::get_light_client_by_client_id;
 use crate::light_client::Error;
 use context::Context;
 use crypto::Signer;
-use ecall_commands::{LightClientResult, QueryClientInput, QueryClientResult};
+use ecall_commands::{LightClientResponse, QueryClientInput, QueryClientResponse};
 use light_client::{ClientReader, LightClientResolver};
 use store::KVStore;
 
 pub fn query_client<R: LightClientResolver, S: KVStore, K: Signer>(
     ctx: &mut Context<R, S, K>,
     input: QueryClientInput,
-) -> Result<LightClientResult, Error> {
+) -> Result<LightClientResponse, Error> {
     let lc = get_light_client_by_client_id(ctx, &input.client_id)?;
     let any_client_state = ctx.client_state(&input.client_id)?;
     let any_consensus_state =
         ctx.consensus_state(&input.client_id, &lc.latest_height(ctx, &input.client_id)?)?;
 
-    Ok(LightClientResult::QueryClient(QueryClientResult {
+    Ok(LightClientResponse::QueryClient(QueryClientResponse {
         any_client_state,
         any_consensus_state,
     }))

enclave-modules/ecall-handler/src/light_client/query.rs

@@ -5,7 +5,7 @@ use crate::light_client::{
 use context::Context;
 use crypto::NopSigner;
 use ecall_commands::{
-    CommandContext, CommandResult, LightClientCommand, LightClientExecuteCommand,
+    CommandContext, CommandResponse, LightClientCommand, LightClientExecuteCommand,
     LightClientQueryCommand,
 };
 use enclave_environment::Env;
@@ -14,7 +14,7 @@ pub fn dispatch<E: Env>(
     env: E,
     cctx: CommandContext,
     command: LightClientCommand,
-) -> Result<CommandResult, Error> {
+) -> Result<CommandResponse, Error> {
     let res = match command {
         LightClientCommand::Execute(cmd) => {
             use LightClientExecuteCommand::*;
@@ -40,5 +40,5 @@ pub fn dispatch<E: Env>(
             }
         }
     };
-    Ok(CommandResult::LightClient(res))
+    Ok(CommandResponse::LightClient(res))
 }

enclave-modules/ecall-handler/src/light_client/router.rs

@@ -3,38 +3,52 @@ use crate::light_client::Error;
 use crate::prelude::*;
 use context::Context;
 use crypto::Signer;
-use ecall_commands::{LightClientResult, UpdateClientInput, UpdateClientResult};
-use light_client::commitments::{
-    prove_commitment, CommitmentProof, EmittedState, Message, UpdateClientMessage,
-};
-use light_client::{ClientKeeper, LightClientResolver};
+use ecall_commands::{LightClientResponse, UpdateClientInput, UpdateClientResponse};
+use light_client::commitments::{prove_commitment, CommitmentProof, EmittedState, ProxyMessage};
+use light_client::{ClientKeeper, LightClientResolver, UpdateClientResult};
 use store::KVStore;
 
 pub fn update_client<R: LightClientResolver, S: KVStore, K: Signer>(
     ctx: &mut Context<R, S, K>,
     input: UpdateClientInput,
-) -> Result<LightClientResult, Error> {
+) -> Result<LightClientResponse, Error> {
     ctx.set_timestamp(input.current_timestamp);
 
     let lc = get_light_client_by_client_id(ctx, &input.client_id)?;
     let ek = ctx.get_enclave_key();
-    let res = lc.update_client(ctx, input.client_id.clone(), input.any_header.into())?;
+    match lc.update_client(ctx, input.client_id.clone(), input.any_header.into())? {
+        UpdateClientResult::UpdateState(mut data) => {
+            let message: ProxyMessage = {
+                if input.include_state && data.message.emitted_states.is_empty() {
+                    data.message.emitted_states =
+                        vec![EmittedState(data.height, data.new_any_client_state.clone())];
+                }
+                data.message.into()
+            };
 
-    let message: Message = {
-        let mut msg = UpdateClientMessage::try_from(res.message)?;
-        if input.include_state && msg.emitted_states.is_empty() {
-            msg.emitted_states = vec![EmittedState(res.height, res.new_any_client_state.clone())];
-        }
-        msg.into()
-    };
+            ctx.store_any_client_state(input.client_id.clone(), data.new_any_client_state)?;
+            ctx.store_any_consensus_state(
+                input.client_id,
+                data.height,
+                data.new_any_consensus_state,
+            )?;
 
-    ctx.store_any_client_state(input.client_id.clone(), res.new_any_client_state)?;
-    ctx.store_any_consensus_state(input.client_id, res.height, res.new_any_consensus_state)?;
+            let proof = if data.prove {
+                prove_commitment(ek, input.signer, message)?
+            } else {
+                CommitmentProof::new_with_no_signature(message.to_bytes())
+            };
+            Ok(LightClientResponse::UpdateClient(UpdateClientResponse(
+                proof,
+            )))
+        }
+        UpdateClientResult::Misbehaviour(data) => {
+            ctx.store_any_client_state(input.client_id, data.new_any_client_state)?;
 
-    let proof = if res.prove {
-        prove_commitment(ek, input.signer, message)?
-    } else {
-        CommitmentProof::new_with_no_signature(message.to_bytes())
-    };
-    Ok(LightClientResult::UpdateClient(UpdateClientResult(proof)))
+            let proof = prove_commitment(ek, input.signer, data.message.into())?;
+            Ok(LightClientResponse::UpdateClient(UpdateClientResponse(
+                proof,
+            )))
+        }
+    }
 }

enclave-modules/ecall-handler/src/light_client/update_client.rs

@@ -3,8 +3,8 @@ use crate::light_client::Error;
 use context::Context;
 use crypto::Signer;
 use ecall_commands::{
-    LightClientResult, VerifyMembershipInput, VerifyMembershipResult, VerifyNonMembershipInput,
-    VerifyNonMembershipResult,
+    LightClientResponse, VerifyMembershipInput, VerifyMembershipResponse, VerifyNonMembershipInput,
+    VerifyNonMembershipResponse,
 };
 use light_client::commitments::prove_commitment;
 use light_client::LightClientResolver;
@@ -13,7 +13,7 @@ use store::KVStore;
 pub fn verify_membership<R: LightClientResolver, S: KVStore, K: Signer>(
     ctx: &mut Context<R, S, K>,
     input: VerifyMembershipInput,
-) -> Result<LightClientResult, Error> {
+) -> Result<LightClientResponse, Error> {
     let ek = ctx.get_enclave_key();
     let lc = get_light_client_by_client_id(ctx, &input.client_id)?;
 
@@ -27,15 +27,15 @@ pub fn verify_membership<R: LightClientResolver, S: KVStore, K: Signer>(
         input.proof.1,
     )?;
 
-    Ok(LightClientResult::VerifyMembership(VerifyMembershipResult(
-        prove_commitment(ek, input.signer, res.message)?,
-    )))
+    Ok(LightClientResponse::VerifyMembership(
+        VerifyMembershipResponse(prove_commitment(ek, input.signer, res.message.into())?),
+    ))
 }
 
 pub fn verify_non_membership<R: LightClientResolver, S: KVStore, K: Signer>(
     ctx: &mut Context<R, S, K>,
     input: VerifyNonMembershipInput,
-) -> Result<LightClientResult, Error> {
+) -> Result<LightClientResponse, Error> {
     let ek = ctx.get_enclave_key();
     let lc = get_light_client_by_client_id(ctx, &input.client_id)?;
 
@@ -48,7 +48,7 @@ pub fn verify_non_membership<R: LightClientResolver, S: KVStore, K: Signer>(
         input.proof.1,
     )?;
 
-    Ok(LightClientResult::VerifyNonMembership(
-        VerifyNonMembershipResult(prove_commitment(ek, input.signer, res.message)?),
+    Ok(LightClientResponse::VerifyNonMembership(
+        VerifyNonMembershipResponse(prove_commitment(ek, input.signer, res.message.into())?),
     ))
 }