Skip to content

Commit f440290

Browse files
bluelebluele
committed
OK
Signed-off-by: Jun Kimura <jun.kimura@datachain.jp>
1 parent 5cbcff4 commit f440290

File tree

16 files changed

+301
-193
lines changed

16 files changed

+301
-193
lines changed

‎Cargo.lock‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎app/Cargo.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ ecall-commands = { path = "../modules/ecall-commands" }
2626
crypto = { path = "../modules/crypto" }
2727
keymanager = { path = "../modules/keymanager" }
2828
remote-attestation = { path = "../modules/remote-attestation" }
29+
attestation-report = { path = "../modules/attestation-report" }
2930

3031
[build-dependencies]
3132
git2 = "0.19"

‎app/src/commands/enclave.rs‎

Lines changed: 39 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ use crate::{
33
opts::{EnclaveOpts, Opts},
44
};
55
use anyhow::{anyhow, Result};
6+
use attestation_report::RAQuote;
67
use clap::Parser;
78
use crypto::Address;
89
use ecall_commands::GenerateEnclaveKeyInput;
@@ -87,10 +88,13 @@ fn run_generate_key<E: EnclaveCommandAPI<S>, S: CommitStore>(
8788
) -> Result<()> {
8889
let (target_info, _) = remote_attestation::init_quote(input.target_qe3)?;
8990
let res = enclave
90-
.generate_enclave_key(GenerateEnclaveKeyInput {
91-
target_info,
92-
operator: input.get_operator()?,
93-
})
91+
.generate_enclave_key(
92+
GenerateEnclaveKeyInput {
93+
target_info,
94+
operator: input.get_operator()?,
95+
},
96+
input.target_qe3,
97+
)
9498
.map_err(|e| anyhow!("failed to generate an enclave key: {:?}", e))?;
9599
println!("{}", res.pub_key.as_address());
96100
Ok(())
@@ -121,37 +125,37 @@ fn run_list_keys<E: EnclaveCommandAPI<S>, S: CommitStore>(
121125
};
122126
let mut list_json = Vec::new();
123127
for eki in list {
124-
let ias_attested = eki.ias_report.is_some();
125-
let dcap_attested = eki.dcap_quote.is_some();
126-
127-
if ias_attested {
128-
let avr = eki.ias_report.as_ref().unwrap().get_avr()?;
129-
let report_data = avr.parse_quote()?.report_data();
130-
list_json.push(json! {{
131-
"type": "ias",
132-
"address": eki.address.to_hex_string(),
133-
"attested": true,
134-
"report_data": report_data.to_string(),
135-
"isv_enclave_quote_status": avr.isv_enclave_quote_status,
136-
"advisory_ids": avr.advisory_ids,
137-
"attested_at": avr.timestamp
138-
}});
139-
} else if dcap_attested {
140-
let dcap_quote = eki.dcap_quote.as_ref().unwrap();
141-
list_json.push(json! {{
142-
"type": "dcap",
143-
"address": eki.address.to_hex_string(),
144-
"attested": true,
145-
"report_data": dcap_quote.report_data()?.to_string(),
146-
"isv_enclave_quote_status": dcap_quote.tcb_status,
147-
"advisory_ids": dcap_quote.advisory_ids,
148-
"attested_at": dcap_quote.attested_at.to_string(),
149-
}});
150-
} else {
151-
list_json.push(json! {{
152-
"address": eki.address.to_hex_string(),
153-
"attested": false,
154-
}});
128+
match eki.ra_quote {
129+
Some(RAQuote::IAS(report)) => {
130+
let avr = report.get_avr()?;
131+
let report_data = avr.parse_quote()?.report_data();
132+
list_json.push(json! {{
133+
"type": "ias",
134+
"address": eki.address.to_hex_string(),
135+
"attested": true,
136+
"report_data": report_data.to_string(),
137+
"isv_enclave_quote_status": avr.isv_enclave_quote_status,
138+
"advisory_ids": avr.advisory_ids,
139+
"attested_at": avr.timestamp
140+
}});
141+
}
142+
Some(RAQuote::DCAP(quote)) => {
143+
list_json.push(json! {{
144+
"type": "dcap",
145+
"address": eki.address.to_hex_string(),
146+
"attested": true,
147+
"report_data": quote.report_data()?.to_string(),
148+
"isv_enclave_quote_status": quote.tcb_status,
149+
"advisory_ids": quote.advisory_ids,
150+
"attested_at": quote.attested_at.to_string(),
151+
}});
152+
}
153+
None => {
154+
list_json.push(json! {{
155+
"address": eki.address.to_hex_string(),
156+
"attested": false,
157+
}});
158+
}
155159
}
156160
}
157161
println!("{}", serde_json::to_string(&list_json).unwrap());

‎modules/attestation-report/src/errors.rs‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ define_error! {
2323
format_args!("unexpected report data version: expected={} actual={}", e.expected, e.actual)
2424
},
2525

26+
InvalidRaType
27+
{
28+
ra_type: u32
29+
}
30+
|e| {
31+
format_args!("Invalid RA type: ra_type={}", e.ra_type)
32+
},
33+
2634
MrenclaveMismatch
2735
{
2836
expected: Mrenclave,

‎modules/attestation-report/src/ias.rs‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,6 @@ impl IASSignedReport {
4242
pub fn get_avr(&self) -> Result<IASAttestationVerificationReport, Error> {
4343
serde_json::from_slice(self.avr.as_ref()).map_err(Error::serde_json)
4444
}
45-
46-
pub fn to_json(&self) -> Result<String, Error> {
47-
serde_json::to_string(self).map_err(Error::serde_json)
48-
}
49-
50-
pub fn from_json(json: &str) -> Result<Self, Error> {
51-
serde_json::from_str(json).map_err(Error::serde_json)
52-
}
5345
}
5446

5547
// IASAttestationVerificationReport represents Intel's Attestation Verification Report

‎modules/attestation-report/src/lib.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ mod prelude {
2323
pub use dcap::DCAPQuote;
2424
pub use errors::Error;
2525
pub use ias::{verify_ias_report, IASAttestationVerificationReport, IASSignedReport};
26-
pub use report::{Quote, ReportData, VerifiableQuote};
26+
pub use report::{Quote, RAQuote, RAType, ReportData};
2727

2828
pub(crate) mod serde_base64 {
2929
use crate::prelude::*;

‎modules/attestation-report/src/report.rs‎

Lines changed: 46 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,29 +9,67 @@ use sgx_types::{metadata::metadata_t, sgx_measurement_t, sgx_quote_t, sgx_report
99
pub const REPORT_DATA_V1: u8 = 1;
1010

1111
#[derive(Debug, Serialize, Deserialize)]
12-
pub enum VerifiableQuote {
12+
pub enum RAType {
13+
IAS,
14+
DCAP,
15+
}
16+
17+
impl RAType {
18+
pub fn as_u32(&self) -> u32 {
19+
match self {
20+
Self::IAS => 1,
21+
Self::DCAP => 2,
22+
}
23+
}
24+
pub fn from_u32(v: u32) -> Result<Self, Error> {
25+
match v {
26+
1 => Ok(Self::IAS),
27+
2 => Ok(Self::DCAP),
28+
_ => Err(Error::invalid_ra_type(v)),
29+
}
30+
}
31+
}
32+
33+
#[derive(Debug, Serialize, Deserialize)]
34+
#[serde(tag = "type")]
35+
pub enum RAQuote {
1336
IAS(IASSignedReport),
1437
DCAP(DCAPQuote),
1538
}
1639

17-
impl VerifiableQuote {
40+
impl RAQuote {
41+
pub fn ra_type(&self) -> RAType {
42+
match self {
43+
RAQuote::IAS(_) => RAType::IAS,
44+
RAQuote::DCAP(_) => RAType::DCAP,
45+
}
46+
}
47+
1848
pub fn attested_at(&self) -> Result<Time, Error> {
1949
match self {
20-
VerifiableQuote::IAS(report) => report.get_avr()?.attestation_time(),
21-
VerifiableQuote::DCAP(quote) => Ok(quote.attested_at),
50+
RAQuote::IAS(report) => report.get_avr()?.attestation_time(),
51+
RAQuote::DCAP(quote) => Ok(quote.attested_at),
2252
}
2353
}
54+
55+
pub fn from_json(json: &str) -> Result<Self, Error> {
56+
serde_json::from_str(json).map_err(Error::serde_json)
57+
}
58+
59+
pub fn to_json(&self) -> Result<String, Error> {
60+
serde_json::to_string(self).map_err(Error::serde_json)
61+
}
2462
}
2563

26-
impl From<IASSignedReport> for VerifiableQuote {
64+
impl From<IASSignedReport> for RAQuote {
2765
fn from(report: IASSignedReport) -> Self {
28-
VerifiableQuote::IAS(report)
66+
RAQuote::IAS(report)
2967
}
3068
}
3169

32-
impl From<DCAPQuote> for VerifiableQuote {
70+
impl From<DCAPQuote> for RAQuote {
3371
fn from(quote: DCAPQuote) -> Self {
34-
VerifiableQuote::DCAP(quote)
72+
RAQuote::DCAP(quote)
3573
}
3674
}
3775

‎modules/enclave-api/src/api/command.rs‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
use crate::{EnclavePrimitiveAPI, Result};
2+
use attestation_report::RAType;
23
use ecall_commands::{
34
AggregateMessagesInput, AggregateMessagesResponse, Command, CommandResponse,
45
EnclaveManageCommand, EnclaveManageResponse, GenerateEnclaveKeyInput,
@@ -14,6 +15,7 @@ pub trait EnclaveCommandAPI<S: CommitStore>: EnclavePrimitiveAPI<S> {
1415
fn generate_enclave_key(
1516
&self,
1617
input: GenerateEnclaveKeyInput,
18+
is_target_qe3: bool,
1719
) -> Result<GenerateEnclaveKeyResponse> {
1820
let res = match self.execute_command(
1921
Command::EnclaveManage(EnclaveManageCommand::GenerateEnclaveKey(input)),
@@ -22,8 +24,15 @@ pub trait EnclaveCommandAPI<S: CommitStore>: EnclavePrimitiveAPI<S> {
2224
CommandResponse::EnclaveManage(EnclaveManageResponse::GenerateEnclaveKey(res)) => res,
2325
_ => unreachable!(),
2426
};
25-
self.get_key_manager()
26-
.save(res.sealed_ek.clone(), res.report)?;
27+
self.get_key_manager().save(
28+
res.sealed_ek.clone(),
29+
res.report,
30+
if is_target_qe3 {
31+
RAType::DCAP
32+
} else {
33+
RAType::IAS
34+
},
35+
)?;
2736
Ok(res)
2837
}
2938

0 commit comments

Comments
 (0)