Skip to content

Commit 673d835

Browse files
committed
fuzz sgx,exist bugs, just for pr review
1 parent b655a4a commit 673d835

18 files changed

+851
-24
lines changed

cmake/CompilerOptions.cmake

+14-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Normal and occlum mode
2-
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=gnu11 -fPIC -Werror=implicit-function-declaration")
2+
# set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=gnu11 -fPIC -Werror=implicit-function-declaration")
33
set(RATS_TLS_LDFLAGS "-fPIC -Bsymbolic -ldl")
44

55
if(OCCLUM)
@@ -12,6 +12,16 @@ else()
1212
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O2")
1313
endif()
1414

15+
if((BUILD_FUZZ) AND (SGX))
16+
set(SGX_COMMON_CFLAGS "${SGX_COMMON_FLAGS} -Wstrict-prototypes -Wno-implicit-function-declaration")
17+
set(SGX_COMMON_CXXFLAGS "${SGX_COMMON_FLAGS} -Wnon-virtual-dtor")
18+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fPIC -Werror=implicit-function-declaration")
19+
elseif()
20+
set(SGX_COMMON_CFLAGS "${SGX_COMMON_FLAGS} -Wstrict-prototypes -Wunsuffixed-float-constants -Wno-implicit-function-declaration -std=c11")
21+
set(SGX_COMMON_CXXFLAGS "${SGX_COMMON_FLAGS} -Wnon-virtual-dtor -std=c++11")
22+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=gnu11 -fPIC -Werror=implicit-function-declaration")
23+
endif()
24+
1525
# SGX mode
1626
if(SGX)
1727
if(SGX_HW)
@@ -56,8 +66,8 @@ if(SGX)
5666
set(ENCLAVE_COMMON_FLAGS "${ENCLAVE_COMMON_FLAGS} -fstack-protector-strong")
5767
endif()
5868

59-
set(SGX_COMMON_CFLAGS "${SGX_COMMON_FLAGS} -Wstrict-prototypes -Wunsuffixed-float-constants -Wno-implicit-function-declaration -std=c11")
60-
set(SGX_COMMON_CXXFLAGS "${SGX_COMMON_FLAGS} -Wnon-virtual-dtor -std=c++11")
69+
# set(SGX_COMMON_CFLAGS "${SGX_COMMON_FLAGS} -Wstrict-prototypes -Wunsuffixed-float-constants -Wno-implicit-function-declaration -std=c11")
70+
# set(SGX_COMMON_CXXFLAGS "${SGX_COMMON_FLAGS} -Wnon-virtual-dtor -std=c++11")
6171

6272
set(ENCLAVE_INCLUDES "${SGX_INCLUDE}" "${SGX_TLIBC_INCLUDE}" "${SGX_LIBCXX_INCLUDE}" "/usr/include")
6373
set(ENCLAVE_C_FLAGS "${CMAKE_C_FLAGS} ${SGX_COMMON_CFLAGS} ${ENCLAVE_COMMON_FLAGS}")
@@ -67,3 +77,4 @@ if(SGX)
6777
set(APP_C_FLAGS "${CMAKE_C_FLAGS} ${SGX_COMMON_CFLAGS} ${APP_COMMON_FLAGS}")
6878
set(APP_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${SGX_COMMON_CXXFLAGS} ${APP_COMMON_FLAGS}")
6979
endif()
80+

fuzz/CMakeLists.txt

+10-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
1-
add_subdirectory(tls_init)
2-
add_subdirectory(tls_negotiate)
1+
if(SGX)
2+
add_subdirectory(tls_sgx_mode)
3+
add_subdirectory(sgx-stub-enclave)
4+
else()
5+
add_subdirectory(tls_init)
6+
add_subdirectory(tls_negotiate)
7+
add_subdirectory(tls_transmit)
8+
endif()
39
add_subdirectory(tls_server)
4-
add_subdirectory(tls_transmit)
10+
11+

fuzz/sgx-stub-enclave/CMakeLists.txt

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# Project name
2+
project(sgx-stub-enclave CXX)
3+
4+
set(CMAKE_CXX_COMPILER "/usr/bin/clang++")
5+
set(CMAKE_CXX_FLAGS "-g ${CMAKE_CXX_FLAGS}")
6+
set(RATS_TLS_INSTALL_FUZZ_PATH /usr/share/rats-tls/fuzz)
7+
8+
if((BUILD_SAMPLES) OR (BUILD_FUZZ))
9+
set(INCLUDE_DIRS ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include
10+
${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/rats-tls
11+
${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/edl
12+
${CMAKE_CURRENT_SOURCE_DIR}/../../src/external/sgx-ssl/intel-sgx-ssl/src/intel-sgx-ssl/Linux/package/include
13+
)
14+
15+
set(LIBRARY_DIRS ${INTEL_SGXSSL_LIB_PATH}
16+
${LIBCBOR_LIB_PATH}
17+
${CMAKE_BINARY_DIR}/src
18+
${CMAKE_BINARY_DIR}/src/crypto_wrappers/nullcrypto
19+
${CMAKE_BINARY_DIR}/src/crypto_wrappers/openssl
20+
${CMAKE_BINARY_DIR}/src/tls_wrappers/nulltls
21+
${CMAKE_BINARY_DIR}/src/tls_wrappers/openssl
22+
${CMAKE_BINARY_DIR}/src/verifiers/nullverifier
23+
${CMAKE_BINARY_DIR}/src/verifiers/sgx-ecdsa-qve
24+
${CMAKE_BINARY_DIR}/src/verifiers/tdx-ecdsa
25+
${CMAKE_BINARY_DIR}/src/verifiers/sgx-la
26+
${CMAKE_BINARY_DIR}/src/attesters/nullattester
27+
${CMAKE_BINARY_DIR}/src/attesters/sgx-ecdsa
28+
${CMAKE_BINARY_DIR}/src/attesters/sgx-la
29+
)
30+
31+
set(EDL_SEARCH_PATHS ${CMAKE_CURRENT_SOURCE_DIR}
32+
${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/edl
33+
)
34+
else()
35+
list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake")
36+
include(CustomInstallDirs)
37+
include(FindRatsTls)
38+
if(NOT RATS_TLS_FOUND)
39+
message(FATAL_ERROR "Failed to find rats_tls!")
40+
endif()
41+
include(FindSGX)
42+
if(NOT SGX_FOUND)
43+
message(FATAL_ERROR "Failed to find sgx!")
44+
endif()
45+
include(CompilerOptions)
46+
include(SGXCommon)
47+
48+
set(INCLUDE_DIRS ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include
49+
${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/rats-tls
50+
${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/edl)
51+
52+
set(LIBRARY_DIRS ${RATS_TLS_INSTALL_LIB_PATH})
53+
54+
set(EDL_SEARCH_PATHS ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/edl)
55+
endif()
56+
57+
include_directories(${INCLUDE_DIRS})
58+
link_directories(${LIBRARY_DIRS})
59+
60+
set(E_SRCS ${CMAKE_CURRENT_SOURCE_DIR}/sgx_stub_ecall.c)
61+
set(EDLS ${CMAKE_CURRENT_SOURCE_DIR}/sgx_stub.edl)
62+
set(LDS ${CMAKE_CURRENT_SOURCE_DIR}/sgx_stub_enclave.lds)
63+
set(DEPEND_TRUSTED_LIBS crypto_wrapper_nullcrypto
64+
crypto_wrapper_openssl
65+
tls_wrapper_nulltls
66+
tls_wrapper_openssl
67+
attester_nullattester
68+
attester_sgx_ecdsa
69+
attester_sgx_la
70+
verifier_nullverifier
71+
verifier_sgx_la
72+
verifier_sgx_ecdsa_qve
73+
verifier_tdx_ecdsa
74+
rats_tls
75+
cbor
76+
)
77+
78+
add_enclave_library(sgx_stub_enclave SRCS ${E_SRCS} EDL ${EDLS} TRUSTED_LIBS ${DEPEND_TRUSTED_LIBS} EDL_SEARCH_PATHS ${EDL_SEARCH_PATHS} LDSCRIPT ${LDS})
79+
enclave_sign(sgx_stub_enclave KEY sgx_stub_enclave.pem CONFIG sgx_stub_enclave.xml)
80+
add_dependencies(sgx_stub_enclave rats_tls)
81+
82+
install(FILES ${CMAKE_CURRENT_BINARY_DIR}/sgx_stub_enclave.signed.so
83+
DESTINATION ${RATS_TLS_INSTALL_FUZZ_PATH})

fuzz/sgx-stub-enclave/sgx_stub.edl

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
enclave {
2+
include "rats-tls/api.h"
3+
include "internal/core.h"
4+
include "sgx_eid.h"
5+
6+
from "../../src/include/edl/rtls.edl" import *;
7+
from "sgx_tsgxssl.edl" import *;
8+
9+
trusted {
10+
public int ecall_client_startup(
11+
rats_tls_log_level_t log_level,
12+
[in, string] char *fuzz_conf_bytes,
13+
[in, string] char *attester_type,
14+
[in, string] char *verifier_type,
15+
[in, string] char *tls_type,
16+
[in, string] char *crypto_type,
17+
unsigned long flags);
18+
19+
public int ecall_server_startup(
20+
rats_tls_log_level_t log_level,
21+
[in, string] char *fuzz_conf_bytes,
22+
[in, string] char *attester_type,
23+
[in, string] char *verifier_type,
24+
[in, string] char *tls_type,
25+
[in, string] char *crypto_type,
26+
unsigned long flags);
27+
};
28+
};
+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
#include <stdio.h>
2+
#include <string.h>
3+
#include <unistd.h>
4+
#include <errno.h>
5+
6+
7+
#include <rats-tls/api.h>
8+
#include <rats-tls/log.h>
9+
#include "rats-tls/api.h"
10+
#include "sgx_urts.h"
11+
#include "sgx_stub_t.h"
12+
13+
#define FUZZ_IP "127.0.0.1"
14+
#define FUZZ_PORT 1234
15+
16+
int ecall_client_startup(rats_tls_log_level_t log_level,char *fuzz_conf_bytes,char *attester_type,char *verifier_type, char *tls_type, char *crypto_type, unsigned long flags){
17+
18+
rats_tls_conf_t conf;
19+
memcpy(&conf,fuzz_conf_bytes,sizeof(&conf));
20+
21+
// little confused, why use snprintf
22+
snprintf(conf.attester_type, sizeof(conf.attester_type), "%s", attester_type);
23+
snprintf(conf.verifier_type, sizeof(conf.verifier_type), "%s", verifier_type);
24+
snprintf(conf.tls_type, sizeof(conf.tls_type), "%s", tls_type);
25+
snprintf(conf.crypto_type, sizeof(conf.crypto_type), "%s", crypto_type);
26+
conf.flags = flags;
27+
conf.cert_algo = RATS_TLS_CERT_ALGO_DEFAULT;
28+
29+
/*passing a struct into enclave seems a little complicated,
30+
use the default instead */
31+
claim_t custom_claims[2] = {
32+
{ .name = "key_0", .value = (uint8_t *)"value_0", .value_size = sizeof("value_0") },
33+
{ .name = "key_1", .value = (uint8_t *)"value_1", .value_size = sizeof("value_1") },
34+
};
35+
conf.custom_claims = (claim_t *)custom_claims;
36+
conf.custom_claims_length = 2;
37+
38+
/* Create a socket that uses an internet IPv4 address,
39+
* Sets the socket to be stream based (TCP),
40+
* 0 means choose the default protocol.
41+
*/
42+
43+
int64_t sockfd;
44+
int sgx_status = ocall_socket(&sockfd, RTLS_AF_INET, RTLS_SOCK_STREAM, 0);
45+
if (sgx_status != SGX_SUCCESS || sockfd < 0) {
46+
RTLS_ERR("Failed to call socket() %#x %d\n", sgx_status, sockfd);
47+
return -1;
48+
}
49+
50+
struct rtls_sockaddr_in s_addr;
51+
memset(&s_addr, 0, sizeof(s_addr));
52+
s_addr.sin_family = RTLS_AF_INET;
53+
s_addr.sin_addr.s_addr = FUZZ_IP;
54+
s_addr.sin_port = FUZZ_PORT;
55+
56+
/* Connect to the server */
57+
int ocall_ret = 0;
58+
sgx_status = ocall_connect(&ocall_ret, sockfd, &s_addr, sizeof(s_addr));
59+
if (sgx_status != SGX_SUCCESS || ocall_ret == -1) {
60+
RTLS_ERR("failed to call connect() %#x %d\n", sgx_status, ocall_ret);
61+
return -1;
62+
}
63+
64+
/* rats-tls init */
65+
librats_tls_init();
66+
rats_tls_handle handle;
67+
rats_tls_err_t ret = rats_tls_init(&conf, &handle);
68+
if (ret != RATS_TLS_ERR_NONE) {
69+
RTLS_ERR("Failed to initialize rats tls %#x\n", ret);
70+
return -1;
71+
}
72+
73+
ret = rats_tls_negotiate(handle, (int)sockfd);
74+
if (ret != RATS_TLS_ERR_NONE) {
75+
RTLS_ERR("Failed to negotiate %#x\n", ret);
76+
return -1;
77+
}
78+
79+
const char* msg = "Hello and welcome to RATS-TLS!\n";
80+
81+
82+
return 0;
83+
}
84+
85+
86+
int ecall_server_startup(rats_tls_log_level_t log_level,char *fuzz_conf_bytes,char *attester_type,char *verifier_type, char *tls_type, char *crypto_type, unsigned long flags){
87+
RTLS_ERR("entering into the server ");
88+
return 0;
89+
90+
}
+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#ifndef _SGX_STUB_ECALL_H_
2+
#define _SGX_STUB_ECALL_H_
3+
#endif
+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
libsgx_stub_enclave.so.so
2+
{
3+
global:
4+
g_global_data_sim;
5+
g_global_data;
6+
enclave_entry;
7+
g_peak_heap_used;
8+
g_peak_rsrv_mem_committed;
9+
local:
10+
*;
11+
};
+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIG4gIBAAKCAYEAroOogvsj/fZDZY8XFdkl6dJmky0lRvnWMmpeH41Bla6U1qLZ
3+
AmZuyIF+mQC/cgojIsrBMzBxb1kKqzATF4+XwPwgKz7fmiddmHyYz2WDJfAjIveJ
4+
ZjdMjM4+EytGlkkJ52T8V8ds0/L2qKexJ+NBLxkeQLfV8n1mIk7zX7jguwbCG1Pr
5+
nEMdJ3Sew20vnje+RsngAzdPChoJpVsWi/K7cettX/tbnre1DL02GXc5qJoQYk7b
6+
3zkmhz31TgFrd9VVtmUGyFXAysuSAb3EN+5VnHGr0xKkeg8utErea2FNtNIgua8H
7+
ONfm9Eiyaav1SVKzPHlyqLtcdxH3I8Wg7yqMsaprZ1n5A1v/levxnL8+It02KseD
8+
5HqV4rf/cImSlCt3lpRg8U5E1pyFQ2IVEC/XTDMiI3c+AR+w2jSRB3Bwn9zJtFlW
9+
KHG3m1xGI4ck+Lci1JvWWLXQagQSPtZTsubxTQNx1gsgZhgv1JHVZMdbVlAbbRMC
10+
1nSuJNl7KPAS/VfzAgEDAoIBgHRXxaynbVP5gkO0ug6Qw/E27wzIw4SmjsxG6Wpe
11+
K7kfDeRskKxESdsA/xCrKkwGwhcx1iIgS5+Qscd1Yg+1D9X9asd/P7waPmWoZd+Z
12+
AhlKwhdPsO7PiF3e1AzHhGQwsUTt/Y/aSI1MpHBvy2/s1h9mFCslOUxTmWw0oj/Q
13+
ldIEgWeNR72CE2+jFIJIyml6ftnb6qzPiga8Bm48ubKh0kvySOqnkmnPzgh+JBD6
14+
JnBmtZbfPT97bwTT+N6rnPqOOApvfHPf15kWI8yDbprG1l4OCUaIUH1AszxLd826
15+
5IPM+8gINLRDP1MA6azECPjTyHXhtnSIBZCyWSVkc05vYmNXYUNiXWMajcxW9M02
16+
wKzFELO8NCEAkaTPxwo4SCyIjUxiK1LbQ9h8PSy4c1+gGP4LAMR8xqP4QKg6zdu9
17+
osUGG/xRe/uufgTBFkcjqBHtK5L5VI0jeNIUAgW/6iNbYXjBMJ0GfauLs+g1VsOm
18+
WfdgXzsb9DYdMa0OXXHypmV4GwKBwQDUwQj8RKJ6c8cT4vcWCoJvJF00+RFL+P3i
19+
Gx2DLERxRrDa8AVGfqaCjsR+3vLgG8V/py+z+dxZYSqeB80Qeo6PDITcRKoeAYh9
20+
xlT3LJOS+k1cJcEmlbbO2IjLkTmzSwa80fWexKu8/Xv6vv15gpqYl1ngYoqJM3pd
21+
vzmTIOi7MKSZ0WmEQavrZj8zK4endE3v0eAEeQ55j1GImbypSf7Idh7wOXtjZ7WD
22+
Dg6yWDrri+AP/L3gClMj8wsAxMV4ZR8CgcEA0fzDHkFa6raVOxWnObmRoDhAtE0a
23+
cjUj976NM5yyfdf2MrKy4/RhdTiPZ6b08/lBC/+xRfV3xKVGzacm6QjqjZrUpgHC
24+
0LKiZaMtccCJjLtPwQd0jGQEnKfMFaPsnhOc5y8qVkCzVOSthY5qhz0XNotHHFmJ
25+
gffVgB0iqrMTvSL7IA2yqqpOqNRlhaYhNl8TiFP3gIeMtVa9rZy31JPgT2uJ+kfo
26+
gV7sdTPEjPWZd7OshGxWpT6QfVDj/T9T7L6tAoHBAI3WBf2DFvxNL2KXT2QHAZ9t
27+
k3imC4f7U+wSE6zILaDZyzygA4RUbwG0gv8/TJVn2P/Eynf76DuWHGlaiLWnCbSz
28+
Az2DHBQBBaku409zDQym3j1ugMRjzzSQWzJg0SIyBH3hTmnYcn3+Uqcp/lEBvGW6
29+
O+rsXFt3pukqJmIV8HzLGGaLm62BHUeZf3dyWm+i3p/hQAL7Xvu04QW70xuGqdr5
30+
afV7p5eaeQIJXyGQJ0eylV/90+qxjMKiB1XYg6WYvwKBwQCL/ddpgOdHJGN8uRom
31+
e7Zq0Csi3hGheMKlKbN3vcxT5U7MdyHtTZZOJbTvxKNNUNYH/8uD+PqDGNneb29G
32+
BfGzvI3EASyLIcGZF3OhKwZd0jUrWk2y7Vhob91jwp2+t73vdMbkKyI4mHOuXvGv
33+
fg95si9oO7EBT+Oqvhccd2J+F1IVXncccYnF4u5ZGWt5lLewN/pVr7MjjykeaHqN
34+
t+rfnQam2psA6fL4zS2zTmZPzR2tnY8Y1GBTi0Ko1OKd1HMCgcAb5cB/7/AQlhP9
35+
yQa04PLH9ygQkKKptZp7dy5WcWRx0K/hAHRoi2aw1wZqfm7VBNu2SLcs90kCCCxp
36+
6C5sfJi6b8NpNbIPC+sc9wsFr7pGo9SFzQ78UlcWYK2Gu2FxlMjonhka5hvo4zvg
37+
WxlpXKEkaFt3gLd92m/dMqBrHfafH7VwOJY2zT3WIpjwuk0ZzmRg5p0pG/svVQEH
38+
NZmwRwlopysbR69B/n1nefJ84UO50fLh5s5Zr3gBRwbWNZyzhXk=
39+
-----END RSA PRIVATE KEY-----
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<EnclaveConfiguration>
2+
<ProdID>0</ProdID>
3+
<ISVSVN>0</ISVSVN>
4+
<StackMaxSize>0x400000</StackMaxSize>
5+
<HeapMaxSize>0x1000000</HeapMaxSize>
6+
<TCSNum>10</TCSNum>
7+
<TCSPolicy>1</TCSPolicy>
8+
<DisableDebug>0</DisableDebug>
9+
</EnclaveConfiguration>

0 commit comments

Comments
 (0)