Skip to content

Commit 3c86625

Browse files
mohamed-armmohamed-arm
committed
Add docker files from attested-tls PoC
1 parent 590cc7a commit 3c86625

18 files changed

+2710
-0
lines changed

‎docker/attested-tls/Makefile

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
.DEFAULT_GOAL := help
2+
3+
# command line can override this
4+
ENV_FILE ?= demo.env
5+
6+
DC := docker-compose --env-file $(ENV_FILE)
7+
8+
NODES := $(shell $(DC) config --services | sed -e 's/_/-/g' | xargs)
9+
10+
define interactive_shell_template
11+
sh-$(1): start ; docker exec -ti $(1) bash
12+
endef
13+
14+
$(foreach node,$(NODES),$(eval $(call interactive_shell_template,$(node))))
15+
16+
define logs
17+
logs-$(1): start ; $(DC) logs $(1)
18+
endef
19+
20+
ifdef BUILD
21+
BUILD_FLAGS := --build --progress=plain
22+
endif
23+
24+
$(foreach node,$(NODES),$(eval $(call logs,$(node))))
25+
26+
start: veraison-build-containers
27+
$(DC) up -d $(BUILD_FLAGS)
28+
29+
stop:
30+
$(DC) down --remove-orphans
31+
32+
show-logs:
33+
$(DC) logs
34+
35+
top:
36+
$(DC) top
37+
38+
endorse: start
39+
$(DC) exec attester /root/endorse.sh
40+
41+
handshake: start
42+
$(DC) exec attester /root/handshake.sh
43+
44+
help:
45+
@echo "available targets:"
46+
@echo
47+
@echo " start start the demo environment (containers, network, volumes, etc.)"
48+
@echo " do \"make BUILD=true start\" to force building the containers"
49+
@echo " endorse collect keys and reference values from the attester and provision the verifier"
50+
@echo " handshake run an attested TLS handshake and exchange minimal application data between attester and verifier"
51+
@echo " stop tear down the demo environment"
52+
@echo " show-logs show logs for all the containers"
53+
@echo " log-<node> show logs for the specific container"
54+
@echo " sh-<node> start an interactive shell in the container"
55+
@echo
56+
@echo "nodes: $(NODES)"
57+
58+
include build/veraison.mk

‎docker/attested-tls/attester/attester.Dockerfile

Lines changed: 191 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,191 @@
1+
from ${DOCKER_ARCH}golang:1.19 AS go_builder
2+
3+
RUN apt-get update && \
4+
apt-get install -y wget curl vim git && \
5+
apt-get clean
6+
7+
RUN set -eux; \
8+
echo "iteration 0"; \
9+
git clone https://github.com/veracruz-project/proxy_attestation_server.git --branch main --tags ; \
10+
cd proxy_attestation_server; \
11+
git checkout v0.2.1; \
12+
go build -o ./vts/vts -ldflags "-X 'github.com/veraison/services/config.SchemeLoader=builtin'" github.com/veraison/services/vts/cmd/vts-service; \
13+
go build -o ./provisioning/provisioning -ldflags "-X 'github.com/veraison/services/config.SchemeLoader=builtin'" github.com/veraison/services/provisioning/cmd/provisioning-service; \
14+
go build .; \
15+
ls
16+
17+
from ${DOCKER_ARCH}golang:1.19 AS corim_builder
18+
19+
RUN set -eux; \
20+
go install github.com/veraison/corim/cocli@latest
21+
22+
COPY MyComidPsaIak.json /go/
23+
COPY corimMini.json /go/
24+
RUN pwd
25+
RUN cocli comid create --template MyComidPsaIak.json
26+
RUN cocli corim create -m MyComidPsaIak.cbor -t corimMini.json -o psa_corim.cbor
27+
RUN mkdir /opt/veraison/; \
28+
mkdir /opt/veraison/vts; \
29+
mkdir /opt/veraison/vts/plugins; \
30+
mkdir /opt/veraison/provisioning; \
31+
mkdir /opt/veraison/provisioning/plugins; \
32+
mkdir ~/example/
33+
34+
COPY --from=go_builder /go/proxy_attestation_server/vts /opt/veraison/vts/
35+
COPY --from=go_builder /go/proxy_attestation_server/provisioning /opt/veraison/provisioning/
36+
COPY --from=go_builder /go/proxy_attestation_server/proxy_attestation_server /opt/veraison/
37+
#COPY --from=corim_builder /go/psa_corim.cbor /opt/veraison/
38+
39+
COPY vts_config.yaml /opt/veraison/vts/config.yaml
40+
COPY --from=go_builder /go/proxy_attestation_server/vts/skey.jwk /opt/veraison/vts/
41+
COPY provisioning_config.yaml /opt/veraison/provisioning/config.yaml
42+
43+
44+
FROM ubuntu:20.04
45+
46+
ARG TARGETARCH
47+
ENV PKG_CONFIG_PATH /usr/local/lib/pkgconfig
48+
ENV DEBIAN_FRONTEND noninteractive
49+
50+
RUN apt update
51+
RUN apt install -y autoconf-archive libcmocka0 libcmocka-dev procps
52+
RUN apt install -y iproute2 build-essential git pkg-config gcc libtool automake libssl-dev uthash-dev doxygen libjson-c-dev
53+
RUN apt install -y --fix-missing wget python3 cmake clang
54+
RUN apt install -y libini-config-dev libcurl4-openssl-dev curl libgcc1
55+
RUN apt install -y python3-distutils libclang-12-dev protobuf-compiler python3-pip
56+
RUN apt install -y openssl
57+
RUN pip3 install Jinja2
58+
RUN apt-get -y install tzdata
59+
60+
WORKDIR /tmp
61+
62+
# Download and install TSS 2.0
63+
RUN git clone https://github.com/tpm2-software/tpm2-tss.git --branch 3.2.2
64+
RUN cd tpm2-tss \
65+
&& ./bootstrap \
66+
&& ./configure \
67+
&& make -j$(nproc) \
68+
&& make install \
69+
&& ldconfig
70+
RUN rm -rf tpm2-tss
71+
72+
# Download and install TPM 2.0 Tools verison 4.1.1
73+
RUN git clone https://github.com/tpm2-software/tpm2-tools.git --branch 4.1.1
74+
RUN cd tpm2-tools \
75+
&& ./bootstrap \
76+
&& ./configure --prefix=/usr \
77+
&& make -j$(nproc) \
78+
&& make install
79+
RUN rm -rf tpm2-tools
80+
81+
# Download and install software TPM
82+
ARG ibmtpm_name=ibmtpm1637
83+
RUN wget -L "https://downloads.sourceforge.net/project/ibmswtpm2/$ibmtpm_name.tar.gz"
84+
RUN sha256sum $ibmtpm_name.tar.gz | grep ^dd3a4c3f7724243bc9ebcd5c39bbf87b82c696d1c1241cb8e5883534f6e2e327
85+
RUN mkdir -p $ibmtpm_name \
86+
&& tar -xvf $ibmtpm_name.tar.gz -C $ibmtpm_name \
87+
&& chown -R root:root $ibmtpm_name \
88+
&& rm $ibmtpm_name.tar.gz
89+
WORKDIR $ibmtpm_name/src
90+
RUN sed -i 's/-DTPM_NUVOTON/-DTPM_NUVOTON $(CFLAGS)/' makefile
91+
RUN CFLAGS="-DNV_MEMORY_SIZE=32768 -DMIN_EVICT_OBJECTS=7" make -j$(nproc) \
92+
&& cp tpm_server /usr/local/bin
93+
RUN rm -rf $ibmtpm_name/src $ibmtpm_name
94+
95+
WORKDIR /tmp
96+
97+
# Install Rust toolchain
98+
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
99+
ENV PATH="/root/.cargo/bin:/opt/rust/bin:${PATH}"
100+
101+
# Install Parsec service
102+
RUN git clone -b attested-tls https://github.com/ionut-arm/parsec.git \
103+
&& cd parsec \
104+
&& git checkout 1ac2060531b391ff1f335369dc4d1e4f17aee1aa \
105+
&& cargo build --release --features=tpm-provider \
106+
&& cp ./target/release/parsec /usr/bin/
107+
RUN mkdir /etc/parsec/
108+
COPY parsec-config.toml /etc/parsec/config.toml
109+
110+
# At runtime, Parsec is configured with the socket in /tmp/
111+
ENV PARSEC_SERVICE_ENDPOINT="unix:/tmp/parsec.sock"
112+
113+
# Install MbedTLS (used for building purposes)
114+
RUN git clone https://github.com/ARMmbed/mbedtls.git
115+
RUN cd mbedtls \
116+
&& git checkout v3.0.0 \
117+
&& ./scripts/config.py crypto \
118+
&& ./scripts/config.py set MBEDTLS_PSA_CRYPTO_SE_C \
119+
&& make \
120+
&& make install
121+
ENV MBEDTLS_PATH=/tmp/mbedtls
122+
ENV MBEDTLS_INCLUDE_DIR=$MBEDTLS_PATH/include
123+
124+
# Build and install the Parsec C client
125+
RUN git clone -b attested-tls https://github.com/ionut-arm/parsec-se-driver.git
126+
RUN cd parsec-se-driver \
127+
&& cargo build --release \
128+
&& install -m 644 target/release/libparsec_se_driver.a /usr/local/lib \
129+
&& mkdir -p /usr/local/include/parsec \
130+
&& install -m 644 include/* /usr/local/include/parsec
131+
132+
# Build and install QCBOR
133+
RUN git clone https://github.com/laurencelundblade/QCBOR
134+
RUN cd QCBOR \
135+
&& git checkout ad2f3877e16d20f0f2a8965c1a27770ef9407904 \
136+
&& make \
137+
&& make install
138+
139+
# Build and install t_cose
140+
RUN git clone https://github.com/laurencelundblade/t_cose
141+
RUN cd t_cose \
142+
&& env CRYPTO_LIB=/usr/local/lib/libmbedcrypto.a CRYPTO_INC="-I $MBEDTLS_INCLUDE_DIR" QCBOR_LIB="-lqcbor -lm" make -f Makefile.psa -e \
143+
&& make -f Makefile.psa install
144+
145+
# Build and install ctoken
146+
RUN git clone https://github.com/laurencelundblade/ctoken.git
147+
RUN cd ctoken \
148+
&& env CRYPTO_LIB=/usr/local/lib/libmbedcrypto.a CRYPTO_INC="-I $MBEDTLS_INCLUDE_DIR" QCBOR_LIB="-lqcbor -lm" make -f Makefile.psa -e \
149+
&& mkdir -p /usr/local/include/ctoken \
150+
&& install -m 644 inc/ctoken/ctoken* /usr/local/include/ctoken \
151+
&& install -m 644 libctoken.a /usr/local/lib
152+
153+
# Build attester MbedTLS
154+
RUN cd mbedtls \
155+
&& make clean \
156+
&& git reset --hard HEAD \
157+
&& git remote add ionut https://github.com/ionut-arm/mbedtls.git \
158+
&& git fetch ionut parsec-attestation \
159+
&& git checkout f4ac7593826a506fc509c83cad73786acab1d442 \
160+
&& make CFLAGS="-DCTOKEN_LABEL_CNF=8 -DCTOKEN_TEMP_LABEL_KAK_PUB=2500" LDFLAGS="-lctoken -lt_cose -lqcbor -lm -lparsec_se_driver -lpthread -ldl" \
161+
&& install -m 755 programs/ssl/ssl_client2 /usr/local/bin
162+
163+
# Install Parsec tool
164+
RUN git clone -b attested-tls https://github.com/ionut-arm/parsec-tool.git \
165+
&& cd parsec-tool \
166+
&& git checkout b123006aaeb8c3783c46b9157547453ab10a08f6 \
167+
&& cargo build --release \
168+
&& cp target/release/parsec-tool /usr/bin/parsec-tool
169+
170+
# Install Go toolchain
171+
RUN wget -c https://go.dev/dl/go1.20.4.linux-arm64.tar.gz -O - | tar -xz -C /usr/local
172+
ENV PATH $PATH:/usr/local/go/bin:/root/go/bin
173+
174+
# Install cocli
175+
RUN go install github.com/veraison/corim/[email protected]
176+
177+
# Introduce scripts
178+
COPY endorse.sh /root/
179+
COPY handshake.sh /root/
180+
COPY start.sh /root/
181+
182+
# Introduced platform endorsement templates
183+
COPY comid-pcr.json /root/
184+
COPY corim.json /root/
185+
186+
WORKDIR /root/
187+
188+
CMD /root/start.sh
189+
190+
191+

‎docker/attested-tls/attester/comid-pcr.json

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"tag-identity": {
3+
"id": "99019224-57AA-44BC-BEF8-D36BDD6BD035"
4+
},
5+
"entities": [
6+
{
7+
"name": "Parsec",
8+
"regid": "https://github.com/parallaxsecond",
9+
"roles": [
10+
"tagCreator",
11+
"creator",
12+
"maintainer"
13+
]
14+
}
15+
],
16+
"triples": {
17+
"reference-values": [
18+
{
19+
"environment": {
20+
"class": {
21+
"id": {
22+
"type": "uuid",
23+
"value": "D10E4BD6-7E02-4D2C-BF1A-69AE22680478"
24+
}
25+
}
26+
},
27+
"measurements": [
28+
{
29+
"key": {
30+
"type": "uint",
31+
"value": 0
32+
},
33+
"value": {
34+
"digests": [
35+
"sha-256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
36+
]
37+
}
38+
},
39+
{
40+
"key": {
41+
"type": "uint",
42+
"value": 1
43+
},
44+
"value": {
45+
"digests": [
46+
"sha-256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
47+
]
48+
}
49+
},
50+
{
51+
"key": {
52+
"type": "uint",
53+
"value": 2
54+
},
55+
"value": {
56+
"digests": [
57+
"sha-256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
58+
]
59+
}
60+
}
61+
]
62+
}
63+
]
64+
}
65+
}

‎docker/attested-tls/attester/corim.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"corim-id": "B3EC060E-2A5B-4BC2-8F71-1DAB08CE5BE9",
3+
"profiles": [
4+
"tag:github.com/parallaxsecond,2023-03-03:tpm"
5+
]
6+
}

‎docker/attested-tls/attester/endorse.sh

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/usr/bin/env bash
2+
3+
set -xeuf -o pipefail
4+
5+
# Create AIK endorsement
6+
mkdir -p endorsement/comid
7+
parsec-tool create-endorsement -c "D10E4BD6-7E02-4D2C-BF1A-69AE22680478" > endorsement/comid-key.json
8+
cp ~/comid-pcr.json ~/corim.json endorsement/
9+
10+
# Create the endorsement bundle and endorse
11+
pushd endorsement
12+
cocli comid create -o comid -t comid-key.json
13+
cocli comid create -o comid -t comid-pcr.json
14+
cocli corim create -t corim.json -M comid -o corim-parsec-tpm.cbor
15+
cocli corim submit -f corim-parsec-tpm.cbor \
16+
-s 'http://pfe:8888/endorsement-provisioning/v1/submit' \
17+
-m 'application/corim-unsigned+cbor; profile="tag:github.com/parallaxsecond,2023-03-03:tpm"'

‎docker/attested-tls/attester/handshake.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/usr/bin/env bash
2+
3+
set -xuf -o pipefail
4+
5+
ssl_client2 client_att_type=eat server_addr=$(getent hosts relying-party | cut -d ' ' -f1) server_port=4433

‎docker/attested-tls/attester/parsec-config.toml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
[core_settings]
2+
log_level = "trace"
3+
# The CI already timestamps the logs
4+
log_timestamp = false
5+
log_error_details = true
6+
7+
# The container runs the Parsec service as root, so make sure we disable root
8+
# checks.
9+
allow_root = true
10+
11+
[listener]
12+
listener_type = "DomainSocket"
13+
# The timeout needs to be smaller than the test client timeout (five seconds) as it is testing
14+
# that the service does not hang for very big values of body or authentication length.
15+
timeout = 3000 # in milliseconds
16+
socket_path = "/tmp/parsec.sock"
17+
18+
[authenticator]
19+
auth_type = "UnixPeerCredentials"
20+
21+
[[key_manager]]
22+
name = "sqlite-manager"
23+
manager_type = "SQLite"
24+
sqlite_db_path = "/root/kim-mappings/sqlite/sqlite-key-info-manager.sqlite3"
25+
26+
[[provider]]
27+
provider_type = "Tpm"
28+
key_info_manager = "sqlite-manager"
29+
tcti = "mssim"
30+
owner_hierarchy_auth = ""
31+
endorsement_hierarchy_auth = ""
32+
root_of_trust = {pcr_list = [0,1,2] , pcr_hash_alg = "Sha256"}
33+
attesting_key = "Ecc"

0 commit comments

Comments
 (0)