mirror of
https://github.com/corda/corda.git
synced 2025-01-01 02:36:44 +00:00
83d6a248a8
* ENT-970 - SGX remote attestation host
* Remote attestation enclave
* Client for the remote attestation host
* Communicates with ISV / RA server, which in turn communicates with
the Intel Attestation Service
* Native library bridging the client code running on the JVM with
the native bits controlling and communicating with the enclave
* ENT-970 - Address comments from code review
* ENT-970 - More updates addressing review comments
* ENT-970 - Integrate with root Gradle project for SGX
96 lines
3.0 KiB
C++
96 lines
3.0 KiB
C++
#include <cstddef>
|
|
|
|
#include <sgx.h>
|
|
#include <sgx_key_exchange.h>
|
|
#include <sgx_uae_service.h>
|
|
|
|
#include "enclave-manager.hpp"
|
|
#include "logging.hpp"
|
|
|
|
// Instantiate a new enclave from a signed enclave binary, and return the
|
|
// identifier of the instance.
|
|
sgx_enclave_id_t create_enclave(
|
|
const char *path,
|
|
bool use_platform_services,
|
|
sgx_status_t *result,
|
|
sgx_launch_token_t *token
|
|
) {
|
|
int updated = 0; // Indication of whether the launch token was updated.
|
|
sgx_enclave_id_t enclave_id = 0; // The identifier of the created enclave.
|
|
|
|
// If the launch token is empty, then create a new enclave. Otherwise, try
|
|
// to re-activate the existing enclave. `SGX_DEBUG_FLAG` is automatically
|
|
// set to 1 in debug mode, and 0 in release mode.
|
|
sgx_status_t status = sgx_create_enclave(
|
|
path, SGX_DEBUG_FLAG, token, &updated, &enclave_id, NULL
|
|
);
|
|
|
|
LOG(enclave_id, status, 0, "sgx_create_enclave()");
|
|
|
|
// Store the return value of the operation.
|
|
if (NULL != result) {
|
|
*result = status;
|
|
}
|
|
|
|
// Return the identifier of the created enclave. Remember that if `status`
|
|
// is `SGX_ERROR_ENCLAVE_LOST`, the enclave should be destroyed and then
|
|
// re-created.
|
|
return (SGX_SUCCESS == status) ? enclave_id : 0;
|
|
}
|
|
|
|
// Destroy enclave if currently loaded.
|
|
bool destroy_enclave(sgx_enclave_id_t enclave_id) {
|
|
if (enclave_id != 0){
|
|
// Attempt to destroy the enclave if we are provided with a valid
|
|
// enclave identifier.
|
|
sgx_status_t status = sgx_destroy_enclave(enclave_id);
|
|
|
|
LOG(enclave_id, status, 0, "sgx_destroy_enclave()");
|
|
|
|
return SGX_SUCCESS == status;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
// Check the status of the SGX device on the current machine.
|
|
sgx_device_status_t get_device_status(void) {
|
|
#if SGX_SIM == 1
|
|
#pragma message "get_device_status() is being simulated"
|
|
// If in simulation mode, simulate device capabilities.
|
|
return SGX_ENABLED;
|
|
#endif
|
|
|
|
// Try to retrieve the current status of the SGX device.
|
|
sgx_device_status_t status;
|
|
sgx_status_t ret = sgx_cap_enable_device(&status);
|
|
|
|
LOG(0, ret, 0, "sgx_cap_enable_device() = { status = %x }", status);
|
|
|
|
if (SGX_SUCCESS != ret) {
|
|
return SGX_DISABLED;
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
// Report which extended Intel EPID Group the client uses by default.
|
|
uint32_t get_extended_group_id(sgx_status_t *result) {
|
|
uint32_t egid;
|
|
|
|
// The extended EPID group identifier is indicative of which attestation
|
|
// service the client is supposed to be communicating with. Currently, only
|
|
// a value of zero is supported, which is referring to Intel. The user
|
|
// should verify the retrieved extended group identifier, as any other
|
|
// value than zero will be disregarded by the service provider.
|
|
sgx_status_t status = sgx_get_extended_epid_group_id(&egid);
|
|
|
|
LOG(0, status, 0, "sgx_get_extended_epid_group_id() = %u", egid);
|
|
|
|
// Store the return value of the operation.
|
|
if (NULL != result) {
|
|
*result = status;
|
|
}
|
|
|
|
return egid;
|
|
}
|