christoph/wamr
1
Fork 0
Code Releases Activity

linux-sgx: Improve the remote attestation (#1695)

Browse Source 
The current implementation of remote attestation does not take into
account the integrity of the wasm module. The SHA256 of the wasm
module has been put into user_data to generate the quote, and more
parameters are exposed for further verification.
This commit is contained in:
Zeuson
2022-11-22 14:45:03 +08:00
committed by GitHub
parent 87c3195d47
commit 656a8427e6
11 changed files with 298 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
product-mini/platforms/linux-sgx/enclave-sample/Enclave/Enclave.cpp
View File

@ -12,6 +12,12 @@
#include "wasm_export.h"
#include "bh_platform.h"
#if WASM_ENABLE_LIB_RATS != 0
#include <openssl/sha.h>
char wasm_module_hash[SHA256_DIGEST_LENGTH];
#endif
extern "C" {
typedef int (*os_print_function_t)(const char *message);
extern void
@ -243,6 +249,13 @@ handle_cmd_load_module(uint64 *args, uint32 argc)
*(EnclaveModule **)args_org = enclave_module;
#if WASM_ENABLE_LIB_RATS != 0
SHA256_CTX sha256;
SHA256_Init(&sha256);
SHA256_Update(&sha256, wasm_file, wasm_file_size);
SHA256_Final((unsigned char *)wasm_module_hash, &sha256);
#endif
LOG_VERBOSE("Load module success.\n");
}

5
product-mini/platforms/linux-sgx/enclave-sample/Enclave/Enclave.edl
View File

@ -3,15 +3,16 @@
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*/
#define LIB_RATS 0
#define WASM_ENABLE_LIB_RATS 0
#define SGX_IPFS 0
enclave {
from "sgx_tstdc.edl" import *;
from "sgx_pthread.edl" import *;
from "sgx_wamr.edl" import *;
#if LIB_RATS != 0
#if WASM_ENABLE_LIB_RATS != 0
from "rats.edl" import *;
from "sgx_tsgxssl.edl" import *;
#endif
#if SGX_IPFS != 0
from "sgx_tprotected_fs.edl" import *;