Skip to content

Commit

Permalink
Merge pull request #116 from dominic-mulligan-arm/runtime-manager-linux
Browse files Browse the repository at this point in the history
Ported Veracruz to Linux
  • Loading branch information
dominic-mulligan-arm authored Nov 3, 2021
2 parents 2efd142 + 72a4fb0 commit d6210f4
Show file tree
Hide file tree
Showing 59 changed files with 3,595 additions and 909 deletions.
68 changes: 53 additions & 15 deletions .github/workflows/main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ on:
jobs:
check-repo-and-compile-sdk:
runs-on: ubuntu-latest
container:
container:
image: ghcr.io/veracruz-project/veracruz/veracruz:ci
volumes:
- ${{ github.workspace }}:/work/veracruz
volumes:
- ${{ github.workspace }}:/work/veracruz

steps:

Expand All @@ -26,7 +26,7 @@ jobs:
uses: actions/checkout@v2
with:
submodules: recursive

# Compile all examples and data sources in the sdk
- name: Compile SDK
id: sdk
Expand All @@ -46,19 +46,19 @@ jobs:
uses: actions/upload-artifact@v2
with:
name: veracruz.tar
path: /veracruz.tar
path: /veracruz.tar
if-no-files-found: error

sgx:
runs-on: ubuntu-latest
container:
container:
image: ghcr.io/veracruz-project/veracruz/veracruz:ci
volumes:
- ${{ github.workspace }}:/work/veracruz
volumes:
- ${{ github.workspace }}:/work/veracruz
needs: [check-repo-and-compile-sdk]

steps:

# Download the artifact containing repo and sdk artifact, using the action from github
- name: Download veracruz cache artifact
uses: actions/download-artifact@v2
Expand All @@ -73,7 +73,7 @@ jobs:
mkdir -p /work/veracruz
tar -C /work/veracruz -xvf veracruz.tar
rm veracruz.tar
# Run the sgx test
- name: Running sgx test script
id: sgx-test
Expand All @@ -83,16 +83,17 @@ jobs:
make sgx-veracruz-server-test-dry-run
make sgx-veracruz-test-dry-run
make sgx-veracruz-client-test
tz:
runs-on: ubuntu-latest
container:
container:
image: ghcr.io/veracruz-project/veracruz/veracruz:ci
volumes:
- ${{ github.workspace }}:/work/veracruz
volumes:
- ${{ github.workspace }}:/work/veracruz
needs: [check-repo-and-compile-sdk]

steps:

# Download the artifact containing repo and sdk artifact, using the action from github
- name: Download veracruz cache artifact
uses: actions/download-artifact@v2
Expand All @@ -107,7 +108,7 @@ jobs:
mkdir -p /work/veracruz
tar -C /work/veracruz -xvf veracruz.tar
rm veracruz.tar
- name: Running trustzone test script
id: tz-test
run: |
Expand All @@ -119,6 +120,39 @@ jobs:
make trustzone-veracruz-test
make trustzone-veracruz-client-test
linux:
runs-on: ubuntu-latest
container:
image: ghcr.io/veracruz-project/veracruz/veracruz:ci
volumes:
- ${{ github.workspace }}:/work/veracruz
needs: [check-repo-and-compile-sdk]
steps:
# Download the artifact containing repo and sdk artifact, using the action from github
- name: Download veracruz cache artifact
uses: actions/download-artifact@v2
with:
name: veracruz.tar
path: /
# Unpack
- name: Unpack veracruz cache artifact
id: tz-unpack
run: |
cd /
mkdir -p /work/veracruz
mv veracruz.tar /work/veracruz
cd /work/veracruz
tar -xvf veracruz.tar
rm veracruz.tar
- name: Running linux test script
id: linux-test
run: |
cd /work/veracruz
make linux
make linux-veracruz-server-test
make linux-veracruz-test
make linux-veracruz-client-test
icecap:
runs-on: ubuntu-latest
container:
Expand All @@ -132,3 +166,7 @@ jobs:
submodules: recursive
- name: Build and test Veracruz on IceCap
run: bash /work/veracruz/icecap/ci/run.sh




49 changes: 44 additions & 5 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,9 @@
#
# See the `LICENSE_MIT.markdown` file in the Veracruz root directory for licensing
# and copyright information.

.PHONY: all sdk setup-githooks sgx-veracruz-client-test trustzone-veracruz-client-test nitro-veracruz-client-test sgx trustzone sgx-veracruz-server-test sgx-veracruz-server-performance sgx-veracruz-test sgx-psa-attestation tz-psa-attestationtrustzone-veracruz-server-test-setting trustzone-veracruz-test-setting trustzone-env sgx-env trustzone-test-env clean clean-cargo-lock fmt


.PHONY: all sdk setup-githooks sgx-veracruz-client-test trustzone-veracruz-client-test nitro-veracruz-client-test sgx trustzone sgx-veracruz-server-test sgx-veracruz-server-performance sgx-veracruz-test sgx-psa-attestation tz-psa-attestationtrustzone-veracruz-server-test-setting trustzone-veracruz-test-setting trustzone-env sgx-env trustzone-test-env clean clean-cargo-lock fmt linux linux-veracruz-server-test linux-veracruz-server-test-dry-run linux-test-collateral linux-veracruz-client-test linux-veracruz-test-dry-run linux-veracruz-test linux-cli

WARNING_COLOR := "\e[1;33m"
INFO_COLOR := "\e[1;32m"
RESET_COLOR := "\e[0m"
Expand All @@ -22,6 +21,7 @@ OPENSSL_INCLUDE_DIR ?= /usr/include/aarch64-linux-gnu
OPENSSL_LIB_DIR ?= /usr/lib/aarch64-linux-gnu
TRUSTZONE_C_INCLUDE_PATH ?= /usr/include/aarch64-linux-gnu:/usr/include
NITRO_RUST_FLAG ?= ""
LINUX_RUST_FLAG ?= ""
BIN_DIR ?= /usr/local/cargo/bin

all:
Expand All @@ -42,6 +42,9 @@ sgx-test-collateral:
trustzone-test-collateral:
TEE=tz $(MAKE) -C test-collateral

linux-test-collateral:
TEE=linux $(MAKE) -C test-collateral

# Test veracruz-client for sgx, due to the use of a mocked server with a fixed port, these tests must run in a single thread
sgx-veracruz-client-test: sgx sgx-test-collateral
cd veracruz-client && RUSTFLAGS=$(SGX_RUST_FLAG) cargo test --lib --features "mock sgx" -- --test-threads=1
Expand All @@ -53,6 +56,9 @@ trustzone-veracruz-client-test: trustzone trustzone-test-collateral
nitro-veracruz-client-test: nitro nitro-test-collateral
cd veracruz-client && cargo test --lib --features "mock" -- --test-threads=1

linux-veracruz-client-test: linux linux-test-collateral
cd veracruz-client && cargo test --lib --features "mock linux" -- --test-threads=1

nitro-test-collateral:
TEE=nitro $(MAKE) -C test-collateral
# Compile for sgx
Expand Down Expand Up @@ -108,7 +114,7 @@ trustzone-cli: trustzone-env
OPENSSL_INCLUDE_DIR=$(OPENSSL_INCLUDE_DIR) \
OPENSSL_LIB_DIR=$(OPENSSL_LIB_DIR) \
C_INCLUDE_PATH=$(TRUSTZONE_C_INCLUDE_PATH) \
cargo build --target aarch64-unknown-linux-gnu --features psa --features cli
cargo build --target aarch64-unknown-linux-gnu --features tz --features cli
cd veracruz-server && \
CC_aarch64_unknown_linux_gnu=$(AARCH64_GCC) \
OPENSSL_INCLUDE_DIR=$(OPENSSL_INCLUDE_DIR) \
Expand Down Expand Up @@ -153,6 +159,20 @@ veracruz-test/proxy-attestation-server.db: $(wildcard sgx-root-enclave/css.bin)
veracruz-server-test/proxy-attestation-server.db: $(wildcard sgx-root-enclave/css.bin)
cd veracruz-server-test && \
bash ../test-collateral/populate-test-database.sh
linux: sdk
pwd
RUSTFLAGS=$(LINUX_RUST_FLAG) $(MAKE) -C runtime-manager linux
RUSTFLAGS=$(LINUX_RUST_FLAG) $(MAKE) -C linux-root-enclave linux

linux-cli:
# build CLIs in top-level crates
cd proxy-attestation-server && RUSTFLAGS=$(LINUX_RUST_FLAG) cargo build --features linux --features cli
cd veracruz-server && RUSTFLAGS=$(LINUX_RUST_FLAG) cargo build --features linux --features cli
cd veracruz-client && RUSTFLAGS=$(LINUX_RUST_FLAG) cargo build --features linux --features cli
# build CLIs in the SDK/test-collateral
$(MAKE) -C sdk/freestanding-execution-engine
$(MAKE) -C sdk/wasm-checker
$(MAKE) -C test-collateral/generate-policy

sgx-veracruz-server-test: sgx sgx-test-collateral veracruz-server-test/proxy-attestation-server.db
cd veracruz-server-test \
Expand Down Expand Up @@ -209,6 +229,15 @@ nitro-veracruz-server-test: nitro nitro-test-collateral veracruz-server-test/pro
cd veracruz-server-test \
&& ./nitro-terminate.sh

linux-veracruz-server-test-dry-run: linux linux-test-collateral
cd veracruz-server-test \
&& RUSTFLAGS=$(LINUX_RUST_FLAG) cargo test --features linux --no-run -- --nocapture

linux-veracruz-server-test: linux linux-test-collateral veracruz-server-test/proxy-attestation-server.db
cd veracruz-server-test \
&& RUSTFLAGS=$(LINUX_RUST_FLAG) cargo test --features linux -- --test-threads=1 --nocapture \
&& RUSTFLAGS=$(LINUX_RUST_FLAG) cargo test test_debug --features linux -- --ignored --test-threads=1

nitro-veracruz-server-test-dry-run: nitro nitro-test-collateral
cd veracruz-server-test \
&& RUSTFLAGS=$(NITRO_RUST_FLAG) cargo test --features sgx --no-run
Expand Down Expand Up @@ -236,6 +265,14 @@ nitro-veracruz-test: nitro nitro-test-collateral veracruz-test/proxy-attestation
nitro-psa-attestation:
cd psa-attestation && cargo build --features nitro

linux-veracruz-test-dry-run: linux-test-collateral
cd veracruz-test \
&& RUSTFLAGS=$(LINUX_RUST_FLAG) cargo test --features linux --no-run

linux-veracruz-test: linux-test-collateral linux veracruz-test/proxy-attestation-server.db
cd veracruz-test \
&& RUSTFLAGS=$(LINUX_RUST_FLAG) cargo test --features linux -- --test-threads=1

trustzone-env:
unset CC
rustup target add aarch64-unknown-linux-gnu arm-unknown-linux-gnueabihf
Expand All @@ -257,14 +294,15 @@ clean:
cd proxy-attestation-server && cargo clean
cd session-manager && cargo clean
cd veracruz-utils && cargo clean
cd veracruz-server && cargo clean
cd veracruz-server-test && cargo clean
cd veracruz-test && cargo clean && rm -f proxy-attestation-server.db
$(MAKE) clean -C runtime-manager
$(MAKE) clean -C sgx-root-enclave
$(MAKE) clean -C veracruz-server
$(MAKE) clean -C test-collateral
$(MAKE) clean -C trustzone-root-enclave
$(MAKE) clean -C sdk
$(MAKE) clean -C linux-root-enclave
rm -rf bin

# NOTE: this target deletes ALL cargo.lock.
Expand Down Expand Up @@ -304,4 +342,5 @@ fmt:
cd veracruz-utils && cargo fmt
cd trustzone-root-enclave && cargo fmt
cd proxy-attestation-server && cargo fmt
cd linux-root-enclave && cargo fmt
$(MAKE) -C sdk fmt
14 changes: 12 additions & 2 deletions io-utils/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,22 @@ edition = "2018"
description = "Common IO-related code used by multiple Veracruz components."

[features]
nitro = ["serde_json/std", "nix", "byteorder"]
sgx = ["base64/std"]
linux = ["bincode", "byteorder", "base64/std"]
icecap = ["serde/derive", "base64/std"]
nitro = ["serde_json/std", "base64/std", "nix", "byteorder"]
tz = ["base64/std"]

[dependencies]
sgx_tstd = { rev = "v1.1.2", git = "https://github.com/apache/teaclave-sgx-sdk.git", optional = true }
bincode = { git= "https://github.com/veracruz-project/bincode.git", branch= "veracruz", default-features = false, optional = true }
serde = { git = "https://github.com/veracruz-project/serde.git", features=["derive"], branch = "veracruz" }
serde_json = { git = "https://github.com/veracruz-project/json.git", branch = "veracruz", default-features = false }
err-derive = "0.2"
nix = { version = "0.15", optional = true }
byteorder = { version = "1.3", optional = true }
log = "=0.4.13"
curl = "=0.4.35"
stringreader = "0.1"
transport-protocol = { path = "../transport-protocol" }
base64 = { version = "0.13.0", default-features = false, optional = true }

18 changes: 17 additions & 1 deletion io-utils/src/error.rs
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,11 @@
//! See the `LICENSE_MIT.markdown` file in the Veracruz root directory for
//! information on licensing and copyright.
#[cfg(feature = "linux")]
use bincode::Error as BincodeError;
use err_derive::Error;
#[cfg(feature = "linux")]
use std::io::Error as IOError;

////////////////////////////////////////////////////////////////////////////////
// Socket-related error types.
Expand All @@ -18,7 +22,19 @@ use err_derive::Error;
/// a enumerated type for Veracruz-specific io errors
#[derive(Debug, Error)]
pub enum SocketError {
/// An error was returned by nix
/// A Bincode-related (de)serialization error occurred.
#[cfg(feature = "linux")]
#[error(
display = "SocketError: a Bincode serialization error occurred: {:?}",
_0
)]
BincodeError(BincodeError),
/// An IO error occurred when writing to e.g. an FD.
#[cfg(feature = "linux")]
#[error(display = "SocketError: an IO error occurred: {:?}.", _0)]
IOError(IOError),
/// An error was returned by the Unix libraries.
#[cfg(feature = "nitro")]
#[error(display = "SocketError: a Unix error occurred: {:?}", _0)]
NixError(#[error(source)] nix::Error),
}
76 changes: 76 additions & 0 deletions io-utils/src/fd.rs
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
//! Common file descriptor-related material
//!
//! # Authors
//!
//! The Veracruz Development Team.
//!
//! # Copyright and licensing
//!
//! See the `LICENSE.markdown` file in the Veracruz root directory for copyright
//! and licensing information.
use byteorder::{ByteOrder, LittleEndian};

/// Sends a `buffer` of data (by first transmitting an encoded length followed by
/// the data proper) to the file descriptor `fd`.
pub fn send_buffer<T>(mut fd: T, buffer: &[u8]) -> Result<(), std::io::Error>
where
T: std::io::Write,
{
let len = buffer.len();

// 1: Encode the data length and send it.
{
let mut buff = [0u8; 9];
LittleEndian::write_u64(&mut buff, len as u64);

let mut sent_bytes = 0;

while sent_bytes < 9 {
sent_bytes += fd.write(&buff[sent_bytes..9])?;
}
}

// 2. Send the data proper.
{
let mut sent_bytes = 0;

while sent_bytes < len {
sent_bytes += fd.write(&buffer[sent_bytes..len])?;
}
}

Ok(())
}

/// Reads a buffer of data from a file descriptor `fd` by first reading a length
/// of data, followed by the data proper.
pub fn receive_buffer<T>(mut fd: T) -> Result<Vec<u8>, std::io::Error>
where
T: std::io::Read,
{
// 1. First read and decode the length of the data proper.
let length = {
let mut buff = [0u8; 9];
let mut received_bytes = 0;

while received_bytes < 9 {
received_bytes += fd.read(&mut buff[received_bytes..9])?;
}

LittleEndian::read_u64(&buff) as usize
};

// 2. Next, read the data proper.
let mut buffer = vec![0u8; length];

{
let mut received_bytes = 0;

while received_bytes < length {
received_bytes += fd.read(&mut buffer[received_bytes..length])?;
}
}

Ok(buffer)
}
Loading

0 comments on commit d6210f4

Please sign in to comment.