fuzz/*: fuzz rats-tls APIs in sgx mode #184
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,9 @@ | ||
| if(SGX) | ||
| add_subdirectory(tls_sgx_mode) | ||
| add_subdirectory(sgx-stub-enclave) | ||
| else() | ||
| add_subdirectory(tls_init) | ||
| add_subdirectory(tls_negotiate) | ||
| add_subdirectory(tls_transmit) | ||
| endif() | ||
| add_subdirectory(tls_server) | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| # Project name | ||
| project(sgx-stub-enclave CXX) | ||
|
|
||
| set(CMAKE_CXX_COMPILER "/usr/bin/clang++") | ||
| set(CMAKE_CXX_FLAGS "-g ${CMAKE_CXX_FLAGS}") | ||
| set(RATS_TLS_INSTALL_FUZZ_PATH /usr/share/rats-tls/fuzz) | ||
|
|
||
| if((BUILD_SAMPLES) OR (BUILD_FUZZ)) | ||
| set(INCLUDE_DIRS ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include | ||
| ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/rats-tls | ||
| ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/edl | ||
| ${CMAKE_CURRENT_SOURCE_DIR}/../../src/external/sgx-ssl/intel-sgx-ssl/src/intel-sgx-ssl/Linux/package/include | ||
| ) | ||
|
|
||
| set(LIBRARY_DIRS ${INTEL_SGXSSL_LIB_PATH} | ||
| ${LIBCBOR_LIB_PATH} | ||
| ${CMAKE_BINARY_DIR}/src | ||
| ${CMAKE_BINARY_DIR}/src/crypto_wrappers/nullcrypto | ||
| ${CMAKE_BINARY_DIR}/src/crypto_wrappers/openssl | ||
| ${CMAKE_BINARY_DIR}/src/tls_wrappers/nulltls | ||
| ${CMAKE_BINARY_DIR}/src/tls_wrappers/openssl | ||
| ${CMAKE_BINARY_DIR}/src/verifiers/nullverifier | ||
| ${CMAKE_BINARY_DIR}/src/verifiers/sgx-ecdsa-qve | ||
| ${CMAKE_BINARY_DIR}/src/verifiers/tdx-ecdsa | ||
| ${CMAKE_BINARY_DIR}/src/verifiers/sgx-la | ||
| ${CMAKE_BINARY_DIR}/src/attesters/nullattester | ||
| ${CMAKE_BINARY_DIR}/src/attesters/sgx-ecdsa | ||
| ${CMAKE_BINARY_DIR}/src/attesters/sgx-la | ||
| ) | ||
|
|
||
| set(EDL_SEARCH_PATHS ${CMAKE_CURRENT_SOURCE_DIR} | ||
| ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/edl | ||
| ) | ||
| else() | ||
| list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake") | ||
| include(CustomInstallDirs) | ||
| include(FindRatsTls) | ||
| if(NOT RATS_TLS_FOUND) | ||
| message(FATAL_ERROR "Failed to find rats_tls!") | ||
| endif() | ||
| include(FindSGX) | ||
| if(NOT SGX_FOUND) | ||
| message(FATAL_ERROR "Failed to find sgx!") | ||
| endif() | ||
| include(CompilerOptions) | ||
| include(SGXCommon) | ||
|
|
||
| set(INCLUDE_DIRS ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include | ||
| ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/rats-tls | ||
| ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/edl) | ||
|
|
||
| set(LIBRARY_DIRS ${RATS_TLS_INSTALL_LIB_PATH}) | ||
|
|
||
| set(EDL_SEARCH_PATHS ${CMAKE_CURRENT_SOURCE_DIR}/../../src/include/edl) | ||
| endif() | ||
|
|
||
| include_directories(${INCLUDE_DIRS}) | ||
| link_directories(${LIBRARY_DIRS}) | ||
|
|
||
| set(E_SRCS ${CMAKE_CURRENT_SOURCE_DIR}/sgx_stub_ecall.c) | ||
| set(EDLS ${CMAKE_CURRENT_SOURCE_DIR}/sgx_stub.edl) | ||
| set(LDS ${CMAKE_CURRENT_SOURCE_DIR}/sgx_stub_enclave.lds) | ||
| set(DEPEND_TRUSTED_LIBS crypto_wrapper_nullcrypto | ||
| crypto_wrapper_openssl | ||
| tls_wrapper_nulltls | ||
| tls_wrapper_openssl | ||
| attester_nullattester | ||
| attester_sgx_ecdsa | ||
| attester_sgx_la | ||
| verifier_nullverifier | ||
| verifier_sgx_la | ||
| verifier_sgx_ecdsa_qve | ||
| verifier_tdx_ecdsa | ||
| rats_tls | ||
| cbor | ||
| ) | ||
|
|
||
| add_enclave_library(sgx_stub_enclave SRCS ${E_SRCS} EDL ${EDLS} TRUSTED_LIBS ${DEPEND_TRUSTED_LIBS} EDL_SEARCH_PATHS ${EDL_SEARCH_PATHS} LDSCRIPT ${LDS}) | ||
| enclave_sign(sgx_stub_enclave KEY sgx_stub_enclave.pem CONFIG sgx_stub_enclave.xml) | ||
| add_dependencies(sgx_stub_enclave rats_tls) | ||
|
|
||
| install(FILES ${CMAKE_CURRENT_BINARY_DIR}/sgx_stub_enclave.signed.so | ||
| DESTINATION ${RATS_TLS_INSTALL_FUZZ_PATH}) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| enclave { | ||
| include "rats-tls/api.h" | ||
| include "internal/core.h" | ||
| include "sgx_eid.h" | ||
|
|
||
| from "../../src/include/edl/rtls.edl" import *; | ||
| from "sgx_tsgxssl.edl" import *; | ||
|
|
||
| trusted { | ||
| public int ecall_client_startup( | ||
| rats_tls_log_level_t log_level, | ||
| [in, out] char *fuzz_conf_bytes, | ||
| [in, string] char *attester_type, | ||
| [in, string] char *verifier_type, | ||
| [in, string] char *tls_type, | ||
| [in, string] char *crypto_type, | ||
| unsigned long flags, | ||
| uint32_t s_ip, | ||
| uint16_t s_port | ||
| ); | ||
|
|
||
| public int ecall_server_startup( | ||
| rats_tls_log_level_t log_level, | ||
| [in, string] char *attester_type, | ||
| [in, string] char *verifier_type, | ||
| [in, string] char *tls_type, | ||
| [in, string] char *crypto_type, | ||
| unsigned long flags, | ||
| uint32_t s_ip, | ||
| uint16_t s_port); | ||
| }; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,190 @@ | ||
| #include <stdio.h> | ||
| #include <string.h> | ||
| #include <unistd.h> | ||
| #include <errno.h> | ||
|
|
||
| #include <rats-tls/api.h> | ||
| #include <rats-tls/log.h> | ||
| #include "rats-tls/api.h" | ||
| #include "sgx_urts.h" | ||
| #include "sgx_stub_t.h" | ||
|
|
||
| #define FUZZ_IP "127.0.0.1" | ||
| #define FUZZ_PORT 1234 | ||
|
|
||
| int ecall_client_startup(rats_tls_log_level_t log_level, char *fuzz_conf_bytes, char *attester_type, | ||
| char *verifier_type, char *tls_type, char *crypto_type, | ||
| unsigned long flags, uint32_t s_ip, uint16_t s_port) | ||
| { | ||
| rats_tls_conf_t conf; | ||
| memset(&conf, 0, sizeof(rats_tls_conf_t)); | ||
|
|
||
| snprintf(conf.attester_type, sizeof(conf.attester_type), "%s", attester_type); | ||
| snprintf(conf.verifier_type, sizeof(conf.verifier_type), "%s", verifier_type); | ||
| snprintf(conf.tls_type, sizeof(conf.tls_type), "%s", tls_type); | ||
| snprintf(conf.crypto_type, sizeof(conf.crypto_type), "%s", crypto_type); | ||
| conf.flags = flags; | ||
| conf.cert_algo = RATS_TLS_CERT_ALGO_DEFAULT; | ||
|
|
||
| RTLS_INFO("Enter the client \n"); | ||
|
|
||
| claim_t custom_claims[2] = { | ||
| { .name = "key_0", .value = (uint8_t *)"value_0", .value_size = sizeof("value_0") }, | ||
| { .name = "key_1", .value = (uint8_t *)"value_1", .value_size = sizeof("value_1") }, | ||
| }; | ||
| conf.custom_claims = (claim_t *)custom_claims; | ||
| conf.custom_claims_length = 2; | ||
|
|
||
| /* Create a socket that uses an internet IPv4 address, | ||
| * Sets the socket to be stream based (TCP), | ||
| * 0 means choose the default protocol. | ||
| */ | ||
|
|
||
| int64_t sockfd; | ||
| int sgx_status = ocall_socket(&sockfd, RTLS_AF_INET, RTLS_SOCK_STREAM, 0); | ||
| if (sgx_status != SGX_SUCCESS || sockfd < 0) { | ||
| // RTLS_ERR("Failed to call socket() %#x %d\n", sgx_status, sockfd); | ||
| return -1; | ||
| } | ||
|
|
||
| struct rtls_sockaddr_in s_addr; | ||
| memset(&s_addr, 0, sizeof(s_addr)); | ||
| s_addr.sin_family = RTLS_AF_INET; | ||
| s_addr.sin_addr.s_addr = s_ip; | ||
| s_addr.sin_port = s_port; | ||
|
|
||
| /* Connect to the server */ | ||
| int ocall_ret = 0; | ||
| sgx_status = ocall_connect(&ocall_ret, sockfd, &s_addr, sizeof(s_addr)); | ||
| if (sgx_status != SGX_SUCCESS || ocall_ret == -1) { | ||
| // RTLS_ERR("failed to call connect() %#x %d\n", sgx_status, ocall_ret); | ||
| return -1; | ||
| } | ||
|
|
||
| // RTLS_INFO("Enter the init \n"); | ||
| /* rats-tls init */ | ||
| librats_tls_init(); | ||
| rats_tls_handle handle; | ||
| rats_tls_err_t ret = rats_tls_init(&conf, &handle); | ||
| if (ret != RATS_TLS_ERR_NONE) { | ||
| // RTLS_ERR("Failed to initialize rats tls %#x\n", ret); | ||
| return -1; | ||
| } | ||
| // RTLS_INFO("start to negotiate\n"); | ||
|
|
||
| ret = rats_tls_negotiate(handle, (int)sockfd); | ||
| if (ret != RATS_TLS_ERR_NONE) { | ||
| // RTLS_ERR("Failed to negotiate %#x\n", ret); | ||
| return -1; | ||
| } | ||
|
|
||
| const char *msg = "Hello and welcome to RATS-TLS!\n"; | ||
| size_t len = strlen(msg); | ||
| // RTLS_INFO("Enter the transmit \n"); | ||
| ret = rats_tls_transmit(handle, (void *)msg, &len); | ||
| if (ret != RATS_TLS_ERR_NONE || len != strlen(msg)) { | ||
| // RTLS_ERR("Failed to transmit %#x\n", ret); | ||
| goto err; | ||
| } | ||
|
|
||
| ret = rats_tls_cleanup(handle); | ||
| if (ret != RATS_TLS_ERR_NONE) | ||
| // RTLS_ERR("Failed to cleanup %#x\n", ret); | ||
|
|
||
| return 0; | ||
|
|
||
| err: | ||
| rats_tls_cleanup(handle); | ||
| return -1; | ||
| } | ||
|
|
||
| int ecall_server_startup(rats_tls_log_level_t log_level, char *attester_type, char *verifier_type, | ||
| char *tls_type, char *crypto_type, unsigned long flags, uint32_t s_ip, | ||
| uint16_t s_port) | ||
| { | ||
| rats_tls_conf_t conf; | ||
| memset(&conf, 0, sizeof(conf)); | ||
| conf.log_level = log_level; | ||
|
|
||
| snprintf(conf.attester_type, sizeof(conf.attester_type), "%s", attester_type); | ||
| snprintf(conf.verifier_type, sizeof(conf.verifier_type), "%s", verifier_type); | ||
| snprintf(conf.tls_type, sizeof(conf.tls_type), "%s", tls_type); | ||
| snprintf(conf.crypto_type, sizeof(conf.crypto_type), "%s", crypto_type); | ||
|
|
||
| conf.flags = flags; | ||
| conf.cert_algo = RATS_TLS_CERT_ALGO_DEFAULT; | ||
|
|
||
| claim_t custom_claims[2] = { | ||
| { .name = "key_0", .value = (uint8_t *)"value_0", .value_size = sizeof("value_0") }, | ||
| { .name = "key_1", .value = (uint8_t *)"value_1", .value_size = sizeof("value_1") }, | ||
| }; | ||
| conf.custom_claims = (claim_t *)custom_claims; | ||
| conf.custom_claims_length = 2; | ||
|
|
||
| int64_t sockfd; | ||
| int sgx_status = ocall_socket(&sockfd, RTLS_AF_INET, RTLS_SOCK_STREAM, 0); | ||
| if (sgx_status != SGX_SUCCESS || sockfd < 0) { | ||
| // RTLS_ERR("Failed to call socket() %#x %d\n", sgx_status, sockfd); | ||
| return -1; | ||
| } | ||
|
|
||
| int ocall_ret = 0; | ||
|
|
||
| struct rtls_sockaddr_in s_addr; | ||
| memset(&s_addr, 0, sizeof(s_addr)); | ||
| s_addr.sin_family = RTLS_AF_INET; | ||
| s_addr.sin_addr.s_addr = s_ip; | ||
| s_addr.sin_port = s_port; | ||
|
|
||
| /* Bind the server socket */ | ||
| sgx_status = ocall_bind(&ocall_ret, sockfd, &s_addr, sizeof(s_addr)); | ||
| if (sgx_status != SGX_SUCCESS || ocall_ret == -1) { | ||
| // RTLS_ERR("Failed to call bind(), %#x %d\n", sgx_status, ocall_ret); | ||
| return -1; | ||
| } | ||
|
|
||
| /* Listen for a new connection, allow 5 pending connections */ | ||
| sgx_status = ocall_listen(&ocall_ret, sockfd, 5); | ||
| if (sgx_status != SGX_SUCCESS || ocall_ret == -1) { | ||
| // RTLS_ERR("Failed to call listen(), %#x %d\n", sgx_status, ocall_ret); | ||
| return -1; | ||
| } | ||
|
|
||
| librats_tls_init(); | ||
| rats_tls_handle handle; | ||
| rats_tls_err_t ret = rats_tls_init(&conf, &handle); | ||
| if (ret != RATS_TLS_ERR_NONE) { | ||
| // RTLS_ERR("Failed to initialize rats tls %#x\n", ret); | ||
| return -1; | ||
| } | ||
|
|
||
| struct rtls_sockaddr_in c_addr; | ||
| uint32_t addrlen_in = sizeof(c_addr); | ||
| uint32_t addrlen_out; | ||
| while (1) { | ||
| // RTLS_INFO("Waiting for a connection ...\n"); | ||
|
|
||
| int64_t connd; | ||
| sgx_status = ocall_accept(&connd, sockfd, &c_addr, addrlen_in, &addrlen_out); | ||
| if (sgx_status != SGX_SUCCESS || connd < 0) { | ||
| // RTLS_ERR("Failed to call accept() %#x %d\n", sgx_status, connd); | ||
| return -1; | ||
| } | ||
|
|
||
| ret = rats_tls_negotiate(handle, connd); | ||
| if (ret != RATS_TLS_ERR_NONE) { | ||
| // RTLS_ERR("Failed to negotiate %#x\n", ret); | ||
| goto err; | ||
| } | ||
|
|
||
| // RTLS_INFO("Client connected successfully\n"); | ||
|
|
||
| ocall_close(&ocall_ret, connd); | ||
| } | ||
|
|
||
| return 0; | ||
| err: | ||
| /* Ignore the error code of cleanup in order to return the prepositional error */ | ||
| rats_tls_cleanup(handle); | ||
| return -1; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| #ifndef _SGX_STUB_ECALL_H_ | ||
| #define _SGX_STUB_ECALL_H_ | ||
| #endif |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please remove this code to line 65