Skip to content

Commit fdd1c0a

Browse files
author
Junxian.Xiao
committed
verify secret policy in client side
1 parent 829b3cb commit fdd1c0a

File tree

14 files changed

+168
-58
lines changed

14 files changed

+168
-58
lines changed

‎client/cpp_occlum/bom_aecs_client_gnu.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,4 @@ targets:
2323
- from: ../../../deployment/conf/
2424
files:
2525
- service_secret_policy.yaml
26+
- ta_secret_policy.yaml

‎client/cpp_occlum/occlum_aecs_client_lib/occlum_aecs_client_main.cpp‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ DEFINE_string(output, "", "output file to save secret when get/getpub");
4040
//=============================================================
4141
static int DoCreateSecret() {
4242
std::string aecs_ra_policy = "";
43-
printf("[Get secret public key]\n");
43+
printf("[Create Secret]\n");
4444
printf(" AECS Server: %s\n", FLAGS_endpoint.c_str());
4545
printf(" Template File: %s\n", FLAGS_policy.c_str());
4646

@@ -57,7 +57,7 @@ static int DoCreateSecret() {
5757

5858
static int DoDestroySecret() {
5959
std::string aecs_ra_policy = "";
60-
printf("[Get secret public key]\n");
60+
printf("[Destroy Secret]\n");
6161
printf(" AECS Server: %s\n", FLAGS_endpoint.c_str());
6262
printf(" Secret Name: %s\n", FLAGS_secret.c_str());
6363

@@ -74,6 +74,7 @@ static int DoDestroySecret() {
7474

7575
static int DoGetSecret() {
7676
std::string aecs_ra_policy = "";
77+
std::string secret_policy = "{}";
7778
printf("[Get secret]\n");
7879
printf(" AECS Server: %s\n", FLAGS_endpoint.c_str());
7980
printf(" Service Name: %s\n", FLAGS_action.c_str());
@@ -84,7 +85,8 @@ static int DoGetSecret() {
8485
// Use the C-ABI interface to get secret
8586
int ret = aecs_client_get_secret_and_save_file(
8687
FLAGS_endpoint.c_str(), aecs_ra_policy.c_str(), FLAGS_service.c_str(),
87-
FLAGS_secret.c_str(), FLAGS_nonce.c_str(), FLAGS_output.c_str());
88+
FLAGS_secret.c_str(), secret_policy.data(), FLAGS_nonce.c_str(),
89+
FLAGS_output.c_str());
8890
if (ret != 0) {
8991
printf("Fail to get secret from aecs: %d!\n", ret);
9092
return ret;
@@ -106,6 +108,7 @@ static int DoGetSecret() {
106108

107109
static int DoGetSecretPublic() {
108110
std::string aecs_ra_policy = "";
111+
std::string secret_policy = "";
109112
printf("[Get secret public key]\n");
110113
printf(" AECS Server: %s\n", FLAGS_endpoint.c_str());
111114
printf(" Service Name: %s\n", FLAGS_action.c_str());
@@ -116,7 +119,8 @@ static int DoGetSecretPublic() {
116119
// Use the C-ABI interface to get secret public key
117120
int ret = aecs_client_get_public_secret_and_save_file(
118121
FLAGS_endpoint.c_str(), aecs_ra_policy.c_str(), FLAGS_service.c_str(),
119-
FLAGS_secret.c_str(), FLAGS_nonce.c_str(), FLAGS_output.c_str());
122+
FLAGS_secret.c_str(), secret_policy.data(), FLAGS_nonce.c_str(),
123+
FLAGS_output.c_str());
120124
if (ret != 0) {
121125
printf("Fail to get secret public key from aecs: %d!\n", ret);
122126
return ret;

‎client/cpp_occlum/occlum_aecs_client_lib/src/occlum_aecs_client_lib.cpp‎

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,13 @@ TeeErrorCode aecs_client_get_secret_to_file(
4141
const std::string& aecs_server_policy,
4242
const std::string& secret_service,
4343
const std::string& secret_name,
44+
const std::string& secret_policy,
4445
const std::string& nonce,
4546
const std::string& save_file_name) {
4647
std::string secret_str;
47-
TEE_CHECK_RETURN(aecs_client_get_secret(aecs_server_endpoint,
48-
aecs_server_policy, secret_service,
49-
secret_name, nonce, &secret_str));
48+
TEE_CHECK_RETURN(aecs_client_get_secret(
49+
aecs_server_endpoint, aecs_server_policy, secret_service, secret_name,
50+
secret_policy, nonce, &secret_str));
5051
// Save the secret string into local file system
5152
// For occlum, it should be secure filesytem to avoid secret leak
5253
using kubetee::utils::FsWriteString;
@@ -59,6 +60,7 @@ TeeErrorCode aecs_client_get_secret(const std::string& aecs_server_endpoint,
5960
const std::string& aecs_server_policy,
6061
const std::string& secret_service,
6162
const std::string& secret_name,
63+
const std::string& secret_policy,
6264
const std::string& nonce,
6365
std::string* secret_str) {
6466
kubetee::GetEnclaveSecretRequest req;
@@ -86,8 +88,21 @@ TeeErrorCode aecs_client_get_secret(const std::string& aecs_server_endpoint,
8688
TEE_CHECK_RETURN(VerifyAecsEnclave(res.auth_ra_report(), aecs_server_policy));
8789

8890
// Decrypt and verify the digital envelope encrypted identity keys
89-
TEE_CHECK_RETURN(EnvelopeDecryptAndVerify(res, nonce, secret_str));
91+
std::string enclave_secret_str;
92+
kubetee::EnclaveSecret secret;
93+
TEE_CHECK_RETURN(EnvelopeDecryptAndVerify(res, nonce, &enclave_secret_str));
94+
JSON2PB(enclave_secret_str, &secret);
95+
96+
// Verify secret policy if necessary
97+
if (!secret_policy.empty() && secret_policy != "{}") {
98+
const kubetee::UnifiedAttestationPolicy& policy =
99+
secret.spec().policy().policy();
100+
kubetee::UnifiedAttestationPolicy expected_policy;
101+
JSON2PB(secret_policy, &expected_policy);
102+
TEE_CHECK_RETURN(UaVerifyPolicy(policy, expected_policy));
103+
}
90104

105+
secret_str->assign(secret.data());
91106
return TEE_SUCCESS;
92107
}
93108

@@ -113,8 +128,9 @@ TeeErrorCode aecs_client_create_secret(const std::string& aecs_server_endpoint,
113128
for (int i = 0; i < result.secrets_size(); i++) {
114129
std::string secret_name = result.secrets()[i].spec().secret_name();
115130
TEE_LOG_INFO("Create the secret[%d]: %s", i, secret_name.c_str());
116-
req.mutable_secret()->CopyFrom(result.secrets()[i]);
117-
req.mutable_secret()->mutable_spec()->mutable_policy()->Clear();
131+
kubetee::EnclaveSecret* secret = req.mutable_secret();
132+
secret->CopyFrom(result.secrets()[i]);
133+
secret->mutable_spec()->mutable_policy()->mutable_policy()->Clear();
118134
int ret = aecs_client.CreateTaSecret(req, &res);
119135
if (ret != TEE_SUCCESS) {
120136
TEE_LOG_ERROR("Fail to create secret: %s", secret_name.c_str());
@@ -154,19 +170,21 @@ int aecs_client_get_secret_and_save_file(const char* aecs_server_endpoint,
154170
const char* aecs_server_policy,
155171
const char* secret_service,
156172
const char* secret_name,
173+
const char* secret_policy,
157174
const char* nonce,
158175
const char* save_file_name) {
159176
TEE_CHECK_RETURN(aecs_client_get_secret_to_file(
160177
SAFESTR(aecs_server_endpoint), SAFESTR(aecs_server_policy),
161-
SAFESTR(secret_service), SAFESTR(secret_name), SAFESTR(nonce),
162-
SAFESTR(save_file_name)));
178+
SAFESTR(secret_service), SAFESTR(secret_name), SAFESTR(secret_policy),
179+
SAFESTR(nonce), SAFESTR(save_file_name)));
163180
return 0;
164181
}
165182

166183
int aecs_client_get_secret_by_buffer(const char* aecs_server_endpoint,
167184
const char* aecs_server_policy,
168185
const char* secret_service,
169186
const char* secret_name,
187+
const char* secret_policy,
170188
const char* nonce,
171189
char* secret_outbuf,
172190
int* secret_outbuf_len) {
@@ -175,8 +193,8 @@ int aecs_client_get_secret_by_buffer(const char* aecs_server_endpoint,
175193
std::string secret_str;
176194
TEE_CHECK_RETURN(aecs_client_get_secret(
177195
SAFESTR(aecs_server_endpoint), SAFESTR(aecs_server_policy),
178-
SAFESTR(secret_service), SAFESTR(secret_name), SAFESTR(nonce),
179-
&secret_str));
196+
SAFESTR(secret_service), SAFESTR(secret_name), SAFESTR(secret_policy),
197+
SAFESTR(nonce), &secret_str));
180198
if (*secret_outbuf_len <= secret_str.size()) {
181199
return TEE_ERROR_SMALL_BUFFER;
182200
}

‎client/cpp_occlum/occlum_aecs_client_lib/src/occlum_aecs_client_lib.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ extern "C" {
1515
* @param[in] aecs_server_policy
1616
* @param[in] secret_service
1717
* @param[in] secret_name
18+
* @param[in] secret_policy
1819
* @param[in] nonce
1920
* @param[in] save_file_name
2021
* @return int Error code
@@ -24,6 +25,7 @@ TeeErrorCode aecs_client_get_secret_to_file(
2425
const std::string& aecs_server_policy,
2526
const std::string& secret_service,
2627
const std::string& secret_name,
28+
const std::string& secret_policy,
2729
const std::string& nonce,
2830
const std::string& save_file_name);
2931

@@ -34,6 +36,7 @@ TeeErrorCode aecs_client_get_secret_to_file(
3436
* @param[in] aecs_server_policy
3537
* @param[in] secret_service
3638
* @param[in] secret_name
39+
* @param[in] secret_policy
3740
* @param[in] nonce
3841
* @param[out] secret Json-format secret
3942
* @return int Error code
@@ -42,6 +45,7 @@ TeeErrorCode aecs_client_get_secret(const std::string& aecs_server_endpoint,
4245
const std::string& aecs_server_policy,
4346
const std::string& secret_service,
4447
const std::string& secret_name,
48+
const std::string& secret_policy,
4549
const std::string& nonce,
4650
std::string* secret);
4751

‎client/cpp_occlum/occlum_aecs_client_lib/src/occlum_aecs_client_lib_c.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ extern "C" {
1313
* @param[in] aecs_server_policy
1414
* @param[in] secret_service
1515
* @param[in] secret_name
16+
* @param[in] secret_policy
1617
* @param[in] nonce
1718
* @param[in] file name to save secret
1819
* @return int Error code
@@ -21,6 +22,7 @@ int aecs_client_get_secret_and_save_file(const char* aecs_server_endpoint,
2122
const char* aecs_server_policy,
2223
const char* secret_service,
2324
const char* secret_name,
25+
const char* secret_policy,
2426
const char* nonce,
2527
const char* save_file_name);
2628

@@ -31,6 +33,7 @@ int aecs_client_get_secret_and_save_file(const char* aecs_server_endpoint,
3133
* @param[in] aecs_server_policy
3234
* @param[in] secret_service
3335
* @param[in] secret_name
36+
* @param[in] secret_policy
3437
* @param[in] nonce
3538
* @param[out] secret_outbuf output buffer which includes the secret
3639
* @param[inout] secret_outbuf_len max len as input/real len as output
@@ -40,6 +43,7 @@ int aecs_client_get_secret_by_buffer(const char* aecs_server_endpoint,
4043
const char* aecs_server_policy,
4144
const char* secret_service,
4245
const char* secret_name,
46+
const char* secret_policy,
4347
const char* nonce,
4448
char* secret_outbuf,
4549
int* secret_outbuf_len);

‎client/cpp_occlum/occlum_aecs_client_lib/src/public_aecs_client_lib.cpp‎

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,12 +26,13 @@ TeeErrorCode aecs_client_get_public_secret_to_file(
2626
const std::string& aecs_server_policy,
2727
const std::string& secret_service,
2828
const std::string& secret_name,
29+
const std::string& secret_policy,
2930
const std::string& nonce,
3031
const std::string& save_file_name) {
3132
std::string secret_public_str;
3233
TEE_CHECK_RETURN(aecs_client_get_public_secret(
3334
aecs_server_endpoint, aecs_server_policy, secret_service, secret_name,
34-
nonce, &secret_public_str));
35+
secret_policy, nonce, &secret_public_str));
3536
// Save the secret string into local file system
3637
// For occlum, it should be secure filesytem to avoid secret leak
3738
using kubetee::utils::FsWriteString;
@@ -45,8 +46,9 @@ TeeErrorCode aecs_client_get_public_secret(
4546
const std::string& aecs_server_policy,
4647
const std::string& secret_service,
4748
const std::string& secret_name,
49+
const std::string& secret_policy,
4850
const std::string& nonce,
49-
std::string* secret) {
51+
std::string* secret_public) {
5052
// Create the authentication remote attestation report
5153
aecs::untrusted::AecsClient aecs_client(aecs_server_endpoint);
5254
kubetee::GetEnclaveSecretPublicRequest req;
@@ -70,8 +72,18 @@ TeeErrorCode aecs_client_get_public_secret(
7072
TEE_CHECK_RETURN(
7173
kubetee::common::RsaCrypto::Verify(verify_pubkey, sig_str, signature));
7274

73-
*secret = res.secret_public();
75+
// Verify secret policy if necessary
76+
kubetee::EnclaveSecret secret;
77+
JSON2PB(res.secret_public(), &secret);
78+
if (!secret_policy.empty() && secret_policy != "{}") {
79+
const kubetee::UnifiedAttestationPolicy& policy =
80+
secret.spec().policy().policy();
81+
kubetee::UnifiedAttestationPolicy expected_policy;
82+
JSON2PB(secret_policy, &expected_policy);
83+
TEE_CHECK_RETURN(UaVerifyPolicy(policy, expected_policy));
84+
}
7485

86+
secret_public->assign(secret.data());
7587
return TEE_SUCCESS;
7688
}
7789

@@ -84,19 +96,21 @@ int aecs_client_get_public_secret_and_save_file(
8496
const char* aecs_server_policy,
8597
const char* secret_service,
8698
const char* secret_name,
99+
const char* secret_policy,
87100
const char* nonce,
88101
const char* save_file_name) {
89102
TEE_CHECK_RETURN(aecs_client_get_public_secret_to_file(
90103
SAFESTR(aecs_server_endpoint), SAFESTR(aecs_server_policy),
91-
SAFESTR(secret_service), SAFESTR(secret_name), SAFESTR(nonce),
92-
SAFESTR(save_file_name)));
104+
SAFESTR(secret_service), SAFESTR(secret_name), SAFESTR(secret_policy),
105+
SAFESTR(nonce), SAFESTR(save_file_name)));
93106
return 0;
94107
}
95108

96109
int aecs_client_get_public_secret_by_buffer(const char* aecs_server_endpoint,
97110
const char* aecs_server_policy,
98111
const char* secret_service,
99112
const char* secret_name,
113+
const char* secret_policy,
100114
const char* nonce,
101115
const char* secret_outbuf,
102116
int* secret_outbuf_len) {
@@ -105,8 +119,8 @@ int aecs_client_get_public_secret_by_buffer(const char* aecs_server_endpoint,
105119
std::string secret_str;
106120
TEE_CHECK_RETURN(aecs_client_get_public_secret(
107121
SAFESTR(aecs_server_endpoint), SAFESTR(aecs_server_policy),
108-
SAFESTR(secret_service), SAFESTR(secret_name), SAFESTR(nonce),
109-
&secret_str));
122+
SAFESTR(secret_service), SAFESTR(secret_name), SAFESTR(secret_policy),
123+
SAFESTR(nonce), &secret_str));
110124
if (*secret_outbuf_len <= secret_str.size()) {
111125
return TEE_ERROR_SMALL_BUFFER;
112126
}

‎client/cpp_occlum/occlum_aecs_client_lib/src/public_aecs_client_lib.h‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,43 @@ TeeErrorCode VerifyAecsEnclave(
1414
extern "C" {
1515
#endif
1616

17+
/// @brief Get secret public key or cert-chain and save it to file
18+
///
19+
/// @param aecs_server_endpoint
20+
/// @param aecs_server_policy
21+
/// @param secret_service
22+
/// @param secret_name
23+
/// @param secret_policy
24+
/// @param nonce
25+
/// @param save_file_name
26+
/// @return
1727
TeeErrorCode aecs_client_get_public_secret_to_file(
1828
const std::string& aecs_server_endpoint,
1929
const std::string& aecs_server_policy,
2030
const std::string& secret_service,
2131
const std::string& secret_name,
32+
const std::string& secret_policy,
2233
const std::string& nonce,
2334
const std::string& save_file_name);
2435

36+
/// @brief Get secret public key or cert-chain if it exists andis allowed
37+
///
38+
/// @param aecs_server_endpoint
39+
/// @param aecs_server_policy
40+
/// @param secret_service
41+
/// @param secret_name
42+
/// @param secret_policy
43+
/// @param nonce
44+
/// @param secret_public
45+
/// @return
2546
TeeErrorCode aecs_client_get_public_secret(
2647
const std::string& aecs_server_endpoint,
2748
const std::string& aecs_server_policy,
2849
const std::string& secret_service,
2950
const std::string& secret_name,
51+
const std::string& secret_policy,
3052
const std::string& nonce,
31-
std::string* secret);
53+
std::string* secret_public);
3254

3355
#ifdef __cplusplus
3456
}

‎client/cpp_occlum/occlum_aecs_client_lib/src/public_aecs_client_lib_c.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ extern "C" {
1313
* @param[in] aecs_server_policy
1414
* @param[in] secret_service
1515
* @param[in] secret_name
16+
* @param[in] secret_policy
1617
* @param[in] nonce
1718
* @param[in] file name to save secret public key
1819
* @return int Error code
@@ -22,6 +23,7 @@ int aecs_client_get_public_secret_and_save_file(
2223
const char* aecs_server_policy,
2324
const char* secret_service,
2425
const char* secret_name,
26+
const char* secret_policy,
2527
const char* nonce,
2628
const char* save_file_name);
2729

@@ -32,6 +34,7 @@ int aecs_client_get_public_secret_and_save_file(
3234
* @param[in] aecs_server_policy
3335
* @param[in] secret_service
3436
* @param[in] secret_name
37+
* @param[in] secret_policy
3538
* @param[in] nonce
3639
* @param[out] secret_outbuf output buffer which includes the secret public key
3740
* @param[inout] secret_outbuf_len max len as input/real len as output
@@ -41,6 +44,7 @@ int aecs_client_get_public_secret_by_buffer(const char* aecs_server_endpoint,
4144
const char* aecs_server_policy,
4245
const char* secret_service,
4346
const char* secret_name,
47+
const char* secret_policy,
4448
const char* nonce,
4549
const char* secret_outbuf,
4650
int* secret_outbuf_len);

‎client/cpp_occlum/occlum_run_aecs_client.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ if [ "$ACTIONS" == "all" -o "$ACTIONS" == "run" ] ; then
7878
--nonce nonce_2 \
7979
--output saved_secret_aes_256 && \
8080
OCCLUM_LOG_LEVEL=$LOGLEVEL occlum run /bin/aecs_client_get_secret \
81-
--action get \
81+
--action getpub \
8282
--endpoint localhost:19527 \
8383
--service $SERVICE_NAME \
8484
--secret $SECRET_RSA_NAME \
@@ -87,7 +87,7 @@ if [ "$ACTIONS" == "all" -o "$ACTIONS" == "run" ] ; then
8787
OCCLUM_LOG_LEVEL=$LOGLEVEL occlum run /bin/aecs_client_get_secret \
8888
--action create \
8989
--endpoint localhost:19527 \
90-
--policy /etc/kubetee/service_secret_policy.yaml && \
90+
--policy /etc/kubetee/ta_secret_policy.yaml && \
9191
OCCLUM_LOG_LEVEL=$LOGLEVEL occlum run /bin/aecs_client_get_secret \
9292
--action get \
9393
--endpoint localhost:19527 \

0 commit comments

Comments
 (0)