The current Makefiles are unnecessarily too smart in avoiding
duplication (which is small, I think). As a result, it's hard to
understand what files are listed. Use plain, explicit listing instead.
Also, append .o to objs variables. Usually obj means .o file, not the
base name of file. It was confusing.
The use of wildcards in Makefiles for targets is undesirable for tests.
For example, if a file is deleted accidentally, Make doesn't detect it.
What needs to be build should be explicit.
This patch replaces the use of wildcards in tests' Makefiles with
explicitly listed executables.
Plain wildcards `*` in .gitignore are considered a bad practice
because they may cause unintended ignore of files. This commit
replaces `*` with explicit lists of file names.
The goal of `$(SYS)` check in Makefiles is to skip all targets on
unsupported systems. This commit defines a default goal `all` as
a no-op for simplicity.
For device handles, `info.dev.dev_ops` contains function pointers into
LibOS. They may become invalid due to relocation of LibOS text section
in the child process on fork. This commit forces an update of these
function pointers.
Instead of implementing downloading of external resources in every
Makefile again, use one script. This script adds the following
features:
- Always check the download against a known SHA-256 hash.
- Support caching of downloaded resources (set DL_CACHE=/some/dir).
- Allow offline builds if all files are cached. If DL_OFFLINE=true the
build will never attempt to download anything.
Previously, Graphene didn't have emulation of setsockopt(IPV6_V6ONLY).
This flag signals that application doesn't want to create dual-stack
socket (i.e., it wants to bind both IPv4 and IPv6 connections on the
same port).
In reality, different applications require different behavior: e.g.,
Redis sets IPV6_V6ONLY whereas Apache with SSL/TLS unsets it, and
always emulating as set or unset leads to failure of one of these
apps. This commit introduces emulation of IPV6_V6ONLY via a generic
PAL_CREATE_DUALSTACK flag passed to DkStreamOpen(.., create, ..).
Notice that it is impossible to emulate IPV6_V6ONLY as other flags
such as TCP_NODELAY because IPV6_V6ONLY flag makes sense only before
bind, whereas Graphene historically applies other flags only after
bind() syscall. Therefore we introduced PAL_CREATE_DUALSTACK.
Previously, Graphene-SGX did not protect send/recv of checkpoint from
parent to child. This leaked all memory contents of the parent process.
This commit adds TLS-PSK (TLS with Pre-Shared Key) wrapper for process
communication. Graphene-SGX already has the logic for SGX-based local
attestation and generation of the shared key for each parent <-> child
communication channel via Diffie–Hellman key exchange. This commit
uses this pre-shared key to create an mbedTLS-based session based on
UNIX domain socketpair (parent.process.stream <-> child.process.stream).
_DkStreamSecure{Init,Free,Read,Write} internal Linux-SGX PAL functions
are added and used during child process creation and sending of the
parent-generated checkpoint. These functions are backed by crypto-layer
lib_SSL{Init,Free,Read,Write} functions which in turn use mbedTLS.
Configuration of mbedTLS is expanded to support TLS-PSK; note that for
entropy source we use only rdrand instruction inside SGX enclave (i.e.,
no untrusted host-platform sources of entropy). The only ciphersuite
currently supported for IPC is MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256.
This commit adds protection only for checkpoint IPC. After the checkpoint
is sent/received, the parent/child processes downgrade their sockets to
plain non-secure ones (by disabling TLS). This is done because child
may spawn a grandchild that also wants to communicate with grandparent,
but it is impossible for multiple processes to share same TLS context.
Additionally, this commit sanitizes "process" PAL handles during send-
handle checkpoint send (via DkSendHandle): shared key and TLS context
are zeroed out.
Previously in Graphene, some getsockopt() syscalls, e.g. TCP_NODELAY,
failed because an underlying PAL handle was't created for the LibOS
handle until bind() was called. Thus, a sequence of accept() and
getsockopt() failed. This commit fixes this by returning default
socket options (possibly augmented with setsockopt values). Test
case is also provided.
Path to enclave file had been a fixed string that is determined at
build time. Therefore Runtime binares were not allowed to move
their location. This commit adds sgx.enclave_pal_file manifest
option to specify the uri of libpal-Linux-SGX.so.
Previously, Graphene failed if recv() contained MSG_PEEK flag. This
resulted in many TLS-based applications failing, including Nginx,
Apache, and Lighttpd in SSL/TLS mode. This commit adds emulation of
MSG_PEEK at LibOS level. A simple TCP test case is provided.
borysp