The goal of `$(SYS)` check in Makefiles is to skip all targets on
unsupported systems. This commit defines a default goal `all` as
a no-op for simplicity.
For device handles, `info.dev.dev_ops` contains function pointers into
LibOS. They may become invalid due to relocation of LibOS text section
in the child process on fork. This commit forces an update of these
function pointers.
Instead of implementing downloading of external resources in every
Makefile again, use one script. This script adds the following
features:
- Always check the download against a known SHA-256 hash.
- Support caching of downloaded resources (set DL_CACHE=/some/dir).
- Allow offline builds if all files are cached. If DL_OFFLINE=true the
build will never attempt to download anything.
Previously, Graphene didn't have emulation of setsockopt(IPV6_V6ONLY).
This flag signals that application doesn't want to create dual-stack
socket (i.e., it wants to bind both IPv4 and IPv6 connections on the
same port).
In reality, different applications require different behavior: e.g.,
Redis sets IPV6_V6ONLY whereas Apache with SSL/TLS unsets it, and
always emulating as set or unset leads to failure of one of these
apps. This commit introduces emulation of IPV6_V6ONLY via a generic
PAL_CREATE_DUALSTACK flag passed to DkStreamOpen(.., create, ..).
Notice that it is impossible to emulate IPV6_V6ONLY as other flags
such as TCP_NODELAY because IPV6_V6ONLY flag makes sense only before
bind, whereas Graphene historically applies other flags only after
bind() syscall. Therefore we introduced PAL_CREATE_DUALSTACK.
Previously, Graphene-SGX did not protect send/recv of checkpoint from
parent to child. This leaked all memory contents of the parent process.
This commit adds TLS-PSK (TLS with Pre-Shared Key) wrapper for process
communication. Graphene-SGX already has the logic for SGX-based local
attestation and generation of the shared key for each parent <-> child
communication channel via Diffie–Hellman key exchange. This commit
uses this pre-shared key to create an mbedTLS-based session based on
UNIX domain socketpair (parent.process.stream <-> child.process.stream).
_DkStreamSecure{Init,Free,Read,Write} internal Linux-SGX PAL functions
are added and used during child process creation and sending of the
parent-generated checkpoint. These functions are backed by crypto-layer
lib_SSL{Init,Free,Read,Write} functions which in turn use mbedTLS.
Configuration of mbedTLS is expanded to support TLS-PSK; note that for
entropy source we use only rdrand instruction inside SGX enclave (i.e.,
no untrusted host-platform sources of entropy). The only ciphersuite
currently supported for IPC is MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256.
This commit adds protection only for checkpoint IPC. After the checkpoint
is sent/received, the parent/child processes downgrade their sockets to
plain non-secure ones (by disabling TLS). This is done because child
may spawn a grandchild that also wants to communicate with grandparent,
but it is impossible for multiple processes to share same TLS context.
Additionally, this commit sanitizes "process" PAL handles during send-
handle checkpoint send (via DkSendHandle): shared key and TLS context
are zeroed out.
Previously in Graphene, some getsockopt() syscalls, e.g. TCP_NODELAY,
failed because an underlying PAL handle was't created for the LibOS
handle until bind() was called. Thus, a sequence of accept() and
getsockopt() failed. This commit fixes this by returning default
socket options (possibly augmented with setsockopt values). Test
case is also provided.
Path to enclave file had been a fixed string that is determined at
build time. Therefore Runtime binares were not allowed to move
their location. This commit adds sgx.enclave_pal_file manifest
option to specify the uri of libpal-Linux-SGX.so.
Previously, Graphene failed if recv() contained MSG_PEEK flag. This
resulted in many TLS-based applications failing, including Nginx,
Apache, and Lighttpd in SSL/TLS mode. This commit adds emulation of
MSG_PEEK at LibOS level. A simple TCP test case is provided.
Previously, Graphene incorrectly handled poll/ppoll/select/pselect
of regular and dev files like `/dev/urandom`: it tried to perform
an actual host-OS poll on these files. However, poll of such files
must be emulated completely inside LibOS. This commit adds this
special case to poll/ppoll/select/pselect. A test case is supplied.
Previously, Graphene failed with -EPERM on epoll_ctl(EPOLL_CTL_ADD)
of a LibOS shim handle without a backing PAL handle. However, it is
possible for a LibOS socket handle to not have a PAL handle: if
user app first creates the handle via socket(), then adds it to epoll
via epoll_ctl(), and only then performs bind() at which point PAL
handle is finally created. This commit removes this restriction.
Checkpoint's total memory size is stored in shim_cp_store::mem_size
field. Previously, this field was of type `int`. When a process
allocates more than 2GB of memory and then tries to spawn a child,
the checkpoint send/receive fails due to int overflow of mem_size.
This commit simply changes mem_size type to `size_t`. This is enough
to make the bug go away on e.g. a huge Python app with TensorFlow.
Now Graphene supports an improved version of DkObjectsWaitAny() with
correct polling semantics -- DkObjectsWaitEvents(). This makes
DkObjectsWaitAny() obsolete. This commit removes DkObjectsWaitAny()
and replaces it with:
- DkSynchronizationObjectWait() to wait on a single synchronization
object like mutex or event.
- DkStreamsWaitEvents() to wait on stream-like objects (this is the
renamed DkObjectsWaitEvents()).
The corresponding tests are fixed to use the new PAL interfaces.
Also, IPC helper and Async helper threads are significantly refactored
to make better use of DkStreamsWaitEvents().
This commit adds more cases to the chroot FS to update file metadata:
- update inode number immediately after creating a new file;
- update file size after writing a non-mmapped file.
This commit also adds corresponding LibOS tests.
Syscall recvmsg() accepts an array of buffers (iovecs). This buffers are
filled in array order. POSIX does not allow to fill e.g. iov[0] only
partially before proceeding to iov[1]. This commit makes recvmsg()
emulation compliant with this requirement.
Also, this commit fixes a small performance issue when recvmsg() would
overwrite the same received-address info over and over.
Isaku Yamahata