Attestation API and integration with the PDO build

.gitmodules

@@ -1,3 +1,9 @@
 [submodule "interpreters/wasm-micro-runtime"]
 	path = interpreters/wasm-micro-runtime
 	url = https://github.com/bytecodealliance/wasm-micro-runtime.git
+[submodule "common/crypto/attestation-api/common/jwt-cpp"]
+	path = common/crypto/attestation-api/common/jwt-cpp
+	url = https://github.com/Thalhammer/jwt-cpp
+[submodule "common/crypto/attestation-api/common/nlohmann/json"]
+	path = common/crypto/attestation-api/common/nlohmann/json
+	url = https://github.com/nlohmann/json.git

build/__tools__/build.sh

@@ -89,9 +89,17 @@ if [ ! -d build ]; then
 fi
 
 cd build
-#try cmake ${CMAKE_ARGS} ..
-#try make ${MAKE_ARGS}
-try cmake --build . -- ${MAKE_ARGS}
+
+#In the following we use a single threaded build due to race conditions the arise with a multi-threaded one.
+#In the following we append the error log for multi-threaded (j4) build for troubleshooting in the future.
+#11 33.53  build.sh: ERROR: operation failed: cmake --build . -- -j4 BUILD_CLIENT=0
+#11 33.53 make[1]: *** [Makefile:98: build] Error 111
+#11 33.53 make[1]: Leaving directory '/project/pdo/src/build'
+#11 33.53 make: *** [Makefile:101: verified-build] Error 2
+#11 33.53 make: Leaving directory '/project/pdo/src/build'
+#11 33.53  build_services.sh: ERROR: operation failed: make -C /project/pdo/src/build verified-build
+#11 ERROR: process "/bin/sh -c /project/pdo/tools/build_services.sh" did not complete successfully: exit code: 111
+try cmake --build . -- ${MAKE_ARGS} -j1
 
 yell --------------- BIN ---------------
 cd $SRCDIR/bin

build/common-config.sh

@@ -34,6 +34,12 @@ var_set() {
 	"
 	env_key_sort[$i]="WASM_SRC"; i=$i+1; export WASM_SRC=${env_val[WASM_SRC]};
 
+	env_val[DCAP_PRIMITIVES]="${DCAP_PRIMITIVES:-/tmp/SGXDataCenterAttestationPrimitives}"
+	env_desc[DCAP_PRIMITIVES]="
+	    DCAP_PRIMITIVES points to the source repo of DCAP
+	"
+	env_key_sort[$i]="DCAP_PRIMITIVES"; i=$i+1; export DCAP_PRIMITIVES=${env_val[DCAP_PRIMITIVES]};
+
 	env_val[PDO_MEMORY_CONFIG]="${PDO_MEMORY_CONFIG:-MEDIUM}"
 	env_desc[PDO_MEMORY_CONFIG]="
 		PDO_MEMORY_CONFIG indicates the memory configuration for the

common/crypto/CMakeLists.txt

@@ -39,6 +39,9 @@ ENDIF()
 # by the client (ias verification requires sgx).
 ################################################################################
 IF (BUILD_TRUSTED OR BUILD_UNTRUSTED)
+  # Build attestation library
+  ADD_SUBDIRECTORY (attestation-api)
+
   SET(PROJECT_GENERATED_IAS_SOURCES ${CMAKE_CURRENT_SOURCE_DIR}/verify_ias_report/ias-certificates.txt)
   SET_SOURCE_FILES_PROPERTIES(${PROJECT_GENERATED_IAS_SOURCES} PROPERTIES GENERATED TRUE)
   SET(FETCH_IAS_CERTS ${CMAKE_CURRENT_SOURCE_DIR}/verify_ias_report/fetch_ias_certificates.sh)

common/crypto/attestation-api/.gitignore

@@ -0,0 +1,2 @@
+build
+

common/crypto/attestation-api/CMakeLists.txt

@@ -0,0 +1,219 @@
+# Copyright 2023 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+cmake_minimum_required(VERSION 3.13)
+
+PROJECT(ATTESTATION-API)
+
+set(CMAKE_CXX_STANDARD 14)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+
+INCLUDE(CMakeVariables.txt)
+
+IF (NOT DEFINED ENV{DCAP_PRIMITIVES})
+  MESSAGE(FATAL_ERROR "DCAP_PRIMITIVES variable with source repo path not defined")
+ENDIF()
+
+###################################################################################################
+# First run cmake in common
+###################################################################################################
+# This patches the jwt repo for sgx use
+ADD_SUBDIRECTORY(common)
+
+###################################################################################################
+# Set up trusted certificates in headers
+###################################################################################################
+
+# This creates the necessary headers which include the trusted certificates
+# and returns sets CERTIFICATE_INCLUDE_PATH to find them
+ADD_SUBDIRECTORY(common/crypto/verify_ias_report)
+LIST(APPEND CERTIFICATE_INCLUDE_PATHS "${CERTIFICATE_INCLUDE_PATH}")
+
+ADD_SUBDIRECTORY(common/crypto/verify_ita_token)
+LIST(APPEND CERTIFICATE_INCLUDE_PATHS "${CERTIFICATE_INCLUDE_PATH}")
+
+ADD_SUBDIRECTORY(common/crypto/verify_dcap_direct)
+LIST(APPEND CERTIFICATE_INCLUDE_PATHS "${CERTIFICATE_INCLUDE_PATH}")
+
+###################################################################################################
+# Logging
+###################################################################################################
+
+# Prepare the logging libs.
+# Note: by default, no trusted logging and untrusted logging is printf.
+# This returns the variables: LOGGING_UNTRUSTED_INCLUDE_PATH, LOGGING_TRUSTED_INCLUDE_PATH
+ADD_SUBDIRECTORY(common/logging)
+
+###################################################################################################
+# Project files and headers
+###################################################################################################
+
+FILE(GLOB PROJECT_HEADERS
+    "include/*.h"
+    "${CERTIFICATE_INCLUDE_PATH}/*.h"
+    )
+
+FILE(GLOB PROJECT_SOURCES
+    "evidence/*.cpp"
+    "common/base64/base64.cpp"
+    "common/types/*.cpp"
+    "common/crypto/*.cpp"
+    "common/crypto/verify_ias_report/*.cpp"
+    "common/crypto/verify_ita_token/*.cpp"
+    "common/crypto/verify_dcap_direct/*.cpp"
+    )
+
+FILE(GLOB PROJECT_OCALLS
+    "ocalls/*.c"
+    )
+
+FILE(GLOB PROJECT_TRUSTED_SOURCES
+    "attestation/*.cpp"
+    $ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src/*.cpp
+    $ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src/OpensslHelpers/*.cpp
+    $ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src/PckParser/*.cpp
+    $ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src/CertVerification/*.cpp
+    $ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src/QuoteVerification/*.cpp
+    $ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src/Verifiers/*.cpp
+    $ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src/Verifiers/Checks/*.cpp
+    $ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src/Utils/*.cpp
+    $ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/include/SgxEcdsaAttestation/*.h
+    )
+
+SET(DCAP_QG_PATH "$ENV{DCAP_PRIMITIVES}/QuoteGeneration")
+SET(DCAP_QV_PATH "$ENV{DCAP_PRIMITIVES}/QuoteVerification")
+
+###################################################################################################
+# Tools
+###################################################################################################
+SET(B64ATTESTATION_TO_B64COLLATERAL "b64attestation_to_b64collateral")
+ADD_EXECUTABLE(${B64ATTESTATION_TO_B64COLLATERAL}
+	conversion/dcap-direct/b64attestation2b64collateral.cpp
+	common/base64/base64.cpp)
+ADD_CUSTOM_COMMAND(TARGET ${B64ATTESTATION_TO_B64COLLATERAL}
+	POST_BUILD
+	COMMAND mkdir -p ${CMAKE_CURRENT_BINARY_DIR}/conversion/dcap-direct/ &&
+        mv $<TARGET_FILE:${B64ATTESTATION_TO_B64COLLATERAL}> ${CMAKE_CURRENT_BINARY_DIR}/conversion/dcap-direct/)
+
+TARGET_INCLUDE_DIRECTORIES(${B64ATTESTATION_TO_B64COLLATERAL} PRIVATE common)
+
+# newer DCAP (1.22) libs need the qal (older, 1.19, don't)
+SET(DCAP_LINK_LIBS ${DCAP_QV_PATH}/appraisal/qal/libdcap_qal.a)
+
+TARGET_LINK_LIBRARIES(${B64ATTESTATION_TO_B64COLLATERAL}
+    #${DCAP_QV_PATH}/dcap_quoteverify/linux/libsgx_dcap_quoteverify.a
+    #${DCAP_QG_PATH}/build/linux/libdcap_quoteprov.a
+    #${DCAP_QG_PATH}/build/linux/libsgx_default_qcnl_wrapper.a
+    #sgx_dcap_quoteverify dcap_quoteprov sgx_default_qcnl_wrapper
+    sgx_dcap_quoteverify
+    # sgx_dcap_ql dcap_quoteprov necessary for the callbacks
+    sgx_dcap_ql
+    dcap_quoteprov
+    )
+
+###################################################################################################
+# Untrusted one-attestation library
+###################################################################################################
+
+SET(U_OA_LIB_STATIC ${U_ONE_ATTESTATION_LIB_NAME}_Static)
+
+ADD_LIBRARY(${U_OA_LIB_STATIC} STATIC ${PROJECT_HEADERS} ${PROJECT_SOURCES} ${PROJECT_OCALLS})
+
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE "$ENV{SGX_SDK}/include")
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE "include")
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} BEFORE PRIVATE "common")
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE "common/nlohmann/json/include")
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE "common/jwt-cpp/include")
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE ${CERTIFICATE_INCLUDE_PATHS})
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE ${LOGGING_UNTRUSTED_INCLUDE_PATH})
+
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE "$ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/Build/Release/dist/include/")
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE "$ENV{DCAP_PRIMITIVES}")
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE "$ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src")
+TARGET_INCLUDE_DIRECTORIES(${U_OA_LIB_STATIC} PRIVATE "$ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationCommons/include")
+
+TARGET_COMPILE_OPTIONS(${U_OA_LIB_STATIC} PRIVATE -fvisibility=hidden)
+TARGET_COMPILE_OPTIONS(${U_OA_LIB_STATIC} PRIVATE -fpie)
+TARGET_COMPILE_OPTIONS(${U_OA_LIB_STATIC} PRIVATE -fstack-protector)
+
+SET(QVL_LIB_PATH "$ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/Build/Release/dist/lib")
+
+add_custom_target(combined_u_static_target ALL
+    COMMAND mkdir -p oals_objs lqvs_objs lacs_objs laps_objs
+    COMMAND ar -x --output oals_objs $<TARGET_FILE:${U_OA_LIB_STATIC}>
+    COMMAND ar -x --output lqvs_objs ${QVL_LIB_PATH}/libQuoteVerificationStatic.a
+    COMMAND ar -x --output lacs_objs ${QVL_LIB_PATH}/libAttestationCommonsStatic.a
+    COMMAND ar -x --output laps_objs ${QVL_LIB_PATH}/libAttestationParsersStatic.a
+    COMMAND ar -qcs lib${U_ONE_ATTESTATION_LIB_NAME}.a oals_objs/*.o lqvs_objs/*.o lacs_objs/*.o laps_objs/*.o
+    WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
+    DEPENDS ${U_OA_LIB_STATIC}
+    )
+ADD_LIBRARY(${U_ONE_ATTESTATION_LIB_NAME} STATIC IMPORTED)
+ADD_DEPENDENCIES(${U_ONE_ATTESTATION_LIB_NAME} combined_u_static_target)
+SET_TARGET_PROPERTIES(${U_ONE_ATTESTATION_LIB_NAME}
+    PROPERTIES
+    IMPORTED_LOCATION lib${U_ONE_ATTESTATION_LIB_NAME}.a
+    )
+
+###################################################################################################
+# Trusted one-attestation library
+###################################################################################################
+
+SET(T_OA_LIB_STATIC ${T_ONE_ATTESTATION_LIB_NAME}_Static)
+ADD_LIBRARY(${T_OA_LIB_STATIC} STATIC
+    ${PROJECT_HEADERS} ${PROJECT_TRUSTED_HEADERS} ${PROJECT_SOURCES} ${PROJECT_TRUSTED_SOURCES})
+
+#dependency in common to ensure the jwt lib is patched for building the trusted lib in SGX
+ADD_DEPENDENCIES(${T_OA_LIB_STATIC} patch_jwt)
+
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "common/sgx-support") # for clocale, before sgxsdk includes
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "$ENV{SGX_SDK}/include")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "$ENV{SGX_SDK}/include/libcxx")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "$ENV{SGX_SDK}/include/tlibc")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "$ENV{SGX_SSL}/include")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "include")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} BEFORE PRIVATE "common")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "common/nlohmann/json/include")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "common/jwt-cpp/include")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE ${CERTIFICATE_INCLUDE_PATHS})
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE ${LOGGING_TRUSTED_INCLUDE_PATH})
+
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "$ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/Build/Release/dist/include/")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "$ENV{DCAP_PRIMITIVES}")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "$ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationLibrary/src")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE "$ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/AttestationCommons/include")
+TARGET_INCLUDE_DIRECTORIES(${T_OA_LIB_STATIC} PRIVATE  "$ENV{DCAP_PRIMITIVES}/QuoteVerification/QVL/Src/ThirdParty/rapidjson/include")
+
+TARGET_COMPILE_OPTIONS(${T_OA_LIB_STATIC} PRIVATE -nostdinc++)
+TARGET_COMPILE_OPTIONS(${T_OA_LIB_STATIC} PRIVATE -fvisibility=hidden)
+TARGET_COMPILE_OPTIONS(${T_OA_LIB_STATIC} PRIVATE -fpie)
+TARGET_COMPILE_OPTIONS(${T_OA_LIB_STATIC} PRIVATE -fstack-protector)
+
+#remove time-related code from jwt tool (as dcap primitives do)
+TARGET_COMPILE_OPTIONS(${T_OA_LIB_STATIC} PRIVATE -DSGX_JWT)
+
+add_custom_target(combined_t_static_target ALL
+    COMMAND mkdir -p toals_objs lacse_objs lapse_objs
+    COMMAND ar -x --output toals_objs $<TARGET_FILE:${T_OA_LIB_STATIC}>
+    COMMAND ar -x --output lacse_objs ${QVL_LIB_PATH}/libAttestationCommonsStaticEnclave.a
+    COMMAND ar -x --output lapse_objs ${QVL_LIB_PATH}/libAttestationParsersStaticEnclave.a
+    COMMAND ar -qcs lib${T_ONE_ATTESTATION_LIB_NAME}.a toals_objs/*.o lacse_objs/*.o lapse_objs/*.o
+    WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
+    DEPENDS ${U_OA_LIB_STATIC}
+    )
+ADD_LIBRARY(${T_ONE_ATTESTATION_LIB_NAME} STATIC IMPORTED)
+ADD_DEPENDENCIES(${T_ONE_ATTESTATION_LIB_NAME} combined_t_static_target)
+SET_TARGET_PROPERTIES(${T_ONE_ATTESTATION_LIB_NAME}
+    PROPERTIES
+    IMPORTED_LOCATION lib${T_ONE_ATTESTATION_LIB_NAME}.a
+    )
+
+
+###################################################################################################
+# Local Tests
+###################################################################################################
+ENABLE_TESTING()
+ADD_SUBDIRECTORY (test)
+

common/crypto/attestation-api/CMakeVariables.txt

@@ -0,0 +1,7 @@
+# Copyright 2023 Intel Corporation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+SET(U_ONE_ATTESTATION_LIB_NAME u-one-attestation)
+SET(T_ONE_ATTESTATION_LIB_NAME t-one-attestation)
+