Merge pull request #314 from skalenetwork/feature/SKALE-4110-use-latest-sgx

Feature/skale 4110 use latest sgx

.github/workflows/dockerimage.yml

-name: Build, test and push SGX container
+name: Build and push SGX container
 on:
   workflow_dispatch:
   push:
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v1
       - name: submodule update
         run: git submodule update --init --recursive
-      - name: build
+      - name: build and deploy test image
         run: python3 scripts/docker_build.py Dockerfile sgxwallet ${GITHUB_SHA}
       - name: deploy docker image
         if: |

.github/workflows/dockerimagerelease.yml

-name: Build, test and push release SGX container
+name: Build and push release SGX container
 on:
   workflow_dispatch:
   push:

.github/workflows/dockerimagesim.yml

@@ -18,11 +18,15 @@ jobs:
     - uses: actions/checkout@v1
     - name: submodule update
       run: git submodule update --init --recursive
-    - name: build container for testing
+    - name: Build and publish container for testing
       run: python3 scripts/docker_build.py DockerfileSimulation sgxwallet_sim ${GITHUB_SHA}
     - name: test
       run: python3 scripts/docker_test.py DockerfileSimulation sgxwallet_sim
     - name: build and deploy docker image
+      if: |
+            contains(github.ref, 'develop') || contains(github.ref, 'beta') ||
+            contains(github.ref, 'master') ||
+            contains(github.ref, 'SECURE_ENCLAVE_CHANGES')
       run : |
             sudo rm -rf /home/runner/work/sgxwallet/sgxwallet/sgx_data
             export BRANCH=${GITHUB_REF##*/}

DockerfileBase

-FROM ubuntu:bionic
+FROM ubuntu:18.04
 
+RUN apt-get update && apt-get install  -y \
+    autoconf \
+    automake \
+    build-essential \
+    cmake \
+    curl \
+    debhelper \
+    git \
+    libcurl4-openssl-dev \
+    libprotobuf-dev \
+    libssl-dev \
+    libtool \
+    lsb-release \
+    ocaml \
+    ocamlbuild \
+    protobuf-compiler \
+    python \
+    wget \
+    libcurl4 \
+    libprotobuf10 \
+    libssl1.1 \
+    make \
+    module-init-tools \
+    unzip
+
+RUN git clone -b sgx_2.13 --depth 1 https://github.com/intel/linux-sgx
+
+RUN cd linux-sgx && make preparation
+
+WORKDIR /linux-sgx
+COPY . .
+
+RUN make sdk_install_pkg_no_mitigation
+
+WORKDIR /opt/intel
+RUN sh -c 'echo yes | /linux-sgx/linux/installer/bin/sgx_linux_x64_sdk_*.bin'
+
+WORKDIR /linux-sgx
+RUN make psw_install_pkg
+
+WORKDIR /opt/intel
+RUN cp /linux-sgx/linux/installer/bin/sgx_linux_x64_psw*.bin .
+RUN ./sgx_linux_x64_psw*.bin --no-start-aesm
 
 COPY . /usr/src/sdk
 RUN ls /usr/src/sdk/autoconf.bash
 WORKDIR /usr/src/sdk
 
-COPY docker/install-psw.patch ./
-
 RUN    apt update && \
        apt install -yq apt-utils && \
        apt install -yq --no-install-recommends python-yaml vim \
-           telnet git ca-certificates build-essential ocaml ocamlbuild \
-           automake autoconf libtool wget python libssl-dev libssl-dev \
-           libcurl4-openssl-dev protobuf-compiler git libprotobuf-dev  libboost-all-dev \
-           alien cmake debhelper uuid-dev libxml2-dev ccache vim libprotobuf10 \
-           yasm cmake flex bison  libprocps-dev ccache autoconf texinfo libssl-dev \
-           libboost-all-dev libjsonrpccpp-dev curl libjsonrpccpp-tools && \
+           telnet git ca-certificates perl \
+           reprepro libboost-all-dev alien uuid-dev libxml2-dev ccache \
+           yasm flex bison libprocps-dev ccache texinfo \
+           libjsonrpccpp-dev curl libjsonrpccpp-tools && \
        ln -s /usr/bin/ccache /usr/local/bin/clang && \
        ln -s /usr/bin/ccache /usr/local/bin/clang++ && \
        ln -s /usr/bin/ccache /usr/local/bin/gcc && \
        ln -s /usr/bin/ccache /usr/local/bin/g++ && \
        ln -s /usr/bin/ccache /usr/local/bin/cc && \
-       ln -s /usr/bin/ccache /usr/local/bin/c++ && \
-       git clone -b sgx_2.5 --depth 1 https://github.com/intel/linux-sgx && \
-       cd linux-sgx && \
-       patch -p1 -i ../install-psw.patch && \
-       ./download_prebuilt.sh 2> /dev/null && \
-       make -s -j$(nproc) sdk_install_pkg psw_install_pkg && \
-       ./linux/installer/bin/sgx_linux_x64_sdk_2.5.100.49891.bin --prefix=/opt/intel && \
-       ./linux/installer/bin/sgx_linux_x64_psw_2.5.100.49891.bin && \
-       cd .. && rm -rf linux-sgx/ && cd scripts && ./build_deps.py && \
+       ln -s /usr/bin/ccache /usr/local/bin/c++
+
+RUN    cd scripts && ./build_deps.py && \
        wget --progress=dot:mega -O - https://github.com/intel/dynamic-application-loader-host-interface/archive/072d233296c15d0dcd1fb4570694d0244729f87b.tar.gz | tar -xz && \
        cd dynamic-application-loader-host-interface-072d233296c15d0dcd1fb4570694d0244729f87b && \
        cmake . -DCMAKE_BUILD_TYPE=Release -DINIT_SYSTEM=SysVinit && \
@@ -37,5 +70,5 @@ RUN    apt update && \
        cd .. && rm -rf dynamic-application-loader-host-interface-072d233296c15d0dcd1fb4570694d0244729f87b && \
        cd /usr/src/sdk && \
        ./autoconf.bash && \
-       ./configure  && \
+       ./configure && \
        bash -c "make -j$(nproc)"

VERSION

-1.73.0
+1.75.0
\ No newline at end of file

docker/install-psw.patch

 diff --git a/linux/installer/bin/install-sgx-psw.bin.tmpl b/linux/installer/bin/install-sgx-psw.bin.tmpl
-index 3510e97c..751831ab 100755
+index 7d19987..7386ce7 100755
 --- a/linux/installer/bin/install-sgx-psw.bin.tmpl
 +++ b/linux/installer/bin/install-sgx-psw.bin.tmpl
-@@ -30,34 +30,10 @@
+@@ -30,33 +30,10 @@
  #
  #
  
@@ -12,7 +12,7 @@ index 3510e97c..751831ab 100755
 -    if [[ $? != "0" ]]; then
 -        /sbin/modinfo intel_sgx &> /dev/null
 -        if [[ $? != "0" ]]; then
--            lsmod | grep 'isgx\|intel_sgx' &> /dev/null
+-            /sbin/lsmod 2> /dev/null | grep 'isgx\|intel_sgx'
 -            if [[ $? = "0" ]]; then
 -                echo "Warning: You did not follow the document to install the driver package."
 -                echo
@@ -33,45 +33,46 @@ index 3510e97c..751831ab 100755
 -    exit 4
 -fi
 -
--
+ 
  PKG_ARCH=@arch@
  ARCH=$(uname -m)
- 
-diff --git a/linux/installer/common/libsgx-enclave-common/install.sh b/linux/installer/common/libsgx-enclave-common/install.sh
-index 296879af..851d520b 100755
---- a/linux/installer/common/libsgx-enclave-common/install.sh
-+++ b/linux/installer/common/libsgx-enclave-common/install.sh
-@@ -33,11 +33,6 @@
- 
- set -e 
- 
--if test $(id -u) -ne 0; then
--    echo "Root privilege is required."
--    exit 1
--fi
--
- SCRIPT_DIR=$(dirname "$0")
- source ${SCRIPT_DIR}/installConfig
- 
-@@ -95,7 +90,7 @@ elif [ -d /etc/init/ ]; then
- else
-     echo " failed."
-     echo "Unsupported platform - neither systemctl nor initctl is found."
--    exit 5
-+    retval=0
- fi
- 
- if test $retval -ne 0; then
 diff --git a/linux/installer/common/psw/install.sh b/linux/installer/common/psw/install.sh
-index 59f3ed61..8ba940a3 100755
+index 042f83c..3043ad1 100755
 --- a/linux/installer/common/psw/install.sh
 +++ b/linux/installer/common/psw/install.sh
-@@ -96,7 +96,7 @@ elif [ -d /etc/init/ ]; then
- else
-     echo " failed."
-     echo "Unsupported platform - neither systemctl nor initctl is found."
--    exit 5
-+    retval=0
+@@ -106,7 +106,7 @@ else
+         echo "Warning: No systemctl/initctl to start AESM. You may start AESM manually, e.g., /opt/intel/sgxpsw/aesm/aesm_service --no-daemon"
+     else
+         echo "Error: Unsupported platform - neither systemctl nor initctl is found."
+-        exit 5
++        retval=0
+     fi
  fi
  
- if test $retval -ne 0; then
+diff --git a/linux/installer/common/sgx-aesm-service/Makefile b/linux/installer/common/sgx-aesm-service/Makefile
+index 89c5b21..2b4eb8f 100644
+--- a/linux/installer/common/sgx-aesm-service/Makefile
++++ b/linux/installer/common/sgx-aesm-service/Makefile
+@@ -48,7 +48,8 @@ AESMD_CONF_DEL=aesmd.conf
+ AESMD_CONF_PATH=/lib/systemd/system
+ $(warning "You may need to start aesmd manually after it's installed!")
+ else
+-$(error "Unsupported platform - neither systemctl nor initctl is found!")
++# $(error "Unsupported platform - neither systemctl nor initctl is found!")
++exit 0
+ endif
+ endif
+ 
+ diff --git a/external/dcap_source/tools/SGXPlatformRegistration/package/installer/common/sgx-ra-service/Makefile b/external/dcap_source/tools/SGXPlatformRegistration/package/installer/common/sgx-ra-service/Makefile
+index 1f3efdb..07ede24 100644
+--- a/tools/SGXPlatformRegistration/package/installer/common/sgx-ra-service/Makefile
++++ b/tools/SGXPlatformRegistration/package/installer/common/sgx-ra-service/Makefile
+@@ -47,7 +47,8 @@ RAD_CONF_NAME=mpa_registration_tool.service
+ RAD_CONF_DEL=mpa_registration.conf
+ RAD_CONF_PATH=/lib/systemd/system
+ else
+-$(error "Unsupported platform - neither systemctl nor initctl is found!")
++# $(error "Unsupported platform - neither systemctl nor initctl is found!")
++exit 0
+ endif
+ endif

docker/start.sh

@@ -35,7 +35,7 @@ pid=$!
 sleep 2
 echo "Checking that sgxwallet can connect to SGX whitelist update server whitelist.trustedservices.intel.com "
 echo "If this test fails, you need to update your network config or firewall to allow this connection"
-curl  -I http://whitelist.trustedservices.intel.com/SGX/LCWL/Linux/sgx_white_list_cert.bin
+curl -I http://whitelist.trustedservices.intel.com/SGX/LCWL/Linux/sgx_white_list_cert.bin
 else
 echo "Running in SGX simulation mode"
 fi
@@ -46,7 +46,7 @@ echo "Test run requested"
 sleep 5
 ./testw.py
 else
-  sleep 3
-   ./sgxwallet $1 $2 $3 $4 $5
+sleep 3
+./sgxwallet $1 $2 $3 $4 $5
 fi
 

docs/enabling-sgx.md

@@ -45,11 +45,11 @@ apt-get install  build-essential
 Run the following command:
 
 ```bash
-cd scripts; sudo ./sgx_linux_x64_driver_2.5.0_2605efa.bin; cd ..
+cd scripts; sudo ./sgx_linux_x64_driver_2.11.0_0373e2e.bin; cd ..
 ```
 
 Alternatively, other driver versions may be downloaded from Intel.
-Please note that version `2.5.0_2605efa` is what is currently supported.
+Please note that version `2.11.0_0373e2e` is what is currently supported.
 
 Reboot you machine after driver install.  Do `ls /dev/isgx` to check that `isgx` device is properly installed.
 If you do not see the `isgx` device, you need to troubleshoot your driver installation.

intel-sgx-ssl @ a70a1b07

-Subproject commit 8dc9f547c612010ea0b6257d86bcbd4ff7149565
+Subproject commit a70a1b07fd1bbfd3797197654297f8aa010e269a

linux-sgx-driver @ 75bf89f7

-Subproject commit 95eaa6f6693cd86c35e10a22b4f8e483373c987c
+Subproject commit 75bf89f7d6dd4598b9f8148bd6374a407f37105c

scripts/build_deps.py

@@ -77,7 +77,7 @@ print("Build LibBLS");
 os.chdir(BLS_DIR + "/deps")
 assert subprocess.call(["bash", "-c", "./build.sh"]) == 0
 os.chdir(BLS_DIR)
-assert subprocess.call(["bash", "-c", "cmake -H. -Bbuild"]) == 0
+assert subprocess.call(["bash", "-c", "cmake -H. -Bbuild -DBUILD_TESTS=OFF"]) == 0
 os.chdir(BLS_DIR + "/build")
 assert subprocess.call(["bash", "-c", "make"]) == 0
 
@@ -105,12 +105,12 @@ assert subprocess.call(["bash", "-c", "./build.sh"]) == 0
 print("Install Linux SDK");
 
 os.chdir(SCRIPTS_DIR)
-assert subprocess.call(["bash", "-c", "./sgx_linux_x64_sdk_2.5.100.49891.bin --prefix=" + topDir + "/sgx-sdk-build"]) == 0
+assert subprocess.call(["bash", "-c", "./sgx_linux_x64_sdk_2.13.100.4.bin --prefix=" + topDir + "/sgx-sdk-build"]) == 0
 
 print("Make GMP");
 
 os.chdir(GMP_DIR)
-assert subprocess.call(["bash", "-c", "./configure --prefix=" + TGMP_BUILD_DIR + " --disable-shared --enable-static --with-pic --enable-sgx  --with-sgxsdk=" + SDK_DIR + "/sgxsdk"]) == 0
+assert subprocess.call(["bash", "-c", "./configure --prefix=" + TGMP_BUILD_DIR + " --disable-shared --enable-static --with-pic --enable-sgx --with-sgxsdk=" + SDK_DIR + "/sgxsdk"]) == 0
 
 assert subprocess.call(["make", "install"]) == 0
 assert subprocess.call(["make", "clean"]) == 0

scripts/docker_build.py

@@ -29,13 +29,14 @@ topDir = os.getcwd() + "/sgxwallet"
 DOCKER_FILE_NAME = sys.argv[1]
 IMAGE_NAME = sys.argv[2]
 COMMIT_HASH = sys.argv[3]
-TAG_POSTFIX = "latest_commit"
 
-FULL_IMAGE_TAG = "skalenetwork/" + IMAGE_NAME + ":" + TAG_POSTFIX
+FULL_IMAGE_TAG = "skalenetwork/" + IMAGE_NAME + ":" + COMMIT_HASH
 
 print("Starting build", flush=True)
 
 assert subprocess.call(["pwd"]) == 0
 
 assert subprocess.call(["docker", "build", topDir, "--file", topDir + "/" + DOCKER_FILE_NAME, "--tag",
-                        FULL_IMAGE_TAG]) == 0
\ No newline at end of file
+                        FULL_IMAGE_TAG]) == 0
+
+assert subprocess.call(["docker", "push", FULL_IMAGE_TAG]) == 0
\ No newline at end of file

third_party/intel/config.h

+/* config.h.  Generated from config.h.in by configure.  */
+/* config.h.in.  Generated from configure.ac by autoheader.  */
+
+/* Enable libcurl as a user agent */
+#define AGENT_LIBCURL 1
+
+/* Enable debugging */
+#define DEBUG 1
+
+/* Default CA bundle for OpenSSL-based applications */
+#define DEFAULT_CA_BUNDLE_AUTO "/etc/ssl/certs/ca-certificates.crt"
+
+/* Flag set for prerelease builds */
+/* #undef EDEBUG */
+
+/* Define to 1 if you have the <inttypes.h> header file. */
+#define HAVE_INTTYPES_H 1
+
+/* Define to 1 if you have the <memory.h> header file. */
+#define HAVE_MEMORY_H 1
+
+/* Define to 1 if you have the <openssl/evp.h> header file. */
+#define HAVE_OPENSSL_EVP_H 1
+
+/* Define to 1 if you have the <openssl/pem.h> header file. */
+#define HAVE_OPENSSL_PEM_H 1
+
+/* Define to 1 if you have the <openssl/x509.h> header file. */
+#define HAVE_OPENSSL_X509_H 1
+
+/* Define to 1 if you have the <stdint.h> header file. */
+#define HAVE_STDINT_H 1
+
+/* Define to 1 if you have the <stdlib.h> header file. */
+#define HAVE_STDLIB_H 1
+
+/* Define to 1 if you have the <strings.h> header file. */
+#define HAVE_STRINGS_H 1
+
+/* Define to 1 if you have the <string.h> header file. */
+#define HAVE_STRING_H 1
+
+/* Define to 1 if you have the <sys/stat.h> header file. */
+#define HAVE_SYS_STAT_H 1
+
+/* Define to 1 if you have the <sys/types.h> header file. */
+#define HAVE_SYS_TYPES_H 1
+
+/* Define to 1 if you have the <unistd.h> header file. */
+#define HAVE_UNISTD_H 1
+
+/* Flag set for prerelease and release builds */
+/* #undef NDEBUG */
+
+/* Name of package */
+#define PACKAGE "sgxautosample"
+
+/* Define to the address where bug reports for this package should be sent. */
+#define PACKAGE_BUGREPORT "john.p.mechalas@intel.com"
+
+/* Define to the full name of this package. */
+#define PACKAGE_NAME "sgxautosample"
+
+/* Define to the full name and version of this package. */
+#define PACKAGE_STRING "sgxautosample 1.0"
+
+/* Define to the one symbol short name of this package. */
+#define PACKAGE_TARNAME "sgxautosample"
+
+/* Define to the home page for this package. */
+#define PACKAGE_URL ""
+
+/* Define to the version of this package. */
+#define PACKAGE_VERSION "1.0"
+
+/* Enable hardware simulation mode */
+/* #undef SGX_HW_SIM */
+
+/* Define to 1 if you have the ANSI C header files. */
+#define STDC_HEADERS 1
+
+/* Define if sgx_uae_service.h uses the bool type */
+/* #undef UAE_SERVICE_HAS_BOOL */
+
+/* Version number of package */
+#define VERSION "1.0"

third_party/intel/create_enclave.c

@@ -35,6 +35,7 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #include "third_party/intel/sgx_stub.h"
 #include <limits.h>
 #include <stdio.h>
+#include <sgx_uae_quote_ex.h>
 #include <sgx_urts.h>
 #include <sys/stat.h>
 #include <stdlib.h>
@@ -108,7 +109,7 @@ int file_in_searchpath (const char *file, char *search, char *fullpath,
 	if ( search == NULL ) return 0;
 	if ( strlen(search) == 0 ) return 0;
 
-	str= strdup(search);
+	str = strdup(search);
 	if ( str == NULL ) return 0;
 
 	p= strtok(str, ":");

third_party/intel/sgx_stub.h

 /*
-
-Copyright 2018 Intel Corporation
-
+Copyright 2017 Intel Corporation
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:
-
 1. Redistributions of source code must retain the above copyright
 notice, this list of conditions and the following disclaimer.
-
 2. Redistributions in binary form must reproduce the above copyright
 notice, this list of conditions and the following disclaimer in the
 documentation and/or other materials provided with the distribution.
-
 3. Neither the name of the copyright holder nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
-
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
 IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
@@ -28,7 +22,6 @@ PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
 */
 #ifndef __SGX_STUB_H
 #define __SGX_STUB_H
@@ -39,6 +32,8 @@ extern "C" {
 
 	int have_sgx_psw();
 
+	void *get_sgx_ufunction(const char *name); /* Returns func pointer */
+
 #ifdef __cplusplus
 };
 #endif