mbedtls-client.patch

diff --git a/programs/ssl/ssl_client1.c b/programs/ssl/ssl_client1.c
index fa70431..a580d22 100644
--- a/programs/ssl/ssl_client1.c
+++ b/programs/ssl/ssl_client1.c
@@ -62,11 +62,16 @@ int main( void )
 
 #include <string.h>
 
-#define SERVER_PORT "4433"
+#include <sgx_quote.h>
+
+#include "ra.h"
+#include "ra-challenger.h"
+
+#define SERVER_PORT "11111"
 #define SERVER_NAME "localhost"
 #define GET_REQUEST "GET / HTTP/1.0\r\n\r\n"
 
-#define DEBUG_LEVEL 1
+#define DEBUG_LEVEL 0
 
 static void my_debug( void *ctx, int level,
                       const char *file, int line,
@@ -78,11 +83,22 @@ static void my_debug( void *ctx, int level,
     fflush(  (FILE *) ctx  );
 }
 
+/* The callback is supposed to return 0 on success. Otherwise, the
+   verification failed. */
+static int my_verify(void *data, mbedtls_x509_crt *crt, int depth, uint32_t *flags) {
+
+    if (depth != 0) return 0;
+
+    (void) data;
+    (void) flags;
+
+    return verify_sgx_cert_extensions(crt->raw.p, crt->raw.len);
+}
+
 int main( void )
 {
     int ret, len;
     mbedtls_net_context server_fd;
-    uint32_t flags;
     unsigned char buf[1024];
     const char *pers = "ssl_client1";
 
@@ -90,7 +106,6 @@ int main( void )
     mbedtls_ctr_drbg_context ctr_drbg;
     mbedtls_ssl_context ssl;
     mbedtls_ssl_config conf;
-    mbedtls_x509_crt cacert;
 
 #if defined(MBEDTLS_DEBUG_C)
     mbedtls_debug_set_threshold( DEBUG_LEVEL );
@@ -102,7 +117,6 @@ int main( void )
     mbedtls_net_init( &server_fd );
     mbedtls_ssl_init( &ssl );
     mbedtls_ssl_config_init( &conf );
-    mbedtls_x509_crt_init( &cacert );
     mbedtls_ctr_drbg_init( &ctr_drbg );
 
     mbedtls_printf( "\n  . Seeding the random number generator..." );
@@ -120,22 +134,6 @@ int main( void )
     mbedtls_printf( " ok\n" );
 
     /*
-     * 0. Initialize certificates
-     */
-    mbedtls_printf( "  . Loading the CA root certificate ..." );
-    fflush( stdout );
-
-    ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) mbedtls_test_cas_pem,
-                          mbedtls_test_cas_pem_len );
-    if( ret < 0 )
-    {
-        mbedtls_printf( " failed\n  !  mbedtls_x509_crt_parse returned -0x%x\n\n", -ret );
-        goto exit;
-    }
-
-    mbedtls_printf( " ok (%d skipped)\n", ret );
-
-    /*
      * 1. Start the connection
      */
     mbedtls_printf( "  . Connecting to tcp/%s/%s...", SERVER_NAME, SERVER_PORT );
@@ -170,7 +168,7 @@ int main( void )
     /* OPTIONAL is not optimal for security,
      * but makes interop easier in this simplified example */
     mbedtls_ssl_conf_authmode( &conf, MBEDTLS_SSL_VERIFY_OPTIONAL );
-    mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL );
+    mbedtls_ssl_conf_verify(&conf, my_verify, NULL);
     mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );
     mbedtls_ssl_conf_dbg( &conf, my_debug, stdout );
 
@@ -180,18 +178,18 @@ int main( void )
         goto exit;
     }
 
-    if( ( ret = mbedtls_ssl_set_hostname( &ssl, SERVER_NAME ) ) != 0 )
-    {
-        mbedtls_printf( " failed\n  ! mbedtls_ssl_set_hostname returned %d\n\n", ret );
-        goto exit;
-    }
+    /* if( ( ret = mbedtls_ssl_set_hostname( &ssl, SERVER_NAME ) ) != 0 ) */
+    /* { */
+    /*     mbedtls_printf( " failed\n  ! mbedtls_ssl_set_hostname returned %d\n\n", ret ); */
+    /*     goto exit; */
+    /* } */
 
     mbedtls_ssl_set_bio( &ssl, &server_fd, mbedtls_net_send, mbedtls_net_recv, NULL );
 
     /*
      * 4. Handshake
      */
-    mbedtls_printf( "  . Performing the SSL/TLS handshake..." );
+    mbedtls_printf( "  . Performing the SSL/TLS handshake...\n" );
     fflush( stdout );
 
     while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 )
@@ -203,26 +201,25 @@ int main( void )
         }
     }
 
-    mbedtls_printf( " ok\n" );
+    mbedtls_printf( "... handshake ok\n" );
 
-    /*
-     * 5. Verify the server certificate
-     */
-    mbedtls_printf( "  . Verifying peer X.509 certificate..." );
-
-    /* In real life, we probably want to bail out when ret != 0 */
-    if( ( flags = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 )
-    {
-        char vrfy_buf[512];
-
-        mbedtls_printf( " failed\n" );
+    /* This demonstrates how to extract SGX-related fields from the
+       certificate. */
+    const mbedtls_x509_crt* peercrt = mbedtls_ssl_get_peer_cert( &ssl );
+    sgx_quote_t quote;
+    
+    get_quote_from_cert(peercrt->raw.p, peercrt->raw.len, &quote);
 
-        mbedtls_x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), "  ! ", flags );
+    sgx_report_body_t* body = &quote.report_body;
 
-        mbedtls_printf( "%s\n", vrfy_buf );
-    }
-    else
-        mbedtls_printf( " ok\n" );
+    printf("Certificate's SGX information:\n");
+    printf("  . MRENCLAVE = ");
+    for (int i=0; i < SGX_HASH_SIZE; ++i) printf("%02x", body->mr_enclave.m[i]);
+    printf("\n");
+    
+    printf("  . MRSIGNER  = ");
+    for (int i=0; i < SGX_HASH_SIZE; ++i) printf("%02x", body->mr_signer.m[i]);
+    printf("\n");
 
     /*
      * 3. Write the GET request
@@ -294,7 +291,6 @@ exit:
 
     mbedtls_net_free( &server_fd );
 
-    mbedtls_x509_crt_free( &cacert );
     mbedtls_ssl_free( &ssl );
     mbedtls_ssl_config_free( &conf );
     mbedtls_ctr_drbg_free( &ctr_drbg );
@@ -305,6 +301,8 @@ exit:
     fflush( stdout ); getchar();
 #endif
 
+    if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) ret = 0;
+    
     return( ret );
 }
 #endif /* MBEDTLS_BIGNUM_C && MBEDTLS_ENTROPY_C && MBEDTLS_SSL_TLS_C &&