wolfssl-examples.patch

diff --git a/SGX_Linux/sgx_t.mk b/SGX_Linux/sgx_t.mk
index b4dd62c..3802e25 100644
--- a/SGX_Linux/sgx_t.mk
+++ b/SGX_Linux/sgx_t.mk
@@ -39,16 +39,18 @@ endif
 
 Crypto_Library_Name := sgx_tcrypto
 
+SGX_RA_TLS_ROOT="../../.."
 
-Wolfssl_C_Extra_Flags := -DWOLFSSL_SGX
+Wolfssl_C_Extra_Flags := -DSGX_SDK -DWOLFSSL_SGX -DWOLFSSL_SGX_ATTESTATION -DUSER_TIME -DWOLFSSL_CERT_EXT
 Wolfssl_Include_Paths := -I$(WOLFSSL_ROOT)/ \
 						 -I$(WOLFSSL_ROOT)/wolfcrypt/
 
 
 Wolfssl_Enclave_C_Files := trusted/Wolfssl_Enclave.c
 Wolfssl_Enclave_Include_Paths := -IInclude -Itrusted $(Wolfssl_Include_Paths)\
-   								   -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc\
-								   -I$(SGX_SDK)/include/stlport
+								   -I$(SGX_SDK)/include -I$(SGX_SDK)/include/tlibc\
+								   -I$(SGX_SDK)/include/stlport \
+									 -I$(SGX_RA_TLS_ROOT)
 
 ifeq ($(HAVE_WOLFSSL_TEST), 1)
 	Wolfssl_Include_Paths += -I$(WOLFSSL_ROOT)/wolfcrypt/test/
@@ -62,10 +64,11 @@ endif
 
 
 Flags_Just_For_C := -Wno-implicit-function-declaration -std=c11
-Common_C_Cpp_Flags := $(SGX_COMMON_CFLAGS) -nostdinc -fvisibility=hidden -fpie -fstack-protector $(Wolfssl_Enclave_Include_Paths)-fno-builtin -fno-builtin-printf -I.
+Common_C_Cpp_Flags := $(SGX_COMMON_CFLAGS) -nostdinc -fvisibility=hidden -fpie -fstack-protector $(Wolfssl_Enclave_Include_Paths) -fno-builtin -fno-builtin-printf -I.
 Wolfssl_Enclave_C_Flags := $(Flags_Just_For_C) $(Common_C_Cpp_Flags) $(Wolfssl_C_Extra_Flags)
 
 Wolfssl_Enclave_Link_Flags := $(SGX_COMMON_CFLAGS) -Wl,--no-undefined -nostdlib -nodefaultlibs -nostartfiles -L$(SGX_LIBRARY_PATH) \
+  -L$(SGX_RA_TLS_LIB) -lsgx_ra_tls_wolfssl \
 	-L$(SGX_WOLFSSL_LIB) -lwolfssl.sgx.static.lib \
 	-Wl,--whole-archive -l$(Trts_Library_Name) -Wl,--no-whole-archive \
 	-Wl,--start-group -lsgx_tstdc -lsgx_tstdcxx -l$(Crypto_Library_Name) -l$(Service_Library_Name) -Wl,--end-group \
@@ -112,7 +115,7 @@ endif
 ######## Wolfssl_Enclave Objects ########
 
 trusted/Wolfssl_Enclave_t.c: $(SGX_EDGER8R) ./trusted/Wolfssl_Enclave.edl
-	@cd ./trusted && $(SGX_EDGER8R) --trusted ../trusted/Wolfssl_Enclave.edl --search-path ../trusted --search-path $(SGX_SDK)/include
+	@cd ./trusted && $(SGX_EDGER8R) --trusted ../trusted/Wolfssl_Enclave.edl --search-path ../trusted --search-path $(SGX_SDK)/include --search-path ../../../..
 	@echo "GEN  =>  $@"
 
 trusted/Wolfssl_Enclave_t.o: ./trusted/Wolfssl_Enclave_t.c
diff --git a/SGX_Linux/sgx_u.mk b/SGX_Linux/sgx_u.mk
index 4d157cd..d538825 100644
--- a/SGX_Linux/sgx_u.mk
+++ b/SGX_Linux/sgx_u.mk
@@ -30,6 +30,8 @@ else
         SGX_COMMON_CFLAGS += -O2
 endif
 
+SGX_RA_TLS_ROOT="../../.."
+
 ######## App Settings ########
 
 ifneq ($(SGX_MODE), HW)
@@ -54,8 +56,8 @@ endif
 
 
 
-App_C_Files := $(UNTRUSTED_DIR)/App.c $(UNTRUSTED_DIR)/client-tls.c $(UNTRUSTED_DIR)/server-tls.c
-App_Include_Paths := -IInclude $(Wolfssl_Include_Paths) -I$(UNTRUSTED_DIR) -I$(SGX_SDK)/include
+App_C_Files := $(UNTRUSTED_DIR)/App.c $(UNTRUSTED_DIR)/client-tls.c $(UNTRUSTED_DIR)/server-tls.c $(UNTRUSTED_DIR)/sgxsdk-ra-attester_u.c $(UNTRUSTED_DIR)/ias-ra.c
+App_Include_Paths := $(Wolfssl_Include_Paths) -I$(UNTRUSTED_DIR) -I$(SGX_SDK)/include -I$(SGX_RA_TLS_ROOT) -I../../local/include
 
 App_C_Flags := $(SGX_COMMON_CFLAGS) -fPIC -Wno-attributes $(App_Include_Paths) $(Wolfssl_C_Extra_Flags)
 
@@ -71,7 +73,7 @@ else
         App_C_Flags += -DNDEBUG -UEDEBUG -UDEBUG
 endif
 
-App_Link_Flags := $(SGX_COMMON_CFLAGS) -L$(SGX_LIBRARY_PATH) -l$(Urts_Library_Name) -lpthread
+App_Link_Flags := $(SGX_COMMON_CFLAGS) -L$(SGX_LIBRARY_PATH) -L$(SGX_RA_TLS_ROOT)/deps/local/lib -l$(Urts_Library_Name) -lpthread -lcurl-openssl -lssl -lcrypto -lz -ldl
 
 ifneq ($(SGX_MODE), HW)
 	App_Link_Flags += -lsgx_uae_service_sim
@@ -116,7 +118,7 @@ endif
 ######## App Objects ########
 
 $(UNTRUSTED_DIR)/Wolfssl_Enclave_u.c: $(SGX_EDGER8R) trusted/Wolfssl_Enclave.edl
-	@cd $(UNTRUSTED_DIR) && $(SGX_EDGER8R) --untrusted ../trusted/Wolfssl_Enclave.edl --search-path ../trusted --search-path $(SGX_SDK)/include
+	@cd $(UNTRUSTED_DIR) && $(SGX_EDGER8R) --untrusted ../trusted/Wolfssl_Enclave.edl --search-path ../trusted --search-path $(SGX_SDK)/include --search-path ../../../..
 	@echo "GEN  =>  $@"
 
 $(UNTRUSTED_DIR)/Wolfssl_Enclave_u.o: $(UNTRUSTED_DIR)/Wolfssl_Enclave_u.c
diff --git a/SGX_Linux/trusted/Wolfssl_Enclave.c b/SGX_Linux/trusted/Wolfssl_Enclave.c
index 155df0b..a304bc0 100644
--- a/SGX_Linux/trusted/Wolfssl_Enclave.c
+++ b/SGX_Linux/trusted/Wolfssl_Enclave.c
@@ -1,3 +1,4 @@
+#include <assert.h>
 #include <stdarg.h>
 #include <stdio.h>      /* vsnprintf */
 
@@ -208,3 +209,25 @@ size_t send(int sockfd, const void *buf, size_t len, int flags)
     sgxStatus = ocall_send(&ret, sockfd, buf, len, flags);
     return ret;
 }
+
+extern struct ra_tls_options my_ra_tls_options;
+
+void enc_create_key_and_x509(WOLFSSL_CTX* ctx) {
+    uint8_t der_key[2048];
+    uint8_t der_cert[8 * 1024];
+    uint32_t der_key_len = sizeof(der_key);
+    uint32_t der_cert_len = sizeof(der_cert);
+
+    create_key_and_x509(&der_key, &der_key_len,
+                        &der_cert, &der_cert_len,
+                        &my_ra_tls_options);
+
+    int ret;
+    ret = wolfSSL_CTX_use_certificate_buffer(ctx, der_cert, der_cert_len,
+                                             SSL_FILETYPE_ASN1);
+    assert(ret == SSL_SUCCESS);
+
+    wolfSSL_CTX_use_PrivateKey_buffer(ctx, der_key, der_key_len,
+                                      SSL_FILETYPE_ASN1);
+    assert(ret == SSL_SUCCESS);
+}
diff --git a/SGX_Linux/trusted/Wolfssl_Enclave.edl b/SGX_Linux/trusted/Wolfssl_Enclave.edl
index 9a51b0f..2ca4de3 100644
--- a/SGX_Linux/trusted/Wolfssl_Enclave.edl
+++ b/SGX_Linux/trusted/Wolfssl_Enclave.edl
@@ -7,6 +7,8 @@ enclave {
     include "wolfcrypt/test/test.h"
     include "wolfcrypt/benchmark/benchmark.h"
 
+  from "ra_tls.edl" import *;
+
     trusted {
         public int wc_test([user_check]void* args);
         public int wc_benchmark_test([user_check]void* args);
@@ -49,6 +51,8 @@ enclave {
 		public void enc_wolfSSL_free([user_check]WOLFSSL* ssl);
 		public void enc_wolfSSL_CTX_free([user_check]WOLFSSL_CTX* ctx);
 		public int enc_wolfSSL_Cleanup(void);
+
+    public void enc_create_key_and_x509([user_check]WOLFSSL_CTX* ctx);
     };
 
     untrusted {
diff --git a/SGX_Linux/untrusted/server-tls.c b/SGX_Linux/untrusted/server-tls.c
index f49b912..01c381b 100644
--- a/SGX_Linux/untrusted/server-tls.c
+++ b/SGX_Linux/untrusted/server-tls.c
@@ -22,6 +22,7 @@
 #include "server-tls.h"
 
 /* the usual suspects */
+#include <assert.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -79,6 +80,9 @@ int server_connect(sgx_enclave_id_t id)
         return -1;
     }
 
+    int enable = 1;
+    ret = setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &enable, sizeof(int));
+    assert(ret != -1);
 
     /* Create and initialize WOLFSSL_CTX */
     sgxStatus = enc_wolfTLSv1_2_server_method(id, &method);
@@ -93,6 +97,7 @@ int server_connect(sgx_enclave_id_t id)
         return EXIT_FAILURE;
     }
 
+#if 0
     /* Load server certificates into WOLFSSL_CTX */
     sgxStatus = enc_wolfSSL_CTX_use_certificate_buffer(id, &ret, ctx,
             server_cert_der_2048, sizeof_server_cert_der_2048, SSL_FILETYPE_ASN1);
@@ -108,7 +113,11 @@ int server_connect(sgx_enclave_id_t id)
         printf("wolfSSL_CTX_use_PrivateKey_buffer failure\n");
         return EXIT_FAILURE;
     }
+#endif
 
+    sgxStatus = enc_create_key_and_x509(id, ctx);
+    assert(sgxStatus == SGX_SUCCESS);
+    
     /* Initialize the server address struct with zeros */
     memset(&servAddr, 0, sizeof(servAddr));
 /* Fill in the server address */
diff --git a/tls/client-tls.c b/tls/client-tls.c
index a72dfad..faa623b 100644
--- a/tls/client-tls.c
+++ b/tls/client-tls.c
@@ -20,6 +20,9 @@
  */
 
 /* the usual suspects */
+#ifdef SGX_RATLS_MUTUAL
+#include <assert.h>
+#endif
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -36,9 +39,30 @@
 
 #define DEFAULT_PORT 11111
 
-#define CERT_FILE "../certs/ca-cert.pem"
+#include <sgx_quote.h>
 
+#include "ra.h"
+#ifdef SGX_RATLS_MUTUAL
+#include "ra-attester.h"
+#endif
+#include "ra-challenger.h"
 
+static
+int cert_verify_callback(int preverify, WOLFSSL_X509_STORE_CTX* store) {
+
+    (void) preverify;
+
+    int ret = verify_sgx_cert_extensions(store->certs->buffer,
+                                         store->certs->length);
+
+    fprintf(stderr, "Verifying SGX certificate extensions ... %s\n",
+            ret == 0 ? "Success" : "Failure");
+    return !ret;
+}
+
+#ifdef SGX_RATLS_MUTUAL
+extern struct ra_tls_options my_ra_tls_options;
+#endif
 
 int main(int argc, char** argv)
 {
@@ -51,15 +75,8 @@ int main(int argc, char** argv)
     WOLFSSL_CTX* ctx;
     WOLFSSL*     ssl;
 
-
-
-    /* Check for proper calling convention */
-    if (argc != 2) {
-        printf("usage: %s <IPv4 address>\n", argv[0]);
-        return 0;
-    }
-
-
+    (void) argc;
+    (void) argv;
 
     /* Initialize wolfSSL */
     wolfSSL_Init();
@@ -82,16 +99,19 @@ int main(int argc, char** argv)
         return -1;
     }
 
-    /* Load client certificates into WOLFSSL_CTX */
-    if (wolfSSL_CTX_load_verify_locations(ctx, CERT_FILE, NULL)
-        != SSL_SUCCESS) {
-        fprintf(stderr, "ERROR: failed to load %s, please check the file.\n",
-                CERT_FILE);
-        return -1;
-    }
-
+#ifdef SGX_RATLS_MUTUAL
+    uint8_t key[2048]; uint8_t crt[8192];
+    int key_len = sizeof(key);
+    int crt_len = sizeof(crt);
 
+    create_key_and_x509(key, &key_len, crt, &crt_len, &my_ra_tls_options);
+    int ret = wolfSSL_CTX_use_PrivateKey_buffer(ctx, key, key_len, SSL_FILETYPE_ASN1);
+    assert(SSL_SUCCESS == ret);
 
+    ret = wolfSSL_CTX_use_certificate_buffer(ctx, crt, crt_len, SSL_FILETYPE_ASN1);
+    assert(SSL_SUCCESS == ret);
+#endif
+    
     /* Initialize the server address struct with zeros */
     memset(&servAddr, 0, sizeof(servAddr));
 
@@ -99,8 +119,10 @@ int main(int argc, char** argv)
     servAddr.sin_family = AF_INET;             /* using IPv4      */
     servAddr.sin_port   = htons(DEFAULT_PORT); /* on DEFAULT_PORT */
 
+    const char* srvaddr = "127.0.0.1";
+
     /* Get the server IPv4 address from the command line call */
-    if (inet_pton(AF_INET, argv[1], &servAddr.sin_addr) != 1) {
+    if (inet_pton(AF_INET, srvaddr, &servAddr.sin_addr) != 1) {
         fprintf(stderr, "ERROR: invalid address\n");
         return -1;
     }
@@ -114,7 +136,7 @@ int main(int argc, char** argv)
         return -1;
     }
 
-
+    wolfSSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, cert_verify_callback);
 
     /* Create a WOLFSSL object */
     if ((ssl = wolfSSL_new(ctx)) == NULL) {
@@ -131,22 +153,35 @@ int main(int argc, char** argv)
         return -1;
     }
 
-
-
-    /* Get a message for the server from stdin */
-    printf("Message for server: ");
-    memset(buff, 0, sizeof(buff));
-    fgets(buff, sizeof(buff), stdin);
-    len = strnlen(buff, sizeof(buff));
+    WOLFSSL_X509* srvcrt =
+        wolfSSL_get_peer_certificate(ssl);
+      
+    int derSz;
+    const unsigned char* der =
+        wolfSSL_X509_get_der(srvcrt, &derSz);
+
+    sgx_quote_t quote;
+    get_quote_from_cert(der, derSz, &quote);
+    sgx_report_body_t* body = &quote.report_body;
+
+    printf("Server's SGX identity:\n");
+    printf("  . MRENCLAVE = ");
+    for (int i=0; i < SGX_HASH_SIZE; ++i) printf("%02x", body->mr_enclave.m[i]);
+    printf("\n");
+    
+    printf("  . MRSIGNER  = ");
+    for (int i=0; i < SGX_HASH_SIZE; ++i) printf("%02x", body->mr_signer.m[i]);
+    printf("\n");
+
+    const char* http_request = "GET / HTTP/1.0\r\n\r\n";
+    len = strlen(http_request);
 
     /* Send the message to the server */
-    if (wolfSSL_write(ssl, buff, len) != len) {
+    if (wolfSSL_write(ssl, http_request, len) != (int) len) {
         fprintf(stderr, "ERROR: failed to write\n");
         return -1;
     }
 
-
-
     /* Read the server data into our buff array */
     memset(buff, 0, sizeof(buff));
     if (wolfSSL_read(ssl, buff, sizeof(buff)-1) == -1) {
@@ -155,7 +190,7 @@ int main(int argc, char** argv)
     }
 
     /* Print to stdout any data the server sends */
-    printf("Server: %s\n", buff);
+    printf("Server:\n%s\n", buff);
 
 
 
diff --git a/tls/server-tls.c b/tls/server-tls.c
index ebab830..dbdcaa0 100644
--- a/tls/server-tls.c
+++ b/tls/server-tls.c
@@ -20,6 +20,7 @@
  */
 
 /* the usual suspects */
+#include <assert.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -34,12 +35,32 @@
 #include <wolfssl/options.h>
 #include <wolfssl/ssl.h>
 
+#include "ra-attester.h"
+#ifdef SGX_RATLS_MUTUAL
+#include "ra-challenger.h"
+#endif
+
 #define DEFAULT_PORT 11111
 
 #define CERT_FILE "../certs/server-cert.pem"
 #define KEY_FILE  "../certs/server-key.pem"
 
+extern struct ra_tls_options my_ra_tls_options;
+
+#ifdef SGX_RATLS_MUTUAL
+static
+int cert_verify_callback(int preverify, WOLFSSL_X509_STORE_CTX* store) {
+
+    (void) preverify;
 
+    int ret = verify_sgx_cert_extensions(store->certs->buffer,
+                                         store->certs->length);
+
+    fprintf(stderr, "Verifying SGX certificate extensions ... %s\n",
+            ret == 0 ? "Success" : "Failure");
+    return !ret;
+}
+#endif
 
 int main()
 {
@@ -79,23 +100,34 @@ int main()
         return -1;
     }
 
+    uint8_t key[2048]; uint8_t crt[8192];
+    int key_len = sizeof(key);
+    int crt_len = sizeof(crt);
+
+    create_key_and_x509(key, &key_len, crt, &crt_len, &my_ra_tls_options);
+    
     /* Load server certificates into WOLFSSL_CTX */
-    if (wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, SSL_FILETYPE_PEM)
+    if (wolfSSL_CTX_use_certificate_buffer(ctx, crt, crt_len, SSL_FILETYPE_ASN1)
         != SSL_SUCCESS) {
-        fprintf(stderr, "ERROR: failed to load %s, please check the file.\n",
-                CERT_FILE);
+        fprintf(stderr, "ERROR: failed to load server certificate.\n");
         return -1;
     }
 
     /* Load server key into WOLFSSL_CTX */
-    if (wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, SSL_FILETYPE_PEM)
+    if (wolfSSL_CTX_use_PrivateKey_buffer(ctx, key, key_len, SSL_FILETYPE_ASN1)
         != SSL_SUCCESS) {
-        fprintf(stderr, "ERROR: failed to load %s, please check the file.\n",
-                KEY_FILE);
+        fprintf(stderr, "ERROR: failed to load server key.\n");
         return -1;
     }
 
-
+    int ret;
+#ifdef SGX_RATLS_MUTUAL
+    ret = wolfSSL_CTX_load_verify_buffer(ctx, crt, crt_len, SSL_FILETYPE_ASN1);
+    assert(SSL_SUCCESS == ret);
+    
+    wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER | WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT,
+                                 cert_verify_callback);
+#endif
 
     /* Initialize the server address struct with zeros */
     memset(&servAddr, 0, sizeof(servAddr));
@@ -141,10 +173,34 @@ int main()
         /* Attach wolfSSL to the socket */
         wolfSSL_set_fd(ssl, connd);
 
-        printf("Client connected successfully\n");
-
+        ret = wolfSSL_negotiate(ssl);
+        assert(ret == WOLFSSL_SUCCESS);
 
+        printf("Client connected successfully\n");
 
+#ifdef SGX_RATLS_MUTUAL
+        WOLFSSL_X509* cli_crt =
+            wolfSSL_get_peer_certificate(ssl);
+      
+        int derSz;
+        const unsigned char* der =
+            wolfSSL_X509_get_der(cli_crt, &derSz);
+
+        sgx_quote_t quote;
+        get_quote_from_cert(der, derSz, &quote);
+        sgx_report_body_t* body = &quote.report_body;
+
+        printf("Client's SGX identity:\n");
+        printf("  . MRENCLAVE = ");
+        for (int i=0; i < SGX_HASH_SIZE; ++i) printf("%02x", body->mr_enclave.m[i]);
+        printf("\n");
+    
+        printf("  . MRSIGNER  = ");
+        for (int i=0; i < SGX_HASH_SIZE; ++i) printf("%02x", body->mr_signer.m[i]);
+        printf("\n");
+        fflush(stdout);
+#endif
+        
         /* Read the client data into our buff array */
         memset(buff, 0, sizeof(buff));
         if (wolfSSL_read(ssl, buff, sizeof(buff)-1) == -1) {
@@ -169,7 +225,7 @@ int main()
         len = strnlen(buff, sizeof(buff));
 
         /* Reply back to the client */
-        if (wolfSSL_write(ssl, buff, len) != len) {
+        if (wolfSSL_write(ssl, buff, len) != (int) len) {
             fprintf(stderr, "ERROR: failed to write\n");
             return -1;
         }