forked from envoyproxy/envoy
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add SGX private key provider and fuzz tests
* Add SGX private key provider and fuzz tests (envoyproxy#227) * Add fuzz test for sgx private key protection (envoyproxy#151) * Fix factory_context issues. * Fix fallback method in sgx private_key_provider. * temporarily disable sgx fuzz testing * Fix duplicate udpa symbols. Signed-off-by: Liu, Qiming <[email protected]> Signed-off-by: Huang Xin <[email protected]> Signed-off-by: Qiming Liu <[email protected]> Co-authored-by: Qiming <[email protected]>
- Loading branch information
1 parent
79cb30e
commit f741e79
Showing
26 changed files
with
1,506 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Validating CODEOWNERS rules …
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9 changes: 9 additions & 0 deletions
9
api/contrib/envoy/extensions/private_key_providers/sgx/v3alpha/BUILD
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py. | ||
|
|
||
| load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package") | ||
|
|
||
| licenses(["notice"]) # Apache 2 | ||
|
|
||
| api_proto_package( | ||
| deps = ["@com_github_cncf_xds//udpa/annotations:pkg"], | ||
| ) |
35 changes: 35 additions & 0 deletions
35
api/contrib/envoy/extensions/private_key_providers/sgx/v3alpha/sgx.proto
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| syntax = "proto3"; | ||
|
|
||
| package envoy.extensions.private_key_providers.sgx.v3alpha; | ||
|
|
||
| import "udpa/annotations/status.proto"; | ||
|
|
||
| option java_package = "io.envoyproxy.envoy.extensions.private_key_providers.sgx.v3alpha"; | ||
| option java_outer_classname = "SgxProto"; | ||
| option java_multiple_files = true; | ||
| option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/private_key_providers/sgx/v3alpha"; | ||
| option (udpa.annotations.file_status).package_version_status = ACTIVE; | ||
|
|
||
| // [#protodoc-title: SGX private key provider] | ||
| // [#extension: envoy.tls.key_providers.sgx] | ||
|
|
||
| // [#next-free-field: 7] | ||
| message SgxPrivateKeyMethodConfig { | ||
| // Path to the ctk library file. | ||
| string sgx_library = 1; | ||
|
|
||
| // Label of the key. | ||
| string key_label = 2; | ||
|
|
||
| // User PIN. | ||
| string usr_pin = 3; | ||
|
|
||
| // Security Officer user Pin. | ||
| string so_pin = 4; | ||
|
|
||
| // Label of the token. | ||
| string token_label = 5; | ||
|
|
||
| // Type of the key pair in SGX enclave, `rsa` or `ecdsa`. | ||
| string key_type = 6; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| load( | ||
| "//bazel:envoy_build_system.bzl", | ||
| "envoy_cc_extension", | ||
| "envoy_cc_library", | ||
| "envoy_contrib_package", | ||
| ) | ||
|
|
||
| licenses(["notice"]) # Apache 2 | ||
|
|
||
| envoy_contrib_package() | ||
|
|
||
| envoy_cc_library( | ||
| name = "sgx_private_key_provider_lib", | ||
| srcs = [ | ||
| "sgx.cc", | ||
| "sgx_private_key_provider.cc", | ||
| "utility.cc", | ||
| ], | ||
| hdrs = [ | ||
| "sgx.h", | ||
| "sgx_private_key_provider.h", | ||
| "utility.h", | ||
| "@pkcs11//:pkcs11headers", | ||
| ], | ||
| copts = ["-I external/pkcs11/include/pkcs11-v2.40"], | ||
| external_deps = ["ssl"], | ||
| repository = "@envoy", | ||
| deps = [ | ||
| "//envoy/api:api_interface", | ||
| "//envoy/event:dispatcher_interface", | ||
| "//envoy/registry", | ||
| "//envoy/server:transport_socket_config_interface", | ||
| "//envoy/ssl/private_key:private_key_config_interface", | ||
| "//envoy/ssl/private_key:private_key_interface", | ||
| "//source/common/common:logger_lib", | ||
| "//source/common/common:thread_lib", | ||
| "//source/common/common:utility_lib", | ||
| "//source/common/config:datasource_lib", | ||
| "//source/common/grpc:async_client_lib", | ||
| "//source/common/grpc:typed_async_client_lib", | ||
| "@envoy_api//contrib/envoy/extensions/private_key_providers/sgx/v3alpha:pkg_cc_proto", | ||
| ], | ||
| ) | ||
|
|
||
| envoy_cc_extension( | ||
| name = "config", | ||
| srcs = ["config.cc"], | ||
| hdrs = ["config.h"], | ||
| copts = ["-I external/pkcs11/include/pkcs11-v2.40"], | ||
| visibility = ["//visibility:public"], | ||
| deps = [ | ||
| ":sgx_private_key_provider_lib", | ||
| "//envoy/registry", | ||
| "//envoy/ssl/private_key:private_key_config_interface", | ||
| "//envoy/ssl/private_key:private_key_interface", | ||
| "//source/common/common:logger_lib", | ||
| "//source/common/config:utility_lib", | ||
| "//source/common/protobuf:utility_lib", | ||
| "@envoy_api//contrib/envoy/extensions/private_key_providers/sgx/v3alpha:pkg_cc_proto", | ||
| "@envoy_api//envoy/extensions/transport_sockets/tls/v3:pkg_cc_proto", | ||
| ], | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| #include "contrib/sgx/private_key_providers/source/config.h" | ||
|
|
||
| #include <memory> | ||
|
|
||
| #include "envoy/registry/registry.h" | ||
| #include "envoy/server/transport_socket_config.h" | ||
|
|
||
| #include "source/common/config/utility.h" | ||
| #include "source/common/protobuf/message_validator_impl.h" | ||
| #include "source/common/protobuf/utility.h" | ||
|
|
||
| #include "contrib/envoy/extensions/private_key_providers/sgx/v3alpha/sgx.pb.h" | ||
| #include "contrib/envoy/extensions/private_key_providers/sgx/v3alpha/sgx.pb.validate.h" | ||
| #include "contrib/sgx/private_key_providers/source/sgx.h" | ||
| #include "openssl/ssl.h" | ||
|
|
||
| namespace Envoy { | ||
| namespace Extensions { | ||
| namespace PrivateKeyMethodProvider { | ||
| namespace Sgx { | ||
|
|
||
| Ssl::PrivateKeyMethodProviderSharedPtr | ||
| SgxPrivateKeyMethodFactory::createPrivateKeyMethodProviderInstance( | ||
| const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& proto_config, | ||
| Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) { | ||
| ProtobufTypes::MessagePtr message = std::make_unique< | ||
| envoy::extensions::private_key_providers::sgx::v3alpha::SgxPrivateKeyMethodConfig>(); | ||
|
|
||
| Config::Utility::translateOpaqueConfig(proto_config.typed_config(), | ||
| ProtobufMessage::getNullValidationVisitor(), *message); | ||
| const envoy::extensions::private_key_providers::sgx::v3alpha::SgxPrivateKeyMethodConfig conf = | ||
| MessageUtil::downcastAndValidate< | ||
| const envoy::extensions::private_key_providers::sgx::v3alpha::SgxPrivateKeyMethodConfig&>( | ||
| *message, private_key_provider_context.messageValidationVisitor()); | ||
|
|
||
| SgxSharedPtr sgx = std::make_shared<Sgx>(); | ||
| return std::make_shared<SgxPrivateKeyMethodProvider>(conf, private_key_provider_context, sgx); | ||
| } | ||
|
|
||
| REGISTER_FACTORY(SgxPrivateKeyMethodFactory, Ssl::PrivateKeyMethodProviderInstanceFactory); | ||
|
|
||
| } // namespace Sgx | ||
| } // namespace PrivateKeyMethodProvider | ||
| } // namespace Extensions | ||
| } // namespace Envoy |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| #pragma once | ||
|
|
||
| #include "envoy/extensions/transport_sockets/tls/v3/cert.pb.h" | ||
| #include "envoy/ssl/private_key/private_key.h" | ||
| #include "envoy/ssl/private_key/private_key_config.h" | ||
|
|
||
| #include "source/common/common/logger.h" | ||
|
|
||
| #include "contrib/sgx/private_key_providers/source/sgx_private_key_provider.h" | ||
|
|
||
| namespace Envoy { | ||
| namespace Extensions { | ||
| namespace PrivateKeyMethodProvider { | ||
| namespace Sgx { | ||
|
|
||
| class SgxPrivateKeyMethodFactory : public Ssl::PrivateKeyMethodProviderInstanceFactory, | ||
| public Logger::Loggable<Logger::Id::connection> { | ||
| public: | ||
| Ssl::PrivateKeyMethodProviderSharedPtr createPrivateKeyMethodProviderInstance( | ||
| const envoy::extensions::transport_sockets::tls::v3::PrivateKeyProvider& message, | ||
| Server::Configuration::TransportSocketFactoryContext& private_key_provider_context) override; | ||
|
|
||
| std::string name() const override { return "sgx"; }; | ||
| }; | ||
|
|
||
| } // namespace Sgx | ||
| } // namespace PrivateKeyMethodProvider | ||
| } // namespace Extensions | ||
| } // namespace Envoy |
Oops, something went wrong.