You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@teaclave.apache.org by ms...@apache.org on 2020/04/06 21:47:47 UTC
[incubator-teaclave] branch develop updated: [config] Provide
commonly used build configurations in constants
This is an automated email from the ASF dual-hosted git repository.
mssun pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/incubator-teaclave.git
The following commit(s) were added to refs/heads/develop by this push:
new 9dd4bb7 [config] Provide commonly used build configurations in constants
9dd4bb7 is described below
commit 9dd4bb7eb7d2ac024e4621c066852b1d2e44487d
Author: Mingshen Sun <bo...@mssun.me>
AuthorDate: Mon Apr 6 14:08:21 2020 -0700
[config] Provide commonly used build configurations in constants
---
attestation/src/attestation.rs | 3 +--
config/src/build.rs | 27 ++++++++++++++++++++++
config/src/lib.rs | 4 +---
services/access_control/enclave/src/lib.rs | 13 ++++-------
services/authentication/enclave/src/lib.rs | 13 ++++-------
services/execution/enclave/src/lib.rs | 6 +----
services/frontend/enclave/src/lib.rs | 5 ++--
services/management/enclave/src/lib.rs | 11 +++------
services/scheduler/enclave/src/lib.rs | 11 +++------
services/storage/enclave/src/lib.rs | 11 +++------
.../enclave/src/authentication_service.rs | 6 ++---
tests/functional/enclave/src/end_to_end/mod.rs | 4 ++--
tests/functional/enclave/src/frontend_service.rs | 4 ++--
tests/functional/enclave/src/management_service.rs | 6 ++---
14 files changed, 61 insertions(+), 63 deletions(-)
diff --git a/attestation/src/attestation.rs b/attestation/src/attestation.rs
index 9805f0c..ee176c5 100644
--- a/attestation/src/attestation.rs
+++ b/attestation/src/attestation.rs
@@ -27,9 +27,8 @@ use std::thread;
use std::time::Duration;
use std::time::{self, SystemTime};
use std::untrusted::time::SystemTimeEx;
-use teaclave_config::BUILD_CONFIG;
+use teaclave_config::build::ATTESTATION_VALIDITY_SECS;
-const ATTESTATION_VALIDITY_SECS: u64 = BUILD_CONFIG.attestation_validity_secs;
const CERT_ISSUER: &str = "Teaclave";
const CERT_SUBJECT: &str = "CN=Teaclave";
diff --git a/config/src/build.rs b/config/src/build.rs
index 5866042..8257589 100644
--- a/config/src/build.rs
+++ b/config/src/build.rs
@@ -17,3 +17,30 @@
#![allow(clippy::all)]
include!(concat!(env!("OUT_DIR"), "/build_config.rs"));
+
+const AUDITOR_PUBLIC_KEYS_LEN: usize = BUILD_CONFIG.auditor_public_keys.len();
+
+/// CA certification of Attestation Service in binary (DER format).
+pub const AS_ROOT_CA_CERT: &[u8] = BUILD_CONFIG.as_root_ca_cert;
+
+/// Array of auditor's public keys in binary (DER format), usually used to
+/// verify signatures of `enaclave_info.toml`.
+pub const AUDITOR_PUBLIC_KEYS: &[&[u8]; AUDITOR_PUBLIC_KEYS_LEN] = BUILD_CONFIG.auditor_public_keys;
+
+/// The valid duration of one attestation report in seconds.
+pub const ATTESTATION_VALIDITY_SECS: u64 = BUILD_CONFIG.attestation_validity_secs;
+
+macro_rules! def_inbound_services {
+ ($name: tt, $service: tt) => {
+ /// Array of predefined inbound services, usually used for validate
+ /// incoming connections via mutual attestation.
+ pub const $name: &[&str; BUILD_CONFIG.inbound.$service.len()] =
+ BUILD_CONFIG.inbound.$service;
+ };
+}
+
+def_inbound_services!(ACCESS_CONTROL_INBOUND_SERVICES, access_control);
+def_inbound_services!(AUTHENTICATION_INBOUND_SERVICES, authentication);
+def_inbound_services!(MANAGEMENT_INBOUND_SERVICES, management);
+def_inbound_services!(SCHEDULER_INBOUND_SERVICES, scheduler);
+def_inbound_services!(STORAGE_INBOUND_SERVICES, storage);
diff --git a/config/src/lib.rs b/config/src/lib.rs
index 6b075df..ddf03a3 100644
--- a/config/src/lib.rs
+++ b/config/src/lib.rs
@@ -30,9 +30,7 @@ pub(crate) enum ConfigSource {
}
#[cfg(feature = "build_config")]
-mod build;
+pub mod build;
mod runtime;
-#[cfg(feature = "build_config")]
-pub use build::BUILD_CONFIG;
pub use runtime::RuntimeConfig;
diff --git a/services/access_control/enclave/src/lib.rs b/services/access_control/enclave/src/lib.rs
index f6a8b1e..0c08611 100644
--- a/services/access_control/enclave/src/lib.rs
+++ b/services/access_control/enclave/src/lib.rs
@@ -30,7 +30,10 @@ use teaclave_binder::proto::{
StartServiceInput, StartServiceOutput,
};
use teaclave_binder::{handle_ecall, register_ecall_handler};
-use teaclave_config::{RuntimeConfig, BUILD_CONFIG};
+use teaclave_config::build::{
+ ACCESS_CONTROL_INBOUND_SERVICES, AS_ROOT_CA_CERT, AUDITOR_PUBLIC_KEYS,
+};
+use teaclave_config::RuntimeConfig;
use teaclave_proto::teaclave_access_control_service::{
TeaclaveAccessControlRequest, TeaclaveAccessControlResponse,
};
@@ -42,12 +45,6 @@ use teaclave_types::{EnclaveInfo, TeeServiceError, TeeServiceResult};
mod acs;
mod service;
-const AS_ROOT_CA_CERT: &[u8] = BUILD_CONFIG.as_root_ca_cert;
-const AUDITOR_PUBLIC_KEYS_LEN: usize = BUILD_CONFIG.auditor_public_keys.len();
-const AUDITOR_PUBLIC_KEYS: &[&[u8]; AUDITOR_PUBLIC_KEYS_LEN] = BUILD_CONFIG.auditor_public_keys;
-const INBOUND_SERVICES_LEN: usize = BUILD_CONFIG.inbound.access_control.len();
-const INBOUND_SERVICES: &[&str; INBOUND_SERVICES_LEN] = BUILD_CONFIG.inbound.access_control;
-
fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
let listen_address = config.internal_endpoints.access_control.listen_address;
let as_config = &config.attestation;
@@ -76,7 +73,7 @@ fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
.as_ref()
.expect("auditor signatures"),
)?;
- let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = INBOUND_SERVICES
+ let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = ACCESS_CONTROL_INBOUND_SERVICES
.iter()
.map(|service| {
enclave_info
diff --git a/services/authentication/enclave/src/lib.rs b/services/authentication/enclave/src/lib.rs
index afd7cb0..8adcf64 100644
--- a/services/authentication/enclave/src/lib.rs
+++ b/services/authentication/enclave/src/lib.rs
@@ -34,7 +34,10 @@ use teaclave_binder::proto::{
StartServiceInput, StartServiceOutput,
};
use teaclave_binder::{handle_ecall, register_ecall_handler};
-use teaclave_config::{RuntimeConfig, BUILD_CONFIG};
+use teaclave_config::build::{
+ AS_ROOT_CA_CERT, AUDITOR_PUBLIC_KEYS, AUTHENTICATION_INBOUND_SERVICES,
+};
+use teaclave_config::RuntimeConfig;
use teaclave_proto::teaclave_authentication_service::{
TeaclaveAuthenticationApiRequest, TeaclaveAuthenticationApiResponse,
TeaclaveAuthenticationInternalRequest, TeaclaveAuthenticationInternalResponse,
@@ -49,12 +52,6 @@ mod internal_service;
mod user_db;
mod user_info;
-const AS_ROOT_CA_CERT: &[u8] = BUILD_CONFIG.as_root_ca_cert;
-const AUDITOR_PUBLIC_KEYS_LEN: usize = BUILD_CONFIG.auditor_public_keys.len();
-const AUDITOR_PUBLIC_KEYS: &[&[u8]; AUDITOR_PUBLIC_KEYS_LEN] = BUILD_CONFIG.auditor_public_keys;
-const INBOUND_SERVICES_LEN: usize = BUILD_CONFIG.inbound.authentication.len();
-const INBOUND_SERVICES: &[&str; INBOUND_SERVICES_LEN] = BUILD_CONFIG.inbound.authentication;
-
fn start_internal_endpoint(
addr: std::net::SocketAddr,
db_client: user_db::DbClient,
@@ -125,7 +122,7 @@ fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
.as_ref()
.expect("auditor signatures"),
)?;
- let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = INBOUND_SERVICES
+ let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = AUTHENTICATION_INBOUND_SERVICES
.iter()
.map(|service| {
enclave_info
diff --git a/services/execution/enclave/src/lib.rs b/services/execution/enclave/src/lib.rs
index bcef69c..df4a71c 100644
--- a/services/execution/enclave/src/lib.rs
+++ b/services/execution/enclave/src/lib.rs
@@ -29,8 +29,8 @@ use teaclave_binder::proto::{
StartServiceInput, StartServiceOutput,
};
use teaclave_binder::{handle_ecall, register_ecall_handler};
+use teaclave_config::build::{AS_ROOT_CA_CERT, AUDITOR_PUBLIC_KEYS};
use teaclave_config::RuntimeConfig;
-use teaclave_config::BUILD_CONFIG;
use teaclave_service_enclave_utils::create_trusted_scheduler_endpoint;
use teaclave_service_enclave_utils::ServiceEnclave;
use teaclave_types::{EnclaveInfo, TeeServiceError, TeeServiceResult};
@@ -38,10 +38,6 @@ use teaclave_types::{EnclaveInfo, TeeServiceError, TeeServiceResult};
mod ocall;
mod service;
-const AS_ROOT_CA_CERT: &[u8] = BUILD_CONFIG.as_root_ca_cert;
-const AUDITOR_PUBLIC_KEYS_LEN: usize = BUILD_CONFIG.auditor_public_keys.len();
-const AUDITOR_PUBLIC_KEYS: &[&[u8]; AUDITOR_PUBLIC_KEYS_LEN] = BUILD_CONFIG.auditor_public_keys;
-
fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
let enclave_info = EnclaveInfo::verify_and_new(
config
diff --git a/services/frontend/enclave/src/lib.rs b/services/frontend/enclave/src/lib.rs
index 1a0bad4..b27d90e 100644
--- a/services/frontend/enclave/src/lib.rs
+++ b/services/frontend/enclave/src/lib.rs
@@ -31,7 +31,8 @@ use teaclave_binder::proto::{
StartServiceInput, StartServiceOutput,
};
use teaclave_binder::{handle_ecall, register_ecall_handler};
-use teaclave_config::{RuntimeConfig, BUILD_CONFIG};
+use teaclave_config::build::AS_ROOT_CA_CERT;
+use teaclave_config::RuntimeConfig;
use teaclave_proto::teaclave_frontend_service::{
TeaclaveFrontendRequest, TeaclaveFrontendResponse,
};
@@ -44,8 +45,6 @@ use teaclave_types::{TeeServiceError, TeeServiceResult};
mod service;
-const AS_ROOT_CA_CERT: &[u8] = BUILD_CONFIG.as_root_ca_cert;
-
fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
let listen_address = config.api_endpoints.frontend.listen_address;
let as_config = &config.attestation;
diff --git a/services/management/enclave/src/lib.rs b/services/management/enclave/src/lib.rs
index 778b2d3..0f6406f 100644
--- a/services/management/enclave/src/lib.rs
+++ b/services/management/enclave/src/lib.rs
@@ -31,7 +31,8 @@ use teaclave_binder::proto::{
StartServiceInput, StartServiceOutput,
};
use teaclave_binder::{handle_ecall, register_ecall_handler};
-use teaclave_config::{RuntimeConfig, BUILD_CONFIG};
+use teaclave_config::build::{AS_ROOT_CA_CERT, AUDITOR_PUBLIC_KEYS, MANAGEMENT_INBOUND_SERVICES};
+use teaclave_config::RuntimeConfig;
use teaclave_proto::teaclave_management_service::{
TeaclaveManagementRequest, TeaclaveManagementResponse,
};
@@ -42,12 +43,6 @@ use teaclave_types::{EnclaveInfo, TeeServiceError, TeeServiceResult};
mod service;
-const AS_ROOT_CA_CERT: &[u8] = BUILD_CONFIG.as_root_ca_cert;
-const AUDITOR_PUBLIC_KEYS_LEN: usize = BUILD_CONFIG.auditor_public_keys.len();
-const AUDITOR_PUBLIC_KEYS: &[&[u8]; AUDITOR_PUBLIC_KEYS_LEN] = BUILD_CONFIG.auditor_public_keys;
-const INBOUND_SERVICES_LEN: usize = BUILD_CONFIG.inbound.management.len();
-const INBOUND_SERVICES: &[&str; INBOUND_SERVICES_LEN] = BUILD_CONFIG.inbound.management;
-
fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
let listen_address = config.internal_endpoints.management.listen_address;
let as_config = &config.attestation;
@@ -76,7 +71,7 @@ fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
.as_ref()
.expect("auditor signatures"),
)?;
- let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = INBOUND_SERVICES
+ let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = MANAGEMENT_INBOUND_SERVICES
.iter()
.map(|service| {
enclave_info
diff --git a/services/scheduler/enclave/src/lib.rs b/services/scheduler/enclave/src/lib.rs
index b309ba9..704129c 100644
--- a/services/scheduler/enclave/src/lib.rs
+++ b/services/scheduler/enclave/src/lib.rs
@@ -35,7 +35,8 @@ use teaclave_binder::proto::{
StartServiceInput, StartServiceOutput,
};
use teaclave_binder::{handle_ecall, register_ecall_handler};
-use teaclave_config::{RuntimeConfig, BUILD_CONFIG};
+use teaclave_config::build::{AS_ROOT_CA_CERT, AUDITOR_PUBLIC_KEYS, SCHEDULER_INBOUND_SERVICES};
+use teaclave_config::RuntimeConfig;
use teaclave_proto::teaclave_scheduler_service::{
TeaclaveSchedulerRequest, TeaclaveSchedulerResponse,
};
@@ -45,12 +46,6 @@ use teaclave_service_enclave_utils::create_trusted_storage_endpoint;
use teaclave_service_enclave_utils::ServiceEnclave;
use teaclave_types::{EnclaveInfo, TeeServiceError, TeeServiceResult};
-const AS_ROOT_CA_CERT: &[u8] = BUILD_CONFIG.as_root_ca_cert;
-const AUDITOR_PUBLIC_KEYS_LEN: usize = BUILD_CONFIG.auditor_public_keys.len();
-const AUDITOR_PUBLIC_KEYS: &[&[u8]; AUDITOR_PUBLIC_KEYS_LEN] = BUILD_CONFIG.auditor_public_keys;
-const INBOUND_SERVICES_LEN: usize = BUILD_CONFIG.inbound.scheduler.len();
-const INBOUND_SERVICES: &[&str; INBOUND_SERVICES_LEN] = BUILD_CONFIG.inbound.scheduler;
-
fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
let listen_address = config.internal_endpoints.scheduler.listen_address;
let as_config = &config.attestation;
@@ -79,7 +74,7 @@ fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
.as_ref()
.expect("auditor signatures"),
)?;
- let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = INBOUND_SERVICES
+ let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = SCHEDULER_INBOUND_SERVICES
.iter()
.map(|service| {
enclave_info
diff --git a/services/storage/enclave/src/lib.rs b/services/storage/enclave/src/lib.rs
index afd7618..624f173 100644
--- a/services/storage/enclave/src/lib.rs
+++ b/services/storage/enclave/src/lib.rs
@@ -35,7 +35,8 @@ use teaclave_binder::proto::{
StartServiceInput, StartServiceOutput,
};
use teaclave_binder::{handle_ecall, register_ecall_handler};
-use teaclave_config::{RuntimeConfig, BUILD_CONFIG};
+use teaclave_config::build::{AS_ROOT_CA_CERT, AUDITOR_PUBLIC_KEYS, STORAGE_INBOUND_SERVICES};
+use teaclave_config::RuntimeConfig;
use teaclave_proto::teaclave_storage_service::{TeaclaveStorageRequest, TeaclaveStorageResponse};
use teaclave_rpc::config::SgxTrustedTlsServerConfig;
use teaclave_rpc::server::SgxTrustedTlsServer;
@@ -45,12 +46,6 @@ use teaclave_types::{EnclaveInfo, TeeServiceError, TeeServiceResult};
mod proxy;
mod service;
-const AS_ROOT_CA_CERT: &[u8] = BUILD_CONFIG.as_root_ca_cert;
-const AUDITOR_PUBLIC_KEYS_LEN: usize = BUILD_CONFIG.auditor_public_keys.len();
-const AUDITOR_PUBLIC_KEYS: &[&[u8]; AUDITOR_PUBLIC_KEYS_LEN] = BUILD_CONFIG.auditor_public_keys;
-const INBOUND_SERVICES_LEN: usize = BUILD_CONFIG.inbound.storage.len();
-const INBOUND_SERVICES: &[&str; INBOUND_SERVICES_LEN] = BUILD_CONFIG.inbound.storage;
-
fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
let listen_address = config.internal_endpoints.storage.listen_address;
let as_config = &config.attestation;
@@ -79,7 +74,7 @@ fn start_service(config: &RuntimeConfig) -> anyhow::Result<()> {
.as_ref()
.expect("auditor signatures"),
)?;
- let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = INBOUND_SERVICES
+ let accepted_enclave_attrs: Vec<teaclave_types::EnclaveAttr> = STORAGE_INBOUND_SERVICES
.iter()
.map(|service| {
enclave_info
diff --git a/tests/functional/enclave/src/authentication_service.rs b/tests/functional/enclave/src/authentication_service.rs
index 2f5d27c..5af5854 100644
--- a/tests/functional/enclave/src/authentication_service.rs
+++ b/tests/functional/enclave/src/authentication_service.rs
@@ -17,8 +17,8 @@
use std::prelude::v1::*;
use teaclave_attestation::verifier;
+use teaclave_config::build::AS_ROOT_CA_CERT;
use teaclave_config::RuntimeConfig;
-use teaclave_config::BUILD_CONFIG;
use teaclave_proto::teaclave_authentication_service::*;
use teaclave_proto::teaclave_common::*;
use teaclave_rpc::config::SgxTrustedTlsClientConfig;
@@ -47,7 +47,7 @@ fn get_api_client() -> TeaclaveAuthenticationApiClient {
.expect("authentication");
let config = SgxTrustedTlsClientConfig::new().attestation_report_verifier(
vec![enclave_attr],
- BUILD_CONFIG.as_root_ca_cert,
+ AS_ROOT_CA_CERT,
verifier::universal_quote_verifier,
);
@@ -67,7 +67,7 @@ fn get_internal_client() -> TeaclaveAuthenticationInternalClient {
.expect("authentication");
let config = SgxTrustedTlsClientConfig::new().attestation_report_verifier(
vec![enclave_attr],
- BUILD_CONFIG.as_root_ca_cert,
+ AS_ROOT_CA_CERT,
verifier::universal_quote_verifier,
);
diff --git a/tests/functional/enclave/src/end_to_end/mod.rs b/tests/functional/enclave/src/end_to_end/mod.rs
index 406b961..134ee77 100644
--- a/tests/functional/enclave/src/end_to_end/mod.rs
+++ b/tests/functional/enclave/src/end_to_end/mod.rs
@@ -20,8 +20,8 @@ use lazy_static::lazy_static;
use std::collections::HashMap;
use std::prelude::v1::*;
use teaclave_attestation::verifier;
+use teaclave_config::build::AS_ROOT_CA_CERT;
use teaclave_config::RuntimeConfig;
-use teaclave_config::BUILD_CONFIG;
use teaclave_proto::teaclave_authentication_service::*;
use teaclave_proto::teaclave_common::*;
use teaclave_proto::teaclave_frontend_service::*;
@@ -76,7 +76,7 @@ fn create_client_config(
.expect("enclave attr");
let config = SgxTrustedTlsClientConfig::new().attestation_report_verifier(
vec![enclave_attr],
- BUILD_CONFIG.as_root_ca_cert,
+ AS_ROOT_CA_CERT,
verifier::universal_quote_verifier,
);
Ok(config)
diff --git a/tests/functional/enclave/src/frontend_service.rs b/tests/functional/enclave/src/frontend_service.rs
index 8f18b07..ede0fe6 100644
--- a/tests/functional/enclave/src/frontend_service.rs
+++ b/tests/functional/enclave/src/frontend_service.rs
@@ -20,8 +20,8 @@ use std::collections::HashMap;
use std::convert::TryFrom;
use std::prelude::v1::*;
use teaclave_attestation::verifier;
+use teaclave_config::build::AS_ROOT_CA_CERT;
use teaclave_config::RuntimeConfig;
-use teaclave_config::BUILD_CONFIG;
use teaclave_proto::teaclave_authentication_service::*;
use teaclave_proto::teaclave_common::*;
use teaclave_proto::teaclave_frontend_service::*;
@@ -61,7 +61,7 @@ fn get_credential() -> UserCredential {
.expect("authentication");
let config = SgxTrustedTlsClientConfig::new().attestation_report_verifier(
vec![enclave_attr],
- BUILD_CONFIG.as_root_ca_cert,
+ AS_ROOT_CA_CERT,
verifier::universal_quote_verifier,
);
let channel = Endpoint::new("localhost:7776")
diff --git a/tests/functional/enclave/src/management_service.rs b/tests/functional/enclave/src/management_service.rs
index 921d841..cc049c9 100644
--- a/tests/functional/enclave/src/management_service.rs
+++ b/tests/functional/enclave/src/management_service.rs
@@ -19,8 +19,8 @@ use std::collections::HashMap;
use std::convert::TryFrom;
use std::prelude::v1::*;
use teaclave_attestation::verifier;
+use teaclave_config::build::AS_ROOT_CA_CERT;
use teaclave_config::RuntimeConfig;
-use teaclave_config::BUILD_CONFIG;
use teaclave_proto::teaclave_management_service::*;
use teaclave_proto::teaclave_scheduler_service::*;
use teaclave_rpc::config::SgxTrustedTlsClientConfig;
@@ -57,7 +57,7 @@ fn get_client(user_id: &str) -> TeaclaveManagementClient {
.expect("management");
let config = SgxTrustedTlsClientConfig::new().attestation_report_verifier(
vec![enclave_attr],
- BUILD_CONFIG.as_root_ca_cert,
+ AS_ROOT_CA_CERT,
verifier::universal_quote_verifier,
);
@@ -87,7 +87,7 @@ fn get_scheduler_client(user_id: &str) -> TeaclaveSchedulerClient {
.expect("scheduler");
let config = SgxTrustedTlsClientConfig::new().attestation_report_verifier(
vec![enclave_attr],
- BUILD_CONFIG.as_root_ca_cert,
+ AS_ROOT_CA_CERT,
verifier::universal_quote_verifier,
);
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@teaclave.apache.org
For additional commands, e-mail: commits-help@teaclave.apache.org