1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright(c) 2016-20 Intel Corporation. */ 3 4 #include <assert.h> 5 #include <getopt.h> 6 #include <stdbool.h> 7 #include <stdint.h> 8 #include <stdio.h> 9 #include <stdlib.h> 10 #include <string.h> 11 #include <sys/stat.h> 12 #include <sys/types.h> 13 #include <unistd.h> 14 #include <openssl/err.h> 15 #include <openssl/pem.h> 16 #include "defines.h" 17 #include "main.h" 18 19 /* 20 * FIXME: OpenSSL 3.0 has deprecated some functions. For now just ignore 21 * the warnings. 22 */ 23 #pragma GCC diagnostic ignored "-Wdeprecated-declarations" 24 25 struct q1q2_ctx { 26 BN_CTX *bn_ctx; 27 BIGNUM *m; 28 BIGNUM *s; 29 BIGNUM *q1; 30 BIGNUM *qr; 31 BIGNUM *q2; 32 }; 33 34 static void free_q1q2_ctx(struct q1q2_ctx *ctx) 35 { 36 BN_CTX_free(ctx->bn_ctx); 37 BN_free(ctx->m); 38 BN_free(ctx->s); 39 BN_free(ctx->q1); 40 BN_free(ctx->qr); 41 BN_free(ctx->q2); 42 } 43 44 static bool alloc_q1q2_ctx(const uint8_t *s, const uint8_t *m, 45 struct q1q2_ctx *ctx) 46 { 47 ctx->bn_ctx = BN_CTX_new(); 48 ctx->s = BN_bin2bn(s, SGX_MODULUS_SIZE, NULL); 49 ctx->m = BN_bin2bn(m, SGX_MODULUS_SIZE, NULL); 50 ctx->q1 = BN_new(); 51 ctx->qr = BN_new(); 52 ctx->q2 = BN_new(); 53 54 if (!ctx->bn_ctx || !ctx->s || !ctx->m || !ctx->q1 || !ctx->qr || 55 !ctx->q2) { 56 free_q1q2_ctx(ctx); 57 return false; 58 } 59 60 return true; 61 } 62 63 static void reverse_bytes(void *data, int length) 64 { 65 int i = 0; 66 int j = length - 1; 67 uint8_t temp; 68 uint8_t *ptr = data; 69 70 while (i < j) { 71 temp = ptr[i]; 72 ptr[i] = ptr[j]; 73 ptr[j] = temp; 74 i++; 75 j--; 76 } 77 } 78 79 static bool calc_q1q2(const uint8_t *s, const uint8_t *m, uint8_t *q1, 80 uint8_t *q2) 81 { 82 struct q1q2_ctx ctx; 83 int len; 84 85 if (!alloc_q1q2_ctx(s, m, &ctx)) { 86 fprintf(stderr, "Not enough memory for Q1Q2 calculation\n"); 87 return false; 88 } 89 90 if (!BN_mul(ctx.q1, ctx.s, ctx.s, ctx.bn_ctx)) 91 goto out; 92 93 if (!BN_div(ctx.q1, ctx.qr, ctx.q1, ctx.m, ctx.bn_ctx)) 94 goto out; 95 96 if (BN_num_bytes(ctx.q1) > SGX_MODULUS_SIZE) { 97 fprintf(stderr, "Too large Q1 %d bytes\n", 98 BN_num_bytes(ctx.q1)); 99 goto out; 100 } 101 102 if (!BN_mul(ctx.q2, ctx.s, ctx.qr, ctx.bn_ctx)) 103 goto out; 104 105 if (!BN_div(ctx.q2, NULL, ctx.q2, ctx.m, ctx.bn_ctx)) 106 goto out; 107 108 if (BN_num_bytes(ctx.q2) > SGX_MODULUS_SIZE) { 109 fprintf(stderr, "Too large Q2 %d bytes\n", 110 BN_num_bytes(ctx.q2)); 111 goto out; 112 } 113 114 len = BN_bn2bin(ctx.q1, q1); 115 reverse_bytes(q1, len); 116 len = BN_bn2bin(ctx.q2, q2); 117 reverse_bytes(q2, len); 118 119 free_q1q2_ctx(&ctx); 120 return true; 121 out: 122 free_q1q2_ctx(&ctx); 123 return false; 124 } 125 126 struct sgx_sigstruct_payload { 127 struct sgx_sigstruct_header header; 128 struct sgx_sigstruct_body body; 129 }; 130 131 static bool check_crypto_errors(void) 132 { 133 int err; 134 bool had_errors = false; 135 const char *filename; 136 int line; 137 char str[256]; 138 139 for ( ; ; ) { 140 if (ERR_peek_error() == 0) 141 break; 142 143 had_errors = true; 144 err = ERR_get_error_line(&filename, &line); 145 ERR_error_string_n(err, str, sizeof(str)); 146 fprintf(stderr, "crypto: %s: %s:%d\n", str, filename, line); 147 } 148 149 return had_errors; 150 } 151 152 static inline const BIGNUM *get_modulus(RSA *key) 153 { 154 const BIGNUM *n; 155 156 RSA_get0_key(key, &n, NULL, NULL); 157 return n; 158 } 159 160 static RSA *gen_sign_key(void) 161 { 162 unsigned long sign_key_length; 163 BIO *bio; 164 RSA *key; 165 166 sign_key_length = (unsigned long)&sign_key_end - 167 (unsigned long)&sign_key; 168 169 bio = BIO_new_mem_buf(&sign_key, sign_key_length); 170 if (!bio) 171 return NULL; 172 173 key = PEM_read_bio_RSAPrivateKey(bio, NULL, NULL, NULL); 174 BIO_free(bio); 175 176 return key; 177 } 178 179 enum mrtags { 180 MRECREATE = 0x0045544145524345, 181 MREADD = 0x0000000044444145, 182 MREEXTEND = 0x00444E4554584545, 183 }; 184 185 static bool mrenclave_update(EVP_MD_CTX *ctx, const void *data) 186 { 187 if (!EVP_DigestUpdate(ctx, data, 64)) { 188 fprintf(stderr, "digest update failed\n"); 189 return false; 190 } 191 192 return true; 193 } 194 195 static bool mrenclave_commit(EVP_MD_CTX *ctx, uint8_t *mrenclave) 196 { 197 unsigned int size; 198 199 if (!EVP_DigestFinal_ex(ctx, (unsigned char *)mrenclave, &size)) { 200 fprintf(stderr, "digest commit failed\n"); 201 return false; 202 } 203 204 if (size != 32) { 205 fprintf(stderr, "invalid digest size = %u\n", size); 206 return false; 207 } 208 209 return true; 210 } 211 212 struct mrecreate { 213 uint64_t tag; 214 uint32_t ssaframesize; 215 uint64_t size; 216 uint8_t reserved[44]; 217 } __attribute__((__packed__)); 218 219 220 static bool mrenclave_ecreate(EVP_MD_CTX *ctx, uint64_t blob_size) 221 { 222 struct mrecreate mrecreate; 223 uint64_t encl_size; 224 225 for (encl_size = 0x1000; encl_size < blob_size; ) 226 encl_size <<= 1; 227 228 memset(&mrecreate, 0, sizeof(mrecreate)); 229 mrecreate.tag = MRECREATE; 230 mrecreate.ssaframesize = 1; 231 mrecreate.size = encl_size; 232 233 if (!EVP_DigestInit_ex(ctx, EVP_sha256(), NULL)) 234 return false; 235 236 return mrenclave_update(ctx, &mrecreate); 237 } 238 239 struct mreadd { 240 uint64_t tag; 241 uint64_t offset; 242 uint64_t flags; /* SECINFO flags */ 243 uint8_t reserved[40]; 244 } __attribute__((__packed__)); 245 246 static bool mrenclave_eadd(EVP_MD_CTX *ctx, uint64_t offset, uint64_t flags) 247 { 248 struct mreadd mreadd; 249 250 memset(&mreadd, 0, sizeof(mreadd)); 251 mreadd.tag = MREADD; 252 mreadd.offset = offset; 253 mreadd.flags = flags; 254 255 return mrenclave_update(ctx, &mreadd); 256 } 257 258 struct mreextend { 259 uint64_t tag; 260 uint64_t offset; 261 uint8_t reserved[48]; 262 } __attribute__((__packed__)); 263 264 static bool mrenclave_eextend(EVP_MD_CTX *ctx, uint64_t offset, 265 const uint8_t *data) 266 { 267 struct mreextend mreextend; 268 int i; 269 270 for (i = 0; i < 0x1000; i += 0x100) { 271 memset(&mreextend, 0, sizeof(mreextend)); 272 mreextend.tag = MREEXTEND; 273 mreextend.offset = offset + i; 274 275 if (!mrenclave_update(ctx, &mreextend)) 276 return false; 277 278 if (!mrenclave_update(ctx, &data[i + 0x00])) 279 return false; 280 281 if (!mrenclave_update(ctx, &data[i + 0x40])) 282 return false; 283 284 if (!mrenclave_update(ctx, &data[i + 0x80])) 285 return false; 286 287 if (!mrenclave_update(ctx, &data[i + 0xC0])) 288 return false; 289 } 290 291 return true; 292 } 293 294 static bool mrenclave_segment(EVP_MD_CTX *ctx, struct encl *encl, 295 struct encl_segment *seg) 296 { 297 uint64_t end = seg->size; 298 uint64_t offset; 299 300 for (offset = 0; offset < end; offset += PAGE_SIZE) { 301 if (!mrenclave_eadd(ctx, seg->offset + offset, seg->flags)) 302 return false; 303 304 if (seg->measure) { 305 if (!mrenclave_eextend(ctx, seg->offset + offset, seg->src + offset)) 306 return false; 307 } 308 } 309 310 return true; 311 } 312 313 bool encl_measure(struct encl *encl) 314 { 315 uint64_t header1[2] = {0x000000E100000006, 0x0000000000010000}; 316 uint64_t header2[2] = {0x0000006000000101, 0x0000000100000060}; 317 struct sgx_sigstruct *sigstruct = &encl->sigstruct; 318 struct sgx_sigstruct_payload payload; 319 uint8_t digest[SHA256_DIGEST_LENGTH]; 320 EVP_MD_CTX *ctx = NULL; 321 unsigned int siglen; 322 RSA *key = NULL; 323 int i; 324 325 memset(sigstruct, 0, sizeof(*sigstruct)); 326 327 sigstruct->header.header1[0] = header1[0]; 328 sigstruct->header.header1[1] = header1[1]; 329 sigstruct->header.header2[0] = header2[0]; 330 sigstruct->header.header2[1] = header2[1]; 331 sigstruct->exponent = 3; 332 sigstruct->body.attributes = SGX_ATTR_MODE64BIT; 333 sigstruct->body.xfrm = 3; 334 335 /* sanity check */ 336 if (check_crypto_errors()) 337 goto err; 338 339 key = gen_sign_key(); 340 if (!key) { 341 ERR_print_errors_fp(stdout); 342 goto err; 343 } 344 345 BN_bn2bin(get_modulus(key), sigstruct->modulus); 346 347 ctx = EVP_MD_CTX_create(); 348 if (!ctx) 349 goto err; 350 351 if (!mrenclave_ecreate(ctx, encl->src_size)) 352 goto err; 353 354 for (i = 0; i < encl->nr_segments; i++) { 355 struct encl_segment *seg = &encl->segment_tbl[i]; 356 357 if (!mrenclave_segment(ctx, encl, seg)) 358 goto err; 359 } 360 361 if (!mrenclave_commit(ctx, sigstruct->body.mrenclave)) 362 goto err; 363 364 memcpy(&payload.header, &sigstruct->header, sizeof(sigstruct->header)); 365 memcpy(&payload.body, &sigstruct->body, sizeof(sigstruct->body)); 366 367 SHA256((unsigned char *)&payload, sizeof(payload), digest); 368 369 if (!RSA_sign(NID_sha256, digest, SHA256_DIGEST_LENGTH, 370 sigstruct->signature, &siglen, key)) 371 goto err; 372 373 if (!calc_q1q2(sigstruct->signature, sigstruct->modulus, sigstruct->q1, 374 sigstruct->q2)) 375 goto err; 376 377 /* BE -> LE */ 378 reverse_bytes(sigstruct->signature, SGX_MODULUS_SIZE); 379 reverse_bytes(sigstruct->modulus, SGX_MODULUS_SIZE); 380 381 EVP_MD_CTX_destroy(ctx); 382 RSA_free(key); 383 return true; 384 385 err: 386 if (ctx) 387 EVP_MD_CTX_destroy(ctx); 388 RSA_free(key); 389 return false; 390 } 391