mirror of
https://github.com/clearlinux/graphene.git
synced 2026-08-24 16:16:14 +00:00
Dmitrii Kuvaiskii
caf1263070
Previously, Linux-SGX PAL did not encrypt pipe/socketpair
communication (only process checkpoint send/receive was encrypted).
This commit encrypts all pipe/socketpair IPC between threads of
the same enclave and between enclave processes. In particular, all
offsprings of the "first" enclave inherit the same master key and
derive IPC session keys from this master key based on pipe name.
When two pipe/socketpair endpoints are first created, they establish
a TLS-PSK session via intra-enclave handshake (requires a spawn of
an intermediate enclave thread). During clone/fork/exec, endpoints'
TLS contexts are serialized and sent to the child that deserializes
them (using mbedtls_ssl_context_{save,load} functions).
Note that multicast pipes (with more than two communicating entities)
are not supported since TLS protocol doesn't support it.
This commit modifies the PAL `SendHandle` test to correctly test
pipe communication, as well as adds the LibOS `pipe` test.
48 lines
1.0 KiB
C
48 lines
1.0 KiB
C
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <sys/wait.h>
|
|
#include <unistd.h>
|
|
|
|
int main(int argc, char** argv) {
|
|
int pipefds[2];
|
|
char buffer[1024];
|
|
size_t bufsize = sizeof(buffer);
|
|
|
|
if (pipe(pipefds) < 0) {
|
|
perror("pipe error");
|
|
return 1;
|
|
}
|
|
|
|
int pid = fork();
|
|
|
|
if (pid < 0) {
|
|
perror("fork error");
|
|
return 1;
|
|
} else if (pid == 0) {
|
|
/* client */
|
|
close(pipefds[1]);
|
|
|
|
if (read(pipefds[0], &buffer, bufsize) < 0) {
|
|
perror("read error");
|
|
return 1;
|
|
}
|
|
buffer[bufsize - 1] = '\0';
|
|
|
|
printf("read on pipe: %s\n", buffer);
|
|
} else {
|
|
/* server */
|
|
close(pipefds[0]);
|
|
|
|
snprintf(buffer, bufsize, "Hello from write end of pipe!");
|
|
if (write(pipefds[1], &buffer, strlen(buffer) + 1) < 0) {
|
|
perror("write error");
|
|
return 1;
|
|
}
|
|
|
|
wait(NULL); /* wait for child termination, just for sanity */
|
|
}
|
|
|
|
return 0;
|
|
}
|