CreateAttestationGenerator();
24 |
25 | } // namespace generation
26 | } // namespace attestation
27 | } // namespace trustflow
--------------------------------------------------------------------------------
/trustflow/attestation/generation/wrapper/generator_wrapper_c_api.h:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #pragma once
16 |
17 | #ifdef __cplusplus
18 | extern "C" {
19 | #endif
20 |
21 | /// @brief C API for getting the size of the generated report
22 | /// @param params_buf: [Input] The other report generation parameters buffer.
23 | /// @param params_len: [Input] The length of other report generation parameters.
24 | /// @param report_len: [Output] The max report size
25 | ///
26 | /// @return Error code.
27 | ///
28 | extern int GetAttestationReportSize(const char* params_buf,
29 | const unsigned int params_len,
30 | unsigned int* report_len);
31 |
32 | /// @brief C API for report generation
33 | /// @param params_buf: [Input] The other report generation parameters buffer.
34 | /// @param params_len: [Input] The length of other report generation parameters.
35 | /// @param report_buf: [Output] The output serialized JSON string of the report
36 | /// @param report_len: [Input and Output] The maximal JSON report buffer size as
37 | /// input,
38 | /// and the real JSON report string size as output.
39 | /// @param msg: [Output] The error message if any error occurs.
40 | /// @param msg_len: [Input and Output] The maximal error message buffer size as
41 | /// input.
42 | /// The real error message size as output.
43 | /// @param details: [Output] The detailed error message if any error occurs.
44 | /// @param details_len: [Input and Output] The maximal detailed error message
45 | /// buffer size as input.
46 | /// The real detailed error message size as output.
47 | ///
48 | ///
49 | /// @note All the lengths are memory sizes in bytes. For example, char array[] =
50 | /// "hello" has a length of 6, not 5.
51 | ///
52 | /// @return Error code.
53 | ///
54 | extern int GenerateAttestationReport(const char* params_buf,
55 | const unsigned int params_len,
56 | char* report_buf, unsigned int* report_len,
57 | char* msg, unsigned int* msg_len,
58 | char* details, unsigned int* details_len);
59 |
60 | #ifdef __cplusplus
61 | }
62 | #endif
--------------------------------------------------------------------------------
/trustflow/attestation/sample/generation/BUILD.bazel:
--------------------------------------------------------------------------------
1 | # Copyright 2024 Ant Group Co., Ltd.
2 | #
3 | # Licensed under the Apache License, Version 2.0 (the "License");
4 | # you may not use this file except in compliance with the License.
5 | # You may obtain a copy of the License at
6 | #
7 | # http://www.apache.org/licenses/LICENSE-2.0
8 | #
9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 |
15 | load("@trustflow//bazel:trustflow.bzl", "trustflow_cc_binary")
16 |
17 | package(default_visibility = ["//visibility:public"])
18 |
19 | trustflow_cc_binary(
20 | name = "main",
21 | srcs = ["main.cc"],
22 | deps = [
23 | "//trustflow/attestation/generation/wrapper:generator_wrapper_c_api",
24 | "//trustflow/attestation/utils:json2pb",
25 | "@com_google_absl//absl/strings",
26 | "@sf_apis//:cc_sf_apis_proto",
27 | ],
28 | )
29 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/.gitignore:
--------------------------------------------------------------------------------
1 |
2 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/.gitignore:
--------------------------------------------------------------------------------
1 | /node_modules
2 | /.env.local
3 | /.umirc.local.ts
4 | /config/config.local.ts
5 | /src/.umi
6 | /src/.umi-production
7 | /src/.umi-test
8 | /dist
9 | .swc
10 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/.npmrc:
--------------------------------------------------------------------------------
1 | registry=https://registry.npmmirror.com/
2 |
3 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/.umirc.ts:
--------------------------------------------------------------------------------
1 | import { defineConfig } from "umi";
2 |
3 | export default defineConfig({
4 | routes: [
5 | { path: "/", component: "index" },
6 | ],
7 | npmClient: 'pnpm',
8 | });
9 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/README.md:
--------------------------------------------------------------------------------
1 | # 项目初始化&启动
2 |
3 | ## 环境准备
4 |
5 | 确保正确安装 [Node.js](https://nodejs.org/en/) 且版本为 16+ 即可。
6 |
7 | ```bash
8 | $ node -v
9 | v16.14.2
10 | ```
11 |
12 | 确保已安装[pnpm](https://pnpm.io/installation#using-npm)
13 |
14 | ```bash
15 | $ pnpm -v
16 | 8.8.0
17 | ```
18 |
19 | ## trustflow_verifier.js 准备
20 | 参考 [TrustFlow Attestation Library CMake Build](../../../../REMADME.md#CMake) 构建 `trustflow_verifier.js`
21 |
22 | 将 `trustflow_verifier.js` 拷贝到 `src/pages/index` 目录下
23 |
24 | ## 初始化项目
25 |
26 | 在项目根目录运行
27 |
28 | ```bash
29 | $ pnpm i
30 | ```
31 |
32 | ## 启动项目
33 |
34 | 在项目根目录运行
35 |
36 | ```bash
37 | $ pnpm dev
38 | ```
39 |
40 | 此时访问(http://localhost:8000) 即可进入
41 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/package.json:
--------------------------------------------------------------------------------
1 | {
2 | "private": true,
3 | "author": "霓君",
4 | "scripts": {
5 | "dev": "umi dev",
6 | "build": "umi build",
7 | "postinstall": "umi setup",
8 | "setup": "umi setup",
9 | "start": "npm run dev"
10 | },
11 | "dependencies": {
12 | "antd": "^5.15.1",
13 | "umi": "^4.1.2"
14 | },
15 | "devDependencies": {
16 | "@types/react": "^18.2.64",
17 | "@types/react-dom": "^18.2.21",
18 | "typescript": "^5.4.2"
19 | }
20 | }
21 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/src/layouts/index.less:
--------------------------------------------------------------------------------
1 | .navs {
2 | ul {
3 | padding: 0;
4 | list-style: none;
5 | display: flex;
6 | }
7 | li {
8 | margin-right: 1em;
9 | }
10 | }
11 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/src/layouts/index.tsx:
--------------------------------------------------------------------------------
1 | import { Link, Outlet } from 'umi';
2 | import styles from './index.less';
3 |
4 | export default function Layout() {
5 | return (
6 |
7 |
8 |
9 | );
10 | }
11 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/src/pages/index/.gitignore:
--------------------------------------------------------------------------------
1 | trustflow_verifier.js
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/src/pages/index/index.tsx:
--------------------------------------------------------------------------------
1 | import Verifier from './trustflow_verifier';
2 | import { Input, Button, Form } from 'antd';
3 |
4 | export default function HomePage() {
5 |
6 | const policy = '';
7 |
8 | const [form] = Form.useForm();
9 |
10 | const verify = async (report: string, policy: string) => {
11 | const wasmModule = await Verifier();
12 | console.log(wasmModule);
13 | const res = await wasmModule.ready.then(() => {
14 | const status = wasmModule.evidenceVerify(report, policy);
15 | return status;
16 | });
17 |
18 | return res;
19 | };
20 |
21 | return (
22 |
23 |
Yay! Welcome to WASM RA Test (react sample app)!
24 |
46 |
47 | );
48 | }
49 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/tsconfig.json:
--------------------------------------------------------------------------------
1 | {
2 | "extends": "./src/.umi/tsconfig.json"
3 | }
4 |
--------------------------------------------------------------------------------
/trustflow/attestation/sample/verification/wasm/sample_react_app/typings.d.ts:
--------------------------------------------------------------------------------
1 | import 'umi/typings';
2 |
--------------------------------------------------------------------------------
/trustflow/attestation/utils/BUILD.bazel:
--------------------------------------------------------------------------------
1 | # Copyright 2024 Ant Group Co., Ltd.
2 | #
3 | # Licensed under the Apache License, Version 2.0 (the "License");
4 | # you may not use this file except in compliance with the License.
5 | # You may obtain a copy of the License at
6 | #
7 | # http://www.apache.org/licenses/LICENSE-2.0
8 | #
9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 |
15 | load("@trustflow//bazel:trustflow.bzl", "trustflow_cc_library")
16 |
17 | package(default_visibility = ["//visibility:public"])
18 |
19 | trustflow_cc_library(
20 | name = "json2pb",
21 | hdrs = ["json2pb.h"],
22 | deps = [
23 | "@com_github_grpc_grpc//:grpc++",
24 | "@yacl//yacl/base:exception",
25 | ],
26 | )
27 |
--------------------------------------------------------------------------------
/trustflow/attestation/utils/json2pb.h:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #pragma once
16 |
17 | #include "google/protobuf/util/json_util.h"
18 | #include "yacl/base/exception.h"
19 |
20 | #define PB2JSON(pbmsg, p_jsonstr) \
21 | do { \
22 | ::google::protobuf::util::JsonPrintOptions options; \
23 | options.preserve_proto_field_names = false; \
24 | using google::protobuf::util::MessageToJsonString; \
25 | (p_jsonstr)->clear(); \
26 | auto status = MessageToJsonString((pbmsg), (p_jsonstr), options); \
27 | YACL_ENFORCE(status.ok(), \
28 | "Parsing pb message to json failed, " \
29 | "error: {}", \
30 | status.ToString()); \
31 | } while (0)
32 |
33 | #define JSON2PB(jsonstr, p_pbmsg) \
34 | do { \
35 | using google::protobuf::util::JsonStringToMessage; \
36 | auto status = JsonStringToMessage((jsonstr), (p_pbmsg)); \
37 | YACL_ENFORCE(status.ok(), \
38 | "Parsing json to pb message failed, json: {}, " \
39 | "error: {}", \
40 | jsonstr, status.ToString()); \
41 | } while (0)
42 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/BUILD.bazel:
--------------------------------------------------------------------------------
1 | # Copyright 2024 Ant Group Co., Ltd.
2 | #
3 | # Licensed under the Apache License, Version 2.0 (the "License");
4 | # you may not use this file except in compliance with the License.
5 | # You may obtain a copy of the License at
6 | #
7 | # http://www.apache.org/licenses/LICENSE-2.0
8 | #
9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 |
15 | package(default_visibility = ["//visibility:public"])
16 |
17 | cc_library(
18 | name = "verifier_factory",
19 | hdrs = ["verifier_factory.h"],
20 | deps = [
21 | "//trustflow/attestation/verification/csv:csv_verifier",
22 | "//trustflow/attestation/verification/sgx2:sgx2_verifier",
23 | "//trustflow/attestation/verification/tdx:tdx_verifier",
24 | ],
25 | )
26 |
27 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | add_subdirectory(interface)
2 | add_subdirectory(sgx2)
3 | add_subdirectory(tdx)
4 | add_subdirectory(csv)
5 | add_subdirectory(wrapper)
6 |
7 | if(WASM)
8 |
9 | set(SOURCES wasm_binding.cc)
10 |
11 | add_executable(trustflow_verifier ${SOURCES})
12 | target_link_libraries(trustflow_verifier PUBLIC verifier_wrapper)
13 |
14 | set(WASM_MAIN_BASE_FLAGS "-sMAIN_MODULE=2 -fPIC -fexceptions")
15 | set(WASM_COMMON_FLAGS
16 | "-sALLOW_MEMORY_GROWTH=1 -sSAFE_HEAP=1 -fexceptions -fPIC -Wno-limited-postlink-optimizations -Wno-linkflags -O3"
17 | )
18 | set(WASM_MAIN_NORMAL_FLAGS
19 | "${WASM_COMMON_FLAGS} -sMAIN_MODULE=2 --use-preload-plugins -lembind -sDEFAULT_LIBRARY_FUNCS_TO_INCLUDE=$AsciiToString"
20 | )
21 | set(WASM_MAIN_ASYNC_FLAGS
22 | "${WASM_MAIN_NORMAL_FLAGS} -gsource-map -sASYNCIFY -sASYNCIFY_IMPORTS=['dcap_fetch_proxy'] -sSINGLE_FILE -s EXPORT_ES6=1 -s MODULARIZE=1"
23 | )
24 |
25 | target_link_libraries(trustflow_verifier PUBLIC OpenSSL::Crypto absl::type_traits
26 | absl::symbolize spdlog::spdlog)
27 | set_target_properties(
28 | trustflow_verifier
29 | PROPERTIES COMPILE_FLAGS ${WASM_MAIN_BASE_FLAGS}
30 | LINK_FLAGS "${WASM_MAIN_ASYNC_FLAGS}"
31 | SUFFIX ".js")
32 |
33 | endif()
34 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/csv/BUILD.bazel:
--------------------------------------------------------------------------------
1 | # Copyright 2024 Ant Group Co., Ltd.
2 | #
3 | # Licensed under the Apache License, Version 2.0 (the "License");
4 | # you may not use this file except in compliance with the License.
5 | # You may obtain a copy of the License at
6 | #
7 | # http://www.apache.org/licenses/LICENSE-2.0
8 | #
9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 |
15 | load("@trustflow//bazel:trustflow.bzl", "trustflow_cc_library", "trustflow_cc_test")
16 |
17 | package(default_visibility = ["//visibility:public"])
18 |
19 | trustflow_cc_library(
20 | name = "csv_verifier",
21 | srcs = ["csv_verifier.cc"],
22 | hdrs = ["csv_verifier.h"],
23 | deps = [
24 | "//trustflow/attestation/common:constants",
25 | "//trustflow/attestation/utils:json2pb",
26 | "//trustflow/attestation/verification/interface:verifier",
27 | "@com_google_absl//absl/strings",
28 | "@cppcodec",
29 | "@sf_apis//:cc_sf_apis_proto",
30 | "@trustflow//:hygon_csv_header",
31 | "@yacl//yacl/base:exception",
32 | "@yacl//yacl/crypto:openssl_wrappers",
33 | "@yacl//yacl/crypto/sign:sm2_signing",
34 | ],
35 | )
36 |
37 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/csv/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | set(SOURCES csv_verifier.cc)
2 |
3 | add_library(csv_verifier STATIC ${SOURCES})
4 | target_link_libraries(
5 | csv_verifier
6 | ual_proto
7 | yacl_buffer
8 | cppcodec
9 | yacl_crypto spdlog::spdlog_header_only)
10 |
11 | target_include_directories(csv_verifier PUBLIC ${CSV_HEADER_INCLUDE})
12 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/csv/csv_verifier.h:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #include "csv/attestation/attestation.h"
16 |
17 | #include "trustflow/attestation/verification/interface/verifier.h"
18 |
19 | #include "secretflowapis/v2/sdc/ual.pb.h"
20 |
21 | namespace trustflow {
22 | namespace attestation {
23 | namespace verification {
24 |
25 | class CsvAttestationVerifier : public AttestationVerifier {
26 | public:
27 | explicit CsvAttestationVerifier(const std::string& report_json_str)
28 | : AttestationVerifier(report_json_str) {
29 | Init();
30 | }
31 | explicit CsvAttestationVerifier(
32 | const secretflowapis::v2::sdc::UnifiedAttestationReport& report)
33 | : AttestationVerifier(report) {
34 | Init();
35 | }
36 |
37 | void ParseUnifiedReport(
38 | secretflowapis::v2::sdc::UnifiedAttestationAttributes& attrs) override;
39 |
40 | void VerifyPlatform() override;
41 |
42 | static std::unique_ptr Create(
43 | const secretflowapis::v2::sdc::UnifiedAttestationReport& report) {
44 | return std::make_unique(report);
45 | }
46 |
47 | protected:
48 | void Init();
49 |
50 | private:
51 | // HygonCsvReport contains the following 3 fields:
52 | csv_attestation_report quote_;
53 | CHIP_ROOT_CERT_t hsk_cert_;
54 | CSV_CERT_t cek_cert_;
55 | };
56 |
57 | } // namespace verification
58 | } // namespace attestation
59 | } // namespace trustflow
--------------------------------------------------------------------------------
/trustflow/attestation/verification/interface/BUILD.bazel:
--------------------------------------------------------------------------------
1 | # Copyright 2024 Ant Group Co., Ltd.
2 | #
3 | # Licensed under the Apache License, Version 2.0 (the "License");
4 | # you may not use this file except in compliance with the License.
5 | # You may obtain a copy of the License at
6 | #
7 | # http://www.apache.org/licenses/LICENSE-2.0
8 | #
9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 |
15 | package(default_visibility = ["//visibility:public"])
16 |
17 | cc_library(
18 | name = "verifier",
19 | srcs = ["verifier.cc"],
20 | hdrs = ["verifier.h"],
21 | deps = [
22 | "//trustflow/attestation/utils:json2pb",
23 | "@sf_apis//:cc_sf_apis_proto",
24 | "@yacl//yacl/crypto/hash:ssl_hash",
25 | ],
26 | )
27 |
28 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/interface/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | set(SOURCES verifier.cc)
2 |
3 | add_library(verifier_interface STATIC ${SOURCES})
4 | target_link_libraries(
5 | verifier_interface
6 | ual_proto
7 | yacl_crypto)
8 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/interface/verifier.h:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #pragma once
16 |
17 | #include "trustflow/attestation/utils/json2pb.h"
18 |
19 | #include "secretflowapis/v2/sdc/ual.pb.h"
20 |
21 | namespace trustflow {
22 | namespace attestation {
23 | namespace verification {
24 |
25 | class AttestationVerifier {
26 | public:
27 | virtual ~AttestationVerifier() = default;
28 |
29 | AttestationVerifier(const std::string& report_json_str) {
30 | JSON2PB(report_json_str, &report_);
31 | }
32 |
33 | AttestationVerifier(
34 | const secretflowapis::v2::sdc::UnifiedAttestationReport& report)
35 | : report_(report) {}
36 |
37 | /**
38 | * @brief Parse report to UnifiedAttestationAttributes
39 | *
40 | * @param attrs
41 | */
42 | virtual void ParseUnifiedReport(
43 | secretflowapis::v2::sdc::UnifiedAttestationAttributes& attrs) = 0;
44 |
45 | /**
46 | * @brief Verify platform information
47 | *
48 | */
49 | virtual void VerifyPlatform() = 0;
50 |
51 | static void VerifyAttributes(
52 | const secretflowapis::v2::sdc::UnifiedAttestationAttributes& actual_attrs,
53 | const secretflowapis::v2::sdc::UnifiedAttestationPolicy& policy);
54 |
55 | virtual void VerifyReport(
56 | const secretflowapis::v2::sdc::UnifiedAttestationPolicy& policy);
57 |
58 | protected:
59 | secretflowapis::v2::sdc::UnifiedAttestationReport report_;
60 | };
61 |
62 | } // namespace verification
63 | } // namespace attestation
64 | } // namespace trustflow
65 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/sgx2/BUILD.bazel:
--------------------------------------------------------------------------------
1 | # Copyright 2024 Ant Group Co., Ltd.
2 | #
3 | # Licensed under the Apache License, Version 2.0 (the "License");
4 | # you may not use this file except in compliance with the License.
5 | # You may obtain a copy of the License at
6 | #
7 | # http://www.apache.org/licenses/LICENSE-2.0
8 | #
9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 |
15 | package(default_visibility = ["//visibility:public"])
16 |
17 | cc_library(
18 | name = "sgx2_verifier",
19 | srcs = ["sgx2_verifier.cc"],
20 | hdrs = ["sgx2_verifier.h"],
21 | deps = [
22 | "//trustflow/attestation/common:constants",
23 | "//trustflow/attestation/verification/interface:verifier",
24 | "@cppcodec",
25 | "@dcap//:sgx_dcap_quoteverify",
26 | "@yacl//yacl/crypto/hash:ssl_hash",
27 | ],
28 | )
29 |
30 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/sgx2/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | set(SOURCES sgx2_verifier.cc)
2 |
3 | add_library(sgx2_verifier STATIC ${SOURCES})
4 | target_link_libraries(
5 | sgx2_verifier
6 | ual_proto
7 | yacl_buffer
8 | cppcodec
9 | sgx_headers
10 | dcap::quoteverify
11 | yacl_crypto)
12 | add_dependencies(sgx2_verifier dcap)
13 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/sgx2/sgx2_verifier.h:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #pragma once
16 |
17 | #include "yacl/base/buffer.h"
18 |
19 | #include "trustflow/attestation/verification/interface/verifier.h"
20 |
21 | namespace trustflow {
22 | namespace attestation {
23 | namespace verification {
24 |
25 | class Sgx2AttestationVerifier : public AttestationVerifier {
26 | public:
27 | explicit Sgx2AttestationVerifier(const std::string& report_json_str)
28 | : AttestationVerifier(report_json_str) {
29 | Init();
30 | }
31 |
32 | explicit Sgx2AttestationVerifier(
33 | const secretflowapis::v2::sdc::UnifiedAttestationReport& report)
34 | : AttestationVerifier(report) {
35 | Init();
36 | }
37 |
38 | void ParseUnifiedReport(
39 | secretflowapis::v2::sdc::UnifiedAttestationAttributes& attrs) override;
40 |
41 | void VerifyPlatform() override;
42 |
43 | static std::unique_ptr Create(
44 | const secretflowapis::v2::sdc::UnifiedAttestationReport& report) {
45 | return std::make_unique(report);
46 | }
47 |
48 | protected:
49 | void Init();
50 |
51 | private:
52 | std::vector quote_;
53 | secretflowapis::v2::sdc::SgxQlQveCollateral collateral_;
54 | };
55 |
56 | } // namespace verification
57 | } // namespace attestation
58 | } // namespace trustflow
--------------------------------------------------------------------------------
/trustflow/attestation/verification/tdx/BUILD.bazel:
--------------------------------------------------------------------------------
1 | # Copyright 2024 Ant Group Co., Ltd.
2 | #
3 | # Licensed under the Apache License, Version 2.0 (the "License");
4 | # you may not use this file except in compliance with the License.
5 | # You may obtain a copy of the License at
6 | #
7 | # http://www.apache.org/licenses/LICENSE-2.0
8 | #
9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 |
15 | package(default_visibility = ["//visibility:public"])
16 |
17 | cc_library(
18 | name = "tdx_verifier",
19 | srcs = ["tdx_verifier.cc"],
20 | hdrs = ["tdx_verifier.h"],
21 | deps = [
22 | "//trustflow/attestation/common:constants",
23 | "//trustflow/attestation/verification/interface:verifier",
24 | "@cppcodec",
25 | "@dcap//:sgx_dcap_quoteverify",
26 | "@yacl//yacl/crypto/hash:ssl_hash",
27 | ],
28 | )
29 |
30 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/tdx/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | set(SOURCES tdx_verifier.cc)
2 |
3 | add_library(tdx_verifier STATIC ${SOURCES})
4 | target_link_libraries(
5 | tdx_verifier
6 | ual_proto
7 | yacl_buffer
8 | cppcodec
9 | sgx_headers
10 | dcap::quoteverify
11 | yacl_crypto)
12 | add_dependencies(tdx_verifier dcap)
13 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/tdx/tdx_verifier.h:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #pragma once
16 |
17 | #include "yacl/base/buffer.h"
18 |
19 | #include "trustflow/attestation/verification/interface/verifier.h"
20 |
21 | namespace trustflow {
22 | namespace attestation {
23 | namespace verification {
24 |
25 | class TdxAttestationVerifier : public AttestationVerifier {
26 | public:
27 | explicit TdxAttestationVerifier(const std::string& report_json_str)
28 | : AttestationVerifier(report_json_str) {
29 | Init();
30 | }
31 |
32 | explicit TdxAttestationVerifier(
33 | const secretflowapis::v2::sdc::UnifiedAttestationReport& report)
34 | : AttestationVerifier(report) {
35 | Init();
36 | }
37 |
38 | void ParseUnifiedReport(
39 | secretflowapis::v2::sdc::UnifiedAttestationAttributes& attrs) override;
40 |
41 | void VerifyPlatform() override;
42 |
43 | static std::unique_ptr Create(
44 | const secretflowapis::v2::sdc::UnifiedAttestationReport& report) {
45 | return std::make_unique(report);
46 | }
47 |
48 | protected:
49 | void Init();
50 |
51 | private:
52 | std::vector quote_;
53 | secretflowapis::v2::sdc::SgxQlQveCollateral collateral_;
54 | };
55 |
56 | } // namespace verification
57 | } // namespace attestation
58 | } // namespace trustflow
--------------------------------------------------------------------------------
/trustflow/attestation/verification/verifier_factory.h:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #include
16 |
17 | #include "absl/strings/escaping.h"
18 | #include "yacl/base/exception.h"
19 |
20 | #include "trustflow/attestation/verification/interface/verifier.h"
21 |
22 | namespace trustflow {
23 | namespace attestation {
24 | namespace verification {
25 |
26 | class VerifierFactory {
27 | public:
28 | VerifierFactory() {}
29 | VerifierFactory(const VerifierFactory &) = delete;
30 | VerifierFactory &operator=(const VerifierFactory &) = delete;
31 |
32 | std::unique_ptr Create(
33 | const std::string &report_json_str) {
34 | secretflowapis::v2::sdc::UnifiedAttestationReport report;
35 | JSON2PB(report_json_str, &report);
36 | const std::string &name = report.str_tee_platform();
37 |
38 | std::vector supported_platforms(creators_.size());
39 | std::transform(creators_.begin(), creators_.end(),
40 | supported_platforms.begin(),
41 | [](const auto &pair) { return pair.first; });
42 |
43 | YACL_ENFORCE(creators_.count(name) > 0,
44 | "Supported platform list: {}, but not include {}",
45 | fmt::join(supported_platforms, ", "), name);
46 | return creators_[name](report);
47 | }
48 |
49 | void Register(
50 | const std::string &name,
51 | std::function(
52 | const secretflowapis::v2::sdc::UnifiedAttestationReport &report)>
53 | &&creator) {
54 | creators_[name] = std::move(creator);
55 | }
56 |
57 | protected:
58 | std::unordered_map<
59 | std::string,
60 | std::function(
61 | const secretflowapis::v2::sdc::UnifiedAttestationReport &report)>>
62 | creators_;
63 | };
64 |
65 | } // namespace verification
66 | } // namespace attestation
67 | } // namespace trustflow
--------------------------------------------------------------------------------
/trustflow/attestation/verification/wasm_binding.cc:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #include
16 |
17 | #include "trustflow/attestation/verification/wrapper/verifier_wrapper.h"
18 |
19 | using namespace emscripten;
20 |
21 | // Binding code
22 | EMSCRIPTEN_BINDINGS(trustflow) {
23 | value_object("Status")
24 | .field("code", &trustflow::attestation::Status::code)
25 | .field("message", &trustflow::attestation::Status::message)
26 | .field("details", &trustflow::attestation::Status::details);
27 |
28 | function("evidenceVerify",
29 | &trustflow::attestation::verification::AttestationReportVerify);
30 | }
--------------------------------------------------------------------------------
/trustflow/attestation/verification/wrapper/BUILD.bazel:
--------------------------------------------------------------------------------
1 | # Copyright 2024 Ant Group Co., Ltd.
2 | #
3 | # Licensed under the Apache License, Version 2.0 (the "License");
4 | # you may not use this file except in compliance with the License.
5 | # You may obtain a copy of the License at
6 | #
7 | # http://www.apache.org/licenses/LICENSE-2.0
8 | #
9 | # Unless required by applicable law or agreed to in writing, software
10 | # distributed under the License is distributed on an "AS IS" BASIS,
11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | # See the License for the specific language governing permissions and
13 | # limitations under the License.
14 |
15 | package(default_visibility = ["//visibility:public"])
16 |
17 | cc_library(
18 | name = "verifier_wrapper",
19 | srcs = ["verifier_wrapper.cc"],
20 | hdrs = ["verifier_wrapper.h"],
21 | deps = [
22 | "//trustflow/attestation/common:status",
23 | "//trustflow/attestation/verification:verifier_factory",
24 | "//trustflow/attestation/verification/csv:csv_verifier",
25 | "//trustflow/attestation/verification/sgx2:sgx2_verifier",
26 | "//trustflow/attestation/verification/tdx:tdx_verifier",
27 | ],
28 | )
29 |
30 | cc_library(
31 | name = "verifier_wrapper_c_api",
32 | srcs = ["verifier_wrapper_c_api.cc"],
33 | hdrs = ["verifier_wrapper_c_api.h"],
34 | deps = [
35 | "//trustflow/attestation/common:status",
36 | "//trustflow/attestation/verification:verifier_factory",
37 | "//trustflow/attestation/verification/csv:csv_verifier",
38 | "//trustflow/attestation/verification/sgx2:sgx2_verifier",
39 | "//trustflow/attestation/verification/tdx:tdx_verifier",
40 | ],
41 | )
42 |
43 | cc_binary(
44 | name = "libverification.so",
45 | srcs = ["verifier_wrapper_c_api.cc"],
46 | linkshared = True,
47 | deps = [
48 | ":verifier_wrapper_c_api",
49 | ],
50 | )
51 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/wrapper/CMakeLists.txt:
--------------------------------------------------------------------------------
1 | set(SOURCES verifier_wrapper.cc)
2 |
3 | add_library(verifier_wrapper STATIC ${SOURCES})
4 | target_link_libraries(
5 | verifier_wrapper
6 | verifier_interface
7 | sgx2_verifier
8 | tdx_verifier
9 | csv_verifier
10 | )
11 | add_dependencies(verifier_wrapper dcap)
12 |
--------------------------------------------------------------------------------
/trustflow/attestation/verification/wrapper/verifier_wrapper.cc:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #include "trustflow/attestation/verification/wrapper/verifier_wrapper.h"
16 |
17 | #include "trustflow/attestation/common/constants.h"
18 | #include "trustflow/attestation/utils/json2pb.h"
19 | #include "trustflow/attestation/verification/csv/csv_verifier.h"
20 | #include "trustflow/attestation/verification/sgx2/sgx2_verifier.h"
21 | #include "trustflow/attestation/verification/tdx/tdx_verifier.h"
22 | #include "trustflow/attestation/verification/verifier_factory.h"
23 |
24 | #include "secretflowapis/v2/sdc/ual.pb.h"
25 |
26 | namespace trustflow {
27 | namespace attestation {
28 | namespace verification {
29 |
30 | trustflow::attestation::Status AttestationReportVerify(
31 | const std::string& report_json_str, const std::string& policy_json_str) {
32 | secretflowapis::v2::sdc::UnifiedAttestationPolicy policy;
33 |
34 | trustflow::attestation::Status status = {0, "success", ""};
35 | try {
36 | VerifierFactory factory;
37 | factory.Register(Platform::kPlatformTdx, &TdxAttestationVerifier::Create);
38 | factory.Register(Platform::kPlatformSgxDcap,
39 | &Sgx2AttestationVerifier::Create);
40 | factory.Register(Platform::kPlatformCsv, &CsvAttestationVerifier::Create);
41 |
42 | JSON2PB(policy_json_str, &policy);
43 | factory.Create(report_json_str)->VerifyReport(policy);
44 | } catch (const yacl::ArgumentError& ex) {
45 | status.code =
46 | static_cast(trustflow::attestation::ErrorCode::kArgumentError);
47 | status.message = ex.what();
48 | status.details = ex.stack_trace();
49 | } catch (const yacl::InvalidFormat& ex) {
50 | status.code =
51 | static_cast(trustflow::attestation::ErrorCode::kInvalidFormat);
52 | status.message = ex.what();
53 | status.details = ex.stack_trace();
54 | } catch (const yacl::Exception& ex) {
55 | status.code =
56 | static_cast(trustflow::attestation::ErrorCode::kInternalError);
57 | status.message = ex.what();
58 | status.details = ex.stack_trace();
59 | } catch (const std::exception& ex) {
60 | status.code =
61 | static_cast(trustflow::attestation::ErrorCode::kInternalError);
62 | status.message = ex.what();
63 | }
64 | return status;
65 | }
66 |
67 | } // namespace verification
68 | } // namespace attestation
69 | } // namespace trustflow
--------------------------------------------------------------------------------
/trustflow/attestation/verification/wrapper/verifier_wrapper.h:
--------------------------------------------------------------------------------
1 | // Copyright 2024 Ant Group Co., Ltd.
2 | //
3 | // Licensed under the Apache License, Version 2.0 (the "License");
4 | // you may not use this file except in compliance with the License.
5 | // You may obtain a copy of the License at
6 | //
7 | // http://www.apache.org/licenses/LICENSE-2.0
8 | //
9 | // Unless required by applicable law or agreed to in writing, software
10 | // distributed under the License is distributed on an "AS IS" BASIS,
11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 | // See the License for the specific language governing permissions and
13 | // limitations under the License.
14 |
15 | #pragma once
16 |
17 | #include "trustflow/attestation/common/status.h"
18 |
19 | namespace trustflow {
20 | namespace attestation {
21 | namespace verification {
22 |
23 | trustflow::attestation::Status AttestationReportVerify(
24 | const std::string& report_json_str, const std::string& policy_json_str);
25 |
26 | } // namespace verification
27 | } // namespace attestation
28 | } // namespace trustflow
29 |
--------------------------------------------------------------------------------