Update SGX task support for remote attestation protected communication

sbip-sg · Dec 13, 2023 · 100f481 · 100f481
1 parent 6325031
commit 100f481
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 0 deletions.
diff --git a/task_executor/README.md b/task_executor/README.md
@@ -74,3 +74,12 @@ use sgx
 ```sh
 curl http://172.18.0.255:2591 -X POST -H "Content-Type: application/json" -d '{"id": "sgx-task:latest", "resource": {"cpu":2, "mem":256}, "input": "{\"value\": \"sbip\"}", "use_sgx": true}'
 ```
+
+Perform RA then send encrypted request
+
+```sh
+curl http://172.18.0.255:2591 -X POST -H "Content-Type: application/json" -d '{"id": "mock-sgx-task:latest", "resource": {"cpu":2, "mem":256}, "input": "SGXRAREQUEST", "use_sgx": true}'
+curl http://172.18.0.255:2591 -X POST -H "Content-Type: application/json" -d '{"id": "mock-sgx-task:latest", "resource": {"cpu":2, "mem":256}, "input": "{\"value\": \"<the-encrypted-task-input>\"}", "use_sgx": true}'
+```
+
+Can use the meca sample repo sgx task direct client to interact with a running mock server task to get a valid encryted input sample for testing.
diff --git a/task_executor/docker_task.go b/task_executor/docker_task.go
@@ -23,6 +23,7 @@ const (
 	dockerInitMark   = "meca-init-done"
 	dockerReadyRetry = 5
 	mecaVnet         = "meca"
+	SGXRAREQUEST     = "SGXRAREQUEST"
 )
 
 var (
@@ -178,8 +179,30 @@ func (t *DockerTask) Init(ctx context.Context, _ string, _ int) error {
 	return nil
 }
 
+func (t *DockerTask) ra(ctx context.Context) ([]byte, error) {
+	// send the request to the task server
+	cli := http.DefaultClient
+	url := fmt.Sprintf("http://%s:8080", t.vIP)
+	if t.useSGX {
+		url = fmt.Sprintf("http://%s:8080/ra", t.vIP)
+	}
+	if resp, err := cli.Get(url); err != nil {
+		return nil, err
+	} else {
+		defer resp.Body.Close()
+		if body, err := io.ReadAll(resp.Body); err != nil {
+			return nil, ErrFailedToDecodeTaskResponse
+		} else {
+			return body, nil
+		}
+	}
+}
+
 // pass the input to the container
 func (t *DockerTask) Execute(ctx context.Context, input []byte) ([]byte, error) {
+	if t.useSGX && bytes.Equal(input, []byte(SGXRAREQUEST)) {
+		return t.ra(ctx)
+	}
 	// send the request to the task server
 	cli := http.DefaultClient
 	url := fmt.Sprintf("http://%s:8080", t.vIP)