{"action":"created","comment":{"url":"https://api.github.com/repos/oscarlab/graphene/pulls/comments/196458870","pull_request_review_id":130014483,"id":196458870,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDE5NjQ1ODg3MA==","diff_hunk":"@@ -244,20 +244,49 @@ int load_trusted_file (PAL_HANDLE file, sgx_stub_t ** stubptr,\n         goto failed;\n \n     for (; offset < tf->size ; offset += TRUSTED_STUB_SIZE, s++) {\n-        uint64_t mapping_size = tf->size - offset;\n-        if (mapping_size > TRUSTED_STUB_SIZE)\n-            mapping_size = TRUSTED_STUB_SIZE;\n+        uint64_t mapping_size = MIN(tf->size - offset, TRUSTED_STUB_SIZE);\n+        LIB_AESCMAC_CONTEXT aes_cmac;\n+        ret = lib_AESCMACInit(&aes_cmac, (uint8_t *) &enclave_key,\n+                              AES_CMAC_KEY_LEN);\n+        if (ret < 0)\n+            goto failed;\n \n         ret = ocall_map_untrusted(fd, offset, mapping_size, PROT_READ, &umem);\n         if (ret < 0)\n             goto unmap;\n \n-        lib_AESCMAC((void *) &enclave_key, AES_CMAC_KEY_LEN, umem,\n-                    mapping_size, (uint8_t *) s, sizeof *s);\n+        /*\n+         * To prevent TOCTOU attack when generating the file checksum, we\n+         * need to copy the file content into the enclave before hashing.\n+         * For optimization, we use a relatively small buffer (1024 byte) to\n+         * store the data for checksum generation.\n+         */\n+\n+#define FILE_CHUNK_SIZE 1024\n+\n+        uint8_t small_chunk[FILE_CHUNK_SIZE]; /* Buffer for hashing */\n+        int chunk_offset = 0;\n+\n+        for (; chunk_offset < mapping_size; chunk_offset += FILE_CHUNK_SIZE) {\n+            uint64_t chunk_size = MIN(mapping_size - chunk_offset, FILE_CHUNK_SIZE);\n+\n+            /* Any file content needs to be copied into the enclave before\n+             * checking and re-hashing */\n+            memcpy(small_chunk, umem + chunk_offset, chunk_size);\n+\n+            /* Update the file checksum */\n+            ret = lib_SHA256Update(&sha, small_chunk, chunk_size);","path":"Pal/src/host/Linux-SGX/enclave_framework.c","position":40,"original_position":40,"commit_id":"def2d408e2ee5727b3d2e716c13b43d850611145","original_commit_id":"def2d408e2ee5727b3d2e716c13b43d850611145","user":{"login":"chiache","id":339249,"node_id":"MDQ6VXNlcjMzOTI0OQ==","avatar_url":"https://avatars0.githubusercontent.com/u/339249?v=4","gravatar_id":"","url":"https://api.github.com/users/chiache","html_url":"https://github.com/chiache","followers_url":"https://api.github.com/users/chiache/followers","following_url":"https://api.github.com/users/chiache/following{/other_user}","gists_url":"https://api.github.com/users/chiache/gists{/gist_id}","starred_url":"https://api.github.com/users/chiache/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chiache/subscriptions","organizations_url":"https://api.github.com/users/chiache/orgs","repos_url":"https://api.github.com/users/chiache/repos","events_url":"https://api.github.com/users/chiache/events{/privacy}","received_events_url":"https://api.github.com/users/chiache/received_events","type":"User","site_admin":false},"body":"For performance. Technically we can use any secure hash algorithm for the Merkel tree, but AES-CMAC is much faster and can use hardware acceleration.","created_at":"2018-06-19T14:55:07Z","updated_at":"2018-06-19T14:55:08Z","html_url":"https://github.com/oscarlab/graphene/pull/131#discussion_r196458870","pull_request_url":"https://api.github.com/repos/oscarlab/graphene/pulls/131","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/oscarlab/graphene/pulls/comments/196458870"},"html":{"href":"https://github.com/oscarlab/graphene/pull/131#discussion_r196458870"},"pull_request":{"href":"https://api.github.com/repos/oscarlab/graphene/pulls/131"}},"in_reply_to_id":196423959},"pull_request":{"url":"https://api.github.com/repos/oscarlab/graphene/pulls/131","id":156302776,"node_id":"MDExOlB1bGxSZXF1ZXN0MTU2MzAyNzc2","html_url":"https://github.com/oscarlab/graphene/pull/131","diff_url":"https://github.com/oscarlab/graphene/pull/131.diff","patch_url":"https://github.com/oscarlab/graphene/pull/131.patch","issue_url":"https://api.github.com/repos/oscarlab/graphene/issues/131","number":131,"state":"open","locked":false,"title":"Address a TOCTTOU vulnerability in SGX read/map","user":{"login":"donporter","id":7039633,"node_id":"MDQ6VXNlcjcwMzk2MzM=","avatar_url":"https://avatars2.githubusercontent.com/u/7039633?v=4","gravatar_id":"","url":"https://api.github.com/users/donporter","html_url":"https://github.com/donporter","followers_url":"https://api.github.com/users/donporter/followers","following_url":"https://api.github.com/users/donporter/following{/other_user}","gists_url":"https://api.github.com/users/donporter/gists{/gist_id}","starred_url":"https://api.github.com/users/donporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/donporter/subscriptions","organizations_url":"https://api.github.com/users/donporter/orgs","repos_url":"https://api.github.com/users/donporter/repos","events_url":"https://api.github.com/users/donporter/events{/privacy}","received_events_url":"https://api.github.com/users/donporter/received_events","type":"User","site_admin":false},"body":"The current SGX PAL checks a file based on the contents in an untrusted buffer.  If the hash passes, the contents are copied in.  This creates a risk of a TOCTTOU race, where the untrusted runtime changes the contents between the hash check and the copy.\r\n\r\nThis patch changes this behavior, where all contents are hashed from in-enclave buffers.  As an optimization, we try to use the final destination when possible.   Because the hashes are calculated in 16K chunks, any sub-blocks require hashing in (in-enclave) scratch space, along with the rest of the data in the 16K chunk, even though the rest of the data is not returned to the user.  This code is also complicated by the fact that for read(), the user provides a buffer, and for map() you are changing the virtual address space, and may have immovable neighbors.\r\n\r\nThis code does pass all of the unit tests on SGX, so I'm reasonably confident it is right, but some of the math is subtle enough that it could use more review, and suggestions for how to simplify this further are also welcome.","created_at":"2017-12-04T20:52:13Z","updated_at":"2018-06-19T14:55:08Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d42797bfc613c9e6bfe6cd88da4ea6aa97232168","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/oscarlab/graphene/pulls/131/commits","review_comments_url":"https://api.github.com/repos/oscarlab/graphene/pulls/131/comments","review_comment_url":"https://api.github.com/repos/oscarlab/graphene/pulls/comments{/number}","comments_url":"https://api.github.com/repos/oscarlab/graphene/issues/131/comments","statuses_url":"https://api.github.com/repos/oscarlab/graphene/statuses/def2d408e2ee5727b3d2e716c13b43d850611145","head":{"label":"oscarlab:issue-107","ref":"issue-107","sha":"def2d408e2ee5727b3d2e716c13b43d850611145","user":{"login":"oscarlab","id":7105811,"node_id":"MDEyOk9yZ2FuaXphdGlvbjcxMDU4MTE=","avatar_url":"https://avatars0.githubusercontent.com/u/7105811?v=4","gravatar_id":"","url":"https://api.github.com/users/oscarlab","html_url":"https://github.com/oscarlab","followers_url":"https://api.github.com/users/oscarlab/followers","following_url":"https://api.github.com/users/oscarlab/following{/other_user}","gists_url":"https://api.github.com/users/oscarlab/gists{/gist_id}","starred_url":"https://api.github.com/users/oscarlab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oscarlab/subscriptions","organizations_url":"https://api.github.com/users/oscarlab/orgs","repos_url":"https://api.github.com/users/oscarlab/repos","events_url":"https://api.github.com/users/oscarlab/events{/privacy}","received_events_url":"https://api.github.com/users/oscarlab/received_events","type":"Organization","site_admin":false},"repo":{"id":18259989,"node_id":"MDEwOlJlcG9zaXRvcnkxODI1OTk4OQ==","name":"graphene","full_name":"oscarlab/graphene","owner":{"login":"oscarlab","id":7105811,"node_id":"MDEyOk9yZ2FuaXphdGlvbjcxMDU4MTE=","avatar_url":"https://avatars0.githubusercontent.com/u/7105811?v=4","gravatar_id":"","url":"https://api.github.com/users/oscarlab","html_url":"https://github.com/oscarlab","followers_url":"https://api.github.com/users/oscarlab/followers","following_url":"https://api.github.com/users/oscarlab/following{/other_user}","gists_url":"https://api.github.com/users/oscarlab/gists{/gist_id}","starred_url":"https://api.github.com/users/oscarlab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oscarlab/subscriptions","organizations_url":"https://api.github.com/users/oscarlab/orgs","repos_url":"https://api.github.com/users/oscarlab/repos","events_url":"https://api.github.com/users/oscarlab/events{/privacy}","received_events_url":"https://api.github.com/users/oscarlab/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/oscarlab/graphene","description":"Graphene / Graphene-SGX Library OS - a library OS for Linux multi-process applications, with Intel SGX support","fork":false,"url":"https://api.github.com/repos/oscarlab/graphene","forks_url":"https://api.github.com/repos/oscarlab/graphene/forks","keys_url":"https://api.github.com/repos/oscarlab/graphene/keys{/key_id}","collaborators_url":"https://api.github.com/repos/oscarlab/graphene/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/oscarlab/graphene/teams","hooks_url":"https://api.github.com/repos/oscarlab/graphene/hooks","issue_events_url":"https://api.github.com/repos/oscarlab/graphene/issues/events{/number}","events_url":"https://api.github.com/repos/oscarlab/graphene/events","assignees_url":"https://api.github.com/repos/oscarlab/graphene/assignees{/user}","branches_url":"https://api.github.com/repos/oscarlab/graphene/branches{/branch}","tags_url":"https://api.github.com/repos/oscarlab/graphene/tags","blobs_url":"https://api.github.com/repos/oscarlab/graphene/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/oscarlab/graphene/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/oscarlab/graphene/git/refs{/sha}","trees_url":"https://api.github.com/repos/oscarlab/graphene/git/trees{/sha}","statuses_url":"https://api.github.com/repos/oscarlab/graphene/statuses/{sha}","languages_url":"https://api.github.com/repos/oscarlab/graphene/languages","stargazers_url":"https://api.github.com/repos/oscarlab/graphene/stargazers","contributors_url":"https://api.github.com/repos/oscarlab/graphene/contributors","subscribers_url":"https://api.github.com/repos/oscarlab/graphene/subscribers","subscription_url":"https://api.github.com/repos/oscarlab/graphene/subscription","commits_url":"https://api.github.com/repos/oscarlab/graphene/commits{/sha}","git_commits_url":"https://api.github.com/repos/oscarlab/graphene/git/commits{/sha}","comments_url":"https://api.github.com/repos/oscarlab/graphene/comments{/number}","issue_comment_url":"https://api.github.com/repos/oscarlab/graphene/issues/comments{/number}","contents_url":"https://api.github.com/repos/oscarlab/graphene/contents/{+path}","compare_url":"https://api.github.com/repos/oscarlab/graphene/compare/{base}...{head}","merges_url":"https://api.github.com/repos/oscarlab/graphene/merges","archive_url":"https://api.github.com/repos/oscarlab/graphene/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/oscarlab/graphene/downloads","issues_url":"https://api.github.com/repos/oscarlab/graphene/issues{/number}","pulls_url":"https://api.github.com/repos/oscarlab/graphene/pulls{/number}","milestones_url":"https://api.github.com/repos/oscarlab/graphene/milestones{/number}","notifications_url":"https://api.github.com/repos/oscarlab/graphene/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/oscarlab/graphene/labels{/name}","releases_url":"https://api.github.com/repos/oscarlab/graphene/releases{/id}","deployments_url":"https://api.github.com/repos/oscarlab/graphene/deployments","created_at":"2014-03-30T07:58:58Z","updated_at":"2018-06-16T21:31:24Z","pushed_at":"2018-06-19T14:17:18Z","git_url":"git://github.com/oscarlab/graphene.git","ssh_url":"git@github.com:oscarlab/graphene.git","clone_url":"https://github.com/oscarlab/graphene.git","svn_url":"https://github.com/oscarlab/graphene","homepage":"https://github.com/oscarlab/graphene/wiki","size":377242,"stargazers_count":149,"watchers_count":149,"language":"C","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":61,"mirror_url":null,"archived":false,"open_issues_count":74,"license":{"key":"lgpl-3.0","name":"GNU Lesser General Public License v3.0","spdx_id":"LGPL-3.0","url":"https://api.github.com/licenses/lgpl-3.0","node_id":"MDc6TGljZW5zZTEy"},"forks":61,"open_issues":74,"watchers":149,"default_branch":"master"}},"base":{"label":"oscarlab:master","ref":"master","sha":"1f2360c857f0f15c89abfb38209456af7f1a74c8","user":{"login":"oscarlab","id":7105811,"node_id":"MDEyOk9yZ2FuaXphdGlvbjcxMDU4MTE=","avatar_url":"https://avatars0.githubusercontent.com/u/7105811?v=4","gravatar_id":"","url":"https://api.github.com/users/oscarlab","html_url":"https://github.com/oscarlab","followers_url":"https://api.github.com/users/oscarlab/followers","following_url":"https://api.github.com/users/oscarlab/following{/other_user}","gists_url":"https://api.github.com/users/oscarlab/gists{/gist_id}","starred_url":"https://api.github.com/users/oscarlab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oscarlab/subscriptions","organizations_url":"https://api.github.com/users/oscarlab/orgs","repos_url":"https://api.github.com/users/oscarlab/repos","events_url":"https://api.github.com/users/oscarlab/events{/privacy}","received_events_url":"https://api.github.com/users/oscarlab/received_events","type":"Organization","site_admin":false},"repo":{"id":18259989,"node_id":"MDEwOlJlcG9zaXRvcnkxODI1OTk4OQ==","name":"graphene","full_name":"oscarlab/graphene","owner":{"login":"oscarlab","id":7105811,"node_id":"MDEyOk9yZ2FuaXphdGlvbjcxMDU4MTE=","avatar_url":"https://avatars0.githubusercontent.com/u/7105811?v=4","gravatar_id":"","url":"https://api.github.com/users/oscarlab","html_url":"https://github.com/oscarlab","followers_url":"https://api.github.com/users/oscarlab/followers","following_url":"https://api.github.com/users/oscarlab/following{/other_user}","gists_url":"https://api.github.com/users/oscarlab/gists{/gist_id}","starred_url":"https://api.github.com/users/oscarlab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oscarlab/subscriptions","organizations_url":"https://api.github.com/users/oscarlab/orgs","repos_url":"https://api.github.com/users/oscarlab/repos","events_url":"https://api.github.com/users/oscarlab/events{/privacy}","received_events_url":"https://api.github.com/users/oscarlab/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/oscarlab/graphene","description":"Graphene / Graphene-SGX Library OS - a library OS for Linux multi-process applications, with Intel SGX support","fork":false,"url":"https://api.github.com/repos/oscarlab/graphene","forks_url":"https://api.github.com/repos/oscarlab/graphene/forks","keys_url":"https://api.github.com/repos/oscarlab/graphene/keys{/key_id}","collaborators_url":"https://api.github.com/repos/oscarlab/graphene/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/oscarlab/graphene/teams","hooks_url":"https://api.github.com/repos/oscarlab/graphene/hooks","issue_events_url":"https://api.github.com/repos/oscarlab/graphene/issues/events{/number}","events_url":"https://api.github.com/repos/oscarlab/graphene/events","assignees_url":"https://api.github.com/repos/oscarlab/graphene/assignees{/user}","branches_url":"https://api.github.com/repos/oscarlab/graphene/branches{/branch}","tags_url":"https://api.github.com/repos/oscarlab/graphene/tags","blobs_url":"https://api.github.com/repos/oscarlab/graphene/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/oscarlab/graphene/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/oscarlab/graphene/git/refs{/sha}","trees_url":"https://api.github.com/repos/oscarlab/graphene/git/trees{/sha}","statuses_url":"https://api.github.com/repos/oscarlab/graphene/statuses/{sha}","languages_url":"https://api.github.com/repos/oscarlab/graphene/languages","stargazers_url":"https://api.github.com/repos/oscarlab/graphene/stargazers","contributors_url":"https://api.github.com/repos/oscarlab/graphene/contributors","subscribers_url":"https://api.github.com/repos/oscarlab/graphene/subscribers","subscription_url":"https://api.github.com/repos/oscarlab/graphene/subscription","commits_url":"https://api.github.com/repos/oscarlab/graphene/commits{/sha}","git_commits_url":"https://api.github.com/repos/oscarlab/graphene/git/commits{/sha}","comments_url":"https://api.github.com/repos/oscarlab/graphene/comments{/number}","issue_comment_url":"https://api.github.com/repos/oscarlab/graphene/issues/comments{/number}","contents_url":"https://api.github.com/repos/oscarlab/graphene/contents/{+path}","compare_url":"https://api.github.com/repos/oscarlab/graphene/compare/{base}...{head}","merges_url":"https://api.github.com/repos/oscarlab/graphene/merges","archive_url":"https://api.github.com/repos/oscarlab/graphene/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/oscarlab/graphene/downloads","issues_url":"https://api.github.com/repos/oscarlab/graphene/issues{/number}","pulls_url":"https://api.github.com/repos/oscarlab/graphene/pulls{/number}","milestones_url":"https://api.github.com/repos/oscarlab/graphene/milestones{/number}","notifications_url":"https://api.github.com/repos/oscarlab/graphene/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/oscarlab/graphene/labels{/name}","releases_url":"https://api.github.com/repos/oscarlab/graphene/releases{/id}","deployments_url":"https://api.github.com/repos/oscarlab/graphene/deployments","created_at":"2014-03-30T07:58:58Z","updated_at":"2018-06-16T21:31:24Z","pushed_at":"2018-06-19T14:17:18Z","git_url":"git://github.com/oscarlab/graphene.git","ssh_url":"git@github.com:oscarlab/graphene.git","clone_url":"https://github.com/oscarlab/graphene.git","svn_url":"https://github.com/oscarlab/graphene","homepage":"https://github.com/oscarlab/graphene/wiki","size":377242,"stargazers_count":149,"watchers_count":149,"language":"C","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":61,"mirror_url":null,"archived":false,"open_issues_count":74,"license":{"key":"lgpl-3.0","name":"GNU Lesser General Public License v3.0","spdx_id":"LGPL-3.0","url":"https://api.github.com/licenses/lgpl-3.0","node_id":"MDc6TGljZW5zZTEy"},"forks":61,"open_issues":74,"watchers":149,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/oscarlab/graphene/pulls/131"},"html":{"href":"https://github.com/oscarlab/graphene/pull/131"},"issue":{"href":"https://api.github.com/repos/oscarlab/graphene/issues/131"},"comments":{"href":"https://api.github.com/repos/oscarlab/graphene/issues/131/comments"},"review_comments":{"href":"https://api.github.com/repos/oscarlab/graphene/pulls/131/comments"},"review_comment":{"href":"https://api.github.com/repos/oscarlab/graphene/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/oscarlab/graphene/pulls/131/commits"},"statuses":{"href":"https://api.github.com/repos/oscarlab/graphene/statuses/def2d408e2ee5727b3d2e716c13b43d850611145"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"chiache"}}