Skip to content

Commit cdb1c68

Browse files
csegarragonzcsegarragonz
authored
sgx-faasm: resurrect and add cold-start experiments (#16)
* wip * cleanup * refactor workflows * accless: run clang format * docker: get cli into experiments * more work * more wip * as: fix key exchange and encryption * accless: implement key exchange w/ self-hosted as * refactor * more ansible work * invrs: add cold-start structure for faasm * finish cold-start for faasm * add plot and data * update docs * run cargo fmt * self-review * ansible: remove branch
1 parent 454e90c commit cdb1c68

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

83 files changed

+3237
-1928
lines changed

‎accless/.clang-format‎

Lines changed: 246 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,246 @@
1+
---
2+
Language: Cpp
3+
# BasedOnStyle: LLVM
4+
AccessModifierOffset: -2
5+
AlignAfterOpenBracket: Align
6+
AlignArrayOfStructures: None
7+
AlignConsecutiveAssignments:
8+
Enabled: false
9+
AcrossEmptyLines: false
10+
AcrossComments: false
11+
AlignCompound: false
12+
AlignFunctionPointers: false
13+
PadOperators: true
14+
AlignConsecutiveBitFields:
15+
Enabled: false
16+
AcrossEmptyLines: false
17+
AcrossComments: false
18+
AlignCompound: false
19+
AlignFunctionPointers: false
20+
PadOperators: false
21+
AlignConsecutiveDeclarations:
22+
Enabled: false
23+
AcrossEmptyLines: false
24+
AcrossComments: false
25+
AlignCompound: false
26+
AlignFunctionPointers: false
27+
PadOperators: false
28+
AlignConsecutiveMacros:
29+
Enabled: false
30+
AcrossEmptyLines: false
31+
AcrossComments: false
32+
AlignCompound: false
33+
AlignFunctionPointers: false
34+
PadOperators: false
35+
AlignConsecutiveShortCaseStatements:
36+
Enabled: false
37+
AcrossEmptyLines: false
38+
AcrossComments: false
39+
AlignCaseColons: false
40+
AlignEscapedNewlines: Right
41+
AlignOperands: Align
42+
AlignTrailingComments:
43+
Kind: Always
44+
OverEmptyLines: 0
45+
AllowAllArgumentsOnNextLine: true
46+
AllowAllParametersOfDeclarationOnNextLine: true
47+
AllowBreakBeforeNoexceptSpecifier: Never
48+
AllowShortBlocksOnASingleLine: Never
49+
AllowShortCaseLabelsOnASingleLine: false
50+
AllowShortCompoundRequirementOnASingleLine: true
51+
AllowShortEnumsOnASingleLine: true
52+
AllowShortFunctionsOnASingleLine: All
53+
AllowShortIfStatementsOnASingleLine: Never
54+
AllowShortLambdasOnASingleLine: All
55+
AllowShortLoopsOnASingleLine: false
56+
AlwaysBreakAfterDefinitionReturnType: None
57+
AlwaysBreakAfterReturnType: None
58+
AlwaysBreakBeforeMultilineStrings: false
59+
AlwaysBreakTemplateDeclarations: MultiLine
60+
AttributeMacros:
61+
- __capability
62+
BinPackArguments: true
63+
BinPackParameters: true
64+
BitFieldColonSpacing: Both
65+
BraceWrapping:
66+
AfterCaseLabel: false
67+
AfterClass: false
68+
AfterControlStatement: Never
69+
AfterEnum: false
70+
AfterExternBlock: false
71+
AfterFunction: false
72+
AfterNamespace: false
73+
AfterObjCDeclaration: false
74+
AfterStruct: false
75+
AfterUnion: false
76+
BeforeCatch: false
77+
BeforeElse: false
78+
BeforeLambdaBody: false
79+
BeforeWhile: false
80+
IndentBraces: false
81+
SplitEmptyFunction: true
82+
SplitEmptyRecord: true
83+
SplitEmptyNamespace: true
84+
BreakAdjacentStringLiterals: true
85+
BreakAfterAttributes: Leave
86+
BreakAfterJavaFieldAnnotations: false
87+
BreakArrays: true
88+
BreakBeforeBinaryOperators: None
89+
BreakBeforeConceptDeclarations: Always
90+
BreakBeforeBraces: Attach
91+
BreakBeforeInlineASMColon: OnlyMultiline
92+
BreakBeforeTernaryOperators: true
93+
BreakConstructorInitializers: BeforeColon
94+
BreakInheritanceList: BeforeColon
95+
BreakStringLiterals: true
96+
ColumnLimit: 80
97+
CommentPragmas: '^ IWYU pragma:'
98+
CompactNamespaces: false
99+
ConstructorInitializerIndentWidth: 4
100+
ContinuationIndentWidth: 4
101+
Cpp11BracedListStyle: true
102+
DerivePointerAlignment: false
103+
DisableFormat: false
104+
EmptyLineAfterAccessModifier: Never
105+
EmptyLineBeforeAccessModifier: LogicalBlock
106+
ExperimentalAutoDetectBinPacking: false
107+
FixNamespaceComments: true
108+
ForEachMacros:
109+
- foreach
110+
- Q_FOREACH
111+
- BOOST_FOREACH
112+
IfMacros:
113+
- KJ_IF_MAYBE
114+
IncludeBlocks: Preserve
115+
IncludeCategories:
116+
- Regex: '^"(llvm|llvm-c|clang|clang-c)/'
117+
Priority: 2
118+
SortPriority: 0
119+
CaseSensitive: false
120+
- Regex: '^(<|"(gtest|gmock|isl|json)/)'
121+
Priority: 3
122+
SortPriority: 0
123+
CaseSensitive: false
124+
- Regex: '.*'
125+
Priority: 1
126+
SortPriority: 0
127+
CaseSensitive: false
128+
IncludeIsMainRegex: '(Test)?$'
129+
IncludeIsMainSourceRegex: ''
130+
IndentAccessModifiers: false
131+
IndentCaseBlocks: false
132+
IndentCaseLabels: false
133+
IndentExternBlock: AfterExternBlock
134+
IndentGotoLabels: true
135+
IndentPPDirectives: None
136+
IndentRequiresClause: true
137+
IndentWidth: 4
138+
IndentWrappedFunctionNames: false
139+
InsertBraces: false
140+
InsertNewlineAtEOF: false
141+
InsertTrailingCommas: None
142+
IntegerLiteralSeparator:
143+
Binary: 0
144+
BinaryMinDigits: 0
145+
Decimal: 0
146+
DecimalMinDigits: 0
147+
Hex: 0
148+
HexMinDigits: 0
149+
JavaScriptQuotes: Leave
150+
JavaScriptWrapImports: true
151+
KeepEmptyLinesAtTheStartOfBlocks: true
152+
KeepEmptyLinesAtEOF: false
153+
LambdaBodyIndentation: Signature
154+
LineEnding: DeriveLF
155+
MacroBlockBegin: ''
156+
MacroBlockEnd: ''
157+
MaxEmptyLinesToKeep: 1
158+
NamespaceIndentation: None
159+
ObjCBinPackProtocolList: Auto
160+
ObjCBlockIndentWidth: 2
161+
ObjCBreakBeforeNestedBlockParam: true
162+
ObjCSpaceAfterProperty: false
163+
ObjCSpaceBeforeProtocolList: true
164+
PackConstructorInitializers: BinPack
165+
PenaltyBreakAssignment: 2
166+
PenaltyBreakBeforeFirstCallParameter: 19
167+
PenaltyBreakComment: 300
168+
PenaltyBreakFirstLessLess: 120
169+
PenaltyBreakOpenParenthesis: 0
170+
PenaltyBreakScopeResolution: 500
171+
PenaltyBreakString: 1000
172+
PenaltyBreakTemplateDeclaration: 10
173+
PenaltyExcessCharacter: 1000000
174+
PenaltyIndentedWhitespace: 0
175+
PenaltyReturnTypeOnItsOwnLine: 60
176+
PointerAlignment: Right
177+
PPIndentWidth: -1
178+
QualifierAlignment: Leave
179+
ReferenceAlignment: Pointer
180+
ReflowComments: true
181+
RemoveBracesLLVM: false
182+
RemoveParentheses: Leave
183+
RemoveSemicolon: false
184+
RequiresClausePosition: OwnLine
185+
RequiresExpressionIndentation: OuterScope
186+
SeparateDefinitionBlocks: Leave
187+
ShortNamespaceLines: 1
188+
SkipMacroDefinitionBody: false
189+
SortIncludes: CaseSensitive
190+
SortJavaStaticImport: Before
191+
SortUsingDeclarations: LexicographicNumeric
192+
SpaceAfterCStyleCast: false
193+
SpaceAfterLogicalNot: false
194+
SpaceAfterTemplateKeyword: true
195+
SpaceAroundPointerQualifiers: Default
196+
SpaceBeforeAssignmentOperators: true
197+
SpaceBeforeCaseColon: false
198+
SpaceBeforeCpp11BracedList: false
199+
SpaceBeforeCtorInitializerColon: true
200+
SpaceBeforeInheritanceColon: true
201+
SpaceBeforeJsonColon: false
202+
SpaceBeforeParens: ControlStatements
203+
SpaceBeforeParensOptions:
204+
AfterControlStatements: true
205+
AfterForeachMacros: true
206+
AfterFunctionDefinitionName: false
207+
AfterFunctionDeclarationName: false
208+
AfterIfMacros: true
209+
AfterOverloadedOperator: false
210+
AfterPlacementOperator: true
211+
AfterRequiresInClause: false
212+
AfterRequiresInExpression: false
213+
BeforeNonEmptyParentheses: false
214+
SpaceBeforeRangeBasedForLoopColon: true
215+
SpaceBeforeSquareBrackets: false
216+
SpaceInEmptyBlock: false
217+
SpacesBeforeTrailingComments: 1
218+
SpacesInAngles: Never
219+
SpacesInContainerLiterals: true
220+
SpacesInLineCommentPrefix:
221+
Minimum: 1
222+
Maximum: -1
223+
SpacesInParens: Never
224+
SpacesInParensOptions:
225+
InCStyleCasts: false
226+
InConditionalStatements: false
227+
InEmptyParentheses: false
228+
Other: false
229+
SpacesInSquareBrackets: false
230+
Standard: Latest
231+
StatementAttributeLikeMacros:
232+
- Q_EMIT
233+
StatementMacros:
234+
- Q_UNUSED
235+
- QT_REQUIRE_VERSION
236+
TabWidth: 4
237+
UseTab: Never
238+
VerilogBreakBetweenInstancePorts: true
239+
WhitespaceSensitiveMacros:
240+
- BOOST_PP_STRINGIZE
241+
- CF_SWIFT_NAME
242+
- NS_SWIFT_NAME
243+
- PP_STRINGIZE
244+
- STRINGIZE
245+
...
246+

‎accless/CMakeLists.txt‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# -----------------------------------------------------------------------------
2+
# Accless access control C++ library
3+
#
4+
# This library supports native compilation and cross-compilation to WebAssembly.
5+
# Each version of the library has slightly different features:
6+
# - Native:
7+
# - library to interact with S3 KV
8+
# - library to fetch a cVM's attestation from a vTPM on Azure
9+
# - WASM:
10+
# -----------------------------------------------------------------------------
11+
12+
cmake_minimum_required(VERSION 3.8.0)
13+
project(accless)
14+
15+
set(CMAKE_PROJECT_TARGET accless)
16+
set(CMAKE_CXX_STANDARD 20)
17+
set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
18+
19+
add_library(${CMAKE_PROJECT_TARGET}
20+
./src/accless.cpp
21+
./src/dag.cpp
22+
./src/utils.cpp
23+
)
24+
25+
# TODO: for the time being we need to comment this if out if we want UBENCH
26+
# in WASM because there is no easy way to pass CMake vars to `wasm_cmake` in
27+
# faasmtools
28+
if (ACCLESS_UBENCH)
29+
target_compile_definitions(${CMAKE_PROJECT_TARGET} PUBLIC ACCLESS_UBENCH)
30+
endif ()
31+
32+
if (CMAKE_SYSTEM_NAME STREQUAL "WASI")
33+
# The WASM version of the library relies on a pre-populated sysroot as part
34+
# of a Faasm installation
35+
set(ACCLESS_LIBRARIES
36+
faasm
37+
rabe-cpp
38+
rabe
39+
tless-jwt-cpp
40+
tless-jwt
41+
)
42+
43+
set(ACCLESS_HEADERS ${CMAKE_CURRENT_LIST_DIR}/include)
44+
else ()
45+
add_subdirectory(./libs/s3)
46+
47+
set(ACCLESS_LIBRARIES
48+
accless::s3
49+
# Order matters: librabe-cpp must preceede librabe
50+
"/usr/local/lib/rabe/librabe-cpp.a"
51+
"/usr/local/lib/rabe/librabe.a"
52+
)
53+
set(ACCLESS_HEADERS
54+
${CMAKE_CURRENT_LIST_DIR}/include
55+
${CMAKE_CURRENT_LIST_DIR}/libs
56+
"/usr/include/rabe"
57+
)
58+
endif()
59+
60+
target_include_directories(${CMAKE_PROJECT_TARGET} PUBLIC ${ACCLESS_HEADERS})
61+
target_link_libraries(${CMAKE_PROJECT_TARGET} PUBLIC ${ACCLESS_LIBRARIES})
62+
63+
if (CMAKE_SYSTEM_NAME STREQUAL "WASI")
64+
# Manually install the .imports file so that we can link against it
65+
add_custom_command(
66+
TARGET ${CMAKE_PROJECT_TARGET}
67+
POST_BUILD
68+
COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_LIST_DIR}/libaccless.imports ${CMAKE_CURRENT_BINARY_DIR}/libaccless.imports
69+
COMMENT "Created ${PROJECT_BINARY_DIR}/libaccless.imports"
70+
)
71+
endif ()
72+
73+
add_library(accless::accless ALIAS accless)

workflows/libs/tless/tless.h renamed to accless/include/accless.h

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,17 @@
1010
// mr_enclave in the SGX report has type sgx_measurement_t which is a SHA256
1111
// digest (see sgx_report.h)
1212
#define MRENCLAVE_SIZE 32
13-
#define ATT_PROVIDER_JKU "https://faasmattprov.eus2.attest.azure.net/certs"
13+
#define ATT_PROVIDER_AUD "accless-attestation-service"
14+
#define ATT_PROVIDER_SUB "attested-client"
1415

1516
// We define with C-linkage all the external symbols that a TLess ECF needs
1617
// from the runtime environment. These are implemented by the runtime outside
1718
// of WASM. For correct WASM linkage, these symbols also need to be listed in
1819
// workflows/libs/tless/libtless.imports
1920
extern "C" {
20-
int32_t __tless_is_enabled();
21-
void __tless_get_attestation_jwt(char** jwt, int32_t* jwtSize);
22-
void __tless_get_mrenclave(uint8_t* buf, int32_t bufSize);
21+
int32_t __accless_is_enabled();
22+
void __accless_get_attestation_jwt(char **jwt, int32_t *jwtSize);
23+
void __accless_get_mrenclave(uint8_t *buf, int32_t bufSize);
2324
}
2425
#endif
2526

@@ -29,26 +30,24 @@ void __tless_get_mrenclave(uint8_t* buf, int32_t bufSize);
2930
* - Decrypt/Encrypt function input/output
3031
* - Decrypt/Encrypt S3 input/output
3132
*/
32-
namespace tless {
33+
namespace accless {
3334
// Return whether we must use TLess chaining protection mechanisms or not
3435
bool on();
3536

3637
// Validate that the attested call chain is consistent with the DAG and with
3738
// the function we are executing (i.e. us). This method is the main entrypoint
3839
// implementing the chaining validation protocol from the paper. For a
3940
// detailed explanation of the protocol, see the comment in the source file
40-
bool checkChain(const std::string& workflow, const std::string& function, int id);
41+
bool checkChain(const std::string &workflow, const std::string &function,
42+
int id);
4143

4244
// Chain a function by name, and return the function id to wait-on
43-
int32_t chain(const std::string& workflow,
44-
const std::string& parentFuncName,
45-
int parentIdx,
46-
const std::string& funcName,
47-
int idx,
48-
const std::string& inputData);
45+
int32_t chain(const std::string &workflow, const std::string &parentFuncName,
46+
int parentIdx, const std::string &funcName, int idx,
47+
const std::string &inputData);
4948

5049
#ifdef __faasm
5150
// Wait for a function by its id, and get its output and return code
52-
std::pair<int, std::string> wait(int32_t functionId, bool ignoreOutput=false);
51+
std::pair<int, std::string> wait(int32_t functionId, bool ignoreOutput = false);
5352
#endif
54-
}
53+
} // namespace tless

0 commit comments

Comments
 (0)