Skip to content

Commit c79711a

Browse files
jbern0rdjbern0rd
authored
feat: enforce String serialization for TEE sessions tokens values (#319)
1 parent 0b596f5 commit c79711a

File tree

7 files changed

+51
-53
lines changed

7 files changed

+51
-53
lines changed

‎src/main/java/com/iexec/sms/tee/session/base/SecretEnclaveBase.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2022-2023 IEXEC BLOCKCHAIN TECH
2+
* Copyright 2022-2025 IEXEC BLOCKCHAIN TECH
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -30,5 +30,5 @@ public class SecretEnclaveBase {
3030
@JsonProperty("mrenclave")
3131
String mrenclave;
3232
@JsonProperty("environment")
33-
Map<String, Object> environment;
33+
Map<String, String> environment;
3434
}

‎src/main/java/com/iexec/sms/tee/session/base/SecretSessionBaseService.java‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ private List<DatasetOrder> fetchDatasetOrders(final TaskDescription taskDescript
188188
}
189189
}
190190

191-
private Map<String, Object> getBulkDatasetTokens(final int index,
191+
private Map<String, String> getBulkDatasetTokens(final int index,
192192
final TaskDescription taskDescription,
193193
final DatasetOrder datasetOrder) {
194194
final String prefix = IEXEC_DATASET_PREFIX + (index + 1);
@@ -235,17 +235,17 @@ boolean isBulkDatasetOrderCompatibleWithDeal(final DatasetOrder datasetOrder, fi
235235
SecretEnclaveBase getPreComputeTokens(final TeeSessionRequest request, final Map<String, String> signTokens) throws TeeSessionGenerationException {
236236
final SecretEnclaveBaseBuilder enclaveBase = SecretEnclaveBase.builder();
237237
enclaveBase.name("pre-compute");
238-
final Map<String, Object> tokens = new HashMap<>();
238+
final Map<String, String> tokens = new HashMap<>();
239239
final TaskDescription taskDescription = request.getTaskDescription();
240240
final String taskId = taskDescription.getChainTaskId();
241241
enclaveBase.mrenclave(request.getTeeServicesProperties().getPreComputeProperties().getFingerprint());
242242
tokens.put(IEXEC_PRE_COMPUTE_OUT.name(), IexecFileHelper.SLASH_IEXEC_IN);
243243
// `IS_DATASET_REQUIRED` still meaningful?
244-
tokens.put(IS_DATASET_REQUIRED.name(), taskDescription.containsDataset());
244+
tokens.put(IS_DATASET_REQUIRED.name(), String.valueOf(taskDescription.containsDataset()));
245245

246246
if (taskDescription.isBulkRequest()) {
247247
final List<DatasetOrder> orders = fetchDatasetOrders(taskDescription);
248-
tokens.put(IEXEC_BULK_SLICE_SIZE.name(), orders.size());
248+
tokens.put(IEXEC_BULK_SLICE_SIZE.name(), String.valueOf(orders.size()));
249249
for (int i = 0; i < orders.size(); i++) {
250250
final DatasetOrder order = orders.get(i);
251251
tokens.putAll(getBulkDatasetTokens(i, taskDescription, order));
@@ -307,7 +307,7 @@ SecretEnclaveBase getAppTokens(final TeeSessionRequest request) throws TeeSessio
307307
enclaveBase.name("app");
308308
final TaskDescription taskDescription = request.getTaskDescription();
309309

310-
final Map<String, Object> tokens = new HashMap<>();
310+
final Map<String, String> tokens = new HashMap<>();
311311
final TeeEnclaveConfiguration enclaveConfig = taskDescription.getAppEnclaveConfiguration();
312312
if (enclaveConfig == null) {
313313
throw new TeeSessionGenerationException(
@@ -323,7 +323,7 @@ SecretEnclaveBase getAppTokens(final TeeSessionRequest request) throws TeeSessio
323323

324324
enclaveBase.mrenclave(enclaveConfig.getFingerprint());
325325

326-
final Map<String, Object> computeSecrets = getApplicationComputeSecrets(taskDescription);
326+
final Map<String, String> computeSecrets = getApplicationComputeSecrets(taskDescription);
327327
tokens.putAll(computeSecrets);
328328
// trusted env variables (not confidential)
329329
tokens.putAll(IexecEnvUtils.getComputeStageEnvMap(taskDescription));
@@ -332,7 +332,7 @@ SecretEnclaveBase getAppTokens(final TeeSessionRequest request) throws TeeSessio
332332
final List<String> addresses = fetchDatasetOrders(taskDescription).stream()
333333
.map(DatasetOrder::getDataset)
334334
.toList();
335-
tokens.put(IEXEC_BULK_SLICE_SIZE.name(), addresses.size());
335+
tokens.put(IEXEC_BULK_SLICE_SIZE.name(), String.valueOf(addresses.size()));
336336
for (int i = 0; i < addresses.size(); i++) {
337337
tokens.put(IEXEC_DATASET_PREFIX + (i + 1) + IEXEC_DATASET_FILENAME_SUFFIX, addresses.get(i));
338338
}
@@ -356,8 +356,8 @@ SecretEnclaveBase getAppTokens(final TeeSessionRequest request) throws TeeSessio
356356
* @param taskDescription A task description
357357
* @return A {@code Map} containing secrets retrieved from the database.
358358
*/
359-
private Map<String, Object> getApplicationComputeSecrets(final TaskDescription taskDescription) {
360-
final Map<String, Object> tokens = new HashMap<>();
359+
private Map<String, String> getApplicationComputeSecrets(final TaskDescription taskDescription) {
360+
final Map<String, String> tokens = new HashMap<>();
361361
final List<TeeTaskComputeSecretHeader> ids = getAppComputeSecretsHeaders(taskDescription);
362362
log.debug("TeeTaskComputeSecret looking for secrets [chainTaskId:{}, count:{}]",
363363
taskDescription.getChainTaskId(), ids.size());
@@ -434,7 +434,7 @@ SecretEnclaveBase getPostComputeTokens(final TeeSessionRequest request, final Ma
434434
final SecretEnclaveBaseBuilder enclaveBase = SecretEnclaveBase.builder()
435435
.name("post-compute")
436436
.mrenclave(request.getTeeServicesProperties().getPostComputeProperties().getFingerprint());
437-
final Map<String, Object> tokens = new HashMap<>();
437+
final Map<String, String> tokens = new HashMap<>();
438438
final TaskDescription taskDescription = request.getTaskDescription();
439439
final List<Web2SecretHeader> ids = getPostComputeSecretHeaders(taskDescription, request.getWorkerAddress());
440440
log.debug("Web2Secret looking for secrets [chainTaskId:{}, count:{}]",

‎src/main/java/com/iexec/sms/tee/session/gramine/GramineSessionMakerService.java‎

Lines changed: 11 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2022-2023 IEXEC BLOCKCHAIN TECH
2+
* Copyright 2022-2025 IEXEC BLOCKCHAIN TECH
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -37,7 +37,7 @@ public class GramineSessionMakerService {
3737

3838
private final SecretSessionBaseService secretSessionBaseService;
3939

40-
public GramineSessionMakerService(SecretSessionBaseService secretSessionBaseService) {
40+
public GramineSessionMakerService(final SecretSessionBaseService secretSessionBaseService) {
4141
this.secretSessionBaseService = secretSessionBaseService;
4242
}
4343

@@ -49,29 +49,25 @@ public GramineSessionMakerService(SecretSessionBaseService secretSessionBaseServ
4949
* @return session config
5050
*/
5151
@NonNull
52-
public GramineSession generateSession(TeeSessionRequest request) throws TeeSessionGenerationException {
53-
SecretSessionBase baseSession = secretSessionBaseService.getSecretsTokens(request);
54-
GramineSessionBuilder gramineSession = GramineSession.builder()
52+
public GramineSession generateSession(final TeeSessionRequest request) throws TeeSessionGenerationException {
53+
final SecretSessionBase baseSession = secretSessionBaseService.getSecretsTokens(request);
54+
final GramineSessionBuilder gramineSession = GramineSession.builder()
5555
.session(request.getSessionId());
56-
GramineEnclave gramineAppEnclave = toGramineEnclave(baseSession.getAppCompute());
57-
GramineEnclave graminePostEnclave = toGramineEnclave(baseSession.getPostCompute());
56+
final GramineEnclave gramineAppEnclave = toGramineEnclave(baseSession.getAppCompute());
57+
final GramineEnclave graminePostEnclave = toGramineEnclave(baseSession.getPostCompute());
5858

59-
return gramineSession.enclaves(List.of(
60-
// No pre-compute for now
61-
gramineAppEnclave,
62-
graminePostEnclave))
59+
// No pre-compute for now
60+
return gramineSession
61+
.enclaves(List.of(gramineAppEnclave, graminePostEnclave))
6362
.build();
6463
}
6564

66-
private GramineEnclave toGramineEnclave(SecretEnclaveBase enclaveBase) {
65+
private GramineEnclave toGramineEnclave(final SecretEnclaveBase enclaveBase) {
6766
return GramineEnclave.builder()
6867
.name(enclaveBase.getName())
6968
.mrenclave(enclaveBase.getMrenclave())
70-
// TODO: Validate command-line arguments from the host
71-
// (https://github.com/gramineproject/gsc/issues/13)
7269
.command("")
7370
.environment(enclaveBase.getEnvironment())
74-
// TODO: Remove useless volumes when SPS is ready
7571
.volumes(List.of())
7672
.build();
7773
}

‎src/main/java/com/iexec/sms/tee/session/gramine/sps/GramineEnclave.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2022-2023 IEXEC BLOCKCHAIN TECH
2+
* Copyright 2022-2025 IEXEC BLOCKCHAIN TECH
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -17,7 +17,8 @@
1717
package com.iexec.sms.tee.session.gramine.sps;
1818

1919
import com.fasterxml.jackson.annotation.JsonProperty;
20-
import lombok.*;
20+
import lombok.Builder;
21+
import lombok.Value;
2122

2223
import java.util.List;
2324
import java.util.Map;
@@ -33,7 +34,7 @@ public class GramineEnclave {
3334
@JsonProperty("command")
3435
String command;
3536
@JsonProperty("environment")
36-
Map<String, Object> environment;
37+
Map<String, String> environment;
3738
@JsonProperty("volumes")
3839
List<String> volumes;
3940

‎src/main/java/com/iexec/sms/tee/session/scone/SconeSessionMakerService.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ private URL resolveValidAttestationServer() {
154154
private SconeEnclave toSconeEnclave(final SecretEnclaveBase enclaveBase,
155155
final String command,
156156
final boolean addJavaEnvVars) {
157-
final HashMap<String, Object> enclaveEnvironment = new HashMap<>(enclaveBase.getEnvironment());
157+
final HashMap<String, String> enclaveEnvironment = new HashMap<>(enclaveBase.getEnvironment());
158158
if (addJavaEnvVars) {
159159
enclaveEnvironment.putAll(
160160
Map.of(

‎src/main/java/com/iexec/sms/tee/session/scone/cas/SconeEnclave.java‎

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2022-2023 IEXEC BLOCKCHAIN TECH
2+
* Copyright 2022-2025 IEXEC BLOCKCHAIN TECH
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -19,7 +19,8 @@
1919
import com.fasterxml.jackson.annotation.JsonProperty;
2020
import com.fasterxml.jackson.core.JsonProcessingException;
2121
import com.fasterxml.jackson.databind.ObjectMapper;
22-
import lombok.*;
22+
import lombok.Builder;
23+
import lombok.Value;
2324
import lombok.extern.slf4j.Slf4j;
2425

2526
import java.util.List;
@@ -41,16 +42,16 @@ public class SconeEnclave {
4142
@JsonProperty("command")
4243
String command;
4344
@JsonProperty("environment")
44-
Map<String, Object> environment;
45+
Map<String, String> environment;
4546

46-
@Override
47-
public String toString() {
48-
try {
49-
return new ObjectMapper().writeValueAsString(this);
50-
} catch (JsonProcessingException e) {
51-
log.error("Failed to write CAS session as string [session:{}]", name, e);
52-
return "";
47+
@Override
48+
public String toString() {
49+
try {
50+
return new ObjectMapper().writeValueAsString(this);
51+
} catch (JsonProcessingException e) {
52+
log.error("Failed to write CAS session as string [session:{}]", name, e);
53+
return "";
54+
}
5355
}
54-
}
5556

5657
}

‎src/test/java/com/iexec/sms/tee/session/base/SecretSessionBaseServiceTests.java‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -291,7 +291,7 @@ void shouldGetPreComputeBulkProcessingTokensForInvalidOrder() throws Exception {
291291
assertThat(enclaveBase.getName()).isEqualTo("pre-compute");
292292
assertThat(enclaveBase.getMrenclave()).isEqualTo(PRE_COMPUTE_FINGERPRINT);
293293
assertThat(enclaveBase.getEnvironment()).containsAllEntriesOf(Map.ofEntries(
294-
Map.entry("IEXEC_BULK_SLICE_SIZE", 1),
294+
Map.entry("IEXEC_BULK_SLICE_SIZE", "1"),
295295
Map.entry("IEXEC_DATASET_1_URL", ""),
296296
Map.entry("IEXEC_DATASET_1_CHECKSUM", ""),
297297
Map.entry("IEXEC_DATASET_1_KEY", ""),
@@ -332,7 +332,7 @@ void shouldGetPreComputeBulkProcessingTokensForValidOrder() throws Exception {
332332
assertThat(enclaveBase.getName()).isEqualTo("pre-compute");
333333
assertThat(enclaveBase.getMrenclave()).isEqualTo(PRE_COMPUTE_FINGERPRINT);
334334
assertThat(enclaveBase.getEnvironment()).containsAllEntriesOf(Map.ofEntries(
335-
Map.entry("IEXEC_BULK_SLICE_SIZE", 1),
335+
Map.entry("IEXEC_BULK_SLICE_SIZE", "1"),
336336
Map.entry("IEXEC_DATASET_1_URL", DATASET_URL),
337337
Map.entry("IEXEC_DATASET_1_CHECKSUM", DATASET_CHECKSUM),
338338
Map.entry("IEXEC_DATASET_1_KEY", DATASET_KEY),
@@ -355,7 +355,7 @@ void shouldNotGetBulkProcessingPreComputeTokens() throws Exception {
355355
);
356356
assertThat(enclaveBase.getName()).isEqualTo("pre-compute");
357357
assertThat(enclaveBase.getMrenclave()).isEqualTo(PRE_COMPUTE_FINGERPRINT);
358-
assertThat(enclaveBase.getEnvironment()).contains(Map.entry("IEXEC_BULK_SLICE_SIZE", 0));
358+
assertThat(enclaveBase.getEnvironment()).contains(Map.entry("IEXEC_BULK_SLICE_SIZE", "0"));
359359
}
360360

361361
@Test
@@ -375,12 +375,12 @@ void shouldGetPreComputeTokensWithDataset() throws Exception {
375375
);
376376
assertThat(enclaveBase.getName()).isEqualTo("pre-compute");
377377
assertThat(enclaveBase.getMrenclave()).isEqualTo(PRE_COMPUTE_FINGERPRINT);
378-
final Map<String, Object> expectedTokens = Map.ofEntries(
378+
final Map<String, String> expectedTokens = Map.ofEntries(
379379
Map.entry("IEXEC_DEAL_ID", DEAL_ID),
380380
Map.entry("IEXEC_TASK_INDEX", "0"),
381381
Map.entry("IEXEC_TASK_ID", TASK_ID),
382382
Map.entry("IEXEC_PRE_COMPUTE_OUT", "/iexec_in"),
383-
Map.entry("IS_DATASET_REQUIRED", true),
383+
Map.entry("IS_DATASET_REQUIRED", "true"),
384384
Map.entry("IEXEC_DATASET_KEY", DATASET_KEY),
385385
Map.entry("IEXEC_DATASET_URL", DATASET_URL),
386386
Map.entry("IEXEC_DATASET_FILENAME", DATASET_ADDRESS),
@@ -426,12 +426,12 @@ void shouldGetPreComputeTokensWithoutDataset() throws Exception {
426426
);
427427
assertThat(enclaveBase.getName()).isEqualTo("pre-compute");
428428
assertThat(enclaveBase.getMrenclave()).isEqualTo(PRE_COMPUTE_FINGERPRINT);
429-
final Map<String, Object> expectedTokens = Map.ofEntries(
429+
final Map<String, String> expectedTokens = Map.ofEntries(
430430
Map.entry("IEXEC_DEAL_ID", DEAL_ID),
431431
Map.entry("IEXEC_TASK_INDEX", "0"),
432432
Map.entry("IEXEC_TASK_ID", TASK_ID),
433433
Map.entry("IEXEC_PRE_COMPUTE_OUT", "/iexec_in"),
434-
Map.entry("IS_DATASET_REQUIRED", false),
434+
Map.entry("IS_DATASET_REQUIRED", "false"),
435435
Map.entry("IEXEC_INPUT_FILES_FOLDER", "/iexec_in"),
436436
Map.entry("IEXEC_INPUT_FILES_NUMBER", "2"),
437437
Map.entry("IEXEC_INPUT_FILE_URL_1", INPUT_FILE_URL_1),
@@ -462,7 +462,7 @@ void shouldGetAppComputeBulkProcessingTokens() throws TeeSessionGenerationExcept
462462
assertThat(enclaveBase.getName()).isEqualTo("app");
463463
assertThat(enclaveBase.getMrenclave()).isEqualTo(APP_FINGERPRINT);
464464
assertThat(enclaveBase.getEnvironment()).containsAllEntriesOf(Map.ofEntries(
465-
Map.entry("IEXEC_BULK_SLICE_SIZE", 1),
465+
Map.entry("IEXEC_BULK_SLICE_SIZE", "1"),
466466
Map.entry("IEXEC_DATASET_1_FILENAME", datasetAddress)
467467
));
468468
}
@@ -483,7 +483,7 @@ void shouldGetAppTokensForAdvancedTaskDescription() throws TeeSessionGenerationE
483483
final SecretEnclaveBase enclaveBase = teeSecretsService.getAppTokens(request);
484484
assertThat(enclaveBase.getName()).isEqualTo("app");
485485
assertThat(enclaveBase.getMrenclave()).isEqualTo(APP_FINGERPRINT);
486-
final Map<String, Object> expectedTokens = Map.ofEntries(
486+
final Map<String, String> expectedTokens = Map.ofEntries(
487487
Map.entry("IEXEC_DEAL_ID", DEAL_ID),
488488
Map.entry("IEXEC_TASK_INDEX", "0"),
489489
Map.entry("IEXEC_TASK_ID", TASK_ID),
@@ -541,7 +541,7 @@ void shouldGetTokensWithEmptyAppComputeSecretWhenSecretsDoNotExist() throws TeeS
541541
final SecretEnclaveBase enclaveBase = teeSecretsService.getAppTokens(request);
542542
assertThat(enclaveBase.getName()).isEqualTo("app");
543543
assertThat(enclaveBase.getMrenclave()).isEqualTo(APP_FINGERPRINT);
544-
final Map<String, Object> expectedTokens = Map.ofEntries(
544+
final Map<String, String> expectedTokens = Map.ofEntries(
545545
Map.entry("IEXEC_DEAL_ID", DEAL_ID),
546546
Map.entry("IEXEC_TASK_INDEX", "0"),
547547
Map.entry("IEXEC_TASK_ID", TASK_ID),
@@ -652,7 +652,7 @@ void shouldGetPostComputeTokens() throws Exception {
652652
);
653653
assertThat(enclaveBase.getName()).isEqualTo("post-compute");
654654
assertThat(enclaveBase.getMrenclave()).isEqualTo(POST_COMPUTE_FINGERPRINT);
655-
final Map<String, Object> expectedTokens = Map.of(
655+
final Map<String, String> expectedTokens = Map.of(
656656
// encryption tokens
657657
"RESULT_ENCRYPTION", "true",
658658
"RESULT_ENCRYPTION_PUBLIC_KEY", ENCRYPTION_PUBLIC_KEY,

0 commit comments

Comments
 (0)