Skip to content

Commit 74b6a15

Browse files
zguesmizguesmi
authored
Merge pull request #303 from iExecBlockchainComputing/feature/sms-auth
Clean old sms legacy
2 parents 3c85b2e + 3e9bd30 commit 74b6a15

File tree

8 files changed

+97
-292
lines changed

8 files changed

+97
-292
lines changed

‎src/main/java/com/iexec/worker/docker/ComputationService.java‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -159,16 +159,13 @@ public boolean runTeeComputation(TaskDescription taskDescription,
159159
return false;
160160
}
161161

162-
String secureSessionId = sconeTeeService.createSconeSecureSession(contributionAuth);
163-
164-
log.info("Secure session created [chainTaskId:{}, secureSessionId:{}]", chainTaskId, secureSessionId);
165-
162+
String secureSessionId = smsService.createTeeSession(contributionAuth);
166163
if (secureSessionId.isEmpty()) {
167-
String msg = "Could not generate scone secure session for tee computation";
168-
log.error(msg + " [chainTaskId:{}]", chainTaskId);
164+
log.error("Cannot compute TEE task without secure session [chainTaskId:{}]", chainTaskId);
169165
return false;
170166
}
171167

168+
log.info("Secure session created [chainTaskId:{}, secureSessionId:{}]", chainTaskId, secureSessionId);
172169
ArrayList<String> sconeAppEnv = sconeTeeService.buildSconeDockerEnv(secureSessionId + "/app",
173170
publicConfigService.getSconeCasURL(), "1G");
174171
ArrayList<String> sconeUploaderEnv = sconeTeeService.buildSconeDockerEnv(secureSessionId + "/post-compute",

‎src/main/java/com/iexec/worker/feign/CustomSmsFeignClient.java‎

Lines changed: 0 additions & 49 deletions
This file was deleted.

‎src/main/java/com/iexec/worker/feign/client/SmsClient.java‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,29 @@
11
package com.iexec.worker.feign.client;
22

33

4-
import com.iexec.common.sms.SmsRequest;
4+
import com.iexec.common.chain.ContributionAuthorization;
55
import com.iexec.common.sms.secrets.SmsSecretResponse;
66
import com.iexec.worker.feign.config.FeignConfiguration;
77

8-
import feign.FeignException;
98
import org.springframework.cloud.openfeign.FeignClient;
109
import org.springframework.http.ResponseEntity;
1110
import org.springframework.web.bind.annotation.PostMapping;
1211
import org.springframework.web.bind.annotation.RequestBody;
12+
import org.springframework.web.bind.annotation.RequestHeader;
1313

14+
import feign.FeignException;
1415

1516
@FeignClient(name = "SmsClient",
1617
url = "#{publicConfigurationService.smsURL}",
1718
configuration = FeignConfiguration.class)
1819
public interface SmsClient {
1920

2021
@PostMapping("/untee/secrets")
21-
ResponseEntity<SmsSecretResponse> getUnTeeSecrets(@RequestBody SmsRequest smsRequest) throws FeignException;
22+
ResponseEntity<SmsSecretResponse> getUnTeeSecrets(@RequestHeader("Authorization") String authorization,
23+
@RequestBody ContributionAuthorization contributionAuth) throws FeignException;
2224

2325
@PostMapping("/tee/sessions")
24-
ResponseEntity<String> generateTeeSession(@RequestBody SmsRequest smsRequest) throws FeignException;
26+
ResponseEntity<String> createTeeSession(@RequestHeader("Authorization") String authorization,
27+
@RequestBody ContributionAuthorization contributionAuth) throws FeignException;
2528

2629
}

‎src/main/java/com/iexec/worker/sms/SmsService.java‎

Lines changed: 25 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,17 @@
33
import java.util.Optional;
44

55
import com.iexec.common.chain.ContributionAuthorization;
6-
import com.iexec.common.security.Signature;
76
import com.iexec.common.sms.secrets.SmsSecret;
8-
import com.iexec.common.sms.SmsRequest;
9-
import com.iexec.common.sms.SmsRequestData;
10-
import com.iexec.common.sms.scone.SconeSecureSessionResponse.SconeSecureSession;
117
import com.iexec.common.sms.secrets.SmsSecretResponse;
128
import com.iexec.common.sms.secrets.TaskSecrets;
13-
import com.iexec.common.utils.BytesUtils;
149
import com.iexec.common.utils.FileHelper;
15-
import com.iexec.common.utils.HashUtils;
1610
import com.iexec.worker.chain.CredentialsService;
17-
import com.iexec.worker.feign.CustomSmsFeignClient;
11+
import com.iexec.worker.feign.client.SmsClient;
1812

1913
import org.springframework.http.ResponseEntity;
2014
import org.springframework.retry.annotation.Recover;
2115
import org.springframework.retry.annotation.Retryable;
2216
import org.springframework.stereotype.Service;
23-
import org.web3j.crypto.Sign;
2417

2518
import feign.FeignException;
2619
import lombok.extern.slf4j.Slf4j;
@@ -31,22 +24,23 @@
3124
public class SmsService {
3225

3326
private CredentialsService credentialsService;
34-
private CustomSmsFeignClient customSmsFeignClient;
27+
private SmsClient smsClient;
3528

36-
public SmsService(CredentialsService credentialsService, CustomSmsFeignClient customSmsFeignClient) {
29+
public SmsService(CredentialsService credentialsService, SmsClient smsClient) {
3730
this.credentialsService = credentialsService;
38-
this.customSmsFeignClient = customSmsFeignClient;
31+
this.smsClient = smsClient;
3932
}
4033

4134
@Retryable(value = FeignException.class)
4235
public Optional<TaskSecrets> fetchTaskSecrets(ContributionAuthorization contributionAuth) {
4336
String chainTaskId = contributionAuth.getChainTaskId();
37+
String authorization = getAuthorizationString(contributionAuth);
38+
ResponseEntity<SmsSecretResponse> response = smsClient.getUnTeeSecrets(authorization, contributionAuth);
39+
if (!response.getStatusCode().is2xxSuccessful()) {
40+
return Optional.empty();
41+
}
4442

45-
SmsRequest smsRequest = buildSmsRequest(contributionAuth);
46-
47-
SmsSecretResponse smsResponse = customSmsFeignClient.getUnTeeSecrets(smsRequest);
48-
49-
43+
SmsSecretResponse smsResponse = response.getBody();
5044
if (smsResponse == null) {
5145
log.error("Received null response from SMS [chainTaskId:{}]", chainTaskId);
5246
return Optional.empty();
@@ -69,11 +63,10 @@ public Optional<TaskSecrets> fetchTaskSecrets(ContributionAuthorization contribu
6963
}
7064

7165
@Recover
72-
private boolean fetchTaskSecrets(FeignException e, ContributionAuthorization contributionAuth) {
73-
log.error("Failed to get task secrets from SMS [chainTaskId:{}, attempts:3]",
74-
contributionAuth.getChainTaskId());
75-
e.printStackTrace();
76-
return false;
66+
private Optional<TaskSecrets> fetchTaskSecrets(FeignException e, ContributionAuthorization contributionAuth) {
67+
log.error("Failed to get task secrets from SMS [chainTaskId:{}, httpStatus:{}, exception:{}, attempts:3]",
68+
contributionAuth.getChainTaskId(), e.status(), e.getMessage());
69+
return Optional.empty();
7770
}
7871

7972
public void saveSecrets(String chainTaskId,
@@ -109,43 +102,21 @@ public void saveSecrets(String chainTaskId,
109102
}
110103

111104
@Retryable(value = FeignException.class)
112-
public String getSconeSecureSession(ContributionAuthorization contributionAuth) {
113-
String chainTaskId = contributionAuth.getChainTaskId();
114-
SmsRequest smsRequest = buildSmsRequest(contributionAuth);
115-
116-
String sessionId = customSmsFeignClient.generateTeeSession(smsRequest);
117-
118-
if (sessionId.isEmpty()) {
119-
log.error("Received null session from SMS [chainTaskId:{}]", chainTaskId);
120-
return "";
121-
}
122-
123-
return sessionId;
105+
public String createTeeSession(ContributionAuthorization contributionAuth) {
106+
String authorization = getAuthorizationString(contributionAuth);
107+
ResponseEntity<String> response = smsClient.createTeeSession(authorization, contributionAuth);
108+
return response.getStatusCode().is2xxSuccessful() ? response.getBody() : "";
124109
}
125110

126111
@Recover
127-
private String getSconeSecureSession(FeignException e, ContributionAuthorization contributionAuth) {
128-
log.error("Failed to generate secure session [chainTaskId:{}, attempts:3]",
129-
contributionAuth.getChainTaskId());
130-
e.printStackTrace();
112+
private String createTeeSession(FeignException e, ContributionAuthorization contributionAuth) {
113+
log.error("Failed to create secure session [chainTaskId:{}, httpStatus:{}, exception:{}, attempts:3]",
114+
contributionAuth.getChainTaskId(), e.status(), e.getMessage());
131115
return "";
132116
}
133117

134-
public SmsRequest buildSmsRequest(ContributionAuthorization contributionAuth) {
135-
String hash = HashUtils.concatenateAndHash(contributionAuth.getWorkerWallet(),
136-
contributionAuth.getChainTaskId(), contributionAuth.getEnclaveChallenge());
137-
138-
Sign.SignatureData workerSignature = Sign.signPrefixedMessage(
139-
BytesUtils.stringToBytes(hash), credentialsService.getCredentials().getEcKeyPair());
140-
141-
SmsRequestData smsRequestData = SmsRequestData.builder()
142-
.chainTaskId(contributionAuth.getChainTaskId())
143-
.workerAddress(contributionAuth.getWorkerWallet())
144-
.enclaveChallenge(contributionAuth.getEnclaveChallenge())
145-
.coreSignature(contributionAuth.getSignature().getValue())
146-
.workerSignature(new Signature(workerSignature).getValue())
147-
.build();
148-
149-
return new SmsRequest(smsRequestData);
118+
private String getAuthorizationString(ContributionAuthorization contributionAuth) {
119+
String challenge = contributionAuth.getHash();
120+
return credentialsService.hashAndSignMessage(challenge).getValue();
150121
}
151-
}
122+
}

‎src/main/java/com/iexec/worker/tee/scone/SconeTeeService.java‎

Lines changed: 2 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,10 @@
44

55
import javax.annotation.PreDestroy;
66

7-
import com.iexec.common.chain.ContributionAuthorization;
8-
import com.iexec.common.security.Signature;
9-
import com.iexec.common.utils.BytesUtils;
10-
import com.iexec.common.utils.HashUtils;
11-
import com.iexec.common.utils.SignatureUtils;
127
import com.iexec.worker.docker.CustomDockerClient;
138
import com.iexec.worker.docker.DockerExecutionConfig;
149
import com.iexec.worker.docker.DockerExecutionResult;
1510
import com.iexec.worker.sgx.SgxService;
16-
import com.iexec.worker.sms.SmsService;
1711

1812
import org.springframework.stereotype.Service;
1913

@@ -24,27 +18,15 @@
2418
@Service
2519
public class SconeTeeService {
2620

27-
// metadata file used by scone enclave. It contains the hash and encryption key
28-
// for each file in the protected filesystem regions.
29-
private static final String FSPF_FILENAME = "volume.fspf";
30-
31-
// beneficiary public key used when encrypting result
32-
private static final String BENEFICIARY_KEY_FILENAME = "public.key";
33-
34-
private boolean isLasStarted;
35-
3621
private SconeLasConfiguration sconeLasConfig;
3722
private CustomDockerClient customDockerClient;
38-
private SmsService smsService;
23+
private boolean isLasStarted;
3924

4025
public SconeTeeService(SconeLasConfiguration sconeLasConfig,
4126
CustomDockerClient customDockerClient,
42-
SgxService sgxService,
43-
SmsService smsService) {
44-
27+
SgxService sgxService) {
4528
this.sconeLasConfig = sconeLasConfig;
4629
this.customDockerClient = customDockerClient;
47-
this.smsService = smsService;
4830
isLasStarted = sgxService.isSgxEnabled() ? startLasService() : false;
4931
}
5032

@@ -78,17 +60,6 @@ private boolean startLasService() {
7860
return true;
7961
}
8062

81-
public String createSconeSecureSession(ContributionAuthorization contributionAuth) {
82-
83-
// generate secure session
84-
String sessionId = smsService.getSconeSecureSession(contributionAuth);
85-
if (sessionId.isEmpty()) {
86-
return "";
87-
}
88-
89-
return sessionId;
90-
}
91-
9263
public ArrayList<String> buildSconeDockerEnv(String sconeConfigId, String sconeCasUrl, String sconeHeap) {
9364
SconeConfig sconeConfig = SconeConfig.builder()
9465
.sconeLasAddress(sconeLasConfig.getUrl())
@@ -100,12 +71,6 @@ public ArrayList<String> buildSconeDockerEnv(String sconeConfigId, String sconeC
10071
return sconeConfig.toDockerEnv();
10172
}
10273

103-
public boolean isEnclaveSignatureValid(String resultHash, String resultSeal,
104-
Signature enclaveSignature, String enclaveAddress) {
105-
byte[] message = BytesUtils.stringToBytes(HashUtils.concatenateAndHash(resultHash, resultSeal));
106-
return SignatureUtils.isSignatureValid(message, enclaveSignature, enclaveAddress);
107-
}
108-
10974
@PreDestroy
11075
void stopLasService() {
11176
if (isLasStarted) {

‎src/test/java/com/iexec/worker/docker/ComputationServiceTests.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ public void shouldComputeTeeTask() {
154154
ArrayList<String> stubSconeEnv = new ArrayList<>();
155155
stubSconeEnv.add("fooBar");
156156

157-
when(sconeTeeService.createSconeSecureSession(any()))
157+
when(smsService.createTeeSession(any()))
158158
.thenReturn(awesomeSessionId);
159159
when(sconeTeeService.buildSconeDockerEnv(any(), any(), any())).thenReturn(stubSconeEnv);
160160
when(customDockerClient.pullImage(anyString(), anyString())).thenReturn(true);
@@ -173,7 +173,7 @@ public void shouldNotComputeTeeTaskSinceFailedToCreateSconeSession() {
173173
TaskDescription task = getStubTaskDescription(false);
174174
ContributionAuthorization contributionAuth = getStubAuth(TEE_ENCLAVE_CHALLENGE);
175175

176-
when(sconeTeeService.createSconeSecureSession(any()))
176+
when(smsService.createTeeSession(any()))
177177
.thenReturn("");
178178

179179
boolean isComputed = computationService.runTeeComputation(task, contributionAuth);
@@ -186,7 +186,7 @@ public void shouldNotComputeTeeTaskSinceFailedToBuildSconeDockerEnv() {
186186
ContributionAuthorization contributionAuth = getStubAuth(TEE_ENCLAVE_CHALLENGE);
187187
String awesomeSessionId = "awesomeSessionId";
188188

189-
when(sconeTeeService.createSconeSecureSession(any()))
189+
when(smsService.createTeeSession(any()))
190190
.thenReturn(awesomeSessionId);
191191
when(sconeTeeService.buildSconeDockerEnv(any(), any(), any())).thenReturn(new ArrayList<>());
192192

@@ -202,7 +202,7 @@ public void shouldNotComputeTeeTaskSinceFirstRunFailed() {
202202
ArrayList<String> stubSconeEnv = new ArrayList<>();
203203
stubSconeEnv.add("fooBar");
204204

205-
when(sconeTeeService.createSconeSecureSession(any()))
205+
when(smsService.createTeeSession(any()))
206206
.thenReturn(awesomeSessionId);
207207
when(sconeTeeService.buildSconeDockerEnv(any(), any(), any())).thenReturn(stubSconeEnv);
208208
when(customDockerClient.execute(any())).thenReturn(DockerExecutionResult.failure());

0 commit comments

Comments
 (0)