runtime: Enclave quote status related cleanups/improvements #4396
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previous builds would default to lax verification. After this change the default verify behavior will be the strict (requires `OK` quote status), unless `OASIS_UNSAFE_LAX_AVR_VERIFY` is set. Note: As with previously, this option has no effect if AVR verification is disabled entirely.
Yawning
requested review from
kostko,
peterjgilbert,
pro-wh and
ptrus
as code owners
Yawning
force-pushed
the
yawning/feature/sgx-contraints
branch
from
153a5c0 to
943f218
Compare
kostko
reviewed
Dec 13, 2021
Yawning
force-pushed
the
yawning/feature/sgx-contraints
branch
from
943f218 to
ffa93cd
Compare
When verifying a TEECapabilities structure, additionally verify the quote status against the new SGXConstraints.AllowedQuoteStatuses vector so that nodes that have an invalid quote status can be omitted from scheduling entirely. Note: QuoteOK is ALWAYS allowed, as disallowing it is nonsensical.
Yawning
force-pushed
the
yawning/feature/sgx-contraints
branch
from
ffa93cd to
4556f9c
Compare
kostko
approved these changes
Dec 14, 2021
Codecov Report
@@ Coverage Diff @@
## master #4396 +/- ##
==========================================
- Coverage 69.40% 69.01% -0.39%
==========================================
Files 413 413
Lines 46983 46993 +10
==========================================
- Hits 32610 32434 -176
- Misses 10406 10588 +182
- Partials 3967 3971 +4
Continue to review full report at Codecov.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Yes I had to move the
Constraintsfield definition to the node package, because it doesn't belong in our IAS support code, and there will be an import loop otherwise.