manage proxied vault account per shard #1467

brenzi · 2023-10-11T15:44:30Z

closes #1253
closes #1466

Register a shard vault account on Integritee parentchain (no multichain option yet for this) and register every new shard worker as a proxy

Also added draft doc diagrams on the way that helped me find my way

derive vault account from enclave seed and shard identifier
endow vault account as primary worker
add self as proxy
persist vault AccountId in state (hardcoded key)
dummy unshield proxy(balance.transfer_keep_alive) extrinsic (no matter if fails, but must decode correctly)
register new validateers as proxy upon provisioning
let stf make use of proxied vault account (example for later unshielding refactoring)

testing

run node:

./target/release/integritee-node --dev --unsafe-ws-external --rpc-cors all

build worker as sidechain
SGX_MODE=SW WORKER_MODE=sidechain WORKER_FEATURES=dcap make

run first worker

export RUST_LOG=info,substrate_api_client=warn,ws=warn,mio=warn,its_consensus_common=info,sidechain=info,integritee_service=trace,enclave_runtime=trace,ac_node_api=warn,sp_io=warn,itc_parentchain_indirect_calls_executor=trace,itp_stf_executor=trace,itc_parentchain_light_client=trace,itc_parentchain_block_importer=trace,itp_stf_state_handler=trace,ita_stf=trace,itp-attestation-handler=debug
./integritee-service -u ws://172.17.0.1 -c -d /tmp/worker1 run --skip-ra --dev &> worker1.log

verify the following events are issued:

teerex.AddedSgxEnclave
balances.Endowed creating the vault account
proxy.ProxyAdded registering enclave signer as a proxy of vault

You'll also see plenty of enclaveBridge.ProcessedParentchainBlock and sidechain.FinalizedSidechainBlock. don't care!

now, run second worker provisioning

./integritee-service -u ws://172.17.0.1 -r 3444 -P 2100 -h 2110 -w 2101 -i 8788 -c -d /tmp/worker2 request-state --skip-ra &> worker2.log

verify the following events are issued:

proxy.ProxyAdded adding the second worker enclave account as a proxy for vault

then, test unshielding (replace mrenclave with yours)

export MRENCLAVE=G51nYibsmo8Gj4VJiEsLxoKttZF6xMbQGCRc3GqzTPHf
./integritee-cli -u ws://172.17.0.1 shield-funds //Alice //Alice 20000000000000 $MRENCLAVE

verify the following events are issued:

enclaveBridge.ShieldFunds

then unshield:
./integritee-cli -u ws://172.17.0.1 trusted --mrenclave $MRENCLAVE --direct unshield-funds //Alice //Alice 1000000000000

verify the following events are issued:

proxy.ProxyExecuted don't care this fails because we're unshielding funds which never went into the vault account. to be solved later safely unshield using balances.transfer on parentchain #1257

…here were funds

…ient pubkey form cert. builds but fails

…n't behave as expected. punkeys don't match and fill all 64 bytes

…count-per-shard

brenzi · 2023-10-13T12:33:07Z

core-primitives/attestation-handler/src/cert.rs

@@ -346,6 +371,7 @@ where
 		verify_attn_report(attn_report_raw, pub_k, attestation_ocall)
 	} else {
 		// TODO Refactor state provisioning to not use MURA #1385
+		// TODO DCAP is currently just passed through! SECURITY!!!


I wasn't aware that our MU RA is insecure for DCAP. Increases the urgency for #1385

brenzi · 2023-10-13T12:34:56Z

core-primitives/attestation-handler/src/cert.rs

@@ -234,6 +234,31 @@ pub fn percent_decode(orig: String) -> EnclaveResult<String> {
 	Ok(ret)
 }

+pub fn parse_cert_issuer(cert_der: &[u8]) -> SgxResult<Vec<u8>> {


this is currently not used. I wrote it because I tried to derive the MU RA client from the TLS certificate. fell back to passing it as a payload instead. Still, I think this fn might be useful on its own. webpki and rustls hide the issuer all too well behind private fields

brenzi · 2023-10-13T12:39:07Z

core-primitives/extrinsics-factory/src/lib.rs

@@ -88,6 +88,15 @@ where
 	) -> Self {
 		ExtrinsicsFactory { genesis_hash, signer, nonce_cache, node_metadata_repository }
 	}
+
+	pub fn with_signer(&self, signer: Signer, nonce_cache: Arc<NonceCache>) -> Self {


this allows the enclave to send extrinsics using arbitrary signers (closes #1466)

core-primitives/node-api/metadata/src/pallet_proxy.rs

brenzi · 2023-10-13T12:41:18Z

core-primitives/ocall-api/src/lib.rs

@@ -93,6 +93,7 @@ pub trait EnclaveOnChainOCallApi: Clone + Send + Sync {
 		&self,
 		extrinsics: Vec<OpaqueExtrinsic>,
 		parentchain_id: &ParentchainId,
+		await_each_inclusion: bool,


necessary to wait for vault to be created before trying to send an extrinsic as vault

core-primitives/stf-interface/src/lib.rs

enclave-runtime/src/tls_ra/README.md

enclave-runtime/src/tls_ra/tls_ra_client.rs

service/src/parentchain_handler.rs

DESIGN.md

clangenb

Nice, looks good to me in general, only minor stuff!

DESIGN.md

core-primitives/node-api/metadata/src/pallet_proxy.rs

core-primitives/types/src/parentchain.rs

service/src/parentchain_handler.rs

enclave-runtime/src/tls_ra/tls_ra_server.rs

enclave-runtime/src/tls_ra/tls_ra_client.rs

enclave-runtime/src/shard_vault.rs

clangenb

LGTM!

brenzi added 18 commits October 11, 2023 09:11

add design document with some mermaid diagrams

ecdf920

support enclave signing with changing keypairs at runtime

347e187

tame nervous polling of not yet finalized block

81e94dd

shard vault account creation works

6ddd043

prepare vault account getter. not working yet

156aac3

fix build and add trusted_call dummy for unshielding

f1d3d77

fix transfer call indexes

9911098

unshieldind dummy with real vault account and proxy call

ead3662

await vault account creation before registering proxy

b20d978

proxied unshielding call encodes correctly and would be executed if t…

4524b9f

…here were funds

start MU_RA doc diagrams and refactor namings for improved readability

6587f1b

refactoring MU RA functions for better readability. try to extract cl…

d5ce0c7

…ient pubkey form cert. builds but fails

logging pubkey of counterparty now during MU RA. but seems skip_ra wo…

cd3562d

…n't behave as expected. punkeys don't match and fill all 64 bytes

add client account to MU RA request

36bdc5c

starting to modularize vault logic

b5da3a2

secondary worker is registered as a vault proxy now

ed26be7

Merge remote-tracking branch 'origin/master' into ab/proxied-vault-ac…

da6bea0

…count-per-shard

cleanup

b72c063

brenzi added A0-core Affects a core part B1-releasenotes C1-low 📌 Does not elevate a release containing this beyond "low priority" E5-publicapi PR breaks public API labels Oct 13, 2023

clippy

4d2c000