m4sterchain commented on code in PR #221: URL: https://github.com/apache/incubator-teaclave-trustzone-sdk/pull/221#discussion_r2280375001
########## crates/rustls_provider/Cargo.toml: ########## @@ -0,0 +1,37 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +[package] +name = "rustls_provider" +version = "0.1.0" +authors = ["Teaclave Contributors <dev@teaclave.apache.org>"] +license = "Apache-2.0" +repository = "https://github.com/apache/incubator-teaclave-trustzone-sdk.git"; +description = "Custom Rustls providers for OP-TEE TrustZone SDK." +edition = "2018" + +[dependencies] +optee-utee = "0.4.0" Review Comment: We should have "0.5.0" published on crates.io, as it's been a while for the v0.5.0 Apache release. ########## crates/rustls_provider/src/lib.rs: ########## @@ -0,0 +1,55 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +use optee_utee::Time; +use rustls::crypto::CryptoProvider; +use rustls::pki_types::UnixTime; +use rustls::time_provider::TimeProvider; +use std::time::Duration; + +/// CryptoProvider from rustls-rustcrypto, with the rng backend for OP-TEE in getrandom crate +pub fn optee_crypto_provider() -> CryptoProvider { + rustls_rustcrypto::provider() +} + +/// Custom TimeProvider implementation using OP-TEE UTEE API +#[derive(Debug)] +pub struct OpteeTimeProvider; Review Comment: `ReeTimeProvider` might be better than `OpteeTimeProvider`, as it explicitly shows the source of time info. The security properties for the ReeTimeProvider should also be hilighted. `In normal operation, the value returned should correspond to the real time, but it should not be considered as trusted, as it may be tampered by the user or the REE software.` ref: GPD_TEE_Internal_API_Specification ########## crates/rustls_provider/src/lib.rs: ########## @@ -0,0 +1,55 @@ +// Licensed to the Apache Software Foundation (ASF) under one +// or more contributor license agreements. See the NOTICE file +// distributed with this work for additional information +// regarding copyright ownership. The ASF licenses this file +// to you under the Apache License, Version 2.0 (the +// "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +use optee_utee::Time; +use rustls::crypto::CryptoProvider; +use rustls::pki_types::UnixTime; +use rustls::time_provider::TimeProvider; +use std::time::Duration; + +/// CryptoProvider from rustls-rustcrypto, with the rng backend for OP-TEE in getrandom crate +pub fn optee_crypto_provider() -> CryptoProvider { + rustls_rustcrypto::provider() +} + +/// Custom TimeProvider implementation using OP-TEE UTEE API +#[derive(Debug)] +pub struct OpteeTimeProvider; + +impl TimeProvider for OpteeTimeProvider { + fn current_time(&self) -> Option<UnixTime> { + // Get time from OP-TEE REE (Rich Execution Environment) + let mut time = Time::new(); + time.ree_time(); + + // Convert OP-TEE time to Unix timestamp + // OP-TEE time seconds field represents seconds since some epoch + // We need to treat it as Unix timestamp (seconds since Jan 1, 1970) + let seconds = time.seconds as u64; + let millis = time.millis as u64; + + // Create UnixTime from seconds and milliseconds + let total_millis = seconds * 1000 + millis; Review Comment: Because the Ree time can be manipulated, operations on it may overflow. Although the exact consequences are unclear, it would be safer to return None in such cases. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: dev-unsubscr...@teaclave.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@teaclave.apache.org For additional commands, e-mail: dev-h...@teaclave.apache.org
