Skip to content

fix(secret-provider-agent): improve robustness of provider agent #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 19, 2025
Merged

fix(secret-provider-agent): improve robustness of provider agent #43

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
17175d7
fix: add NULL check to adppId
aghiles-ait Nov 18, 2025
84ea09b
fix: add control on ip address and port
aghiles-ait Nov 18, 2025
8d08c54
fix: enforce const on immutable values
aghiles-ait Nov 19, 2025
bcbd018
fix: enforce const on immutable values
aghiles-ait Nov 19, 2025
4488df8
fix: replace strtok with strchr to avoid modifying sbsEndpoint variable
aghiles-ait Nov 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
75 changes: 52 additions & 23 deletions cvmassistants/secretprovider/secret-provider-agent/src/secret_provider_agent.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
do { \
if (log_level <= rats_level) { \
time_t now = time(NULL); \
struct tm *t = gmtime(&now); \
const struct tm *t = gmtime(&now); \
char ts[24]; \
strftime(ts, sizeof(ts), "%Y-%m-%d %H:%M:%S UTC", t); \
printf("%-29s [%-5s] [%s:%d] " fmt "\n", ts, level, __FILE__, __LINE__, ##__VA_ARGS__); \
Expand All @@ -44,14 +44,14 @@ rats_tls_log_level_t log_level = RATS_TLS_LOG_LEVEL_INFO;
const char* command_get_secret = "getSecret";

char* get_secret_from_sbs_through_rats_tls(rats_tls_log_level_t log_level,
char* attester_type,
char* verifier_type,
char* tls_type,
char* crypto_type,
const char* attester_type,
const char* verifier_type,
const char* tls_type,
const char* crypto_type,
bool mutual,
char* ip,
const char* ip,
int port,
char* app_id) {
const char* app_id) {

bool validation_error = false;
if (attester_type == NULL || strlen(attester_type) >= ENCLAVE_ATTESTER_TYPE_NAME_SIZE) {
Expand Down Expand Up @@ -223,10 +223,10 @@ int main(int argc, char** argv) {
char* secret = "";
LOG_INFO("Try to get key from SBS");

char* secret_save_path = NULL;
char* sbs_endpoint = NULL;
char* srv_ip = NULL;
char* str_port = NULL;
const char* secret_save_path = NULL;
const char* sbs_endpoint = NULL;
char ip_buf[INET_ADDRSTRLEN];
const char* str_port = NULL;
int port;

char* const short_options = "a:v:t:c:ml:s:i:e:h";
Expand All @@ -243,12 +243,12 @@ int main(int argc, char** argv) {
{"help", no_argument, NULL, 'h'},
{0, 0, 0, 0}};

char* attester_type = "";
char* verifier_type = "";
char* tls_type = "";
char* crypto_type = "";
const char* attester_type = "";
const char* verifier_type = "";
const char* tls_type = "";
const char* crypto_type = "";
bool mutual = true;
char* app_id = NULL;
const char* app_id = NULL;
int opt;
do {
opt = getopt_long(argc, argv, short_options, long_options, NULL);
Expand Down Expand Up @@ -317,22 +317,51 @@ int main(int argc, char** argv) {

LOG_INFO("Selected log level %d", log_level);

if (app_id == NULL) {
LOG_ERROR("App ID is missing");
return -1;
}

if (sbs_endpoint == NULL) {
LOG_ERROR("SBS mode must provide sbsEndpoint argument (--sbsEndpoint/-e)");
return -1;
}

LOG_DEBUG("Config of SBS endpoint is %s", sbs_endpoint);

srv_ip = strtok(sbs_endpoint, ":");
str_port = strtok(NULL, ":");
if (NULL == str_port) {
LOG_ERROR("sbsEndpoint format error, eg: 127.0.0.1:5443");
const char* colon = strchr(sbs_endpoint, ':');
if (colon == NULL) {
LOG_ERROR("sbsEndpoint format error: missing ':', eg: 127.0.0.1:5443");
return -1;
}

size_t ip_len = colon - sbs_endpoint;
if (ip_len == 0) {
LOG_ERROR("sbsEndpoint format error: missing IP address");
return -1;
}
if (ip_len >= INET_ADDRSTRLEN) {
LOG_ERROR("sbsEndpoint format error: IP address too long");
return -1;
}

memcpy(ip_buf, sbs_endpoint, ip_len);
ip_buf[ip_len] = '\0';

struct in_addr test_addr;
if (inet_pton(AF_INET, ip_buf, &test_addr) != 1) {
LOG_ERROR("Invalid IP address format: %s", ip_buf);
return -1;
}

str_port = colon + 1;
if (*str_port == '\0') {
LOG_ERROR("sbsEndpoint format error: missing port, eg: 5443");
return -1;
}
port = atoi(str_port);
if (port == 0) {
LOG_ERROR("Port is invalid, got %s", str_port);
if (port <= 0 || port > 65535) {
LOG_ERROR("Port is invalid or out of valid range (1-65535), got %d", port);
return -1;
}

Expand All @@ -347,7 +376,7 @@ int main(int argc, char** argv) {
}

secret = get_secret_from_sbs_through_rats_tls(log_level, attester_type, verifier_type,
tls_type, crypto_type, mutual, srv_ip,
tls_type, crypto_type, mutual, ip_buf,
port, app_id);
if (secret == NULL) {
LOG_ERROR("Get secret from SBS failed");
Expand Down