Connecting to HTTPS hosts from enclave

[Katerinaaaa]

We try to access HTTPS host and download webpage from within enclave. We call busybox wget -O- "https://github.com/" (the whole bash script actually is the same as https://github.com/occlum/occlum/blob/master/demos/bash/occlum_bash_test.sh, but with added single line of wget call).

We get the following error message:

Connecting to 140.82.121.3 (140.82.121.3:443)
wget: note: TLS certificate validation not implemented
wget: fork: Function not implemented

We suspected DNS problems and also made busybox cat /etc/resolv.conf, but it gave us the contents of docker resolv.conf:

Our questions are:

1. Does Occlum support https requests to outer hosts?
2. Does Occlum use some own resolv.conf? How to access and modify it in this case? Or does Occlum use outer docker resolv.conf for name resolving?

[jessehui]

@Katerinaaaa Thanks for using Occlum.

Does Occlum support https requests to outer hosts?

Yes.

Does Occlum use some own resolv.conf? How to access and modify it in this case? Or does Occlum use outer docker resolv.conf for name resolving?

Occlum is using the same resolv.conf as docker. Could you modify the resolv.conf on your docker?

Plus, the error message looks like wget is using fork for process creation which we don't support.

[tychobrailleur]

FWIW, busybox wget forks, but not “standard” wget (unless it is put in the background):

root@a1cbeace832d:/tmp/instance# occlum run /usr/bin/wget -O- http://127.0.0.1:8000
ERROR: could not open HSTS store. HSTS will be disabled.
--2022-06-20 09:13:22--  http://127.0.0.1:8000/
Connecting to 127.0.0.1:8000... connected.
127.0.0.1 - - [20/Jun/2022 09:13:22] "GET / HTTP/1.1" 200 -
HTTP request sent, awaiting response... 200 OK
Length: 6 [text/html]
Saving to: 'STDOUT'

Hello
-                                                           100%[=========================================================================================================================================>]       6  --.-KB/s    in 0s      

2022-06-20 09:13:22 (38.2 KB/s) - written to stdout [6/6]

root@a1cbeace832d:/tmp/instance# occlum run /usr/bin/wget -b -O- http://127.0.0.1:8000
fork: Function not implemented

[jessehui]

Cool! so the standard wget can work for basic functions. Thanks for the info~!