Proxmox-Port/swtpm
1
0
Fork 0
mirror of https://github.com/stefanberger/swtpm.git synced 2026-08-12 17:32:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tests: Extend test cases with aes-256-cbc state file encryption

Browse Source 
Extend existing test cases with aes-256-cbc state file encryption.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
This commit is contained in:
Stefan Berger 2018-09-17 10:26:51 -04:00
parent 2e260468cb
commit 71d9581aa4
14 changed files with 289 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
tests/Makefile.am
View File

@ -93,6 +93,7 @@ EXTRA_DIST=$(TESTS) \
data/pubek.pem \
data/signkey.pem \
data/keyfile.txt \
data/keyfile256bit.txt \
data/pwdfile.txt \
data/migkey1/tpm2-volatilestate.bin \
data/migkey1/volatilestate.bin \
@ -103,10 +104,16 @@ EXTRA_DIST=$(TESTS) \
data/tpmstate2/tpm-00.volatilestate \
data/tpmstate2/pwdfile.txt \
data/tpmstate2/README \
data/tpmstate2b/tpm-00.permall \
data/tpmstate2b/tpm-00.volatilestate \
data/tpmstate2b/pwdfile.txt \
data/tpm2state1/tpm2-00.permall \
data/tpm2state1/tpm2-00.volatilestate \
data/tpm2state2/tpm2-00.permall \
data/tpm2state2/tpm2-00.volatilestate \
data/tpm2state2b/pwdfile.txt \
data/tpm2state2b/tpm2-00.permall \
data/tpm2state2b/tpm2-00.volatilestate \
data/tpm2state2/pwdfile.txt \
data/tpm2state3/hkey.priv \
data/tpm2state3/hkey.pub \

64
tests/_test_resume_volatile
View File

@ -61,7 +61,7 @@ if [ $? -ne 0 ]; then
exit 1
fi
# Read PCR 10
# Read PCR 10 (extend -ix 10 -ic test)
swtpm_open_cmddev ${SWTPM_INTERFACE} 100
RES=$(swtpm_cmd_tx ${SWTPM_INTERFACE} '\x00\xC1\x00\x00\x00\x0E\x00\x00\x00\x15\x00\x00\x00\x0a')
exp=' 00 c4 00 00 00 1e 00 00 00 00 c7 8a 6e 94 c7 3c 4d 7f c3 05 c8 a6 6b bf 15 45 f4 ed b7 a5'
@ -118,7 +118,7 @@ if [ $? -ne 0 ]; then
exit 1
fi
# Read PCR 10
# Read PCR 10 (extend -ix 10 -ic test)
swtpm_open_cmddev ${SWTPM_INTERFACE} 100
RES=$(swtpm_cmd_tx ${SWTPM_INTERFACE} '\x00\xC1\x00\x00\x00\x0E\x00\x00\x00\x15\x00\x00\x00\x0a')
exp=' 00 c4 00 00 00 1e 00 00 00 00 c7 8a 6e 94 c7 3c 4d 7f c3 05 c8 a6 6b bf 15 45 f4 ed b7 a5'
@ -149,3 +149,63 @@ if [ $? -ne 0 ]; then
fi
echo "Test 2: Ok"
# 3rd test: with encrypted state using aes-256-cbc
# copy all the state files
cp ${TESTDIR}/data/tpmstate2b/* ${TPM_PATH}
run_swtpm ${SWTPM_INTERFACE} \
--key pwdfile=${TESTDIR}/data/tpmstate2b/pwdfile.txt,mode=aes-256-cbc
ps aux | grep $SWTPM | grep -v grep
kill_quiet -0 ${SWTPM_PID}
if [ $? -ne 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM did not start."
exit 1
fi
# Init the TPM
run_swtpm_ioctl ${SWTPM_INTERFACE} -i
if [ $? -ne 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM initialization failed."
exit 1
fi
kill_quiet -0 ${SWTPM_PID} 2>/dev/null
if [ $? -ne 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM not running anymore after INIT."
exit 1
fi
# Read PCR 10
swtpm_open_cmddev ${SWTPM_INTERFACE} 100
RES=$(swtpm_cmd_tx ${SWTPM_INTERFACE} '\x00\xC1\x00\x00\x00\x0E\x00\x00\x00\x15\x00\x00\x00\x0a')
exp=' 00 c4 00 00 00 1e 00 00 00 00 c7 8a 6e 94 c7 3c 4d 7f c3 05 c8 a6 6b bf 15 45 f4 ed b7 a5'
if [ "$RES" != "$exp" ]; then
echo "Error: (1) Did not get expected result from TPM_PCRRead(10)"
echo "expected: $exp"
echo "received: $RES"
exit 1
fi
# Save the volatile state again
run_swtpm_ioctl ${SWTPM_INTERFACE} -v
if [ $? -ne 0 ]; then
echo "Error: Could not have the ${SWTPM_INTERFACE} TPM write the volatile state to a file."
exit 1
fi
if [ ! -r $VOLATILE_STATE_FILE ]; then
echo "Error: Volatile state file $VOLATILE_STATE_FILE does not exist."
exit 1
fi
# Shut the TPM down
exec 100>&-
run_swtpm_ioctl ${SWTPM_INTERFACE} -s
if [ $? -ne 0 ]; then
echo "Error: Could not shut down the ${SWTPM_INTERFACE} TPM."
exit 1
fi
echo "Test 3: Ok"

71
tests/_test_save_load_encrypted_state
View File

@ -343,8 +343,79 @@ if [ "${sha1_permanent}" != "$(get_sha1_file "${STATE_FILE}")" ]; then
exit 1
fi
# shut it down
run_swtpm_ioctl ${SWTPM_INTERFACE} -s
if [ $? -ne 0 ]; then
echo "Error: Could not shut down the ${SWTPM_INTERFACE} TPM."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
if wait_process_gone ${SWTPM_PID} 1; then
echo "Error: ${SWTPM_INTERFACE} TPM should not be running anymore."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
echo "Test 2: Ok"
# This time start we start the TPM with a different cipher and try to
# start it. It has to fail and the state must not have been modified.
# volatile state file does not exist
sha1_volatile=$(get_sha1_file "${VOLATILE_STATE_FILE}")
sha1_permanent=$(get_sha1_file "${STATE_FILE}")
echo "sha1(volatile): $sha1_volatile sha1(permanent): $sha1_permanent"
# we need a 256bit key
echo "${KEY}${KEY}" > $keyfile
run_swtpm ${SWTPM_INTERFACE} \
--key pwdfile=$keyfile,mode=aes-256-cbc \
--log file=$logfile
ps aux | grep $SWTPM | grep -v grep
kill_quiet -0 ${SWTPM_PID}
if [ $? -ne 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM did not start."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
# Init the TPM
run_swtpm_ioctl ${SWTPM_INTERFACE} -i
if [ $? -eq 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM initialization should have failed."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
cat $logfile
kill_quiet -0 ${SWTPM_PID} 2>/dev/null
if [ $? -ne 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM not running anymore after failed INIT."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
if [ "${sha1_volatile}" != "$(get_sha1_file "${VOLATILE_STATE_FILE}")" ]; then
echo "Error: Volatile state file was modified during failed init."
exit 1
fi
if [ "${sha1_permanent}" != "$(get_sha1_file "${STATE_FILE}")" ]; then
echo "Error: Permanent state file was modified during failed init."
exit 1
fi
echo "Test 3: Ok"
# Final shut down
exec 100>&-
run_swtpm_ioctl ${SWTPM_INTERFACE} -s

66
tests/_test_tpm2_resume_volatile
View File

@ -155,3 +155,69 @@ if [ $? -ne 0 ]; then
fi
echo "Test 2: Ok"
# 3rd test: with encrypted state using aes-256-cbc
# copy all the state files
cp ${TESTDIR}/data/tpm2state2b/* ${TPM_PATH}
run_swtpm ${SWTPM_INTERFACE} \
--tpm2 \
--key pwdfile=${TESTDIR}/data/tpm2state2b/pwdfile.txt,mode=aes-256-cbc
ps aux | grep $SWTPM | grep -v grep
kill_quiet -0 ${SWTPM_PID}
if [ $? -ne 0 ]; then
echo "Error: CUSE TPM did not start."
exit 1
fi
# Init the TPM
run_swtpm_ioctl ${SWTPM_INTERFACE} -i
if [ $? -ne 0 ]; then
echo "Error: CUSE TPM initialization failed."
exit 1
fi
kill_quiet -0 ${SWTPM_PID} 2>/dev/null
if [ $? -ne 0 ]; then
echo "Error: CUSE TPM not running anymore after INIT."
exit 1
fi
swtpm_open_cmddev ${SWTPM_INTERFACE} 100
if [ $? -ne 0 ]; then
echo "Error: Could not open command interface."
ext 1
fi
# Read PCR 10 (from pcrextend -ha 10 -ic test)
RES=$(swtpm_cmd_tx ${SWTPM_INTERFACE} '\x80\x01\x00\x00\x00\x14\x00\x00\x01\x7e\x00\x00\x00\x01\x00\x0b\x03\x00\x04\x00')
exp=' 80 01 00 00 00 3e 00 00 00 00 00 00 00 16 00 00 00 01 00 0b 03 00 04 00 00 00 00 01 00 20 f6 85 98 e5 86 8d e6 8b 97 29 99 60 f2 71 7d 17 67 89 a4 2f 9a ae a8 c7 b7 aa 79 a8 62 56 c1 de'
if [ "$RES" != "$exp" ]; then
echo "Error: (1) Did not get expected result from TPM_PCRRead(10)"
echo "expected: $exp"
echo "received: $RES"
exit 1
fi
# Save the volatile state again
run_swtpm_ioctl ${SWTPM_INTERFACE} -v
if [ $? -ne 0 ]; then
echo "Error: Could not have the CUSE TPM write the volatile state to a file."
exit 1
fi
if [ ! -r $VOLATILE_STATE_FILE ]; then
echo "Error: Volatile state file $VOLATILE_STATE_FILE does not exist."
exit 1
fi
# Shut the TPM down
exec 100>&-
run_swtpm_ioctl ${SWTPM_INTERFACE} -s
if [ $? -ne 0 ]; then
echo "Error: Could not shut down the CUSE TPM."
exit 1
fi
echo "Test 3: Ok"

75
tests/_test_tpm2_save_load_encrypted_state
View File

@ -312,8 +312,82 @@ if [ "${sha1_permanent}" != "$(get_sha1_file "${STATE_FILE}")" ]; then
exit 1
fi
run_swtpm_ioctl ${SWTPM_INTERFACE} -s
if [ $? -ne 0 ]; then
echo "Error: Could not shut down the ${SWTPM_INTERFACE} TPM."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
kill_quiet -0 ${SWTPM_PID} 2>/dev/null
if [ $? -eq 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM should not be running anymore."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
# shut it down
echo "Test 2: Ok"
# This time start we start the TPM with a wrong state encryption key
# (key used as password) and try to start it. It has to fail and
# the state must not have been modified.
# volatile state file does not exist
sha1_volatile=$(get_sha1_file "${VOLATILE_STATE_FILE}")
sha1_permanent=$(get_sha1_file "${STATE_FILE}")
echo "sha1(volatile): $sha1_volatile sha1(permanent): $sha1_permanent"
# we need a 256bit key
echo "${KEY}${KEY}" > $keyfile
run_swtpm ${SWTPM_INTERFACE} \
--key pwdfile=$keyfile,mode=aes-256-cbc \
--log file=$logfile \
--tpm2
ps aux | grep $SWTPM | grep -v grep
kill_quiet -0 ${SWTPM_PID}
if [ $? -ne 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM did not start."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
# Init the TPM
run_swtpm_ioctl ${SWTPM_INTERFACE} -i
if [ $? -eq 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM initialization should have failed."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
kill_quiet -0 ${SWTPM_PID} 2>/dev/null
if [ $? -ne 0 ]; then
echo "Error: ${SWTPM_INTERFACE} TPM not running anymore after failed INIT."
echo "TPM Logfile:"
cat $logfile
exit 1
fi
if [ "${sha1_volatile}" != "$(get_sha1_file "${VOLATILE_STATE_FILE}")" ]; then
echo "Error: Volatile state file was modified during failed init."
exit 1
fi
if [ "${sha1_permanent}" != "$(get_sha1_file "${STATE_FILE}")" ]; then
echo "Error: Permanent state file was modified during failed init."
exit 1
fi
echo "Test 3: Ok"
# Final shut down
exec 100>&-
run_swtpm_ioctl ${SWTPM_INTERFACE} -s
@ -323,7 +397,6 @@ if [ $? -ne 0 ]; then
cat $logfile
exit 1
fi
sleep 0.5
kill_quiet -0 ${SWTPM_PID} 2>/dev/null
if [ $? -eq 0 ]; then

1
tests/data/keyfile256bit.txt Normal file
View File

@ -0,0 +1 @@
1234567890123456789012345678901212345678901234567890123456789012

1
tests/data/tpm2state2b/pwdfile.txt Normal file
View File

@ -0,0 +1 @@
mypassword

BIN
tests/data/tpm2state2b/tpm2-00.permall Normal file
View File

Binary file not shown.

BIN
tests/data/tpm2state2b/tpm2-00.volatilestate Normal file
View File

Binary file not shown.

1
tests/data/tpmstate2b/pwdfile.txt Normal file
View File

@ -0,0 +1 @@
mypassword

BIN
tests/data/tpmstate2b/tpm-00.permall Normal file
View File

Binary file not shown.

BIN
tests/data/tpmstate2b/tpm-00.volatilestate Normal file
View File

Binary file not shown.

2
tests/test_parameters
View File

@ -25,6 +25,8 @@ PARAMETERS=(
"--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display"
"--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile.txt"
"--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt"
"--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile256bit.txt --cipher aes-256-cbc"
"--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt --cipher aes-256-cbc"
)
FILESIZES=(

4
tests/test_tpm2_parameters
View File

@ -16,6 +16,8 @@ PARAMETERS=(
"--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display"
"--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile.txt"
"--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt"
"--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile256bit.txt --cipher aes-256-cbc"
"--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt --cipher aes-256-cbc"
"--ecc --createek"
"--ecc --createek --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display"
"--ecc --createek --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile.txt"
@ -24,6 +26,8 @@ PARAMETERS=(
"--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display"
"--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile.txt"
"--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt"
"--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile256bit.txt --cipher aes-256-cbc"
"--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt --cipher aes-256-cbc"
)
# produced file size is always the same with TPM2