diff --git a/tests/Makefile.am b/tests/Makefile.am index 30159ee6..69739f4b 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -93,6 +93,7 @@ EXTRA_DIST=$(TESTS) \ data/pubek.pem \ data/signkey.pem \ data/keyfile.txt \ + data/keyfile256bit.txt \ data/pwdfile.txt \ data/migkey1/tpm2-volatilestate.bin \ data/migkey1/volatilestate.bin \ @@ -103,10 +104,16 @@ EXTRA_DIST=$(TESTS) \ data/tpmstate2/tpm-00.volatilestate \ data/tpmstate2/pwdfile.txt \ data/tpmstate2/README \ + data/tpmstate2b/tpm-00.permall \ + data/tpmstate2b/tpm-00.volatilestate \ + data/tpmstate2b/pwdfile.txt \ data/tpm2state1/tpm2-00.permall \ data/tpm2state1/tpm2-00.volatilestate \ data/tpm2state2/tpm2-00.permall \ data/tpm2state2/tpm2-00.volatilestate \ + data/tpm2state2b/pwdfile.txt \ + data/tpm2state2b/tpm2-00.permall \ + data/tpm2state2b/tpm2-00.volatilestate \ data/tpm2state2/pwdfile.txt \ data/tpm2state3/hkey.priv \ data/tpm2state3/hkey.pub \ diff --git a/tests/_test_resume_volatile b/tests/_test_resume_volatile index 0957efaf..c96752eb 100755 --- a/tests/_test_resume_volatile +++ b/tests/_test_resume_volatile @@ -61,7 +61,7 @@ if [ $? -ne 0 ]; then exit 1 fi -# Read PCR 10 +# Read PCR 10 (extend -ix 10 -ic test) swtpm_open_cmddev ${SWTPM_INTERFACE} 100 RES=$(swtpm_cmd_tx ${SWTPM_INTERFACE} '\x00\xC1\x00\x00\x00\x0E\x00\x00\x00\x15\x00\x00\x00\x0a') exp=' 00 c4 00 00 00 1e 00 00 00 00 c7 8a 6e 94 c7 3c 4d 7f c3 05 c8 a6 6b bf 15 45 f4 ed b7 a5' @@ -118,7 +118,7 @@ if [ $? -ne 0 ]; then exit 1 fi -# Read PCR 10 +# Read PCR 10 (extend -ix 10 -ic test) swtpm_open_cmddev ${SWTPM_INTERFACE} 100 RES=$(swtpm_cmd_tx ${SWTPM_INTERFACE} '\x00\xC1\x00\x00\x00\x0E\x00\x00\x00\x15\x00\x00\x00\x0a') exp=' 00 c4 00 00 00 1e 00 00 00 00 c7 8a 6e 94 c7 3c 4d 7f c3 05 c8 a6 6b bf 15 45 f4 ed b7 a5' @@ -149,3 +149,63 @@ if [ $? -ne 0 ]; then fi echo "Test 2: Ok" + +# 3rd test: with encrypted state using aes-256-cbc +# copy all the state files +cp ${TESTDIR}/data/tpmstate2b/* ${TPM_PATH} + +run_swtpm ${SWTPM_INTERFACE} \ + --key pwdfile=${TESTDIR}/data/tpmstate2b/pwdfile.txt,mode=aes-256-cbc + +ps aux | grep $SWTPM | grep -v grep + +kill_quiet -0 ${SWTPM_PID} +if [ $? -ne 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM did not start." + exit 1 +fi + +# Init the TPM +run_swtpm_ioctl ${SWTPM_INTERFACE} -i +if [ $? -ne 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM initialization failed." + exit 1 +fi + +kill_quiet -0 ${SWTPM_PID} 2>/dev/null +if [ $? -ne 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM not running anymore after INIT." + exit 1 +fi + +# Read PCR 10 +swtpm_open_cmddev ${SWTPM_INTERFACE} 100 +RES=$(swtpm_cmd_tx ${SWTPM_INTERFACE} '\x00\xC1\x00\x00\x00\x0E\x00\x00\x00\x15\x00\x00\x00\x0a') +exp=' 00 c4 00 00 00 1e 00 00 00 00 c7 8a 6e 94 c7 3c 4d 7f c3 05 c8 a6 6b bf 15 45 f4 ed b7 a5' +if [ "$RES" != "$exp" ]; then + echo "Error: (1) Did not get expected result from TPM_PCRRead(10)" + echo "expected: $exp" + echo "received: $RES" + exit 1 +fi + +# Save the volatile state again +run_swtpm_ioctl ${SWTPM_INTERFACE} -v +if [ $? -ne 0 ]; then + echo "Error: Could not have the ${SWTPM_INTERFACE} TPM write the volatile state to a file." + exit 1 +fi +if [ ! -r $VOLATILE_STATE_FILE ]; then + echo "Error: Volatile state file $VOLATILE_STATE_FILE does not exist." + exit 1 +fi + +# Shut the TPM down +exec 100>&- +run_swtpm_ioctl ${SWTPM_INTERFACE} -s +if [ $? -ne 0 ]; then + echo "Error: Could not shut down the ${SWTPM_INTERFACE} TPM." + exit 1 +fi + +echo "Test 3: Ok" diff --git a/tests/_test_save_load_encrypted_state b/tests/_test_save_load_encrypted_state index 94ba2e9a..db9694e0 100755 --- a/tests/_test_save_load_encrypted_state +++ b/tests/_test_save_load_encrypted_state @@ -343,8 +343,79 @@ if [ "${sha1_permanent}" != "$(get_sha1_file "${STATE_FILE}")" ]; then exit 1 fi +# shut it down +run_swtpm_ioctl ${SWTPM_INTERFACE} -s +if [ $? -ne 0 ]; then + echo "Error: Could not shut down the ${SWTPM_INTERFACE} TPM." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi + +if wait_process_gone ${SWTPM_PID} 1; then + echo "Error: ${SWTPM_INTERFACE} TPM should not be running anymore." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi + echo "Test 2: Ok" +# This time start we start the TPM with a different cipher and try to +# start it. It has to fail and the state must not have been modified. + +# volatile state file does not exist +sha1_volatile=$(get_sha1_file "${VOLATILE_STATE_FILE}") +sha1_permanent=$(get_sha1_file "${STATE_FILE}") +echo "sha1(volatile): $sha1_volatile sha1(permanent): $sha1_permanent" + +# we need a 256bit key +echo "${KEY}${KEY}" > $keyfile + +run_swtpm ${SWTPM_INTERFACE} \ + --key pwdfile=$keyfile,mode=aes-256-cbc \ + --log file=$logfile + +ps aux | grep $SWTPM | grep -v grep + +kill_quiet -0 ${SWTPM_PID} +if [ $? -ne 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM did not start." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi + +# Init the TPM +run_swtpm_ioctl ${SWTPM_INTERFACE} -i +if [ $? -eq 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM initialization should have failed." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi +cat $logfile + +kill_quiet -0 ${SWTPM_PID} 2>/dev/null +if [ $? -ne 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM not running anymore after failed INIT." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi + +if [ "${sha1_volatile}" != "$(get_sha1_file "${VOLATILE_STATE_FILE}")" ]; then + echo "Error: Volatile state file was modified during failed init." + exit 1 +fi + +if [ "${sha1_permanent}" != "$(get_sha1_file "${STATE_FILE}")" ]; then + echo "Error: Permanent state file was modified during failed init." + exit 1 +fi + +echo "Test 3: Ok" + # Final shut down exec 100>&- run_swtpm_ioctl ${SWTPM_INTERFACE} -s diff --git a/tests/_test_tpm2_resume_volatile b/tests/_test_tpm2_resume_volatile index d262a081..992c06f4 100755 --- a/tests/_test_tpm2_resume_volatile +++ b/tests/_test_tpm2_resume_volatile @@ -155,3 +155,69 @@ if [ $? -ne 0 ]; then fi echo "Test 2: Ok" + +# 3rd test: with encrypted state using aes-256-cbc +# copy all the state files +cp ${TESTDIR}/data/tpm2state2b/* ${TPM_PATH} + +run_swtpm ${SWTPM_INTERFACE} \ + --tpm2 \ + --key pwdfile=${TESTDIR}/data/tpm2state2b/pwdfile.txt,mode=aes-256-cbc + +ps aux | grep $SWTPM | grep -v grep + +kill_quiet -0 ${SWTPM_PID} +if [ $? -ne 0 ]; then + echo "Error: CUSE TPM did not start." + exit 1 +fi + +# Init the TPM +run_swtpm_ioctl ${SWTPM_INTERFACE} -i +if [ $? -ne 0 ]; then + echo "Error: CUSE TPM initialization failed." + exit 1 +fi + +kill_quiet -0 ${SWTPM_PID} 2>/dev/null +if [ $? -ne 0 ]; then + echo "Error: CUSE TPM not running anymore after INIT." + exit 1 +fi + +swtpm_open_cmddev ${SWTPM_INTERFACE} 100 +if [ $? -ne 0 ]; then + echo "Error: Could not open command interface." + ext 1 +fi + +# Read PCR 10 (from pcrextend -ha 10 -ic test) +RES=$(swtpm_cmd_tx ${SWTPM_INTERFACE} '\x80\x01\x00\x00\x00\x14\x00\x00\x01\x7e\x00\x00\x00\x01\x00\x0b\x03\x00\x04\x00') +exp=' 80 01 00 00 00 3e 00 00 00 00 00 00 00 16 00 00 00 01 00 0b 03 00 04 00 00 00 00 01 00 20 f6 85 98 e5 86 8d e6 8b 97 29 99 60 f2 71 7d 17 67 89 a4 2f 9a ae a8 c7 b7 aa 79 a8 62 56 c1 de' +if [ "$RES" != "$exp" ]; then + echo "Error: (1) Did not get expected result from TPM_PCRRead(10)" + echo "expected: $exp" + echo "received: $RES" + exit 1 +fi + +# Save the volatile state again +run_swtpm_ioctl ${SWTPM_INTERFACE} -v +if [ $? -ne 0 ]; then + echo "Error: Could not have the CUSE TPM write the volatile state to a file." + exit 1 +fi +if [ ! -r $VOLATILE_STATE_FILE ]; then + echo "Error: Volatile state file $VOLATILE_STATE_FILE does not exist." + exit 1 +fi + +# Shut the TPM down +exec 100>&- +run_swtpm_ioctl ${SWTPM_INTERFACE} -s +if [ $? -ne 0 ]; then + echo "Error: Could not shut down the CUSE TPM." + exit 1 +fi + +echo "Test 3: Ok" diff --git a/tests/_test_tpm2_save_load_encrypted_state b/tests/_test_tpm2_save_load_encrypted_state index 2639149b..ee576492 100755 --- a/tests/_test_tpm2_save_load_encrypted_state +++ b/tests/_test_tpm2_save_load_encrypted_state @@ -312,8 +312,82 @@ if [ "${sha1_permanent}" != "$(get_sha1_file "${STATE_FILE}")" ]; then exit 1 fi +run_swtpm_ioctl ${SWTPM_INTERFACE} -s +if [ $? -ne 0 ]; then + echo "Error: Could not shut down the ${SWTPM_INTERFACE} TPM." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi + +kill_quiet -0 ${SWTPM_PID} 2>/dev/null +if [ $? -eq 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM should not be running anymore." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi + +# shut it down + echo "Test 2: Ok" +# This time start we start the TPM with a wrong state encryption key +# (key used as password) and try to start it. It has to fail and +# the state must not have been modified. + +# volatile state file does not exist +sha1_volatile=$(get_sha1_file "${VOLATILE_STATE_FILE}") +sha1_permanent=$(get_sha1_file "${STATE_FILE}") +echo "sha1(volatile): $sha1_volatile sha1(permanent): $sha1_permanent" + +# we need a 256bit key +echo "${KEY}${KEY}" > $keyfile + +run_swtpm ${SWTPM_INTERFACE} \ + --key pwdfile=$keyfile,mode=aes-256-cbc \ + --log file=$logfile \ + --tpm2 + +ps aux | grep $SWTPM | grep -v grep + +kill_quiet -0 ${SWTPM_PID} +if [ $? -ne 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM did not start." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi + +# Init the TPM +run_swtpm_ioctl ${SWTPM_INTERFACE} -i +if [ $? -eq 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM initialization should have failed." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi + +kill_quiet -0 ${SWTPM_PID} 2>/dev/null +if [ $? -ne 0 ]; then + echo "Error: ${SWTPM_INTERFACE} TPM not running anymore after failed INIT." + echo "TPM Logfile:" + cat $logfile + exit 1 +fi + +if [ "${sha1_volatile}" != "$(get_sha1_file "${VOLATILE_STATE_FILE}")" ]; then + echo "Error: Volatile state file was modified during failed init." + exit 1 +fi + +if [ "${sha1_permanent}" != "$(get_sha1_file "${STATE_FILE}")" ]; then + echo "Error: Permanent state file was modified during failed init." + exit 1 +fi + +echo "Test 3: Ok" + # Final shut down exec 100>&- run_swtpm_ioctl ${SWTPM_INTERFACE} -s @@ -323,7 +397,6 @@ if [ $? -ne 0 ]; then cat $logfile exit 1 fi -sleep 0.5 kill_quiet -0 ${SWTPM_PID} 2>/dev/null if [ $? -eq 0 ]; then diff --git a/tests/data/keyfile256bit.txt b/tests/data/keyfile256bit.txt new file mode 100644 index 00000000..b454eb67 --- /dev/null +++ b/tests/data/keyfile256bit.txt @@ -0,0 +1 @@ +1234567890123456789012345678901212345678901234567890123456789012 \ No newline at end of file diff --git a/tests/data/tpm2state2b/pwdfile.txt b/tests/data/tpm2state2b/pwdfile.txt new file mode 100644 index 00000000..b3c42b5a --- /dev/null +++ b/tests/data/tpm2state2b/pwdfile.txt @@ -0,0 +1 @@ +mypassword \ No newline at end of file diff --git a/tests/data/tpm2state2b/tpm2-00.permall b/tests/data/tpm2state2b/tpm2-00.permall new file mode 100644 index 00000000..286c24b8 Binary files /dev/null and b/tests/data/tpm2state2b/tpm2-00.permall differ diff --git a/tests/data/tpm2state2b/tpm2-00.volatilestate b/tests/data/tpm2state2b/tpm2-00.volatilestate new file mode 100644 index 00000000..15c3e7a4 Binary files /dev/null and b/tests/data/tpm2state2b/tpm2-00.volatilestate differ diff --git a/tests/data/tpmstate2b/pwdfile.txt b/tests/data/tpmstate2b/pwdfile.txt new file mode 100644 index 00000000..b3c42b5a --- /dev/null +++ b/tests/data/tpmstate2b/pwdfile.txt @@ -0,0 +1 @@ +mypassword \ No newline at end of file diff --git a/tests/data/tpmstate2b/tpm-00.permall b/tests/data/tpmstate2b/tpm-00.permall new file mode 100644 index 00000000..843cc35c Binary files /dev/null and b/tests/data/tpmstate2b/tpm-00.permall differ diff --git a/tests/data/tpmstate2b/tpm-00.volatilestate b/tests/data/tpmstate2b/tpm-00.volatilestate new file mode 100644 index 00000000..9522dec7 Binary files /dev/null and b/tests/data/tpmstate2b/tpm-00.volatilestate differ diff --git a/tests/test_parameters b/tests/test_parameters index 3597bfba..7662de01 100755 --- a/tests/test_parameters +++ b/tests/test_parameters @@ -25,6 +25,8 @@ PARAMETERS=( "--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display" "--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile.txt" "--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt" + "--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile256bit.txt --cipher aes-256-cbc" + "--createek --create-ek-cert --create-platform-cert --lock-nvram --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt --cipher aes-256-cbc" ) FILESIZES=( diff --git a/tests/test_tpm2_parameters b/tests/test_tpm2_parameters index a0e8046b..e432443c 100755 --- a/tests/test_tpm2_parameters +++ b/tests/test_tpm2_parameters @@ -16,6 +16,8 @@ PARAMETERS=( "--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display" "--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile.txt" "--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt" + "--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile256bit.txt --cipher aes-256-cbc" + "--createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt --cipher aes-256-cbc" "--ecc --createek" "--ecc --createek --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display" "--ecc --createek --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile.txt" @@ -24,6 +26,8 @@ PARAMETERS=( "--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display" "--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile.txt" "--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt" + "--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --keyfile ${TESTDIR}/data/keyfile256bit.txt --cipher aes-256-cbc" + "--ecc --createek --allow-signing --create-ek-cert --create-platform-cert --config ${TESTDIR}/swtpm_setup.conf --vmid test --display --pwdfile ${TESTDIR}/data/pwdfile.txt --cipher aes-256-cbc" ) # produced file size is always the same with TPM2