Proxmox-Port/swtpm
1
0
Fork 0
mirror of https://github.com/stefanberger/swtpm.git synced 2026-08-08 18:46:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

samples: Apply password for signing key when creating platform cert (bugfix)

Browse Source 
Apply the password for the signing key and parent key when creating a
platform certificate. The bug was introduced in commit 961bb827
"samples: Use new pwd format option for secretly passing passwords"

Extend a test case to ensure that the passwords are always used.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2020-09-15 18:34:59 -04:00 committed by Stefan Berger
parent 79a0bdb483
commit a73e9cb831
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
samples/swtpm-localca.in
View File

@ -290,6 +290,8 @@ create_cert() {
swtpm_cert \
--subject "$subj" \
$options \
${SIGNKEY_PASSWORD:+--signkey-pwd file:<(echo -en "$SIGNKEY_PASSWORD")} \
${PARENTKEY_PASSWORD:+--parentkey-pwd file:<(echo -en "$PARENTKEY_PASSWORD")} \
$tpm_attr_params \
--type platform \
--signkey "${SIGNKEY}" \

25
tests/test_tpm2_samples_swtpm_localca
View File

@ -41,6 +41,7 @@ statedir=${workdir}
signingkey = ${SIGNINGKEY}
issuercert = ${ISSUERCERT}
certserial = ${CERTSERIAL}
signingkey_password = password
_EOF_
cat <<_EOF_ > "${workdir}/swtpm-localca.options"
@ -78,6 +79,27 @@ do
exit 1
fi
# Signing key should always be password protected
if [ -z "$(grep "ENCRYPTED PRIVATE KEY" "${SIGNINGKEY}")" ]; then
echo "Error: Signing key is not password protected."
exit 1
fi
# For the root CA's key we flip the password protection
if [ -n "${SWTPM_ROOTCA_PASSWORD}" ] ;then
if [ -z "$(grep "ENCRYPTED PRIVATE KEY" "${workdir}/swtpm-localca-rootca-privkey.pem")" ]; then
echo "Error: Root CA's private key is not password protected."
exit 1
fi
unset SWTPM_ROOTCA_PASSWORD
else
if [ -n "$(grep "ENCRYPTED PRIVATE KEY" "${workdir}/swtpm-localca-rootca-privkey.pem")" ]; then
echo "Error: Root CA's private key is password protected but should not be."
exit 1
fi
export SWTPM_ROOTCA_PASSWORD=xyz
fi
if [ ! -r "${workdir}/ek.cert" ]; then
echo "Error: ${workdir}/ek.cert was not created."
exit 1
@ -114,6 +136,9 @@ do
echo "Error: Could not verify certificate chain."
exit 1
fi
# Delete all keys to have CA re-created
rm -rf "${workdir}"/*.pem
done
echo "Test 1: OK"