From a73e9cb831acd820dc83ece682f80ceba96a6bcf Mon Sep 17 00:00:00 2001
From: Stefan Berger <stefanb@linux.vnet.ibm.com>
Date: Tue, 15 Sep 2020 18:34:59 -0400
Subject: [PATCH] samples: Apply password for signing key when creating
 platform cert (bugfix)

Apply the password for the signing key and parent key when creating a
platform certificate. The bug was introduced in commit 961bb827
"samples: Use new pwd format option for secretly passing passwords"

Extend a test case to ensure that the passwords are always used.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
 samples/swtpm-localca.in              |  2 ++
 tests/test_tpm2_samples_swtpm_localca | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/samples/swtpm-localca.in b/samples/swtpm-localca.in
index 23d2e4bc..30086330 100755
--- a/samples/swtpm-localca.in
+++ b/samples/swtpm-localca.in
@@ -290,6 +290,8 @@ create_cert() {
 			swtpm_cert \
 			--subject "$subj" \
 			$options \
+			${SIGNKEY_PASSWORD:+--signkey-pwd file:<(echo -en "$SIGNKEY_PASSWORD")} \
+			${PARENTKEY_PASSWORD:+--parentkey-pwd file:<(echo -en "$PARENTKEY_PASSWORD")} \
 			$tpm_attr_params \
 			--type platform \
 			--signkey "${SIGNKEY}" \
diff --git a/tests/test_tpm2_samples_swtpm_localca b/tests/test_tpm2_samples_swtpm_localca
index f3b78a02..4f1193f4 100755
--- a/tests/test_tpm2_samples_swtpm_localca
+++ b/tests/test_tpm2_samples_swtpm_localca
@@ -41,6 +41,7 @@ statedir=${workdir}
 signingkey = ${SIGNINGKEY}
 issuercert = ${ISSUERCERT}
 certserial = ${CERTSERIAL}
+signingkey_password = password
 _EOF_
 
 cat <<_EOF_ > "${workdir}/swtpm-localca.options"
@@ -78,6 +79,27 @@ do
     exit 1
   fi
 
+  # Signing key should always be password protected
+  if [ -z "$(grep "ENCRYPTED PRIVATE KEY" "${SIGNINGKEY}")" ]; then
+    echo "Error: Signing key is not password protected."
+    exit 1
+  fi
+
+  # For the root CA's key we flip the password protection
+  if [ -n "${SWTPM_ROOTCA_PASSWORD}" ] ;then
+     if [ -z "$(grep "ENCRYPTED PRIVATE KEY" "${workdir}/swtpm-localca-rootca-privkey.pem")" ]; then
+       echo "Error: Root CA's private key is not password protected."
+       exit 1
+     fi
+     unset SWTPM_ROOTCA_PASSWORD
+  else
+     if [ -n "$(grep "ENCRYPTED PRIVATE KEY" "${workdir}/swtpm-localca-rootca-privkey.pem")" ]; then
+       echo "Error: Root CA's private key is password protected but should not be."
+       exit 1
+     fi
+     export SWTPM_ROOTCA_PASSWORD=xyz
+  fi
+
   if [ ! -r "${workdir}/ek.cert" ]; then
     echo "Error: ${workdir}/ek.cert was not created."
     exit 1
@@ -114,6 +136,9 @@ do
     echo "Error: Could not verify certificate chain."
     exit 1
   fi
+
+  # Delete all keys to have CA re-created
+  rm -rf "${workdir}"/*.pem
 done
 
 echo "Test 1: OK"