Proxmox-Port/swtpm
1
0
Fork 0
mirror of https://github.com/stefanberger/swtpm.git synced 2026-08-17 08:37:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

swtpm_setup: Get default rsa keysize from setup_setup.conf if not given

Browse Source 
If the user did not provide the RSA keysize to use try to read it from
setup_setup.conf and if nothing is found there fall back to using the
internal default RSA keysize (2048).

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2024-07-17 09:34:13 -04:00 committed by Stefan Berger
parent 5dfc42c622
commit cc9ee0fbc6
3 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
man/man5/swtpm_setup.conf.pod
View File

@ -95,6 +95,13 @@ This keyword is to be followed by a comma-separated list
of names of PCR banks. The list must not contain any spaces.
Valid PCR bank names are sha1, sha256, sha384, and sha512.
=item B<rsa_keysize> (since v0.10)
This keyword allows to specify the default RSA keysize to be used if it is
not provided with a command line option to swtpm_setup. Any value
that can be passed to swtpm_setup is also valid here, such as 2048, or
'max'. The supported key sizes depend on the version of libtpms.
=back
=head1 SEE ALSO

1
samples/swtpm_setup.conf.in
View File

@ -4,3 +4,4 @@ create_certs_tool_config = @SYSCONFDIR@/swtpm-localca.conf
create_certs_tool_options = @SYSCONFDIR@/swtpm-localca.options
# Comma-separated list (no spaces) of PCR banks to activate by default
active_pcr_banks = @DEFAULT_PCR_BANKS@
rsa_keysize = 2048

26
src/swtpm_setup/swtpm_setup.c
View File

@ -60,6 +60,7 @@
#define SETUP_DECRYPTION_F (1 << 14)
#define SETUP_WRITE_EK_CERT_FILES_F (1 << 15)
#define SETUP_RECONFIGURE_F (1 << 16)
#define SETUP_RSA_KEYSIZE_BY_USER_F (1 << 17)
/* default configuration file */
#define SWTPM_SETUP_CONF "swtpm_setup.conf"
@ -488,6 +489,25 @@ static gchar *get_default_pcr_banks(gchar *const *config_file_lines)
return pcr_banks;
}
/* Get the default RSA keysize from the config file */
static gchar *get_default_rsa_keysize(gchar *const *config_file_lines)
{
gchar *rsa_keysize;
if (!config_file_lines)
return NULL;
rsa_keysize = get_config_value(config_file_lines, "rsa_keysize");
if (rsa_keysize)
g_strstrip(rsa_keysize);
if (rsa_keysize == NULL || strlen(rsa_keysize) == 0) {
g_free(rsa_keysize);
rsa_keysize = g_strdup_printf("%d", DEFAULT_RSA_KEYSIZE);
}
return rsa_keysize;
}
/* Activate the given list of PCR banks. If pcr_banks is '-' then leave
* the configuration as-is.
*/
@ -1246,7 +1266,7 @@ int main(int argc, char *argv[])
g_autofree gchar *pwdfile = NULL;
long int pwdfile_fd = -1;
g_autofree gchar *cipher = g_strdup("aes-128-cbc");
g_autofree gchar *rsa_keysize_str = g_strdup_printf("%d", DEFAULT_RSA_KEYSIZE);
g_autofree gchar *rsa_keysize_str = NULL;
unsigned int rsa_keysize;
g_autofree gchar *swtpm_keyopt = NULL;
g_autofree gchar *runas = NULL;
@ -1412,6 +1432,7 @@ int main(int argc, char *argv[])
case 'A': /* --rsa-keysize */
g_free(rsa_keysize_str);
rsa_keysize_str = strdup(optarg);
flags |= SETUP_RSA_KEYSIZE_BY_USER_F;
break;
case '3': /* --write-ek-cert-files */
g_free(user_certsdir);
@ -1632,6 +1653,9 @@ int main(int argc, char *argv[])
logit(gl_LOGFILE, " The TPM's state will be encrypted using a key derived from a passphrase (fd).\n");
}
if ((flags & SETUP_RSA_KEYSIZE_BY_USER_F) == 0)
rsa_keysize_str = get_default_rsa_keysize(config_file_lines);
if (strcmp(rsa_keysize_str, "max") == 0) {
unsigned int *keysizes = NULL;
size_t n_keysizes;