Use the EVP_CIPHER implementation for the AES CBC computations. This
API has been supported already in OpenSSL 1.1.x for sure and is also
not deprecated in OpenSSL 3.0.
This now resolves issue #538.
We can build src/swtpm without having to suppress deprecated API warnings.
Since this is the last issue related to OpenSSL deprecated APIs, we don't
need to suppress any OpenSSL 3.0 deprecated API warnings anymore.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add an implementation of SWTPM_HMAC using non-deprecated APIs when
compiling with OpenSSL 3.0.
This partially addresses issue #538.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Use the (undocumented) OPENSSL_SUPPRESS_DEPRECATED to suppress the
deprecated API warnings when compiling swtpm and swtpm_setup with
OpenSSL 3.0.0 replacing the global -Wno-deprecated-declarations.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
When there is a delay between "Sending TPM2_NV_Write with wrong
password" and "timenow=$(date +%s)", the test can fail with "Error: Did
not get expected failure from TPM2_NV_Write() with good password.
Lockout should be enabled.". This can sometimes happen on slow or busy
systems.
To stabilize the test, this patch introduces precise recovery time
measurement ($timerecovery) and check good password works after that
time. As for lockout timeout, moves starting timer just before
TPM2_NV_Write and check good password fails before that time.
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
To be able to build with OpenSSL 3.0 we need to added
-Wno-deprecated-declarations to the default CFLAGS.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Instead of directly accessing TPM state store file, use --print-states
to check if there is existing state file or not. This can reduce TPM
state directory dependencies of swtpm_setup.
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
--print-states reports TPM states stored in --tpmstate backend.
This feature is supposed to be used by swtpm_setup for checking TPM state
existence.
Sample output is as follows:
$ swtpm socket --print-states --tpmstate dir=/tmp --tpm2 | jq .
{
"type": "swtpm",
"states": [
{
"name": "tpm2-00.permall"
}
]
}
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Introduce GetFilepathForName() and use it to get a rooted state file
path instead of existing GetFilenameForName().
Move GetFilenameForName() to swtpm_nvstore.c so that other TPM state
store backend can use it.
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
The tests for the following options:
- with "--overwrite"
- with "--not-overwrite"
- without "--overwrite" nor "--not-overwrite"
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Currently swtpm_setup saves ek.cert and platform.cert to TPM state
directory and removes them later. As the usage of these files are
temporary, temp directory can be used for this purpose. This reduces
dependencies on TPM state dir, which is convenient for pluggable state
store (https://github.com/stefanberger/swtpm/issues/461).
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Skip tests that require the chardev after checking for the chardev
interface support in swtpm. Remove the conditional addition of chardev
related tests from the Makefile.am.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix the following compilation issue:
swtpm_nvstore_dir.c: In function 'SWTPM_NVRAM_Validate_Dir':
swtpm_nvstore_dir.c:149:86: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body]
TPM_DEBUG("SWTPM_NVRAM_Validate_Dir: Rooted state path %s\n", tpm_state_path);
^
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
glib's (v2.68) g_thread_pool_new() calls the syscall sched_setattr(),
which we must allow to avoid termination of the CUSE TPM.
This patch resolves issue #520.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add an options to specify pluggable backend URI.
Ex:
--tpmstate backend-uri=dir://<path_to_dir>
Backend URI is specific to each backend plugin which points to the
location of the NVRAM files.
Currently, "dir" is the only one available backend. In this case
backend-uri should be a path to the directory where files are stored.
This option is designed to compatible with existing "dir" option.
If "dir" is specified, swtpm prioritize "dir" ignoring "backend-uri".
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Related GH issue: https://github.com/stefanberger/swtpm/issues/461
This patch adds an abstraction layer to NVRAM state store implementation
for pluggable storage backends. No functional changes are intended in
this change. The default state store backend ("dir backend") keeps
current behavior.
To make swtpm ready for pluggable store, this patch moves file related
operations to the seperate file (swtpm_nvstore_dir.c) and defined the
interface for plugins (nvram_backend_ops in swtpm_nvstore.h). The
interface can be used by each plugin which will be added later.
With the interface, each plugin can access its "backend_uri" which
points to the location of the backend storage, for example S3 bucket
URL or iSCSI URL, and decide how it stores TPM state data.
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Implement get_supported_tpm_versions to get swtpm's support for TPM 1.2
and TPM 2 and use it error out in case user choose a TPM version that
is not supported. Also display the supported TPM versions in the
capabilites JSON.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The "version" field can be used to decide when capabilities are
supported/reported and give some library build details.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Skip test cases for TPM 1.2 if TPM 1.2 support is not provided by swtpm.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
[ skip more tests ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
A version was selected early for TPMLIB_GetInfo() to succeed in
--print-capabilities. TPM 1.2 is the default version, but can now be
disabled in libtpms.
Ignore the error when the version is unsupported by libtpms and skip
reporting the GetInfo related details.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Fix the handler for control channel command CMD_SET_DATAFD so that
it ORs new bits onto mlp->flags instead of overwriting its value.
This was causing loss of flags previously set during command-line
argument parsing, which resulted in user-provided options (e.g.
--terminate) to be permanently ignored if command CMD_SET_DATAFD
was at any point received on the control channel.
Signed-off-by: Nick Chevsky <nchevsky@users.noreply.github.com>
Use the --write-ek-cert-files option in existing test cases
and check for written files and correctness of the files.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Write the EK certificate files into the directory specified as parameter
to the --write-ek-cert-files option.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Pass an optional key_description parameter through the APIs to be able to
get the a human readable key description, such as 'rsa2048' or 'secp384r1'
of the key that was created.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move code from setpm_setup into new function check_directory_access
that checks for existence of directory and access to it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The PID filename was generated using the ${SWTPM} environment variable,
which caused test failures if set to a URL for example. Replace it with
'swptm'.
This issue was reported in issue #454.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
- Move content of swtpm-localca(8) manual page to swtpm_localca(8)
and make swtpm-localca(8) an alias for swtpm_localca(8), mirroring
the fact that /usr/bin/swtpm_localca is the actual program and
/usr/share/swtpm/swtpm-localca a wrapper for it.
- Change references to `swtpm-localca` in manual pages' content to
`swtpm_localca`, reflecting the actual name of the program they are
meant to document.
Signed-off-by: Nick Chevsky <nchevsky@users.noreply.github.com>
Add MY_CFLAGS, CFLAGS, and MY_LDFLAGS to all Makefile.am's so that they
can be defined during configure time as well as CFLAGS added during
build time. LDFLAGS were already handled correctly during build-time.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To avoid the following warning use MY_ as a prefix for the offending
variables that have AM_ as a prefix:
configure.ac:587: warning: macro 'AM_CFLAGS' not found in library
configure.ac:590: warning: macro 'AM_LDFLAGS' not found in library
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
- debian/clean: Add files that were not being automatically cleaned
up by dh(1)'s `clean` target.
- debian/control:
- Add new recommended/required fields and bump Standards-Version.
- Remove redundant build dependencies that are implied transitively.
- Bump debhelper dependency version to match debian/compat.
- Move swtpm-libs's ${misc:Pre-Depends} dependency to `Pre-Depends`.
Resolves `depends-on-misc-pre-depends` Lintian warning.
- Sort packages and dependency lists alphabetically as per
wrap-and-sort(1).
- debian/not-installed: List deliberately non-installed files to
avoid dh_missing(1) warnings.
- debian/rules:
- Pass --no-scripts to dh_makeshlibs(1) in order to keep a
ldconfig(8) trigger from being implicitly added, which for
this package was redundant and triggered Lintian warning
`package-has-unnecessary-activation-of-ldconfig-trigger`.
- Remove redundant --parallel dh flag.
- Remove redundant dh_usrlocal override.
- debian/*.install:
- Add swtpm-create-tpmca(8) and its manpage, which were missing.
- Remove redundant `#! /usr/bin/dh-exec` lines.
- Sort entries alphabetically as per wrap-and-sort(1).
- debian/swtpm-tools.postinst.in: Add `set -e` to fail in case of
error. Fixes `maintainer-script-ignores-errors` Lintian warning.
Signed-off-by: Nick Chevsky <nchevsky@users.noreply.github.com>
