As objected by QEMU upstream developers to use two different sockets for
starting/using of swtpm, This commit adds support for passing unix domain
socket over control channel.
The summary of the changes include:
- Defined new control command CMD_SET_DATAFD, using this clients can send data
socket.
- set mlp.fd and mlp.flags outside of the mainloop
- updated the testcases
Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com>
In preparation for receiving control messages via UnixIO sockets,
switch to recvmsg() for receiving the first chunk of data.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Enable receiving control commands in small chnunks. Allow 500ms
for the whole control command to be received.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add the missing PTM_CAP_GET_CONFIG to the returned flags.
Fix the order of the flags on the way.
Fix the test cases that test for the flags.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Remove the check for the FUSE_IOCTL_COMPAT flag to make a 32bit
CUSE swtpm work on 64bit host.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Use a new and encrypted token. Fix other parameters. Build works now
and submits to coverity if coverty_scan branch is pushed to.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Fix possible illegal buffer access in case a character device
is used via ioctl. In this case we have to make sure we only
access the number of bytes in the ioctl structure itself.
In case of a socket, make sure we received enough bytes to
be able to access the payload.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Refactor the tests so that they all run on socket interfaces as well.
Use socket ports in the range of 65400-65499 for TPM 1.2 tests.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
To be able to run tests with either one of the interfaces, add function
for running swtpm and swtpm_ioctl commands and form the command line
parameters dependent on the type of interface being passed. We rely on
environment variables to provide the specific parameters that are needed
to run the program with the appropriate parameters.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Change the startup behavior with respect to requiring an INIT command
via control channel. We change this for the socket and chardev
interfaces so that the behavior now is the same as that of the CUSE
interface.
Introduce the --flag not-need-init command line option for the socket
and chardev interfaces to allow the old behavior using this option.
Adapt some of the test cases and swtpm_setup.sh.in that now need this
command line flag.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Allow running swtpm_setup directly as tss user using the following
command lines as an example for how to do it:
mkdir /tmp/test-tss
chown tss:tss /tmp/test-tss
chmod 770 /tmp/test-tss
su -c "swtpm_setup --tpm-state /tmp/test-tss" -s /bin/sh tss
This change prevents us from requiring invocation under the root
user.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Replace the show_help variable with change_user varaible with
opposite logic. The name of the variable is better for upcoming
changes.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
If the return code from the command processing function is 0,
get the error code from the command response and return that one
instead. The problem was that clients though resetting the
establishment bit worked in locality 0 for example, while it did
not.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Return the number of bytes received in case ctrlcmd does not
use an ioctl because in this case we need to know how many bytes
we received in the response.
The receiving of the state blob also needs to take into account
how many bytes were received in the initial response so we write
the proper amount of bytes from that response into the file.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
While parsing the options we modified the argv[] values and
the commas disappeared, which showed when checking for the
swtpm processes using 'ps'. So, work on a copy of the options
parameter.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
There was an offset bug in the code getting the state blobs
from a client.
Also fix an endianess bug in a control channel command.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement allow-set-locality for CUSE TPM and extend the existing
locality test case with commands that try to write the SetLocality
comamnd to the device.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement support for --locality allow-set-locality option that
is primarily useful in cases when the VTPM proxy access is enabled
by file descriptor passing.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add options for locality handling so that commands in locality
4 for example are rejected per command line parameter. This is
useful when the vTPM is used with containers.
Also implement the custom TPM/TPM2_SetLocality command to allow
the Linux vTPM proxy driver to set the locality in which subsequent
TPM commands will be executed.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Fix the missing check of return code from handle_server_options
to check for negative value like all the other checks also do.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Use logprintf wherever possible. While the logging is not set up,
print error messages to stderr and prefix them with 'swtpm: '. After
the logging has been set up all error messages go into the log file.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Use a buffer for printing in TPM_PrintAll. Emit the buffer
upon a new line. This prepares for printing every line with
a prefix.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add MAIN_LOOP_FLAG_READALL for non SOCK_STREAM client sockets. This allows
reading all socket data once.
Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com>
swtpm server is closing the client data connection after serving a single
request, which shall not happen. Hence added MAIN_LOOP_FLAG_KEEP_CONNECTION
mainloop flag to keep the client data connection alive, till client is alive.
Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com>
New option '--ctrl clientfd=<fd>' is added to the control socket parameters.
The passed 'fd' is used as control channel client-fd and treated as single
client mode.
Signed-off-by: Amarnath Valluri <amarnath.valluri@intel.com>
