The ECC storage primary key was mistakently created in the endorsement
hierarchy but should be in the owner hierarchy. This patch corrects this
to have this key created in the owner hierarchy (like the RSA key),
thus using 0x40 00 00 01.
This only mattered if one used --create-spk and --ecc together.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Return the result of the called function rather than 0.
Fixes: d65f5ae1 ("swtpm_setup: Create RSA 2048 and ECC NIST P256 keys and certs")
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove tpm2_stirrandom, which we should not need to run on a newly
created TPM 2.
Also remove tpm2_changeeps which was called twice when creating two
EKs, thus invalidating a previous EK that may have been created.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Switch to NIST P384 curves for the storage primary key as well as the 2nd EK.
The EK part now complies with the following specification:
TCG PC Client Platform TPM Profile Specification for TPM 2.0
Version 1.04
Revision 37
February 3, 2020
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Following "TCG PC Client Platform TPM Profile Specification for
TPM 2.0, version 1.04, Rev 37" create and RSA and an ECC NIST P256
key now. We will upgrade the ECC NIST key to P384 in the next
step.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Pass the ECC curve id and hash algorithm and the ECC_NONCE to the
function creating the ECC keys rather than hard coding them. Rename
the functions that create the NIST_P256 ECC keys to have _nist_p256
suffix in the name.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Rather than passing the offset of the 2nd part of an ecc key pass
the length of the key and calculate the 2nd offset using the length.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Leave a not about what version of template was used for the
RSA and ECC EK keys before updating them now.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement support for passing the curve id via the --curve-id
option. Default assumes secp256r1. secp384r1 is also supported.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
tssgetcapability only retrieves a maximum of 64 handles by default.
However, there are 65 persisted keys. Pass -pc 80 to the command to
see all 65 Handles.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Handle the default cases, which shouldn't ever be reachable, and set
the tocopy to '0' so that no unitialized variable gets copied.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add a test case that fills up the NVRAM area with as many persisted keys
as possible and then fills up the rest with an NVRAM index so that all
space is occupied. We have to be able to load this state again into the
NVRAM once the OBJECT's size increases due to RSA keys size increase,
which must have us increase the total size of NVRAM in libtpm's TPM profile.
The state in tests/data/tpm2state5/tpm2-00.permall was created using
libtpms 0.6.0, where only 2048 bit keys were supported and total NVRAM size
was 128kb. This state file should never be changed and always be loadable
into a current libtpms. In its USER NVRAM it holds 64 persisted 2048 bit
keys and an NVRAM index with 236 bytes. For this to stay the reference
NVRAM, we need to make sure that it fits exactly to the byte.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Sometimes the download of the TPM 1.2 test suite from sourceforge
fails. So retry up to 3 times and wait a random seconds in the interval
of [3..10] before retrying.
Check the hash of the file we downloaded to make sure we get what we
expected.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add a test case testing the returned value from
swtpm <iface> --tpm2 --print-capabilities
along with those return from swtpm_setup.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
It's not necessary anymore to #include <seccomp.h> from the main programs.
Once removed, it also fixes the build on SuSE where seccomp.h is in
seccomp/seccomp.h and we didn't use the LIBSECCOMP_CFLAGS for swtpm.c etc.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Extend the script that creates a CA that uses a TPM 2 for signing.
For this we have to create tokens using the TPM 2 pkcs11 module's
tpm2_ptool and can then use the p11tool for creating keys.
Add a test case that requires a running tpm2-abrmd and tpm2_ptool.
Eventually the test case should (try to) start its own tpm2-abrmd
and talk to swtpm directly but the tcti module to do that isn't
available as a package, yet.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Compilation on cygwin reports the following issue:
In file included from key.c:43:
key.c: In function ‘key_stream_to_bin’:
key.c:135:26: error: array subscript has type ‘char’ [-Werror=char-subscripts]
135 | !isspace(input[digits]) &&
| ~~~~~^~~~~~~~
key.c:143:40: error: array subscript has type ‘char’ [-Werror=char-subscripts]
143 | if (input[digits] && !isspace(input[digits]))
| ~~~~~^~~~~~~~
Address the issue using an explicit cast of char to int.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove some commented code and some code that isn't executed any
differently for the user id that's running it.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Create orderly NVRAM indices and then clear the TPM 2 so that NvDeleteRam()
gets executed and we get better code coverage.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Modify the test_tpm2_save_load_state_3 to create 2 orderly NVRAM indices
in the first two locations. Those indices will be cleared by a reset
of the TPM and therefore cannot be read once the TPM 2 restarts after
the reset. This also provides better test coverage.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The IBM TSS2 is available starting with Bionic. Use it there
to extend the test coverage of the code.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To make the test cases work on Travis on Bionic replace all occurrences of
localhost with 127.0.0.1. The only affected client tools seem to be those
related to the TPM 1.2 and the IBM TSS2. For some reason the API used
there cannot resolve localhost to 127.0.0.1.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To make swtpm_setup.sh work on Travis on Bionic we need to
explicitly set TCSD_TCP_DEVICE_HOSTAME=127.0.0.1 since lookup
of localhost (with the API the tcsd is using) does not work.
It doesn't negatively affect any other use case, so no problem
setting it.
Also replace localhost in the bash tcp device path with 127.0.0.1.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Previous commit broke the run_test script and only ended up running
the first test. This patch fixes it and displays an success message
at the end.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Diable testing with the CUSE interface in run_test.sh. The CUSE driver
in Linux seems to have some stability problems.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The simplest way to detect whether SWTPM_EXE is a 64 bit application on
Linux is to check whether it links against any library in a */lib64/*
directory and only if this is the case we run a particular test case for
which we know what keys 64 bit TPMs are producing given a pre-created
state.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Upgrade to use the IBM TSS2 tests from v1.4.0 but eliminate all testing
with 3072 bit RSA keys.
This test also passes with libtpms 0.6.0 and 0.7.0.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Allow specifying a libtpms revision to test with, defaulting to
master branch.
Have the OS X test use the stable-0.6.0 branch.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
'swtpm chardev --vptm-proxy' currently requires a '--flag startup-xyz'
to be passed since otherwise the need_init_cmd variable would not be
set to false and swtpm would terminate after sending the startup
command. To maintain backwards compatibility we have to always
set the need_init_cmd variable to false for the --vtpm-proxy case
and must not require a startup flag to be passed.
Roll back one of the test case to not use the startup flag.
Fixes: e6bc4bdf0 ('swtpm: Enable sending startup commands ...')
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
libtpms may not support TDES, so we have to skip test case 4 in
case we encounter an allowed error message.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Remove the CUSE TPM from the build and adjust the rules file
so that the build works on Ubuntu servers for example.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
