To avoid failures with mktemp call on BSD type of systems replace
mktemp --tmpdir=<dir> with TMPDIR=<dir> mktemp, which seems more portable.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
OS X cannot resolve the path we get from genenv("_") when running a
test script on Travis (reason unknown). So we use _NSGetExecutablePath()
instead and display the path in the error message in case realpath()
fails.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Run the build on OSX as well and run a quick test that exercises
some of the config files installed in --prefix=/usr/local
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Adjust the localstatedir variable to not have ${prefix} if
prefix is '/usr/', otherwise use ${prefix}.
Also adjust the files that were pointing to directories that
are controlled by $localstatedir.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
When the project is configured with --prefix=/usr/local several configuration
files are installed to /usr/local/etc but not read by the programs that
need them. This patch fixes this issue by replacing @SYSCONFDIR@ in the source
code of those files with the actual used path.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Allow to build without the TPM 1.2 NVRAM area tools but print out a warning
that they are needed for TPM 1.2 certificate injection.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
The signingkey entry can also be a pkcs11: URI. The semilcolons in the URI
have to be escaped due to the shell reading the entries.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
For PKCS11 modules (such as SoftHSM) to sign a TPM EK or platform
certificate we use 'pkcs11:' prefixed URIs like those URIs for
TPM 1.2 starting with tpmkey:.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
GnuTLS PKCS11 URLs have ';' in the string that we need to preserve for
passing to GnuTLS. So we escape the semicolons before using them on the
command line.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement terminate_proc, which first tries to gracefully terminate a
process and then, if synchronization is requested, waits for 1 second
for it to disappear and then kills it with SIGKILL if it didn't go away.
Use this function for stop_tpm and stop_tcsd, which will first try
to send a SIGTERM to a process assuming it will terminate while we
do something else and then, in case the process needs to be restarted,
make sure that it's gone before it is restarted.
This addresses an issue where previously SIGTERM was sent to a process
before it was restarted but the restarting failed due to the previous
process still holding a lock on the file because it wasn't able to react
to the SIGTERM fast enough.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Uninstall the signal handler before we close the signal handler's
notification file descriptor so that signals received after the file
descriptor is closed do not cause an error.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Make sure that the msg parameter passed into recvmsg wasn't modified
by the library and verify that the pointers and sizes it contains are
still valid after the call. This addresses an issue raised by Coverity.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
To get better code coverage, convert existing test case to
use one time a hex formatted key and the other time the same
key in binary format.
Do some improvements on the test code on the way.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
2 file sizes were missing. Also use $() to execut commands rather
than ``. Use get_filesize to get the size of a file.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Move the packages to install into the addons section and
rename the before_install section to before_script section.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Prevent the LIBS variable from collecting all kinds of libraries
by setting the action-if-found parameter in AC_CHECK_LIB. This
avoid linking of executables with unnecessary libraries.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
If tpmtool supports --srk-well-known we also support the well known
SRK password and allow the user not to provide an SRK password on
the command line.
This patch should have been applied before the previous patch that
tests this. Luckily, only very few systems have tpmtool with
--srk-well-known so that the order would matter there (and cause test
failures).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Extend the swtpm-create-tpmca test with test cases using the
'well known' password of 20 zero bytes if tpmtool supports the
--srk-well-known option.
Besides that, extend the existing test to actually use the TPM CA
for signing a TPM 1.2 or TPM 2 (test) EK and check the contents of the
certificate by grepping through the text info provided by certtool.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Refactor the swtpm-create-tpmca test case so we can use it for
testing with the 'well known' (20 bytes of zeros) SRK password
in the next pass.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Ceritficates for a TPM 2 have to be signed using SHA256 and those for
a TPM 1.2 have to be signed using SHA1 (following specs). We can use
either of these algorithms when using the GnuTLS TPM support since it
will create the hash and have the TPM 1.2 sign whatever it created.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
swtpm_setup.sh does not need to be owned by tss:tss and in the
Fedora package it's not even allowed. So remove the install hook
that was changing the ownership.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Return the result code from the expect script to the caller.
Also, display possible log messages in case the private key file
was not written properly.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Run the TPM CA setup script with a local swtpm and tcsd instance.
We have to take ownership of the TPM and set its SRK passwork so
that the TPM CA setup script can create a signing key as a child
key of the SRK.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Implement the --tcsp-system-ps-file option to make a backup of
TCSD's system_ps_file for later use of the setup TPM with the
TCSD. We need this for a test case.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Integrate the Travis builds with Coveralls.io by sumitting the coverage
results to Coveralls.io.
We have to run the coveralls script with sudo rights since otherwise we
get permission denied errors.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Have the CUSE TPM return the TPM start error, particularly
TPM_DECRYPT_ERROR in case a wrong key was passed, rather than the plain
TPM_FAIL error code. This was a difference with the 'other' swtpm
interfaces that already returned the original error code.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Support creation and usage of the root CA with a password protected
private key. The root CA's key password can be set using the environment
variable SWTPM_ROOTCA_PASSWORD.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
