Certtool seems to not verify a certificate chain properly unless
the certificate has a distinguished name.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Only pass through the vmid parameter to the tool creating the cert
if this parameter was set. The tool creating the cert may require
it or ignore it and is supposed to be able to track certificates
for which it minted certs using this parameter.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
The certificate chain could not be verified due to a wrong
API call for getting the authority key id where the key id
was gotten instead.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Determine the size of the unix_path parameter and then only copy
those number of bytes + terminating null into the destination.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Determine the size of the unix_path parameter and then only copy
those number of bytes + terminating null into the destination.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Check whether filename and input pointers are NULL pointers.
Per previous code this is currently not possibly but should
resolve some issues with Coverity.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Use void * for the command rather than tpm_header *, which we do
not need. This addresses a few Coverity complaints.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Extend the encrypted state test with a test case using a wrong key
for decrypting the state and make sure that the init fails and the
state files remain unmodified.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Move some of the debugging output into its own function and
differentiate output by TPM Version number.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add options --overwrite and --not-overwrite to allow or prevent
overwriting of existing TPM state. If neiter of the options is
given and existing state is found, an error is returned.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement a command for setting and querying the buffer size the
TPM implementation (libtpms) is using. The setting of the
buffersize allows to reduce the size of the buffer to a size
that the interface can support so that these two sizes match
and the TPM will not produce larger responses than what the
interface can support.
Extend swtpm_ioctl with an option to set the buffersize.
Adapt the existing tests to reflect the newly supported command.
Implement a new test for getting/setting of the buffer size.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Changeset aa3999 introduced a segfault when calling
ctrlchannel_set_client_fd() with a NULL pointer. Like all the other
functions, we return with -1 in this case.
Since the segfault occurred on process shutdown no problems were
noticeable through bad test results or so.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Introduce another parameter to ctrlchannel_new and server_new
to pass the Unix socket's path. Implement ctrlchannel_free and
server_free to clean up and remove the Unix socket's path.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement ctrlchannel_set_client_fd() to set a new client
fd and return its current value.
Use this new function to set the file descriptor to -1 upon
closing its associate file descriptor in the main loop.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Implement server_set_fd() function to get the current file descriptor
and set a new one on the server structure.
Use this function to transfer the server file descriptor from the
server structure to the mainloop structure and have the main loop
close the file descriptor.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
