- Move swtpm_localca's sources out of samples/ (where they no longer
belong now that swtpm_localca is a binary) to src/swtpm_localca/.
- Tests now call the swtpm_localca binary directly at the location
where it was built, as they do with all other compiled programs.
- Simplify samples/swtpm-localca.in and delete swtpm-localca.2inst,
removing the now-unnecessary logic to selectively call swtpm_localca
from different locations (samples/ when running tests vs. /usr/bin/
post-installation).
Signed-off-by: Nick Chevsky <nchevsky@users.noreply.github.com>
Since commit 502cb1129a -D_FORTIFY_SOURCE=2 is passed to the gcc
command line resulting in memcpy() becoming a macro on Cygwin, which
then causes the following compiler errors due to the anonymous arrays
being used:
swtpm.c: In function ‘swtpm_tpm2_createprimary_ek_rsa’:
swtpm.c:686:26: error: macro "memcpy" passed 34 arguments, but takes just 3
686 | }, authpolicy_len);
| ^
In file included from /usr/include/string.h:180,
from swtpm.c:15:
/usr/include/ssp/string.h:97: note: macro "memcpy" defined here
97 | #define memcpy(dst, src, len) __ssp_bos_check3(memcpy, dst, src, len)
|
swtpm.c:682:9: error: statement with no effect [-Werror=unused-value]
682 | memcpy(authpolicy, (unsigned char []){
| ^~~~~~
swtpm.c:698:26: error: macro "memcpy" passed 50 arguments, but takes just 3
698 | }, authpolicy_len);
| ^
The solution is to surround the anonymous array definitions with '( )'.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Add fsync(2) before rename(2) for temp file to ensure data reaches disk
and for directory which containing state file to ensure directory entry
also reaches disk.
Signed-off-by: Eiichi Tsukata <eiichi.tsukata@nutanix.com>
Some of the code comes from libtpms, where various methods are named
"TPM_Something". The swtpm version of these methods are named
"SWTPM_Something". However, certain debug/log messages and comments were
updated accordingly to reflect that.
This is a cosmetic change that fixes that.
Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
Cygwin's regex implementation doesn't seem to understand '\\s'
but needs [[:space:]] instead to properly skip over spaces.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch addresses the following gcc-11 compiler issues:
In file included from /usr/include/glib-2.0/glib.h:114,
from swtpm_setup_utils.c:14:
swtpm_setup_utils.c: In function 'get_config_value':
/usr/include/glib-2.0/glib/glib-autocleanups.h:28:3: error: 'tmp' may be used uninitialized in this function [-Werror=maybe-uninitialized]
28 | g_free (*pp);
| ^~~~~~~~~~~~
swtpm_setup_utils.c:36:31: note: 'tmp' was declared here
36 | g_autofree gchar *tmp;
| ^~~
swtpm.c: In function 'swtpm_start':
/usr/include/glib-2.0/glib/glib-autocleanups.h:28:3: error: 'pidfile_file' may be used uninitialized in this function [-Werror=maybe-uninitialized]
28 | g_free (*pp);
| ^~~~~~~~~~~~
swtpm.c:54:23: note: 'pidfile_file' was declared here
54 | g_autofree gchar *pidfile_file;
| ^~~~~~~~~~~~
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This is a 1:1 rewrite of swtpm_localca in 'C' as a final step to get
rid of the python dependency. It addresses issue #437.
Tested on: Cygwin, Fedora 33, Ubuntu Xenial & Bionic, FreeBSD,
DragonFlyBSD, OpenBSD (i386), Mac, Debian (recent), Centos-8,
CentOS (recent), Alpine (recent), OpenSUSE (recent),
Fedora 28 PPC Big Endian
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This is a 1:1 rewrite of swtpm_setup in 'C' as a first step to get
rid of the python dependency. It addresses issue #437.
Tested on: Cygwin, Fedora 33, Ubuntu Xenial & Bionic, FreeBSD,
DragonFlyBSD, OpenBSD (i386), Mac, Debian (recent), Centos-8,
CentOS (recent), Alpine (recent), OpenSUSE (recent)
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Some of the wording in the help screen was odd, so rephrase it.
Fix the default owner and SRK passwords for the TPM 1.2 case.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Fix some typos. The value for TPM2_ALG_SHA3_512 was wrong but also is
currently not used since libtpms does not support it yet.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Initialize the key structure before loading the key into it. This
resolves an issue raised by Coverity, but doesn't seem to be really
necessary.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
These types have been renamed in libtasn1 version 3.0 (released 2012-10-28).
The most recent libtasn1 version 4.17.0 (released 2021-05-13) now prints
deprecation warnings that are made fatal by -Werror:
ek-cert.c:76:13: error: 'ASN1_ARRAY_TYPE' macro is deprecated, use 'asn1_static_node' instead. [-Werror]
76 | extern const ASN1_ARRAY_TYPE tpm_asn1_tab[];
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[...]
The new types were introduced almost ten years ago, so they should be pretty
universally available by now.
Signed-off-by: Jonas Witschel <diabonas@archlinux.org>
Write a note in swtpm_setup's help screen and man page that the usage
of --allow-signing will lead to a non-standard EK. Be more precise in the
man page.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Start using timeouts when communicating with swtpm over Unix sockets so
that swtpm_ioctl does not just hang when it cannot communicate with swtpm
such as establishing a connection or reading results. This is because swtpm
listens to nlye one control channel connections.
This patch addresses an aspect of the problem reported in issue #415
but may also starting hiding bugs if certain operations are done in
the wrong order, as was the case in libvirt (6.10 & 7.0).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
We need to probe for the support socketpair() domain. On Linux only
socket.AF_UNIX is support and on Cygwin AF_INET works.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch fixes the following issue:
$ ./src/swtpm/swtpm chardev --print-capabilities --tpm2
swtpm: Error: Missing character device or file descriptor
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch adds support for partial reads to the CUSE swtpm.
We introduce a ptm_read_offset variable that holds the offset where to read
from next. It is reset every time a command has been processed as part of a
write() so that subsequent read()s start reading from offset 0. It is
advanced by the number of bytes that were read.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Asan reports this error for the CUSE TPM. The file_ops_lock was accidentally
duplicated in a code move of threadpool related code out of cuse_tpm.c
This patch removes the unused file_ops_lock from threadpool.c to resolve
the ASAN issue.
=================================================================
==545493==ERROR: AddressSanitizer: odr-violation (0x000000419340):
[1] size=8 'file_ops_lock' cuse_tpm.c:112:8
[2] size=8 'file_ops_lock' threadpool.c:55:8
These globals were registered at these points:
[1]:
#0 0x14f6c27f3cc8 (/lib64/libasan.so.6+0x37cc8)
#1 0x40c2c3 in _sub_I_00099_1 (/home/stefanb/tmp/swtpm/src/swtpm/.libs/lt-swtpm+0x40c2c3)
#2 0x40c31c in __libc_csu_init (/home/stefanb/tmp/swtpm/src/swtpm/.libs/lt-swtpm+0x40c31c)
[2]:
#0 0x14f6c27f3cc8 (/lib64/libasan.so.6+0x37cc8)
#1 0x14f6c27aad1a in _sub_I_00099_1 (/home/stefanb/tmp/swtpm/src/swtpm/.libs/libswtpm_libtpms.so.0+0x25d1a)
#2 0x14f6c31dc7b1 in call_init.part.0 (/lib64/ld-linux-x86-64.so.2+0x117b1)
==545493==HINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_odr_violation=0
SUMMARY: AddressSanitizer: odr-violation: global 'file_ops_lock' at cuse_tpm.c:112:8
==545493==ABORTING
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Do not bother trying to keep pidfilefd open in case fd = pidfilefd,
but close it unconditionally. If writing the pidfile fails, the process
terminates anyway, besides that we only ever need to write to the
pidfile once, which is happening in this function.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch fixes the following compilation issue/bug:
ctrlchannel.c: In function ‘ctrlchannel_process_fd’:
ctrlchannel.c:694:13: error: array subscript ‘ptm_hdata[0]’ is partly outside array bounds of ‘struct output[1]’ [-Werror=array-bounds]
694 | data->u.resp.tpm_result = htobe32(res);
| ^~
ctrlchannel.c:486:7: note: while referencing ‘output’
486 | } output;
| ^~~~~~
Sending hashes to the TPM is not currently used in any major
application, so this bug should not affect much.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Older ARM processors need more time to create the initial CA keys
and then the key for the TPM. So we increase the timeout to 30s.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch addresses CVE-2020-28407.
Use the open() call rather than the fopen() call when accessing
the statefile and make sure we do not follow symlinks using O_NOFOLLOW.
The modification does not allow an attacker to create a symbolic link
with the name of the temporary file (TMP2-00.permall for TPM 2) and
have this point to a valueable file and swtpm ends up overwriting the
file. The success of the attack depends on the attacker having access
to the TPM's state directory (--tpmstate dir=...).
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch addresses CVE-2020-28407.
Use the open() call rather than the fopen() call when creating a pidfile.
Also prevent us from following symbolic links when opening the pidfile for
writing.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This patch addresses CVE-2020-28407.
Prevent us from following symliks when we open the lockfile
for writing.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Lift the code that sets up the vtpm proxy device out of the main
function and put it into its own function.
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
