Move the code to get the TPM state blobs into is own function and introduce
a caching layer that retrieves the state blob from the TPM once and has
subsequent requests to copy the state work on the cached blob.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add an ioctl that lets an application retrieve which keys are in use by the
TPM, i.e., file encryption or migration key
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
The migration key ensures that TPM state blobs, when retrieved using the
ioctl for getting state blobs, are always encrypted with this key.
When the state is later on loaded back into the TPM using the ioctl
to set the state blobs, the migration key is used to decrypt them.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Have the crypto functions use a key as a parameter rather than having them
operate on a specific fixed key.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Break the key parsing function apart into a common parsing function
and one specific to the file encryption key.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Prepend a header in front of all blobs retrieved from the TPM.
Write flags into this header indicating whether the blob is
encrypted.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Have test_resume_volatile create a temporary dir and copy test files to it
that may be modified during the test run.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Integrity protect the TPM state when it is written in entrypted form.
libtpms state (for TPM1.2) is also integrity protecting the blobs, but
we better determine the integrity of the decrypted data on the layer
above it.
Change the type of the len variable from size_t to ssize_t for
comparison against neg. values to work.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Change variable type of val1 and val2 from unsigned char to char for
the comparison with neg. numbers to work.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Add a test case that ensures that swtpm-localca automatically
creates a signing key and issuer cert if none is available.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Automatically create the signing key and a self-signed issuer
certificate if the state dir has to be created.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Rather than only using the ioctl to reset the TPM Establishment
bit in a given locality, also use the TPM_ResetEstablishmentBit
command for it in some test cases.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
PPC64 seems to not work with 8k blob sizes, but 7k worked.
To be on the safe size, we set the size so that the requests
and responses are below a 4k page size.
Add documentation to the options source code and introduce an explicit
default value to return in case an option was not found while parsing.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
