mirror of
https://github.com/stefanberger/swtpm.git
synced 2025-08-22 19:04:35 +00:00
487892f2fc
Add a test case that checks that swtpm sends a TPM2_Shutdown() to the TPM 2 upon abrupt re-initialization (CMD_INIT) or graceful shutdown (control channel, CMD_SHUTDOWN) of the TPM 2 and avoids a potential dictionary attack (DA) lock-out. A previously sent command failing authorization with DA implications would otherwise trigger the TPM_PT_LOCKOUT_COUNTER to increase by '1' if the TPM 2 was not properly shut down by the client (guest OS) with a TPM2_Shutdown() command. The test case tests whether a TPM2_Shutdown() is now sent before a reset. The defined password-protected NVRAM area has the DA flag set and the test case tries to read from it without providing a password. If we didn't send the TPM2_Shutdown() before the test cases sends the reset (CMD_INIT), then the dictionary attack lockout counter would be increased by one. With the instrumentation in the previous patch the automatically sent TPM2_Shutdown() keeps the counter at 0. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
37 lines
883 B
Bash
Executable File
37 lines
883 B
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
TESTDIR=${abs_top_testdir:-$(dirname "$0")}
|
|
ROOT=${abs_top_builddir:-$(dirname "$0")/..}
|
|
source ${TESTDIR}/common
|
|
skip_test_no_tpm20 "${SWTPM_EXE}"
|
|
|
|
cd "$(dirname "$0")"
|
|
|
|
export SWTPM_IOCTL_BUFFERSIZE=100
|
|
export SWTPM_INTERFACE=cuse
|
|
bash _test_tpm2_avoid_da_lockout
|
|
ret=$?
|
|
[ $ret -ne 0 ] && [ $ret -ne 77 ] && exit $ret
|
|
|
|
export SWTPM_INTERFACE=socket+socket
|
|
export SWTPM_SERVER_NAME=localhost
|
|
export SWTPM_SERVER_PORT=65464
|
|
export SWTPM_CTRL_PORT=65465
|
|
bash _test_tpm2_avoid_da_lockout
|
|
ret=$?
|
|
[ $ret -ne 0 ] && [ $ret -ne 77 ] && exit $ret
|
|
|
|
export SWTPM_INTERFACE=socket+unix
|
|
export SWTPM_SERVER_NAME=localhost
|
|
export SWTPM_SERVER_PORT=65464
|
|
bash _test_tpm2_avoid_da_lockout
|
|
ret=$?
|
|
[ $ret -ne 0 ] && [ $ret -ne 77 ] && exit $ret
|
|
|
|
export SWTPM_INTERFACE=unix+unix
|
|
bash _test_tpm2_avoid_da_lockout
|
|
ret=$?
|
|
[ $ret -ne 0 ] && [ $ret -ne 77 ] && exit $ret
|
|
|
|
exit 0
|