swtpm/samples/swtpm-localca

#!/bin/bash

#
# sample/swtpm-localca
#
# Authors: Stefan Berger <stefanb@us.ibm.com>
#
# (c) Copyright IBM Corporation 2014.
#
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
# Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
#
# Redistributions in binary form must reproduce the above copyright notice,
# this list of conditions and the following disclaimer in the documentation
# and/or other materials provided with the distribution.
#
# Neither the names of the IBM Corporation nor the names of its contributors
# may be used to endorse or promote products derived from this software
# without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
# IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

LOCALCA_OPTIONS=/etc/swtpm-localca.options
LOCALCA_CONFIG=/etc/swtpm-localca.conf

# Default logging goes to stderr
LOGFILE=""

logit()
{
	if [ -z "$LOGFILE" ]; then
		echo "$@" >&1
	else
		echo "$@" >> $LOGFILE
	fi
}

logerr()
{
	if [ -z "$LOGFILE" ]; then
		echo "Error: $@" >&2
	else
		echo "Error: $@" >> $LOGFILE
	fi
}

# Get an configuration value from an configurations file
# @param1: The file with the options
# @param2: The name of the option
get_config_value() {
	local configfile="$1"
	local configname="$(echo "$2" | sed 's/-/\\-/g')"
	local defaultvalue="$3"
	local tmp

	if [ ! -r $configfile ]; then
		logerr "Cannot read config file $configfile"
		return 1
	fi

	tmp=$(sed -n "s/^${configname}[[:space:]]*=[[:space:]]*\([^ ]\+\)/\1/p" \
		$configfile)
	if [ -z "$tmp" ]; then
		if [ -n "$defaultvalue" ]; then
			echo "$defaultvalue"
		else
			return 1
		fi
	else
		echo "$tmp"
	fi

	return 0
}

# Get the next serial number for the certificate
#
# If an error occurs nothing is echo'ed and the return code 1 is returned,
# otherwise the next serial number is echo'ed with a return code of 0.
get_next_cert_serial() {
	local serial

	touch ${LOCK}
	(
		# Avoid concurrent creation of next serial
		flock -e 200
		if [ $? -ne 0 ]; then
			logerr "Could not get lock ${LOCK}"
			return 1
		fi
		if [ ! -r ${CERTSERIAL} ]; then
			echo -n "0" > ${CERTSERIAL}
		fi
		serial=$(cat ${CERTSERIAL})
		if ! [[ "$serial" =~ ^[0-9]+$ ]]; then
			serial=1
		else
			serial=$((serial+1))
		fi
		echo -n $serial > ${CERTSERIAL}
		if [ $? -ne 0 ]; then
			logerr "Could not write cert serial number file"
			return 1
		fi
		echo $serial
	) 200>${LOCK}

	return 0
}

create_cert() {
	local typ="$1"
	local dir="$2"
	local ek="$3"
	local vmid="$4"
	local tpm_spec_params="$5"
	local tpm_attr_params="$6"

	local serial=$(get_next_cert_serial)
	local options rc=0

	if [ -z "$serial" ]; then
		return 1
	fi

	if [ -r "${LOCALCA_OPTIONS}" ]; then
		options=$(cat ${LOCALCA_OPTIONS})
	fi

	if [ -n "$vmid" ]; then
		options="$options --subject \"CN=$vmid\""
	else
		options="$options --subject \"CN=unknown\""
	fi

	# TPM 1.2 cert needs a header
	options="$options --add-header"

	case "$typ" in
	ek)
		if [ -z "$(type -p swtpm_cert)" ]; then
			logerr "Missing swtpm_cert tool"
			rc=1
		else
			eval swtpm_cert \
			$options \
			$tpm_spec_params \
			$tpm_attr_params \
			--signkey ${SIGNKEY} \
			--issuercert ${ISSUERCERT} \
			--out-cert ${dir}/ek.cert \
			--modulus "${ek}" \
			--days $((10*365)) \
			--serial $serial
			if [ $? -eq 0 ]; then
				logit "Successfully created EK certificate locally."
			else
				logerr "Could not create EK certificate locally."
				rc=1
			fi
		fi
		;;
	platform)
		if [ -z "$(type -p swtpm_cert)" ]; then
			logerr "Missing swtpm_cert tool"
			rc=1
		else
			eval swtpm_cert \
			$options \
			$tpm_attr_params \
			--type platform \
			--signkey ${SIGNKEY} \
			--issuercert ${ISSUERCERT} \
			--out-cert ${dir}/platform.cert \
			--modulus "${ek}" \
			--days $((10*365)) \
			--serial $serial
			if [ $? -eq 0 ]; then
				logit "Successfully created platform certificate locally."
			else
				logerr "Could not create platform certificate locally."
				rc=1
			fi
		fi
		;;
	esac

	return $rc
}

# Create the local CA's certificate if it doesn't already exist.
# The local CA will be an intermediate CA with a root CA we create
# here as well so that we get an Authority Key Id in our EK cert.
#
create_localca_cert() {
	touch ${LOCK}
	(
		# Avoid concurrent creation of keys and certs
		flock -e 200
		if [ $? -ne 0 ]; then
			logerr "Could not get lock ${LOCK}"
			return 1
		fi
		if [ ! -d ${STATEDIR} ]; then
			# RPM installation must have created this already ...
			# so user tss can use it (user tss cannot create it)
			mkdir -p ${STATEDIR}
		fi
		if [ ! -r ${SIGNKEY} ]; then
			local dir=$(dirname ${SIGNKEY})
			local cakey=${dir}/swtpm-localca-rootca-privkey.pem
			local cacert=${dir}/swtpm-localca-rootca-cert.pem
			local msg

			# create a CA first
			msg=$(certtool \
				--generate-privkey \
				--outfile ${cakey} \
				2>&1)
			[ $? -ne 0 ] && {
				logerr "Could not create root-CA key ${cakey}."
				logerr "${msg}"
				return 1
			}
			chmod 640 ${cakey}

			local tmp=$(mktemp)
			echo "cn=swtpm-localca-rootca" > ${tmp}
			echo "ca" >> ${tmp}
			echo "cert_signing_key" >> ${tmp}
			echo "expiration_days = 3650" >> ${tmp}

			msg=$(certtool \
				--generate-self-signed \
				--template ${tmp} \
				--outfile ${cacert} \
				--load-privkey ${cakey} \
				2>&1)
			[ $? -ne 0 ] && {
				logerr "Could not create root CA."
				logerr "${msg}"
				rm -f ${cakey}
				return 1
			}

			# now our signing CA
			msg=$(certtool \
				--generate-privkey \
				--outfile ${SIGNKEY} \
				2>&1)
			[ $? -ne 0 ] && {
				rm -f ${cakey} ${cacert}
				logerr "Could not create local-CA key ${SIGNKEY}."
				logerr "${msg}"
				return 1
			}
			chmod 640 ${SIGNKEY}

			echo "cn=swtpm-localca" > ${tmp}
			echo "ca" >> ${tmp}
			echo "cert_signing_key" >> ${tmp}
			echo "expiration_days = 3650" >> ${tmp}

			msg=$(certtool \
				--generate-certificate \
				--template ${tmp} \
				--outfile ${ISSUERCERT} \
				--load-privkey ${SIGNKEY} \
				--load-ca-privkey ${cakey} \
				--load-ca-certificate ${cacert} \
				2>&1)
			[ $? -ne 0 ] && {
				rm -f ${cakey} ${cacert} ${SIGNKEY}
				logerr "Could not create local CA."
				logerr "${msg}"
				return 1
			}
			rm -f ${tmp}
		fi
	) 200>${LOCK}

	return 0
}

main() {
	local typ ek dir vmid tmp
	local tpm_spec_params="" tpm_attr_params=""

	while [ $# -ne 0 ]; do
		case "$1" in
		--type)
			shift
			typ="$1"
			;;
		--ek)
			shift
			ek="$1"
			;;
		--dir)
			shift
			dir="$1"
			;;
		--vmid)
			shift
			vmid="$1"
			;;
		--optsfile)
			shift
			LOCALCA_OPTIONS="$1"
			;;
		--configfile)
			shift
			LOCALCA_CONFIG="$1"
			;;
		--logfile)
			shift
			LOGFILE="$1"
			;;
		--tpm-spec-family)
			shift
			tpm_spec_params+="--tpm-spec-family $1 "
			;;
		--tpm-spec-revision)
			shift
			tpm_spec_params+="--tpm-spec-revision $1 "
			;;
		--tpm-spec-level)
			shift
			tpm_spec_params+="--tpm-spec-level $1 "
			;;
		--tpm-manufacturer)
			shift
			tpm_attr_params+="--tpm-manufacturer $1 "
			;;
		--tpm-model)
			shift
			tpm_attr_params+="--tpm-model $1 "
			;;
		--tpm-version)
			# this is the firmware version!
			shift
			tpm_attr_params+="--tpm-version $1 "
			;;
		*)
			logerr "Unsupported option $1"
			exit 1
			;;
		esac
		shift
	done

	if [ -n "$LOGFILE" ]; then
		touch $LOGFILE &>/dev/null
		if [ ! -w "$LOGFILE" ]; then
			logerr "Cannot write to logfile ${LOGFILE}."
			exit 1
		fi
	fi

	if [ ! -r "$LOCALCA_OPTIONS" ]; then
		logerr "Cannot access options file ${LOCALCA_OPTIONS}."
		exit 1
	fi

	if [ ! -r "$LOCALCA_CONFIG" ]; then
		logerr "Cannot access config file ${LOCALCA_CONFIG}."
		exit 1
	fi

	tmp=$(get_config_value "$LOCALCA_CONFIG" "statedir")
	if [ -z "$tmp" ]; then
		logerr "Missing 'statedir' config value in config file ${LOCALCA_CONFIG}"
		exit 1
	fi
	STATEDIR="$tmp"
	if [ ! -d "$STATEDIR" ]; then
		logit "Creating swtpm-local state dir."
		mkdir -p "$STATEDIR"
		if [ $? -ne 0 ]; then
			logerr "Could not create directory '${STATEDIR}."
			exit 1
		fi
	fi
	LOCK="${STATEDIR}/.lock"
	if [ ! -w ${LOCK} ]; then
		touch $LOCK
		if [ ! -w ${LOCK} ]; then
			logerr "Could not create lock file ${LOCK}."
			exit 1
		fi
	fi

	SIGNKEY=$(get_config_value "$LOCALCA_CONFIG" "signingkey")
	if [ -z "$SIGNKEY" ]; then
		logerr "Missing signingkey variable in config file $LOCALCA_CONFIG."
		exit 1
	fi
	ISSUERCERT=$(get_config_value "$LOCALCA_CONFIG" "issuercert")
	if [ -z "$ISSUERCERT" ]; then
		logerr "Missing issuercert variable in config file $LOCALCA_CONFIG."
		exit 1
	fi

	if [ ! -r "$SIGNKEY" ]; then
		if [ -f "$SIGNKEY" ]; then
			logerr "Signing key $SIGNKEY exists but cannot access" \
			       "it as $(id -un):$(id -gn)."
			exit 1
		fi
		# Create the signing key and issuer cert since it will be missing
		logit "Creating root CA and a local CA's signing key and issuer cert."
		create_localca_cert
		if [ $? -ne 0 ]; then
			logerr "Error creating local CA's signing key and cert"
			exit 1
		fi
	fi

	if [ ! -r "$SIGNKEY" ]; then
		logerr "Cannot access signing key ${SIGNKEY}."
		exit 1
	fi

	if [ ! -r "$ISSUERCERT" ]; then
		logerr "Cannot access issuer certificate ${ISSUERCERT}."
		exit 1
	fi

	CERTSERIAL=$(get_config_value "$LOCALCA_CONFIG" "certserial" \
	    "${STATEDIR}/certserial")

	create_cert "$typ" "$dir" "$ek" "$vmid" "$tpm_spec_params" "$tpm_attr_params"

	exit $?
}

main "$@" # 2>&1 | tee -a /tmp/localca.log