swtpm_setup: Use swtpm_ioctl to get TPM specification info for EK cert

Use the new --info parameter for swtpm_ioctl to get TPM specification
info from the swtpm and use this as a parameter for creating the EK
certificate.

Extend the man page.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

diff --git a/man/man8/swtpm_setup.8 b/man/man8/swtpm_setup.8
index 48c1cfb2f2be465d24bb6abe1447386108549a45..b10f080b75e61244d1bd98f4a830e6747ca47de1 100644 (file)
--- a/man/man8/swtpm_setup.8
+++ b/man/man8/swtpm_setup.8
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "swtpm_setup 8"
-.TH swtpm_setup 8 "2018-04-18" "swtpm" ""
+.TH swtpm_setup 8 "2018-04-21" "swtpm" ""
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -226,6 +226,10 @@ program ends without an error.
 Optional \s-1VM ID\s0 that can be used to keep track of certificates issued
 for VMs (or containers). This parameter will be passed through to the tool
 used for creating the certificates and may be required by that tool.
+.IP "\fB\-\-swtpm_ioctl <executable\fR>" 4
+.IX Item "--swtpm_ioctl <executable>"
+Pass the path to the swtpm_ioctl executable. By default the swtpm_ioctl
+in the \s-1PATH\s0 is used.
 .IP "\fB\-\-help, \-h\fR" 4
 .IX Item "--help, -h"
 Display the help screen

diff --git a/man/man8/swtpm_setup.conf.8 b/man/man8/swtpm_setup.conf.8
index a975e170cd04a66a9478f5adc3ff3957e81cf0ab..a4b7b1273e928eaf146c14b845c71323d3cb29fa 100644 (file)
--- a/man/man8/swtpm_setup.conf.8
+++ b/man/man8/swtpm_setup.conf.8
@@ -1,4 +1,4 @@
-.\" Automatically generated by Pod::Man 2.27 (Pod::Simple 3.28)
+.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.31)
 .\"
 .\" Standard preamble:
 .\" ========================================================================
@@ -133,7 +133,7 @@
 .\" ========================================================================
 .\"
 .IX Title "swtpm_setup.conf 8"
-.TH swtpm_setup.conf 8 "2014-11-07" "swtpm" ""
+.TH swtpm_setup.conf 8 "2018-04-21" "swtpm" ""
 .\" For nroff, turn off justification.  Always turn off hyphenation; it makes
 .\" way too many mistakes in technical documents.
 .if n .ad l
@@ -185,6 +185,10 @@ its default configuration file.
 The options file to use. This file typically contains options that the
 invoked program uses. If omitted, the program must use its default
 options file.
+.IP "\fB\-\-tpm\-spec\-family <family\fR>, \fB\-\-tpm\-spec\-level <level\fR>, \fB\-\-tpm\-spec\-revision <revision\fR>" 4
+.IX Item "--tpm-spec-family <family>, --tpm-spec-level <level>, --tpm-spec-revision <revision>"
+These 3 options describe the \s-1TPM\s0 specification that was followed for
+the implementation of the \s-1TPM\s0 and will be part of the \s-1EK\s0 certificate.
 .RE
 .RS 4
 .RE

diff --git a/man/man8/swtpm_setup.conf.pod b/man/man8/swtpm_setup.conf.pod
index a21ef178e534c070863f506275d82bb62fa0ad17..07d4ea2ba34a57fadd3dd4c831f83d7e68f54fff 100644 (file)
--- a/man/man8/swtpm_setup.conf.pod
+++ b/man/man8/swtpm_setup.conf.pod
@@ -59,6 +59,11 @@ The options file to use. This file typically contains options that the
 invoked program uses. If omitted, the program must use its default
 options file.
 
+=item B<--tpm-spec-family <family>>, B<--tpm-spec-level <level>>, B<--tpm-spec-revision <revision>>
+
+These 3 options describe the TPM specification that was followed for
+the implementation of the TPM and will be part of the EK certificate.
+
 =back
 
 =item B<create_certs_tool_config>

diff --git a/man/man8/swtpm_setup.pod b/man/man8/swtpm_setup.pod
index 1575aaced55f078d8e365d76e147c94c778e7c6f..fec85bba07b8c4b8cce4906e6dd3332d249935d4 100644 (file)
--- a/man/man8/swtpm_setup.pod
+++ b/man/man8/swtpm_setup.pod
@@ -112,6 +112,11 @@ Optional VM ID that can be used to keep track of certificates issued
 for VMs (or containers). This parameter will be passed through to the tool
 used for creating the certificates and may be required by that tool.
 
+=item B<--swtpm_ioctl <executable>>
+
+Pass the path to the swtpm_ioctl executable. By default the swtpm_ioctl
+in the PATH is used.
+
 =item B<--help, -h>
 
 Display the help screen

diff --git a/src/swtpm_setup/swtpm_setup.c b/src/swtpm_setup/swtpm_setup.c
index 59808b15043704784bc2a47888097b2b1ffaee02..a20ef53e22c1612a3e1ce2bf2d9881d59f5ab17b 100644 (file)
--- a/src/swtpm_setup/swtpm_setup.c
+++ b/src/swtpm_setup/swtpm_setup.c
@@ -64,6 +64,7 @@ const char *one_arg_params[] = {
     "--logfile",
     "--keyfile",
     "--pwdfile",
+    "--swtpm_ioctl",
     NULL
 };
 

diff --git a/src/swtpm_setup/swtpm_setup.sh.in b/src/swtpm_setup/swtpm_setup.sh.in
index 0e24e3ad094bfe2cdf94de13a3be3a983047a476..6e22e09543bb5862f088e5b47f6948ab56e50956 100755 (executable)
--- a/src/swtpm_setup/swtpm_setup.sh.in
+++ b/src/swtpm_setup/swtpm_setup.sh.in
@@ -54,6 +54,7 @@ if [ -z "$TCSD" ]; then
     echo "Error: tcsd program not found. (PATH=$PATH)"
     exit 1
 fi
+SWTPM_IOCTL=`type -P swtpm_ioctl`
 
 ECHO=`which echo`
 if [ -z "$ECHO" ]; then
@@ -90,6 +91,8 @@ TPM_NV_INDEX_LOCK=$((0xFFFFFFFF))
 # Default logging goes to stderr
 LOGFILE=""
 
+TPMLIB_INFO_TPMSPECIFICATION=1
+
 trap "cleanup" SIGTERM EXIT
 
 logit()
@@ -119,6 +122,40 @@ logerr()
        fi
 }
 
+# Get the TPM specification parameters from the TPM using swtpm_ioctl
+get_tpm_spec_parameters()
+{
+       local json
+       local res part arr
+
+       json="$($SWTPM_IOCTL \
+               --info $TPMLIB_INFO_TPMSPECIFICATION \
+               --tcp :$((TPM_PORT+1)) 2>&1)"
+       if [ $? -ne 0 ]; then
+               logerr "Error: $SWTPM_IOCTL failed: $json"
+               return 1
+       fi
+
+       for params in \
+               's/.*"family":\s*"\([^"]*\)".*/\1/p --tpm-spec-family' \
+               's/.*"level":\s*\([0-9\.]*\).*/\1/p --tpm-spec-level' \
+               's/.*"revision":\s*\([0-9]*\).*/\1/p --tpm-spec-revision';
+       do
+               arr=($params)
+               part=$(echo "$json" | sed -n "${arr[0]}")
+               if [ -z "$part" ]; then
+                       logerr "Error: Could not parse JSON output"
+                       logerr "       No result from \"echo '$json' | sed -n '${arr[0]}'\""
+                       return 1
+               fi
+               res+="${arr[1]} ${part} "
+       done
+
+       echo "${res}"
+
+       return 0
+}
+
 # Call external program to create certificates
 #
 # @param1: flags
@@ -147,6 +184,9 @@ call_create_certs()
                logparam="--logfile $LOGFILE"
        fi
 
+       params+="$(get_tpm_spec_parameters) "
+       [ $? -ne 0 ] && return 1
+
        if [ $((flags & SETUP_EK_CERT_F)) -ne 0 ] || \
           [ $((flags & SETUP_PLATFORM_CERT_F)) -ne 0 ]; then
                if [ -r "$configfile" ]; then
@@ -230,12 +270,17 @@ start_tpm()
                # skip used ports
                if [ -n "$(netstat -lnpt 2>/dev/null |
                         gawk '{print $4}' |
-                        grep ":${TPM_PORT} ")" ]; then
+                        grep -E ":(${TPM_PORT}|$((TPM_PORT+1))) ")" ]; then
                        let ctr=$ctr+1
                        continue
                fi
 
-               $swtpm --flags not-need-init -p $TPM_PORT --tpmstate dir=$swtpm_state 2>&1 1>/dev/null &
+               $swtpm \
+                       --flags not-need-init \
+                       -p $TPM_PORT \
+                       --tpmstate dir=$swtpm_state \
+                       --ctrl type=tcp,port=$((TPM_PORT+1)) \
+                       2>&1 1>/dev/null &
                SWTPM_PID=$!
 
                # poll for open port (good) or the process to have
@@ -734,6 +779,10 @@ The following options are supported:
                  : Path to the TPM executable; this is an optional argument and
                    by default $SWTPM is used.
 
+--swtpm_ioctl <executable>
+                 : Path to the swtpm_ioctl executable; this is an optional
+                   argument and by default $SWTPM_IOCTL is used.
+
 --createek       : Create the EK
 
 --take-ownership : Take ownership; this option implies --createek
@@ -801,6 +850,7 @@ main()
                case "$1" in
                --tpm-state|--tpmstate) shift; tpm_state_path="$1";;
                --tpm) shift; SWTPM="$1";;
+               --swtpm_ioctl) shift; SWTPM_IOCTL="$1";;
                --createek) flags=$((flags | SETUP_CREATE_EK_F));;
                --take-ownership) flags=$((flags |
                                   SETUP_CREATE_EK_F|SETUP_TAKEOWN_F));;
@@ -906,6 +956,16 @@ main()
                exit 1
        fi
 
+       if [ -z "$SWTPM_IOCTL" ]; then
+               logerr "Default 'swtpm_ioctl' could not be found and was not provided using --swtpm_ioctl."
+               exit 1
+       fi
+
+       if [ ! -x "$(echo $SWTPM_IOCTL | cut -d " " -f1)" ]; then
+               logerr "swtpm_ioctl at $SWTPM_IOCTL is not an executable."
+               exit 1
+       fi
+
        if [ ! -r "$config_file" ]; then
                logerr "Cannot access config file ${config_file}."
                exit 1

diff --git a/tests/test_parameters b/tests/test_parameters
index 1d48b1016451828a877d1fa2f4009f79bc20636d..fea0b1a6332e43345a0c7c0dea4d783bd04a49c0 100755 (executable)
--- a/tests/test_parameters
+++ b/tests/test_parameters
@@ -54,6 +54,7 @@ fi
 
 SWTPM=swtpm
 SWTPM_EXE=${SWTPM_EXE:-$ROOT/src/swtpm/$SWTPM}
+SWTPM_IOCTL=${SWTPM_IOCTL:-$ROOT/src/swtpm_ioctl/swtpm_ioctl}
 TCSD=`type -P tcsd`
 TPMDIR=`mktemp -d`
 SWTPM_SETUP_CONF=$ROOT/etc/swtpm_setup.conf
@@ -94,6 +95,7 @@ for (( i=0; i<${#PARAMETERS[*]}; i++)); do
        $TPMAUTHORING \
                --tpm-state $TPMDIR \
                --tpm "$SWTPM_EXE socket" \
+               --swtpm_ioctl "$SWTPM_IOCTL" \
                ${PARAMETERS[$i]} 2>&1 >/dev/null
        
        if [ $? -ne 0 ]; then

diff --git a/tests/test_swtpm_setup_create_cert b/tests/test_swtpm_setup_create_cert
index c8282068bafeef19857972f09f2ddd40a081a2d5..7b96553c680b5c5934e6a8a9c983a87edd315c94 100755 (executable)
--- a/tests/test_swtpm_setup_create_cert
+++ b/tests/test_swtpm_setup_create_cert
@@ -12,6 +12,7 @@ ROOT=${DIR}/..
 SWTPM_SETUP=${ROOT}/src/swtpm_setup/swtpm_setup
 SWTPM_LOCALCA=${ROOT}/samples/swtpm-localca
 SWTPM=${ROOT}/src/swtpm/swtpm
+SWTPM_IOCTL=${ROOT}/src/swtpm_ioctl/swtpm_ioctl
 
 workdir=$(mktemp -d)
 
@@ -61,7 +62,8 @@ $SWTPM_SETUP \
        --create-ek-cert \
        --config ${workdir}/swtpm_setup.conf \
        --logfile ${workdir}/logfile \
-       --tpm "${SWTPM} socket"
+       --tpm "${SWTPM} socket" \
+       --swtpm_ioctl ${SWTPM_IOCTL}
 
 if [ $? -ne 0 ]; then
        echo "Error: Could not run $SWTPM_SETUP."