Stefan Berger [Fri, 29 Sep 2017 17:53:06 +0000 (13:53 -0400)]
tests: Use python twisted for sendmsg on python 2
Rather than sending two separate messages with the bare python 2
API, use the python twisted package to send the control and data
in one sendmsg() call. This avoids occasional test failures in
the ctrlchannel test case that is currently sending the data and
control part of the message in 2 steps, which can lead to the
recpient not seeing the whole message.
Add python-twisted as a build dependency to the rpm and Debian
builds and the .travis.yml.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Support added to receive data socket over control socket
As objected by QEMU upstream developers to use two different sockets for
starting/using of swtpm, This commit adds support for passing unix domain
socket over control channel.
The summary of the changes include:
- Defined new control command CMD_SET_DATAFD, using this clients can send data
socket.
- set mlp.fd and mlp.flags outside of the mainloop
- updated the testcases
Stefan Berger [Tue, 18 Jul 2017 21:02:59 +0000 (17:02 -0400)]
Fix possible illegal buffer access
Fix possible illegal buffer access in case a character device
is used via ioctl. In this case we have to make sure we only
access the number of bytes in the ioctl structure itself.
In case of a socket, make sure we received enough bytes to
be able to access the payload.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Thu, 15 Jun 2017 17:14:17 +0000 (13:14 -0400)]
tests: add functions for running swtpm and swtpm_ioctl
To be able to run tests with either one of the interfaces, add function
for running swtpm and swtpm_ioctl commands and form the command line
parameters dependent on the type of interface being passed. We rely on
environment variables to provide the specific parameters that are needed
to run the program with the appropriate parameters.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Mon, 10 Jul 2017 14:29:10 +0000 (10:29 -0400)]
Introduce '--flag not-need-init' for socket and chardev
Change the startup behavior with respect to requiring an INIT command
via control channel. We change this for the socket and chardev
interfaces so that the behavior now is the same as that of the CUSE
interface.
Introduce the --flag not-need-init command line option for the socket
and chardev interfaces to allow the old behavior using this option.
Adapt some of the test cases and swtpm_setup.sh.in that now need this
command line flag.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Sun, 9 Jul 2017 15:20:16 +0000 (11:20 -0400)]
Fix return code for ResetEstablishmentBit
If the return code from the command processing function is 0,
get the error code from the command response and return that one
instead. The problem was that clients though resetting the
establishment bit worked in locality 0 for example, while it did
not.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Fri, 30 Jun 2017 19:52:32 +0000 (15:52 -0400)]
swtpm_ioctl: fix ctrlcmd return parameter and fix state recv logic
Return the number of bytes received in case ctrlcmd does not
use an ioctl because in this case we need to know how many bytes
we received in the response.
The receiving of the state blob also needs to take into account
how many bytes were received in the initial response so we write
the proper amount of bytes from that response into the file.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Thu, 15 Jun 2017 22:59:25 +0000 (18:59 -0400)]
swtpm: work on a copy of argv[] variables
While parsing the options we modified the argv[] values and
the commas disappeared, which showed when checking for the
swtpm processes using 'ps'. So, work on a copy of the options
parameter.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 6 Jun 2017 20:44:16 +0000 (16:44 -0400)]
Implement allow-set-locality for CUSE TPM and extend test case.
Implement allow-set-locality for CUSE TPM and extend the existing
locality test case with commands that try to write the SetLocality
comamnd to the device.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 6 Jun 2017 18:09:59 +0000 (14:09 -0400)]
Implement support for --locality allow-set-locality option
Implement support for --locality allow-set-locality option that
is primarily useful in cases when the VTPM proxy access is enabled
by file descriptor passing.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Thu, 1 Jun 2017 20:00:15 +0000 (16:00 -0400)]
Add options for locality handling and SetLocality command
Add options for locality handling so that commands in locality
4 for example are rejected per command line parameter. This is
useful when the vTPM is used with containers.
Also implement the custom TPM/TPM2_SetLocality command to allow
the Linux vTPM proxy driver to set the locality in which subsequent
TPM commands will be executed.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Fri, 31 Mar 2017 12:41:08 +0000 (08:41 -0400)]
swtpm: Use logprintf wherever possible
Use logprintf wherever possible. While the logging is not set up,
print error messages to stderr and prefix them with 'swtpm: '. After
the logging has been set up all error messages go into the log file.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Amarnath Valluri [Fri, 31 Mar 2017 06:54:38 +0000 (09:54 +0300)]
swtpm: Keep client data connection alive
swtpm server is closing the client data connection after serving a single
request, which shall not happen. Hence added MAIN_LOOP_FLAG_KEEP_CONNECTION
mainloop flag to keep the client data connection alive, till client is alive.
Amarnath Valluri [Wed, 15 Mar 2017 20:10:29 +0000 (22:10 +0200)]
swtpm: Added support for passing control channel client fd.
New option '--ctrl clientfd=<fd>' is added to the control socket parameters.
The passed 'fd' is used as control channel client-fd and treated as single
client mode.
Stefan Berger [Thu, 2 Feb 2017 18:07:29 +0000 (13:07 -0500)]
swtpm_cert: Create sets of items
Following the example in the Appendix A.1 of the TCG EK Credential
Profile Spec Version 2.0, a ASN.1 SET is supposed to be created for
each one of the items. This patch fixes the format.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Thu, 2 Feb 2017 15:49:58 +0000 (10:49 -0500)]
swtpm_cert: use GNUTLS 3.5 function to set TPM data
Use the GNUTLS 3.5 function gnutls_x509_crt_set_subject_alt_othername
to set the TP<M and platform manufacturer info since the other function
does not accept binary data.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Thu, 2 Feb 2017 14:01:37 +0000 (09:01 -0500)]
tests: Skip CUSE TPM related tests if cuse module is not available
Skip the CUSE TPM related tests if the CUSE kernel module is not
available. Return similar error messages for both CUSE and VTPM proxy
module if they are not available.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Tue, 24 Jan 2017 13:43:48 +0000 (08:43 -0500)]
tests: Wait for chardev to appear
Wait for the chardev the VTPM proxy device creates to actually appear.
In some cases the exec statement opening the file would otherwise
create a file /dev/tpm0 for example and subsequently tests then ended
up failing.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Mon, 23 Jan 2017 23:18:59 +0000 (18:18 -0500)]
swtpm: Expose logging level to command line
Expose the logging level to the command line by extending the
log option with a level parameter.
Extend the man swtpm man page with the level parameter.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Mon, 23 Jan 2017 22:56:07 +0000 (17:56 -0500)]
swtpm: Implement logging following indentation level
Introduce a log level for the logging functions. The log level
is defined by the number of spaces used for indentation. Adapt
the log functions to only log when the number of leading spaces
in a string is appropriate for logging.
Call the log function of libtpms to set the file descriptor to
log to, the log level, and log line prefix.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Fri, 13 Jan 2017 23:32:57 +0000 (18:32 -0500)]
Implement option --vtpm-proxy to create Linux vtpm proxy device
Implement the option --vtpm-proxy that create a Linux vtpm proxy device
and makes the chardev TPM listen on the anaonymous file descriptor that
is returned from the ioctl creating the device.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Stefan Berger [Mon, 27 Jun 2016 00:26:50 +0000 (20:26 -0400)]
swtpm_setup: support --tpmstate as alias for --tpm-state
Support --tpm-state option as an alias for the --tpmstate option.
--tpm-state is a parameter that is also supported by the swtpm
program, so for consistency reasons we should have the same name
for the option here.
Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
projects / swtpm.git / log