aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/checksum/Makefile.am4
-rw-r--r--src/checksum/checksum_builder.c3
-rw-r--r--src/libtpmtss/Makefile.am27
-rw-r--r--src/libtpmtss/plugins/tpm/Makefile.am20
-rw-r--r--src/libtpmtss/plugins/tpm/tpm_plugin.c76
-rw-r--r--src/libtpmtss/plugins/tpm/tpm_plugin.h42
-rw-r--r--src/libtpmtss/plugins/tpm/tpm_private_key.c239
-rw-r--r--src/libtpmtss/plugins/tpm/tpm_private_key.h49
8 files changed, 454 insertions, 6 deletions
diff --git a/src/checksum/Makefile.am b/src/checksum/Makefile.am
index 88210908a..5db5b79c0 100644
--- a/src/checksum/Makefile.am
+++ b/src/checksum/Makefile.am
@@ -61,6 +61,10 @@ endif
if USE_LIBTPMTSS
deps += $(top_builddir)/src/libtpmtss/libtpmtss.la
libs += $(DESTDIR)$(ipseclibdir)/libtpmtss.so
+if !MONOLITHIC
+ AM_CPPFLAGS += -DP_PLUGINS=\""${p_plugins}\""
+endif
+
endif
if USE_LIBTNCCS
diff --git a/src/checksum/checksum_builder.c b/src/checksum/checksum_builder.c
index e8998d5a7..a36014634 100644
--- a/src/checksum/checksum_builder.c
+++ b/src/checksum/checksum_builder.c
@@ -157,6 +157,9 @@ int main(int argc, char* argv[])
#ifdef S_PLUGINS
build_plugin_checksums(S_PLUGINS);
#endif
+#ifdef P_PLUGINS
+ build_plugin_checksums(P_PLUGINS);
+#endif
#ifdef T_PLUGINS
build_plugin_checksums(T_PLUGINS);
#endif
diff --git a/src/libtpmtss/Makefile.am b/src/libtpmtss/Makefile.am
index e2c159710..c7ac39a09 100644
--- a/src/libtpmtss/Makefile.am
+++ b/src/libtpmtss/Makefile.am
@@ -8,12 +8,6 @@ AM_LDFLAGS = \
-no-undefined
ipseclib_LTLIBRARIES = libtpmtss.la
-libtpmtss_la_SOURCES = \
- tpm_tss.h tpm_tss.c \
- tpm_tss_quote_info.h tpm_tss_quote_info.c \
- tpm_tss_trousers.h tpm_tss_trousers.c \
- tpm_tss_tss2.h tpm_tss_tss2.c \
- tpm_tss_tss2_names.h tpm_tss_tss2_names.c
libtpmtss_la_LIBADD = \
$(top_builddir)/src/libstrongswan/libstrongswan.la
@@ -26,3 +20,24 @@ if USE_TROUSERS
libtpmtss_la_LIBADD += -ltspi
endif
+libtpmtss_la_SOURCES = \
+ tpm_tss.h tpm_tss.c \
+ tpm_tss_quote_info.h tpm_tss_quote_info.c \
+ tpm_tss_trousers.h tpm_tss_trousers.c \
+ tpm_tss_tss2.h tpm_tss_tss2.c \
+ tpm_tss_tss2_names.h tpm_tss_tss2_names.c
+
+if MONOLITHIC
+SUBDIRS =
+else
+SUBDIRS = .
+endif
+
+if USE_TPM
+ SUBDIRS += plugins/tpm
+if MONOLITHIC
+ libtpmtss_la_LIBADD += plugins/tpm/libstrongswan-tpm.la
+endif
+endif
+
+
diff --git a/src/libtpmtss/plugins/tpm/Makefile.am b/src/libtpmtss/plugins/tpm/Makefile.am
new file mode 100644
index 000000000..c12f09b55
--- /dev/null
+++ b/src/libtpmtss/plugins/tpm/Makefile.am
@@ -0,0 +1,20 @@
+AM_CPPFLAGS = \
+ -I$(top_srcdir)/src/libstrongswan \
+ -I$(top_srcdir)/src/libtpmtss
+
+AM_CFLAGS = \
+ $(PLUGIN_CFLAGS)
+
+if MONOLITHIC
+noinst_LTLIBRARIES = libstrongswan-tpm.la
+else
+plugin_LTLIBRARIES = libstrongswan-tpm.la
+libstrongswan_tpm_la_LIBADD = \
+ $(top_builddir)/src/libtpmtss/libtpmtss.la
+endif
+
+libstrongswan_tpm_la_SOURCES = \
+ tpm_plugin.h tpm_plugin.c \
+ tpm_private_key.h tpm_private_key.c
+
+libstrongswan_tpm_la_LDFLAGS = -module -avoid-version
diff --git a/src/libtpmtss/plugins/tpm/tpm_plugin.c b/src/libtpmtss/plugins/tpm/tpm_plugin.c
new file mode 100644
index 000000000..3d6321e9e
--- /dev/null
+++ b/src/libtpmtss/plugins/tpm/tpm_plugin.c
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2017 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "tpm_plugin.h"
+#include "tpm_private_key.h"
+
+#include <library.h>
+
+typedef struct private_tpm_plugin_t private_tpm_plugin_t;
+
+/**
+ * private data of tpm_plugin
+ */
+struct private_tpm_plugin_t {
+
+ /**
+ * public functions
+ */
+ tpm_plugin_t public;
+};
+
+METHOD(plugin_t, get_name, char*,
+ private_tpm_plugin_t *this)
+{
+ return "tpm";
+}
+
+METHOD(plugin_t, get_features, int,
+ private_tpm_plugin_t *this, plugin_feature_t *features[])
+{
+ static plugin_feature_t f[] = {
+ PLUGIN_REGISTER(PRIVKEY, tpm_private_key_connect, FALSE),
+ PLUGIN_PROVIDE(PRIVKEY, KEY_ANY),
+ };
+ *features = f;
+
+ return countof(f);
+}
+
+METHOD(plugin_t, destroy, void,
+ private_tpm_plugin_t *this)
+{
+ free(this);
+}
+
+/*
+ * see header file
+ */
+plugin_t *tpm_plugin_create()
+{
+ private_tpm_plugin_t *this;
+
+ INIT(this,
+ .public = {
+ .plugin = {
+ .get_name = _get_name,
+ .get_features = _get_features,
+ .destroy = _destroy,
+ },
+ },
+ );
+
+ return &this->public.plugin;
+}
diff --git a/src/libtpmtss/plugins/tpm/tpm_plugin.h b/src/libtpmtss/plugins/tpm/tpm_plugin.h
new file mode 100644
index 000000000..bf419b328
--- /dev/null
+++ b/src/libtpmtss/plugins/tpm/tpm_plugin.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2017 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup tpm tpm
+ * @ingroup plugins
+ *
+ * @defgroup tpm_plugin tpm_plugin
+ * @{ @ingroup tpm
+ */
+
+#ifndef TPM_PLUGIN_H_
+#define TPM_PLUGIN_H_
+
+#include <plugins/plugin.h>
+
+typedef struct tpm_plugin_t tpm_plugin_t;
+
+/**
+ * Plugin providing TPM token support.
+ */
+struct tpm_plugin_t {
+
+ /**
+ * Implements plugin interface,
+ */
+ plugin_t plugin;
+};
+
+#endif /** TPM_PLUGIN_H_ @}*/
diff --git a/src/libtpmtss/plugins/tpm/tpm_private_key.c b/src/libtpmtss/plugins/tpm/tpm_private_key.c
new file mode 100644
index 000000000..bd5a8baeb
--- /dev/null
+++ b/src/libtpmtss/plugins/tpm/tpm_private_key.c
@@ -0,0 +1,239 @@
+/*
+ * Copyright (C) 2017 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "tpm_private_key.h"
+
+#include <tpm_tss.h>
+#include <utils/debug.h>
+
+typedef struct private_tpm_private_key_t private_tpm_private_key_t;
+
+/**
+ * Private data of an tpm_private_key_t object.
+ */
+struct private_tpm_private_key_t {
+
+ /**
+ * Public tpm_private_key_t interface.
+ */
+ tpm_private_key_t public;
+
+ /**
+ * Token keyid used to reference optional PIN for TPM key
+ */
+ identification_t *keyid;
+
+ /**
+ * Trusted Platform Module
+ */
+ tpm_tss_t *tpm;
+
+ /**
+ * TPM key object handle
+ */
+ uint32_t handle;
+
+ /**
+ * Hierarchy the TPM key object is attached to
+ */
+ uint32_t hierarchy;
+
+ /**
+ * Associated public key
+ */
+ public_key_t *pubkey;
+
+ /**
+ * References to this key
+ */
+ refcount_t ref;
+
+};
+
+
+METHOD(private_key_t, get_type, key_type_t,
+ private_tpm_private_key_t *this)
+{
+ return this->pubkey->get_type(this->pubkey);
+}
+
+METHOD(private_key_t, get_keysize, int,
+ private_tpm_private_key_t *this)
+{
+ return this->pubkey->get_keysize(this->pubkey);
+}
+
+METHOD(private_key_t, sign, bool,
+ private_tpm_private_key_t *this, signature_scheme_t scheme,
+ chunk_t data, chunk_t *signature)
+{
+ chunk_t pin = chunk_empty;
+ shared_key_t *shared;
+ enumerator_t *enumerator;
+
+ /* check for optional PIN */
+ enumerator = lib->credmgr->create_shared_enumerator(lib->credmgr,
+ SHARED_PIN, this->keyid, NULL);
+ if (enumerator->enumerate(enumerator, &shared, NULL, NULL))
+ {
+ pin = shared->get_key(shared);
+ }
+ enumerator->destroy(enumerator);
+
+ return this->tpm->sign(this->tpm, this->hierarchy, this->handle, scheme,
+ data, pin, signature);
+}
+
+METHOD(private_key_t, decrypt, bool,
+ private_tpm_private_key_t *this, encryption_scheme_t scheme,
+ chunk_t crypt, chunk_t *plain)
+{
+ return FALSE;
+}
+
+METHOD(private_key_t, get_public_key, public_key_t*,
+ private_tpm_private_key_t *this)
+{
+ return this->pubkey->get_ref(this->pubkey);
+}
+
+METHOD(private_key_t, get_fingerprint, bool,
+ private_tpm_private_key_t *this, cred_encoding_type_t type,
+ chunk_t *fingerprint)
+{
+ return this->pubkey->get_fingerprint(this->pubkey, type, fingerprint);
+}
+
+METHOD(private_key_t, get_encoding, bool,
+ private_tpm_private_key_t *this, cred_encoding_type_t type,
+ chunk_t *encoding)
+{
+ return FALSE;
+}
+
+METHOD(private_key_t, get_ref, private_key_t*,
+ private_tpm_private_key_t *this)
+{
+ ref_get(&this->ref);
+ return &this->public.key;
+}
+
+METHOD(private_key_t, destroy, void,
+ private_tpm_private_key_t *this)
+{
+ if (ref_put(&this->ref))
+ {
+ DESTROY_IF(this->pubkey);
+ this->tpm->destroy(this->tpm);
+ this->keyid->destroy(this->keyid);
+ free(this);
+ }
+}
+
+/**
+ * See header.
+ */
+tpm_private_key_t *tpm_private_key_connect(key_type_t type, va_list args)
+{
+ private_tpm_private_key_t *this;
+ tpm_tss_t *tpm;
+ chunk_t keyid = chunk_empty, pubkey_blob = chunk_empty;
+ char handle_str[4];
+ size_t len;
+ uint32_t hierarchy = 0x4000000B; /* TPM_RH_ENDORSEMENT */
+ uint32_t handle;
+
+ while (TRUE)
+ {
+ switch (va_arg(args, builder_part_t))
+ {
+ case BUILD_PKCS11_KEYID:
+ keyid = va_arg(args, chunk_t);
+ continue;
+ case BUILD_PKCS11_SLOT:
+ hierarchy = va_arg(args, int);
+ continue;
+ case BUILD_PKCS11_MODULE:
+ va_arg(args, char*);
+ continue;
+ case BUILD_END:
+ break;
+ default:
+ return NULL;
+ }
+ break;
+ }
+
+ /* convert keyid into 32 bit TPM key object handle */
+ if (!keyid.len)
+ {
+ return NULL;
+ }
+ len = min(keyid.len, 4);
+ memset(handle_str, 0x00, 4);
+ memcpy(handle_str + 4 - len, keyid.ptr + keyid.len - len, len);
+ handle = untoh32(handle_str);
+
+ /* try to find a TPM 2.0 */
+ tpm = tpm_tss_probe(TPM_VERSION_2_0);
+ if (!tpm)
+ {
+ DBG1(DBG_LIB, "no TPM 2.0 found");
+ return NULL;
+ }
+
+ INIT(this,
+ .public = {
+ .key = {
+ .get_type = _get_type,
+ .sign = _sign,
+ .decrypt = _decrypt,
+ .get_keysize = _get_keysize,
+ .get_public_key = _get_public_key,
+ .equals = private_key_equals,
+ .belongs_to = private_key_belongs_to,
+ .get_fingerprint = _get_fingerprint,
+ .has_fingerprint = private_key_has_fingerprint,
+ .get_encoding = _get_encoding,
+ .get_ref = _get_ref,
+ .destroy = _destroy,
+ },
+ },
+ .tpm = tpm,
+ .keyid = identification_create_from_encoding(ID_KEY_ID, keyid),
+ .handle = handle,
+ .hierarchy = hierarchy,
+ .ref = 1,
+ );
+
+ /* get public key from TPM */
+ pubkey_blob = tpm->get_public(tpm, handle);
+ if (!pubkey_blob.len)
+ {
+ destroy(this);
+ return NULL;
+ }
+ this->pubkey = lib->creds->create(lib->creds, CRED_PUBLIC_KEY, KEY_ANY,
+ BUILD_BLOB_ASN1_DER, pubkey_blob, BUILD_END);
+ chunk_free(&pubkey_blob);
+
+ if (!this->pubkey)
+ {
+ destroy(this);
+ return NULL;
+ }
+
+ return &this->public;
+}
diff --git a/src/libtpmtss/plugins/tpm/tpm_private_key.h b/src/libtpmtss/plugins/tpm/tpm_private_key.h
new file mode 100644
index 000000000..d3745e2af
--- /dev/null
+++ b/src/libtpmtss/plugins/tpm/tpm_private_key.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2017 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup tpm_private_key tpm_private_key
+ * @{ @ingroup tpm
+ */
+
+#ifndef TPM_PRIVATE_KEY_H_
+#define TPM_PRIVATE_KEY_H_
+
+typedef struct tpm_private_key_t tpm_private_key_t;
+
+#include <credentials/builder.h>
+#include <credentials/keys/private_key.h>
+
+/**
+ * Private Key implementation for the TPM 2.0 Trusted Platform Module
+ */
+struct tpm_private_key_t {
+
+ /**
+ * Implements private_key_t interface.
+ */
+ private_key_t key;
+};
+
+/**
+ * Connect to a private key bound to the TPM
+ *
+ * @param type type of the key
+ * @param args builder_part_t argument list
+ * @return loaded key, NULL on failure
+ */
+tpm_private_key_t *tpm_private_key_connect(key_type_t type, va_list args);
+
+#endif /** tpm_PRIVATE_KEY_H_ @}*/
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-22 04:57:39 +0000