| #!/usr/bin/env bash |
| |
| FLAG_OVERWRITE=1 |
| FLAG_REGISTER_KEY=2 |
| FLAG_TPMTOOL_SUPPORTS_SRK_WELL_KNOWN=4 |
| FLAG_SRK_WELL_KNOWN=8 |
| FLAG_TPM2=16 |
| |
| TSS_TCSD_HOSTNAME_DEFAULT=localhost |
| TSS_TCSD_PORT_DEFAULT=30003 |
| |
| logit() |
| { |
| if [ -z "$LOGFILE" ]; then |
| echo "$@" >&1 |
| else |
| echo "$@" >> "$LOGFILE" |
| fi |
| } |
| |
| logerr() |
| { |
| if [ -z "$LOGFILE" ]; then |
| echo "Error: $*" >&2 |
| else |
| echo "Error: $*" >> "$LOGFILE" |
| fi |
| } |
| |
| # Get the size of a file in bytes |
| # |
| # @1: filename |
| function get_filesize() |
| { |
| if [[ "$(uname -s)" =~ (Linux|CYGWIN_NT-) ]]; then |
| stat -c%s "$1" |
| else |
| # OpenBSD |
| stat -f%z "$1" |
| fi |
| } |
| |
| # Create a config value by escaping the proper characters |
| # |
| # @param 1: The string to escape |
| function escape_pkcs11_url() |
| { |
| echo "$1" | sed 's/;/\\;/g' |
| } |
| |
| # Use expect for automating the interaction with the tpmtool |
| # |
| # @param 1...: parameters to pass to tpmtool command line |
| # |
| # TPM_SRK_PASSWORD and TPM_KEY_PASSWORD global variables are used |
| # for the SRK and key passwords respectively. |
| run_tpmtool() { |
| local prg out rc |
| |
| prg="spawn tpmtool "$@" |
| expect { |
| \"Enter SRK password:\" { |
| send \"${TPM_SRK_PASSWORD}\n\" |
| exp_continue |
| } |
| \"Enter key password:\" { |
| send \"${TPM_KEY_PASSWORD}\n\" |
| exp_continue |
| } |
| \"tpmkey:\" { |
| send_user \"\n\" |
| } |
| eof { |
| exit |
| } |
| } |
| catch wait result |
| exit [lindex \$result 3] |
| " |
| out=$(expect -c "${prg}") |
| rc=$? |
| echo "${out}" |
| return $rc |
| } #run_tpmtool |
| |
| create_localca_cert() { |
| local flags=$1 |
| local dir="$2" |
| local outfile="$3" |
| local owner="$4" |
| local pid="$5" # TPM2 parameter |
| |
| local cakey=${dir}/swtpm-localca-rootca-privkey.pem |
| local cacert=${dir}/swtpm-localca-rootca-cert.pem |
| local tpmkey=${dir}/swtpm-localca-tpmca-privkey.pem |
| local tpmpubkey=${dir}/swtpm-localca-tpmca-pubkey.pem |
| local tpmca=${dir}/swtpm-localca-tpmca-cert.pem |
| local template=${dir}/template |
| local tpmkeyurl |
| local msg output |
| |
| if ! [ -r "${cakey}" ] || ! [ -r "${cacert}" ]; then |
| msg=$("${CERTTOOL}" \ |
| --generate-privkey \ |
| ${SWTPM_ROOTCA_PASSWORD:+--password "${SWTPM_ROOTCA_PASSWORD}"} \ |
| --outfile "${cakey}" \ |
| 2>&1) |
| [ $? -ne 0 ] && { |
| logerr "Could not create root-CA key ${cakey}." |
| logerr "${msg}" |
| return 1 |
| } |
| chmod 640 "${cakey}" |
| |
| echo "cn=swtpm-localca-rootca" > "${template}" |
| echo "ca" >> "${template}" |
| echo "cert_signing_key" >> "${template}" |
| echo "expiration_days = 3650" >> "${template}" |
| |
| msg=$(GNUTLS_PIN="${SWTPM_ROOTCA_PASSWORD}" ${CERTTOOL} \ |
| --generate-self-signed \ |
| --template "${template}" \ |
| --outfile "${cacert}" \ |
| --load-privkey "${cakey}" \ |
| 2>&1) |
| |
| if [ $? -ne 0 ]; then |
| logerr "Could not create root CA." |
| logerr "${msg}" |
| rm -f "${cakey}" "${template}" |
| return 1 |
| fi |
| else |
| logit "Reusing existing root CA" |
| fi |
| |
| rm -f "${tpmkey}" "${tpmpubkey}" "${tpmca}" |
| |
| if [ $((flags & FLAG_TPM2)) -ne 0 ]; then |
| local tokenurl tpmkeyurl |
| local token="swtpm-tpmca-${pid}" |
| local label="${token}" # must be same |
| local keylabel="swtpm-tpmca-key" |
| local userpin="${SWTPM_PKCS11_PIN:-swtpm-tpmca}" |
| |
| tokenurl=$(p11tool --list-tokens 2>&1 | \ |
| grep -E ";token=${token}\$" | \ |
| sed -n "s/.*URL: //p") |
| if [ -z "${tokenurl}" ]; then |
| if [ -z "${SWTPM_PKCS11_SO_PIN}" ]; then |
| logerr "The env. variable SWTPM_PKCS11_SO_PIN must be set to create token ${label}." |
| return 1 |
| fi |
| msg=$(tpm2_ptool addtoken \ |
| --pid "${pid}" \ |
| --sopin "${SWTPM_PKCS11_SO_PIN}" \ |
| --userpin "${userpin}" \ |
| --label "${label}" 2>&1) |
| if [ $? -ne 0 ]; then |
| logerr "Error: Could not create pkcs11 token" |
| logerr "${msg}" |
| return 1 |
| fi |
| tokenurl=$(p11tool --list-tokens 2>&1 | \ |
| grep -E ";token=${token}\$" | \ |
| sed -n "s/.*URL: //p") |
| if [ -z "${tokenurl}" ]; then |
| logerr "Error: Could not get token URL for token '${token}'" |
| logerr "${msg}" |
| return 1 |
| fi |
| msg=$(tpm2_ptool config \ |
| --key tcti \ |
| --value tabrmd \ |
| --label "${label}") |
| if [ $? -ne 0 ]; then |
| logerr "Error: Could not set config value for tcti key" |
| logerr "${msg}" |
| return 1 |
| fi |
| fi |
| |
| export GNUTLS_PIN="${userpin}" |
| # GNUTLS_SO_PIN not needed at this point |
| |
| msg="$(p11tool --login --list-keys "${tokenurl}" 2>&1)" |
| if [ $? -eq 0 ]; then |
| tpmkeyurl=$(echo "${msg}" | \ |
| grep ";object=${keylabel}" | \ |
| sed -n "s/.*URL: //p") |
| fi |
| if [ -z "${tpmkeyurl}" ]; then |
| msg=$(tpm2_ptool addkey \ |
| "--label=${label}" \ |
| "--userpin=${userpin}" \ |
| --algorithm=rsa2048 \ |
| "--key-label=${keylabel}" \ |
| --id 1 2>&1) |
| if [ $? -ne 0 ]; then |
| logerr "Error: Could not create create key under pkcs11 token ${token}" |
| logerr "${msg}" |
| return 1 |
| fi |
| msg="$(p11tool --login --list-keys "${tokenurl}" 2>&1)" |
| if [ $? -ne 0 ]; then |
| logerr "Error: Could not get TPM key URL for ${tokenurl}" |
| logerr "${msg}" |
| return 1 |
| fi |
| tpmkeyurl=$(echo "${msg}" | \ |
| grep ";object=${keylabel}" | \ |
| sed -n "s/.*URL: //p") |
| if [ -z "${tpmkeyurl}" ]; then |
| logerr "Error: Could not get TPM key URL for ${tokenurl}" |
| logerr "${msg}" |
| return 1 |
| fi |
| fi |
| rm -f "${tpmpubkey}" |
| |
| msg=$(p11tool --export-pubkey "${tpmkeyurl}" --login --outfile "${tpmpubkey}" 2>&1) |
| if [ $? -ne 0 ] || \ |
| [ ! -r "${tpmpubkey}" ] || [ $(get_filesize "${tpmpubkey}") -eq 0 ]; then |
| logerr "Error: Could not get TPM public key" |
| logerr "${msg}" |
| rm -f "${tpmkey}" "${tpmpubkey}" |
| return 1 |
| fi |
| else |
| local params="" |
| |
| if [ $((flags & FLAG_SRK_WELL_KNOWN)) -ne 0 ]; then |
| unset GNUTLS_PIN |
| params="--srk-well-known" |
| else |
| export GNUTLS_PIN="${TPM_SRK_PASSWORD}" |
| fi |
| |
| if [ $((flags & FLAG_REGISTER_KEY)) -ne 0 ]; then |
| msg="$(run_tpmtool --generate-rsa --signing --register ${params})" |
| if [ $? -ne 0 ]; then |
| logerr "Could not generate registered signing key with tpmtool" |
| logerr "${msg}" |
| return 1 |
| fi |
| tpmkeyurl=$(echo "${msg}" | sed -n 's/\(tpmkey:uuid=[^;]*\);.*/\1/p') |
| if [ -z "${tpmkeyurl}" ]; then |
| logerr "Could not parse tpmkey URL" |
| logerr "${msg}" |
| return 1 |
| fi |
| else |
| rm -f "${tpmkey}" |
| msg="$(run_tpmtool --generate-rsa --signing --outfile \"${tpmkey}\" ${params})" |
| if [ $? -ne 0 ]; then |
| logerr "Could not create signing key with tpmtool" |
| logerr "${msg}" |
| rm -f "${tpmkey}" |
| return 1 |
| fi |
| if [ ! -r "${tpmkey}" ] || [ $(get_filesize "${tpmkey}") -eq 0 ]; then |
| logerr "The TPM key file ${tpmkey} was not written properly" |
| logerr "${msg}" |
| rm -f "${tpmkey}" |
| return 1 |
| fi |
| chmod 640 "${tpmkey}" |
| tpmkeyurl="tpmkey:file=${tpmkey}" |
| fi |
| |
| rm -f "${tpmpubkey}" |
| msg=$(run_tpmtool "--pubkey=${tpmkeyurl}" --outfile \"${tpmpubkey}\" ${params}) |
| if [ $? -ne 0 ] || \ |
| [ ! -r "${tpmpubkey}" ] || [ $(get_filesize "${tpmpubkey}") -eq 0 ]; then |
| logerr "Error: Could not get TPM public key" |
| logerr "${msg}" |
| rm -f "${tpmkey}" "${tpmpubkey}" |
| return 1 |
| fi |
| fi |
| |
| echo "cn=swtpm-localca" > "${template}" |
| echo "ca" >> "${template}" |
| echo "cert_signing_key" >> "${template}" |
| echo "expiration_days = 3650" >> "${template}" |
| |
| msg=$(${CERTTOOL} \ |
| --generate-certificate \ |
| --template "${template}" \ |
| --outfile "${tpmca}" \ |
| --load-ca-privkey "${cakey}" \ |
| --load-ca-certificate "${cacert}" \ |
| --load-privkey "${tpmkeyurl}" \ |
| --load-pubkey "${tpmpubkey}" \ |
| 2>&1) |
| |
| if [ $? -ne 0 ]; then |
| logerr "Could not create TPM CA" |
| logerr "${msg}" |
| rm -f "${template}" |
| return 1 |
| fi |
| |
| output="statedir = ${dir} |
| signingkey = $(escape_pkcs11_url ${tpmkeyurl}) |
| issuercert = ${tpmca} |
| certserial = ${dir}/certserial" |
| |
| if [ $((flags & FLAG_TPM2)) -eq 0 ]; then |
| output+="$(echo -e "\nTSS_TCSD_HOSTNAME = ${TSS_TCSD_HOSTNAME}")" |
| output+="$(echo -e "\nTSS_TCSD_PORT = ${TSS_TCSD_PORT}")" |
| else |
| output+="$(echo -e "\nSWTPM_PKCS11_PIN = ${SWTPM_PKCS11_PIN}")" |
| # output+="$(echo -e "\nSWTPM_PKCS11_SO_PIN = ${SWTPM_PKCS11_SO_PIN}")" |
| fi |
| if [ -n "${TPM_KEY_PASSWORD}" ]; then |
| output+="$(echo -e "\nsigningkey_password = ${TPM_KEY_PASSWORD}")" |
| fi |
| if [ -n "${TPM_SRK_PASSWORD}" ]; then |
| output+="$(echo -e "\nparentkey_password = ${TPM_SRK_PASSWORD}")" |
| fi |
| |
| if [ -n "${outfile}" ]; then |
| echo "${output}" > "${outfile}" |
| chmod 640 "${outfile}" |
| fi |
| echo "${output}" |
| |
| if [ "$(id -u)" -eq 0 ]; then |
| chown "${owner}:${group}" "${dir}" |
| |
| pushd "${dir}" &>/dev/null |
| if [ $? -eq 0 ]; then |
| chown "${owner}:${group}" ./* |
| popd &>/dev/null |
| fi |
| |
| if [ -n "${outfile}" ]; then |
| chown "${owner}:${group}" "${outfile}" |
| fi |
| fi |
| |
| rm -f "${template}" |
| |
| return 0 |
| } #create_localca_cert |
| |
| usage() { |
| local flags=$2 |
| |
| local tpmtool_note=" use 'well known' password if not |
| given" |
| [ $((flags & FLAG_TPMTOOL_SUPPORTS_SRK_WELL_KNOWN)) -eq 0 ] && \ |
| tpmtool_note=" |
| Note: the well known password of 20 zero bytes is not |
| supported by tpmtool" |
| |
| cat << _EOF_ |
| Create a TPM-based CA for signing EK and platform certificates. |
| |
| Usage: $(basename "$1") [options] |
| |
| THIS SCRIPT IS EXPERIMENTAL |
| |
| The following options are supported: |
| |
| --dir directory Directory where to write the CA files into; must not exist |
| unless --overwrite is passed |
| --overwrite Overwrite any data in an existing directory; tries to |
| reuse a root CA if one is found there |
| --register Create a registered TPM 1.2 key rather than a file that |
| contains the key; this option has no effect if --tpm2 is |
| used |
| --key-password s Password for the newly created TPM key; required if |
| --register is not passed |
| Note: use the same as the --srk-password (bug in certtool) |
| --srk-password s Password for the TPM's SRK;${tpmtool_note} |
| --outfile file File to write the configuration to; if not passed it will be |
| written to stdout only |
| --owner owner The owner of the directory and the files; only set if this |
| script is run as root; recommended to be 'tss' |
| --group group The group owning the directory and the files; |
| recommended to be 'tss' |
| --tss-tcsd-hostname hostname |
| The name of the host where tcsd (TrouSerS daemon) is running |
| on; default is '${TSS_TCSD_HOSTNAME_DEFAULT}' |
| --tss-tcsd-port p The TCP port on which tcsd is listening for connections; |
| default is ${TSS_TCSD_PORT_DEFAULT} |
| --tpm2 Setup a CA that uses a TPM 2.0 |
| --pid <pid> Pimary object Id used by tpm2_ptool; only valid if --tpm2 |
| is used |
| --help, -h, -? Display this help screen and exit |
| |
| |
| The following environment variables are supported: |
| |
| SWTPM_ROOTCA_PASSWORD The root CA's private key password |
| |
| _EOF_ |
| } #usage |
| |
| # Check whether tpmtool supports --srk-well-known |
| tpmtool_supports_srk_well_known() |
| { |
| local tmp |
| |
| tmp=$(tpmtool --help | grep "srk-well-known") |
| [ -z "${tmp}" ] && return 1 |
| return 0 |
| } |
| |
| main() { |
| local flags=0 |
| local dir outfile owner group msg pid |
| |
| if tpmtool_supports_srk_well_known; then |
| flags=$((flags | FLAG_TPMTOOL_SUPPORTS_SRK_WELL_KNOWN | FLAG_SRK_WELL_KNOWN)) |
| fi |
| |
| CERTTOOL=certtool |
| export TSS_TCSD_HOSTNAME=${TSS_TCSD_HOSTNAME_DEFAULT} |
| export TSS_TCSD_PORT=${TSS_TCSD_PORT_DEFAULT} |
| |
| while [ $# -ne 0 ]; do |
| case "$1" in |
| --dir) |
| shift |
| dir="$1" |
| ;; |
| --overwrite) |
| flags=$((flags | FLAG_OVERWRITE)) |
| ;; |
| --register) |
| flags=$((flags | FLAG_REGISTER_KEY)) |
| ;; |
| --srk-password) |
| shift |
| TPM_SRK_PASSWORD="$1" |
| flags=$((flags & ~FLAG_SRK_WELL_KNOWN)) |
| ;; |
| --key-password) |
| shift |
| TPM_KEY_PASSWORD="$1" |
| ;; |
| --outfile) |
| shift |
| outfile="$1" |
| ;; |
| --owner) |
| shift |
| owner="$1" |
| ;; |
| --group) |
| shift |
| group="$1" |
| ;; |
| --tss-tcsd-hostname) |
| shift |
| TSS_TCSD_HOSTNAME="$1" |
| ;; |
| --tss-tcsd-port) |
| shift |
| TSS_TCSD_PORT="$1" |
| ;; |
| --tpm2) |
| flags=$((flags | FLAG_TPM2)) |
| ;; |
| --pid) |
| shift |
| pid="$1" |
| ;; |
| --help|-h|-?) |
| usage "$0" "${flags}" |
| exit 0 |
| ;; |
| *) |
| logerr "Unsupported option $1" |
| exit 1 |
| ;; |
| esac |
| shift |
| done |
| if [ -z "${dir}" ]; then |
| logerr "Missing --dir option." |
| return 1 |
| fi |
| # strip trailing '/' from dir |
| dir="$(echo "${dir}" | sed -n 's|[/]*$||p')" |
| |
| if [ -d "${dir}" ] && [ $((flags & FLAG_OVERWRITE)) -eq 0 ]; then |
| logerr "Refusing to overwrite existing directory ${dir}." |
| return 1 |
| fi |
| |
| if [ -z "${TPM_SRK_PASSWORD}" ] && [ $((flags & FLAG_TPM2)) -eq 0 ] && |
| [ $((flags & FLAG_TPMTOOL_SUPPORTS_SRK_WELL_KNOWN)) -eq 0 ]; then |
| logerr "SRK password must be provided" |
| return 1 |
| fi |
| |
| if [ -z "${TPM_KEY_PASSWORD}" ] && \ |
| [ $((flags & FLAG_REGISTER_KEY)) -eq 0 ] && \ |
| [ $((flags & FLAG_TPM2)) -eq 0 ]; then |
| logerr "Key password is required" |
| return 1 |
| fi |
| |
| if [ $((flags & FLAG_TPM2)) -ne 0 ] && [ -z "${pid}" ]; then |
| logerr "--pid is required for TPM 2" |
| return 1 |
| fi |
| |
| if [ "$(id -u)" -eq 0 ]; then |
| if [ -n "${owner}" ]; then |
| msg="$(id -u "${owner}" 2>&1)" |
| if [ $? -ne 0 ]; then |
| logerr "User ${owner} cannot be used: ${msg}" |
| return 1 |
| fi |
| else |
| owner="root" |
| fi |
| if [ -n "${group}" ]; then |
| msg="$(id -g "${group}" 2>&1)" |
| if [ $? -ne 0 ]; then |
| logerr "Group ${group} cannot be used: ${msg}" |
| return 1 |
| fi |
| else |
| group="root" |
| fi |
| fi |
| |
| mkdir -p "${dir}" |
| if [ $? -ne 0 ]; then |
| logerr "Could not create directory ${dir}." |
| return 1 |
| fi |
| |
| create_localca_cert "${flags}" "${dir}" "${outfile}" "${owner}" "${pid}" |
| return $? |
| } #main |
| |
| main "$@" |
| exit $? |
