From f5e5ab910b8b1d69f962ca033d1295c3e1e1e131 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Wed, 23 Feb 2022 19:48:52 +0100 Subject: [PATCH] tpm2: dynamically load tss2 libraries as needed libtss2-esys links to OpenSSL or mbed TLS for cryptography, which may cause packaging issues. This instead dlopen's tss2 libraries as needed so non-TPM applications continue working without loading multiple crypto libraries. Signed-off-by: Daiki Ueno --- configure.ac | 11 +- lib/Makefile.am | 6 +- lib/tpm2.c | 2 +- lib/tpm2.h | 2 +- lib/tpm2_esys.c | 273 ++++++++++++++++++++++++++++++++++++-------- tests/Makefile.am | 3 +- tests/sanity-lib.sh | 40 +++++++ tests/tpm2.sh | 14 ++- 8 files changed, 296 insertions(+), 55 deletions(-) create mode 100644 tests/sanity-lib.sh diff --git a/configure.ac b/configure.ac index 53c3aefca1..721ff208f0 100644 --- a/configure.ac +++ b/configure.ac @@ -882,6 +882,8 @@ AM_CONDITIONAL(P11KIT_0_23_11_API, $PKG_CONFIG --atleast-version=0.23.11 p11-kit AM_CONDITIONAL(ENABLE_PKCS11, test "$with_p11_kit" != "no") +need_ltlibdl=no + AC_ARG_WITH(tpm2, AS_HELP_STRING([--without-tpm2], [Disable TPM2 support.]), @@ -892,6 +894,7 @@ if test "$with_tpm2" != "no"; then if test "$have_tpm2" = "yes"; then tss2lib="tss2-esys tss2-mu tss2-tctildr" AC_DEFINE([HAVE_TSS2], 1, [Have TSS2]) + need_ltlibdl=yes elif test "$with_tpm2" = "yes"; then AC_MSG_ERROR([[ *** @@ -920,7 +923,8 @@ if test "$with_tpm" != "no"; then AC_SUBST([TSS_LIBS], [-ltspi]) AC_SUBST([TSS_CFLAGS], []) AC_DEFINE([HAVE_TROUSERS], 1, [Enable TPM]) - with_tpm=yes], + with_tpm=yes, + need_ltlibdl=yes], [AC_MSG_RESULT(no) AC_MSG_WARN([[ *** @@ -957,6 +961,9 @@ fi AC_DEFINE_UNQUOTED([TROUSERS_LIB], ["$ac_trousers_lib"], [the location of the trousers library]) AC_SUBST(TROUSERS_LIB) + +AM_CONDITIONAL(NEED_LTLIBDL, test "$need_ltlibdl" = yes) + # For minitasn1. AC_CHECK_SIZEOF(unsigned long int, 4) AC_CHECK_SIZEOF(unsigned int, 4) @@ -1312,7 +1319,7 @@ AC_MSG_NOTICE([External hardware support: Random gen. variant: $rnd_variant PKCS#11 support: $with_p11_kit TPM support: $with_tpm - TPM2 support: $have_tpm2 + TPM2 support: $with_tpm2 KTLS support: $enable_ktls ]) diff --git a/lib/Makefile.am b/lib/Makefile.am index 35df35ee8d..e61ee1b6ae 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am @@ -44,7 +44,7 @@ AM_CPPFLAGS = \ -I$(srcdir)/x509 \ $(LIBTASN1_CFLAGS) \ $(P11_KIT_CFLAGS) \ - $(TPM2_CFLAGS) + $(TSS2_CFLAGS) if !HAVE_LIBUNISTRING SUBDIRS += unistring @@ -156,7 +156,7 @@ libgnutls_la_LIBADD = ../gl/libgnu.la x509/libgnutls_x509.la \ auth/libgnutls_auth.la algorithms/libgnutls_alg.la \ extras/libgnutls_extras.la thirdparty_libadd = $(LTLIBZ) $(LTLIBINTL) $(LIBSOCKET) $(LTLIBNSL) \ - $(P11_KIT_LIBS) $(LIB_SELECT) $(TSS2_LIBS) $(GNUTLS_LIBS_PRIVATE) + $(P11_KIT_LIBS) $(LIB_SELECT) $(GNUTLS_LIBS_PRIVATE) if HAVE_LIBIDN2 thirdparty_libadd += $(LIBIDN2_LIBS) @@ -203,7 +203,7 @@ all-local: $(hmac_files) CLEANFILES = $(hmac_files) endif -if ENABLE_TROUSERS +if NEED_LTLIBDL thirdparty_libadd += $(LTLIBDL) endif diff --git a/lib/tpm2.c b/lib/tpm2.c index 076cc7f407..750eadc777 100644 --- a/lib/tpm2.c +++ b/lib/tpm2.c @@ -297,5 +297,5 @@ int _gnutls_load_tpm2_key(gnutls_privkey_t pkey, const gnutls_datum_t *fdata) void _gnutls_tpm2_deinit(void) { - tpm2_tcti_deinit(); + tpm2_esys_deinit(); } diff --git a/lib/tpm2.h b/lib/tpm2.h index e40dc01df7..7966e2d811 100644 --- a/lib/tpm2.h +++ b/lib/tpm2.h @@ -37,7 +37,7 @@ struct tpm2_info_st; struct tpm2_info_st *tpm2_info_init(struct pin_info_st *pin); -void tpm2_tcti_deinit(void); +void tpm2_esys_deinit(void); void release_tpm2_ctx(struct tpm2_info_st *info); diff --git a/lib/tpm2_esys.c b/lib/tpm2_esys.c index 93e54413ba..4000c1b76e 100644 --- a/lib/tpm2_esys.c +++ b/lib/tpm2_esys.c @@ -72,6 +72,170 @@ #include #include +#include + +/* We don't want to link to libtss2-esys, as it brings in other + * crypto libraries. Instead, only dlopen it as needed. + */ + +static void *_gnutls_tss2_esys_dlhandle; +static void *_gnutls_tss2_mu_dlhandle; +static void *_gnutls_tss2_tctildr_dlhandle; + +static TSS2_RC +(*_gnutls_tss2_Esys_GetCapability)(ESYS_CONTEXT *esysContext, + ESYS_TR shandle1, + ESYS_TR shandle2, + ESYS_TR shandle3, + TPM2_CAP capability, + UINT32 property, + UINT32 propertyCount, + TPMI_YES_NO *moreData, + TPMS_CAPABILITY_DATA **capabilityData); +static void (*_gnutls_tss2_Esys_Free)(void *__ptr); +static TSS2_RC (*_gnutls_tss2_Esys_TR_SetAuth)(ESYS_CONTEXT *esysContext, + ESYS_TR handle, + TPM2B_AUTH const *authValue); +static TSS2_RC +(*_gnutls_tss2_Esys_CreatePrimary)(ESYS_CONTEXT *esysContext, + ESYS_TR primaryHandle, + ESYS_TR shandle1, + ESYS_TR shandle2, + ESYS_TR shandle3, + const TPM2B_SENSITIVE_CREATE *inSensitive, + const TPM2B_PUBLIC *inPublic, + const TPM2B_DATA *outsideInfo, + const TPML_PCR_SELECTION *creationPCR, + ESYS_TR *objectHandle, + TPM2B_PUBLIC **outPublic, + TPM2B_CREATION_DATA **creationData, + TPM2B_DIGEST **creationHash, + TPMT_TK_CREATION **creationTicket); +static TSS2_RC (*_gnutls_tss2_Esys_Initialize)(ESYS_CONTEXT **esys_context, + TSS2_TCTI_CONTEXT *tcti, + TSS2_ABI_VERSION *abiVersion); +static TSS2_RC (*_gnutls_tss2_Esys_Startup)(ESYS_CONTEXT *esysContext, + TPM2_SU startupType); +static TSS2_RC (*_gnutls_tss2_Esys_TR_FromTPMPublic)(ESYS_CONTEXT *esysContext, + TPM2_HANDLE tpm_handle, + ESYS_TR optionalSession1, + ESYS_TR optionalSession2, + ESYS_TR optionalSession3, + ESYS_TR *object); +static TSS2_RC (*_gnutls_tss2_Esys_ReadPublic)(ESYS_CONTEXT *esysContext, + ESYS_TR objectHandle, + ESYS_TR shandle1, + ESYS_TR shandle2, + ESYS_TR shandle3, + TPM2B_PUBLIC **outPublic, + TPM2B_NAME **name, + TPM2B_NAME **qualifiedName); +static TSS2_RC (*_gnutls_tss2_Esys_Load)(ESYS_CONTEXT *esysContext, + ESYS_TR parentHandle, + ESYS_TR shandle1, + ESYS_TR shandle2, + ESYS_TR shandle3, + const TPM2B_PRIVATE *inPrivate, + const TPM2B_PUBLIC *inPublic, + ESYS_TR *objectHandle); +static TSS2_RC (*_gnutls_tss2_Esys_FlushContext)(ESYS_CONTEXT *esysContext, + ESYS_TR flushHandle); +static void (*_gnutls_tss2_Esys_Finalize)(ESYS_CONTEXT **context); +static TSS2_RC +(*_gnutls_tss2_Esys_RSA_Decrypt)(ESYS_CONTEXT *esysContext, + ESYS_TR keyHandle, + ESYS_TR shandle1, + ESYS_TR shandle2, + ESYS_TR shandle3, + const TPM2B_PUBLIC_KEY_RSA *cipherText, + const TPMT_RSA_DECRYPT *inScheme, + const TPM2B_DATA *label, + TPM2B_PUBLIC_KEY_RSA **message); +static TSS2_RC (*_gnutls_tss2_Esys_Sign)(ESYS_CONTEXT *esysContext, + ESYS_TR keyHandle, + ESYS_TR shandle1, + ESYS_TR shandle2, + ESYS_TR shandle3, + const TPM2B_DIGEST *digest, + const TPMT_SIG_SCHEME *inScheme, + const TPMT_TK_HASHCHECK *validation, + TPMT_SIGNATURE **signature); + +static TSS2_RC +(*_gnutls_tss2_Tss2_MU_TPM2B_PRIVATE_Unmarshal)(uint8_t const buffer[], + size_t buffer_size, + size_t *offset, + TPM2B_PRIVATE *dest); +static TSS2_RC +(*_gnutls_tss2_Tss2_MU_TPM2B_PUBLIC_Unmarshal)(uint8_t const buffer[], + size_t buffer_size, + size_t *offset, + TPM2B_PUBLIC *dest); + +static TSS2_RC +(*_gnutls_tss2_Tss2_TctiLdr_Initialize)(const char *nameConf, + TSS2_TCTI_CONTEXT **context); +static void (*_gnutls_tss2_Tss2_TctiLdr_Finalize)(TSS2_TCTI_CONTEXT **context); + +#define DLSYM_TSS2(sys, sym) \ + _gnutls_tss2_##sym = dlsym(_gnutls_tss2_##sys##_dlhandle, #sym); \ + if (!_gnutls_tss2_##sym) { \ + return -1; \ + } + +static int +init_tss2_funcs(void) +{ + if (!_gnutls_tss2_esys_dlhandle) { + _gnutls_tss2_esys_dlhandle = + dlopen("libtss2-esys.so.0", RTLD_NOW | RTLD_GLOBAL); + if (!_gnutls_tss2_esys_dlhandle) { + _gnutls_debug_log("tpm2: unable to dlopen libtss2-esys\n"); + return -1; + } + } + + DLSYM_TSS2(esys, Esys_GetCapability) + DLSYM_TSS2(esys, Esys_Free) + DLSYM_TSS2(esys, Esys_TR_SetAuth) + DLSYM_TSS2(esys, Esys_CreatePrimary) + DLSYM_TSS2(esys, Esys_Initialize) + DLSYM_TSS2(esys, Esys_Startup) + DLSYM_TSS2(esys, Esys_TR_FromTPMPublic) + DLSYM_TSS2(esys, Esys_ReadPublic) + DLSYM_TSS2(esys, Esys_Load) + DLSYM_TSS2(esys, Esys_FlushContext) + DLSYM_TSS2(esys, Esys_Finalize) + DLSYM_TSS2(esys, Esys_RSA_Decrypt) + DLSYM_TSS2(esys, Esys_Sign) + + if (!_gnutls_tss2_mu_dlhandle) { + _gnutls_tss2_mu_dlhandle = + dlopen("libtss2-mu.so.0", RTLD_NOW | RTLD_GLOBAL); + if (!_gnutls_tss2_mu_dlhandle) { + _gnutls_debug_log("tpm2: unable to dlopen libtss2-mu\n"); + return -1; + } + } + + DLSYM_TSS2(mu, Tss2_MU_TPM2B_PRIVATE_Unmarshal) + DLSYM_TSS2(mu, Tss2_MU_TPM2B_PUBLIC_Unmarshal) + + if (!_gnutls_tss2_tctildr_dlhandle) { + _gnutls_tss2_tctildr_dlhandle = + dlopen("libtss2-tctildr.so.0", RTLD_NOW | RTLD_GLOBAL); + if (!_gnutls_tss2_tctildr_dlhandle) { + _gnutls_debug_log("tpm2: unable to dlopen libtss2-tctildr\n"); + return -1; + } + } + + DLSYM_TSS2(tctildr, Tss2_TctiLdr_Initialize) + DLSYM_TSS2(tctildr, Tss2_TctiLdr_Finalize) + + return 0; +} + struct tpm2_info_st { TPM2B_PUBLIC pub; TPM2B_PRIVATE priv; @@ -227,10 +391,10 @@ get_primary_template(ESYS_CONTEXT *ctx) UINT32 i; TSS2_RC rc; - rc = Esys_GetCapability (ctx, - ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, - TPM2_CAP_ALGS, 0, TPM2_MAX_CAP_ALGS, - NULL, &capability_data); + rc = _gnutls_tss2_Esys_GetCapability(ctx, + ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, + TPM2_CAP_ALGS, 0, TPM2_MAX_CAP_ALGS, + NULL, &capability_data); if (rc) { _gnutls_debug_log("tpm2: Esys_GetCapability failed: 0x%x\n", rc); return NULL; @@ -239,7 +403,7 @@ get_primary_template(ESYS_CONTEXT *ctx) for (i = 0; i < capability_data->data.algorithms.count; i++) { if (capability_data->data.algorithms.algProperties[i].alg == TPM2_ALG_ECC) { - Esys_Free(capability_data); + _gnutls_tss2_Esys_Free(capability_data); return &primary_template_ecc; } } @@ -247,12 +411,12 @@ get_primary_template(ESYS_CONTEXT *ctx) for (i = 0; i < capability_data->data.algorithms.count; i++) { if (capability_data->data.algorithms.algProperties[i].alg == TPM2_ALG_RSA) { - Esys_Free(capability_data); + _gnutls_tss2_Esys_Free(capability_data); return &primary_template_rsa; } } - Esys_Free(capability_data); + _gnutls_tss2_Esys_Free(capability_data); _gnutls_debug_log("tpm2: unable to find primary template\n"); return NULL; } @@ -320,7 +484,7 @@ static int init_tpm2_primary(struct tpm2_info_st *info, install_tpm_passphrase(&info->ownerauth, pass); info->need_ownerauth = false; } - rc = Esys_TR_SetAuth(ctx, hierarchy, &info->ownerauth); + rc = _gnutls_tss2_Esys_TR_SetAuth(ctx, hierarchy, &info->ownerauth); if (rc) { _gnutls_debug_log("tpm2: Esys_TR_SetAuth failed: 0x%x\n", rc); return gnutls_assert_val(GNUTLS_E_TPM_ERROR); @@ -329,7 +493,7 @@ static int init_tpm2_primary(struct tpm2_info_st *info, if (!primary_template) { return gnutls_assert_val(GNUTLS_E_TPM_ERROR); } - rc = Esys_CreatePrimary(ctx, hierarchy, + rc = _gnutls_tss2_Esys_CreatePrimary(ctx, hierarchy, ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE, &primary_sensitive, primary_template, @@ -359,14 +523,14 @@ static int init_tpm2_key(ESYS_CONTEXT **ctx, ESYS_TR *key_handle, _gnutls_debug_log("tpm2: establishing connection with TPM\n"); - rc = Esys_Initialize(ctx, tcti_ctx, NULL); + rc = _gnutls_tss2_Esys_Initialize(ctx, tcti_ctx, NULL); if (rc) { gnutls_assert(); _gnutls_debug_log("tpm2: Esys_Initialize failed: 0x%x\n", rc); goto error; } - rc = Esys_Startup(*ctx, TPM2_SU_CLEAR); + rc = _gnutls_tss2_Esys_Startup(*ctx, TPM2_SU_CLEAR); if (rc == TPM2_RC_INITIALIZE) { _gnutls_debug_log("tpm2: was already started up thus false positive failing in tpm2tss log\n"); } else if (rc) { @@ -381,7 +545,7 @@ static int init_tpm2_key(ESYS_CONTEXT **ctx, ESYS_TR *key_handle, goto error; } } else { - rc = Esys_TR_FromTPMPublic(*ctx, info->parent, + rc = _gnutls_tss2_Esys_TR_FromTPMPublic(*ctx, info->parent, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, @@ -399,7 +563,7 @@ static int init_tpm2_key(ESYS_CONTEXT **ctx, ESYS_TR *key_handle, if (!info->did_ownerauth && !info->ownerauth.size) { TPM2B_PUBLIC *pub = NULL; - rc = Esys_ReadPublic(*ctx, parent_handle, + rc = _gnutls_tss2_Esys_ReadPublic(*ctx, parent_handle, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, @@ -408,7 +572,7 @@ static int init_tpm2_key(ESYS_CONTEXT **ctx, ESYS_TR *key_handle, !(pub->publicArea.objectAttributes & TPMA_OBJECT_NODA)) { info->need_ownerauth = true; } - Esys_Free(pub); + _gnutls_tss2_Esys_Free(pub); } reauth: if (info->need_ownerauth) { @@ -420,7 +584,7 @@ static int init_tpm2_key(ESYS_CONTEXT **ctx, ESYS_TR *key_handle, install_tpm_passphrase(&info->ownerauth, pass); info->need_ownerauth = false; } - rc = Esys_TR_SetAuth(*ctx, parent_handle, &info->ownerauth); + rc = _gnutls_tss2_Esys_TR_SetAuth(*ctx, parent_handle, &info->ownerauth); if (rc) { gnutls_assert(); _gnutls_debug_log("tpm2: Esys_TR_SetAuth failed: 0x%x\n", @@ -432,7 +596,7 @@ static int init_tpm2_key(ESYS_CONTEXT **ctx, ESYS_TR *key_handle, _gnutls_debug_log("tpm2: loading TPM2 key blob, parent handle 0x%x\n", parent_handle); - rc = Esys_Load(*ctx, parent_handle, + rc = _gnutls_tss2_Esys_Load(*ctx, parent_handle, ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE, &info->priv, &info->pub, key_handle); @@ -450,7 +614,7 @@ static int init_tpm2_key(ESYS_CONTEXT **ctx, ESYS_TR *key_handle, info->did_ownerauth = true; if (parent_is_generated(info->parent)) { - rc = Esys_FlushContext(*ctx, parent_handle); + rc = _gnutls_tss2_Esys_FlushContext(*ctx, parent_handle); if (rc) { _gnutls_debug_log("tpm2: Esys_FlushContext for generated primary failed: 0x%x\n", rc); @@ -461,14 +625,14 @@ static int init_tpm2_key(ESYS_CONTEXT **ctx, ESYS_TR *key_handle, return 0; error: if (parent_is_generated(info->parent) && parent_handle != ESYS_TR_NONE) { - Esys_FlushContext(*ctx, parent_handle); + _gnutls_tss2_Esys_FlushContext(*ctx, parent_handle); } if (*key_handle != ESYS_TR_NONE) { - Esys_FlushContext(*ctx, *key_handle); + _gnutls_tss2_Esys_FlushContext(*ctx, *key_handle); } *key_handle = ESYS_TR_NONE; - Esys_Finalize(ctx); + _gnutls_tss2_Esys_Finalize(ctx); return GNUTLS_E_TPM_ERROR; } @@ -488,7 +652,7 @@ auth_tpm2_key(struct tpm2_info_st *info, ESYS_CONTEXT *ctx, ESYS_TR key_handle) info->need_userauth = false; } - rc = Esys_TR_SetAuth(ctx, key_handle, &info->userauth); + rc = _gnutls_tss2_Esys_TR_SetAuth(ctx, key_handle, &info->userauth); if (rc) { _gnutls_debug_log("tpm2: Esys_TR_SetAuth failed: 0x%x\n", rc); return gnutls_assert_val(GNUTLS_E_TPM_ERROR); @@ -574,7 +738,7 @@ int tpm2_rsa_sign_hash_fn(gnutls_privkey_t key, gnutls_sign_algorithm_t algo, goto out; } - rc = Esys_RSA_Decrypt(ectx, key_handle, + rc = _gnutls_tss2_Esys_RSA_Decrypt(ectx, key_handle, ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE, &digest, &in_scheme, &label, &tsig); if (rc_is_key_auth_failed(rc)) { @@ -591,14 +755,14 @@ int tpm2_rsa_sign_hash_fn(gnutls_privkey_t key, gnutls_sign_algorithm_t algo, ret = _gnutls_set_datum(sig, tsig->buffer, tsig->size); out: - Esys_Free(tsig); + _gnutls_tss2_Esys_Free(tsig); if (key_handle != ESYS_TR_NONE) { - Esys_FlushContext(ectx, key_handle); + _gnutls_tss2_Esys_FlushContext(ectx, key_handle); } if (ectx) { - Esys_Finalize(&ectx); + _gnutls_tss2_Esys_Finalize(&ectx); } return ret; @@ -661,7 +825,7 @@ int tpm2_ec_sign_hash_fn(gnutls_privkey_t key, gnutls_sign_algorithm_t algo, goto out; } - rc = Esys_Sign(ectx, key_handle, + rc = _gnutls_tss2_Esys_Sign(ectx, key_handle, ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE, &digest, &in_scheme, &validation, &tsig); @@ -682,31 +846,23 @@ int tpm2_ec_sign_hash_fn(gnutls_privkey_t key, gnutls_sign_algorithm_t algo, ret = gnutls_encode_rs_value(sig, &sig_r, &sig_s); out: - Esys_Free(tsig); + _gnutls_tss2_Esys_Free(tsig); if (key_handle != ESYS_TR_NONE) { - Esys_FlushContext(ectx, key_handle); + _gnutls_tss2_Esys_FlushContext(ectx, key_handle); } if (ectx) { - Esys_Finalize(&ectx); + _gnutls_tss2_Esys_Finalize(&ectx); } return ret; } -GNUTLS_ONCE(tcti_once); - -void -tpm2_tcti_deinit(void) -{ - if (tcti_ctx) { - Tss2_TctiLdr_Finalize(&tcti_ctx); - } -} +GNUTLS_ONCE(tpm2_esys_once); static void -tcti_once_init(void) +tpm2_esys_once_init(void) { const char *tcti; const char * const tcti_vars[] = { @@ -718,6 +874,11 @@ tcti_once_init(void) size_t i; TSS2_RC rc; + if (init_tss2_funcs() < 0) { + _gnutls_debug_log("tpm2: unable to initialize TSS2 functions\n"); + return; + } + for (i = 0; i < sizeof(tcti_vars) / sizeof(tcti_vars[0]); i++) { tcti = secure_getenv(tcti_vars[i]); if (tcti && *tcti != '\0') { @@ -727,7 +888,7 @@ tcti_once_init(void) } } if (tcti && *tcti != '\0') { - rc = Tss2_TctiLdr_Initialize(tcti, &tcti_ctx); + rc = _gnutls_tss2_Tss2_TctiLdr_Initialize(tcti, &tcti_ctx); if (rc) { _gnutls_debug_log("tpm2: TSS2_TctiLdr_Initialize failed: 0x%x\n", rc); @@ -735,13 +896,35 @@ tcti_once_init(void) } } +/* called by the global destructor through _gnutls_tpm2_deinit */ +void +tpm2_esys_deinit(void) +{ + if (tcti_ctx) { + _gnutls_tss2_Tss2_TctiLdr_Finalize(&tcti_ctx); + tcti_ctx = NULL; + } + if (_gnutls_tss2_esys_dlhandle) { + dlclose(_gnutls_tss2_esys_dlhandle); + _gnutls_tss2_esys_dlhandle = NULL; + } + if (_gnutls_tss2_mu_dlhandle) { + dlclose(_gnutls_tss2_mu_dlhandle); + _gnutls_tss2_mu_dlhandle = NULL; + } + if (_gnutls_tss2_tctildr_dlhandle) { + dlclose(_gnutls_tss2_tctildr_dlhandle); + _gnutls_tss2_tctildr_dlhandle = NULL; + } +} + int install_tpm2_key(struct tpm2_info_st *info, gnutls_privkey_t pkey, unsigned int parent, bool emptyauth, gnutls_datum_t *privdata, gnutls_datum_t *pubdata) { TSS2_RC rc; - (void)gnutls_once(&tcti_once, tcti_once_init); + (void)gnutls_once(&tpm2_esys_once, tpm2_esys_once_init); if (!tcti_ctx) { return gnutls_assert_val(GNUTLS_E_TPM_ERROR); @@ -757,16 +940,16 @@ int install_tpm2_key(struct tpm2_info_st *info, gnutls_privkey_t pkey, info->parent = parent; - rc = Tss2_MU_TPM2B_PRIVATE_Unmarshal(privdata->data, privdata->size, NULL, - &info->priv); + rc = _gnutls_tss2_Tss2_MU_TPM2B_PRIVATE_Unmarshal(privdata->data, privdata->size, NULL, + &info->priv); if (rc) { _gnutls_debug_log("tpm2: failed to import private key data: 0x%x\n", rc); return gnutls_assert_val(GNUTLS_E_TPM_ERROR); } - rc = Tss2_MU_TPM2B_PUBLIC_Unmarshal(pubdata->data, pubdata->size, NULL, - &info->pub); + rc = _gnutls_tss2_Tss2_MU_TPM2B_PUBLIC_Unmarshal(pubdata->data, pubdata->size, NULL, + &info->pub); if (rc) { _gnutls_debug_log("tpm2: failed to import public key data: 0x%x\n", rc); diff --git a/tests/Makefile.am b/tests/Makefile.am index 529f1cc077..64ce470a02 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -515,7 +515,8 @@ dist_check_SCRIPTS += fastopen.sh pkgconfig.sh starttls.sh starttls-ftp.sh start psktool.sh ocsp-tests/ocsp-load-chain.sh gnutls-cli-save-data.sh gnutls-cli-debug.sh \ sni-resume.sh ocsp-tests/ocsptool.sh cert-reencoding.sh pkcs7-cat.sh long-crl.sh \ serv-udp.sh logfile-option.sh gnutls-cli-resume.sh profile-tests.sh \ - server-weak-keys.sh ocsp-tests/ocsp-signer-verify.sh cfg-test.sh + server-weak-keys.sh ocsp-tests/ocsp-signer-verify.sh cfg-test.sh \ + sanity-lib.sh if !DISABLE_SYSTEM_CONFIG dist_check_SCRIPTS += system-override-sig.sh system-override-hash.sh \ diff --git a/tests/sanity-lib.sh b/tests/sanity-lib.sh new file mode 100644 index 0000000000..1e3612781b --- /dev/null +++ b/tests/sanity-lib.sh @@ -0,0 +1,40 @@ +#!/bin/sh + +# Copyright (C) 2022 Red Hat, Inc. +# +# Author: Daiki Ueno +# +# This file is part of GnuTLS. +# +# GnuTLS is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 3 of the License, or (at +# your option) any later version. +# +# GnuTLS is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# You should have received a copy of the GNU Lesser General Public License +# along with this program. If not, see + +: ${top_builddir=..} +: ${CLI_DEBUG=../src/gnutls-cli-debug${EXEEXT}} +: ${LDD=ldd} +: ${LIBTOOL=libtool} + +if ! test -x "${CLI_DEBUG}"; then + exit 77 +fi + +# ldd.sh doesn't check recursive dependencies +${LDD} --version >/dev/null || exit 77 + +# We use gnutls-cli-debug, as it has the fewest dependencies among our +# commands (e.g., gnutls-cli pulls in OpenSSL through libunbound). +if ${LIBTOOL} --mode=execute ${LDD} ${CLI_DEBUG} | \ + grep '^[[:space:]]*\(libcrypto\.\|libssl\.\|libgcrypt\.\)'; then + echo "gnutls-cli-debug links to other crypto library" + exit 1 +fi diff --git a/tests/tpm2.sh b/tests/tpm2.sh index 854986c552..6f8e44c64b 100755 --- a/tests/tpm2.sh +++ b/tests/tpm2.sh @@ -21,8 +21,6 @@ # along with GnuTLS; if not, write to the Free Software Foundation, # Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -set +e - : ${srcdir=.} : ${CERTTOOL=../src/certtool${EXEEXT}} KEYPEMFILE=tpmkey.$$.key.pem @@ -192,6 +190,10 @@ run_tests() echo " - Generating ${KEYPEMFILE}" tpm2tss-genkey -a ${kalg} -o ${OPASS} ${KEYPEMFILE} + if [ $? -ne 0 ]; then + echo "unable to generate key" + return 1 + fi cat ${KEYPEMFILE} echo " - Generating certificate based on key" @@ -200,6 +202,10 @@ run_tests() "${CERTTOOL}" --generate-self-signed -d 3 \ --load-privkey "${KEYPEMFILE}" \ --template "${srcdir}/cert-tests/templates/template-test.tmpl" + if [ $? -ne 0 ]; then + echo "unable to generate certificate" + return 1 + fi if test "${kalg}" = "rsa";then echo " - Generating RSA-PSS certificate based on key" @@ -207,6 +213,10 @@ run_tests() --load-privkey "${KEYPEMFILE}" \ --sign-params rsa-pss \ --template "${srcdir}/cert-tests/templates/template-test.tmpl" + if [ $? -ne 0 ]; then + echo "unable to generate certificate" + return 1 + fi fi stop_swtpm -- 2.34.1