Merge pull request #49 from hnez/tpm

machines: machine: attach TPM emulation if a state file is present

Author: hnez

contrib/tpm-setup/setup.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/bash
+
+set -Eeuo pipefail
+
+# Print an error message if any command fails.
+trap 'echo "Error: command failed at ${BASH_SOURCE[0]}:${LINENO}" >&2' ERR
+
+usage() {
+    echo "Usage: $(basename "$0") <base dir> <user/repo/machine> [scripts]" >&2
+    echo >&2
+    echo "Initialize a software TPM and set ip up for ssh / x509 certificate"
+    echo >&2
+    echo "  Example: $(basename "$0") env forrest-runner/test/build ssh.sh"
+
+    exit 1
+}
+
+main() {
+    if [[ $# -lt 2 ]]; then
+        usage
+    fi
+
+    local self="$(realpath "${0}")"
+    local selfdir="$(dirname "${self}")"
+
+    local base_dir="$1"
+    local triplet="$2"
+
+    if [[ ! "$triplet" =~ ^[A-Za-z0-9_-]+/[A-Za-z0-9_-]+/[A-Za-z0-9_-]+$ ]]; then
+        echo "Error: argument must be of the form 'user/repo/machine'" >&2
+        exit 1
+    fi
+
+    local state_file="${base_dir}/machines/${triplet}.swtpm"
+    local store_dir="${base_dir}/machines/${triplet}/tpm/tpm2_pkcs11"
+
+    mkdir -p "${store_dir}"
+
+    swtpm_setup --tpm2 --ecc --tpmstate "file://${state_file}"
+
+    swtpm socket \
+        --tpm2 \
+        --tpmstate "backend-uri=file://${state_file}" \
+        --server type=unixio,path=server.sock \
+        --ctrl type=unixio,path=server.sock.ctrl \
+        --daemon \
+        --pid file=swtpm.pid \
+        --flags startup-clear
+
+    if [[ -e "/usr/lib/x86_64-linux-gnu/pkcs11/libtpm2_pkcs11.so" ]]; then
+        export PKCS11_PROVIDER_MODULE="/usr/lib/x86_64-linux-gnu/pkcs11/libtpm2_pkcs11.so"
+    else
+        export PKCS11_PROVIDER_MODULE="/usr/lib/pkcs11/libtpm2_pkcs11.so"
+    fi
+
+    export PKCS11_SO_PIN="${PKCS11_SO_PIN:-0000}"
+    export PKCS11_USER_PIN="${PKCS11_USER_PIN:-0000}"
+
+    export TPM2TOOLS_TCTI="swtpm:path=$(readlink -f server.sock)"
+    export TPM2_PKCS11_TCTI="${TPM2TOOLS_TCTI}"
+    export TPM2_PKCS11_STORE="${store_dir}"
+
+    pkcs11-tool \
+        --module "${PKCS11_PROVIDER_MODULE}" \
+        --slot-index=0 \
+        --init-token \
+        --label=tpm \
+        --so-pin="${PKCS11_SO_PIN}"
+
+    pkcs11-tool \
+        --module "${PKCS11_PROVIDER_MODULE}" \
+        --init-pin --login --so-pin="${PKCS11_SO_PIN}" \
+        --slot-index=0 \
+        --new-pin="${PKCS11_USER_PIN}"
+
+    echo "-----------------"
+    echo "Run setup scripts"
+    echo "-----------------"
+
+    for script in "${@:3}"; do
+        PATH="${selfdir}:${PATH}" ${script}
+    done
+
+    kill "$(cat swtpm.pid)"
+}
+
+main $*

contrib/tpm-setup/ssh.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/bash
+
+set -Eeuo pipefail
+
+pkcs11-tool \
+    --module "${PKCS11_PROVIDER_MODULE}" \
+    --keypairgen \
+    --login --pin="${PKCS11_USER_PIN}" \
+    --label="ssh" \
+    --usage-sign \
+    --key-type EC:prime256v1
+
+echo "--- SSH Public Key ---"
+ssh-keygen -D "${PKCS11_PROVIDER_MODULE}"
+echo "--- SSH Public Key ---"

contrib/tpm-setup/x509-keygen.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/bash
+
+set -Eeuo pipefail
+
+label="${X509_LABEL:-key}"
+subject="${X509_LABEL:-/CN=${label}}"
+cert_path="${TPM2_PKCS11_STORE}/../${label}.cert.pem"
+key_path="${TPM2_PKCS11_STORE}/../${label}.key.pem"
+key_uri="pkcs11:object=${label};pin-value=${PKCS11_USER_PIN}"
+
+pkcs11-tool \
+    --module "${PKCS11_PROVIDER_MODULE}" \
+    --keypairgen \
+    --login --pin "${PKCS11_USER_PIN}" \
+    --label="${label}" \
+    --usage-sign \
+    --key-type EC:prime256v1
+
+# Generate self-signed certificate using the keypair generated above
+
+openssl req \
+    -new -x509 \
+    -provider default -provider base -provider pkcs11 \
+    -days 36500 \
+    -subj "${subject}" \
+    -key "${key_uri}" \
+    -out "${cert_path}"
+
+pkcs11-tool \
+    --module "${PKCS11_PROVIDER_MODULE}" \
+    --login --pin "${PKCS11_USER_PIN}" \
+    --label="${label}" \
+    --write-object ${cert_path} \
+    --type cert
+
+tmp_dir="$(mktemp --directory)"
+
+cat > "${tmp_dir}/asn1.conf" <<EOF
+asn1=SEQUENCE:pkcs11_uri_seq
+
+[pkcs11_uri_seq]
+version=VISIBLESTRING:PKCS\#11 Provider URI v1.0
+uri=UTF8:${key_uri}
+EOF
+
+openssl asn1parse \
+    -genconf "${tmp_dir}/asn1.conf" \
+    -noout \
+    -out "${tmp_dir}/key.der"
+
+{
+    echo "-----BEGIN PKCS#11 PROVIDER URI-----"
+    openssl base64 -in "${tmp_dir}/key.der"
+    echo "-----END PKCS#11 PROVIDER URI-----"
+} > "${key_path}"
+
+rm -rf "${tmp_dir}"

src/machines/machine.rs

@@ -55,6 +55,19 @@ const QEMU_ARGS: &[&[&str]] = &[
         "if=virtio,format=raw,discard=unmap,cache.writeback=on,cache.direct=on,cache.no-flush=on,file=job-config.img",
     ],
 ];
+const QEMU_ARGS_SWTPM: &[&[&str]] = &[
+    &["-chardev", "socket,id=chrtpm,path=swtpm.ctrl"],
+    &["-tpmdev", "emulator,id=tpm0,chardev=chrtpm"],
+    &["-device", "tpm-tis,tpmdev=tpm0"],
+];
+
+const SWTPM_CMD: &str = "/usr/bin/swtpm";
+const SWTPM_ARGS: &[&[&str]] = &[
+    &["socket"],
+    &["--tpm2"],
+    &["--tpmstate", "backend-uri=file://tpm.swtpm"],
+    &["--ctrl", "type=unixio,path=swtpm.ctrl"],
+];
 
 #[derive(PartialEq, Clone, Copy, Debug)]
 pub(super) enum Status {
@@ -415,6 +428,30 @@ impl Machine {
             ["-virtfs".into(), arg].into_iter()
         });
 
+        // Spawn a software TPM emulation if a state file is present.
+        // We do not monitor the status of this process or wait for the control
+        // socket to be ready.
+        // Instead we just hope that it starts successfully.
+        let (_swtpm, swtpm_args) = {
+            let inner = self.inner();
+            let pwd = inner.run_dir.as_ref().unwrap();
+
+            if pwd.path().join("tpm.swtpm").exists() {
+                let mut swtpm = Command::new(SWTPM_CMD);
+
+                swtpm
+                    .kill_on_drop(true)
+                    .current_dir(pwd.path())
+                    .args(SWTPM_ARGS.iter().flat_map(|arg_list| *arg_list));
+
+                let child = swtpm.spawn()?;
+
+                (Some(child), QEMU_ARGS_SWTPM)
+            } else {
+                (None, [].as_slice())
+            }
+        };
+
         // Assemble the complete set of arguments to pass to the qemu command.
         let mut qemu = {
             let inner = self.inner();
@@ -431,6 +468,7 @@ impl Machine {
                 .arg("-smp")
                 .arg(&smp)
                 .args(QEMU_ARGS.iter().flat_map(|arg_list| *arg_list))
+                .args(swtpm_args.iter().flat_map(|arg_list| *arg_list))
                 .args(virtfs_args);
 
             qemu

src/machines/run_dir.rs

@@ -1,4 +1,4 @@
-use std::fs::{create_dir_all, File};
+use std::fs::{copy, create_dir_all, File};
 use std::io::ErrorKind;
 use std::path::{Path, PathBuf};
 
@@ -176,6 +176,18 @@ impl RunDir {
             )?
         };
 
+        // Copy a TPM state to the run dir _if_ one was prepared for the
+        // machine type. This is optional. Continue if none is present.
+        let machine_tmp_state_path = triplet.machine_tmp_state_path(base_dir);
+        let tmp_state_path = run_dir.join("tpm.swtpm");
+        copy(machine_tmp_state_path, tmp_state_path).or_else(|err| match err.kind() {
+            ErrorKind::NotFound => {
+                info!("Did not find TPM state for {machine}, continuing without TPM");
+                Ok(0)
+            }
+            err => Err(err),
+        })?;
+
         let dir = Self {
             run_dir,
             machine_image,

src/machines/triplet.rs

@@ -118,6 +118,14 @@ impl Triplet {
             .join(&self.repository)
             .join(format!("{}.img", self.machine_name))
     }
+
+    pub(super) fn machine_tmp_state_path(&self, base_dir_path: &Path) -> PathBuf {
+        base_dir_path
+            .join("machines")
+            .join(&self.owner)
+            .join(&self.repository)
+            .join(format!("{}.swtpm", self.machine_name))
+    }
 }
 
 impl std::fmt::Display for Triplet {