[#71] Dockerize TPM 1.2 Provisioner and Integrate with Docker Compose (#77)

* [#71] Initial Dockerization of TPM 1.2 Provisioner

* Fix permissions on new script

* Fix current bugs

* [#71] Try a new direction for setting up TPM 1.2 Provisioner Testing

* [#71] Attempt to the latest version of Trousers on Travis CI VM for 1.2 Provisioner support

* [#71] Try IBM TPM 1.2 Emulator

* [#71] Move towards cleaning up work

* [#71] Update TPM1.2 Provisioner Docker to work with Docker Compose in Systems Test

* [#71] Get TPM 1.2 Provisioner to provision successfully in Docker container

* Update system tests script to include TPM 1.2 Provisioner container

* [#71] Separate TPM 1.2 and 2.0 Provisioner System Tests

* [#71] Pipe TPM Emulator log output to file to clear up system test output

.ci/docker/.env

@@ -1,4 +1,5 @@
 HIRS_ACA_PROVISIONER_IP=172.19.0.3
+HIRS_ACA_PROVISIONER_TPM2_IP=172.19.0.4
 TPM_ENABLED=true
 IMA_ENABLED=false
 
@@ -7,4 +8,6 @@ HIRS_ACA_PORTAL_PORT=8443
 HIRS_BROKER_PORT=61616
 HIRS_ACA_PORTAL_CONTAINER_PORT=80
 
+HIRS_ACA_HOSTNAME=hirsaca
+
 HIRS_SUBNET=172.19.0.0/16

.ci/docker/Dockerfile.tpmprovisioner

@@ -0,0 +1,17 @@
+FROM hirs/hirs-ci:centos7
+
+MAINTAINER apl.dev3@jhuapl.edu
+
+# Install packages for installing HIRS TPM Provisioner
+RUN yum -y update && yum clean all
+# TODO: Remove vim-common if/when Paccor updates (Also update Paccor version below)
+RUN yum install -y java-1.8.0-openjdk wget util-linux chkconfig sed systemd gmp-devel coreutils dmidecode bash autoconf autoconf-archive automake libtool pkgconfig m4 gcc-c++ openssl python-requests && yum clean all
+
+# Install tpm_module for Communicating with TPM
+RUN mkdir tpm_module && pushd tpm_module && wget https://github.com/nsacyber/HIRS/releases/download/v1.0.2/tpm_module-1.0.2-1541093721.d1bdf9.x86_64.rpm && yum -y install tpm_module-*.rpm && popd
+
+# Install PACCOR for Device Info Gathering
+RUN mkdir paccor && pushd paccor && wget https://github.com/nsacyber/paccor/releases/download/v1.0.6r3/paccor-1.0.6-3.noarch.rpm && yum -y install paccor-*.rpm && popd
+
+# Install Software TPM for Provisioning
+RUN mkdir tpm_emulator && pushd tpm_emulator && wget https://phoenixnap.dl.sourceforge.net/project/ibmswtpm/tpm4769tar.gz && tar -xzvf tpm4769tar.gz && pushd libtpm && ./autogen && ./configure && make && popd && pushd tpm && make -f makefile-tpm && popd && popd

.ci/docker/docker-compose-tpm2.yml

@@ -0,0 +1,50 @@
+version: "3.1"
+
+services:
+   aca:
+      image: hirs/hirs-ci:aca
+      container_name: hirs-aca
+      volumes:
+         - ../../:/HIRS
+      ports:
+         - "${HIRS_ACA_PORTAL_PORT}:${HIRS_ACA_PORTAL_CONTAINER_PORT}"
+      entrypoint: /bin/bash -c
+      command: [HIRS/.ci/integration-tests/setup-aca.sh]
+      hostname: ${HIRS_ACA_HOSTNAME}
+      networks:
+         hirs_aca_system_tests:
+            ipv4_address: ${HIRS_ACA_PORTAL_IP}
+            aliases:
+              - ${HIRS_ACA_HOSTNAME}
+
+   tpm2provisioner:
+      image: hirs/hirs-ci:tpm2provisioner
+      container_name: hirs-aca-provisioner-tpm2
+      depends_on:
+         - aca
+      volumes:
+         - ../../:/HIRS
+      entrypoint: /bin/bash -c
+      command: [HIRS/.ci/integration-tests/setup-tpm2provisioner.sh;
+                HIRS/.ci/system-tests/systems-test-centos7-tpm2.sh]
+      networks:
+         hirs_aca_system_tests:
+            ipv4_address: ${HIRS_ACA_PROVISIONER_TPM2_IP}
+      environment:
+         - HIRS_ACA_PROVISIONER_TPM2_IP=${HIRS_ACA_PROVISIONER_TPM2_IP}
+         - TPM_ENABLED=${TPM_ENABLED}
+         - IMA_ENABLED=${IMA_ENABLED}
+         - HIRS_ACA_PORTAL_IP=${HIRS_ACA_PORTAL_IP}
+         - HIRS_ACA_PORTAL_PORT=${HIRS_ACA_PORTAL_PORT}
+         - HIRS_BROKER_PORT=${HIRS_BROKER_PORT}
+         - HIRS_ACA_PORTAL_CONTAINER_PORT=${HIRS_ACA_PORTAL_CONTAINER_PORT}
+         - HIRS_ACA_HOSTNAME=${HIRS_ACA_HOSTNAME}
+         - HIRS_SUBNET=${HIRS_SUBNET}
+
+networks:
+   hirs_aca_system_tests:
+      driver: bridge
+      ipam:
+         driver: default
+         config:
+           - subnet: ${HIRS_SUBNET}

.ci/docker/docker-compose.yml

@@ -10,20 +10,26 @@ services:
          - "${HIRS_ACA_PORTAL_PORT}:${HIRS_ACA_PORTAL_CONTAINER_PORT}"
       entrypoint: /bin/bash -c
       command: [HIRS/.ci/integration-tests/setup-aca.sh]
+      hostname: ${HIRS_ACA_HOSTNAME}
       networks:
          hirs_aca_system_tests:
             ipv4_address: ${HIRS_ACA_PORTAL_IP}
+            aliases:
+              - ${HIRS_ACA_HOSTNAME}
 
-   tpm2provisioner:
+   tpmprovisioner:
-      image: hirs/hirs-ci:tpm2provisioner
+      image: hirs/hirs-ci:tpmprovisioner
-      container_name: hirs-aca-provisioner-tpm2
+      container_name: hirs-aca-provisioner
       depends_on:
          - aca
       volumes:
          - ../../:/HIRS
       entrypoint: /bin/bash -c
-      command: [HIRS/.ci/integration-tests/setup-tpm2provisioner.sh;
+      command: [HIRS/.ci/integration-tests/setup-tpmprovisioner.sh;]
-                HIRS/.ci/system-tests/systems-test-centos7-tpm2.sh]
+      devices:
+        - "/dev/mem:/dev/mem"
+      cap_add:
+        - sys_rawio
       networks:
          hirs_aca_system_tests:
             ipv4_address: ${HIRS_ACA_PROVISIONER_IP}
@@ -35,6 +41,7 @@ services:
          - HIRS_ACA_PORTAL_PORT=${HIRS_ACA_PORTAL_PORT}
          - HIRS_BROKER_PORT=${HIRS_BROKER_PORT}
          - HIRS_ACA_PORTAL_CONTAINER_PORT=${HIRS_ACA_PORTAL_CONTAINER_PORT}
+         - HIRS_ACA_HOSTNAME=${HIRS_ACA_HOSTNAME}
          - HIRS_SUBNET=${HIRS_SUBNET}
 
 networks:

.ci/integration-tests/setup-tpm2provisioner.sh

@@ -10,9 +10,9 @@ until [ "`curl --silent --connect-timeout 1 -I -k https://${HIRS_ACA_PORTAL_IP}:
 done
 echo "ACA is up!"
 
-# Function to install provisioner packages.
+# Function to install TPM2 Provisioner packages.
 function InstallProvisioner {
-	echo "===========Installing Provisioner Packages...==========="
+	echo "===========Installing TPM2 Provisioner Packages...==========="
 
 	pushd /HIRS
 	if [ ! -d package/rpm/RPMS ]; then
@@ -23,7 +23,7 @@ function InstallProvisioner {
 }
 
 # Function to initialize the TPM2 Emulator
-function InitTpmEmulator { 
+function InitTpm2Emulator {
 	echo "===========Initializing TPM2 Emulator...==========="
 
 	mkdir -p /var/run/dbus
@@ -112,12 +112,12 @@ function UpdateHirsSiteConfigFile {
 #*******************************************
 #* HIRS site configuration properties file
 #*******************************************
-CLIENT_HOSTNAME=${HIRS_ACA_PROVISIONER_IP}
+CLIENT_HOSTNAME=${HIRS_ACA_PROVISIONER_TPM2_IP}
 TPM_ENABLED=${TPM_ENABLED}
 IMA_ENABLED=${IMA_ENABLED}
 
 # Site-specific configuration
-ATTESTATION_CA_FQDN=${HIRS_ACA_PORTAL_IP}
+ATTESTATION_CA_FQDN=${HIRS_ACA_HOSTNAME}
 ATTESTATION_CA_PORT=${HIRS_ACA_PORTAL_PORT}
 BROKER_FQDN=${HIRS_ACA_PORTAL_IP}
 BROKER_PORT=${HIRS_BROKER_PORT}
@@ -133,11 +133,11 @@ DEFAULT_SITE_CONFIG_FILE
 # Install packages
 InstallProvisioner
 
-# Install TPM Emulator
+# Install TPM2 Emulator
-InitTpmEmulator
+InitTpm2Emulator
 
-# Update the hir-site.config file
+# Update the hirs-site.config file
 UpdateHirsSiteConfigFile
 
 echo ""
-echo "===========HIRS ACA Provisioner Setup Complete!==========="
+echo "===========HIRS ACA TPM2 Provisioner Setup Complete!==========="

.ci/integration-tests/setup-tpmprovisioner.sh

@@ -0,0 +1,110 @@
+#!/bin/bash
+
+# Script to setup the TPM Provisioner Docker Image for Integration Tests
+set -e
+
+# Wait for ACA to boot
+echo "Waiting for ACA to spin up..."
+until [ "`curl --silent --connect-timeout 1 -I -k https://${HIRS_ACA_PORTAL_IP}:${HIRS_ACA_PORTAL_PORT}/HIRS_AttestationCAPortal | grep '302 Found'`" != "" ]; do
+  :
+done
+echo "ACA is up!"
+
+# Function to install Provisioner packages.
+function InstallProvisioner {
+	echo "===========Installing Provisioner Packages...==========="
+
+  pushd /HIRS
+  if [ ! -d package/rpm/RPMS ]; then
+      ./package/package.centos.sh
+  fi
+  yum install -y package/rpm/RPMS/noarch/HIRS_Provisioner_TPM_1_2*.el7.noarch.rpm
+  popd
+}
+
+# Function to initialize the TPM Emulator
+function InitTpmEmulator {
+	echo "===========Initializing TPM Emulator...==========="
+
+  # Set variables for server
+  export TPM_PATH=/tpm_emulator/tpm_storage
+  export TPM_PORT=6543
+
+  # Set variables for client utils
+  export TPM_SERVER_NAME=localhost
+  export TPM_SERVER_PORT=6543
+
+  # Set variable for TrouSerS
+  export TCSD_TCP_DEVICE_PORT=6543
+
+  mkdir -p $TPM_PATH
+
+  pushd /tpm_emulator
+
+  # Activate Software TPM
+  ./tpm/tpm_server > tpm.log 2>&1 &
+  ./libtpm/utils/tpmbios
+
+  # Restart Software TPM after Activation
+  pkill tpm_server
+  ./tpm/tpm_server > tpm.log 2>&1 &
+  ./libtpm/utils/tpmbios
+
+  # Create EK on Software TPM
+  ./libtpm/utils/createek
+
+  # Initialize last memory address
+  ./libtpm/utils/nv_definespace -in ffffffff -sz 0
+
+  popd
+
+  echo "Starting TrouSerS Daemon"
+  tcsd -e
+
+  echo "Testing TPM Connectivity"
+  tpm_selftest
+
+	echo "===========TPM Emulator Initialization Complete!==========="
+}
+
+# Function to update the hirs-site.config file
+function UpdateHirsSiteConfigFile {
+	HIRS_SITE_CONFIG="/etc/hirs/hirs-site.config"
+
+	echo ""
+	echo "===========Updating ${HIRS_SITE_CONFIG}, using values from /HIRS/.ci/docker/.env file...==========="
+	cat /HIRS/.ci/docker/.env
+
+	cat <<DEFAULT_SITE_CONFIG_FILE > $HIRS_SITE_CONFIG
+#*******************************************
+#* HIRS site configuration properties file
+#*******************************************
+CLIENT_HOSTNAME=${HIRS_ACA_PROVISIONER_IP}
+TPM_ENABLED=${TPM_ENABLED}
+IMA_ENABLED=${IMA_ENABLED}
+
+# Site-specific configuration
+ATTESTATION_CA_FQDN=${HIRS_ACA_HOSTNAME}
+ATTESTATION_CA_PORT=${HIRS_ACA_PORTAL_PORT}
+BROKER_FQDN=${HIRS_ACA_PORTAL_IP}
+BROKER_PORT=${HIRS_BROKER_PORT}
+PORTAL_FQDN=${HIRS_ACA_PORTAL_IP}
+PORTAL_PORT=${HIRS_ACA_PORTAL_PORT}
+
+DEFAULT_SITE_CONFIG_FILE
+
+ echo "===========New HIRS Config File==========="
+ cat /etc/hirs/hirs-site.config
+}
+
+# Install packages
+InstallProvisioner
+
+# Install TPM Emulator
+InitTpmEmulator
+
+# Update the hirs-site.config file
+UpdateHirsSiteConfigFile
+
+echo ""
+echo "===========HIRS ACA Provisioner Setup Complete!==========="

.ci/system-tests/run-system-tests-tpm2.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+
+# Script to run the System Tests for HIRS TPM 2.0 Provisioner
+
+set -e
+
+echo ""
+echo "System Tests Starting..."
+echo ""
+
+# Start System Testing Docker Environment
+cd .ci/docker
+
+docker-compose -f docker-compose-tpm2.yml up -d
+
+tpm2_container_id="$(docker ps -aqf "name=hirs-aca-provisioner-tpm2")"
+echo "TPM2 Container ID: $tpm2_container_id"
+
+tpm2_container_status="$(docker inspect $tpm2_container_id --format='{{.State.Status}}')"
+echo "TPM2 Container Status: $tpm2_container_status"
+
+while [[ $tpm2_container_status == "running" ]]
+do
+  sleep 10
+
+  # Add status message, so Travis will not time out.
+  # It may timeout if it hasn't received output for more than 10 minutes.
+  echo "Still running tests, please wait..."
+
+  tpm2_container_status="$(docker inspect $tpm2_container_id --format='{{.State.Status}}')"
+done
+
+# Store container exit codes
+tpm2_container_exit_code="$(docker inspect $tpm2_container_id --format='{{.State.ExitCode}}')"
+echo "TPM2 Container Exit Code: $tpm2_container_exit_code"
+
+# Display container logs
+echo ""
+echo "===========hirs-aca-provisioner-tpm2 System Tests Log:==========="
+docker logs $tpm2_container_id
+
+echo ""
+echo "End of TPM 2.0 System Tests, cleaning up..."
+echo ""
+# Clean up services and network
+docker-compose down
+
+# Return container exit codes
+if [[ $tpm2_container_exit_code == 0 ]]
+then
+    echo "SUCCESS: TPM 2.0 System tests passed"
+    exit 0
+fi
+
+echo "ERROR: System tests failed"
+exit 1

.ci/system-tests/run-system-tests.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Script to run the System Tests for HIRS
+# Script to run the System Tests for HIRS TPM 1.2 Provisioner
 
 set -e
 
@@ -13,13 +13,13 @@ cd .ci/docker
 
 docker-compose up -d
 
-tpm2_container_id="$(docker ps -aqf "name=hirs-aca-provisioner-tpm2")"
+tpm_container_id="$(docker ps -aqf "name=hirs-aca-provisioner")"
-echo "TPM2 Container ID: $tpm2_container_id"
+echo "TPM Container ID: $tpm_container_id"
 
-tpm2_container_status="$(docker inspect $tpm2_container_id --format='{{.State.Status}}')"
+tpm_container_status="$(docker inspect $tpm_container_id --format='{{.State.Status}}')"
-echo "TPM2 Container Status: $tpm2_container_status"
+echo "TPM Container Status: $tpm_container_status"
 
-while [ $tpm2_container_status == "running" ] 
+while [[ $tpm_container_status == "running" ]]
 do
   sleep 10
 
@@ -27,28 +27,28 @@ do
   # It may timeout if it hasn't received output for more than 10 minutes.
   echo "Still running tests, please wait..."
 
-  tpm2_container_status="$(docker inspect $tpm2_container_id --format='{{.State.Status}}')"
+  tpm_container_status="$(docker inspect $tpm_container_id --format='{{.State.Status}}')"
 done
 
-# Store TPM2 container exit code
+# Store container exit codes
-tpm2_container_exit_code="$(docker inspect $tpm2_container_id --format='{{.State.ExitCode}}')"
+tpm_container_exit_code="$(docker inspect $tpm_container_id --format='{{.State.ExitCode}}')"
-echo "TPM2 Container Exit Code: $tpm2_container_exit_code"
+echo "TPM Container Exit Code: $tpm_container_exit_code"
 
-# Display TPM2 container log
+# Display container logs
 echo ""
-echo "===========hirs-aca-provisioner-tpm2 System Tests Log:==========="
+echo "===========hirs-aca-provisioner System Tests Log:==========="
-docker logs $tpm2_container_id
+docker logs $tpm_container_id
 
 echo ""
-echo "End of System Tests, cleaning up..."
+echo "End of TPM 1.2 System Tests, cleaning up..."
 echo ""
 # Clean up services and network
 docker-compose down
 
-# Return TPM2 container exit code
+# Return container exit codes
-if [[ $tpm2_container_exit_code == 0 ]]
+if [[ $tpm_container_exit_code == 0 ]]
 then
-    echo "SUCCESS: System tests passed"
+    echo "SUCCESS: TPM 1.2 System tests passed"
     exit 0
 fi
 

.travis.yml

@@ -47,3 +47,7 @@ jobs:
       script: .ci/system-tests/./run-system-tests.sh
       env: null
       name: "System Tests"
+    - stage: system-tests
+      script: .ci/system-tests/./run-system-tests-tpm2.sh
+      env: null
+      name: "System Tests TPM2"