heads/initrd/bin/unseal-totp

#!/bin/bash
# Retrieve the sealed file from the NVRAM, unseal it and compute the totp

. /etc/functions

TOTP_SEALED="/tmp/secret/totp.sealed"
TOTP_SECRET="/tmp/secret/totp.key"

TRACE "Under /bin/unseal-totp"

if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then
	tpmr unseal 0x81004d47 sha256:0,1,2,3,4,7 > "$TOTP_SECRET" \
		|| die "Unable to unseal totp secret"
elif [ "$CONFIG_TPM" = "y" ]; then
	tpm nv_readvalue \
		-in 4d47 \
		-sz 312 \
		-of "$TOTP_SEALED" \
		|| die "Unable to retrieve sealed file from TPM NV"

	tpm unsealfile  \
		-hk 40000000 \
		-if "$TOTP_SEALED" \
		-of "$TOTP_SECRET" \
		|| die "Unable to unseal totp secret"
fi

shred -n 10 -z -u "$TOTP_SEALED" 2> /dev/null

if ! totp -q < "$TOTP_SECRET"; then
	shred -n 10 -z -u "$TOTP_SECRET" 2> /dev/null
	die 'Unable to compute TOTP hash?'
fi

shred -n 10 -z -u "$TOTP_SECRET" 2> /dev/null
exit 0
Add dual support for real bash and busybox's bash(ash) - modify bash to have it configured with -Os 2023-02-08 21:01:48 +00:00			`#!/bin/bash`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 10:49:39 +00:00			`# Retrieve the sealed file from the NVRAM, unseal it and compute the totp`

			`. /etc/functions`

			`TOTP_SEALED="/tmp/secret/totp.sealed"`
			`TOTP_SECRET="/tmp/secret/totp.key"`

Add TRACE function tracing function to output on console when enabled - Add TRACE function tracing output under etc/functions, depending on CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT enabled in board configs - Replace current DEBUG to TRACE calls in code, reserving DEBUG calls for more verbose debugging later on (output of variables etc) - add 'export CONFIG_ENABLE_FUNCTION_TRACING_OUTPUT=y' in qemu-coreboot(fb)whiptail-tpm1(-hotp) boards to see it in action 2023-02-20 16:01:17 +00:00			`TRACE "Under /bin/unseal-totp"`
All scripts and functions: Add DEBUG calling trace on console when CONFIG_DEBUG_OUTPUT is exported in board config -qemu-coreboot-*whiptail-tpm1(-hotp) boards have 'export CONFIG_DEBUG_OUTPUT=y' by default now 2023-02-18 17:58:43 +00:00
tpm2-tools: Change sense of CONFIG_TPM to mean any TPM, not just TPM1. Most logic throughout Heads doesn't need to know TPM1 versus TPM2 (and shouldn't, the differences should be localized). Some checks were incorrect and are fixed by this change. Most checks are now unchanged relative to master. There are not that many places outside of tpmr that need to differentiate TPM1 and TPM2. Some of those are duplicate code that should be consolidated (seal-hotpkey, unseal-totp, unseal-hotp), and some more are probably good candidates for abstracting in tpmr so the business logic doesn't have to know TPM1 vs. TPM2. Previously, CONFIG_TPM could be variously 'y', 'n', or empty. Now it is always 'y' or 'n', and 'y' means "any TPM". Board configs are unchanged, setting CONFIG_TPM2_TOOLS=y implies CONFIG_TPM=y so this doesn't have to be duplicated and can't be mistakenly mismatched. There were a few checks for CONFIG_TPM = n that only coincidentally worked for TPM2 because CONFIG_TPM was empty (not 'n'). This test is now OK, but the checks were also cleaned up to '!= "y"' for robustness. Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm> 2023-02-22 21:30:07 +00:00			`if [ "$CONFIG_TPM2_TOOLS" = "y" ]; then`
			`tpmr unseal 0x81004d47 sha256:0,1,2,3,4,7 > "$TOTP_SECRET" \`
			`\|\| die "Unable to unseal totp secret"`
			`elif [ "$CONFIG_TPM" = "y" ]; then`
Addition of qemu-(fb)whiptail-tpm2(-hotp) boards -coreboot support of TPM v2.0 (shared config for TPM2 support across all 4 previous variations) -swtpm set to be launched under TPM v2.0 mode under board config -Documentation file under each board.md softlinks to qemu-coreboot-fbwhiptail-tpm1.md (which has been generalized) This is skeleton for TPM v2 integration under Heads ------------- WiP TODO: - libcurl cannot be built as a tpm2-tools dependency as of now not sure why. curl currently needs to be added in board config to be built - Note: tpm-reset (master and here) needs some review, no handle of no tpm use case. Caller is responsible to not call it otherwise does nothing - init tries to bind fd and fails currently - Note: Check if whiptail is different of fbwhiptail in clearing screen. As of now every clear seems to be removed, still whiptail clears previous console output - When no OS' /boot can be mounted, do not try to TPM reset (will fail) - seal-hotpkey is not working properly - setting disk unlock key asks for TPM ownership passphrase (sealing in NV requires ownership, but text is misleading user as if reowning TPM) - We should cache input, feed tpm behind the scene and wipe passphrase and state clearly that this is TPM disk unlock kye passphrase. - primary key from TPM2 is invalid most of the time from kexec-select-boot and verifying global hashes but is setuped correctly at disk unlock key setup - would be nice to take advantage of bash function tracing to understand where we are for debugging purposes, code takes ash in consideration only - tpmr says it implements nv calls but actually doesn't. Removing those falsely wrapped functions would help. - Implementing them would be better - REVIEW TODOS IN CODE - READD CIRCLECI CONFIG Current state: - TPM unseal works without disk unlock key and generates TOTP properly (was missing die condition at unseal to not produce always good TOTP even if invalid) - TPM disk encryption key fails. Hypothesis is that sealing with USB drivers loaded and measures in inconsistent with sealed with/without. - TPM disk unsealing happens without USB modules being loaded in non-HOTP setup. This fails. - Current tests are with fbwhiptail (no clear called so having traces on command line of what happens) - Testing with HOTP implementation for sealing/unsealing since that forces USB module loads on each boot to remove this from failing possibilities 2022-08-25 18:43:31 +00:00			`tpm nv_readvalue \`
			`-in 4d47 \`
			`-sz 312 \`
			`-of "$TOTP_SEALED" \`
			`\|\| die "Unable to retrieve sealed file from TPM NV"`

			`tpm unsealfile \`
			`-hk 40000000 \`
			`-if "$TOTP_SEALED" \`
			`-of "$TOTP_SECRET" \`
			`\|\| die "Unable to unseal totp secret"`
			`fi`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 10:49:39 +00:00
supress errors on console when files don't exist (equivalent of rm -f) 2019-02-22 01:16:02 +00:00			`shred -n 10 -z -u "$TOTP_SEALED" 2> /dev/null`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 10:49:39 +00:00
print and update the timestamp on the TOTP while waiting for disk unlock code 2017-04-12 12:28:31 +00:00			`if ! totp -q < "$TOTP_SECRET"; then`
supress errors on console when files don't exist (equivalent of rm -f) 2019-02-22 01:16:02 +00:00			`shred -n 10 -z -u "$TOTP_SECRET" 2> /dev/null`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 10:49:39 +00:00			`die 'Unable to compute TOTP hash?'`
			`fi`

supress errors on console when files don't exist (equivalent of rm -f) 2019-02-22 01:16:02 +00:00			`shred -n 10 -z -u "$TOTP_SECRET" 2> /dev/null`
import the seal/unseal totp scripts since they are very specialized to the heads install, skip owner password if not required (issue #151) 2017-04-12 10:49:39 +00:00			`exit 0`