Commit Graph

1929 Commits

Author SHA1 Message Date
tlaurion
2995376cda
Merge pull request #1339 from tlaurion/single_talos_2_board
Talos II - Have single board config
2023-03-20 14:46:38 -04:00
tlaurion
96440b928a
Merge pull request #1342 from tlaurion/qemu-coreboot-whiptail-tpm2-hotp_adds-hotp
qemu-coreboot-whiptail-tpm2-hotp : add missing HOTP board requirements
2023-03-14 12:53:58 -04:00
Thierry Laurion
718520fe5e
qemu-coreboot-whiptail-tpm2-hotp : add missing HOTP board requirements 2023-03-14 11:39:47 -04:00
tlaurion
6ee4b1cbe1
Merge pull request #1341 from tlaurion/fix_kexec-save-default_initrd_removal
ikexec-save-default: fix case when no crypttab found in initrd
2023-03-14 10:54:16 -04:00
Thierry Laurion
ab16b3b26f
ikexec-save-default: fix case when no crypttab found in initrd
- /tmp/initrd_extract was attempted to be deleted while under that directory when no crypptab found.
- changing of directory to / is non-conditional prior of deletion: move to cleaning step
- Clarity on message displayed to user when a generic crypttab will be generated in case of no OS override
2023-03-14 10:42:21 -04:00
tlaurion
d24def4b59
Merge pull request #1292 from tlaurion/tpm2_retry
TPM2/TPM1 support (testing and bug fixes needed through qemu-(fb)whiptail-tpm[1,2](-hotp) testing boards!
2023-03-13 16:22:13 -04:00
Thierry Laurion
445ca053fb
Talos II - Have single board config
- Based on initial server board
- Uses whiptail as opposed to fbwhiptail (was slow and output fuzzy)
 - Simple fix to have dual KVM(BMC) and vga output for consoles

Reasoning for dropping fbwhiptail support is that:
- it is impossible to output framebuffer content through remote BMC console.
- A workstation board config could output to fbwhiptail for VGA and give remote recovery shell access through BMC
  - If someone shows interest for that, qemu-coreboot-tpm boards can be used as reference.
  - slowness/fuzzyness of fbwhiptail output through AST would still need to be fixed in kernel drivers. Not a priority here.

Limitation:
- Since whiptail is sent to both consoles:
 - If one console goes to recovery shell, recovery shell access invalidate TPM PCR4 measurements.
   - The other console won't be aware that TPM measurements were invalidated, and will consequently:
     - not be able to unseal TOTP if refreshed
     - not be able to unseal TPM disk unlock key on default boot
   - A reboot will fix this.
2023-03-13 14:33:03 -04:00
Jonathon Hall
4754a754dc
.circleci/config.yml: Add qemu TPM2 representative board
No other TPM2 boards exist yet, so add a qemu TPM2 board as a build
test for TPM2.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 14:26:25 -04:00
Jonathon Hall
6a9e7e293e
fstab, init: Remove securityfs mount
This is unused, remove it.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 14:11:02 -04:00
Jonathon Hall
1f8c88a7eb
gui-init, tpm-reset: Enforce TPM password maximum length
TPM password must be 1-32 characters.  Loop if the password is not
valid or the repeated password doesn't match, so the user can try
again.

Move prompt_new_owner_password to functions and use in both gui-init
and tpm-reset.

Fixes #1336

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:34:40 -04:00
Jonathon Hall
30963e121f
Combine t430-flash.init, x23-flash.init, fix insmod
They're the same other than a TRACE, combine them.  Use busybox
insmod since the insmod script uses bash, we don't need the TPM PCRs on
legacy-flash-boards.

Remove PCR4 extend, these boards lack TPM configuration.  Update ROM
example name.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:23:29 -04:00
Jonathon Hall
ea5b8dc30f
tpmr: Provide startsession for TPM1 and TPM2
It's a no-op on TPM1, but provide it so init doesn't have to
distinguish TPM1/TPM2.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 13:10:24 -04:00
Jonathon Hall
5c33130ddc
init: Fixes for legacy-flash boards
Fix `[ -a` to POSIX `[ -e`.  Only run cbfs-init, key-init on normal
boards with bash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:52:06 -04:00
Jonathon Hall
0c4fdf343b
poweroff, reboot: Do not use bash
These need to work on legacy-flash boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:51:42 -04:00
Jonathon Hall
0760b6f237
init: Use busybox ash
init must use busybox ash because it is used on legacy-flash boards.
Change shebang, move needed functions to ash_functions.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-13 12:26:41 -04:00
Jonathon Hall
55b3fcfe1a
tpmr: Use at_exit for cleanup traps
Multiple traps overwrite each other.  While no tpmr functions have more
than one trap right now, it is fragile, and the quoting is complex due
to double expansion.  Use at_exit to add exit handlers that accumulate
and do not require special quoting.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 17:50:43 -05:00
Jonathon Hall
decd45f361
openssl: Trim optional algorithms
Disable all optional algorithms except SM3.  (SHA and AES are not
optional.)  tpm2-tss uses SHA, AES, and SM3.  Reduces size of libcrypto
by almost 1 MB, saves about 140 KB in ROM.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 17:07:00 -05:00
Jonathon Hall
b21d8f7a94
oem-factory-reset: Use tpmr reset
tpm-reset is just a prompt for the password followed by tpmr reset.
oem-factory-reset already bypasses the prompt, just call tpmr reset
directly.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:46:01 -05:00
Jonathon Hall
ff481b98fb
gui-init: Fix spelling of generate_totp_hotp()
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:42:19 -05:00
Jonathon Hall
a0272270fe
gui-init, kexec-unseal-key: Move PCR debugging output to DEBUG calls
These were still writing some debugging output containing flags and
PCRs even when debug was not enabled.  Use DEBUG.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:39:54 -05:00
Jonathon Hall
698fc83046
gui-init: Eliminate extra TPM owner password prompts in TPM reset
We just set the TPM owner password, so there's no need to make the user
enter it again.  Eliminates some failure modes if the user mistypes it
or enters the wrong password.

Allow optionally passing in the TPM owner password in tpmr seal,
check_tpm_counter(), seal-totp, and generate_totp_htop().  The user is
still prompted if the password is needed but was not provided, so
existing uses in other contexts continue to work unchanged.

Prompt for the password in reset_tpm() and pass it down to each of the
above.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:36:24 -05:00
Jonathon Hall
48421ada1e
tpmtotp: Update to osresearch merged commit
osresearch has merged support for tpm pcrread.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:09:46 -05:00
Jonathon Hall
9d34dd6687
tpmr: Apply owner password to endorsement hierarchy
Heads doesn't use the endorsement hierarchy, but we shouldn't leave it
with an empty password following a tpm2 clear.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:09:09 -05:00
Jonathon Hall
67f3ac5103
tpmr: Provide reset for both TPM1 and TPM2
tpmr reset now works for both TPM1 and TPM2; bring in TPM1 logic from
tpm-reset.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 15:07:44 -05:00
Jonathon Hall
a2e4392497
tpmr: Do not hash sealing passwords, always pass passwords as hex
Don't hash password used to seal an object.  This limits the password
to 32-characters but avoids obfuscating the usage of the password.  The
32-character limit is considered acceptable because password limits are
lower already (GPG token limits to 25 chars).  We may allow >32 char
passwords in the future by hashing only if the password is >32 chars.

Always pass passwords as hex to tpm2-tools to avoid possible ambiguity
if the password begins with a control prefix like 'hex:' or 'file:'.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 14:46:34 -05:00
Jonathon Hall
298cde26ab
tpmr: Set dictionary lockout parameters and auth when resetting TPM2
Set consistent dictionary lockout parameters suited to Heads.  Disable
lockout reset by setting a random password.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-10 12:25:08 -05:00
Thierry Laurion
536f4a1623
Small cosmetic/typo related changes, ccache enablement for coreboot and reduction of unseal attempts
gui-init: do not consume two unseal attempt to unseal both totp and hotp + cosmetic changes (slow down TPM DA lockout)
kexec-seal-key: Add DEBUG statement for PCR precalc
seal-totp: add DEBUG statements regarding skipping of PCR5 and PCR6 involvement into TOTP/HOTP sealing ops
seal-hotpkey: Add DEBUG statements related to reuse of TOTP sealed secret
tpmr: add DO_WITH_DEBUG calls to output pcrread and extend calls
tpmr: typo correction stating TRACE calls for tpm2 where it was for tpm1
tpmr: add DO_WITH_DEBUG calls for calcfuturepcr
functions: Cosmetic fix on pause_recovery asking user to press Enter to go to recovery shell on host console when board defines CONFIG_BOOT_RECOVERY_SERIAL

Not so related but part of output review and corrections:
kexec-insert-key: cosmetic changes prepending "+++" to disk related changes
kexec-save-default: cosmetic changes prepending "+++" to disk related changes
config/coreboot-qemu-tpm*.config: add ccache support for faster coreboot rebuild times
2023-03-10 12:11:57 -05:00
tlaurion
6300e30504
Merge pull request #1333 from tlaurion/flashtools_version_bump_to_master
modules/flashtools : version bump back to osresearch/flashtools
2023-03-10 09:47:59 -05:00
Thierry Laurion
dcf65ea892
modules/flashtools : version bump back to osresearch/flashtools
Changes to support ppc64 were merged upstream
2023-03-10 09:31:22 -05:00
Jonathon Hall
77060b0031
tpmr: Delete outdated TODO in tpm2_seal
The sealing password is now hashed, so there's no length limit.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:18:11 -05:00
Jonathon Hall
733fea8e2d
tpmr: Add TRACE to cleanup functions
Add TRACE to cleanup_shred, cleanup_session

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:17:01 -05:00
Jonathon Hall
ebabcffbdc
tpmr: Use existing HMAC session in tpm2_unseal
We already have HMAC sessions for encryption and decryption, there's no
need to create an ad-hoc session in tpm2_unseal.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:07:00 -05:00
Jonathon Hall
8d834f649d
tpmr: Add missing traces to tpm2_kexec_finalize, tpm2_shutdown
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 17:06:31 -05:00
Jonathon Hall
c62b96b4a6
tpmr: Move tpm1_unseal next to tpm2_unseal
All the other tpm2/tpm1 corresponding wrappers are next to each other,
do the same for unseal.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:44:47 -05:00
Jonathon Hall
d88fcca2f2
kexec-seal-key, seal-totp: Silence dd status when setting up PCRs
Add status=none to dd invocations building PCR data.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:42:19 -05:00
Jonathon Hall
50daa904f9
tpmr: Capture TPM2 pcaps in qemu TPM2 boards
tpm2-tools is able to log pcap files of TPM2 commands, which can be
inspected with wireshark.  Add CONFIG_TPM2_CAPTURE_PCAP to capture
these from the tpmr wrapper, and enable for qemu TPM2 boards.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:34:45 -05:00
Jonathon Hall
215ff2a397
reboot, poweroff: Prepare TPM2 for shutdown
TPM2 must be prepared for shutdown, or it may track an auth failure for
dictionary attack prevention (per the spec, to prevent an attack by
attempting to authenticate and then powering off the TPM before it can
update the nonvolatile counter).

Add tpmr shutdown to prepare for shutdown (no-op on TPM1).  Invoke it
from poweroff and reboot.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:20:21 -05:00
Jonathon Hall
c7d0f7969e
kexec-seal-key: Fix masked parameter position in tpmr seal
The password was moved to parameter 7 in an earlier commit.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 16:19:37 -05:00
Jonathon Hall
7b8824adf1
seal-totp, kexec-seal-key: Use common logic for TPM1 and TPM2
Provide tpmr commands pcrread, pcrsize, calcfuturepcr, and seal for
both TPM1 and TPM2.

Combine seal logic for TPM1/TPM2 in seal-totp, kexec-seal-key.  This is
essentially the TPM2 logic now that tpmr provides the same wrapped
commands for both TPM1 and TPM2.

Remove algorithm prefix from PCR list in tpmr unseal for consistency
with tpmr seal.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:57 -05:00
Jonathon Hall
e2c2f2d4e0
tpmtotp: Update to branch including tpm pcrread
Update to branch including tpm pcrread until it is merged upstream. tpm
pcrread allows us to use the same logical flow for TPM1 and TPM2 in
seal operations.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:56 -05:00
Jonathon Hall
641bea4d46
tpmr: Don't add newline when extending PCR with literal data
tpmr extend with -ic (extend with literal data) was adding a newline,
use echo -n so it only includes the data given in the hash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:56 -05:00
Jonathon Hall
809b55666b
kexec-seal-key: Clean up TODOs and TPM2 seal
Clean up TODO comments.

Clean up redirections for tpm2 pcrread, use bash redirect to command.

Use DO_WITH_DEBUG --mask-position to trace tpmr seal for TPM2 and hide
the password.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:56 -05:00
Jonathon Hall
719dc57970
init: Always create symlinks for bash
No need to test whether bash is a symlink, bash ships on all boards
using the normal init script now.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:55 -05:00
Jonathon Hall
5588a47d56
modules/openssl: Update to 3.0.8, reduce size
Update OpenSSL to 3.0.8.  Build with -Os.  Install only libcrypto,
libssl is not currently needed.  Don't buid tests.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:55 -05:00
Jonathon Hall
92a6b5410d
tpmr: Improve debug output, hide secrets, trim extend output more
Provide mask_param() function to uniformly mask secret parameters,
while still indicating whether they are empty.

Extend DO_WITH_DEBUG to allow masking a password parameter by position,
using mask_param().  Move from ash_functions to functions (isn't used
by ash scripts).

Mask password parameters in kexec-unseal-key and tpmr seal.  Use
mask_param() on existing masked params in tpmr.

Trim more troubleshooting output from tpm2_extend() in tpmr.

Clarify tpmr kexec_finalize echo; it's the TPM's platform heirarchy,
users might not know what this was referring to.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:55 -05:00
Jonathon Hall
93459563d0
tpmr: Delete unimplemented nvram commands
nv_definespace, nv_writevalue, and nv_readvalue were never actually
implemented, remove them.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:54 -05:00
Jonathon Hall
7afb1e474f
tpmr: Provide HMAC session when unsealing with policy
Provide an HMAC session to tpm2 when unsealing with an auth policy.
The HMAC session is used for transport encryption.

This allows transport encryption to work when unsealing.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:54 -05:00
Jonathon Hall
58c0b7c979
tpmr: Remove PCR debug dump, silence nonsense unseal errors for new TPM
Remove dump of all PCRs from tpm2_extend, it was causing other errors
to roll off the screen before they could be inspected, and it's no
longer needed now that TPM2 is working.

Silence nonsense errors from unseal if TPM2 hasn't been reset.  tpm2 -S
with a file that doesn't exist would complain that the parameter format
was not understood (looks like a script error), when the actual problem
was that the file doesn't exist yet.  We can't try to unseal anyway
without a primary handle, so just exit unsuccessfully in that case.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:54 -05:00
Jonathon Hall
b5985fef03
kexec-seal-key: Reset PCR 23 before precomputing with it
Precomputation relies on PCR 23 being 0 initially, so reset it in case
it isn't.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:53 -05:00
Jonathon Hall
eda24d85bf
*-flash.init: Use busybox ash
Busybox no longer has CONFIG_BASH since we are deploying bash on most
boards.  We also should clearly indicate which scripts cannot use
bashisms.

Change shebang in x230-flash.init, t430-flash.init, flash.sh to
/bin/ash.  Execute /bin/sh for interactive shells.

Move key functions needed by those scripts to initrd/etc/ash_functions.
Source ash_functions instead of functions in those scripts, so any
bashisms in other functions won't break parsing of the script in ash.

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2023-03-08 12:45:53 -05:00