Merge ~sylvain-pineau/plainbox-provider-tpm2:clevis-jobs into plainbox-provider-tpm2:master

[Sylvain Pineau]

App-level tests using clevis

[Sylvain Pineau (sylvain-pineau)]

--------------[ Running job 3 / 6. Estimated time left: unknown ]---------------
----------------------[ clevis encrypt/decrypt precheck ]-----------------------
ID: com.canonical.certification::clevis-encrypt-tpm2/precheck
Category: com.canonical.certification::tpm2
... 8< -------------------------------------------------------------------------
------------------------------------------------------------------------- >8 ---
Outcome: job passed
--------------[ Running job 4 / 6. Estimated time left: unknown ]---------------
----------------[ tpm2 capabilities (algorithms and pcr banks) ]----------------
ID: com.canonical.certification::tpm2_cap
Category: com.canonical.certification::tpm2
... 8< -------------------------------------------------------------------------
assymetric: ecc ecc224 ecc256 rsa rsa1024 rsa2048
symmetric: aes aes128 aes192 aes256 symcipher
hash: sha1 sha256
keyed_hash: hmac keyedhash xor
mask_generation_functions: mgf1
signature_schemes: ecdaa ecdsa ecschnorr rsapss rsassa
assymetric_encryption_scheme: ecdh oaep rsaes
key_derivation_functions: kdf1_sp800_108 kdf1_sp800_56a
aes_modes: cbc cfb ctr ecb ofb
pcr_banks: sha1 sha256
------------------------------------------------------------------------- >8 ---
Outcome: job passed
--------------[ Running job 5 / 6. Estimated time left: unknown ]---------------
-----------------------[ clevis encrypt/decrypt key rsa ]-----------------------
ID: com.canonical.certification::clevis-encrypt-tpm2/rsa
Category: com.canonical.certification::tpm2
... 8< -------------------------------------------------------------------------
hello world
------------------------------------------------------------------------- >8 ---
Outcome: job passed
--------------[ Running job 6 / 6. Estimated time left: unknown ]---------------
-----------------------[ clevis encrypt/decrypt key ecc ]-----------------------
ID: com.canonical.certification::clevis-encrypt-tpm2/ecc
Category: com.canonical.certification::tpm2
... 8< -------------------------------------------------------------------------
hello world
------------------------------------------------------------------------- >8 ---
Outcome: job passed
 ☑ : Hardware Manifest
 ☑ : Enumerate available system executables
 ☑ : clevis encrypt/decrypt precheck
 ☑ : tpm2 capabilities (algorithms and pcr banks)
 ☑ : clevis encrypt/decrypt key rsa
 ☑ : clevis encrypt/decrypt key ecc

[Jonathan Cave (jocave)]

Thanks for the effort going through the specs on this one. Looks really clean and gives us something much more like a realistic use-case.

Good to land as it. Some small improvements might be more verbosity in the tests, which might seem like overkill given they are one-liners, but I think it's reassuring to seem what might is going on.

review: Approve

[Sylvain Pineau (sylvain-pineau)]

One last commit to process larger strings (random strings) and some info msg

review: Needs Resubmitting

[Sylvain Pineau (sylvain-pineau)]

-----------------------[ clevis encrypt/decrypt key rsa ]-----------------------
ID: com.canonical.certification::clevis-encrypt-tpm2/rsa
Category: com.canonical.certification::tpm2
... 8< -------------------------------------------------------------------------
+ Generate a random string
+ Encrypt and decrypt the string using the TPM
+ Compare with the original string
------------------------------------------------------------------------- >8 ---
Outcome: job passed
--------------[ Running job 6 / 6. Estimated time left: unknown ]---------------
-----------------------[ clevis encrypt/decrypt key ecc ]-----------------------
ID: com.canonical.certification::clevis-encrypt-tpm2/ecc
Category: com.canonical.certification::tpm2
... 8< -------------------------------------------------------------------------
+ Generate a random string
+ Encrypt and decrypt the string using the TPM
+ Compare with the original string
------------------------------------------------------------------------- >8 ---
Outcome: job passed

[Jonathan Cave (jocave)]

Nice, thank you

review: Approve

diff --git a/bin/tpm2_capabilities.py b/bin/tpm2_capabilities.py
new file mode 100755
index 0000000..52e4e2f
--- /dev/null
+++ b/bin/tpm2_capabilities.py
@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+
+import yaml
+import subprocess
+
+
+# From TCG Algorithm Registry: Definition of TPM2_ALG_ID Constants
+# https://trustedcomputinggroup.org/wp-content/uploads/TCG-_Algorithm_Registry_r1p32_pub.pdf
+# https://github.com/tpm2-software/tpm2-tools/blob/master/lib/tpm2_alg_util.c
+
+TPM2_ALG_RSA = 0x0001
+TPM2_ALG_TDES = 0x0003
+TPM2_ALG_SHA1 = 0x0004
+TPM2_ALG_HMAC = 0x0005
+TPM2_ALG_AES = 0x0006
+TPM2_ALG_MGF1 = 0x0007
+TPM2_ALG_KEYEDHASH = 0x0008
+TPM2_ALG_XOR = 0x000A
+TPM2_ALG_SHA256 = 0x000B
+TPM2_ALG_SHA384 = 0x000C
+TPM2_ALG_SHA512 = 0x000D
+TPM2_ALG_NULL = 0x0010
+TPM2_ALG_SM3_256 = 0x0012
+TPM2_ALG_SM4 = 0x0013
+TPM2_ALG_RSASSA = 0x0014
+TPM2_ALG_RSAES = 0x0015
+TPM2_ALG_RSAPSS = 0x0016
+TPM2_ALG_OAEP = 0x0017
+TPM2_ALG_ECDSA = 0x0018
+TPM2_ALG_ECDH = 0x0019
+TPM2_ALG_ECDAA = 0x001A
+TPM2_ALG_SM2 = 0x001B
+TPM2_ALG_ECSCHNORR = 0x001C
+TPM2_ALG_ECMQV = 0x001D
+TPM2_ALG_KDF1_SP800_56A = 0x0020
+TPM2_ALG_KDF2 = 0x0021
+TPM2_ALG_KDF1_SP800_108 = 0x0022
+TPM2_ALG_ECC = 0x0023
+TPM2_ALG_SYMCIPHER = 0x0025
+TPM2_ALG_CAMELLIA = 0x0026
+TPM2_ALG_CMAC = 0x003F
+TPM2_ALG_CTR = 0x0040
+TPM2_ALG_SHA3_256 = 0x0027
+TPM2_ALG_SHA3_384 = 0x0028
+TPM2_ALG_SHA3_512 = 0x0029
+TPM2_ALG_OFB = 0x0041
+TPM2_ALG_CBC = 0x0042
+TPM2_ALG_CFB = 0x0043
+TPM2_ALG_ECB = 0x0044
+
+# Mandatory algorithms
+# https://trustedcomputinggroup.org/wp-content/uploads/PC-Client-Specific-Platform-TPM-Profile-for-TPM-2p0-v1p05p_r14_pub.pdf
+# Mandatory algorithms for PCRs are defined in Section 4.6
+
+# TPM2_ALG_RSA
+# TPM2_ALG_SHA1
+# TPM2_ALG_HMAC
+# TPM2_ALG_AES
+# TPM2_ALG_MGF1
+# TPM2_ALG_KEYEDHASH
+# TPM2_ALG_XOR
+# TPM2_ALG_SHA256
+# TPM2_ALG_SHA384
+# TPM2_ALG_RSASSA
+# TPM2_ALG_RSAES
+# TPM2_ALG_RSAPSS
+# TPM2_ALG_OAEP
+# TPM2_ALG_ECDSA
+# TPM2_ALG_ECDH
+# TPM2_ALG_ECC
+# TPM2_ALG_SYMCIPHER
+
+TPM2_CAP = {
+    'assymetric': set(),
+    'symmetric': set(),
+    'hash': set(),
+    'keyed_hash': set(),
+    'mask_generation_functions': set(),
+    'signature_schemes': set(),
+    'assymetric_encryption_scheme': set(),
+    'key_derivation_functions': set(),
+    'aes_modes': set(),
+    'pcr_banks': set(),
+}
+
+try:
+    algs_caps = subprocess.check_output(['tpm2_getcap', 'algorithms'])
+    pcrs_caps = subprocess.check_output(['tpm2_getcap', 'pcrs'])
+except subprocess.CalledProcessError:
+    raise SystemExit
+
+algs_list = yaml.load(algs_caps, Loader=yaml.FullLoader)
+pcrs_list = yaml.load(pcrs_caps, Loader=yaml.FullLoader)
+
+for alg, prop in algs_list.items():
+    # Assymetric
+    if prop['value'] in (TPM2_ALG_RSA, TPM2_ALG_ECC):
+        TPM2_CAP['assymetric'].add(alg)
+
+    # Symmetric
+    if prop['value'] in (
+        TPM2_ALG_TDES, TPM2_ALG_AES, TPM2_ALG_CAMELLIA, TPM2_ALG_SYMCIPHER
+    ):
+        TPM2_CAP['symmetric'].add(alg)
+
+    # Hash
+    if prop['value'] in (
+        TPM2_ALG_SHA1, TPM2_ALG_SHA256, TPM2_ALG_SHA384, TPM2_ALG_SHA512,
+        TPM2_ALG_SM3_256, TPM2_ALG_SHA3_256, TPM2_ALG_SHA3_384,
+        TPM2_ALG_SHA3_512
+    ):
+        TPM2_CAP['hash'].add(alg)
+
+    # Keyed hash
+    if prop['value'] in (
+        TPM2_ALG_HMAC, TPM2_ALG_XOR, TPM2_ALG_CMAC, TPM2_ALG_KEYEDHASH
+    ):
+        TPM2_CAP['keyed_hash'].add(alg)
+
+    # Mask Generation Functions
+    if prop['value'] in (TPM2_ALG_MGF1,):
+        TPM2_CAP['mask_generation_functions'].add(alg)
+
+    # Signature Schemes
+    if prop['value'] in (
+        TPM2_ALG_RSASSA, TPM2_ALG_RSAPSS, TPM2_ALG_ECDSA, TPM2_ALG_ECDAA,
+        TPM2_ALG_ECSCHNORR, TPM2_ALG_SM2, TPM2_ALG_SM4
+    ):
+        TPM2_CAP['signature_schemes'].add(alg)
+
+    # Assymetric Encryption Scheme
+    if prop['value'] in (TPM2_ALG_OAEP, TPM2_ALG_RSAES, TPM2_ALG_ECDH):
+        TPM2_CAP['assymetric_encryption_scheme'].add(alg)
+
+    # Key derivation functions
+    if prop['value'] in (
+        TPM2_ALG_KDF1_SP800_56A, TPM2_ALG_KDF2, TPM2_ALG_KDF1_SP800_108,
+        TPM2_ALG_ECMQV
+    ):
+        TPM2_CAP['key_derivation_functions'].add(alg)
+
+    # AES Modes
+    if prop['value'] in (
+        TPM2_ALG_CTR, TPM2_ALG_OFB, TPM2_ALG_CBC, TPM2_ALG_CFB, TPM2_ALG_ECB
+    ):
+        TPM2_CAP['aes_modes'].add(alg)
+
+if 'aes' in TPM2_CAP['symmetric']:
+    for alg_type in ('aes', 'aes128', 'aes192', 'aes256'):
+        try:
+            subprocess.check_call(
+                ['tpm2_testparms', alg_type], stderr=subprocess.DEVNULL)
+            TPM2_CAP['symmetric'].add(alg_type)
+        except subprocess.CalledProcessError:
+            try:
+                TPM2_CAP['symmetric'].remove(alg_type)
+            except KeyError:
+                pass
+
+if 'ecc' in TPM2_CAP['assymetric']:
+    for alg_type in ('ecc', 'ecc192', 'ecc224', 'ecc256', 'ecc384', 'ecc521'):
+        try:
+            subprocess.check_call(
+                ['tpm2_testparms', alg_type], stderr=subprocess.DEVNULL)
+            TPM2_CAP['assymetric'].add(alg_type)
+        except subprocess.CalledProcessError:
+            try:
+                TPM2_CAP['assymetric'].remove(alg_type)
+            except KeyError:
+                pass
+
+if 'rsa' in TPM2_CAP['assymetric']:
+    for alg_type in ('rsa', 'rsa1024', 'rsa2048', 'rsa4096'):
+        try:
+            subprocess.check_call(
+                ['tpm2_testparms', alg_type], stderr=subprocess.DEVNULL)
+            TPM2_CAP['assymetric'].add(alg_type)
+        except subprocess.CalledProcessError:
+            try:
+                TPM2_CAP['assymetric'].remove(alg_type)
+            except KeyError:
+                pass
+
+for pcr in pcrs_list['selected-pcrs']:
+    for pcr_bank, pcr_ids in pcr.items():
+        if set(range(24)).issubset(set(pcr_ids)):
+            TPM2_CAP['pcr_banks'].add(pcr_bank)
+
+for k, v in TPM2_CAP.items():
+    print("{}: {}".format(k, ' '.join(sorted(v))))
diff --git a/units/clevis.pxu b/units/clevis.pxu
new file mode 100644
index 0000000..c17ef8e
--- /dev/null
+++ b/units/clevis.pxu
@@ -0,0 +1,68 @@
+# This file is part of Checkbox.
+#
+# Copyright 2021 Canonical Ltd.
+# Written by:
+#   Sylvain Pineau <[e-mail]>
+#
+# Checkbox is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3,
+# as published by the Free Software Foundation.
+#
+# Checkbox is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Checkbox.  If not, see <http://www.gnu.org/licenses/>.
+
+id: clevis-encrypt-tpm2/precheck
+category_id: tpm2
+plugin: shell
+imports: from com.canonical.plainbox import manifest
+requires:
+ manifest.has_tpm2_chip == 'True'
+ executable.name == 'clevis-encrypt-tpm2'
+_summary: clevis encrypt/decrypt precheck
+flags: simple
+command: true
+
+id: clevis-encrypt-tpm2/rsa
+category_id: tpm2
+plugin: shell
+depends: clevis-encrypt-tpm2/precheck
+requires:
+ 'sha256' in tpm2_cap.hash
+ 'sha256' in tpm2_cap.pcr_banks
+ 'rsa' in tpm2_cap.assymetric
+estimated_duration: 30
+_summary: clevis encrypt/decrypt key rsa
+flags: simple fail-on-resource
+user: root
+command:
+ echo "+ Generate a random string"
+ rand=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c32768)
+ echo "+ Encrypt and decrypt the string using the TPM"
+ result=$(echo -n $rand | clevis-encrypt-tpm2 '{"hash": "sha256", "key":"rsa", "pcr_bank":"sha256","pcr_ids":"0,1"}' | clevis-decrypt-tpm2)
+ echo "+ Compare with the original string"
+ [[ $result == $rand ]]
+
+id: clevis-encrypt-tpm2/ecc
+category_id: tpm2
+plugin: shell
+depends: clevis-encrypt-tpm2/precheck
+requires:
+ 'sha256' in tpm2_cap.hash
+ 'sha256' in tpm2_cap.pcr_banks
+ 'ecc' in tpm2_cap.assymetric
+estimated_duration: 30
+_summary: clevis encrypt/decrypt key ecc
+flags: simple fail-on-resource
+user: root
+command:
+ echo "+ Generate a random string"
+ rand=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c32768)
+ echo "+ Encrypt and decrypt the string using the TPM"
+ result=$(echo -n $rand | clevis-encrypt-tpm2 '{"hash": "sha256", "key":"ecc", "pcr_bank":"sha256","pcr_ids":"0,1"}' | clevis-decrypt-tpm2)
+ echo "+ Compare with the original string"
+ [[ $result == $rand ]]
diff --git a/units/packaging.pxu b/units/packaging.pxu
index 8aac195..ffa20fb 100644
--- a/units/packaging.pxu
+++ b/units/packaging.pxu
@@ -10,3 +10,8 @@ unit: packaging meta-data
 os-id: ubuntu
 os-version-id: 20.04
 Depends: libtss2-dev
+
+unit: packaging meta-data
+os-id: ubuntu
+os-version-id: 20.04
+Depends: clevis-tpm2
diff --git a/units/resource.pxu b/units/resource.pxu
index 7487095..f58571a 100644
--- a/units/resource.pxu
+++ b/units/resource.pxu
@@ -36,3 +36,12 @@ command:
      echo tpmrm: unsupported
      echo encryptdecrypt: unsupported
  fi
+
+id: tpm2_cap
+category_id: tpm2
+plugin: resource
+estimated_duration: 1
+_summary: tpm2 capabilities (algorithms and pcr banks)
+user: root
+command:
+ tpm2_capabilities.py
diff --git a/units/test-plan.pxu b/units/test-plan.pxu
index 927a90a..f7d5eb3 100644
--- a/units/test-plan.pxu
+++ b/units/test-plan.pxu
@@ -80,3 +80,15 @@ include:
     tpm2.0_4.1.1/.*
 mandatory_include:
     com.canonical.plainbox::manifest
+
+unit: test plan
+id: clevis-automated
+_name:
+ TPM 2.0 (Trusted Platform Module) Clevis encryption tests
+_description:
+ Clevis encryption tests
+estimated_duration: 1m
+include:
+    clevis.*
+mandatory_include:
+    com.canonical.plainbox::manifest