src/tpmtool.c

   1 /*
   2  * Copyright (C) 2010-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * GnuTLS is free software: you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation, either version 3 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * GnuTLS is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program.  If not, see
  20  * <http://www.gnu.org/licenses/>.
  21  */
  22
  23 #include <config.h>
  24
  25 #include <gnutls/gnutls.h>
  26 #include <gnutls/x509.h>
  27 #include <gnutls/openpgp.h>
  28 #include <gnutls/pkcs12.h>
  29 #include <gnutls/tpm.h>
  30 #include <gnutls/abstract.h>
  31
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <string.h>
  35 #include <ctype.h>
  36 #include <time.h>
  37 #include <unistd.h>
  38 #include <errno.h>
  39 #include <sys/types.h>
  40 #include <sys/stat.h>
  41 #include <fcntl.h>
  42 #include <error.h>
  43
  44 /* Gnulib portability files. */
  45 #include <read-file.h>
  46 #include <progname.h>
  47 #include <version-etc.h>
  48
  49 #include "certtool-common.h"
  50 #include "tpmtool-args.h"
  51
  52 static void cmd_parser (int argc, char **argv);
  53 static void tpm_generate(FILE* outfile, unsigned int key_type, unsigned int bits, unsigned int flags);
  54 static void tpm_pubkey(const char* url, FILE* outfile);
  55 static void tpm_delete(const char* url, FILE* outfile);
  56 static void tpm_list(FILE* outfile);
  57
  58 static gnutls_x509_crt_fmt_t incert_format, outcert_format;
  59 static gnutls_tpmkey_fmt_t inkey_format, outkey_format;
  60
  61 static FILE *outfile;
  62 static FILE *infile;
  63 int batch = 0;
  64
  65 static void
  66 tls_log_func (int level, const char *str)
  67 {
  68   fprintf (stderr, "|<%d>| %s", level, str);
  69 }
  70
  71
  72 int
  73 main (int argc, char **argv)
  74 {
  75   set_program_name (argv[0]);
  76   cmd_parser (argc, argv);
  77
  78   return 0;
  79 }
  80
  81 static void
  82 cmd_parser (int argc, char **argv)
  83 {
  84   int ret, debug = 0;
  85   unsigned int optct;
  86   unsigned int key_type = GNUTLS_PK_UNKNOWN;
  87   unsigned int bits = 0;
  88   unsigned int genflags = 0;
  89   /* Note that the default sec-param is legacy because several TPMs
  90    * cannot handle larger keys.
  91    */
  92   const char* sec_param = "legacy";
  93
  94   optct = optionProcess( &tpmtoolOptions, argc, argv);
  95   argc += optct;
  96   argv += optct;
  97
  98   if (HAVE_OPT(DEBUG))
  99     debug = OPT_VALUE_DEBUG;
 100
 101   if (HAVE_OPT(INDER))
 102     {
 103       incert_format = GNUTLS_X509_FMT_DER;
 104       inkey_format = GNUTLS_TPMKEY_FMT_DER;
 105     }
 106   else
 107     {
 108       incert_format = GNUTLS_X509_FMT_PEM;
 109       inkey_format = GNUTLS_TPMKEY_FMT_CTK_PEM;
 110     }
 111
 112   if (HAVE_OPT(OUTDER))
 113     {
 114       outcert_format = GNUTLS_X509_FMT_DER;
 115       outkey_format = GNUTLS_TPMKEY_FMT_DER;
 116     }
 117   else
 118     {
 119       outcert_format = GNUTLS_X509_FMT_PEM;
 120       outkey_format = GNUTLS_TPMKEY_FMT_CTK_PEM;
 121     }
 122
 123   if (HAVE_OPT(REGISTER))
 124     genflags |= GNUTLS_TPM_REGISTER_KEY;
 125   if (!HAVE_OPT(LEGACY))
 126     genflags |= GNUTLS_TPM_KEY_SIGNING;
 127   if (HAVE_OPT(USER))
 128     genflags |= GNUTLS_TPM_KEY_USER;
 129
 130   gnutls_global_set_log_function (tls_log_func);
 131   gnutls_global_set_log_level (debug);
 132   if (debug > 1)
 133     printf ("Setting log level to %d\n", debug);
 134
 135   if ((ret = gnutls_global_init ()) < 0)
 136     error (EXIT_FAILURE, 0, "global_init: %s", gnutls_strerror (ret));
 137
 138   if (HAVE_OPT(OUTFILE))
 139     {
 140       outfile = safe_open_rw (OPT_ARG(OUTFILE), 0);
 141       if (outfile == NULL)
 142         error (EXIT_FAILURE, errno, "%s", OPT_ARG(OUTFILE));
 143     }
 144   else
 145     outfile = stdout;
 146
 147   if (HAVE_OPT(INFILE))
 148     {
 149       infile = fopen (OPT_ARG(INFILE), "rb");
 150       if (infile == NULL)
 151         error (EXIT_FAILURE, errno, "%s", OPT_ARG(INFILE));
 152     }
 153   else
 154     infile = stdin;
 155
 156   if (HAVE_OPT(SEC_PARAM))
 157     sec_param = OPT_ARG(SEC_PARAM);
 158   if (HAVE_OPT(BITS))
 159     bits = OPT_VALUE_BITS;
 160
 161
 162   if (HAVE_OPT(GENERATE_RSA))
 163     {
 164       key_type = GNUTLS_PK_RSA;
 165       bits = get_bits (key_type, bits, sec_param);
 166       tpm_generate (outfile, key_type, bits, genflags);
 167     }
 168   else if (HAVE_OPT(PUBKEY))
 169     {
 170       tpm_pubkey (OPT_ARG(PUBKEY), outfile);
 171     }
 172   else if (HAVE_OPT(DELETE))
 173     {
 174       tpm_delete (OPT_ARG(DELETE), outfile);
 175     }
 176   else if (HAVE_OPT(LIST))
 177     {
 178       tpm_list (outfile);
 179     }
 180   else
 181     {
 182       USAGE(1);
 183     }
 184
 185   fclose (outfile);
 186
 187   gnutls_global_deinit ();
 188 }
 189
 190 static void tpm_generate(FILE* outfile, unsigned int key_type, unsigned int bits, unsigned int flags)
 191 {
 192   int ret;
 193   char* srk_pass, *key_pass = NULL;
 194   gnutls_datum_t privkey, pubkey;
 195
 196   srk_pass = getpass ("Enter SRK password: ");
 197   if (srk_pass != NULL)
 198     srk_pass = strdup(srk_pass);
 199
 200   if (!(flags & GNUTLS_TPM_REGISTER_KEY))
 201     {
 202       key_pass = getpass ("Enter key password: ");
 203       if (key_pass != NULL)
 204         key_pass = strdup(srk_pass);
 205     }
 206
 207   ret = gnutls_tpm_privkey_generate(key_type, bits, srk_pass, key_pass,
 208                                     outkey_format, outcert_format,
 209                                     &privkey, &pubkey,
 210                                     flags);
 211
 212   free(key_pass);
 213   free(srk_pass);
 214
 215   if (ret < 0)
 216     error (EXIT_FAILURE, 0, "gnutls_tpm_privkey_generate: %s", gnutls_strerror (ret));
 217
 218 /*  fwrite (pubkey.data, 1, pubkey.size, outfile);
 219   fputs ("\n", outfile);*/
 220   fwrite (privkey.data, 1, privkey.size, outfile);
 221   fputs ("\n", outfile);
 222
 223   gnutls_free(privkey.data);
 224   gnutls_free(pubkey.data);
 225 }
 226
 227 static void tpm_delete(const char* url, FILE* outfile)
 228 {
 229   int ret;
 230   char* srk_pass;
 231
 232   srk_pass = getpass ("Enter SRK password: ");
 233
 234   ret = gnutls_tpm_privkey_delete(url, srk_pass);
 235   if (ret < 0)
 236     error (EXIT_FAILURE, 0, "gnutls_tpm_privkey_delete: %s", gnutls_strerror (ret));
 237
 238   fprintf (outfile, "Key %s deleted\n", url);
 239 }
 240
 241 static void tpm_list(FILE* outfile)
 242 {
 243   int ret;
 244   gnutls_tpm_key_list_t list;
 245   unsigned int i;
 246   char* url;
 247
 248   ret = gnutls_tpm_get_registered (&list);
 249   if (ret < 0)
 250     error (EXIT_FAILURE, 0, "gnutls_tpm_get_registered: %s", gnutls_strerror (ret));
 251
 252   fprintf(outfile, "Available keys:\n");
 253   for (i=0;;i++)
 254     {
 255       ret = gnutls_tpm_key_list_get_url(list, i, &url, 0);
 256       if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
 257         break;
 258       else if (ret < 0)
 259         error (EXIT_FAILURE, 0, "gnutls_tpm_key_list_get_url: %s", gnutls_strerror (ret));
 260
 261       fprintf(outfile, "\t%u: %s\n", i, url);
 262       gnutls_free(url);
 263     }
 264
 265   fputs ("\n", outfile);
 266 }
 267
 268 static void tpm_pubkey(const char* url, FILE* outfile)
 269 {
 270   int ret;
 271   char* srk_pass;
 272   gnutls_pubkey_t pubkey;
 273
 274   srk_pass = getpass ("Enter SRK password: ");
 275   if (srk_pass != NULL)
 276     srk_pass = strdup(srk_pass);
 277
 278   gnutls_pubkey_init(&pubkey);
 279
 280   ret = gnutls_pubkey_import_tpm_url(pubkey, url, srk_pass, 0);
 281
 282   free(srk_pass);
 283
 284   if (ret < 0)
 285     error (EXIT_FAILURE, 0, "gnutls_pubkey_import_tpm_url: %s", gnutls_strerror (ret));
 286
 287   _pubkey_info(outfile, pubkey);
 288
 289   gnutls_pubkey_deinit(pubkey);
 290 }