Audiobuzz
6278f2847d
Replaces the shell/openssl-provider host enrolment (a35f2d6) with a static
Go + go-tpm binary, and moves BOTH host Go binaries out of the Packer VM.
fleet-enrol (files/enrol/, Go + go-tpm, no CGO):
- talks to /dev/tpmrm0 DIRECTLY via transport.FromReadWriter(os.File) — no
linuxtpm, so go-tpm is the only dep and there is NO tpm2-tools key-gen /
openssl tpm2 provider / curl in the image (removes the biggest bench risk,
the provider handle: key-ref).
- ensures the ECDSA key @0x81010001, builds the CSR (crypto.Signer over the
TPM key), POSTs CSR+context to the broker, shows the Plymouth fingerprint,
polls /status, writes the leaf cert to NV 0x01800001.
- tpmkey/ is an exported package so the TPM ceremony is tested against the
go-tpm software simulator from a SEPARATE simtest/ module (CGO stays out of
the shipped build). Transaction logic (mock broker) tested in-package.
- deps pinned by go.sum (not vendored): the binary now builds on the CI
runner, which has network — reproducible via pinned Go 1.26.4 + go.sum.
Out-of-VM build (decision): both fleet-enrol AND fleet-hostapi compile in the
CI "Build host Go binaries" step (Go 1.26.4, CGO off, -trimpath) and Packer
FILE-PROVISIONS the static binaries in. Dropped the in-VM `dnf install golang`
+ the 2d removal — the Rocky build image carries no Go toolchain / go-tpm tree.
Wiring:
- tpm-enrol.sh: now a thin GATE (empty-NV check, pre-auth DHCP on en*,
exec /usr/sbin/fleet-enrol, reboot-to-converge). module-setup.sh bundles the
binary (asserted) + reverts the tpm2-openssl/curl installs.
- diskless.pkr.hcl: file provisioners for both binaries; enrol installed to
/usr/sbin before the initramfs build + fapolicyd-trusted; lsinitrd asserts
fleet-enrol; dnf reverted to baseline (no tpm2-openssl/curl).
- gitea-main-ci.yaml: Set up Go + build both binaries + run the simulator
ceremony test, before packer validate.
TESTED here: transaction unit tests + the full TPM ceremony (key-gen -> persist
-> ECDSA sign -> CSR verify -> chunked NV write -> re-enrol) against the go-tpm
simulator. BENCH-VERIFY (real/swtpm, empty owner auth, pre-auth DHCP, Plymouth,
reboot-converge, prod HTTPS) tracked in docs/TODO.md #11.
102 lines
2.9 KiB
Go
102 lines
2.9 KiB
Go
// Package simtest validates tpmkey's TPM ceremony against the go-tpm software
|
|
// simulator (the MS TPM 2.0 reference). It lives in its own module so the CGO
|
|
// simulator never enters the shipped fleet-enrol build; see go.mod.
|
|
package simtest
|
|
|
|
import (
|
|
"crypto/ecdsa"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"crypto/x509"
|
|
"crypto/x509/pkix"
|
|
"testing"
|
|
|
|
"fleet-enrol/tpmkey"
|
|
|
|
"github.com/google/go-tpm-tools/simulator"
|
|
"github.com/google/go-tpm/tpm2"
|
|
"github.com/google/go-tpm/tpm2/transport"
|
|
)
|
|
|
|
func openSim(t *testing.T) transport.TPM {
|
|
t.Helper()
|
|
sim, err := simulator.Get()
|
|
if err != nil {
|
|
t.Fatalf("simulator: %v", err)
|
|
}
|
|
t.Cleanup(func() { sim.Close() })
|
|
return transport.FromReadWriter(sim)
|
|
}
|
|
|
|
func TestEnsureKeyAndSignCSR(t *testing.T) {
|
|
tpm := openSim(t)
|
|
const h = tpm2.TPMHandle(0x81010001)
|
|
|
|
signer, created, err := tpmkey.EnsureKey(tpm, h)
|
|
if err != nil {
|
|
t.Fatalf("EnsureKey: %v", err)
|
|
}
|
|
if !created {
|
|
t.Errorf("first EnsureKey should report created=true")
|
|
}
|
|
if _, ok := signer.Public().(*ecdsa.PublicKey); !ok {
|
|
t.Fatalf("signer public key is not ECDSA")
|
|
}
|
|
|
|
// idempotent: second call reuses the persistent key (same pubkey).
|
|
signer2, created2, err := tpmkey.EnsureKey(tpm, h)
|
|
if err != nil || created2 {
|
|
t.Fatalf("second EnsureKey: created=%v err=%v", created2, err)
|
|
}
|
|
if !signer.Public().(*ecdsa.PublicKey).Equal(signer2.Public()) {
|
|
t.Errorf("persistent key changed between calls")
|
|
}
|
|
|
|
// the TPM signer must produce a CSR that verifies — this is the exact
|
|
// openssl-tpm2-provider path the Go binary replaces.
|
|
tmpl := &x509.CertificateRequest{Subject: pkix.Name{CommonName: "fleet-host"}}
|
|
der, err := x509.CreateCertificateRequest(rand.Reader, tmpl, signer)
|
|
if err != nil {
|
|
t.Fatalf("CreateCertificateRequest with TPM signer: %v", err)
|
|
}
|
|
csr, err := x509.ParseCertificateRequest(der)
|
|
if err != nil {
|
|
t.Fatalf("parse CSR: %v", err)
|
|
}
|
|
if err := csr.CheckSignature(); err != nil {
|
|
t.Fatalf("CSR signature (TPM-signed) invalid: %v", err)
|
|
}
|
|
|
|
// raw signer sanity: sign a digest, verify with the public key.
|
|
dig := sha256.Sum256([]byte("hello"))
|
|
sig, err := signer.Sign(rand.Reader, dig[:], nil)
|
|
if err != nil {
|
|
t.Fatalf("sign: %v", err)
|
|
}
|
|
if !ecdsa.VerifyASN1(signer.Public().(*ecdsa.PublicKey), dig[:], sig) {
|
|
t.Fatalf("TPM ECDSA signature did not verify")
|
|
}
|
|
}
|
|
|
|
func TestNVWriteAndPresence(t *testing.T) {
|
|
tpm := openSim(t)
|
|
const nv = tpm2.TPMHandle(0x01800001)
|
|
|
|
if tpmkey.NVPresent(tpm, nv) {
|
|
t.Fatalf("NV should be empty on a fresh TPM")
|
|
}
|
|
// realistic cert-sized payload that also crosses the 512B write chunk.
|
|
want := make([]byte, 700)
|
|
rand.Read(want)
|
|
if err := tpmkey.WriteNVCert(tpm, nv, want); err != nil {
|
|
t.Fatalf("WriteNVCert: %v", err)
|
|
}
|
|
if !tpmkey.NVPresent(tpm, nv) {
|
|
t.Fatalf("NV should be present after write")
|
|
}
|
|
// re-write (re-enrolment) must succeed (undefine + redefine).
|
|
if err := tpmkey.WriteNVCert(tpm, nv, want[:400]); err != nil {
|
|
t.Fatalf("WriteNVCert rewrite: %v", err)
|
|
}
|
|
}
|