Skip to content

Commit 574ee0f

Browse files
aidangarskeaidangarske
committed
Made a sampleTpmPublicKeyRsaBuffer string that holds the hansel key and made helper function LoadTpmSshKey added ci test
1 parent 46a0db5 commit 574ee0f

2 files changed

Lines changed: 236 additions & 92 deletions

File tree

‎.github/workflows/tpm-ssh.yml‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
name: TPM SSH Test
2+
3+
on:
4+
push:
5+
branches: [ '*' ]
6+
pull_request:
7+
branches: [ '*' ]
8+
9+
jobs:
10+
test-tpm-ssh:
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- uses: actions/checkout@v3
15+
with:
16+
path: wolfssh
17+
18+
# Clone dependencies
19+
- name: Clone wolfSSL
20+
uses: actions/checkout@v3
21+
with:
22+
repository: wolfSSL/wolfssl
23+
path: wolfssl
24+
25+
- name: Clone wolfTPM
26+
uses: actions/checkout@v3
27+
with:
28+
repository: wolfSSL/wolftpm
29+
path: wolftpm
30+
31+
# Install dependencies
32+
- name: Install Dependencies
33+
run: |
34+
sudo apt-get update
35+
sudo apt-get install -y libtool automake autoconf
36+
sudo apt-get install -y ibmswtpm2
37+
38+
# Build and install wolfSSL
39+
- name: Build wolfSSL
40+
run: |
41+
cd wolfssl
42+
./autogen.sh
43+
./configure --enable-wolftpm --enable-wolfssh
44+
make
45+
sudo make install
46+
sudo ldconfig
47+
cd ..
48+
49+
# Build and install wolfTPM
50+
- name: Build wolfTPM
51+
run: |
52+
cd wolftpm
53+
./autogen.sh
54+
./configure --enable-swtpm
55+
make
56+
sudo make install
57+
sudo ldconfig
58+
cd ..
59+
60+
# Build wolfSSH
61+
- name: Build wolfSSH
62+
run: |
63+
cd wolfssh
64+
./autogen.sh
65+
./configure --enable-tpm
66+
make
67+
sudo make install
68+
sudo ldconfig
69+
cd ..
70+
71+
# Start TPM simulator
72+
- name: Start TPM Simulator
73+
run: |
74+
tpm_server &
75+
sleep 2 # Give the simulator time to start
76+
77+
# Test TPM SSH Default Password
78+
- name: Test TPM SSH Default Password
79+
run: |
80+
# Generate key with default password
81+
cd wolftpm
82+
./examples/keygen/keygen keyblob.bin -rsa -t -pem -eh
83+
84+
# Convert key to SSH format
85+
ssh-keygen -f key.pem -i -m PKCS8 > ../wolfssh/key.ssh
86+
cd ..
87+
88+
# Start echoserver and wait for it to be ready
89+
cd wolfssh
90+
./examples/echoserver/echoserver -s key.ssh &
91+
SERVER_PID=$!
92+
sleep 5 # Give the server more time to start
93+
if ! kill -0 $SERVER_PID 2>/dev/null; then
94+
echo "Server failed to start"
95+
exit 1
96+
fi
97+
cd ..
98+
99+
# Test client connection with default password
100+
cd wolfssh
101+
./examples/client/client -i ../wolftpm/keyblob.bin -u hansel -K ThisIsMyKeyAuth
102+
cd ..
103+
104+
# Kill the server and simulator and restart them
105+
- name: Kill server and simulator and restart
106+
run: |
107+
kill $SERVER_PID
108+
sleep 2
109+
pkill -f tpm_server
110+
sleep 2
111+
tpm_server &
112+
sleep 2 # Give the simulator time to start
113+
114+
# Test the TPM SSH Custom Password
115+
- name: Test TPM SSH Custom Password
116+
run: |
117+
# Test with custom password
118+
cd wolftpm
119+
./examples/keygen/keygen keyblob2.bin -rsa -t -pem -eh -auth=custompassword
120+
121+
# Convert key to SSH format
122+
ssh-keygen -f key.pem -i -m PKCS8 > ../wolfssh/key.ssh
123+
cd ..
124+
125+
# Start echoserver and wait for it to be ready
126+
cd wolfssh
127+
./examples/echoserver/echoserver -s key.ssh &
128+
SERVER_PID=$!
129+
sleep 5 # Give the server more time to start
130+
if ! kill -0 $SERVER_PID 2>/dev/null; then
131+
echo "Server failed to start"
132+
exit 1
133+
fi
134+
cd ..
135+
136+
# Test with custom password
137+
cd wolfssh
138+
./examples/client/client -i ../wolftpm/keyblob2.bin -u hansel -K custompassword
139+
cd ..
140+
141+
# Cleanup
142+
kill $SERVER_PID
143+
pkill -f tpm_server
144+
145+
# Archive artifacts for debugging
146+
- name: Archive test artifacts
147+
if: always()
148+
uses: actions/upload-artifact@v3
149+
with:
150+
name: test-artifacts
151+
path: |
152+
wolfssh/keyblob.bin
153+
wolfssh/keyblob2.bin
154+
wolfssh/key.pem
155+
wolfssh/key.ssh

‎examples/echoserver/echoserver.c‎

Lines changed: 81 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -1784,85 +1784,24 @@ static const char samplePublicKeyEccBuffer[] =
17841784
#endif
17851785

17861786
#ifndef WOLFSSH_NO_RSA
1787-
static const char* samplePublicKeyRsaBuffer =
1788-
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqDwRVTRVk/wjPhoo66+Mztrc31KsxDZ"
1789-
"+kAV0139PHQ+wsueNpba6jNn5o6mUTEOrxrz0LMsDJOBM7CmG0983kF4gRIihECpQ0rcjO"
1790-
"P6BSfbVTE9mfIK5IsUiZGd8SoE9kSV2pJ2FvZeBQENoAxEFk0zZL9tchPS+OCUGbK4SDjz"
1791-
"uNZl/30Mczs73N3MBzi6J1oPo7sFlqzB6ecBjK2Kpjus4Y1rYFphJnUxtKvB0s+hoaadru"
1792-
"biE57dK6BrH5iZwVLTQKux31uCJLPhiktI3iLbdlGZEctJkTasfVSsUizwVIyRjhVKmbdI"
1793-
"RGwkU38D043AR1h0mUoGCPIKuqcFMf gretel\n"
1794-
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9P3ZFowOsONXHD5MwWiCciXytBRZGho"
1795-
"MNiisWSgUs5HdHcACuHYPi2W6Z1PBFmBWT9odOrGRjoZXJfDDoPi+j8SSfDGsc/hsCmc3G"
1796-
"p2yEhUZUEkDhtOXyqjns1ickC9Gh4u80aSVtwHRnJZh9xPhSq5tLOhId4eP61s+a5pwjTj"
1797-
"nEhBaIPUJO2C/M0pFnnbZxKgJlX7t1Doy7h5eXxviymOIvaCZKU+x5OopfzM/wFkey0EPW"
1798-
"NmzI5y/+pzU5afsdeEWdiQDIQc80H6Pz8fsoFPvYSG+s4/wz0duu7yeeV1Ypoho65Zr+pE"
1799-
"nIf7dO0B8EblgWt+ud+JI8wrAhfE4x hansel\n";
1800-
#endif
1801-
1802-
/* Loads a new key from a file and appends
1803-
* it to the samplePublicKeyRsaBuffer */
1804-
static char* LoadSshKey(const char* path)
1805-
{
1806-
FILE* file;
1807-
char* buffer = NULL;
1808-
char* ret = NULL;
1809-
long length;
1810-
const char* gretelKey = samplePublicKeyRsaBuffer;
1811-
const char* hanselKey;
1812-
long gretelLen = (long)strlen(gretelKey);
1813-
1814-
/* Find where hansel's key starts (it's after gretel's key) */
1815-
hanselKey = strstr(gretelKey + 1, "ssh-rsa");
1816-
if (!hanselKey) {
1817-
fprintf(stderr, "Could not find hansel's key\n");
1818-
return NULL;
1819-
}
1820-
1821-
/* Calculate length of gretel's key portion */
1822-
gretelLen = hanselKey - gretelKey;
1823-
1824-
/* Read new key from file */
1825-
file = fopen(path, "rb");
1826-
if (!file) {
1827-
fprintf(stderr, "Failed to open SSH key file: %s\n", path);
1828-
return NULL;
1829-
}
1830-
1831-
fseek(file, 0, SEEK_END);
1832-
length = ftell(file);
1833-
fseek(file, 0, SEEK_SET);
1834-
1835-
buffer = (char*)WMALLOC(length + 1, NULL, DYNTYPE_BUFFER);
1836-
if (buffer) {
1837-
if (fread(buffer, 1, length, file) != (size_t)length) {
1838-
WFREE(buffer, NULL, DYNTYPE_BUFFER);
1839-
buffer = NULL;
1840-
}
1841-
else {
1842-
/* Remove any trailing newlines */
1843-
while (length > 0 && (buffer[length-1] == '\n'
1844-
|| buffer[length-1] == '\r')) {
1845-
length--;
1846-
}
1847-
buffer[length] = '\0';
1848-
1849-
/* Allocate space for: gretel's key + new key + " hansel\n" */
1850-
ret = (char*)WMALLOC(gretelLen + length + 8, NULL, DYNTYPE_BUFFER);
1851-
if (ret) {
1852-
/* Copy gretel's key */
1853-
WMEMCPY(ret, gretelKey, gretelLen);
1854-
/* Copy new key */
1855-
WMEMCPY(ret + gretelLen, buffer, length);
1856-
/* Append hansel identifier */
1857-
WMEMCPY(ret + gretelLen + length, " hansel\n", 8);
1858-
}
1859-
WFREE(buffer, NULL, DYNTYPE_BUFFER);
1860-
}
1861-
}
1862-
1863-
fclose(file);
1864-
return ret;
1865-
}
1787+
#ifdef WOLFSSH_TPM
1788+
static const char* sampleTpmPublicKeyRsaBuffer = "";
1789+
#else
1790+
static const char* samplePublicKeyRsaBuffer =
1791+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqDwRVTRVk/wjPhoo66+Mztrc31KsxDZ"
1792+
"+kAV0139PHQ+wsueNpba6jNn5o6mUTEOrxrz0LMsDJOBM7CmG0983kF4gRIihECpQ0rcjO"
1793+
"P6BSfbVTE9mfIK5IsUiZGd8SoE9kSV2pJ2FvZeBQENoAxEFk0zZL9tchPS+OCUGbK4SDjz"
1794+
"uNZl/30Mczs73N3MBzi6J1oPo7sFlqzB6ecBjK2Kpjus4Y1rYFphJnUxtKvB0s+hoaadru"
1795+
"biE57dK6BrH5iZwVLTQKux31uCJLPhiktI3iLbdlGZEctJkTasfVSsUizwVIyRjhVKmbdI"
1796+
"RGwkU38D043AR1h0mUoGCPIKuqcFMf gretel\n"
1797+
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9P3ZFowOsONXHD5MwWiCciXytBRZGho"
1798+
"MNiisWSgUs5HdHcACuHYPi2W6Z1PBFmBWT9odOrGRjoZXJfDDoPi+j8SSfDGsc/hsCmc3G"
1799+
"p2yEhUZUEkDhtOXyqjns1ickC9Gh4u80aSVtwHRnJZh9xPhSq5tLOhId4eP61s+a5pwjTj"
1800+
"nEhBaIPUJO2C/M0pFnnbZxKgJlX7t1Doy7h5eXxviymOIvaCZKU+x5OopfzM/wFkey0EPW"
1801+
"NmzI5y/+pzU5afsdeEWdiQDIQc80H6Pz8fsoFPvYSG+s4/wz0duu7yeeV1Ypoho65Zr+pE"
1802+
"nIf7dO0B8EblgWt+ud+JI8wrAhfE4x hansel\n";
1803+
#endif /* WOLFSSH_TPM */
1804+
#endif /* WOLFSSH_NO_RSA */
18661805

18671806
#ifdef WOLFSSH_ALLOW_USERAUTH_NONE
18681807

@@ -2159,6 +2098,46 @@ static int LoadPubKeyList(StrList* strList, int format, PwMapList* mapList)
21592098
}
21602099
#endif
21612100

2101+
#ifdef WOLFSSH_TPM
2102+
static char* LoadTpmSshKey(const char* keyFile)
2103+
{
2104+
FILE* file;
2105+
char* buffer = NULL;
2106+
char* ret = NULL;
2107+
long length;
2108+
2109+
file = fopen(keyFile, "rb");
2110+
if (!file) {
2111+
fprintf(stderr,
2112+
"Failed to open TPM key file: %s\n", keyFile);
2113+
return NULL;
2114+
}
2115+
2116+
fseek(file, 0, SEEK_END);
2117+
length = ftell(file);
2118+
fseek(file, 0, SEEK_SET);
2119+
2120+
buffer = (char*)WMALLOC(length + 8 + 1, NULL, DYNTYPE_BUFFER);
2121+
if (buffer) {
2122+
if (fread(buffer, 1, length, file) == (size_t)length) {
2123+
while (length > 0 && (buffer[length-1] == '\n' ||
2124+
buffer[length-1] == '\r')) {
2125+
length--;
2126+
}
2127+
WMEMCPY(buffer + length, " hansel\n", 8);
2128+
buffer[length + 8] = '\0';
2129+
ret = buffer;
2130+
}
2131+
else {
2132+
WFREE(buffer, NULL, DYNTYPE_BUFFER);
2133+
}
2134+
}
2135+
2136+
fclose(file);
2137+
return ret;
2138+
}
2139+
#endif
2140+
21622141
static int wsUserAuthResult(byte res,
21632142
WS_UserAuthData* authData,
21642143
void* ctx)
@@ -2422,6 +2401,7 @@ static void ShowUsage(void)
24222401
" (user assumed in comment)\n");
24232402
printf(" -I <name>:<file>\n"
24242403
" load in a SSH public key to accept from peer\n");
2404+
printf(" -s <file> load in a TPM public key file to replace default hansel key\n");
24252405
printf(" -J <name>:<file>\n"
24262406
" load in an X.509 PEM cert to accept from peer\n");
24272407
printf(" -K <name>:<file>\n"
@@ -2439,7 +2419,6 @@ static void ShowUsage(void)
24392419
"to use\n");
24402420
printf(" -m <list> set the comma separated list of mac algos to use\n");
24412421
printf(" -b <num> test user auth would block\n");
2442-
printf(" -s <file> load SSH public key file to replace default hansel key\n");
24432422
}
24442423

24452424

@@ -2485,7 +2464,9 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
24852464
const char* macList = NULL;
24862465
const char* cipherList = NULL;
24872466
ES_HEAP_HINT* heap = NULL;
2488-
static char* sshKeyPath = NULL;
2467+
#ifdef WOLFSSH_TPM
2468+
static char* tpmKeyPath = NULL;
2469+
#endif
24892470
int multipleConnections = 1;
24902471
int userEcc = 0;
24912472
int peerEcc = 0;
@@ -2613,7 +2594,9 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
26132594
break;
26142595

26152596
case 's':
2616-
sshKeyPath = myoptarg;
2597+
#ifdef WOLFSSH_TPM
2598+
tpmKeyPath = myoptarg;
2599+
#endif
26172600
break;
26182601

26192602
default:
@@ -2648,20 +2631,22 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
26482631
ES_ERROR("Couldn't initialize wolfSSH.\n");
26492632
}
26502633

2651-
/* Load custom SSH key if specified */
2652-
if (sshKeyPath != NULL) {
2653-
const char* newBuffer = LoadSshKey(sshKeyPath);
2634+
/* Load custom TPM key if specified */
2635+
#ifdef WOLFSSH_TPM
2636+
if (tpmKeyPath != NULL) {
2637+
const char* newBuffer = LoadTpmSshKey(tpmKeyPath);
26542638
if (newBuffer != NULL) {
2655-
samplePublicKeyRsaBuffer = newBuffer;
2639+
sampleTpmPublicKeyRsaBuffer = newBuffer;
26562640
}
26572641
else {
2658-
ES_ERROR("Failed to load SSH key from %s\n", sshKeyPath);
2642+
ES_ERROR("Failed to load TPM key from %s\n", tpmKeyPath);
26592643
}
2660-
#ifdef WOLFSSH_DEBUG
2661-
printf("New samplePublicKeyRsaBuffer:\n%s\n",
2662-
samplePublicKeyRsaBuffer);
2663-
#endif
2644+
printf("New sampleTpmPublicKeyRsaBuffer:\n%s\n", sampleTpmPublicKeyRsaBuffer);
26642645
}
2646+
else {
2647+
printf("No TPM key loaded\n");
2648+
}
2649+
#endif
26652650

26662651
#ifdef WOLFSSH_STATIC_MEMORY
26672652
{
@@ -2877,7 +2862,11 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
28772862
}
28782863
else {
28792864
#ifndef WOLFSSH_NO_RSA
2880-
bufName = samplePublicKeyRsaBuffer;
2865+
#ifdef WOLFSSH_TPM
2866+
bufName = sampleTpmPublicKeyRsaBuffer;
2867+
#else
2868+
bufName = samplePublicKeyRsaBuffer;
2869+
#endif
28812870
#endif
28822871
}
28832872
if (bufName != NULL) {

0 commit comments

Comments
 (0)