Skip to content

Commit 8390676

Browse files
dgarskedgarske
committed
Adds wolfTPM support for Zephyr. Work by @aidangarske and @night1rider 
1 parent c99619d commit 8390676

File tree

25 files changed

+946
-34
lines changed

25 files changed

+946
-34
lines changed

‎.github/workflows/zephyr.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Zephyr wolfTPM Tests
2+
3+
on:
4+
push:
5+
branches: [ '*' ]
6+
pull_request:
7+
branches: [ '*' ]
8+
9+
jobs:
10+
run_test:
11+
name: Build
12+
strategy:
13+
matrix:
14+
config:
15+
- zephyr-ref: v3.4.0
16+
zephyr-sdk: 0.16.1
17+
runs-on: ubuntu-22.04
18+
# This should be a safe limit for the tests to run.
19+
timeout-minutes: 25
20+
steps:
21+
- name: Install dependencies
22+
run: |
23+
# Don't prompt for anything
24+
export DEBIAN_FRONTEND=noninteractive
25+
sudo apt-get update
26+
# most of the ci-base zephyr docker image packages
27+
sudo apt-get install -y zip bridge-utils uml-utilities \
28+
git cmake ninja-build gperf ccache dfu-util device-tree-compiler wget \
29+
python3-dev python3-pip python3-setuptools python3-tk python3-wheel xz-utils file \
30+
make gcc gcc-multilib g++-multilib libsdl2-dev libmagic1 \
31+
autoconf automake bison build-essential ca-certificates cargo ccache chrpath cmake \
32+
cpio device-tree-compiler dfu-util diffstat dos2unix doxygen file flex g++ gawk gcc \
33+
gcovr git git-core gnupg gperf gtk-sharp2 help2man iproute2 lcov libcairo2-dev \
34+
libglib2.0-dev libgtk2.0-0 liblocale-gettext-perl libncurses5-dev libpcap-dev \
35+
libpopt0 libsdl1.2-dev libsdl2-dev libssl-dev libtool libtool-bin locales make \
36+
net-tools ninja-build openssh-client parallel pkg-config python3-dev python3-pip \
37+
python3-ply python3-setuptools python-is-python3 qemu-kvm rsync socat srecord sudo \
38+
texinfo unzip wget ovmf xz-utils
39+
40+
- name: Install west
41+
run: sudo pip install west
42+
43+
- name: Init west workspace
44+
run: west init --mr ${{ matrix.config.zephyr-ref }} zephyr
45+
46+
- name: Update west.yml
47+
working-directory: zephyr/zephyr
48+
run: |
49+
REF=$(echo '${{ github.ref }}' | sed -e 's/\//\\\//g')
50+
sed -e 's/remotes:/remotes:\n \- name: wolfssl\n url\-base: https:\/\/github.com\/wolfssl/' -i west.yml
51+
sed -e "s/remotes:/remotes:\n \- name: wolftpm\n url\-base: https:\/\/github.com\/${{ github.repository_owner }}/" -i west.yml
52+
sed -e "s/projects:/projects:\n \- name: wolftpm\n path: modules\/lib\/wolftpm\n remote: wolftpm\n revision: $REF/" -i west.yml
53+
sed -e 's/projects:/projects:\n \- name: wolfssl\n path: modules\/crypto\/wolfssl\n remote: wolfssl\n revision: master/' -i west.yml
54+
55+
- name: Update west workspace
56+
working-directory: zephyr
57+
run: west update -n -o=--depth=1
58+
59+
- name: Export zephyr
60+
working-directory: zephyr
61+
run: west zephyr-export
62+
63+
- name: Install pip dependencies
64+
working-directory: zephyr
65+
run: sudo pip install -r zephyr/scripts/requirements.txt
66+
67+
- name: Install zephyr SDK
68+
run: |
69+
wget -q https://github.com/zephyrproject-rtos/sdk-ng/releases/download/v${{ matrix.config.zephyr-sdk }}/zephyr-sdk-${{ matrix.config.zephyr-sdk }}_linux-x86_64_minimal.tar.xz
70+
tar xf zephyr-sdk-${{ matrix.config.zephyr-sdk }}_linux-x86_64_minimal.tar.xz
71+
cd zephyr-sdk-${{ matrix.config.zephyr-sdk }}
72+
./setup.sh -h -c -t x86_64-zephyr-elf
73+
74+
- name: Run wolftpm tests
75+
id: wolftpm_tests
76+
working-directory: zephyr
77+
run: |
78+
./zephyr/scripts/twister --testsuite-root modules/lib/wolftpm --test zephyr/samples/wolftpm_wrap_caps/sample.lib.wolftpm_wrap_caps -vvv
79+
rm -rf zephyr/twister-out
80+
./zephyr/scripts/twister --testsuite-root modules/lib/wolftpm --test zephyr/samples/wolftpm_wrap_test/sample.lib.wolftpm_wrap_test -vvv
81+
rm -rf zephyr/twister-out
82+
83+
- name: Zip failure logs
84+
if: ${{ failure() && steps.wolftpm_tests.outcome == 'failure' }}
85+
run: |
86+
zip -9 -r logs.zip zephyr/twister-out
87+
88+
- name: Upload failure logs
89+
if: ${{ failure() && steps.wolftpm_tests.outcome == 'failure' }}
90+
uses: actions/upload-artifact@v4
91+
with:
92+
name: zephyr-client-test-logs
93+
path: logs.zip
94+
retention-days: 5

‎Makefile.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ include docs/include.am
4242
include wrapper/include.am
4343
include hal/include.am
4444
include cmake/include.am
45+
include zephyr/include.am
4546

4647
EXTRA_DIST+= .cyignore
4748
EXTRA_DIST+= README.md

‎examples/csr/csr.c‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,25 @@
3838
#include <wolfssl/wolfcrypt/asn_public.h>
3939

4040
#ifndef NO_RSA
41-
static const char* gClientCsrRsaFile = "./certs/tpm-rsa-cert.csr";
42-
static const char* gClientCertRsaFile = "./certs/tpm-rsa-cert.pem";
41+
#ifndef RSA_CERT_CSR
42+
#define RSA_CERT_CSR "./certs/tpm-rsa-cert.csr"
4343
#endif
44+
#ifndef RSA_CERT_PEM
45+
#define RSA_CERT_PEM "./certs/tpm-rsa-cert.pem"
46+
#endif
47+
static const char* gClientCsrRsaFile = RSA_CERT_CSR;
48+
static const char* gClientCertRsaFile = RSA_CERT_PEM;
49+
#endif
50+
4451
#ifdef HAVE_ECC
45-
static const char* gClientCsrEccFile = "./certs/tpm-ecc-cert.csr";
46-
static const char* gClientCertEccFile = "./certs/tpm-ecc-cert.pem";
52+
#ifndef ECC_CERT_CSR
53+
#define ECC_CERT_CSR "./certs/tpm-ecc-cert.csr"
54+
#endif
55+
#ifndef ECC_CERT_PEM
56+
#define ECC_CERT_PEM "./certs/tpm-ecc-cert.pem"
57+
#endif
58+
static const char* gClientCsrEccFile = ECC_CERT_CSR;
59+
static const char* gClientCertEccFile = ECC_CERT_PEM;
4760
#endif
4861

4962
#ifndef MAX_PEM_SIZE

‎examples/keygen/keygen.c‎

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,28 @@
3636
#include <examples/tpm_test.h>
3737
#include <examples/tpm_test_keys.h>
3838

39+
/* Output file path defines with defaults */
40+
#ifndef OUTPUT_FILE
41+
#define OUTPUT_FILE "keyblob.bin"
42+
#endif
43+
#ifndef EK_PUB_FILE
44+
#define EK_PUB_FILE "ek.pub"
45+
#endif
46+
#ifndef SRK_PUB_FILE
47+
#define SRK_PUB_FILE "srk.pub"
48+
#endif
49+
50+
#if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES)
51+
#ifndef AK_NAME_FILE
52+
#define AK_NAME_FILE "ak.name"
53+
#endif
54+
#if !defined(WOLFTPM2_NO_WOLFCRYPT) && !defined(NO_ASN)
55+
/* PEM_FILE is NULL by default, but can be overridden */
56+
#ifndef PEM_FILE
57+
#define PEM_FILE NULL
58+
#endif
59+
#endif
60+
#endif
3961

4062
/******************************************************************************/
4163
/* --- BEGIN TPM Keygen Example -- */
@@ -118,14 +140,14 @@ int TPM2_Keygen_Example(void* userCtx, int argc, char *argv[])
118140
int bAIK = 1;
119141
int keyBits = 256;
120142
const char* uniqueStr = NULL;
121-
const char *outputFile = "keyblob.bin";
122-
const char *ekPubFile = "ek.pub";
123-
const char *srkPubFile = "srk.pub";
143+
const char *outputFile = OUTPUT_FILE;
144+
const char *ekPubFile = EK_PUB_FILE;
145+
const char *srkPubFile = SRK_PUB_FILE;
124146
const char *pubFilename = NULL;
125147
#if !defined(NO_FILESYSTEM) && !defined(NO_WRITE_TEMP_FILES)
126-
const char *nameFile = "ak.name"; /* Name Digest for attestation purposes */
148+
const char *nameFile = AK_NAME_FILE; /* Name Digest for attestation purposes */
127149
#if !defined(WOLFTPM2_NO_WOLFCRYPT) && !defined(NO_ASN)
128-
const char *pemFilename = NULL;
150+
const char *pemFilename = PEM_FILE;
129151
#endif
130152
#endif
131153
const char* symMode = "aesctr";

‎examples/tls/tls_server.c‎

Lines changed: 49 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,34 @@ static int mStop = 0;
4646
double benchStart;
4747
#endif
4848

49+
/* CA Certificate path defines with defaults */
50+
#ifndef CA_RSA_CERT_PATH
51+
#define CA_RSA_CERT_PATH "./certs/ca-rsa-cert.pem"
52+
#endif
53+
#ifndef WOLF_CA_RSA_CERT_PATH
54+
#define WOLF_CA_RSA_CERT_PATH "./certs/wolf-ca-rsa-cert.pem"
55+
#endif
56+
#ifndef CA_ECC_CERT_PATH
57+
#define CA_ECC_CERT_PATH "./certs/ca-ecc-cert.pem"
58+
#endif
59+
#ifndef WOLF_CA_ECC_CERT_PATH
60+
#define WOLF_CA_ECC_CERT_PATH "./certs/wolf-ca-ecc-cert.pem"
61+
#endif
62+
63+
/* Server Certificate path defines with defaults */
64+
#ifndef SERVER_RSA_CERT_PATH
65+
#define SERVER_RSA_CERT_PATH "./certs/server-rsa-cert.pem"
66+
#endif
67+
#ifndef TPM_RSA_CERT_PATH
68+
#define TPM_RSA_CERT_PATH "./certs/tpm-rsa-cert.pem"
69+
#endif
70+
#ifndef SERVER_ECC_CERT_PATH
71+
#define SERVER_ECC_CERT_PATH "./certs/server-ecc-cert.pem"
72+
#endif
73+
#ifndef TPM_ECC_CERT_PATH
74+
#define TPM_ECC_CERT_PATH "./certs/tpm-ecc-cert.pem"
75+
#endif
76+
4977
/*
5078
* Generating the Server Certificate
5179
*
@@ -380,14 +408,14 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
380408
/* Load CA Certificates */
381409
if (!useECC) {
382410
#ifndef NO_RSA
383-
if (wolfSSL_CTX_load_verify_locations(ctx, "./certs/ca-rsa-cert.pem",
411+
if (wolfSSL_CTX_load_verify_locations(ctx, CA_RSA_CERT_PATH,
384412
0) != WOLFSSL_SUCCESS) {
385-
printf("Error loading ca-rsa-cert.pem cert\n");
413+
printf("Error loading %s cert\n", CA_RSA_CERT_PATH);
386414
goto exit;
387415
}
388-
if (wolfSSL_CTX_load_verify_locations(ctx, "./certs/wolf-ca-rsa-cert.pem",
416+
if (wolfSSL_CTX_load_verify_locations(ctx, WOLF_CA_RSA_CERT_PATH,
389417
0) != WOLFSSL_SUCCESS) {
390-
printf("Error loading wolf-ca-rsa-cert.pem cert\n");
418+
printf("Error loading %s cert\n", WOLF_CA_RSA_CERT_PATH);
391419
goto exit;
392420
}
393421
#else
@@ -398,16 +426,16 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
398426
}
399427
else {
400428
#ifdef HAVE_ECC
401-
if (wolfSSL_CTX_load_verify_locations(ctx, "./certs/ca-ecc-cert.pem",
429+
if (wolfSSL_CTX_load_verify_locations(ctx, CA_ECC_CERT_PATH,
402430
0) != WOLFSSL_SUCCESS) {
403-
printf("Error loading ca-ecc-cert.pem cert\n");
431+
printf("Error loading %s cert\n", CA_ECC_CERT_PATH);
404432
#ifndef WOLFTPM_MFG_IDENTITY /* not fatal if using mfg identity */
405433
goto exit;
406434
#endif
407435
}
408-
if (wolfSSL_CTX_load_verify_locations(ctx, "./certs/wolf-ca-ecc-cert.pem",
436+
if (wolfSSL_CTX_load_verify_locations(ctx, WOLF_CA_ECC_CERT_PATH,
409437
0) != WOLFSSL_SUCCESS) {
410-
printf("Error loading wolf-ca-ecc-cert.pem cert\n");
438+
printf("Error loading %s cert\n", WOLF_CA_ECC_CERT_PATH);
411439
goto exit;
412440
}
413441
#else
@@ -461,14 +489,18 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
461489
WOLFSSL_FILETYPE_ASN1);
462490
#endif
463491
#else
464-
const char* useCert = "./certs/server-rsa-cert.pem";
492+
const char* useCert = SERVER_RSA_CERT_PATH;
465493
if (useSelfSign) {
466-
useCert = "./certs/tpm-rsa-cert.pem";
494+
useCert = TPM_RSA_CERT_PATH;
467495
}
468496
rc = wolfSSL_CTX_use_certificate_file(ctx, useCert, WOLFSSL_FILETYPE_PEM);
469497
#endif
470498
if (rc != WOLFSSL_SUCCESS) {
499+
#ifndef NO_FILESYSTEM
500+
printf("Error loading RSA client cert: %s\n", useCert);
501+
#else
471502
printf("Error loading RSA client cert\n");
503+
#endif
472504
goto exit;
473505
}
474506
#else
@@ -496,14 +528,18 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
496528
WOLFSSL_FILETYPE_ASN1);
497529
#endif
498530
#else
499-
const char* useCert = "./certs/server-ecc-cert.pem";
531+
const char* useCert = SERVER_ECC_CERT_PATH;
500532
if (useSelfSign) {
501-
useCert = "./certs/tpm-ecc-cert.pem";
533+
useCert = TPM_ECC_CERT_PATH;
502534
}
503535
rc = wolfSSL_CTX_use_certificate_file(ctx, useCert, WOLFSSL_FILETYPE_PEM);
504536
#endif
505537
if (rc != WOLFSSL_SUCCESS) {
538+
#ifndef NO_FILESYSTEM
539+
printf("Error loading ECC client cert: %s\n", useCert);
540+
#else
506541
printf("Error loading ECC client cert\n");
542+
#endif
507543
goto exit;
508544
}
509545
#else
@@ -649,7 +685,7 @@ int TPM2_TLS_ServerArgs(void* userCtx, int argc, char *argv[])
649685
}
650686

651687
exit:
652-
688+
mStop = 0; /* Reset the stop flag for if example is compiled into a demo */
653689
if (rc != 0) {
654690
printf("Failure %d (0x%x): %s\n", rc, rc, wolfTPM2_GetRCString(rc));
655691
}

‎examples/tpm_test.h‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,19 @@
5252

5353
#define TPM2_DEMO_PCR_INDEX 16
5454

55+
#ifndef PEM_FILE_AK
56+
#define PEM_FILE_AK "ak.pem"
57+
#endif
58+
#ifndef PEM_FILE_EK
59+
#define PEM_FILE_EK "ek.pem"
60+
#endif
61+
#ifndef PEM_FILE_SRK
62+
#define PEM_FILE_SRK "srk.pem"
63+
#endif
64+
#ifndef PEM_FILE_KEY
65+
#define PEM_FILE_KEY "key.pem"
66+
#endif
67+
5568
static const char gStorageKeyAuth[] = "ThisIsMyStorageKeyAuth";
5669
static const char gAiKeyAuth[] = "ThisIsMyAiKeyAuth";
5770
static const char gKeyAuth[] = "ThisIsMyKeyAuth";
@@ -60,10 +73,10 @@ static const char gUsageAuth[] = "ThisIsASecretUsageAuth";
6073
static const char gNvAuth[] = "ThisIsMyNvAuth";
6174
static const char gXorAuth[] = "ThisIsMyXorAuth";
6275

63-
static const char pemFileAk[] = "ak.pem";
64-
static const char pemFileEk[] = "ek.pem";
65-
static const char pemFileSrk[] = "srk.pem";
66-
static const char pemFileKey[] = "key.pem";
76+
static const char pemFileAk[] = PEM_FILE_AK;
77+
static const char pemFileEk[] = PEM_FILE_EK;
78+
static const char pemFileSrk[] = PEM_FILE_SRK;
79+
static const char pemFileKey[] = PEM_FILE_KEY;
6780

6881
/* Default Test PCR */
6982
/* PCR16 is for DEBUG purposes, thus safe to use */

‎examples/tpm_test_keys.c‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,22 @@
4040

4141
#include <stdio.h>
4242

43-
#define RSA_FILENAME "rsa_test_blob.raw"
44-
#define ECC_FILENAME "ecc_test_blob.raw"
43+
#ifdef WOLFTPM_ZEPHYR
44+
#include <zephyr/fs/fs.h>
45+
#define XFILE struct fs_file_t*
46+
/* Note: Other filesystem macros (XFOPEN, XFCLOSE etc) are already defined
47+
* in wolfSSL's wc_port.h for Zephyr */
48+
#else
49+
#define XFILE FILE*
50+
#endif
51+
52+
#ifndef RSA_FILENAME
53+
#define RSA_FILENAME "rsa_test_blob.raw"
54+
#endif
55+
56+
#ifndef ECC_FILENAME
57+
#define ECC_FILENAME "ecc_test_blob.raw"
58+
#endif
4559

4660
#ifndef WOLFTPM2_NO_WRAPPER
4761

‎examples/wrap/caps.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,8 @@ int TPM2_Wrapper_CapsArgs(void* userCtx, int argc, char *argv[])
129129
/* Print the available PCR's */
130130
TPM2_PCRs_Print();
131131

132+
printf("wolfTPM caps read successfully\n");
133+
132134
exit:
133135
wolfTPM2_Shutdown(&dev, 0); /* 0=just shutdown, no startup */
134136

‎examples/wrap/wrap_test.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -997,6 +997,8 @@ int TPM2_Wrapper_TestArgs(void* userCtx, int argc, char *argv[])
997997
if (rc != 0) goto exit;
998998
#endif
999999

1000+
printf("wolfTPM wrapper test completed successfully\n");
1001+
10001002
exit:
10011003

10021004
if (rc != 0) {

0 commit comments

Comments
 (0)