test: test OpenSSL provider and engine if available

.ci/download-deps.sh

@@ -17,6 +17,19 @@ function get_deps() {
 	local github_deps=("tpm2-tss" "tpm2-abrmd" "tpm2-tools" "${engine_pkg}")
 	declare -A local config_flags=( ["tpm2-tss"]="--disable-doxygen-doc --enable-debug" ["tpm2-abrmd"]="--enable-debug" ["tpm2-tools"]="--disable-hardening --enable-debug" ["${engine_pkg}"]="${engine_flags}")
 	declare -A local versions=( ["tpm2-tss"]="master" ["tpm2-abrmd"]="master" ["tpm2-tools"]="master" ["${engine_pkg}"]="master")
+	local have_openssl_engine=no
+	if printf '#include <openssl/engine.h>\n' | ${CC:-cc} $(pkg-config \
+			--cflags libcrypto) -x c -c -o /dev/null - \
+			>/dev/null 2>&1; then
+		have_engine_header=yes
+	fi
+
+	if [ "$OSSL3_DETECTED" -eq "1" ] &&
+			[ "$have_engine_header" = "yes" ]; then
+		github_deps+=("tpm2-tss-engine")
+		config_flags["tpm2-tss-engine"]="--enable-tctienvvar"
+		versions["tpm2-tss-engine"]="master"
+	fi
 
 	echo "pwd starting: `pwd`"
 	pushd "$1"

src/lib/sign.c

@@ -36,7 +36,7 @@ struct sign_opdata {
     const EVP_MD *md;
 };
 
-static sign_opdata *sign_opdata_new(mdetail *mdtl, CK_MECHANISM_PTR mechanism, tobject *tobj) {
+static sign_opdata *sign_opdata_new(operation op, mdetail *mdtl, CK_MECHANISM_PTR mechanism, tobject *tobj) {
 
     int padding = 0;
     CK_RV rv = mech_get_padding(mdtl,
@@ -74,9 +74,11 @@ static sign_opdata *sign_opdata_new(mdetail *mdtl, CK_MECHANISM_PTR mechanism, t
     }
 
     EVP_PKEY *pkey = NULL;
-    rv = ssl_util_attrs_to_evp(tobj->attrs, &pkey);
-    if (rv != CKR_OK) {
-        return NULL;
+    if (op != operation_sign) {
+        rv = ssl_util_attrs_to_evp(tobj->attrs, &pkey);
+        if (rv != CKR_OK) {
+            return NULL;
+        }
     }
 
     sign_opdata *opdata = calloc(1, sizeof(sign_opdata));
@@ -226,7 +228,7 @@ static CK_RV common_init(operation op, session_ctx *ctx, CK_MECHANISM_PTR mechan
         }
     }
 
-    sign_opdata *opdata = sign_opdata_new(tok->mdtl,
+    sign_opdata *opdata = sign_opdata_new(op, tok->mdtl,
             mechanism, tobj);
     if (!opdata) {
         tpm_opdata_free(&tpm_opdata);

src/lib/ssl_util.c

@@ -81,6 +81,13 @@ CK_RV ssl_util_check_PKCS1_TYPE_2(const CK_BYTE_PTR inbuf, CK_ULONG inlen, CK_UL
 #if defined(LIB_TPM2_OPENSSL_OPENSSL_POST300)
 #include <openssl/core_names.h>
 #include <openssl/param_build.h>
+#if !defined(LIB_TPM2_OPENSSL_OPENSSL_POST400)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+#endif
+
+#if defined(LIB_TPM2_OPENSSL_OPENSSL_POST300)
 static CK_RV get_RSA_evp_pubkey(CK_ATTRIBUTE_PTR e_attr, CK_ATTRIBUTE_PTR n_attr, EVP_PKEY **out_pkey) {
 
     CK_RV rv = CKR_GENERAL_ERROR;
@@ -126,8 +133,38 @@ static CK_RV get_RSA_evp_pubkey(CK_ATTRIBUTE_PTR e_attr, CK_ATTRIBUTE_PTR n_attr
     /* convert params to EVP key */
     evp_ctx = EVP_PKEY_CTX_new_from_name(NULL, "RSA", NULL);
     if (!evp_ctx) {
-        SSL_UTIL_LOGE("EVP_PKEY_CTX_new_id");
+#ifdef LIB_TPM2_OPENSSL_OPENSSL_POST400
+        SSL_UTIL_LOGE("EVP_PKEY_CTX_new_from_name");
+        goto out;
+#else
+        RSA *rsa = RSA_new();
+        if (!rsa) {
+            SSL_UTIL_LOGE("RSA_new");
+            goto out;
+        }
+        if (!RSA_set0_key(rsa, n, e, NULL)) {
+            SSL_UTIL_LOGE("RSA_set0_key");
+            RSA_free(rsa);
+            goto out;
+        }
+        /* ownership of n/e transferred to rsa; avoid double-free below */
+        n = e = NULL;
+
+        EVP_PKEY *pkey = EVP_PKEY_new();
+        if (!pkey) {
+            SSL_UTIL_LOGE("EVP_PKEY_new");
+            RSA_free(rsa);
+            goto out;
+        }
+        if (EVP_PKEY_assign_RSA(pkey, rsa) != 1) {
+            RSA_free(rsa);
+            EVP_PKEY_free(pkey);
+            goto out;
+        }
+        *out_pkey = pkey;
+        rv = CKR_OK;
         goto out;
+#endif
     }
 
     int rc = EVP_PKEY_fromdata_init(evp_ctx);
@@ -343,6 +380,11 @@ static CK_RV get_EC_evp_pubkey(CK_ATTRIBUTE_PTR ecparams, CK_ATTRIBUTE_PTR ecpoi
 }
 #endif
 
+#if defined(LIB_TPM2_OPENSSL_OPENSSL_POST300) && \
+		!defined(LIB_TPM2_OPENSSL_OPENSSL_POST400)
+#pragma GCC diagnostic pop
+#endif
+
 CK_RV ssl_util_attrs_to_evp(attr_list *attrs, EVP_PKEY **outpkey) {
 
     CK_ATTRIBUTE_PTR a = attr_get_attribute_by_type(attrs, CKA_KEY_TYPE);

src/lib/ssl_util.h

@@ -27,6 +27,10 @@
 #define LIB_TPM2_OPENSSL_OPENSSL_POST300 0x1010100f
 #endif
 
+#if (OPENSSL_VERSION_NUMBER >= 0x40000000) /* OpenSSL 4.0.0 */
+#define LIB_TPM2_OPENSSL_OPENSSL_POST400 0x1010100f
+#endif
+
 #define SSL_UTIL_LOGE(m) LOGE("%s: %s", m, ERR_error_string(ERR_get_error(), NULL));
 
 CK_RV ssl_util_attrs_to_evp(attr_list *attrs, EVP_PKEY **outpkey);

test/integration/p11-tool.sh.nosetup

@@ -174,79 +174,133 @@ if [ "$OSSL3_DETECTED" -eq "1" ] && [ "$have_fapi" -eq "0" ]; then
   exit 0
 fi
 
-echo "Testing signing via openssl"
-if [ "$OSSL3_DETECTED" -eq "0" ]; then
-osslconf="$tempdir/ossl.cnf"
-cat << EOF > "$osslconf"
-openssl_conf = openssl_init
+test_ossl_rsa_signing_engine()
+{
+  cnf="$tempdir/ossl.cnf"
+  cat << EOF > "$cnf"
+  openssl_conf = openssl_init
+
+  [openssl_init]
+  engines = engine_section
+
+  [engine_section]
+  pkcs11 = pkcs11_section
+
+  [pkcs11_section]
+  engine_id = pkcs11
+  MODULE_PATH = $modpath
+  init = 0
+EOF
+  if ! OPENSSL_CONF="$cnf" openssl engine -t -c pkcs11 >/dev/null 2>&1; then
+    echo "PKCS#11 engine unavailable, skipping engine tests..."
+    return
+  fi
+  OPENSSL_CONF="$cnf" \
+  openssl dgst -engine pkcs11 -keyform engine \
+          -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 \
+          -sign "$TOKENURL" -out "${tempdir}/sig" -passin pass:mynewuserpin \
+          "${tempdir}/data"
+
+  OPENSSL_CONF="$cnf" \
+  openssl pkeyutl -sign -engine pkcs11 -keyform engine \
+          -inkey "${TOKENURL}" -passin pass:mynewuserpin \
+          -in "${tempdir}/data" -out "${tempdir}/sig"
+}
 
-[openssl_init]
-engines = engine_section
+test_ossl_rsa_signing_provider()
+{
+  pushd $TPM2_PKCS11_STORE
 
-[engine_section]
-pkcs11 = pkcs11_section
+  clear_asan
 
-[pkcs11_section]
-engine_id = pkcs11
-MODULE_PATH = $modpath
-init = 0
-EOF
-export OPENSSL_CONF="$osslconf"
-openssl dgst -engine pkcs11 -keyform engine \
-        -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 \
-        -sign "$TOKENURL" -out ${tempdir}/sig -passin pass:mynewuserpin ${tempdir}/data
-
-openssl pkeyutl -sign -engine pkcs11 -keyform engine \
-        -inkey ${TOKENURL} -passin pass:mynewuserpin \
-        -in ${tempdir}/data -out ${tempdir}/sig
-else #end openssl < 3.0
+  yaml_myrsakey=$(HOME=${OLD_HOME} tpm2_ptool export --label=mynewtoken --userpin=mynewuserpin --key-label=myrsakey --path=$TPM2_PKCS11_STORE)
+  popd
 
-pushd $TPM2_PKCS11_STORE
+  auth_myrsakey=$(echo "$yaml_myrsakey" | grep "object-auth" | cut -d' ' -f2-)
 
-clear_asan
+  setup_asan
 
-yaml_myrsakey=$(HOME=${OLD_HOME} tpm2_ptool export --label=mynewtoken --userpin=mynewuserpin --key-label=myrsakey --path=$TPM2_PKCS11_STORE)
-popd
+  openssl dgst -provider tpm2 -provider default \
+          -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 \
+          -sign "$TPM2_PKCS11_STORE/myrsakey.pem" -out ${tempdir}/sig -passin "pass:$auth_myrsakey" ${tempdir}/data
 
-auth_myrsakey=$(echo "$yaml_myrsakey" | grep "object-auth" | cut -d' ' -f2-)
+  openssl pkeyutl -sign -provider tpm2 -provider base -rawin -digest sha256 \
+          -inkey "$TPM2_PKCS11_STORE/myrsakey.pem" -passin "pass:$auth_myrsakey" \
+          -in ${tempdir}/data -out ${tempdir}/sig
+}
 
-setup_asan
+test_ossl_ecc_signing_engine()
+{
+  cnf="$tempdir/ossl.cnf"
+  cat << EOF > "$cnf"
+  openssl_conf = openssl_init
 
-openssl dgst -provider tpm2 -provider default \
-        -sha256 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-1 \
-        -sign "$TPM2_PKCS11_STORE/myrsakey.pem" -out ${tempdir}/sig -passin "pass:$auth_myrsakey" ${tempdir}/data
+  [openssl_init]
+  engines = engine_section
 
-openssl pkeyutl -sign -provider tpm2 -provider base -rawin -digest sha256 \
-        -inkey "$TPM2_PKCS11_STORE/myrsakey.pem" -passin "pass:$auth_myrsakey" \
-        -in ${tempdir}/data -out ${tempdir}/sig
-fi 
+  [engine_section]
+  pkcs11 = pkcs11_section
 
-echo "RSA Signing tested"
+  [pkcs11_section]
+  engine_id = pkcs11
+  MODULE_PATH = $modpath
+  init = 0
+EOF
+  if ! OPENSSL_CONF="$cnf" openssl engine -t -c pkcs11 >/dev/null 2>&1; then
+    echo "PKCS#11 engine unavailable, skipping engine tests..."
+    return
+  fi
+  ECC_KEY_URL="${TOKENURL2};object=myecckey;type=private"
+  OPENSSL_CONF="$cnf" \
+  openssl dgst -engine pkcs11 -keyform engine -sha1 -sign "$ECC_KEY_URL" \
+          -out ${tempdir}/sig -passin pass:mynewuserpin "${tempdir}/data"
+
+  OPENSSL_CONF="$cnf" \
+  openssl dgst -sha1 -verify "${tempdir}/eccpubkey.pem" \
+               -signature "${tempdir}/sig" "${tempdir}/data"
+}
 
-echo "Test ECC Signing"
-if [ "$OSSL3_DETECTED" -eq "0" ]; then
+test_ossl_ecc_signing_provider()
+{
+  pushd $TPM2_PKCS11_STORE
 
-    ECC_KEY_URL="${TOKENURL2};object=myecckey;type=private"
-    openssl dgst -engine pkcs11 -keyform engine -sha1 -sign "$ECC_KEY_URL" -out ${tempdir}/sig -passin pass:mynewuserpin ${tempdir}/data
-    openssl dgst -sha1 -verify ${tempdir}/eccpubkey.pem -signature ${tempdir}/sig ${tempdir}/data
-else # openssl 3
+  clear_asan
 
-pushd $TPM2_PKCS11_STORE
+  yaml_myecckey=$(HOME=${OLD_HOME} tpm2_ptool export --label=mynewtoken2 \
+                                              --userpin=mynewuserpin \
+                                              --key-label=myecckey \
+                                              --path=$TPM2_PKCS11_STORE)
+  popd
 
-clear_asan
+  auth_myecckey=$(echo "$yaml_myecckey" | grep "object-auth" | cut -d' ' -f2-)
 
-yaml_myecckey=$(HOME=${OLD_HOME} tpm2_ptool export --label=mynewtoken2 --userpin=mynewuserpin --key-label=myecckey --path=$TPM2_PKCS11_STORE)
-popd
+  setup_asan
 
-auth_myecckey=$(echo "$yaml_myecckey" | grep "object-auth" | cut -d' ' -f2-)
+  openssl dgst -provider tpm2 -provider default -sha1 \
+          -sign "$TPM2_PKCS11_STORE/myecckey.pem" -out "${tempdir}/sig" \
+          -passin "pass:$auth_myecckey" "${tempdir}/data"
 
-setup_asan
+  openssl dgst -sha1 -verify "${tempdir}/eccpubkey.pem" \
+          -signature "${tempdir}/sig" "${tempdir}/data"
+}
 
-openssl dgst -provider tpm2 -provider default \
-  -sha1 -sign "$TPM2_PKCS11_STORE/myecckey.pem" -out ${tempdir}/sig -passin "pass:$auth_myecckey" ${tempdir}/data
 
-openssl dgst -sha1 -verify ${tempdir}/eccpubkey.pem -signature ${tempdir}/sig ${tempdir}/data
+echo "Testing signing via openssl"
+if [ "$OSSL3_DETECTED" -eq "0" ]; then
+  test_ossl_rsa_signing_engine
+else #end openssl < 3.0
+  test_ossl_rsa_signing_engine
+  test_ossl_rsa_signing_provider
+fi
+
+echo "RSA Signing tested"
 
+echo "Test ECC Signing"
+if [ "$OSSL3_DETECTED" -eq "0" ]; then
+  test_ossl_ecc_signing_engine
+else # openssl 3
+  test_ossl_ecc_signing_engine
+  test_ossl_ecc_signing_provider
 fi
 echo "ECC Signing tested"
 

test/integration/ptool-link.sh.nosetup

@@ -98,15 +98,16 @@ pid=$(tpm2_ptool init --primary-handle="$handle" --path=$TPM2_PKCS11_STORE | gre
 # Create a token using that pid
 tpm2_ptool addtoken --pid="$pid" --label=linktoken --sopin=mysopin --userpin=myuserpin \
     --path=$TPM2_PKCS11_STORE
-
-if [ "$OSSL3_DETECTED" -eq "0" ]; then
+if ossl_engine_supported tpm2tss "$TEST_FIXTURES/tss2engine.cnf"; then
   # Set up the engine for the tpm2tss-genkey tool both for future and older ways of doing it
   engdir="$(pkg-config --variable=enginesdir libcrypto)"
   if [ -z "$engdir" ]; then
     export OPENSSL_ENGINES=/usr/local/lib/engines
   fi
   tpm2tss_genkey -P"$handle" -a rsa -s 2048 "$tempdir/tss2-rsa-2048.pem"
-else
+fi
+
+if [ "$OSSL3_DETECTED" -eq "1" ]; then
   openssl genpkey -provider tpm2 -provider default -propquery 'provider=tpm2' \
     -algorithm RSA -pkeyopt "parent:$handle" -pkeyopt bits:2048 -out "$tempdir/tss2-rsa-2048.pem"
 fi
@@ -125,9 +126,11 @@ pid=$(tpm2_ptool init --transient-parent="tss2-engine-key" --path=$TPM2_PKCS11_S
 tpm2_ptool addtoken --pid="$pid" --label=linktokentransient --sopin=mysopin --userpin=myuserpin \
     --path=$TPM2_PKCS11_STORE
 
-if [ "$OSSL3_DETECTED" -eq "0" ]; then
+if ossl_engine_supported tpm2tss "$TEST_FIXTURES/tss2engine.cnf"; then
   tpm2tss_genkey "$tempdir/tss2-rsa-2048-transient.pem"
-else
+fi
+
+if [ "$OSSL3_DETECTED" -eq "1" ]; then
   openssl genpkey -provider tpm2 -provider default -propquery 'provider=tpm2' \
     -algorithm RSA -pkeyopt bits:2048 -out "$tempdir/tss2-rsa-2048-transient.pem"
 fi
@@ -149,9 +152,10 @@ pid=$(tpm2_ptool init --transient-parent="tss2-engine-key" --hierarchy-auth=newp
 tpm2_ptool addtoken --hierarchy-auth=newpass --pid="$pid" --label=linktokentransient --sopin=mysopin --userpin=myuserpin \
     --path=$TPM2_PKCS11_STORE
 
-if [ "$OSSL3_DETECTED" -eq "0" ]; then
+if ossl_engine_supported tpm2tss "$TEST_FIXTURES/tss2engine.cnf"; then
   tpm2tss_genkey -o newpass "$tempdir/tss2-rsa-2048-transient.pem"
-else
+fi
+if [ "$OSSL3_DETECTED" -eq "1" ]; then
   openssl genpkey -provider tpm2 -provider default -propquery 'provider=tpm2' \
     -algorithm RSA -pkeyopt "parent-auth:newpass" -pkeyopt bits:2048 -out "$tempdir/tss2-rsa-2048-transient.pem"
 fi