Support LibreSSL

.ci/docker.run

@@ -73,14 +73,14 @@ if ldconfig -p 2>/dev/null| grep libasan > /dev/null && ldconfig -p 2>/dev/null|
 fi
 
 if [ "$SCANBUILD" == "yes" ]; then
-  scan-build --status-bugs ../configure --enable-unit --enable-self-generated-certificate --enable-integration --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
+  scan-build --status-bugs ../configure --enable-unit --enable-integration --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
 elif [ "$CC" == "clang" ]; then
-  ../configure --enable-unit --enable-self-generated-certificate  --enable-integration --with-maxloglevel=none --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
+  ../configure --enable-unit  --enable-integration --with-maxloglevel=none --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
 else
   if [ "$WITH_TCTI" == "mssim" ]; then
-    ../configure $SANITIZER_OPTION --disable-tcti-swtpm --enable-unit --enable-self-generated-certificate --enable-integration --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
+    ../configure $SANITIZER_OPTION --disable-tcti-swtpm --enable-unit --enable-integration --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
   else
-    ../configure $SANITIZER_OPTION --with-maxloglevel=none --enable-debug=yes --enable-unit --enable-self-generated-certificate --enable-integration --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
+    ../configure $SANITIZER_OPTION --with-maxloglevel=none --enable-debug=yes --enable-unit --enable-integration --with-crypto=$WITH_CRYPTO $CONFIGURE_OPTIONS
   fi
 fi
 
@@ -100,34 +100,34 @@ pushd ./config_test
 if [ "$CC" == "gcc" ]; then
   # No TCTI - expect to fail
   echo "========================== START TEST - NO TCTI =========================="
-  (../configure --disable-doxygen-doc --enable-unit --enable-self-generated-certificate --enable-integration --disable-tcti-swtpm --disable-tcti-mssim --disable-tcti-device && exit 1) || echo "failed as expected";
+  (../configure --disable-doxygen-doc --enable-unit --enable-integration --disable-tcti-swtpm --disable-tcti-mssim --disable-tcti-device && exit 1) || echo "failed as expected";
   # only device TCTI
   echo "========================== START TEST - device TCTI =========================="
-  mkdir -p ./dev/tpm0 && ../configure --disable-doxygen-doc --enable-unit --enable-self-generated-certificate --enable-integration --disable-tcti-swtpm --disable-tcti-mssim --enable-tcti-device --with-device=./dev/tpm0
+  mkdir -p ./dev/tpm0 && ../configure --disable-doxygen-doc --enable-unit --enable-integration --disable-tcti-swtpm --disable-tcti-mssim --enable-tcti-device --with-device=./dev/tpm0
   make -j check TESTS="test/unit/tcti-device" && rm -rf ./dev
   # only mssim TCTI
   echo "========================== START TEST - mssim TCTI =========================="
-  ../configure --disable-doxygen-doc --enable-unit --enable-self-generated-certificate --enable-integration --disable-tcti-swtpm --enable-tcti-mssim --disable-tcti-device
+  ../configure --disable-doxygen-doc --enable-unit --enable-integration --disable-tcti-swtpm --enable-tcti-mssim --disable-tcti-device
   make -j check TESTS="test/unit/tcti-mssim"
   # device and mssim TCTIs
   echo "========================== START TEST - mssim & device TCTI =========================="
-  ../configure --disable-doxygen-doc --enable-unit --enable-self-generated-certificate --enable-integration --disable-tcti-swtpm --enable-tcti-mssim --enable-tcti-device
+  ../configure --disable-doxygen-doc --enable-unit --enable-integration --disable-tcti-swtpm --enable-tcti-mssim --enable-tcti-device
   make -j check TESTS="test/unit/tcti-device test/unit/tcti-mssim"
   # only swtmp TCTI
   echo "========================== START TEST - swtpm TCTI =========================="
-  ../configure --disable-doxygen-doc --enable-unit --enable-self-generated-certificate --enable-integration --enable-tcti-swtpm --disable-tcti-mssim --disable-tcti-device
+  ../configure --disable-doxygen-doc --enable-unit --enable-integration --enable-tcti-swtpm --disable-tcti-mssim --disable-tcti-device
   make -j check TESTS="test/unit/tcti-swtpm"
   # swtmp and device TCTIs
   echo "========================== START TEST - swtpm & device TCTI =========================="
-  ../configure --disable-doxygen-doc --enable-unit --enable-self-generated-certificate --enable-integration --enable-tcti-swtpm --disable-tcti-mssim --enable-tcti-device
+  ../configure --disable-doxygen-doc --enable-unit --enable-integration --enable-tcti-swtpm --disable-tcti-mssim --enable-tcti-device
   make -j check TESTS="test/unit/tcti-swtpm test/unit/tcti-device"
   # swtmp and mssim TCTIs
   echo "========================== START TEST - swtpm & mssim TCTI =========================="
-  ../configure --disable-doxygen-doc --enable-unit --enable-self-generated-certificate --enable-integration --enable-tcti-swtpm --enable-tcti-mssim --disable-tcti-device
+  ../configure --disable-doxygen-doc --enable-unit --enable-integration --enable-tcti-swtpm --enable-tcti-mssim --disable-tcti-device
   make -j check TESTS="test/unit/tcti-swtpm test/unit/tcti-mssim"
   # all TCTIs
   echo "========================== START TEST - swtpm & mssim & device TCTI =========================="
-  ../configure --disable-doxygen-doc --enable-unit --enable-self-generated-certificate --enable-integration --enable-tcti-swtpm --enable-tcti-mssim --enable-tcti-device
+  ../configure --disable-doxygen-doc --enable-unit --enable-integration --enable-tcti-swtpm --enable-tcti-mssim --enable-tcti-device
   make -j check TESTS="test/unit/tcti-swtpm test/unit/tcti-mssim test/unit/tcti-device"
 fi # CC == gcc
 popd

.cirrus.yml

@@ -27,5 +27,5 @@ task:
     - cd - && rm -fr libusb
   script:
     ./bootstrap &&
-    ./configure --enable-self-generated-certificate --enable-unit=yes --enable-integration=yes --with-crypto=ossl --disable-doxygen-doc --enable-tcti-swtpm=no --enable-tcti-libtpms=no --enable-tcti-mssim=yes --disable-dependency-tracking &&
+    ./configure --enable-unit=yes --enable-integration=yes --with-crypto=ossl --disable-doxygen-doc --enable-tcti-swtpm=no --enable-tcti-libtpms=no --enable-tcti-mssim=yes --disable-dependency-tracking &&
     gmake -j distcheck || { cat /tmp/cirrus-ci-build/tpm2-tss-*/_build/sub/test-suite.log; exit 1; }

.github/workflows/main.yml

@@ -85,6 +85,27 @@ jobs:
       - name: failure
         if: ${{ failure() }}
         run: cat $(find ../ -name test-suite.log) || true
+  test-libressl:
+    runs-on: ubuntu-latest
+    if: "!contains(github.ref, 'coverity_scan')"
+    strategy:
+      matrix:
+        docker_image: [fedora-34-libressl]
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v2
+        with:
+            fetch-depth: 0
+      - name: Launch Action
+        uses:
+          tpm2-software/ci/runCI@main
+        with:
+          CC: gcc
+          DOCKER_IMAGE: ${{ matrix.docker_image }}
+          PROJECT_NAME: ${{ github.event.repository.name }}
+      - name: failure
+        if: ${{ failure() }}
+        run: cat $(find ../ -name test-suite.log) || true
   test-no-crypto-build:
     runs-on: ubuntu-latest
     if: "!contains(github.ref, 'coverity_scan')"

src/tss2-esys/esys_crypto_ossl.c

@@ -392,7 +392,8 @@ iesys_cryptossl_hmac_start(ESYS_CRYPTO_CONTEXT_BLOB ** context,
                    "Error EVP_MD_CTX_create", cleanup);
     }
 
-#if OPENSSL_VERSION_NUMBER < 0x10101000L
+#if OPENSSL_VERSION_NUMBER < 0x10101000L || \
+    ( defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x3070000fL )
     if (!(hkey = EVP_PKEY_new_mac_key(EVP_PKEY_HMAC, NULL, key, size))) {
 #else
     /* this is preferred, but available since OpenSSL 1.1.1 only */
@@ -558,7 +559,9 @@ iesys_cryptossl_random2b(
     int rc;
 #if OPENSSL_VERSION_NUMBER < 0x30000000L
     const RAND_METHOD *rand_save = RAND_get_rand_method();
+#ifndef LIBRESSL_VERSION_NUMBER
     RAND_set_rand_method(RAND_OpenSSL());
+#endif
 #else
     OSSL_LIB_CTX *libctx = OSSL_LIB_CTX_new();
     if (!libctx)
@@ -615,8 +618,9 @@ iesys_cryptossl_pk_encrypt(TPM2B_PUBLIC * pub_tpm_key,
     RSA *rsa_key = NULL;
     const EVP_MD * hashAlg = NULL;
     const RAND_METHOD *rand_save = RAND_get_rand_method();
-
+#ifndef LIBRESSL_VERSION_NUMBER
     RAND_set_rand_method(RAND_OpenSSL());
+#endif
 #else
     OSSL_LIB_CTX *libctx = NULL;
     EVP_MD * hashAlg = NULL;

test/integration/fapi-provisioning-with-template.int.c

@@ -4,6 +4,8 @@
 #endif
 
 #include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
 
 #include "tss2_esys.h"
 #include "tss2_fapi.h"
@@ -31,6 +33,39 @@
  * @retval EXIT_SKIP
  *
  */
+static bool
+fapi_ek_certless()
+{
+    FILE *stream = NULL;
+    long config_size;
+    char *config = NULL;
+    char *fapi_config_file = getenv("TSS2_FAPICONF");
+
+    stream = fopen(fapi_config_file, "r");
+    if (!stream) {
+        LOG_ERROR("File %s does not exist", fapi_config_file);
+        return NULL;
+    }
+    fseek(stream, 0L, SEEK_END);
+    config_size = ftell(stream);
+    fclose(stream);
+    config = malloc(config_size + 1);
+    stream = fopen(fapi_config_file, "r");
+    ssize_t ret = read(fileno(stream), config, config_size);
+    if (ret != config_size) {
+        LOG_ERROR("IO error %s.", fapi_config_file);
+        return NULL;
+    }
+    config[config_size] = '\0';
+    if (strstr(config, "\"ek_cert_less\": \"yes\"") == NULL) {
+        SAFE_FREE(config);
+        return false;
+    } else {
+        SAFE_FREE(config);
+        return true;
+    }
+}
+
 int
 test_fapi_provision_template(FAPI_CONTEXT *context)
 {
@@ -148,6 +183,9 @@ test_fapi_provision_template(FAPI_CONTEXT *context)
     TPM2B_AUTH auth = { .size = 0, .buffer = {} };
     TPM2B_MAX_NV_BUFFER nv_data;
 
+    if (fapi_ek_certless())
+        return EXIT_SKIP;
+
     if (strcmp(FAPI_PROFILE, "P_ECC") == 0) {
         nv_template_idx = ecc_nv_template_idx;
         nv_nonce_idx = ecc_nv_nonce_idx;
@@ -166,7 +204,7 @@ test_fapi_provision_template(FAPI_CONTEXT *context)
     r = Esys_Initialize(&esys_ctx, tcti, NULL);
     goto_if_error(r, "Error Esys_Initialize", error);
 
-     /*
+    /*
      * Store template (marshaled TPMT_PUBLIC) in NV ram.
      */
     r = Tss2_MU_TPMT_PUBLIC_Marshal(&in_public, &nv_data.buffer[0],