--- /dev/null
+From 2fa8fedba0968d1c6d21d2c7fa33c903f8984815 Mon Sep 17 00:00:00 2001
+From: Jackie Huang <jackie.huang@windriver.com>
+Date: Thu, 25 Jul 2019 15:22:49 +0800
+Subject: [PATCH] haproxy tpm support
+
+original author: Kam Nasim <kam.nasim@windriver.com>
+
+rebased for 1.7.11
+
+Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
+---
+ include/types/global.h | 13 +++++
+ src/cfgparse.c | 28 ++++++++++
+ src/haproxy.c | 26 ++++++++-
+ src/ssl_sock.c | 147 +++++++++++++++++++++++++++++++++++++++++++------
+ 4 files changed, 197 insertions(+), 17 deletions(-)
+
+diff --git a/include/types/global.h b/include/types/global.h
+index 10f3a3c..68f2138 100644
+--- a/include/types/global.h
++++ b/include/types/global.h
+@@ -37,6 +37,10 @@
+ #include <import/51d.h>
+ #endif
+
++#ifdef USE_OPENSSL
++#include <openssl/engine.h>
++#endif
++
+ #ifndef UNIX_MAX_PATH
+ #define UNIX_MAX_PATH 108
+ #endif
+@@ -79,6 +83,14 @@ enum {
+ SSL_SERVER_VERIFY_REQUIRED = 1,
+ };
+
++// WRS: Define a new TPM configuration structure
++struct tpm_conf {
++ char *tpm_object;
++ char *tpm_engine;
++ EVP_PKEY *tpm_key;
++ ENGINE *tpm_engine_ref;
++};
++
+ /* FIXME : this will have to be redefined correctly */
+ struct global {
+ #ifdef USE_OPENSSL
+@@ -101,6 +113,7 @@ struct global {
+ char *connect_default_ciphers;
+ int listen_default_ssloptions;
+ int connect_default_ssloptions;
++ struct tpm_conf tpm; // tpm configuration
+ #endif
+ unsigned int ssl_server_verify; /* default verify mode on servers side */
+ struct freq_ctr conn_per_sec;
+diff --git a/src/cfgparse.c b/src/cfgparse.c
+index 3489f7e..0209874 100644
+--- a/src/cfgparse.c
++++ b/src/cfgparse.c
+@@ -1923,6 +1923,34 @@ int cfg_parse_global(const char *file, int linenum, char **args, int kwm)
+ env++;
+ }
+ }
++ else if (!strcmp(args[0], "tpm-object")) {
++ if (global.tpm.tpm_object) {
++ free(global.tpm.tpm_object);
++ }
++#ifdef USE_OPENSSL
++ if (*(args[1]) && (access(args[1], F_OK) != -1)) {
++ global.tpm.tpm_object = strdup(args[1]);
++ }
++#else
++ Alert("parsing [%s:%d] : '%s' is not implemented.\n", file, linenum, args[0]);
++ err_code |= ERR_ALERT | ERR_FATAL;
++ goto out;
++#endif
++ }
++ else if (!strcmp(args[0], "tpm-engine")) {
++ if (global.tpm.tpm_engine) {
++ free(global.tpm.tpm_engine);
++ }
++#ifdef USE_OPENSSL
++ if (*(args[1]) && (access(args[1], F_OK) != -1)) {
++ global.tpm.tpm_engine = strdup(args[1]);
++ }
++#else
++ Alert("parsing [%s:%d] : '%s' is not implemented.\n", file, linenum, args[0]);
++ err_code |= ERR_ALERT | ERR_FATAL;
++ goto out;
++#endif
++ }
+ else {
+ struct cfg_kw_list *kwl;
+ int index;
+diff --git a/src/haproxy.c b/src/haproxy.c
+index f8a0912..f61dacf 100644
+--- a/src/haproxy.c
++++ b/src/haproxy.c
+@@ -1370,6 +1370,24 @@ static void deinit_stick_rules(struct list *rules)
+ }
+ }
+
++static void deinit_tpm_engine()
++{
++ /*
++ * if the tpm engine is present then
++ * deinit it, this is needed to
++ * flush the TPM key handle from TPM memory
++ */
++ if (global.tpm.tpm_engine_ref) {
++ ENGINE_finish(global.tpm.tpm_engine_ref);
++ }
++
++ if (global.tpm.tpm_key) {
++ EVP_PKEY_free(global.tpm.tpm_key);
++ }
++ free(global.tpm.tpm_engine); global.tpm.tpm_engine = NULL;
++ free(global.tpm.tpm_object); global.tpm.tpm_object = NULL;
++}
++
+ void deinit(void)
+ {
+ struct proxy *p = proxy, *p0;
+@@ -1646,7 +1664,13 @@ void deinit(void)
+
+ free(uap);
+ }
+-
++
++ /* if HAProxy was in TPM mode then deinit
++ * that configuration as well.
++ */
++ if (global.tpm.tpm_object && global.tpm.tpm_object != '\0')
++ deinit_tpm_engine();
++
+ userlist_free(userlist);
+
+ cfg_unregister_sections();
+diff --git a/src/ssl_sock.c b/src/ssl_sock.c
+index 87b2584..44d0b48 100644
+--- a/src/ssl_sock.c
++++ b/src/ssl_sock.c
+@@ -51,6 +51,7 @@
+ #ifndef OPENSSL_NO_DH
+ #include <openssl/dh.h>
+ #endif
++#include <openssl/engine.h>
+
+ #include <import/lru.h>
+ #include <import/xxhash.h>
+@@ -2360,6 +2361,80 @@ end:
+ return ret;
+ }
+
++/*
++ * initialize the TPM engine and load the
++ * TPM object as private key within the Engine.
++ * Only do this for the first bind since TPM can
++ * only load 3-4 contexes before it runs out of memory
++ */
++static int ssl_sock_load_tpm_key(SSL_CTX *ctx, char **err) {
++ if (!global.tpm.tpm_object || global.tpm.tpm_object[0] == '\0') {
++ /* not in TPM mode */
++ return -1;
++ }
++ if (!global.tpm.tpm_key) {
++ Warning ("Could not find tpm_key; initializing engine\n");
++ /* no key present; load the dynamic TPM engine */
++ if (global.tpm.tpm_engine && global.tpm.tpm_engine[0]) {
++ ENGINE_load_dynamic();
++ ENGINE *engine = ENGINE_by_id("dynamic");
++ if (!engine) {
++ memprintf(err, "%s Unable to load the dynamic engine "
++ "(needed for loading custom TPM engine)\n",
++ err && *err ? *err : "");
++ return 1;
++ }
++
++ ENGINE_ctrl_cmd_string(engine, "SO_PATH", global.tpm.tpm_engine, 0);
++ ENGINE_ctrl_cmd_string(engine, "LOAD", NULL, 0);
++ /* stow away for ENGINE cleanup */
++ global.tpm.tpm_engine_ref = engine;
++
++ if (ENGINE_init(engine) != 1) {
++ const char *error_str = ERR_error_string(ERR_get_error(), NULL);
++ memprintf(err, "%s Unable to init the TPM engine (%s). Err: %s\n",
++ err && *err ? *err : "",
++ global.tpm.tpm_engine, error_str);
++ goto tpm_err;
++ }
++ EVP_PKEY *pkey = ENGINE_load_private_key(engine,
++ global.tpm.tpm_object,
++ NULL, NULL);
++ if (!pkey) {
++ const char *error_str = ERR_error_string(ERR_get_error(), NULL);
++ memprintf(err, "%s Unable to load TPM object (%s). Err: %s\n",
++ err && *err ? *err : "",
++ global.tpm.tpm_object, error_str);
++ goto tpm_err;
++ }
++ global.tpm.tpm_key = pkey;
++ }
++ else { /* no TPM engine found */
++ memprintf(err, "%s TPM engine option not set when TPM mode expected\n",
++ err && *err ? *err : "");
++ goto tpm_err;
++ }
++ }
++
++ if (SSL_CTX_use_PrivateKey(ctx, global.tpm.tpm_key) <= 0){
++ const char *error_str = ERR_error_string(ERR_get_error(),
++ NULL);
++ memprintf(err, "%s Invalid private key provided from TPM engine(%s). Err: %s\n",
++ err && *err ? *err : "",
++ global.tpm.tpm_object, error_str);
++ goto tpm_err;
++ }
++
++ return 0;
++
++tpm_err:
++ ENGINE_finish(global.tpm.tpm_engine_ref);
++ global.tpm.tpm_engine_ref = NULL;
++ EVP_PKEY_free(global.tpm.tpm_key);
++ global.tpm.tpm_key = NULL;
++ return 1;
++}
++
+ static int ssl_sock_load_cert_file(const char *path, struct bind_conf *bind_conf, struct proxy *curproxy, char **sni_filter, int fcount, char **err)
+ {
+ int ret;
+@@ -2372,26 +2447,54 @@ static int ssl_sock_load_cert_file(const char *path, struct bind_conf *bind_conf
+ return 1;
+ }
+
+- if (SSL_CTX_use_PrivateKey_file(ctx, path, SSL_FILETYPE_PEM) <= 0) {
+- memprintf(err, "%sunable to load SSL private key from PEM file '%s'.\n",
+- err && *err ? *err : "", path);
+- SSL_CTX_free(ctx);
+- return 1;
++ /* NOTE (knasim-wrs): US93721: TPM support
++ * This SSL context applies to SSL frontends only.
++ * If the TPM option is set then the Private key
++ * is stored in TPM.
++ *
++ * Launch the OpenSSL TPM engine and load the TPM
++ * Private Key. The Public key will still be located
++ * at the provided path and needs to be loaded as
++ * per usual.
++ */
++ if (global.tpm.tpm_object) {
++ ret = ssl_sock_load_tpm_key(ctx, err);
++ if (ret > 0) {
++ /* tpm configuration failed */
++ SSL_CTX_free(ctx);
++ return 1;
++ }
+ }
+-
+- ret = ssl_sock_load_cert_chain_file(ctx, path, bind_conf, sni_filter, fcount);
+- if (ret <= 0) {
+- memprintf(err, "%sunable to load SSL certificate from PEM file '%s'.\n",
+- err && *err ? *err : "", path);
+- if (ret < 0) /* serious error, must do that ourselves */
++ else { /* non TPM mode */
++ if (SSL_CTX_use_PrivateKey_file(ctx, path, SSL_FILETYPE_PEM) <= 0) {
++ memprintf(err, "%sunable to load SSL private key from PEM file '%s'.\n",
++ err && *err ? *err : "", path);
+ SSL_CTX_free(ctx);
+- return 1;
++ return 1;
++ }
+ }
+
+- if (SSL_CTX_check_private_key(ctx) <= 0) {
+- memprintf(err, "%sinconsistencies between private key and certificate loaded from PEM file '%s'.\n",
+- err && *err ? *err : "", path);
+- return 1;
++ ret = ssl_sock_load_cert_chain_file(ctx, path, bind_conf, sni_filter, fcount);
++ if (ret <= 0) {
++ memprintf(err, "%sunable to load SSL certificate from PEM file '%s'.\n",
++ err && *err ? *err : "", path);
++ if (ret < 0) /* serious error, must do that ourselves */
++ SSL_CTX_free(ctx);
++ return 1;
++ }
++
++ /*
++ * only match the private key to the public key
++ * for non TPM mode. This op would never work for
++ * TPM since the private key has been wrapped, whereas
++ * the public key is still the original one.
++ */
++ if (!global.tpm.tpm_object) {
++ if (SSL_CTX_check_private_key(ctx) <= 0) {
++ memprintf(err, "%sinconsistencies between private key and certificate loaded from PEM file '%s'.\n",
++ err && *err ? *err : "", path);
++ return 1;
++ }
+ }
+
+ /* we must not free the SSL_CTX anymore below, since it's already in
+@@ -3068,6 +3171,18 @@ int ssl_sock_prepare_srv_ctx(struct server *srv, struct proxy *curproxy)
+ cfgerr++;
+ return cfgerr;
+ }
++
++ /* NOTE (knasim-wrs): US93721: TPM support
++ * This SSL context applies to SSL backends only.
++ * Since Titanium backends don't support SSL, there
++ * is no need to offload these keys in TPM or reuse the
++ * same TPM key for the frontend engine.
++ *
++ * If SSL backends are to be supported in the future,
++ * over TPM, then create a new TPM Engine context and
++ * load the backend key in TPM, in a similar fashion to
++ * the frontend key.
++ */
+ if (srv->ssl_ctx.client_crt) {
+ if (SSL_CTX_use_PrivateKey_file(srv->ssl_ctx.ctx, srv->ssl_ctx.client_crt, SSL_FILETYPE_PEM) <= 0) {
+ Alert("config : %s '%s', server '%s': unable to load SSL private key from PEM file '%s'.\n",
+--
+2.7.4
+
Code Review / pti / rtp.git / blobdiff