tpm2-common: support loading public key only

Users are slightly perplexed when we ask for a password to read the
public part of the key, since there's no password protected
information in there.  This is because we implement only the private
key load, which always asks for a password if one is required.  This
can be fixed by implementing the engine load public key method.

Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

5 files changed, 48 insertions, 23 deletions

diff --git a/e_tpm2.c b/e_tpm2.c
index 3140a25..a18a6bd 100644
--- a/e_tpm2.c
+++ b/e_tpm2.c
@@ -114,7 +114,7 @@ void tpm2_bind_key_to_engine(EVP_PKEY *pkey, void *data)
 
 static int tpm2_engine_load_nvkey(ENGINE *e, EVP_PKEY **ppkey,
 				  TPM_HANDLE key,  UI_METHOD *ui,
-				  void *cb_data)
+				  void *cb_data, int public_only)
 {
 	TPMT_PUBLIC p;
 	TSS_CONTEXT *tssContext;
@@ -147,6 +147,9 @@ static int tpm2_engine_load_nvkey(ENGINE *e, EVP_PKEY **ppkey,
 	if (!pkey) {
 		fprintf(stderr, "Failed to allocate a new EVP_KEY\n");
 		goto err_del;
+	} else if (public_only) {
+		tpm2_delete(app_data);
+		goto out;
 	}
 	app_data->key = key;
 
@@ -182,6 +185,7 @@ static int tpm2_engine_load_nvkey(ENGINE *e, EVP_PKEY **ppkey,
 
 	tpm2_bind_key_to_engine(pkey, app_data);
 
+ out:
 	*ppkey = pkey;
 	TSS_Delete(tssContext);
 
@@ -197,7 +201,7 @@ static int tpm2_engine_load_nvkey(ENGINE *e, EVP_PKEY **ppkey,
 
 static int tpm2_engine_load_key_core(ENGINE *e, EVP_PKEY **ppkey,
 				     const char *key_id, UI_METHOD *ui,
-				     void *cb_data)
+				     void *cb_data, int public_only)
 {
 	EVP_PKEY *pkey;
 	const int nvkey_len = strlen(nvprefix);
@@ -217,15 +221,17 @@ static int tpm2_engine_load_key_core(ENGINE *e, EVP_PKEY **ppkey,
 			fprintf(stderr, "nvkey is not an NV index\n");
 			return 0;
 		}
-		return tpm2_engine_load_nvkey(e, ppkey, key, ui, cb_data);
+		return tpm2_engine_load_nvkey(e, ppkey, key, ui,
+					      cb_data, public_only);
 	}
 
 	rc = tpm2_load_engine_file(key_id, &app_data, &pkey, ui, cb_data,
-				   srk_auth, 1);
+				   srk_auth, 1, public_only);
 	if (!rc)
 		return 0;
 
-	tpm2_bind_key_to_engine(pkey, app_data);
+	if (!public_only)
+		tpm2_bind_key_to_engine(pkey, app_data);
 
 	*ppkey = pkey;
 	return 1;
@@ -238,7 +244,19 @@ static EVP_PKEY *tpm2_engine_load_key(ENGINE *e, const char *key_id,
 	EVP_PKEY *pkey;
 	int ret;
 
-	ret = tpm2_engine_load_key_core(e, &pkey, key_id, ui, cb);
+	ret = tpm2_engine_load_key_core(e, &pkey, key_id, ui, cb, 0);
+	if (ret == 1)
+		return pkey;
+	return NULL;
+}
+
+static EVP_PKEY *tpm2_engine_load_pubkey(ENGINE *e, const char *key_id,
+					 UI_METHOD *ui, void *cb)
+{
+	EVP_PKEY *pkey;
+	int ret;
+
+	ret = tpm2_engine_load_key_core(e, &pkey, key_id, ui, cb, 1);
 	if (ret == 1)
 		return pkey;
 	return NULL;
@@ -257,7 +275,7 @@ static int tpm2_bind_helper(ENGINE * e)
 	    !ENGINE_set_init_function(e, tpm2_engine_init) ||
 	    !ENGINE_set_finish_function(e, tpm2_engine_finish) ||
 	    !ENGINE_set_ctrl_function(e, tpm2_engine_ctrl) ||
-	    !ENGINE_set_load_pubkey_function(e, tpm2_engine_load_key) ||
+	    !ENGINE_set_load_pubkey_function(e, tpm2_engine_load_pubkey) ||
 	    !ENGINE_set_load_privkey_function(e, tpm2_engine_load_key) ||
 	    !ENGINE_set_cmd_defns(e, tpm2_cmd_defns) ||
 	    !tpm2_setup_ecc_methods() ||
diff --git a/load_tpm2_key.c b/load_tpm2_key.c
index defc1c4..4a31eb1 100644
--- a/load_tpm2_key.c
+++ b/load_tpm2_key.c
@@ -134,7 +134,7 @@ int main(int argc, char **argv)
 	}
 
 	ret = tpm2_load_engine_file(filename, &app_data, NULL, NULL, NULL,
-				    auth, 0);
+				    auth, 0, 0);
 	if (!ret) {
 		fprintf(stderr, "Failed to parse file %s\n", filename);
 		exit(1);
diff --git a/tpm2-common.c b/tpm2-common.c
index 9a57c53..37eb8d8 100644
--- a/tpm2-common.c
+++ b/tpm2-common.c
@@ -1356,7 +1356,8 @@ static int tpm2_engine_load_key_policy(struct app_data *app_data,
 
 int tpm2_load_engine_file(const char *filename, struct app_data **app_data,
 			  EVP_PKEY **ppkey, UI_METHOD *ui, void *cb_data,
-			  const char *srk_auth, int get_key_auth)
+			  const char *srk_auth, int get_key_auth,
+			  int public_only)
 {
 	BIO *bf;
 	TSSLOADABLE *tssl = NULL;
@@ -1481,6 +1482,19 @@ int tpm2_load_engine_file(const char *filename, struct app_data **app_data,
 	TPM2B_PUBLIC_Unmarshal(&iin.objectPublic, &buffer, &size, FALSE);
 	ad->name_alg = iin.objectPublic.publicArea.nameAlg;
 
+	/* create the new objects to return */
+	if (ppkey) {
+		*ppkey = tpm2_to_openssl_public(&iin.objectPublic.publicArea);
+		if (!*ppkey) {
+			fprintf(stderr, "Failed to allocate a new EVP_KEY\n");
+			goto err_free;
+		}
+		if (public_only) {
+			tpm2_delete(ad);
+			goto out;
+		}
+	}
+
 	if (strcmp(OID_importableKey, oid) == 0) {
 		TPM_HANDLE session;
 		TSS_CONTEXT *tssContext;
@@ -1542,7 +1556,7 @@ int tpm2_load_engine_file(const char *filename, struct app_data **app_data,
 		TSS_Delete(tssContext);
 		if (rc) {
 			tpm2_error(rc, reason);
-			goto err_free;
+			goto err_free_key;
 		}
 		buf = priv_2b.t.buffer;
 		size = sizeof(priv_2b.t.buffer);
@@ -1551,27 +1565,18 @@ int tpm2_load_engine_file(const char *filename, struct app_data **app_data,
 					  &buf, &size);
 		ad->priv = OPENSSL_malloc(written);
 		if (!ad->priv)
-			goto err_free;
+			goto err_free_key;
 		ad->priv_len = written;
 		memcpy(ad->priv, priv_2b.t.buffer, written);
 	} else {
 		ad->priv = OPENSSL_malloc(privkey->length);
 		if (!ad->priv)
-			goto err_free;
+			goto err_free_key;
 
 		ad->priv_len = privkey->length;
 		memcpy(ad->priv, privkey->data, ad->priv_len);
 	}
 
-	/* create the new objects to return */
-	if (ppkey) {
-		*ppkey = tpm2_to_openssl_public(&iin.objectPublic.publicArea);
-		if (!*ppkey) {
-			fprintf(stderr, "Failed to allocate a new EVP_KEY\n");
-			goto err_free;
-		}
-	}
-
 	if (empty_auth == 0 && get_key_auth) {
 		ad->auth = tpm2_get_auth(ui, "TPM Key Password: ", cb_data);
 		if (!ad->auth)
@@ -1585,6 +1590,7 @@ int tpm2_load_engine_file(const char *filename, struct app_data **app_data,
 	if (!tpm2_engine_load_key_policy(ad, policy))
 		goto err_free_key;
 
+ out:
 	TSSLOADABLE_free(tssl);
 	TSSPRIVKEY_free(tpk);
 
diff --git a/tpm2-common.h b/tpm2-common.h
index 6e2028f..ea37875 100644
--- a/tpm2-common.h
+++ b/tpm2-common.h
@@ -70,7 +70,8 @@ int tpm2_get_public_point(TPM2B_ECC_POINT *tpmpt, const EC_GROUP *group,
 			  const EC_POINT *pt);
 int tpm2_load_engine_file(const char *filename, struct app_data **app_data,
 			  EVP_PKEY **ppkey, UI_METHOD *ui, void *cb_data,
-			  const char *srk_auth, int get_key_auth);
+			  const char *srk_auth, int get_key_auth,
+			  int public_only);
 TPM_HANDLE tpm2_load_key(TSS_CONTEXT **tsscp, struct app_data *app_data,
 			 const char *srk_auth, uint32_t *psession);
 void tpm2_unload_key(TSS_CONTEXT *tssContext, TPM_HANDLE key);
diff --git a/unseal_tpm2_data.c b/unseal_tpm2_data.c
index 51f1246..1040288 100644
--- a/unseal_tpm2_data.c
+++ b/unseal_tpm2_data.c
@@ -136,7 +136,7 @@ int main(int argc, char **argv)
 
 	UI_method_set_reader(ui, ui_read);
 	rc = tpm2_load_engine_file(filename, &app_data, NULL,
-				   ui, pass, parent_auth, 1);
+				   ui, pass, parent_auth, 1, 0);
 	if (!rc) {
 		reason = "tpm2_engine_load_file";
 		rc = NOT_TPM_ERROR;