cryptsetup: add libcryptsetup TPM2 PIN support

This is unfinished: we don't have any way to actually query for PINs
interactively this way. It is similar to FIDO2 and PKCS#11 in this
regard.

Nonetheless, this code is capable of validating and dumping tokens, so
it is already useful as-is.

3 files changed, 51 insertions, 5 deletions

diff --git a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
index e2d28a5dda..23df974999 100644
--- a/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
+++ b/src/cryptsetup/cryptsetup-tokens/cryptsetup-token-systemd-tpm2.c
@@ -6,8 +6,10 @@
 #include "cryptsetup-token.h"
 #include "cryptsetup-token-util.h"
 #include "hexdecoct.h"
+#include "json.h"
 #include "luks2-tpm2.h"
 #include "memory-util.h"
+#include "strv.h"
 #include "tpm2-util.h"
 #include "version.h"
 
@@ -78,7 +80,8 @@ _public_ int cryptsetup_token_open(
         if (usrptr)
                 params = *(systemd_tpm2_plugin_params *)usrptr;
 
-        r = parse_luks2_tpm2_data(json, params.search_pcr_mask, &pcr_mask, &pcr_bank, &primary_alg, &base64_blob, &hex_policy_hash);
+        TPM2Flags flags = 0;
+        r = parse_luks2_tpm2_data(json, params.search_pcr_mask, &pcr_mask, &pcr_bank, &primary_alg, &base64_blob, &hex_policy_hash, &flags);
         if (r < 0)
                 return log_debug_open_error(cd, r);
 
@@ -101,6 +104,7 @@ _public_ int cryptsetup_token_open(
                         blob_size,
                         policy_hash,
                         policy_hash_size,
+                        flags,
                         &decrypted_key,
                         &decrypted_key_size);
         if (r < 0)
@@ -135,6 +139,7 @@ _public_ void cryptsetup_token_dump(
                 const char *json /* validated 'systemd-tpm2' token if cryptsetup_token_validate is defined */) {
 
         int r;
+        TPM2Flags flags = 0;
         uint32_t pcr_mask;
         uint16_t pcr_bank, primary_alg;
         size_t decoded_blob_size;
@@ -144,7 +149,7 @@ _public_ void cryptsetup_token_dump(
 
         assert(json);
 
-        r = parse_luks2_tpm2_data(json, UINT32_MAX, &pcr_mask, &pcr_bank, &primary_alg, &base64_blob, &hex_policy_hash);
+        r = parse_luks2_tpm2_data(json, UINT32_MAX, &pcr_mask, &pcr_bank, &primary_alg, &base64_blob, &hex_policy_hash, &flags);
         if (r < 0)
                 return (void) crypt_log_debug_errno(cd, r, "Failed to parse " TOKEN_NAME " metadata: %m.");
 
@@ -171,6 +176,7 @@ _public_ void cryptsetup_token_dump(
         crypt_log(cd, "\ttpm2-primary-alg:  %s\n", strna(tpm2_primary_alg_to_string(primary_alg)));
         crypt_log(cd, "\ttpm2-blob:  %s\n", blob_str);
         crypt_log(cd, "\ttpm2-policy-hash:" CRYPT_DUMP_LINE_SEP "%s\n", policy_hash_str);
+        crypt_log(cd, "\ttpm2-pin: %s\n", true_false(flags & TPM2_FLAGS_USE_PIN));
 }
 
 /*
@@ -268,5 +274,13 @@ _public_ int cryptsetup_token_validate(
         if (r < 0)
                 return crypt_log_debug_errno(cd, r, "Invalid base64 data in 'tpm2-policy-hash' field: %m");
 
+        w = json_variant_by_key(v, "tpm2-pin");
+        if (w) {
+                if (!json_variant_is_boolean(w)) {
+                        crypt_log_debug(cd, "TPM2 PIN policy is not a boolean.");
+                        return 1;
+                }
+        }
+
         return 0;
 }
diff --git a/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c b/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c
index de189c7bed..0d6e4bc0f8 100644
--- a/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c
+++ b/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c
@@ -1,11 +1,15 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "alloc-util.h"
+#include "ask-password-api.h"
+#include "env-util.h"
 #include "hexdecoct.h"
 #include "json.h"
+#include "log.h"
 #include "luks2-tpm2.h"
 #include "parse-util.h"
 #include "random-util.h"
+#include "strv.h"
 #include "tpm2-util.h"
 
 int acquire_luks2_key(
@@ -17,10 +21,12 @@ int acquire_luks2_key(
                 size_t key_data_size,
                 const void *policy_hash,
                 size_t policy_hash_size,
+                TPM2Flags flags,
                 void **ret_decrypted_key,
                 size_t *ret_decrypted_key_size) {
 
         _cleanup_free_ char *auto_device = NULL;
+        _cleanup_(erase_and_freep) char *pin_str = NULL;
         int r;
 
         assert(ret_decrypted_key);
@@ -36,12 +42,22 @@ int acquire_luks2_key(
                 device = auto_device;
         }
 
+        r = getenv_steal_erase("PIN", &pin_str);
+        if (r < 0)
+                return log_error_errno(r, "Failed to acquire PIN from environment: %m");
+        if (!r) {
+                /* PIN entry is not supported by plugin, let it fallback, possibly to sd-cryptsetup's
+                 * internal handling. */
+                if (flags & TPM2_FLAGS_USE_PIN)
+                        return -EOPNOTSUPP;
+        }
+
         return tpm2_unseal(
                         device,
                         pcr_mask, pcr_bank,
                         primary_alg,
                         key_data, key_data_size,
-                        policy_hash, policy_hash_size, NULL,
+                        policy_hash, policy_hash_size, pin_str,
                         ret_decrypted_key, ret_decrypted_key_size);
 }
 
@@ -53,7 +69,8 @@ int parse_luks2_tpm2_data(
                 uint16_t *ret_pcr_bank,
                 uint16_t *ret_primary_alg,
                 char **ret_base64_blob,
-                char **ret_hex_policy_hash) {
+                char **ret_hex_policy_hash,
+                TPM2Flags *ret_flags) {
 
         int r;
         JsonVariant *w, *e;
@@ -61,6 +78,7 @@ int parse_luks2_tpm2_data(
         uint16_t pcr_bank = UINT16_MAX, primary_alg = TPM2_ALG_ECC;
         _cleanup_free_ char *base64_blob = NULL, *hex_policy_hash = NULL;
         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
+        TPM2Flags flags = 0;
 
         assert(json);
         assert(ret_pcr_mask);
@@ -138,11 +156,21 @@ int parse_luks2_tpm2_data(
         if (!hex_policy_hash)
                 return -ENOMEM;
 
+        w = json_variant_by_key(v, "tpm2-pin");
+        if (w) {
+                if (!json_variant_is_boolean(w))
+                        return -EINVAL;
+
+                if (json_variant_boolean(w))
+                        flags |= TPM2_FLAGS_USE_PIN;
+        }
+
         *ret_pcr_mask = pcr_mask;
         *ret_pcr_bank = pcr_bank;
         *ret_primary_alg = primary_alg;
         *ret_base64_blob = TAKE_PTR(base64_blob);
         *ret_hex_policy_hash = TAKE_PTR(hex_policy_hash);
+        *ret_flags = flags;
 
         return 0;
 }
diff --git a/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.h b/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.h
index 0c93ea82cc..34c93216ee 100644
--- a/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.h
+++ b/src/cryptsetup/cryptsetup-tokens/luks2-tpm2.h
@@ -2,6 +2,8 @@
 
 #pragma once
 
+#include "tpm2-util.h"
+
 struct crypt_device;
 
 int acquire_luks2_key(
@@ -13,6 +15,7 @@ int acquire_luks2_key(
                 size_t key_data_size,
                 const void *policy_hash,
                 size_t policy_hash_size,
+                TPM2Flags flags,
                 void **ret_decrypted_key,
                 size_t *ret_decrypted_key_size);
 
@@ -23,4 +26,5 @@ int parse_luks2_tpm2_data(
                 uint16_t *ret_pcr_bank,
                 uint16_t *ret_primary_alg,
                 char **ret_base64_blob,
-                char **ret_hex_policy_hash);
+                char **ret_hex_policy_hash,
+                TPM2Flags *ret_flags);