denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Defined functional components within ITA namespace

Browse Source 
Implemented handling of functional components evidence request/response
This commit is contained in:
Sansar Choinyambuu
2011-11-28 14:39:53 +01:00
committed by Andreas Steffen
parent 19fa287f6e
commit 2aa28b164e
11 changed files with 284 additions and 221 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libpts/pts/pts.c
+13 -30
View File
@@ -27,10 +27,6 @@
#include <sys/utsname.h>
#include <errno.h>
#include <openssl/rsa.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
#define PTS_BUF_SIZE 4096
typedef struct private_pts_t private_pts_t;
@@ -249,7 +245,7 @@ METHOD(pts_t, calculate_secret, bool,
DBG1(DBG_PTS, "shared DH secret computation failed");
return FALSE;
}
DBG4(DBG_PTS, "shared DH secret: %B", &shared_secret);
DBG3(DBG_PTS, "shared DH secret: %B", &shared_secret);
/* Calculate the secret assessment value */
hash_alg = pts_meas_algo_to_hash(this->dh_hash_algorithm);
@@ -269,7 +265,7 @@ METHOD(pts_t, calculate_secret, bool,
* argument of the TPM Quote command
*/
this->secret.len = min(this->secret.len, 20);
DBG4(DBG_PTS, "secret assessment value: %B", &this->secret);
DBG3(DBG_PTS, "secret assessment value: %B", &this->secret);
return TRUE;
}
@@ -899,6 +895,9 @@ METHOD(pts_t, quote_tpm, bool,
*pcr_composite = chunk_clone(*pcr_composite);
DBG3(DBG_PTS, "Hash of PCR Composite: %B",pcr_composite);
chunk_t tmp = chunk_create(valData.rgbData, valData.ulDataLength);
DBG3(DBG_PTS, "TPM Quote Info: %B",&tmp);
quote_sign = chunk_alloc(valData.ulValidationDataLength);
memcpy(quote_sign.ptr, valData.rgbValidationData,
valData.ulValidationDataLength);
@@ -931,20 +930,6 @@ METHOD(pts_t, quote_tpm, bool,
return FALSE;
}
/**
* Comparison function for pcr_entry_t struct
*/
static int pcr_entry_compare(const pcr_entry_t *a, const pcr_entry_t *b)
{
return (a->pcr_number - b->pcr_number);
}
static int pcr_entry_compare_qsort(const void *a, const void *b)
{
return pcr_entry_compare(*(const pcr_entry_t *const *)a
, *(const pcr_entry_t *const *)b);
}
METHOD(pts_t, add_pcr_entry, void,
private_pts_t *this, pcr_entry_t *new)
{
@@ -961,7 +946,7 @@ METHOD(pts_t, add_pcr_entry, void,
{
if (entry->pcr_number == new->pcr_number)
{
DBG4(DBG_PTS, "updating already added PCR%d value",
DBG3(DBG_PTS, "updating already added PCR%d value",
entry->pcr_number);
this->pcrs->remove_at(this->pcrs, e);
free(entry);
@@ -969,11 +954,7 @@ METHOD(pts_t, add_pcr_entry, void,
}
}
DESTROY_IF(e);
this->pcrs->insert_last(this->pcrs, new);
qsort(this->pcrs, this->pcrs->get_count(this->pcrs),
sizeof(pcr_entry_t *), pcr_entry_compare_qsort);
}
/**
@@ -1023,7 +1004,7 @@ METHOD(pts_t, get_quote_info, bool,
pcr_composite_len = 2 + PCR_MASK_LEN + 4 +
this->pcrs->get_count(this->pcrs) * PCR_LEN;
writer = bio_writer_create(pcr_composite_len);
/* Lenght of the bist mask field */
writer->write_uint16(writer, PCR_MASK_LEN);
@@ -1054,6 +1035,7 @@ METHOD(pts_t, get_quote_info, bool,
/* PCR Composite structure */
pcr_composite = chunk_clone(writer->get_buf(writer));
DBG3(DBG_PTS, "PCR Composite: %B", &pcr_composite);
writer->destroy(writer);
writer = bio_writer_create(TPM_QUOTE_INFO_LEN);
@@ -1079,13 +1061,13 @@ METHOD(pts_t, get_quote_info, bool,
/* Hash the PCR Composite Structure */
hasher->allocate_hash(hasher, pcr_composite, out_pcr_composite);
DBG4(DBG_PTS, "Hash of calculated PCR Composite: %B", out_pcr_composite);
DBG3(DBG_PTS, "Hash of calculated PCR Composite: %B", out_pcr_composite);
hasher->destroy(hasher);
}
else
{
*out_pcr_composite = chunk_clone(pcr_composite);
DBG4(DBG_PTS, "calculated PCR Composite: %B", out_pcr_composite);
DBG3(DBG_PTS, "calculated PCR Composite: %B", out_pcr_composite);
}
/* SHA1 hash of PCR Composite to construct TPM_QUOTE_INFO */
@@ -1109,7 +1091,7 @@ METHOD(pts_t, get_quote_info, bool,
writer->write_data(writer, this->secret);
/* TPM Quote Info */
*out_quote_info = chunk_clone(writer->get_buf(writer));
DBG4(DBG_PTS, "Calculated TPM Quote Info: %B", out_quote_info);
DBG3(DBG_PTS, "Calculated TPM Quote Info: %B", out_quote_info);
writer->destroy(writer);
return TRUE;
@@ -1127,7 +1109,8 @@ METHOD(pts_t, verify_quote_signature, bool,
return FALSE;
}
if (!aik_pub_key->verify(aik_pub_key, SIGN_RSA_SHA1, data, signature))
if (!aik_pub_key->verify(aik_pub_key, SIGN_RSA_EMSA_PKCS1_SHA1,
data, signature))
{
DBG1(DBG_PTS, "signature verification failed for TPM Quote Info");
DESTROY_IF(aik_pub_key);
src/libpts/pts/pts.h
+43 -1
View File
@@ -40,6 +40,43 @@ typedef struct pcr_entry_t pcr_entry_t;
#define SOLIDUS_UTF 0x2F
#define REVERSE_SOLIDUS_UTF 0x5C
/**
* PCR indices used for measurements of various functional components
*/
/** Commented the real PCR indices out, use just PCR16 for debugging
#define PCR_BIOS 0
#define PCR_PLATFORM_EXT 1
#define PCR_MOTHERBOARD 1
#define PCR_OPTION_ROMS 2
#define PCR_IPL 4
#define PCR_TBOOT_POLICY 17
#define PCR_TBOOT_MLE 18
#define PCR_TGRUB_MBR_STAGE1 4
#define PCR_TGRUB_STAGE2_PART1 8
#define PCR_TGRUB_STAGE2_PART2 9
#define PCR_TGRUB_CMD_LINE_ARGS 12
#define PCR_TGRUB_CHECKFILE 13
#define PCR_TGRUB_LOADED_FILES 14
*/
#define PCR_BIOS 16
#define PCR_PLATFORM_EXT 16
#define PCR_MOTHERBOARD 16
#define PCR_OPTION_ROMS 16
#define PCR_IPL 16
#define PCR_TBOOT_POLICY 16
#define PCR_TBOOT_MLE 16
#define PCR_TGRUB_MBR_STAGE1 16
#define PCR_TGRUB_STAGE2_PART1 16
#define PCR_TGRUB_STAGE2_PART2 16
#define PCR_TGRUB_CMD_LINE_ARGS 16
#define PCR_TGRUB_CHECKFILE 16
#define PCR_TGRUB_LOADED_FILES 16
/**
* Length of the generated nonce used for calculation of shared secret
*/
@@ -63,7 +100,12 @@ typedef struct pcr_entry_t pcr_entry_t;
/**
* Bitmask Lenght for PCR Composite structure
*/
#define PCR_MASK_LEN MAX_NUM_PCR / 8
#define PCR_MASK_LEN MAX_NUM_PCR/8
/**
* Hashing algorithm used by tboot and trustedGRUB
*/
#define TRUSTED_HASH_ALGO PTS_MEAS_ALGO_SHA1
/**
* PCR Entry structure which contains PCR number and current value
src/libpts/pts/pts_funct_comp_name.h
+39 -2
View File
@@ -23,6 +23,8 @@
typedef enum pts_funct_comp_type_t pts_funct_comp_type_t;
typedef enum pts_funct_comp_name_t pts_funct_comp_name_t;
typedef enum pts_ita_funct_comp_type_t pts_ita_funct_comp_type_t;
typedef enum pts_ita_funct_comp_name_t pts_ita_funct_comp_name_t;
typedef struct pts_qualifier_t pts_qualifier_t;
/**
@@ -34,7 +36,7 @@ enum pts_funct_comp_type_t {
/** Trusted Platform */
PTS_FUNC_COMP_TYPE_TRUSTED = 0x1,
/** Operating System */
PTS_FUNC_COMP_TYPE_OS = 0x2,
PTS_FUNC_COMP_TYPE_OS = 0x2,
/** Graphical User Interface */
PTS_FUNC_COMP_TYPE_GUI = 0x3,
/** Application */
@@ -69,13 +71,48 @@ enum pts_funct_comp_name_t {
PTS_FUNC_COMP_NAME_OPT_ROMS = 0x0006,
};
/**
* PTS Component Functional Type for Qualifier field in ITA namespace
*/
enum pts_ita_funct_comp_type_t {
/** Unknown */
PTS_ITA_FUNC_COMP_TYPE_UNKNOWN = 0x0,
/** Trusted Platform */
PTS_ITA_FUNC_COMP_TYPE_TRUSTED = 0x1,
/** All matching Components */
PTS_ITA_FUNC_COMP_TYPE_ALL = 0xF,
};
/**
* PTS Component Functional Name Binary Enumeration in ITA namespace
*/
enum pts_ita_funct_comp_name_t {
/** Components measured into PCR17 during tboot */
PTS_ITA_FUNC_COMP_NAME_TBOOT_POLICY = 0x0000,
/** Components measured into PCR18 during tboot */
PTS_ITA_FUNC_COMP_NAME_TBOOT_MLE = 0x0001,
/** MBR information and stage1 during boot by trustedGRUB */
PTS_ITA_FUNC_COMP_NAME_TGRUB_MBR_STAGE1 = 0x0002,
/** bootloader information stage2 part1 during boot by trustedGRUB */
PTS_ITA_FUNC_COMP_NAME_TGRUB_STAGE2_PART1 = 0x0003,
/** bootloader information stage2 part2 during boot by trustedGRUB */
PTS_ITA_FUNC_COMP_NAME_TGRUB_STAGE2_PART2 = 0x0004,
/** all commandline arguments from menu.lst and those entered in the shell
* during boot by trustedGRUB */
PTS_ITA_FUNC_COMP_NAME_TGRUB_CMD_LINE_ARGS = 0x0005,
/** all files checked via the checkfile-routine during boot by trustedGRUB */
PTS_ITA_FUNC_COMP_NAME_TGRUB_CHECKFILE = 0x0006,
/** all files which are actually loaded during boot by trustedGRUB */
PTS_ITA_FUNC_COMP_NAME_TGRUB_LOADED_FILES = 0x0007,
};
/**
* Qualifier for Functional Component
*/
struct pts_qualifier_t {
bool kernel;
bool sub_component;
pts_funct_comp_type_t type;
pts_ita_funct_comp_type_t type;
};
#endif /** PTS_FUNCT_COMP_NAME_H_ @}*/