denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pts: Variable size PCR banks

Browse Source
This commit is contained in:
Andreas Steffen
2020-10-07 16:54:32 +02:00
parent 56de4dc596
commit 3ef5b23903
17 changed files with 430 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtpmtss/tpm_tss_tss2_v2.c
+83 -21
View File
@@ -35,6 +35,7 @@
#define LABEL "TPM 2.0 -"
#define PLATFORM_PCR 24
#define MAX_PCR_BANKS 4
typedef struct private_tpm_tss_tss2_t private_tpm_tss_tss2_t;
@@ -58,21 +59,31 @@ struct private_tpm_tss_tss2_t {
*/
TSS2_SYS_CONTEXT *sys_context;
/**
* Number of supported algorithms
*/
size_t supported_algs_count;
/**
* TPM version info
*/
chunk_t version_info;
/**
* Number of supported algorithms
*/
size_t supported_algs_count;
/**
* List of supported algorithms
*/
TPM2_ALG_ID supported_algs[TPM2_PT_ALGORITHM_SET];
/**
* Number of assigned PCR banks
*/
size_t assigned_pcrs_count;
/**
* List of assigned PCR banks
*/
TPM2_ALG_ID assigned_pcrs[MAX_PCR_BANKS];
/**
* Is TPM FIPS 186-4 compliant ?
*/
@@ -314,7 +325,7 @@ static bool get_algs_capability(private_tpm_tss_tss2_t *this)
this->mutex->unlock(this->mutex);
if (rval != TPM2_RC_SUCCESS)
{
DBG1(DBG_PTS, "%s GetCapability failed for TPM2_ECC_CURVES: 0x%06x",
DBG1(DBG_PTS, "%s GetCapability failed for TPM2_CAP_ECC_CURVES: 0x%06x",
LABEL, rval);
return FALSE;
}
@@ -337,6 +348,40 @@ static bool get_algs_capability(private_tpm_tss_tss2_t *this)
}
DBG2(DBG_PTS, "%s ECC curves:%s", LABEL, buf);
/* get assigned PCR banks */
this->mutex->lock(this->mutex);
rval = Tss2_Sys_GetCapability(this->sys_context, 0, TPM2_CAP_PCRS,
0, MAX_PCR_BANKS, &more_data, &cap_data, 0);
this->mutex->unlock(this->mutex);
if (rval != TPM2_RC_SUCCESS)
{
DBG1(DBG_PTS, "%s GetCapability failed for TPM2_CAP_PCRS: 0x%06x",
LABEL, rval);
return FALSE;
}
/* Number of assigned PCR banks */
this->assigned_pcrs_count = cap_data.data.assignedPCR.count;
/* reset print buffer */
pos = buf;
len = BUF_LEN;
/* store and print assigned PCR banks */
for (i = 0; i < cap_data.data.assignedPCR.count; i++)
{
alg = cap_data.data.assignedPCR.pcrSelections[i].hash;
this->assigned_pcrs[i] = alg;
written = snprintf(pos, len, " %N", tpm_alg_id_names, alg);
if (written < 0 || written >= len)
{
break;
}
pos += written;
len -= written;
}
DBG2(DBG_PTS, "%s PCR banks:%s", LABEL, buf);
return TRUE;
}
@@ -649,27 +694,45 @@ METHOD(tpm_tss_t, supported_signature_schemes, enumerator_t*,
(void*)signature_params_destroy);
}
METHOD(tpm_tss_t, has_pcr_bank, bool,
private_tpm_tss_tss2_t *this, hash_algorithm_t alg)
{
TPM2_ALG_ID alg_id;
int i;
alg_id = hash_alg_to_tpm_alg_id(alg);
for (i = 0; i < this->assigned_pcrs_count; i++)
{
if (this->assigned_pcrs[i] == alg_id)
{
return TRUE;
}
}
return FALSE;
}
/**
* Configure a PCR Selection assuming a maximum of 24 registers
*/
static bool init_pcr_selection(private_tpm_tss_tss2_t *this, uint32_t pcrs,
hash_algorithm_t alg, TPML_PCR_SELECTION *pcr_sel)
{
TPM2_ALG_ID alg_id;
uint32_t pcr;
/* check if hash algorithm is supported by TPM */
alg_id = hash_alg_to_tpm_alg_id(alg);
if (!is_supported_alg(this, alg_id))
/* check if there is an assigned PCR bank for this hash algorithm */
if (!has_pcr_bank(this, alg))
{
DBG1(DBG_PTS, "%s %N hash algorithm not supported by TPM",
DBG1(DBG_PTS, "%s %N hash algorithm not supported by any PCR bank",
LABEL, hash_algorithm_short_names, alg);
return FALSE;
}
/* initialize the PCR Selection structure,*/
pcr_sel->count = 1;
pcr_sel->pcrSelections[0].hash = alg_id;
pcr_sel->pcrSelections[0].hash = hash_alg_to_tpm_alg_id(alg);
;
pcr_sel->pcrSelections[0].sizeofSelect = 3;
pcr_sel->pcrSelections[0].pcrSelect[0] = 0;
pcr_sel->pcrSelections[0].pcrSelect[1] = 0;
@@ -736,24 +799,22 @@ METHOD(tpm_tss_t, extend_pcr, bool,
chunk_t data, hash_algorithm_t alg)
{
uint32_t rval;
TPM2_ALG_ID alg_id;
TPML_DIGEST_VALUES digest_values;
TSS2L_SYS_AUTH_COMMAND auth_cmd = { 1, { auth_cmd_empty } };
TSS2L_SYS_AUTH_RESPONSE auth_rsp;
auth_cmd.auths[0].sessionHandle = TPM2_RS_PW;
/* check if hash algorithm is supported by TPM */
alg_id = hash_alg_to_tpm_alg_id(alg);
if (!is_supported_alg(this, alg_id))
/* check if there is an assigned PCR bank for this hash algorithm */
if (!has_pcr_bank(this, alg))
{
DBG1(DBG_PTS, "%s %N hash algorithm not supported by TPM",
DBG1(DBG_PTS, "%s %N hash algorithm not supported by any PCR bank",
LABEL, hash_algorithm_short_names, alg);
return FALSE;
}
digest_values.count = 1;
digest_values.digests[0].hashAlg = alg_id;
digest_values.digests[0].hashAlg = hash_alg_to_tpm_alg_id(alg);
switch (alg)
{
@@ -1237,7 +1298,7 @@ METHOD(tpm_tss_t, get_data, bool,
}
METHOD(tpm_tss_t, get_event_digest, bool,
private_tpm_tss_tss2_t *this, int fd, chunk_t *digest)
private_tpm_tss_tss2_t *this, int fd, hash_algorithm_t alg, chunk_t *digest)
{
uint8_t digest_buf[HASH_SIZE_SHA512];
uint32_t digest_count;
@@ -1275,7 +1336,7 @@ METHOD(tpm_tss_t, get_event_digest, bool,
DBG2(DBG_PTS, "alg_id: 0x%04x", alg_id);
return FALSE;
}
if (hash_alg == HASH_SHA1)
if (hash_alg == alg)
{
*digest = chunk_alloc(digest_len);
if (read(fd, digest->ptr, digest_len) != digest_len)
@@ -1285,7 +1346,7 @@ METHOD(tpm_tss_t, get_event_digest, bool,
}
else
{
/* currently skip non-SHA1 digests */
/* read without storing */
if (read(fd, digest_buf, digest_len) != digest_len)
{
return FALSE;
@@ -1320,6 +1381,7 @@ tpm_tss_t *tpm_tss_tss2_create()
.generate_aik = _generate_aik,
.get_public = _get_public,
.supported_signature_schemes = _supported_signature_schemes,
.has_pcr_bank = _has_pcr_bank,
.read_pcr = _read_pcr,
.extend_pcr = _extend_pcr,
.quote = _quote,