From 51b000527737aef208260e34776a846cae30210a Mon Sep 17 00:00:00 2001 From: Sansar Choinyambuu Date: Wed, 23 Nov 2011 12:02:00 +0100 Subject: [PATCH] Set pcr transform field depending on measuring algorithm --- src/libimcv/plugins/imv_attestation/data.sql | 20 +-------------- .../pts/components/ita/ita_comp_tboot.c | 25 ++++++++++++++++--- .../pts/components/ita/ita_comp_tgrub.c | 19 ++++++++++++-- 3 files changed, 39 insertions(+), 25 deletions(-) diff --git a/src/libimcv/plugins/imv_attestation/data.sql b/src/libimcv/plugins/imv_attestation/data.sql index ad5efb2d2..7769223fe 100644 --- a/src/libimcv/plugins/imv_attestation/data.sql +++ b/src/libimcv/plugins/imv_attestation/data.sql @@ -426,30 +426,12 @@ INSERT INTO product_file ( 7, 22 ); -INSERT INTO product_file ( - product, file -) VALUES ( - 7, 23 -); - -INSERT INTO product_file ( - product, file -) VALUES ( - 7, 24 -); - /* Product Component */ INSERT INTO product_component ( product, component, depth, sequence ) VALUES ( - 4, 2, 0, 2 -); - -INSERT INTO product_component ( - product, component, depth, sequence -) VALUES ( - 7, 2, 0, 2 + 4, 2, 0, 1 ); /* File Hashes */ diff --git a/src/libpts/pts/components/ita/ita_comp_tboot.c b/src/libpts/pts/components/ita/ita_comp_tboot.c index beb2a5283..5ab6dc844 100644 --- a/src/libpts/pts/components/ita/ita_comp_tboot.c +++ b/src/libpts/pts/components/ita/ita_comp_tboot.c @@ -81,6 +81,8 @@ METHOD(pts_component_t, measure, status_t, pts_comp_evidence_t *evid; char *meas_hex, *pcr_before_hex, *pcr_after_hex; chunk_t measurement, pcr_before, pcr_after; + pts_pcr_transform_t pcr_transform; + pts_meas_algorithms_t hash_algo; switch (this->extended_pcr) { @@ -109,6 +111,19 @@ METHOD(pts_component_t, measure, status_t, return FAILED; } + hash_algo = pts->get_meas_algorithm(pts); + switch (hash_algo) + { + case PTS_MEAS_ALGO_SHA1: + pcr_transform = PTS_PCR_TRANSFORM_MATCH; + case PTS_MEAS_ALGO_SHA256: + case PTS_MEAS_ALGO_SHA384: + pcr_transform = PTS_PCR_TRANSFORM_LONG; + case PTS_MEAS_ALGO_NONE: + default: + pcr_transform = PTS_PCR_TRANSFORM_NO; + } + measurement = chunk_from_hex( chunk_create(meas_hex, strlen(meas_hex)), NULL); pcr_before = chunk_from_hex( @@ -117,11 +132,13 @@ METHOD(pts_component_t, measure, status_t, chunk_create(pcr_after_hex, strlen(pcr_after_hex)), NULL); evid = *evidence = pts_comp_evidence_create(this->name->clone(this->name), - 0, this->extended_pcr, - PTS_MEAS_ALGO_SHA1, PTS_PCR_TRANSFORM_NO, + this->depth, this->extended_pcr, + hash_algo, pcr_transform, this->measurement_time, measurement); evid->set_pcr_info(evid, pcr_before, pcr_after); + + return (this->extended_pcr == PCR_TBOOT_MLE) ? SUCCESS : NEED_MORE; } @@ -170,10 +187,10 @@ METHOD(pts_component_t, verify, status_t, { return FAILED; } - + /* check measurement in database */ enumerator = pts_db->create_comp_hash_enumerator(pts_db, file, - platform_info, this->name, algo); + platform_info, this->name, TRUSTED_HASH_ALGO); while (enumerator->enumerate(enumerator, &hash)) { if (!chunk_equals(hash, measurement)) diff --git a/src/libpts/pts/components/ita/ita_comp_tgrub.c b/src/libpts/pts/components/ita/ita_comp_tgrub.c index d74451fdf..d54333361 100644 --- a/src/libpts/pts/components/ita/ita_comp_tgrub.c +++ b/src/libpts/pts/components/ita/ita_comp_tgrub.c @@ -71,6 +71,8 @@ METHOD(pts_component_t, measure, status_t, u_int32_t extended_pcr; time_t measurement_time; chunk_t measurement, pcr_before, pcr_after; + pts_pcr_transform_t pcr_transform; + pts_meas_algorithms_t hash_algo; /* Provisional implementation for TGRUB */ extended_pcr = PCR_DEBUG; @@ -82,6 +84,19 @@ METHOD(pts_component_t, measure, status_t, return FAILED; } + hash_algo = pts->get_meas_algorithm(pts); + switch (hash_algo) + { + case PTS_MEAS_ALGO_SHA1: + pcr_transform = PTS_PCR_TRANSFORM_MATCH; + case PTS_MEAS_ALGO_SHA256: + case PTS_MEAS_ALGO_SHA384: + pcr_transform = PTS_PCR_TRANSFORM_LONG; + case PTS_MEAS_ALGO_NONE: + default: + pcr_transform = PTS_PCR_TRANSFORM_NO; + } + measurement = chunk_alloc(HASH_SIZE_SHA1); memset(measurement.ptr, 0x00, measurement.len); @@ -89,8 +104,8 @@ METHOD(pts_component_t, measure, status_t, memset(pcr_before.ptr, 0x00, pcr_before.len); evid = *evidence = pts_comp_evidence_create(this->name->clone(this->name), - 0, extended_pcr, - PTS_MEAS_ALGO_SHA1, PTS_PCR_TRANSFORM_NO, + this->depth, extended_pcr, + hash_algo, pcr_transform, measurement_time, measurement); evid->set_pcr_info(evid, pcr_before, pcr_after);