denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactoring to tpm_tss_quote_info object

Browse Source
This commit is contained in:
Andreas Steffen
2016-06-26 18:19:05 +02:00
parent 12e1a06987
commit 721ed31b39
24 changed files with 924 additions and 398 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/Makefile.am
+1 -1
View File
@@ -64,7 +64,6 @@ libimcv_la_SOURCES = \
pts/pts_pcr.h pts/pts_pcr.c \
pts/pts_proto_caps.h \
pts/pts_req_func_comp_evid.h \
pts/pts_simple_evid_final.h \
pts/pts_creds.h pts/pts_creds.c \
pts/pts_database.h pts/pts_database.c \
pts/pts_dh_group.h pts/pts_dh_group.c \
@@ -205,5 +204,6 @@ imcv_tests_CFLAGS = \
imcv_tests_LDFLAGS = @COVERAGE_LDFLAGS@
imcv_tests_LDADD = \
$(top_builddir)/src/libimcv/libimcv.la \
$(top_builddir)/src/libtpmtss/libtpmtss.la \
$(top_builddir)/src/libstrongswan/libstrongswan.la \
$(top_builddir)/src/libstrongswan/tests/libtest.la
src/libimcv/plugins/imc_attestation/Makefile.am
+2 -1
View File
@@ -1,7 +1,8 @@
AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libtncif \
-I$(top_srcdir)/src/libimcv
-I$(top_srcdir)/src/libimcv \
-I$(top_srcdir)/src/libtpmtss
AM_CFLAGS = \
$(PLUGIN_CFLAGS)
src/libimcv/plugins/imc_attestation/imc_attestation_process.c
+10 -14
View File
@@ -421,10 +421,10 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, imc_msg_t *msg,
}
case TCG_PTS_GEN_ATTEST_EVID:
{
pts_simple_evid_final_flag_t flags;
pts_meas_algorithms_t comp_hash_algorithm;
pts_comp_evidence_t *evid;
chunk_t pcr_composite, quote_sig;
tpm_quote_mode_t quote_mode;
tpm_tss_quote_info_t *quote_info;
chunk_t quote_sig;
bool use_quote2, use_version_info;
/* Send cached Component Evidence entries */
@@ -440,22 +440,18 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, imc_msg_t *msg,
use_version_info = lib->settings->get_bool(lib->settings,
"%s.plugins.imc-attestation.use_version_info",
FALSE, lib->ns);
if (!pts->quote_tpm(pts, use_quote2, use_version_info,
&pcr_composite, &quote_sig))
quote_mode = use_quote2 ? (use_version_info ?
TPM_QUOTE2_VERSION_INFO :
TPM_QUOTE2) :
TPM_QUOTE;
if (!pts->quote(pts, &quote_mode, &quote_info, &quote_sig))
{
DBG1(DBG_IMC, "error occurred during TPM quote operation");
return FALSE;
}
/* Send Simple Evidence Final attribute */
flags = use_quote2 ? (use_version_info ?
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2_CAP_VER :
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2) :
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO;
comp_hash_algorithm = PTS_MEAS_ALGO_SHA1;
attr = tcg_pts_attr_simple_evid_final_create(flags,
comp_hash_algorithm, pcr_composite, quote_sig);
attr = tcg_pts_attr_simple_evid_final_create(quote_info, quote_sig);
msg->add_attribute(msg, attr);
break;
}
src/libimcv/plugins/imv_attestation/Makefile.am
+3
View File
@@ -2,6 +2,7 @@ AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libtncif \
-I$(top_srcdir)/src/libimcv \
-I$(top_srcdir)/src/libtpmtss \
-DPLUGINS=\""${attest_plugins}\""
AM_CFLAGS = \
@@ -11,6 +12,7 @@ imcv_LTLIBRARIES = imv-attestation.la
imv_attestation_la_LIBADD = \
$(top_builddir)/src/libimcv/libimcv.la \
$(top_builddir)/src/libtpmtss/libtpmtss.la \
$(top_builddir)/src/libstrongswan/libstrongswan.la
imv_attestation_la_SOURCES = imv_attestation.c \
@@ -27,6 +29,7 @@ attest_SOURCES = attest.c \
attest_db.h attest_db.c
attest_LDADD = \
$(top_builddir)/src/libimcv/libimcv.la \
$(top_builddir)/src/libtpmtss/libtpmtss.la \
$(top_builddir)/src/libstrongswan/libstrongswan.la
attest.o : $(top_builddir)/config.status
src/libimcv/plugins/imv_attestation/imv_attestation_process.c
+11 -26
View File
@@ -418,45 +418,31 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
case TCG_PTS_SIMPLE_EVID_FINAL:
{
tcg_pts_attr_simple_evid_final_t *attr_cast;
uint8_t flags;
pts_meas_algorithms_t comp_hash_algorithm;
chunk_t pcr_comp, tpm_quote_sig, evid_sig;
chunk_t pcr_composite, quote_info, result_buf;
tpm_tss_quote_info_t *quote_info;
chunk_t quoted = chunk_empty, quote_sig, evid_sig, result_buf;
imv_workitem_t *workitem;
imv_reason_string_t *reason_string;
hash_algorithm_t digest_alg;
enumerator_t *enumerator;
bool use_quote2, use_ver_info;
bio_writer_t *result;
attr_cast = (tcg_pts_attr_simple_evid_final_t*)attr;
flags = attr_cast->get_quote_info(attr_cast, &comp_hash_algorithm,
&pcr_comp, &tpm_quote_sig);
attr_cast->get_quote_info(attr_cast, &quote_info, &quote_sig);
if (flags != PTS_SIMPLE_EVID_FINAL_NO)
if (quote_info->get_quote_mode(quote_info) != TPM_QUOTE_NONE)
{
use_quote2 = (flags == PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2 ||
flags == PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2_CAP_VER);
use_ver_info = (flags == PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2_CAP_VER);
/* Construct PCR Composite and TPM Quote Info structures */
if (!pts->get_quote_info(pts, use_quote2, use_ver_info,
comp_hash_algorithm, &pcr_composite, &quote_info))
if (!pts->get_quote(pts, quote_info, &quoted))
{
DBG1(DBG_IMV, "unable to construct TPM Quote Info");
return FALSE;
}
if (!chunk_equals_const(pcr_comp, pcr_composite))
{
DBG1(DBG_IMV, "received PCR Composite does not match "
"constructed one");
DBG1(DBG_IMV, "unable to construct TPM Quote Info digest");
attestation_state->set_measurement_error(attestation_state,
IMV_ATTESTATION_ERROR_TPM_QUOTE_FAIL);
goto quote_error;
}
DBG2(DBG_IMV, "received PCR Composite matches constructed one");
digest_alg = quote_info->get_pcr_digest_alg(quote_info);
if (!pts->verify_quote_signature(pts, quote_info, tpm_quote_sig))
if (!pts->verify_quote_signature(pts, digest_alg, quoted,
quote_sig))
{
attestation_state->set_measurement_error(attestation_state,
IMV_ATTESTATION_ERROR_TPM_QUOTE_FAIL);
@@ -465,8 +451,7 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
DBG2(DBG_IMV, "TPM Quote Info signature verification successful");
quote_error:
free(pcr_composite.ptr);
free(quote_info.ptr);
chunk_free(&quoted);
/**
* Finalize any pending measurement registrations and check
src/libimcv/plugins/imv_hcd/Makefile.am
+1
View File
@@ -1,6 +1,7 @@
AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libtncif \
-I$(top_srcdir)/src/libtpmtss \
-I$(top_srcdir)/src/libimcv
AM_CFLAGS = \
src/libimcv/plugins/imv_os/Makefile.am
+2 -1
View File
@@ -1,7 +1,8 @@
AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libtncif \
-I$(top_srcdir)/src/libimcv
-I$(top_srcdir)/src/libimcv \
-I$(top_srcdir)/src/libtpmtss
AM_CFLAGS = \
$(PLUGIN_CFLAGS)
src/libimcv/plugins/imv_scanner/Makefile.am
+2 -1
View File
@@ -1,7 +1,8 @@
AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libtncif \
-I$(top_srcdir)/src/libimcv
-I$(top_srcdir)/src/libimcv \
-I$(top_srcdir)/src/libtpmtss
AM_CFLAGS = \
$(PLUGIN_CFLAGS)
src/libimcv/plugins/imv_swid/Makefile.am
+1
View File
@@ -1,6 +1,7 @@
AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libtncif \
-I$(top_srcdir)/src/libtpmtss \
-I$(top_srcdir)/src/libimcv
AM_CFLAGS = \
src/libimcv/pts/pts.c
+74 -128
View File
@@ -622,14 +622,13 @@ METHOD(pts_t, extend_pcr, bool,
return TRUE;
}
METHOD(pts_t, quote_tpm, bool,
private_pts_t *this, bool use_quote2, bool use_version_info,
chunk_t *pcr_comp, chunk_t *quote_sig)
METHOD(pts_t, quote, bool,
private_pts_t *this, tpm_quote_mode_t *quote_mode,
tpm_tss_quote_info_t **quote_info, chunk_t *quote_sig)
{
chunk_t pcr_value;
chunk_t pcr_value, pcr_computed;
uint32_t pcr, pcr_sel = 0;
enumerator_t *enumerator;
tpm_quote_mode_t quote_mode;
/* select PCRs */
DBG2(DBG_PTS, "PCR values hashed into PCR Composite:");
@@ -638,7 +637,9 @@ METHOD(pts_t, quote_tpm, bool,
{
if (this->tpm->read_pcr(this->tpm, pcr, &pcr_value, HASH_SHA1))
{
DBG2(DBG_PTS, "PCR %2d %#B", pcr, &pcr_value);
pcr_computed = this->pcrs->get(this->pcrs, pcr);
DBG2(DBG_PTS, "PCR %2d %#B %s", pcr, &pcr_value,
chunk_equals(pcr_value, pcr_computed) ? "ok" : "differs");
chunk_free(&pcr_value);
};
@@ -647,36 +648,16 @@ METHOD(pts_t, quote_tpm, bool,
}
enumerator->destroy(enumerator);
quote_mode = use_quote2 ? (use_version_info ? TPM_QUOTE2_VERSION_INFO :
TPM_QUOTE2) : TPM_QUOTE;
/* TPM Quote */
return this->tpm->quote(this->tpm, this->aik_handle, pcr_sel, HASH_SHA1,
this->secret, quote_mode, pcr_comp, quote_sig);
this->secret, quote_mode, quote_info, quote_sig);
}
/**
* TPM_QUOTE_INFO structure:
* 4 bytes of version
* 4 bytes 'Q' 'U' 'O' 'T'
* 20 byte SHA1 of TCPA_PCR_COMPOSITE
* 20 byte nonce
*
* TPM_QUOTE_INFO2 structure:
* 2 bytes Tag 0x0036 TPM_Tag_Quote_info2
* 4 bytes 'Q' 'U' 'T' '2'
* 20 bytes nonce
* 26 bytes PCR_INFO_SHORT
*/
METHOD(pts_t, get_quote_info, bool,
private_pts_t *this, bool use_quote2, bool use_version_info,
pts_meas_algorithms_t comp_hash_algo,
chunk_t *out_pcr_comp, chunk_t *out_quote_info)
METHOD(pts_t, get_quote, bool,
private_pts_t *this, tpm_tss_quote_info_t *quote_info, chunk_t *quoted)
{
chunk_t selection, pcr_comp, hash_pcr_comp;
bio_writer_t *writer;
hasher_t *hasher;
tpm_tss_pcr_composite_t *pcr_composite;
bool success;
if (!this->pcrs->get_count(this->pcrs))
{
@@ -690,111 +671,33 @@ METHOD(pts_t, get_quote_info, bool,
"unable to construct TPM Quote Info");
return FALSE;
}
if (use_quote2 && use_version_info && !this->tpm_version_info.ptr)
if (quote_info->get_quote_mode(quote_info) == TPM_QUOTE2_VERSION_INFO)
{
DBG1(DBG_PTS, "TPM Version Information unavailable, ",
"unable to construct TPM Quote Info2");
return FALSE;
}
pcr_comp = this->pcrs->get_composite(this->pcrs);
/* Output the TPM_PCR_COMPOSITE expected from IMC */
if (comp_hash_algo)
{
hash_algorithm_t algo;
algo = pts_meas_algo_to_hash(comp_hash_algo);
hasher = lib->crypto->create_hasher(lib->crypto, algo);
/* Hash the PCR Composite Structure */
if (!hasher || !hasher->allocate_hash(hasher, pcr_comp, out_pcr_comp))
if (!this->tpm_version_info.ptr)
{
DESTROY_IF(hasher);
free(pcr_comp.ptr);
DBG1(DBG_PTS, "TPM Version Information unavailable, ",
"unable to construct TPM Quote Info2");
return FALSE;
}
DBG3(DBG_PTS, "constructed PCR Composite hash: %#B", out_pcr_comp);
hasher->destroy(hasher);
}
else
{
*out_pcr_comp = chunk_clone(pcr_comp);
quote_info->set_version_info(quote_info, this->tpm_version_info);
}
pcr_composite = this->pcrs->get_composite(this->pcrs);
/* SHA1 hash of PCR Composite to construct TPM_QUOTE_INFO */
hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
if (!hasher || !hasher->allocate_hash(hasher, pcr_comp, &hash_pcr_comp))
{
DESTROY_IF(hasher);
chunk_free(out_pcr_comp);
free(pcr_comp.ptr);
return FALSE;
}
hasher->destroy(hasher);
success = quote_info->get_quote(quote_info, this->secret,
pcr_composite, quoted);
chunk_free(&pcr_composite->pcr_select);
chunk_free(&pcr_composite->pcr_composite);
free(pcr_composite);
/* Construct TPM_QUOTE_INFO/TPM_QUOTE_INFO2 structure */
writer = bio_writer_create(TPM_QUOTE_INFO_LEN);
if (use_quote2)
{
/* TPM Structure Tag */
writer->write_uint16(writer, TPM_TAG_QUOTE_INFO2);
/* Magic QUT2 value */
writer->write_data(writer, chunk_create("QUT2", 4));
/* Secret assessment value 20 bytes (nonce) */
writer->write_data(writer, this->secret);
/* PCR selection */
selection.ptr = pcr_comp.ptr;
selection.len = 2 + this->pcrs->get_selection_size(this->pcrs);
writer->write_data(writer, selection);
/* TPM Locality Selection */
writer->write_uint8(writer, TPM_LOC_ZERO);
/* PCR Composite Hash */
writer->write_data(writer, hash_pcr_comp);
if (use_version_info)
{
/* TPM version Info */
writer->write_data(writer, this->tpm_version_info);
}
}
else
{
/* Version number */
writer->write_data(writer, chunk_from_chars(1, 1, 0, 0));
/* Magic QUOT value */
writer->write_data(writer, chunk_create("QUOT", 4));
/* PCR Composite Hash */
writer->write_data(writer, hash_pcr_comp);
/* Secret assessment value 20 bytes (nonce) */
writer->write_data(writer, this->secret);
}
/* TPM Quote Info */
*out_quote_info = writer->extract_buf(writer);
DBG3(DBG_PTS, "constructed TPM Quote Info: %B", out_quote_info);
writer->destroy(writer);
free(pcr_comp.ptr);
free(hash_pcr_comp.ptr);
return TRUE;
return success;
}
METHOD(pts_t, verify_quote_signature, bool,
private_pts_t *this, chunk_t data, chunk_t signature)
private_pts_t *this, hash_algorithm_t digest_alg, chunk_t digest,
chunk_t signature)
{
public_key_t *aik_pubkey;
signature_scheme_t scheme;
aik_pubkey = this->aik_cert->get_public_key(this->aik_cert);
if (!aik_pubkey)
@@ -803,8 +706,51 @@ METHOD(pts_t, verify_quote_signature, bool,
return FALSE;
}
if (!aik_pubkey->verify(aik_pubkey, SIGN_RSA_EMSA_PKCS1_SHA1,
data, signature))
/* Determine signing scheme */
switch (aik_pubkey->get_type(aik_pubkey))
{
case KEY_RSA:
switch (digest_alg)
{
case HASH_SHA1:
scheme = SIGN_RSA_EMSA_PKCS1_SHA1;
break;
case HASH_SHA256:
scheme = SIGN_RSA_EMSA_PKCS1_SHA256;
break;
case HASH_SHA384:
scheme = SIGN_RSA_EMSA_PKCS1_SHA384;
break;
case HASH_SHA512:
scheme = SIGN_RSA_EMSA_PKCS1_SHA512;
break;
default:
scheme = SIGN_UNKNOWN;
}
break;
case KEY_ECDSA:
switch (digest_alg)
{
case HASH_SHA256:
scheme = SIGN_ECDSA_256;
break;
case HASH_SHA384:
scheme = SIGN_ECDSA_384;
break;
case HASH_SHA512:
scheme = SIGN_ECDSA_521;
break;
default:
scheme = SIGN_UNKNOWN;
}
break;
default:
DBG1(DBG_PTS, "%N AIK key type not supported", key_type_names,
aik_pubkey->get_type(aik_pubkey));
return FALSE;
}
if (!aik_pubkey->verify(aik_pubkey, scheme, digest, signature))
{
DBG1(DBG_PTS, "signature verification failed for TPM Quote Info");
DESTROY_IF(aik_pubkey);
@@ -873,9 +819,9 @@ pts_t *pts_create(bool is_imc)
.get_metadata = _get_metadata,
.read_pcr = _read_pcr,
.extend_pcr = _extend_pcr,
.quote_tpm = _quote_tpm,
.quote = _quote,
.get_pcrs = _get_pcrs,
.get_quote_info = _get_quote_info,
.get_quote = _get_quote,
.verify_quote_signature = _verify_quote_signature,
.destroy = _destroy,
},
src/libimcv/pts/pts.h
+18 -26
View File
@@ -32,9 +32,10 @@ typedef struct pts_t pts_t;
#include "pts_dh_group.h"
#include "pts_pcr.h"
#include "pts_req_func_comp_evid.h"
#include "pts_simple_evid_final.h"
#include "components/pts_comp_func_name.h"
#include <tpm_tss_quote_info.h>
#include <library.h>
#include <collections/linked_list.h>
@@ -70,11 +71,6 @@ typedef struct pts_t pts_t;
*/
#define ASSESSMENT_SECRET_LEN 20
/**
* Length of the TPM_QUOTE_INFO structure, TPM Spec 1.2
*/
#define TPM_QUOTE_INFO_LEN 48
/**
* Hashing algorithm used by tboot and trustedGRUB
*/
@@ -262,15 +258,13 @@ struct pts_t {
* Quote over PCR's
* Expects owner and SRK secret to be WELL_KNOWN_SECRET and no password set for AIK
*
* @param use_quote2 Version of the Quote function to be used
* @param use_version_info Version info is concatenated to TPM_QUOTE_INFO2
* @param pcr_comp Chunk to save PCR composite structure
* @param quote_sig Chunk to save quote operation output
* without external data (anti-replay protection)
* @return FALSE in case of TSS error, TRUE otherwise
* @param quote_mode type of Quote signature
* @param quote_info returns various info covered by Quote signature
* @param quote_sig returns Quote signature
* @return FALSE in case of Quote error, TRUE otherwise
*/
bool (*quote_tpm)(pts_t *this, bool use_quote2, bool use_version_info,
chunk_t *pcr_comp, chunk_t *quote_sig);
bool (*quote)(pts_t *this, tpm_quote_mode_t *quote_mode,
tpm_tss_quote_info_t **quote_info, chunk_t *quote_sig);
/**
* Get the shadow PCR set
@@ -279,28 +273,26 @@ struct pts_t {
*/
pts_pcr_t* (*get_pcrs)(pts_t *this);
/**
* Constructs and returns TPM Quote Info structure expected from IMC
/**
* Computes digest of the constructed TPM Quote Info structure
*
* @param use_quote2 Version of the TPM_QUOTE_INFO to be constructed
* @param use_version_info Version info is concatenated to TPM_QUOTE_INFO2
* @param comp_hash_algo Composite Hash Algorithm
* @param pcr_comp Output variable to store PCR Composite
* @param quote_info Output variable to store TPM Quote Info
* @param quote_info TPM Quote Info as received from IMC
* @param quoted Encoding of TPM Quote Info
* @return FALSE in case of any error, TRUE otherwise
*/
bool (*get_quote_info)(pts_t *this, bool use_quote2, bool use_version_info,
pts_meas_algorithms_t comp_hash_algo,
chunk_t *pcr_comp, chunk_t *quote_info);
bool (*get_quote)(pts_t *this, tpm_tss_quote_info_t *quote_info,
chunk_t *quoted);
/**
* Constructs and returns PCR Quote Digest structure expected from IMC
*
* @param data Calculated TPM Quote Digest
* @param digest_alg Hash algorithm used for TPM Quote Digest
* @param digest Calculated TPM Quote Digest
* @param signature TPM Quote Signature received from IMC
* @return FALSE if signature is not verified
*/
bool (*verify_quote_signature)(pts_t *this, chunk_t data, chunk_t signature);
bool (*verify_quote_signature)(pts_t *this, hash_algorithm_t digest_alg,
chunk_t digest, chunk_t signature);
/**
* Destroys a pts_t object.
src/libimcv/pts/pts_meas_algo.c
+18
View File
@@ -155,6 +155,24 @@ hash_algorithm_t pts_meas_algo_to_hash(pts_meas_algorithms_t algorithm)
}
}
/**
* Described in header.
*/
pts_meas_algorithms_t pts_meas_algo_from_hash(hash_algorithm_t algorithm)
{
switch (algorithm)
{
case HASH_SHA1:
return PTS_MEAS_ALGO_SHA1;
case HASH_SHA256:
return PTS_MEAS_ALGO_SHA256;
case HASH_SHA384:
return PTS_MEAS_ALGO_SHA384;
default:
return PTS_MEAS_ALGO_NONE;
}
}
/**
* Described in header.
*/
src/libimcv/pts/pts_meas_algo.h
+8
View File
@@ -95,6 +95,14 @@ pts_meas_algorithms_t pts_meas_algo_select(pts_meas_algorithms_t supported_algos
*/
hash_algorithm_t pts_meas_algo_to_hash(pts_meas_algorithms_t algorithm);
/**
* Convert hash_algorithm_t to pts_meas_algorithms_t
*
* @param algorithm PTS measurement algorithm type
* @return libstrongswan hash algorithm type
*/
pts_meas_algorithms_t pts_meas_algo_from_hash(hash_algorithm_t algorithm);
/**
* Return the hash size of a pts_meas_algorithm
*
src/libimcv/pts/pts_pcr.c
+10 -12
View File
@@ -200,10 +200,10 @@ METHOD(pts_pcr_t, extend, chunk_t,
return this->pcrs[pcr];
}
METHOD(pts_pcr_t, get_composite, chunk_t,
METHOD(pts_pcr_t, get_composite, tpm_tss_pcr_composite_t*,
private_pts_pcr_t *this)
{
chunk_t composite;
tpm_tss_pcr_composite_t *pcr_composite;
enumerator_t *enumerator;
uint16_t selection_size;
uint32_t pcr_field_size, pcr;
@@ -212,14 +212,13 @@ METHOD(pts_pcr_t, get_composite, chunk_t,
selection_size = get_selection_size(this);
pcr_field_size = this->pcr_count * PTS_PCR_LEN;
composite = chunk_alloc(2 + selection_size + 4 + pcr_field_size);
pos = composite.ptr;
htoun16(pos, selection_size);
pos += 2;
memcpy(pos, this->pcr_select, selection_size);
pos += selection_size;
htoun32(pos, pcr_field_size);
pos += 4;
INIT(pcr_composite,
.pcr_select = chunk_alloc(selection_size),
.pcr_composite = chunk_alloc(pcr_field_size),
);
memcpy(pcr_composite->pcr_select.ptr, this->pcr_select, selection_size);
pos = pcr_composite->pcr_composite.ptr;
enumerator = create_enumerator(this);
while (enumerator->enumerate(enumerator, &pcr))
@@ -229,8 +228,7 @@ METHOD(pts_pcr_t, get_composite, chunk_t,
}
enumerator->destroy(enumerator);
DBG3(DBG_PTS, "constructed PCR Composite: %B", &composite);
return composite;
return pcr_composite;
}
METHOD(pts_pcr_t, destroy, void,
src/libimcv/pts/pts_pcr.h
+4 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2012 Andreas Steffen
* Copyright (C) 2012-2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -25,6 +25,8 @@ typedef struct pts_pcr_t pts_pcr_t;
#include <library.h>
#include <tpm_tss_quote_info.h>
/**
* Maximum number of PCR's of TPM, TPM Spec 1.2
*/
@@ -100,7 +102,7 @@ struct pts_pcr_t {
*
* @return PCR Composite object (must be freed)
*/
chunk_t (*get_composite)(pts_pcr_t *this);
tpm_tss_pcr_composite_t* (*get_composite)(pts_pcr_t *this);
/**
src/libimcv/pts/pts_simple_evid_final.h
-47
View File
@@ -1,47 +0,0 @@
/*
* Copyright (C) 2011 Sansar Choinyambuu
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup pts_simple_evid_final pts_rsimple_evid_final
* @{ @ingroup pts
*/
#ifndef PTS_SIMPLE_EVID_FINAL_H_
#define PTS_SIMPLE_EVID_FINAL_H_
typedef enum pts_simple_evid_final_flag_t pts_simple_evid_final_flag_t;
#include <library.h>
/**
* PTS Simple Evidence Final Flags
*/
enum pts_simple_evid_final_flag_t {
/** TPM PCR Composite and TPM Quote Signature not included */
PTS_SIMPLE_EVID_FINAL_NO = 0x00,
/** TPM PCR Composite and TPM Quote Signature included
* using TPM_QUOTE_INFO */
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO = 0x40,
/** TPM PCR Composite and TPM Quote Signature included
* using TPM_QUOTE_INFO2, TPM_CAP_VERSION_INFO not appended */
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2 = 0x80,
/** TPM PCR Composite and TPM Quote Signature included
* using TPM_QUOTE_INFO2, TPM_CAP_VERSION_INFO appended */
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2_CAP_VER = 0xC0,
/** Evidence Signature included */
PTS_SIMPLE_EVID_FINAL_EVID_SIG = 0x20,
};
#endif /** PTS_SIMPLE_EVID_FINAL_H_ @}*/
src/libimcv/tcg/pts/tcg_pts_attr_simple_evid_final.c
+173 -72
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2011-2012 Sansar Choinyambuu
* Copyright (C) 2011-2014 Andreas Steffen
* Copyright (C) 2011-2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -15,7 +15,6 @@
*/
#include "tcg_pts_attr_simple_evid_final.h"
#include "pts/pts_simple_evid_final.h"
#include <pa_tnc/pa_tnc_msg.h>
#include <bio/bio_writer.h>
@@ -27,6 +26,7 @@ typedef struct private_tcg_pts_attr_simple_evid_final_t private_tcg_pts_attr_sim
/**
* Simple Evidence Final
* see section 3.15.2 of PTS Protocol: Binding to TNC IF-M Specification
* plus non-standard extensions to cover the TPM 2.0 Quote Info format
*
* 1 2 3
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
@@ -37,17 +37,57 @@ typedef struct private_tcg_pts_attr_simple_evid_final_t private_tcg_pts_attr_sim
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* ~ Optional TPM PCR Composite (Variable Length) ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Opt. TPM Qual. Signer Length | Optional TPM Qualified Signer ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* ~ Optional TPM Qualified Signer (Variable Length) ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Opt. TPM Clock Info Length | Optional TPM Clock Info ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* ~ Optional TPM Clock Info (Variable Length) ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Opt. TPM Version Info Length | Optional TPM Version Info ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* ~ Optional TPM Version Info (Variable Length) |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Opt. TPM PCR Selection Length | Opt. TPM PCR Selection ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* ~ Optional TPM PCR Selection (Variable Length) ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Optional TPM Quote Signature Length |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* ~ Optional TPM Quote Signature (Variable Length) ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* ~ Optional Evidence Signature (Variable Length) ~
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
*/
#define PTS_SIMPLE_EVID_FINAL_SIZE 2
#define PTS_SIMPLE_EVID_FINAL_RESERVED 0x00
#define PTS_SIMPLE_EVID_FINAL_FLAG_MASK 0xC0
/**
* PTS Simple Evidence Final Flags
*/
enum pts_simple_evid_final_flag_t {
/** TPM PCR Composite and TPM Quote Signature not included */
PTS_SIMPLE_EVID_FINAL_NO = 0x00,
/** TPM Quote Info and TPM Quite Signature included
* using TPM 2.0 Quote Info format */
PTS_SIMPLE_EVID_FINAL_EVID_QUOTE_INFO_TPM2 = 0x10,
/** Evidence Signature included */
PTS_SIMPLE_EVID_FINAL_EVID_SIG = 0x20,
/** TPM PCR Composite and TPM Quote Signature included
* using TPM_QUOTE_INFO */
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO = 0x40,
/** TPM PCR Composite and TPM Quote Signature included
* using TPM_QUOTE_INFO2, TPM_CAP_VERSION_INFO not appended */
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2 = 0x80,
/** TPM PCR Composite and TPM Quote Signature included
* using TPM_QUOTE_INFO2, TPM_CAP_VERSION_INFO appended */
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2_CAP_VER = 0xC0,
/** Mask for the TPM Quote Info flags */
PTS_SIMPLE_EVID_FINAL_QUOTE_INFO_MASK = 0xD0
};
/**
* Private data of an tcg_pts_attr_simple_evid_final_t object.
*/
@@ -79,24 +119,14 @@ struct private_tcg_pts_attr_simple_evid_final_t {
bool noskip_flag;
/**
* Set of flags for Simple Evidence Final
* Optional TPM Quote Info
*/
uint8_t flags;
/**
* Optional Composite Hash Algorithm
*/
pts_meas_algorithms_t comp_hash_algorithm;
/**
* Optional TPM PCR Composite
*/
chunk_t pcr_comp;
tpm_tss_quote_info_t *quote_info;
/**
* Optional TPM Quote Signature
*/
chunk_t tpm_quote_sig;
chunk_t quote_sig;
/**
* Is Evidence Signature included?
@@ -156,9 +186,9 @@ METHOD(pa_tnc_attr_t, destroy, void,
{
if (ref_put(&this->ref))
{
DESTROY_IF(this->quote_info);
free(this->value.ptr);
free(this->pcr_comp.ptr);
free(this->tpm_quote_sig.ptr);
free(this->quote_sig.ptr);
free(this->evid_sig.ptr);
free(this);
}
@@ -167,6 +197,9 @@ METHOD(pa_tnc_attr_t, destroy, void,
METHOD(pa_tnc_attr_t, build, void,
private_tcg_pts_attr_simple_evid_final_t *this)
{
chunk_t pcr_digest, pcr_select, qualified_signer, clock_info, version_info;
hash_algorithm_t pcr_digest_alg;
tpm_quote_mode_t quote_mode;
bio_writer_t *writer;
uint8_t flags;
@@ -174,7 +207,26 @@ METHOD(pa_tnc_attr_t, build, void,
{
return;
}
flags = this->flags & PTS_SIMPLE_EVID_FINAL_FLAG_MASK;
quote_mode = this->quote_info->get_quote_mode(this->quote_info);
switch (quote_mode)
{
case TPM_QUOTE:
flags = PTS_SIMPLE_EVID_FINAL_QUOTE_INFO;
break;
case TPM_QUOTE2:
flags = PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2;
break;
case TPM_QUOTE2_VERSION_INFO:
flags = PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2_CAP_VER;
break;
case TPM_QUOTE_TPM2:
flags = PTS_SIMPLE_EVID_FINAL_EVID_QUOTE_INFO_TPM2;
break;
case TPM_QUOTE_NONE:
default:
flags = PTS_SIMPLE_EVID_FINAL_NO;
}
if (this->has_evid_sig)
{
@@ -185,25 +237,35 @@ METHOD(pa_tnc_attr_t, build, void,
writer->write_uint8 (writer, flags);
writer->write_uint8 (writer, PTS_SIMPLE_EVID_FINAL_RESERVED);
/** Optional Composite Hash Algorithm field is always present
* Field has value of all zeroes if not used.
* Implemented adhering the suggestion of Paul Sangster 28.Oct.2011
*/
writer->write_uint16(writer, this->comp_hash_algorithm);
pcr_digest_alg = this->quote_info->get_pcr_digest_alg(this->quote_info);
pcr_digest = this->quote_info->get_pcr_digest(this->quote_info);
writer->write_uint16(writer, pts_meas_algo_from_hash(pcr_digest_alg));
/* Optional fields */
if (this->flags != PTS_SIMPLE_EVID_FINAL_NO)
if (quote_mode != TPM_QUOTE_NONE)
{
writer->write_uint32 (writer, this->pcr_comp.len);
writer->write_data (writer, this->pcr_comp);
writer->write_uint32 (writer, this->tpm_quote_sig.len);
writer->write_data (writer, this->tpm_quote_sig);
writer->write_data32(writer, pcr_digest);
}
if (this->has_evid_sig)
if (quote_mode == TPM_QUOTE_TPM2)
{
writer->write_data (writer, this->evid_sig);
version_info = this->quote_info->get_version_info(this->quote_info);
this->quote_info->get_tpm2_info(this->quote_info, &qualified_signer,
&clock_info, &pcr_select);
writer->write_data16(writer, qualified_signer);
writer->write_data16(writer, clock_info);
writer->write_data16(writer, version_info);
writer->write_data16(writer, pcr_select);
}
if (quote_mode != TPM_QUOTE_NONE)
{
writer->write_data32(writer, this->quote_sig);
if (this->has_evid_sig)
{
writer->write_data(writer, this->evid_sig);
}
}
this->value = writer->extract_buf(writer);
@@ -214,10 +276,14 @@ METHOD(pa_tnc_attr_t, build, void,
METHOD(pa_tnc_attr_t, process, status_t,
private_tcg_pts_attr_simple_evid_final_t *this, uint32_t *offset)
{
hash_algorithm_t pcr_digest_alg;
tpm_quote_mode_t quote_mode;
bio_reader_t *reader;
uint8_t flags, reserved;
uint16_t algorithm;
uint32_t pcr_comp_len, tpm_quote_sig_len, evid_sig_len;
uint32_t evid_sig_len;
chunk_t pcr_digest = chunk_empty, quote_sig, evid_sig;
chunk_t qualified_signer, clock_info, version_info, pcr_select;
status_t status = FAILED;
*offset = 0;
@@ -236,56 +302,99 @@ METHOD(pa_tnc_attr_t, process, status_t,
reader->read_uint8(reader, &flags);
reader->read_uint8(reader, &reserved);
this->flags = flags & PTS_SIMPLE_EVID_FINAL_FLAG_MASK;
this->has_evid_sig = (flags & PTS_SIMPLE_EVID_FINAL_EVID_SIG) != 0;
flags &= PTS_SIMPLE_EVID_FINAL_QUOTE_INFO_MASK;
switch (flags)
{
case PTS_SIMPLE_EVID_FINAL_QUOTE_INFO:
quote_mode = TPM_QUOTE;
break;
case PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2:
quote_mode = TPM_QUOTE2;
break;
case PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2_CAP_VER:
quote_mode = TPM_QUOTE2_VERSION_INFO;
break;
case PTS_SIMPLE_EVID_FINAL_EVID_QUOTE_INFO_TPM2:
quote_mode = TPM_QUOTE_TPM2;
break;
case PTS_SIMPLE_EVID_FINAL_NO:
default:
quote_mode = TPM_QUOTE_NONE;
break;
}
/** Optional Composite Hash Algorithm field is always present
* Field has value of all zeroes if not used.
* Implemented adhering the suggestion of Paul Sangster 28.Oct.2011
*/
reader->read_uint16(reader, &algorithm);
this->comp_hash_algorithm = algorithm;
pcr_digest_alg = pts_meas_algo_to_hash(algorithm);
/* Optional Composite Hash Algorithm and TPM PCR Composite fields */
if (this->flags != PTS_SIMPLE_EVID_FINAL_NO)
/* Optional fields */
if (quote_mode != TPM_QUOTE_NONE)
{
if (!reader->read_uint32(reader, &pcr_comp_len))
{
DBG1(DBG_TNC, "insufficient data for PTS Simple Evidence Final "
"PCR Composite Length");
goto end;
}
if (!reader->read_data(reader, pcr_comp_len, &this->pcr_comp))
if (!reader->read_data32(reader, &pcr_digest))
{
DBG1(DBG_TNC, "insufficient data for PTS Simple Evidence Final "
"PCR Composite");
goto end;
}
this->pcr_comp = chunk_clone(this->pcr_comp);
}
this->quote_info = tpm_tss_quote_info_create(quote_mode, pcr_digest_alg,
pcr_digest);
if (!reader->read_uint32(reader, &tpm_quote_sig_len))
if (quote_mode == TPM_QUOTE_TPM2)
{
if (!reader->read_data16(reader, &qualified_signer))
{
DBG1(DBG_TNC, "insufficient data for PTS Simple Evidence Final "
"TPM Quote Singature Length");
"Qualified Signer");
goto end;
}
if (!reader->read_data(reader, tpm_quote_sig_len, &this->tpm_quote_sig))
if (!reader->read_data16(reader, &clock_info))
{
DBG1(DBG_TNC, "insufficient data for PTS Simple Evidence Final "
"Clock Info");
goto end;
}
if (!reader->read_data16(reader, &version_info))
{
DBG1(DBG_TNC, "insufficient data for PTS Simple Evidence Final "
"Version Info");
goto end;
}
if (!reader->read_data16(reader, &pcr_select))
{
DBG1(DBG_TNC, "insufficient data for PTS Simple Evidence Final "
"PCR select");
goto end;
}
this->quote_info->set_tpm2_info(this->quote_info, qualified_signer,
clock_info, pcr_select);
this->quote_info->set_version_info(this->quote_info, version_info);
}
if (quote_mode != TPM_QUOTE_NONE)
{
if (!reader->read_data32(reader, &quote_sig))
{
DBG1(DBG_TNC, "insufficient data for PTS Simple Evidence Final "
"TPM Quote Singature");
goto end;
}
this->tpm_quote_sig = chunk_clone(this->tpm_quote_sig);
this->quote_sig = chunk_clone(quote_sig);
}
/* Optional Evidence Signature field */
if (this->has_evid_sig)
{
evid_sig_len = reader->remaining(reader);
reader->read_data(reader, evid_sig_len, &this->evid_sig);
this->evid_sig = chunk_clone(this->evid_sig);
reader->read_data(reader, evid_sig_len, &evid_sig);
this->evid_sig = chunk_clone(evid_sig);
}
reader->destroy(reader);
@@ -296,23 +405,18 @@ end:
return status;
}
METHOD(tcg_pts_attr_simple_evid_final_t, get_quote_info, uint8_t,
METHOD(tcg_pts_attr_simple_evid_final_t, get_quote_info, void,
private_tcg_pts_attr_simple_evid_final_t *this,
pts_meas_algorithms_t *comp_hash_algo, chunk_t *pcr_comp, chunk_t *tpm_quote_sig)
tpm_tss_quote_info_t **quote_info, chunk_t *quote_sig)
{
if (comp_hash_algo)
if (quote_info)
{
*comp_hash_algo = this->comp_hash_algorithm;
*quote_info = this->quote_info;
}
if (pcr_comp)
if (quote_sig)
{
*pcr_comp = this->pcr_comp;
*quote_sig = this->quote_sig;
}
if (tpm_quote_sig)
{
*tpm_quote_sig = this->tpm_quote_sig;
}
return this->flags;
}
METHOD(tcg_pts_attr_simple_evid_final_t, get_evid_sig, bool,
@@ -335,9 +439,8 @@ METHOD(tcg_pts_attr_simple_evid_final_t, set_evid_sig, void,
/**
* Described in header.
*/
pa_tnc_attr_t *tcg_pts_attr_simple_evid_final_create(uint8_t flags,
pts_meas_algorithms_t comp_hash_algorithm,
chunk_t pcr_comp, chunk_t tpm_quote_sig)
pa_tnc_attr_t *tcg_pts_attr_simple_evid_final_create(
tpm_tss_quote_info_t *quote_info, chunk_t quote_sig)
{
private_tcg_pts_attr_simple_evid_final_t *this;
@@ -359,10 +462,8 @@ pa_tnc_attr_t *tcg_pts_attr_simple_evid_final_create(uint8_t flags,
.set_evid_sig = _set_evid_sig,
},
.type = { PEN_TCG, TCG_PTS_SIMPLE_EVID_FINAL },
.flags = flags,
.comp_hash_algorithm = comp_hash_algorithm,
.pcr_comp = pcr_comp,
.tpm_quote_sig = tpm_quote_sig,
.quote_info = quote_info,
.quote_sig = quote_sig,
.ref = 1,
);
src/libimcv/tcg/pts/tcg_pts_attr_simple_evid_final.h
+12 -17
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2011 Sansar Choinyambuu
* Copyright (C) 2014 Andreas Steffen
* Copyright (C) 2014-2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -28,6 +28,8 @@ typedef struct tcg_pts_attr_simple_evid_final_t tcg_pts_attr_simple_evid_final_t
#include "tcg_pts_attr_meas_algo.h"
#include "pa_tnc/pa_tnc_attr.h"
#include <tpm_tss_quote_info.h>
/**
* Class implementing the TCG PTS Simple Evidence Final attribute
*
@@ -40,16 +42,14 @@ struct tcg_pts_attr_simple_evid_final_t {
pa_tnc_attr_t pa_tnc_attribute;
/**
* Get Optional PCR Composite and TPM Quote Signature
* Get Optional TPM Quote Info and TPM Quote Signature
*
* @param comp_hash_algo Optional Composite Hash Algorithm
* @param pcr_comp Optional PCR Composite
* @param tpm_quote sig Optional TPM Quote Signature
* @return PTS_SIMPLE_EVID_FINAL flags
* @param quote_info Optional TPM Quote Info
* @param quote sig Optional TPM Quote Signature
*/
uint8_t (*get_quote_info)(tcg_pts_attr_simple_evid_final_t *this,
pts_meas_algorithms_t *comp_hash_algo,
chunk_t *pcr_comp, chunk_t *tpm_quote_sig);
void (*get_quote_info)(tcg_pts_attr_simple_evid_final_t *this,
tpm_tss_quote_info_t **quote_info,
chunk_t *quote_sig);
/**
* Get Optional Evidence Signature
@@ -73,16 +73,11 @@ struct tcg_pts_attr_simple_evid_final_t {
/**
* Creates an tcg_pts_attr_simple_evid_final_t object
*
* @param flags Set of flags
* @param comp_hash_algorithm Composite Hash Algorithm
* @param pcr_comp Optional TPM PCR Composite
* @param tpm_quote_sign Optional TPM Quote Signature
* @param quote_info Optional TPM Quote Info
* @param quote_sign Optional TPM Quote Signature
*/
pa_tnc_attr_t* tcg_pts_attr_simple_evid_final_create(
uint8_t flags,
pts_meas_algorithms_t comp_hash_algorithm,
chunk_t pcr_comp,
chunk_t tpm_quote_sign);
tpm_tss_quote_info_t *quote_info, chunk_t quote_sig);
/**
* Creates an tcg_pts_attr_simple_evid_final_t object from received data