denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pts: Parse TPM 2.0 BIOS/EFI event log

Browse Source
This commit is contained in:
Andreas Steffen
2020-10-07 16:54:32 +02:00
parent da1d7815ef
commit d647a8f91d
13 changed files with 376 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/pts/components/ita/ita_comp_ima.c
+11 -3
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2017 Andreas Steffen
* Copyright (C) 2011-2020 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -350,6 +350,10 @@ METHOD(pts_component_t, measure, status_t,
status_t status;
pcrs = pts->get_pcrs(pts);
if (!pcrs)
{
return FAILED;
}
if (qualifier == (PTS_ITA_QUALIFIER_FLAG_KERNEL |
PTS_ITA_QUALIFIER_TYPE_TRUSTED))
@@ -357,8 +361,8 @@ METHOD(pts_component_t, measure, status_t,
switch (this->state)
{
case IMA_STATE_INIT:
this->bios_list = pts_ima_bios_list_create(
IMA_BIOS_MEASUREMENTS);
this->bios_list = pts_ima_bios_list_create(pts->get_tpm(pts),
IMA_BIOS_MEASUREMENTS);
if (!this->bios_list)
{
return FAILED;
@@ -534,6 +538,10 @@ METHOD(pts_component_t, verify, status_t,
this->aik_id = pts->get_aik_id(pts);
pcrs = pts->get_pcrs(pts);
if (!pcrs)
{
return FAILED;
}
measurement = evidence->get_measurement(evidence, &pcr, &algo, &transform,
&creation_time);
src/libimcv/pts/components/ita/ita_comp_tboot.c
+9 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2015 Andreas Steffen
* Copyright (C) 2011-2020 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -173,6 +173,10 @@ METHOD(pts_component_t, measure, status_t,
}
pcrs = pts->get_pcrs(pts);
if (!pcrs)
{
return FAILED;
}
pcrs->set(pcrs, extended_pcr, pcr_after);
evid = *evidence = pts_comp_evidence_create(this->name->clone(this->name),
this->depth, extended_pcr, hash_algo, pcr_transform,
@@ -198,6 +202,10 @@ METHOD(pts_component_t, verify, status_t,
this->aik_id = pts->get_aik_id(pts);
pcrs = pts->get_pcrs(pts);
if (!pcrs)
{
return FAILED;
}
measurement = evidence->get_measurement(evidence, &extended_pcr,
&algo, &transform, &measurement_time);
src/libimcv/pts/components/ita/ita_comp_tgrub.c
+5 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2012 Andreas Steffen
* Copyright (C) 2011-2020 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -129,6 +129,10 @@ METHOD(pts_component_t, verify, status_t,
chunk_t measurement __attribute__((unused));
pcrs = pts->get_pcrs(pts);
if (!pcrs)
{
return FAILED;
}
measurement = evidence->get_measurement(evidence, &extended_pcr,
&algo, &transform, &measurement_time);
if (extended_pcr != PCR_DEBUG)
src/libimcv/pts/pts.c
+80 -13
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2011-2012 Sansar Choinyambuu
* Copyright (C) 2012-2016 Andreas Steffen
* Copyright (C) 2012-2020 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -21,7 +21,6 @@
#include <bio/bio_writer.h>
#include <bio/bio_reader.h>
#include <tpm_tss.h>
#include <tpm_tss_trousers.h>
#include <sys/types.h>
@@ -96,12 +95,17 @@ struct private_pts_t {
bool is_imc;
/**
* Active TPM
* IMC-PTS: own TPM / IMV-PTS: unused
*/
tpm_tss_t *tpm;
/**
* Contains a TPM_CAP_VERSION_INFO struct
* IMC-PTS: own TPM version / IMV-PTS: peer TPM version
*/
tpm_version_t tpm_version;
/**
* Contains a TPM Version Info struct
*/
chunk_t tpm_version_info;
@@ -311,6 +315,12 @@ METHOD(pts_t, set_platform_id, void,
this->platform_id = pid;
}
METHOD(pts_t, get_tpm, tpm_tss_t*,
private_pts_t *this)
{
return this->tpm;
}
METHOD(pts_t, get_tpm_version_info, bool,
private_pts_t *this, chunk_t *info)
{
@@ -319,9 +329,68 @@ METHOD(pts_t, get_tpm_version_info, bool,
return info->len > 0;
}
#define TPM_VERSION_INFO_TAG_1_2 0x0030
#define TPM_VERSION_INFO_TAG_2_0 0x0200
#define TPM_VERSION_INFO_LABEL "Version Information: TPM"
METHOD(pts_t, set_tpm_version_info, void,
private_pts_t *this, chunk_t info)
{
bio_reader_t *reader;
uint16_t tpm_version_info_tag;
chunk_t vendor;
reader = bio_reader_create(info);
reader->read_uint16(reader, &tpm_version_info_tag);
if (tpm_version_info_tag == TPM_VERSION_INFO_TAG_1_2)
{
uint8_t major, minor, rev_major, rev_minor, errata_rev;
uint16_t spec_level;
this->tpm_version = TPM_VERSION_1_2;
if (reader->read_uint8 (reader, &major) &&
reader->read_uint8 (reader, &minor) &&
reader->read_uint8 (reader, &rev_major) &&
reader->read_uint8 (reader, &rev_minor) &&
reader->read_uint16(reader, &spec_level) &&
reader->read_uint8 (reader, &errata_rev) &&
reader->read_data (reader, 4, &vendor))
{
DBG2(DBG_PTS, "%s 1.2 rev. %u.%u.%u.%u %.*s", TPM_VERSION_INFO_LABEL,
(uint32_t)major, (uint32_t)minor, (uint32_t)rev_major,
(uint32_t)rev_minor, vendor.len, vendor.ptr);
}
else
{
DBG2(DBG_PTS, "%s 1.2", TPM_VERSION_INFO_LABEL);
}
}
else if (tpm_version_info_tag == TPM_VERSION_INFO_TAG_2_0)
{
uint32_t revision, year;
uint8_t reserved, locality;
this->tpm_version = TPM_VERSION_2_0;
if (reader->read_uint16(reader, &reserved) &&
reader->read_uint32(reader, &revision) &&
reader->read_uint32(reader, &year) &&
reader->read_data (reader, 4, &vendor))
{
DBG2(DBG_PTS, "%s 2.0 rev. %4.2f %u %.*s - startup locality: %u",
TPM_VERSION_INFO_LABEL, revision/100.0, year,
vendor.len, vendor.ptr, (uint32_t)locality);
}
else
{
DBG2(DBG_PTS, "%s 2.0", TPM_VERSION_INFO_LABEL);
}
}
reader->destroy(reader);
this->tpm_version_info = chunk_clone(info);
}
@@ -775,6 +844,10 @@ METHOD(pts_t, verify_quote_signature, bool,
METHOD(pts_t, get_pcrs, pts_pcr_t*,
private_pts_t *this)
{
if (!this->pcrs)
{
this->pcrs = pts_pcr_create(this->tpm_version);
}
return this->pcrs;
}
@@ -798,14 +871,6 @@ METHOD(pts_t, destroy, void,
pts_t *pts_create(bool is_imc)
{
private_pts_t *this;
pts_pcr_t *pcrs;
pcrs = pts_pcr_create();
if (!pcrs)
{
DBG1(DBG_PTS, "shadow PCR set could not be created");
return NULL;
}
INIT(this,
.public = {
@@ -821,6 +886,7 @@ pts_t *pts_create(bool is_imc)
.calculate_secret = _calculate_secret,
.get_platform_id = _get_platform_id,
.set_platform_id = _set_platform_id,
.get_tpm = _get_tpm,
.get_tpm_version_info = _get_tpm_version_info,
.set_tpm_version_info = _set_tpm_version_info,
.get_aik = _get_aik,
@@ -840,7 +906,6 @@ pts_t *pts_create(bool is_imc)
.proto_caps = PTS_PROTO_CAPS_V,
.algorithm = PTS_MEAS_ALGO_SHA256,
.dh_hash_algorithm = PTS_MEAS_ALGO_SHA256,
.pcrs = pcrs,
);
if (is_imc)
@@ -849,12 +914,14 @@ pts_t *pts_create(bool is_imc)
if (this->tpm)
{
this->proto_caps |= PTS_PROTO_CAPS_T | PTS_PROTO_CAPS_D;
this->tpm_version = this->tpm->get_version(this->tpm);
load_aik(this);
}
}
else
{
this->proto_caps |= PTS_PROTO_CAPS_T | PTS_PROTO_CAPS_D;
this->tpm_version = TPM_VERSION_2_0;
}
return &this->public;
src/libimcv/pts/pts.h
+12 -4
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2011 Sansar Choinyambuu
* Copyright (C) 2012-2016 Andreas Steffen
* Copyright (C) 2012-2020 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -35,6 +35,7 @@ typedef struct pts_t pts_t;
#include "components/pts_comp_func_name.h"
#include <tpm_tss_quote_info.h>
#include <tpm_tss.h>
#include <library.h>
#include <collections/linked_list.h>
@@ -174,18 +175,25 @@ struct pts_t {
*/
void (*set_platform_id)(pts_t *this, int pid);
/**
* Get TPM object handle
*
* @return TPM object handle
*/
tpm_tss_t* (*get_tpm)(pts_t *this);
/**
* Get TPM 1.2 Version Info
*
* @param info chunk containing a TPM_CAP_VERSION_INFO struct
* @return TRUE if TPM Version Info available
* @param info chunk containing a TPM_Version Info struct
* @return TRUE if TPM Version_Info available
*/
bool (*get_tpm_version_info)(pts_t *this, chunk_t *info);
/**
* Set TPM 1.2 Version Info
*
* @param info chunk containing a TPM_CAP_VERSION_INFO struct
* @param info chunk containing a TPM Version Info struct
*/
void (*set_tpm_version_info)(pts_t *this, chunk_t info);
src/libimcv/pts/pts_ima_bios_list.c
+68 -33
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2014 Andreas Steffen
* Copyright (C) 2011-2020 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -27,8 +27,8 @@ typedef struct private_pts_ima_bios_list_t private_pts_ima_bios_list_t;
typedef struct bios_entry_t bios_entry_t;
typedef enum event_type_t event_type_t;
/* BIOS Events (TCG PC Client Specification for Conventional BIOS 1.21) */
enum event_type_t {
/* BIOS Events (TCG PC Client Specification for Conventional BIOS 1.21) */
EV_PREBOOT_CERT = 0x00000000,
EV_POST_CODE = 0x00000001,
EV_UNUSED = 0x00000002,
@@ -50,22 +50,25 @@ enum event_type_t {
EV_OMIT_BOOT_DEVICE_EVENTS = 0x00000012,
/* EFI Events (TCG EFI Platform Specification 1.22) */
EV_EFI_EVENT_BASE = 0x80000000,
EV_EFI_VARIABLE_DRIVER_CONFIG = 0x80000001,
EV_EFI_VARIABLE_BOOT = 0x80000002,
EV_EFI_BOOT_SERVICES_APPLICATION = 0x80000003,
EV_EFI_BOOT_SERVICES_DRIVER = 0x80000004,
EV_EFI_RUNTIME_SERVICES_DRIVER = 0x80000005,
EV_EFI_GPT_EVENT = 0x80000006,
EV_EFI_ACTION = 0x80000007,
EV_EFI_PLATFORM_FIRMWARE_BLOB = 0x80000008,
EV_EFI_HANDOFF_TABLES = 0x80000009,
EV_EFI_VARIABLE_DRIVER_CONFIG = 0x70000001,
EV_EFI_VARIABLE_BOOT = 0x70000002,
EV_EFI_BOOT_SERVICES_APPLICATION = 0x70000003,
EV_EFI_BOOT_SERVICES_DRIVER = 0x70000004,
EV_EFI_RUNTIME_SERVICES_DRIVER = 0x70000005,
EV_EFI_GPT_EVENT = 0x70000006,
EV_EFI_ACTION = 0x70000007,
EV_EFI_PLATFORM_FIRMWARE_BLOB = 0x70000008,
EV_EFI_HANDOFF_TABLES = 0x70000009,
EV_EFI_HCRTM_EVENT = 0x80000010,
EV_EFI_HCRTM_EVENT = 0x70000010,
EV_EFI_VARIABLE_AUTHORITY = 0x800000E0
EV_EFI_VARIABLE_AUTHORITY = 0x700000E0,
};
/* By subtracting an offset from EFI events the enum will always be positive */
#define EV_EFI_EVENT_BASE 0x80000000
#define EV_EFI_OFFSET 0x10000000
ENUM_BEGIN(event_type_names, EV_PREBOOT_CERT, EV_OMIT_BOOT_DEVICE_EVENTS,
"Preboot Cert",
"POST Code",
@@ -87,9 +90,8 @@ ENUM_BEGIN(event_type_names, EV_PREBOOT_CERT, EV_OMIT_BOOT_DEVICE_EVENTS,
"Nonhost Info",
"Omit Boot Device Events"
);
ENUM_NEXT(event_type_names, EV_EFI_EVENT_BASE, EV_EFI_HANDOFF_TABLES,
ENUM_NEXT(event_type_names, EV_EFI_VARIABLE_DRIVER_CONFIG, EV_EFI_HANDOFF_TABLES,
EV_OMIT_BOOT_DEVICE_EVENTS,
"EFI Event Base",
"EFI Variable Driver Config",
"EFI Variable Boot",
"EFI Boot Services Application",
@@ -194,11 +196,11 @@ METHOD(pts_ima_bios_list_t, destroy, void,
/**
* See header
*/
pts_ima_bios_list_t* pts_ima_bios_list_create(char *file)
pts_ima_bios_list_t* pts_ima_bios_list_create(tpm_tss_t *tpm, char *file)
{
private_pts_ima_bios_list_t *this;
uint32_t pcr, event_type, event_len, seek_len;
uint32_t buf_len = 2048;
uint32_t pcr, ev_type, event_type, event_len, seek_len, count = 1;
uint32_t buf_len = 8192;
uint8_t event_buf[buf_len];
chunk_t event;
bios_entry_t *entry;
@@ -206,6 +208,12 @@ pts_ima_bios_list_t* pts_ima_bios_list_create(char *file)
ssize_t res;
int fd;
if (!tpm)
{
DBG1(DBG_PTS, "no TPM available");
return NULL;
}
fd = open(file, O_RDONLY);
if (fd == -1)
{
@@ -232,7 +240,7 @@ pts_ima_bios_list_t* pts_ima_bios_list_create(char *file)
.list = linked_list_create(),
);
DBG2(DBG_PTS, "PCR Event Type (Size)");
DBG2(DBG_PTS, "No. PCR Event Type (Size)");
while (TRUE)
{
res = read(fd, &pcr, 4);
@@ -246,7 +254,7 @@ pts_ima_bios_list_t* pts_ima_bios_list_create(char *file)
entry = malloc_thing(bios_entry_t);
entry->pcr = pcr;
entry->measurement = chunk_alloc(HASH_SIZE_SHA1);
entry->measurement = chunk_empty;
if (res != 4)
{
@@ -256,7 +264,7 @@ pts_ima_bios_list_t* pts_ima_bios_list_create(char *file)
{
break;
}
if (read(fd, entry->measurement.ptr, HASH_SIZE_SHA1) != HASH_SIZE_SHA1)
if (!tpm->get_event_digest(tpm, fd, &entry->measurement))
{
break;
}
@@ -264,9 +272,10 @@ pts_ima_bios_list_t* pts_ima_bios_list_create(char *file)
{
break;
}
DBG2(DBG_PTS, "%2u %N (%u bytes)", pcr, event_type_names, event_type,
event_len);
ev_type = (event_type < EV_EFI_EVENT_BASE) ?
event_type : event_type - EV_EFI_OFFSET;
DBG2(DBG_PTS, "%3u %2u %N (%u bytes)", count, pcr, event_type_names,
ev_type, event_len);
seek_len = (event_len > buf_len) ? event_len - buf_len : 0;
event_len -= seek_len;
@@ -274,23 +283,49 @@ pts_ima_bios_list_t* pts_ima_bios_list_create(char *file)
{
break;
}
switch (event_type)
{
case EV_PREBOOT_CERT:
case EV_POST_CODE:
case EV_NO_ACTION:
case EV_ACTION:
case EV_EFI_ACTION:
case EV_S_CRTM_CONTENTS:
case EV_IPL:
if (event_type == EV_NO_ACTION && event_len == 17 &&
streq(event_buf, "StartupLocality"))
{
DBG2(DBG_PTS, " 'StartupLocality' %x", event_buf[16]);
}
else
{
DBG2(DBG_PTS, " '%.*s'", event_len, event_buf);
}
break;
default:
break;
}
event = chunk_create(event_buf, event_len);
DBG3(DBG_PTS,"%B", &event);
if (event_type == EV_ACTION || event_type == EV_EFI_ACTION)
{
DBG2(DBG_PTS, " '%.*s'", event_len, event_buf);
}
if (seek_len > 0 && lseek(fd, seek_len, SEEK_CUR) == -1)
{
break;
}
this->list->insert_last(this->list, entry);
if (event_type == EV_NO_ACTION || entry->measurement.len == 0)
{
free_bios_entry(entry);
DBG2(DBG_PTS, " Not extended into PCR!");
}
else
{
this->list->insert_last(this->list, entry);
count++;
}
}
DBG1(DBG_PTS, "loading bios measurements '%s' failed: %s", file,
strerror(errno));
DBG1(DBG_PTS, "loading bios measurements '%s' failed", file);
free_bios_entry(entry);
close(fd);
destroy(this);
src/libimcv/pts/pts_ima_bios_list.h
+4 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2014 Andreas Steffen
* Copyright (C) 2014-2020 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -24,6 +24,7 @@
#include <time.h>
#include <library.h>
#include <tpm_tss.h>
typedef struct pts_ima_bios_list_t pts_ima_bios_list_t;
@@ -67,8 +68,9 @@ struct pts_ima_bios_list_t {
/**
* Create a PTS IMA BIOS measurement object
*
* @param tpm TPM object
* @param file Pathname pointing to the BIOS measurements
*/
pts_ima_bios_list_t* pts_ima_bios_list_create(char *file);
pts_ima_bios_list_t* pts_ima_bios_list_create(tpm_tss_t *tpm, char *file);
#endif /** PTS_IMA_BIOS_LIST_H_ @}*/
src/libimcv/pts/pts_pcr.c
+11 -1
View File
@@ -243,7 +243,7 @@ METHOD(pts_pcr_t, destroy, void,
/**
* See header
*/
pts_pcr_t *pts_pcr_create(void)
pts_pcr_t *pts_pcr_create(tpm_version_t tpm_version)
{
private_pts_pcr_t *this;
hasher_t *hasher;
@@ -278,6 +278,16 @@ pts_pcr_t *pts_pcr_create(void)
memset(this->pcrs[i].ptr, 0x00, PTS_PCR_LEN);
}
/* Set locality indicator in PCR[0] */
if (tpm_version == TPM_VERSION_2_0)
{
const uint8_t locality = 3;
DBG2(DBG_PTS, "TPM 2.0 - locality indicator set to %u",
(uint32_t)locality);
this->pcrs[0].ptr[PTS_PCR_LEN - 1] = locality;
}
return &this->public;
}
src/libimcv/pts/pts_pcr.h
+4 -1
View File
@@ -25,6 +25,7 @@ typedef struct pts_pcr_t pts_pcr_t;
#include <library.h>
#include <tpm_tss.h>
#include <tpm_tss_quote_info.h>
/**
@@ -114,7 +115,9 @@ struct pts_pcr_t {
/**
* Creates an pts_pcr_t object
*
* @param tpm_version TPM version
*/
pts_pcr_t* pts_pcr_create(void);
pts_pcr_t* pts_pcr_create(tpm_version_t tpm_version);
#endif /** PTS_PCR_H_ @}*/