• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*******************************************************************************
3  * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
4  * All rights reserved.
5  ******************************************************************************/
6 
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10 
11 #include "tss2_mu.h"
12 #include "tss2_sys.h"
13 #include "tss2_esys.h"
14 
15 #include "esys_types.h"
16 #include "esys_iutil.h"
17 #include "esys_mu.h"
18 #define LOGMODULE esys
19 #include "util/log.h"
20 #include "util/aux_util.h"
21 
22 /** One-Call function for TPM2_ObjectChangeAuth
23  *
24  * This function invokes the TPM2_ObjectChangeAuth command in a one-call
25  * variant. This means the function will block until the TPM response is
26  * available. All input parameters are const. The memory for non-simple output
27  * parameters is allocated by the function implementation.
28  *
29  * @param[in,out] esysContext The ESYS_CONTEXT.
30  * @param[in]  objectHandle Handle of the object.
31  * @param[in]  parentHandle Handle of the parent.
32  * @param[in]  shandle1 Session handle for authorization of objectHandle
33  * @param[in]  shandle2 Second session handle.
34  * @param[in]  shandle3 Third session handle.
35  * @param[in]  newAuth New authorization value.
36  * @param[out] outPrivate Private area containing the new authorization value.
37  *             (callee-allocated)
38  * @retval TSS2_RC_SUCCESS if the function call was a success.
39  * @retval TSS2_ESYS_RC_BAD_REFERENCE if the esysContext or required input
40  *         pointers or required output handle references are NULL.
41  * @retval TSS2_ESYS_RC_BAD_CONTEXT: if esysContext corruption is detected.
42  * @retval TSS2_ESYS_RC_MEMORY: if the ESAPI cannot allocate enough memory for
43  *         internal operations or return parameters.
44  * @retval TSS2_ESYS_RC_BAD_SEQUENCE: if the context has an asynchronous
45  *         operation already pending.
46  * @retval TSS2_ESYS_RC_INSUFFICIENT_RESPONSE: if the TPM's response does not
47  *          at least contain the tag, response length, and response code.
48  * @retval TSS2_ESYS_RC_MALFORMED_RESPONSE: if the TPM's response is corrupted.
49  * @retval TSS2_ESYS_RC_RSP_AUTH_FAILED: if the response HMAC from the TPM
50            did not verify.
51  * @retval TSS2_ESYS_RC_MULTIPLE_DECRYPT_SESSIONS: if more than one session has
52  *         the 'decrypt' attribute bit set.
53  * @retval TSS2_ESYS_RC_MULTIPLE_ENCRYPT_SESSIONS: if more than one session has
54  *         the 'encrypt' attribute bit set.
55  * @retval TSS2_ESYS_RC_BAD_TR: if any of the ESYS_TR objects are unknown
56  *         to the ESYS_CONTEXT or are of the wrong type or if required
57  *         ESYS_TR objects are ESYS_TR_NONE.
58  * @retval TSS2_RCs produced by lower layers of the software stack may be
59  *         returned to the caller unaltered unless handled internally.
60  */
61 TSS2_RC
Esys_ObjectChangeAuth(ESYS_CONTEXT * esysContext,ESYS_TR objectHandle,ESYS_TR parentHandle,ESYS_TR shandle1,ESYS_TR shandle2,ESYS_TR shandle3,const TPM2B_AUTH * newAuth,TPM2B_PRIVATE ** outPrivate)62 Esys_ObjectChangeAuth(
63     ESYS_CONTEXT *esysContext,
64     ESYS_TR objectHandle,
65     ESYS_TR parentHandle,
66     ESYS_TR shandle1,
67     ESYS_TR shandle2,
68     ESYS_TR shandle3,
69     const TPM2B_AUTH *newAuth,
70     TPM2B_PRIVATE **outPrivate)
71 {
72     TSS2_RC r;
73 
74     r = Esys_ObjectChangeAuth_Async(esysContext, objectHandle, parentHandle,
75                                     shandle1, shandle2, shandle3, newAuth);
76     return_if_error(r, "Error in async function");
77 
78     /* Set the timeout to indefinite for now, since we want _Finish to block */
79     int32_t timeouttmp = esysContext->timeout;
80     esysContext->timeout = -1;
81     /*
82      * Now we call the finish function, until return code is not equal to
83      * from TSS2_BASE_RC_TRY_AGAIN.
84      * Note that the finish function may return TSS2_RC_TRY_AGAIN, even if we
85      * have set the timeout to -1. This occurs for example if the TPM requests
86      * a retransmission of the command via TPM2_RC_YIELDED.
87      */
88     do {
89         r = Esys_ObjectChangeAuth_Finish(esysContext, outPrivate);
90         /* This is just debug information about the reattempt to finish the
91            command */
92         if ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN)
93             LOG_DEBUG("A layer below returned TRY_AGAIN: %" PRIx32
94                       " => resubmitting command", r);
95     } while ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN);
96 
97     /* Restore the timeout value to the original value */
98     esysContext->timeout = timeouttmp;
99     return_if_error(r, "Esys Finish");
100 
101     return TSS2_RC_SUCCESS;
102 }
103 
104 /** Asynchronous function for TPM2_ObjectChangeAuth
105  *
106  * This function invokes the TPM2_ObjectChangeAuth command in a asynchronous
107  * variant. This means the function will return as soon as the command has been
108  * sent downwards the stack to the TPM. All input parameters are const.
109  * In order to retrieve the TPM's response call Esys_ObjectChangeAuth_Finish.
110  *
111  * @param[in,out] esysContext The ESYS_CONTEXT.
112  * @param[in]  objectHandle Handle of the object.
113  * @param[in]  parentHandle Handle of the parent.
114  * @param[in]  shandle1 Session handle for authorization of objectHandle
115  * @param[in]  shandle2 Second session handle.
116  * @param[in]  shandle3 Third session handle.
117  * @param[in]  newAuth New authorization value.
118  * @retval ESYS_RC_SUCCESS if the function call was a success.
119  * @retval TSS2_ESYS_RC_BAD_REFERENCE if the esysContext or required input
120  *         pointers or required output handle references are NULL.
121  * @retval TSS2_ESYS_RC_BAD_CONTEXT: if esysContext corruption is detected.
122  * @retval TSS2_ESYS_RC_MEMORY: if the ESAPI cannot allocate enough memory for
123  *         internal operations or return parameters.
124  * @retval TSS2_RCs produced by lower layers of the software stack may be
125            returned to the caller unaltered unless handled internally.
126  * @retval TSS2_ESYS_RC_MULTIPLE_DECRYPT_SESSIONS: if more than one session has
127  *         the 'decrypt' attribute bit set.
128  * @retval TSS2_ESYS_RC_MULTIPLE_ENCRYPT_SESSIONS: if more than one session has
129  *         the 'encrypt' attribute bit set.
130  * @retval TSS2_ESYS_RC_BAD_TR: if any of the ESYS_TR objects are unknown
131  *         to the ESYS_CONTEXT or are of the wrong type or if required
132  *         ESYS_TR objects are ESYS_TR_NONE.
133  */
134 TSS2_RC
Esys_ObjectChangeAuth_Async(ESYS_CONTEXT * esysContext,ESYS_TR objectHandle,ESYS_TR parentHandle,ESYS_TR shandle1,ESYS_TR shandle2,ESYS_TR shandle3,const TPM2B_AUTH * newAuth)135 Esys_ObjectChangeAuth_Async(
136     ESYS_CONTEXT *esysContext,
137     ESYS_TR objectHandle,
138     ESYS_TR parentHandle,
139     ESYS_TR shandle1,
140     ESYS_TR shandle2,
141     ESYS_TR shandle3,
142     const TPM2B_AUTH *newAuth)
143 {
144     TSS2_RC r;
145     LOG_TRACE("context=%p, objectHandle=%"PRIx32 ", parentHandle=%"PRIx32 ","
146               "newAuth=%p",
147               esysContext, objectHandle, parentHandle, newAuth);
148     TSS2L_SYS_AUTH_COMMAND auths;
149     RSRC_NODE_T *objectHandleNode;
150     RSRC_NODE_T *parentHandleNode;
151 
152     /* Check context, sequence correctness and set state to error for now */
153     if (esysContext == NULL) {
154         LOG_ERROR("esyscontext is NULL.");
155         return TSS2_ESYS_RC_BAD_REFERENCE;
156     }
157     r = iesys_check_sequence_async(esysContext);
158     if (r != TSS2_RC_SUCCESS)
159         return r;
160     esysContext->state = _ESYS_STATE_INTERNALERROR;
161 
162     /* Check input parameters */
163     r = check_session_feasibility(shandle1, shandle2, shandle3, 1);
164     return_state_if_error(r, _ESYS_STATE_INIT, "Check session usage");
165 
166     /* Retrieve the metadata objects for provided handles */
167     r = esys_GetResourceObject(esysContext, objectHandle, &objectHandleNode);
168     return_state_if_error(r, _ESYS_STATE_INIT, "objectHandle unknown.");
169     r = esys_GetResourceObject(esysContext, parentHandle, &parentHandleNode);
170     return_state_if_error(r, _ESYS_STATE_INIT, "parentHandle unknown.");
171 
172     /* Initial invocation of SAPI to prepare the command buffer with parameters */
173     r = Tss2_Sys_ObjectChangeAuth_Prepare(esysContext->sys,
174                                           (objectHandleNode == NULL)
175                                            ? TPM2_RH_NULL
176                                            : objectHandleNode->rsrc.handle,
177                                           (parentHandleNode == NULL)
178                                            ? TPM2_RH_NULL
179                                            : parentHandleNode->rsrc.handle,
180                                           newAuth);
181     return_state_if_error(r, _ESYS_STATE_INIT, "SAPI Prepare returned error.");
182 
183     /* Calculate the cpHash Values */
184     r = init_session_tab(esysContext, shandle1, shandle2, shandle3);
185     return_state_if_error(r, _ESYS_STATE_INIT, "Initialize session resources");
186     if (objectHandleNode != NULL)
187         iesys_compute_session_value(esysContext->session_tab[0],
188                 &objectHandleNode->rsrc.name, &objectHandleNode->auth);
189     else
190         iesys_compute_session_value(esysContext->session_tab[0], NULL, NULL);
191 
192     iesys_compute_session_value(esysContext->session_tab[1], NULL, NULL);
193     iesys_compute_session_value(esysContext->session_tab[2], NULL, NULL);
194 
195     /* Generate the auth values and set them in the SAPI command buffer */
196     r = iesys_gen_auths(esysContext, objectHandleNode, parentHandleNode, NULL, &auths);
197     return_state_if_error(r, _ESYS_STATE_INIT,
198                           "Error in computation of auth values");
199 
200     esysContext->authsCount = auths.count;
201     if (auths.count > 0) {
202         r = Tss2_Sys_SetCmdAuths(esysContext->sys, &auths);
203         return_state_if_error(r, _ESYS_STATE_INIT, "SAPI error on SetCmdAuths");
204     }
205 
206     /* Trigger execution and finish the async invocation */
207     r = Tss2_Sys_ExecuteAsync(esysContext->sys);
208     return_state_if_error(r, _ESYS_STATE_INTERNALERROR,
209                           "Finish (Execute Async)");
210 
211     esysContext->state = _ESYS_STATE_SENT;
212 
213     return r;
214 }
215 
216 /** Asynchronous finish function for TPM2_ObjectChangeAuth
217  *
218  * This function returns the results of a TPM2_ObjectChangeAuth command
219  * invoked via Esys_ObjectChangeAuth_Finish. All non-simple output parameters
220  * are allocated by the function's implementation. NULL can be passed for every
221  * output parameter if the value is not required.
222  *
223  * @param[in,out] esysContext The ESYS_CONTEXT.
224  * @param[out] outPrivate Private area containing the new authorization value.
225  *             (callee-allocated)
226  * @retval TSS2_RC_SUCCESS on success
227  * @retval ESYS_RC_SUCCESS if the function call was a success.
228  * @retval TSS2_ESYS_RC_BAD_REFERENCE if the esysContext or required input
229  *         pointers or required output handle references are NULL.
230  * @retval TSS2_ESYS_RC_BAD_CONTEXT: if esysContext corruption is detected.
231  * @retval TSS2_ESYS_RC_MEMORY: if the ESAPI cannot allocate enough memory for
232  *         internal operations or return parameters.
233  * @retval TSS2_ESYS_RC_BAD_SEQUENCE: if the context has an asynchronous
234  *         operation already pending.
235  * @retval TSS2_ESYS_RC_TRY_AGAIN: if the timeout counter expires before the
236  *         TPM response is received.
237  * @retval TSS2_ESYS_RC_INSUFFICIENT_RESPONSE: if the TPM's response does not
238  *         at least contain the tag, response length, and response code.
239  * @retval TSS2_ESYS_RC_RSP_AUTH_FAILED: if the response HMAC from the TPM did
240  *         not verify.
241  * @retval TSS2_ESYS_RC_MALFORMED_RESPONSE: if the TPM's response is corrupted.
242  * @retval TSS2_RCs produced by lower layers of the software stack may be
243  *         returned to the caller unaltered unless handled internally.
244  */
245 TSS2_RC
Esys_ObjectChangeAuth_Finish(ESYS_CONTEXT * esysContext,TPM2B_PRIVATE ** outPrivate)246 Esys_ObjectChangeAuth_Finish(
247     ESYS_CONTEXT *esysContext,
248     TPM2B_PRIVATE **outPrivate)
249 {
250     TSS2_RC r;
251     LOG_TRACE("context=%p, outPrivate=%p",
252               esysContext, outPrivate);
253 
254     if (esysContext == NULL) {
255         LOG_ERROR("esyscontext is NULL.");
256         return TSS2_ESYS_RC_BAD_REFERENCE;
257     }
258 
259     /* Check for correct sequence and set sequence to irregular for now */
260     if (esysContext->state != _ESYS_STATE_SENT &&
261         esysContext->state != _ESYS_STATE_RESUBMISSION) {
262         LOG_ERROR("Esys called in bad sequence.");
263         return TSS2_ESYS_RC_BAD_SEQUENCE;
264     }
265     esysContext->state = _ESYS_STATE_INTERNALERROR;
266 
267     /* Allocate memory for response parameters */
268     if (outPrivate != NULL) {
269         *outPrivate = calloc(sizeof(TPM2B_PRIVATE), 1);
270         if (*outPrivate == NULL) {
271             return_error(TSS2_ESYS_RC_MEMORY, "Out of memory");
272         }
273     }
274 
275     /*Receive the TPM response and handle resubmissions if necessary. */
276     r = Tss2_Sys_ExecuteFinish(esysContext->sys, esysContext->timeout);
277     if ((r & ~TSS2_RC_LAYER_MASK) == TSS2_BASE_RC_TRY_AGAIN) {
278         LOG_DEBUG("A layer below returned TRY_AGAIN: %" PRIx32, r);
279         esysContext->state = _ESYS_STATE_SENT;
280         goto error_cleanup;
281     }
282     /* This block handle the resubmission of TPM commands given a certain set of
283      * TPM response codes. */
284     if (r == TPM2_RC_RETRY || r == TPM2_RC_TESTING || r == TPM2_RC_YIELDED) {
285         LOG_DEBUG("TPM returned RETRY, TESTING or YIELDED, which triggers a "
286             "resubmission: %" PRIx32, r);
287         if (esysContext->submissionCount++ >= _ESYS_MAX_SUBMISSIONS) {
288             LOG_WARNING("Maximum number of (re)submissions has been reached.");
289             esysContext->state = _ESYS_STATE_INIT;
290             goto error_cleanup;
291         }
292         esysContext->state = _ESYS_STATE_RESUBMISSION;
293         r = Tss2_Sys_ExecuteAsync(esysContext->sys);
294         if (r != TSS2_RC_SUCCESS) {
295             LOG_WARNING("Error attempting to resubmit");
296             /* We do not set esysContext->state here but inherit the most recent
297              * state of the _async function. */
298             goto error_cleanup;
299         }
300         r = TSS2_ESYS_RC_TRY_AGAIN;
301         LOG_DEBUG("Resubmission initiated and returning RC_TRY_AGAIN.");
302         goto error_cleanup;
303     }
304     /* The following is the "regular error" handling. */
305     if (iesys_tpm_error(r)) {
306         LOG_WARNING("Received TPM Error");
307         esysContext->state = _ESYS_STATE_INIT;
308         goto error_cleanup;
309     } else if (r != TSS2_RC_SUCCESS) {
310         LOG_ERROR("Received a non-TPM Error");
311         esysContext->state = _ESYS_STATE_INTERNALERROR;
312         goto error_cleanup;
313     }
314 
315     /*
316      * Now the verification of the response (hmac check) and if necessary the
317      * parameter decryption have to be done.
318      */
319     r = iesys_check_response(esysContext);
320     goto_state_if_error(r, _ESYS_STATE_INTERNALERROR, "Error: check response",
321                         error_cleanup);
322 
323     /*
324      * After the verification of the response we call the complete function
325      * to deliver the result.
326      */
327     r = Tss2_Sys_ObjectChangeAuth_Complete(esysContext->sys,
328                                            (outPrivate != NULL) ? *outPrivate
329                                             : NULL);
330     goto_state_if_error(r, _ESYS_STATE_INTERNALERROR,
331                         "Received error from SAPI unmarshaling" ,
332                         error_cleanup);
333 
334     esysContext->state = _ESYS_STATE_INIT;
335 
336     return TSS2_RC_SUCCESS;
337 
338 error_cleanup:
339     if (outPrivate != NULL)
340         SAFE_FREE(*outPrivate);
341 
342     return r;
343 }
344