1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*******************************************************************************
3 * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
4 * All rights reserved.
5 *******************************************************************************/
6
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10
11 #include <stdlib.h>
12
13 #include "tss2_fapi.h"
14
15 #include "test-fapi.h"
16 #include "fapi_util.h"
17 #include "fapi_int.h"
18
19 #include "esys_iutil.h"
20 #define LOGMODULE test
21 #include "util/log.h"
22 #include "util/aux_util.h"
23
24 #define PASSWORD "abc"
25 #define SIGN_TEMPLATE "sign,noDa"
26
27
28 static TSS2_RC
auth_callback(FAPI_CONTEXT * context,char const * description,char ** auth,void * userData)29 auth_callback(
30 FAPI_CONTEXT *context,
31 char const *description,
32 char **auth,
33 void *userData)
34 {
35 (void)description;
36 (void)userData;
37 *auth = strdup(PASSWORD);
38 return_if_null(*auth, "Out of memory.", TSS2_FAPI_RC_MEMORY);
39 return TSS2_RC_SUCCESS;
40 }
41
42 /** Test the FAPI functions for TpmBlobs and certificates.
43 *
44 * Tested FAPI commands:
45 * - Fapi_Provision()
46 * - Fapi_SetAuthCB()
47 * - Fapi_CreateKey()
48 * - Fapi_GetTpmBlobs()
49 * - Fapi_Sign()
50 * - Fapi_VerifySignature()
51 * - Fapi_SetCertificate()
52 * - Fapi_List()
53 * - Fapi_ChangeAuth()
54 * - Fapi_Delete()
55 *
56 * @param[in,out] context The FAPI_CONTEXT.
57 * @retval EXIT_FAILURE
58 * @retval EXIT_SUCCESS
59 */
60 int
test_fapi_key_create_sign(FAPI_CONTEXT * context)61 test_fapi_key_create_sign(FAPI_CONTEXT *context)
62 {
63 TSS2_RC r;
64 char *sigscheme = NULL;
65
66 const char *cert =
67 "-----BEGIN CERTIFICATE-----\n"
68 "MIIDBjCCAe4CCQDcvXBOEVM0UTANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJE\n"
69 "RTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0\n"
70 "cyBQdHkgTHRkMB4XDTE5MDIyODEwNDkyM1oXDTM1MDgyNzEwNDkyM1owRTELMAkG\n"
71 "A1UEBhMCREUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0\n"
72 "IFdpZGdpdHMgUHR5IEx0ZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB\n"
73 "AKBi+iKwkgM55iCMwXrLCJlu7TzlMu/LlkyGrm99ip2B5+/Cl6a62d8pKelg6zkH\n"
74 "jI7+AAPteJiW4O+2qVWF8hJ5BXTjGtYbM0iZ6enCb8eyC54C7xVMc21ZIv3ob4Et\n"
75 "50ZOuzY2pfpzE3vIaXt1CkHlfyI/hdK+mM/dVvuCz5p3AIlHrEWS3rSNgWbCsB2E\n"
76 "TM55qSGKaLmtTbUvEKRF0TJrFLntfXkv10QD5pgn52+QV9k59OogqZOsDvkXzKPX\n"
77 "rXF+XC0gLiGBEGAr1dv9F03xMOtO77bQTdGOeC61Tip6Nb0V3ebMckZXwdFi+Nhe\n"
78 "FRuU33CaObtV6u5PZvSue/MCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAcamUPe8I\n"
79 "nMOHcv9x5lVN1joihVRmKc0QqNLFc6XpJY8+U5rGkZvOcDe9Da8L97wDNXpKmU/q\n"
80 "pprj3rT8l3v0Z5xs8Vdr8lxS6T5NhqQV0UCsn1x14gZJcE48y9/LazYi6Zcar+BX\n"
81 "Am4vewAV3HmQ8X2EctsRhXe4wlAq4slIfEWaaofa8ai7BzO9KwpMLsGPWoNetkB9\n"
82 "19+SFt0lFFOj/6vDw5pCpSd1nQlo1ug69mJYSX/wcGkV4t4LfGhV8jRPDsGs6I5n\n"
83 "ETHSN5KV1XCPYJmRCjFY7sIt1x4zN7JJRO9DVw+YheIlduVfkBiF+GlQgLlFTjrJ\n"
84 "VrpSGMIFSu301A==\n"
85 "-----END CERTIFICATE-----\n";
86
87 uint8_t *signature = NULL;
88 char *publicKey = NULL;
89 uint8_t *publicblob = NULL;
90 uint8_t *privateblob = NULL;
91 char *path_list = NULL;
92 size_t publicsize;
93 size_t privatesize;
94
95 if (strcmp("P_ECC", fapi_profile) != 0)
96 sigscheme = "RSA_PSS";
97
98 /* We need to reset the passwords again, in order to not brick physical TPMs */
99 r = Fapi_Provision(context, NULL, PASSWORD, NULL);
100 goto_if_error(r, "Error Fapi_Provision", error);
101
102 r = Fapi_SetAuthCB(context, auth_callback, NULL);
103 goto_if_error(r, "Error SetPolicyAuthCallback", error);
104
105 r = Fapi_CreateKey(context, "HS/SRK/mySignKey", SIGN_TEMPLATE, "",
106 PASSWORD);
107 goto_if_error(r, "Error Fapi_CreateKey_Async", error);
108
109 goto_if_error(r, "Error Fapi_CreateKey_Finish", error);
110 size_t signatureSize = 0;
111
112 TPM2B_DIGEST digest = {
113 .size = 32,
114 .buffer = {
115 0x67, 0x68, 0x03, 0x3e, 0x21, 0x64, 0x68, 0x24, 0x7b, 0xd0,
116 0x31, 0xa0, 0xa2, 0xd9, 0x87, 0x6d, 0x79, 0x81, 0x8f, 0x8f,
117 0x31, 0xa0, 0xa2, 0xd9, 0x87, 0x6d, 0x79, 0x81, 0x8f, 0x8f,
118 0x67, 0x68
119 }
120 };
121
122 r = Fapi_GetTpmBlobs(context, "HS/SRK/mySignKey", &publicblob,
123 &publicsize,
124 &privateblob, &privatesize, NULL);
125 goto_if_error(r, "Error Fapi_GetTpmBlobs", error);
126
127 r = Fapi_Sign(context, "HS/SRK/mySignKey", sigscheme,
128 &digest.buffer[0], digest.size, &signature, &signatureSize,
129 &publicKey, NULL);
130 goto_if_error(r, "Error Fapi_Sign", error);
131
132 r = Fapi_VerifySignature(context, "HS/SRK/mySignKey",
133 &digest.buffer[0], digest.size, signature, signatureSize);
134 goto_if_error(r, "Error Fapi_VerifySignature", error);
135
136
137 r = Fapi_SetCertificate(context, "HS/SRK/mySignKey", cert);
138 goto_if_error(r, "Error Fapi_SetCertificate", error);
139
140 r = Fapi_List(context, "/", &path_list);
141 goto_if_error(r, "Error Fapi_Delete", error);
142
143 fprintf(stderr, "\nPathList:\n%s\n", path_list);
144
145 /* We need to reset the passwords again, in order to not brick physical TPMs */
146 r = Fapi_ChangeAuth(context, "/HS", NULL);
147 goto_if_error(r, "Error Fapi_ChangeAuth", error);
148
149 r = Fapi_Delete(context, "/");
150 goto_if_error(r, "Error Fapi_Delete", error);
151
152 SAFE_FREE(path_list);
153 SAFE_FREE(publicblob);
154 SAFE_FREE(privateblob);
155 SAFE_FREE(publicKey);
156 SAFE_FREE(signature);
157 return EXIT_SUCCESS;
158
159 error:
160 Fapi_Delete(context, "/HS/SRK");
161 SAFE_FREE(path_list);
162 SAFE_FREE(publicblob);
163 SAFE_FREE(privateblob);
164 SAFE_FREE(publicKey);
165 SAFE_FREE(signature);
166 return EXIT_FAILURE;
167 }
168
169 int
test_invoke_fapi(FAPI_CONTEXT * fapi_context)170 test_invoke_fapi(FAPI_CONTEXT *fapi_context)
171 {
172 return test_fapi_key_create_sign(fapi_context);
173 }
174