1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /***********************************************************************
3 * Copyright (c) 2017-2018, Intel Corporation
4 *
5 * All rights reserved.
6 ***********************************************************************/
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10
11 #include <inttypes.h>
12 #include <stdio.h>
13 #include <stdlib.h>
14 #include <string.h>
15
16 #include "tss2_mu.h"
17 #include "tss2_sys.h"
18
19 #define LOGMODULE test
20 #include "util/log.h"
21 #include "test.h"
22 #include "sapi-util.h"
23
24 int
test_invoke(TSS2_SYS_CONTEXT * sapi_context)25 test_invoke (TSS2_SYS_CONTEXT *sapi_context)
26 {
27 TSS2_RC rc;
28 TPM2B_SENSITIVE_CREATE in_sensitive = { 0 };
29 TPM2B_PUBLIC in_public = { 0 };
30 TPM2B_DATA outside_info = { 0 };
31 TPML_PCR_SELECTION creation_pcr = { 0 };
32 TPM2B_PUBLIC out_public = { 0 };
33 TPM2B_CREATION_DATA creation_data = { 0 };
34 TPM2B_DIGEST creation_hash = TPM2B_DIGEST_INIT;
35 TPMT_TK_CREATION creation_ticket = { 0 };
36 TPM2B_NAME name = TPM2B_NAME_INIT;
37 TPM2B_NONCE nonce_caller = {
38 .size = TPM2_SHA256_DIGEST_SIZE,
39 .buffer = { 0 }
40 };
41 TPM2B_NONCE nonce_tpm = {
42 .size = TPM2_SHA256_DIGEST_SIZE,
43 .buffer = { 0 }
44 };
45
46 TPM2B_ENCRYPTED_SECRET encrypted_salt = { 0 };
47 TPMI_SH_AUTH_SESSION session_handle = 0;
48 TPMT_SYM_DEF symmetric = { .algorithm = TPM2_ALG_NULL };
49 TPM2B_DIGEST templ_dgst = { 0 };
50 TPM2_HANDLE object_handle = 0;
51 TSS2L_SYS_AUTH_COMMAND cmd_auth = { 0 };
52 TSS2L_SYS_AUTH_RESPONSE rsp_auth = { 0 };
53 TPM2B_DIGEST policy_digest;
54 size_t template_size = 0;
55 uint8_t tmp_buff[sizeof(in_public)] = { 0 };
56 static uint8_t auth[32];
57
58 memset(auth, 's', 32);
59
60 LOG_INFO("StartAuthSession for TPM2_SE_POLICY (policy session)");
61 rc = Tss2_Sys_StartAuthSession (sapi_context,
62 TPM2_RH_NULL, /* tpmKey */
63 TPM2_RH_NULL, /* bind */
64 NULL, /* cmdAuthsArray */
65 &nonce_caller, /* nonceCaller */
66 &encrypted_salt, /* encryptedSalt */
67 TPM2_SE_POLICY, /* sessionType */
68 &symmetric, /* symmetric */
69 TPM2_ALG_SHA256, /* authHash */
70 &session_handle, /* sessionHandle */
71 &nonce_tpm, /* nonceTPM */
72 NULL /* rspAuthsArray */
73 );
74 if (rc != TSS2_RC_SUCCESS) {
75 LOG_ERROR("Tss2_Sys_StartAuthSession failed: 0x%" PRIx32, rc);
76 exit(1);
77 }
78 LOG_INFO("StartAuthSession for TPM2_SE_POLICY success! Session handle: "
79 "0x%" PRIx32, session_handle);
80
81 in_public.publicArea.type = TPM2_ALG_RSA;
82 in_public.publicArea.nameAlg = TPM2_ALG_SHA256;
83 in_public.publicArea.objectAttributes = TPMA_OBJECT_RESTRICTED;
84 in_public.publicArea.objectAttributes |= TPMA_OBJECT_USERWITHAUTH;
85 in_public.publicArea.objectAttributes |= TPMA_OBJECT_DECRYPT;
86 in_public.publicArea.objectAttributes |= TPMA_OBJECT_FIXEDTPM;
87 in_public.publicArea.objectAttributes |= TPMA_OBJECT_FIXEDPARENT;
88 in_public.publicArea.objectAttributes |= TPMA_OBJECT_SENSITIVEDATAORIGIN;
89 in_public.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM2_ALG_AES;
90 in_public.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 128;
91 in_public.publicArea.parameters.rsaDetail.symmetric.mode.aes = TPM2_ALG_CFB;
92 in_public.publicArea.parameters.rsaDetail.scheme.scheme = TPM2_ALG_NULL;
93 in_public.publicArea.parameters.rsaDetail.keyBits = 2048;
94
95 in_public.publicArea.authPolicy.size = sizeof(auth);
96 memcpy(in_public.publicArea.authPolicy.buffer, auth, sizeof(auth));
97
98 cmd_auth.auths[0].sessionHandle = session_handle;
99 cmd_auth.auths[0].sessionAttributes |= TPMA_SESSION_CONTINUESESSION;
100 cmd_auth.auths[0].hmac.size = sizeof(auth);
101 memcpy(cmd_auth.auths[0].hmac.buffer, auth, sizeof(auth));
102
103 /* Calculate the digest of the public param template */
104 rc = Tss2_MU_TPM2B_PUBLIC_Marshal(&in_public, tmp_buff,
105 sizeof(in_public), &template_size);
106 if (rc != TSS2_RC_SUCCESS) {
107 LOG_ERROR("Marshal in_public failed");
108 exit(1);
109 }
110
111 LOG_INFO("Calculating template digest size of in_public: %d", (int)template_size - 2);
112
113 rc = hash(in_public.publicArea.nameAlg, tmp_buff + 2,
114 template_size - 2, &templ_dgst);
115
116
117 if (rc != TSS2_RC_SUCCESS) {
118 LOG_ERROR("Failed calculating template hash");
119 exit(1);
120 }
121 LOGBLOB_DEBUG(tmp_buff + 2, template_size - 2, "%s", "in_public:");
122 LOGBLOB_DEBUG(templ_dgst.buffer, templ_dgst.size, "%s", "template digest:");
123
124 /* Set the template digest on the session.
125 * After that all objects created for this session will be limited
126 * to this particular template
127 */
128 LOG_INFO("Calling Tss2_Sys_PolicyTemplate");
129 rc = Tss2_Sys_PolicyTemplate (sapi_context,
130 session_handle,
131 NULL,
132 &templ_dgst,
133 NULL);
134 if (rc != TSS2_RC_SUCCESS) {
135 LOG_ERROR("Tss2_Sys_PolicyTemplate failed: 0x%" PRIx32, rc);
136 exit(1);
137 }
138
139 /* Need to set the policy auth value */
140 rc = Tss2_Sys_PolicyGetDigest(sapi_context, session_handle,
141 0, &policy_digest, 0);
142
143 if (rc != TSS2_RC_SUCCESS) {
144 LOG_ERROR("Tss2_Sys_PolicyGetDigest failed: 0x%" PRIx32, rc);
145 exit(1);
146 }
147
148 LOGBLOB_DEBUG(policy_digest.buffer, policy_digest.size, "%s", "policy digest:");
149
150 cmd_auth.count = 1;
151 cmd_auth.auths[0].sessionHandle = TPM2_RS_PW;
152 cmd_auth.auths[0].nonce.size = 0;
153 cmd_auth.auths[0].hmac.size = 0;
154
155 rc = Tss2_Sys_SetPrimaryPolicy(sapi_context,
156 TPM2_RH_OWNER,
157 &cmd_auth,
158 &policy_digest,
159 TPM2_ALG_SHA256,
160 &rsp_auth);
161 if (rc == TPM2_RC_SUCCESS) {
162 LOG_INFO("Tss2_Sys_SetPrimaryPolicy success");
163 } else {
164 LOG_ERROR("Tss2_Sys_SetPrimaryPolicy FAILED! Response Code : 0x%x", rc);
165 exit(1);
166 }
167
168 cmd_auth.auths[0].sessionHandle = session_handle;
169 cmd_auth.auths[0].sessionAttributes |= TPMA_SESSION_CONTINUESESSION;
170
171 /* Create an object using the valid template */
172 LOG_INFO("Creating an object using a correct template");
173 rc = Tss2_Sys_CreatePrimary (sapi_context,
174 TPM2_RH_OWNER,
175 &cmd_auth,
176 &in_sensitive,
177 &in_public,
178 &outside_info,
179 &creation_pcr,
180 &object_handle,
181 &out_public,
182 &creation_data,
183 &creation_hash,
184 &creation_ticket,
185 &name,
186 &rsp_auth
187 );
188
189 if (rc == TPM2_RC_SUCCESS) {
190 LOG_INFO("Creating object: 0x%" PRIx32 " success", object_handle);
191 } else {
192 LOG_ERROR("CreatePrimary FAILED! Response Code : 0x%x", rc);
193 exit(1);
194 }
195
196 rc = Tss2_Sys_FlushContext(sapi_context, object_handle);
197 if (rc != TSS2_RC_SUCCESS) {
198 LOG_ERROR("Tss2_Sys_FlushContext failed with 0x%"PRIx32, rc);
199 return 99; /* fatal error */
200 }
201
202 object_handle = 0;
203 TPM2B_DATA outside_info2 = { 0 };
204 TPML_PCR_SELECTION creation_pcr2 = { 0 };
205 TPM2B_PUBLIC out_public2 = { 0 };
206 TPM2B_CREATION_DATA creation_data2 = { 0 };
207 TPM2B_DIGEST creation_hash2 = TPM2B_DIGEST_INIT;
208 TPMT_TK_CREATION creation_ticket2 = { 0 };
209 TPM2B_NAME name2 = TPM2B_NAME_INIT;
210
211 /* Changing the template value */
212 in_public.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 256;
213
214 /* Create an object using an invalid template. This should fail */
215 LOG_INFO("Creating an object using an incorrect template");
216 rc = Tss2_Sys_CreatePrimary (sapi_context,
217 TPM2_RH_OWNER,
218 &cmd_auth,
219 &in_sensitive,
220 &in_public,
221 &outside_info2,
222 &creation_pcr2,
223 &object_handle,
224 &out_public2,
225 &creation_data2,
226 &creation_hash2,
227 &creation_ticket2,
228 &name2,
229 &rsp_auth
230 );
231 if (rc != TPM2_RC_1 + TPM2_RC_S + TPM2_RC_POLICY_FAIL) {
232 LOG_ERROR("Error: CreatePrimary with invalid template succeeded!"
233 "Response Code: 0x%x expected: 0x%x", rc,
234 TPM2_RC_1 + TPM2_RC_S + TPM2_RC_POLICY_FAIL);
235 exit(1);
236 }
237
238 rc = Tss2_Sys_FlushContext (sapi_context, session_handle);
239 if (rc != TSS2_RC_SUCCESS) {
240 LOG_ERROR("Tss2_Sys_FlushContext failed: 0x%" PRIx32, rc);
241 exit(1);
242 }
243 LOG_INFO("Flushed context for session handle: 0x%" PRIx32 " success!",
244 session_handle);
245 return 0;
246 }
247