1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*******************************************************************************
3 * Copyright 2017-2019, Intel Corporation
4 * All rights reserved.
5 *******************************************************************************/
6
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10
11 #include <stdlib.h>
12 #include "tss2_esys.h"
13 #include "esys_iutil.h"
14 #define LOGMODULE test
15 #include "util/log.h"
16 #include "util/aux_util.h"
17
18 /** This test is intended to test auto adjust and restore session flags in ESAPI
19 *
20 * Tested ESAPI commands:
21 * - Esys_FlushContext() (M)
22 * - Esys_NV_DefineSpace() (M)
23 * - Esys_NV_Read() (M)
24 * - Esys_NV_Write() (M)
25 * - Esys_NV_UndefineSpace() (M)
26 * - Esys_StartAuthSession() (M)
27 *
28 * @param[in,out] esys_context The ESYS_CONTEXT.
29 * @retval EXIT_FAILURE
30 * @retval EXIT_SUCCESS
31 */
32
33 int
test_esys_auto_flags(ESYS_CONTEXT * esys_context)34 test_esys_auto_flags(ESYS_CONTEXT * esys_context)
35 {
36
37 TSS2_RC r;
38 int test_ret = EXIT_SUCCESS ;
39 ESYS_TR nvHandle = ESYS_TR_NONE;
40 ESYS_TR session_auth = ESYS_TR_NONE;
41 ESYS_TR session_enc = ESYS_TR_NONE;
42 TPMT_SYM_DEF symmetric = {.algorithm = TPM2_ALG_AES,
43 .keyBits = {.aes = 128},
44 .mode = {.aes = TPM2_ALG_CFB}
45 };
46
47 TPM2B_NONCE nonceCaller = {
48 .size = 20,
49 .buffer = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10,
50 11, 12, 13, 14, 15, 16, 17, 18, 19, 20}
51 };
52
53 /* Auth session */
54 r = Esys_StartAuthSession(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
55 ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
56 &nonceCaller,
57 TPM2_SE_HMAC, &symmetric, TPM2_ALG_SHA1,
58 &session_auth);
59 goto_if_error(r, "Error: During initialization of session_auth", error);
60
61 /* Enc param session */
62 r = Esys_StartAuthSession(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
63 ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
64 &nonceCaller,
65 TPM2_SE_HMAC, &symmetric, TPM2_ALG_SHA1,
66 &session_enc);
67 goto_if_error(r, "Error: During initialization of session_enc", error);
68
69 /* Set both ENC and DEC flags for the enc session */
70 TPMA_SESSION sessionAttributes = TPMA_SESSION_DECRYPT |
71 TPMA_SESSION_ENCRYPT |
72 TPMA_SESSION_CONTINUESESSION;
73
74 r = Esys_TRSess_SetAttributes(esys_context, session_enc, sessionAttributes, 0xFF);
75 goto_if_error(r, "Error: During SetAttributes", error);
76
77 TPM2B_AUTH auth = {.size = 20,
78 .buffer={10, 11, 12, 13, 14, 15, 16, 17, 18, 19,
79 20, 21, 22, 23, 24, 25, 26, 27, 28, 29}};
80
81 TPM2B_NV_PUBLIC publicInfo = {
82 .size = 0,
83 .nvPublic = {
84 .nvIndex =TPM2_NV_INDEX_FIRST,
85 .nameAlg = TPM2_ALG_SHA1,
86 .attributes = (
87 TPMA_NV_OWNERWRITE |
88 TPMA_NV_AUTHWRITE |
89 TPMA_NV_WRITE_STCLEAR |
90 TPMA_NV_READ_STCLEAR |
91 TPMA_NV_AUTHREAD |
92 TPMA_NV_OWNERREAD
93 ),
94 .authPolicy = {
95 .size = 0,
96 .buffer = {},
97 },
98 .dataSize = 20,
99 }
100 };
101
102 r = Esys_NV_DefineSpace (
103 esys_context,
104 ESYS_TR_RH_OWNER,
105 session_auth,
106 ESYS_TR_NONE,
107 ESYS_TR_NONE,
108 &auth,
109 &publicInfo,
110 &nvHandle);
111 goto_if_error(r, "Error esys define nv space", error);
112
113 TPM2B_MAX_NV_BUFFER nv_test_data = { .size = 20,
114 .buffer={0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0,
115 1, 2, 3, 4, 5, 6, 7, 8, 9}};
116 const TPM2B_MAX_NV_BUFFER *nv_test_data_ptr = &nv_test_data;
117
118 /* NV_Write cmd does not support TPMA_SESSION_ENCRYPT - the flag should
119 * be auto cleared by ESYS */
120 r = Esys_NV_Write(
121 esys_context,
122 nvHandle,
123 nvHandle,
124 session_enc,
125 ESYS_TR_NONE,
126 ESYS_TR_NONE,
127 nv_test_data_ptr,
128 0);
129 goto_if_error(r, "Error esys nv write", error);
130
131 /* Verify that the same session flags are still set after the test */
132 TPMA_SESSION sessionAttributesVerify;
133 r = Esys_TRSess_GetAttributes(esys_context, session_enc,
134 &sessionAttributesVerify);
135 goto_if_error(r, "Error: During GetAttributes", error);
136
137 if (sessionAttributes != sessionAttributesVerify) {
138 LOG_ERROR("Session flags not equal after write %x, %x",
139 sessionAttributes, sessionAttributesVerify);
140 r = TSS2_ESYS_RC_GENERAL_FAILURE;
141 goto_if_error(r, "Error esys nv write", error);
142 }
143
144 TPM2B_MAX_NV_BUFFER *data;
145
146 /* NV_Read cmd does not support TPMA_SESSION_DECRYPT - the flags should
147 * be auto cleared by ESYS */
148 r = Esys_NV_Read(
149 esys_context,
150 nvHandle,
151 nvHandle,
152 session_enc,
153 ESYS_TR_NONE,
154 ESYS_TR_NONE,
155 20, 0, &data);
156 goto_if_error(r, "Error: nv read", error);
157 free(data);
158
159 /* Verify that the same session flags are still set after the test */
160 r = Esys_TRSess_GetAttributes(esys_context, session_enc,
161 &sessionAttributesVerify);
162 goto_if_error(r, "Error: During GetAttributes", error);
163
164 if (sessionAttributes != sessionAttributesVerify) {
165 LOG_ERROR("Session flags not equal after read %x, %x",
166 sessionAttributes, sessionAttributesVerify);
167 r = TSS2_ESYS_RC_GENERAL_FAILURE;
168 }
169
170 error:
171 if (r)
172 test_ret = EXIT_FAILURE;
173
174 if (nvHandle != ESYS_TR_NONE) {
175 if (Esys_NV_UndefineSpace(esys_context,
176 ESYS_TR_RH_OWNER,
177 nvHandle,
178 session_auth,
179 ESYS_TR_NONE,
180 ESYS_TR_NONE) != TSS2_RC_SUCCESS) {
181 LOG_ERROR("Cleanup nvHandle failed.");
182 }
183 }
184
185 if (session_auth != ESYS_TR_NONE) {
186 if (Esys_FlushContext(esys_context, session_auth) != TSS2_RC_SUCCESS) {
187 LOG_ERROR("Cleanup session_auth failed.");
188 }
189 }
190 if (session_enc != ESYS_TR_NONE) {
191 if (Esys_FlushContext(esys_context, session_enc) != TSS2_RC_SUCCESS) {
192 LOG_ERROR("Cleanup session_enc failed.");
193 }
194 }
195
196 return test_ret;
197 }
198
199 int
test_invoke_esapi(ESYS_CONTEXT * esys_context)200 test_invoke_esapi(ESYS_CONTEXT * esys_context) {
201 return test_esys_auto_flags(esys_context);
202 }
203