1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*******************************************************************************
3 * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
4 * All rights reserved.
5 *******************************************************************************/
6
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10
11 #include <stdlib.h>
12
13 #include "tss2_esys.h"
14
15 #include "esys_iutil.h"
16 #define LOGMODULE test
17 #include "util/log.h"
18 #include "util/aux_util.h"
19
20 /** This test is intended to test the ESAPI command ObjectChangeAuth.
21 *
22 * We start by creating a primary key (Esys_CreatePrimary).
23 * The auth value for this primary will be changed.
24 *
25 * Tested ESAPI commands:
26 * - Esys_Create() (M)
27 * - Esys_CreatePrimary() (M)
28 * - Esys_FlushContext() (M)
29 * - Esys_Load() (M)
30 * - Esys_ObjectChangeAuth() (M)
31 *
32 * @param[in,out] esys_context The ESYS_CONTEXT.
33 * @retval EXIT_FAILURE
34 * @retval EXIT_SUCCESS
35 */
36
37 int
test_esys_object_changeauth(ESYS_CONTEXT * esys_context)38 test_esys_object_changeauth(ESYS_CONTEXT * esys_context)
39 {
40 TSS2_RC r;
41 ESYS_TR primaryHandle = ESYS_TR_NONE;
42 ESYS_TR loadedKeyHandle = ESYS_TR_NONE;
43
44 TPM2B_PUBLIC *outPublic = NULL;
45 TPM2B_CREATION_DATA *creationData = NULL;
46 TPM2B_DIGEST *creationHash = NULL;
47 TPMT_TK_CREATION *creationTicket = NULL;
48
49 TPM2B_PUBLIC *outPublic2 = NULL;
50 TPM2B_PRIVATE *outPrivate2 = NULL;
51 TPM2B_CREATION_DATA *creationData2 = NULL;
52 TPM2B_DIGEST *creationHash2 = NULL;
53 TPMT_TK_CREATION *creationTicket2 = NULL;
54
55 TPM2B_PRIVATE *outPrivateChangeAuth = NULL;
56
57 TPM2B_PUBLIC inPublic = {
58 .size = 0,
59 .publicArea = {
60 .type = TPM2_ALG_RSA,
61 .nameAlg = TPM2_ALG_SHA256,
62 .objectAttributes = (TPMA_OBJECT_USERWITHAUTH |
63 TPMA_OBJECT_RESTRICTED |
64 TPMA_OBJECT_DECRYPT |
65 TPMA_OBJECT_FIXEDTPM |
66 TPMA_OBJECT_FIXEDPARENT |
67 TPMA_OBJECT_SENSITIVEDATAORIGIN),
68 .authPolicy = {
69 .size = 0,
70 },
71 .parameters.rsaDetail = {
72 .symmetric = {
73 .algorithm = TPM2_ALG_AES,
74 .keyBits.aes = 128,
75 .mode.aes = TPM2_ALG_CFB},
76 .scheme = {
77 .scheme = TPM2_ALG_NULL
78 },
79 .keyBits = 2048,
80 .exponent = 0,
81 },
82 .unique.rsa = {
83 .size = 0,
84 .buffer = {},
85 },
86 },
87 };
88
89 TPM2B_AUTH authValuePrimary = {
90 .size = 5,
91 .buffer = {1, 2, 3, 4, 5}
92 };
93
94 TPM2B_SENSITIVE_CREATE inSensitivePrimary = {
95 .size = 0,
96 .sensitive = {
97 .userAuth = authValuePrimary,
98 .data = {
99 .size = 0,
100 .buffer = {0},
101 },
102 },
103 };
104
105 TPM2B_DATA outsideInfo = {
106 .size = 0,
107 .buffer = {},
108 };
109
110 TPML_PCR_SELECTION creationPCR = {
111 .count = 0,
112 };
113
114 TPM2B_AUTH authValue = {
115 .size = 0,
116 .buffer = {}
117 };
118
119 r = Esys_TR_SetAuth(esys_context, ESYS_TR_RH_OWNER, &authValue);
120 goto_if_error(r, "Error: TR_SetAuth", error);
121
122 r = Esys_CreatePrimary(esys_context, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD,
123 ESYS_TR_NONE, ESYS_TR_NONE, &inSensitivePrimary, &inPublic,
124 &outsideInfo, &creationPCR, &primaryHandle,
125 &outPublic, &creationData, &creationHash,
126 &creationTicket);
127 goto_if_error(r, "Error esys create primary", error);
128
129 r = Esys_TR_SetAuth(esys_context, primaryHandle, &authValuePrimary);
130 goto_if_error(r, "Error esys TR_SetAuth ", error);
131
132 TPM2B_AUTH authKey2 = {
133 .size = 6,
134 .buffer = {6, 7, 8, 9, 10, 11}
135 };
136
137 TPM2B_SENSITIVE_CREATE inSensitive2 = {
138 .size = 0,
139 .sensitive = {
140 .userAuth = {
141 .size = 0,
142 .buffer = {0}
143 },
144 .data = {
145 .size = 0,
146 .buffer = {}
147 }
148 }
149 };
150
151 inSensitive2.sensitive.userAuth = authKey2;
152
153 TPM2B_PUBLIC inPublic2 = {
154 .size = 0,
155 .publicArea = {
156 .type = TPM2_ALG_RSA,
157 .nameAlg = TPM2_ALG_SHA256,
158 .objectAttributes = (TPMA_OBJECT_USERWITHAUTH |
159 TPMA_OBJECT_RESTRICTED |
160 TPMA_OBJECT_DECRYPT |
161 TPMA_OBJECT_FIXEDTPM |
162 TPMA_OBJECT_FIXEDPARENT |
163 TPMA_OBJECT_SENSITIVEDATAORIGIN),
164
165 .authPolicy = {
166 .size = 0,
167 },
168 .parameters.rsaDetail = {
169 .symmetric = {
170 .algorithm = TPM2_ALG_AES,
171 .keyBits.aes = 128,
172 .mode.aes = TPM2_ALG_CFB
173 },
174 .scheme = {
175 .scheme =
176 TPM2_ALG_NULL,
177 },
178 .keyBits = 2048,
179 .exponent = 0
180 },
181 .unique.rsa = {
182 .size = 0,
183 .buffer = {}
184 ,
185 }
186 }
187 };
188
189 TPM2B_DATA outsideInfo2 = {
190 .size = 0,
191 .buffer = {}
192 ,
193 };
194
195 TPML_PCR_SELECTION creationPCR2 = {
196 .count = 0,
197 };
198
199 r = Esys_Create(esys_context,
200 primaryHandle,
201 ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE,
202 &inSensitive2,
203 &inPublic2,
204 &outsideInfo2,
205 &creationPCR2,
206 &outPrivate2,
207 &outPublic2,
208 &creationData2, &creationHash2, &creationTicket2);
209 goto_if_error(r, "Error esys create ", error);
210
211 r = Esys_Load(esys_context,
212 primaryHandle,
213 ESYS_TR_PASSWORD,
214 ESYS_TR_NONE,
215 ESYS_TR_NONE, outPrivate2, outPublic2, &loadedKeyHandle);
216 goto_if_error(r, "Error esys load ", error);
217
218 r = Esys_TR_SetAuth(esys_context, loadedKeyHandle, &authKey2);
219 goto_if_error(r, "Error esys TR_SetAuth ", error);
220
221 TPM2B_AUTH newAuth = {.size = 20,
222 .buffer={30, 31, 32, 33, 34, 35, 36, 37, 38, 39,
223 40, 41, 42, 43, 44, 45, 46, 47, 48, 49}};
224
225 r = Esys_ObjectChangeAuth(esys_context,
226 loadedKeyHandle,
227 primaryHandle,
228 ESYS_TR_PASSWORD,
229 ESYS_TR_NONE,
230 ESYS_TR_NONE,
231 &newAuth,
232 &outPrivateChangeAuth
233 );
234 goto_if_error(r, "Error: ObjectChangeAuth", error);
235
236 r = Esys_FlushContext(esys_context, loadedKeyHandle);
237 goto_if_error(r, "Error during FlushContext", error);
238
239 r = Esys_FlushContext(esys_context, primaryHandle);
240 goto_if_error(r, "Error during FlushContext", error);
241
242 SAFE_FREE(outPublic);
243 SAFE_FREE(creationData);
244 SAFE_FREE(creationHash);
245 SAFE_FREE(creationTicket);
246
247 SAFE_FREE(outPublic2);
248 SAFE_FREE(outPrivate2);
249 SAFE_FREE(creationData2);
250 SAFE_FREE(creationHash2);
251 SAFE_FREE(creationTicket2);
252
253 SAFE_FREE(outPrivateChangeAuth);
254 return EXIT_SUCCESS;
255
256 error:
257
258 if (loadedKeyHandle != ESYS_TR_NONE) {
259 if (Esys_FlushContext(esys_context, loadedKeyHandle) != TSS2_RC_SUCCESS) {
260 LOG_ERROR("Cleanup loadedKeyHandle failed.");
261 }
262 }
263
264 if (primaryHandle != ESYS_TR_NONE) {
265 if (Esys_FlushContext(esys_context, primaryHandle) != TSS2_RC_SUCCESS) {
266 LOG_ERROR("Cleanup primaryHandle failed.");
267 }
268 }
269
270 SAFE_FREE(outPublic);
271 SAFE_FREE(creationData);
272 SAFE_FREE(creationHash);
273 SAFE_FREE(creationTicket);
274
275 SAFE_FREE(outPublic2);
276 SAFE_FREE(outPrivate2);
277 SAFE_FREE(creationData2);
278 SAFE_FREE(creationHash2);
279 SAFE_FREE(creationTicket2);
280
281 SAFE_FREE(outPrivateChangeAuth);
282 return EXIT_FAILURE;
283 }
284
285 int
test_esys_tr_setauth(ESYS_CONTEXT * esys_context)286 test_esys_tr_setauth(ESYS_CONTEXT * esys_context)
287 {
288 TSS2_RC r;
289 TPM2B_AUTH auth = {.size = 20,
290 .buffer={30, 31, 32, 33, 34, 35, 36, 37, 38, 39,
291 40, 41, 42, 43, 44, 45, 46, 47, 48, 49}};
292
293 r = Esys_TR_SetAuth(esys_context, ESYS_TR_RH_OWNER, &auth);
294 return_if_error(r, "Error in Esys_TR_SetAuth");
295
296 r = Esys_TR_SetAuth(esys_context, ESYS_TR_RH_OWNER, NULL);
297 return_if_error(r, "Error in Esys_TR_SetAuth");
298
299 return EXIT_SUCCESS;
300 }
301
302 int
test_invoke_esapi(ESYS_CONTEXT * esys_context)303 test_invoke_esapi(ESYS_CONTEXT * esys_context) {
304 TSS2_RC r;
305
306 r = test_esys_object_changeauth(esys_context);
307 return_if_error(r, "test_esys_object_changeauth");
308
309 r = test_esys_tr_setauth(esys_context);
310 return_if_error(r, "test_esys_tr_setauth");
311
312 return EXIT_SUCCESS;
313 }
314