1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*******************************************************************************
3 * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
4 * All rights reserved.
5 *******************************************************************************/
6
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10
11 #include <stdlib.h>
12
13 #include "tss2_esys.h"
14
15 #include "esys_iutil.h"
16 #include "test-esapi.h"
17 #define LOGMODULE test
18 #include "util/log.h"
19 #include "util/aux_util.h"
20
21 /** This test is intended to test the ESAPI audit commands.
22 *
23 * First a key for signing the audit digest is computed.
24 * A audit session is started, and for the command GetCapability the
25 * command audit digest and the session audit digest is computed.
26 * (Esys_GetCommandAuditDigest, Esys_GetSessionAuditDigest). In the
27 * last test the audit hash alg is changed with Esys_SetCommandCodeAuditStatus.
28 *
29 *\b Note: platform authorization needed.
30 *
31 * Tested ESAPI commands:
32 * - Esys_CreatePrimary() (M)
33 * - Esys_FlushContext() (M)
34 * - Esys_GetCapability() (M)
35 * - Esys_GetCommandAuditDigest() (O)
36 * - Esys_GetSessionAuditDigest() (M)
37 * - Esys_SetCommandCodeAuditStatus() (O)
38 * - Esys_StartAuthSession() (M)
39 * - Esys_StartAuthSession() (M)
40 *
41 * @param[in,out] esys_context The ESYS_CONTEXT.
42 * @retval EXIT_FAILURE
43 * @retval EXIT_SKIP
44 * @retval EXIT_SUCCESS
45 */
46
47 int
test_esys_audit(ESYS_CONTEXT * esys_context)48 test_esys_audit(ESYS_CONTEXT * esys_context)
49 {
50 TSS2_RC r;
51 ESYS_TR signHandle = ESYS_TR_NONE;
52 ESYS_TR session = ESYS_TR_NONE;
53 int failure_return = EXIT_FAILURE;
54
55 TPM2B_PUBLIC *outPublic = NULL;
56 TPM2B_CREATION_DATA *creationData = NULL;
57 TPM2B_DIGEST *creationHash = NULL;
58 TPMT_TK_CREATION *creationTicket = NULL;
59 TPMS_CAPABILITY_DATA *capabilityData = NULL;
60 TPM2B_ATTEST *auditInfo = NULL;
61 TPMT_SIGNATURE *signature = NULL;
62
63 /* Compute a signing key */
64 TPM2B_AUTH authValuePrimary = {
65 .size = 5,
66 .buffer = {1, 2, 3, 4, 5}
67 };
68
69 TPM2B_SENSITIVE_CREATE inSensitivePrimary = {
70 .size = 0,
71 .sensitive = {
72 .userAuth = {
73 .size = 0,
74 .buffer = {0},
75 },
76 .data = {
77 .size = 0,
78 .buffer = {0},
79 },
80 },
81 };
82
83 inSensitivePrimary.sensitive.userAuth = authValuePrimary;
84
85 TPM2B_PUBLIC inPublic = {
86 .size = 0,
87 .publicArea = {
88 .type = TPM2_ALG_RSA,
89 .nameAlg = TPM2_ALG_SHA1,
90 .objectAttributes = (
91 TPMA_OBJECT_USERWITHAUTH |
92 TPMA_OBJECT_RESTRICTED |
93 TPMA_OBJECT_SIGN_ENCRYPT |
94 TPMA_OBJECT_FIXEDTPM |
95 TPMA_OBJECT_FIXEDPARENT |
96 TPMA_OBJECT_SENSITIVEDATAORIGIN
97 ),
98 .authPolicy = {
99 .size = 0,
100 },
101 .parameters.rsaDetail = {
102 .symmetric = {
103 .algorithm = TPM2_ALG_NULL,
104 .keyBits.aes = 128,
105 .mode.aes = TPM2_ALG_CFB,
106 },
107 .scheme = {
108 .scheme = TPM2_ALG_RSASSA,
109 .details = { .rsassa = { .hashAlg = TPM2_ALG_SHA1 }},
110
111 },
112 .keyBits = 2048,
113 .exponent = 0,
114 },
115 .unique.rsa = {
116 .size = 0,
117 .buffer = {},
118 },
119 },
120 };
121
122 TPM2B_AUTH authValue = {
123 .size = 0,
124 .buffer = {}
125 };
126
127 TPM2B_DATA outsideInfo = {
128 .size = 0,
129 .buffer = {},
130 };
131
132 TPML_PCR_SELECTION creationPCR = {
133 .count = 0,
134 };
135
136 r = Esys_TR_SetAuth(esys_context, ESYS_TR_RH_OWNER, &authValue);
137 goto_if_error(r, "Error: TR_SetAuth", error);
138
139 r = Esys_CreatePrimary(esys_context, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD,
140 ESYS_TR_NONE, ESYS_TR_NONE, &inSensitivePrimary,
141 &inPublic, &outsideInfo, &creationPCR,
142 &signHandle, &outPublic, &creationData,
143 &creationHash, &creationTicket);
144 goto_if_error(r, "Error esys create primary", error);
145
146 /* Start a audit session */
147 TPMA_SESSION sessionAttributes = TPMA_SESSION_CONTINUESESSION |
148 TPMA_SESSION_AUDIT;
149 TPM2_SE sessionType = TPM2_SE_HMAC;
150 TPMI_ALG_HASH authHash = TPM2_ALG_SHA256;
151 TPMT_SYM_DEF symmetric = {.algorithm = TPM2_ALG_NULL };
152
153 r = Esys_StartAuthSession(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
154 ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
155 NULL,
156 sessionType, &symmetric, authHash, &session);
157
158 goto_if_error(r, "Error Esys_StartAuthSession", error);
159 r = Esys_TRSess_SetAttributes(esys_context, session, sessionAttributes,
160 0xff);
161 goto_if_error(r, "Error Esys_TRSess_SetAttributes", error);
162
163 /* Execute one command to be audited */
164 TPM2_CAP capability = TPM2_CAP_TPM_PROPERTIES;
165 UINT32 property = TPM2_PT_LOCKOUT_COUNTER;
166 UINT32 propertyCount = 1;
167 TPMI_YES_NO moreData;
168
169 r = Esys_GetCapability(esys_context,
170 session, ESYS_TR_NONE, ESYS_TR_NONE,
171 capability, property, propertyCount,
172 &moreData, &capabilityData);
173
174 goto_if_error(r, "Error esys get capability", error);
175
176 ESYS_TR privacyHandle = ESYS_TR_RH_ENDORSEMENT;
177 TPM2B_DATA qualifyingData = {0};
178 TPMT_SIG_SCHEME inScheme = { .scheme = TPM2_ALG_NULL };
179
180 /* Test the audit commands */
181 r = Esys_GetCommandAuditDigest(
182 esys_context,
183 privacyHandle,
184 signHandle,
185 ESYS_TR_PASSWORD,
186 ESYS_TR_PASSWORD,
187 ESYS_TR_NONE,
188 &qualifyingData,
189 &inScheme,
190 &auditInfo,
191 &signature);
192
193 if ((r == TPM2_RC_COMMAND_CODE) ||
194 (r == (TPM2_RC_COMMAND_CODE | TSS2_RESMGR_RC_LAYER)) ||
195 (r == (TPM2_RC_COMMAND_CODE | TSS2_RESMGR_TPM_RC_LAYER))) {
196 LOG_WARNING("Command TPM2_GetCommandAuditDigest not supported by TPM.");
197 failure_return = EXIT_SKIP;
198 goto error;
199 }
200
201 Esys_Free(auditInfo);
202 Esys_Free(signature);
203
204 goto_if_error(r, "Error: GetCommandAuditDigest", error);
205
206 r = Esys_GetSessionAuditDigest(
207 esys_context,
208 privacyHandle,
209 signHandle,
210 session,
211 ESYS_TR_PASSWORD,
212 ESYS_TR_PASSWORD,
213 ESYS_TR_NONE,
214 &qualifyingData,
215 &inScheme,
216 &auditInfo,
217 &signature);
218 goto_if_error(r, "Error: GetSessionAuditDigest", error);
219
220 TPMI_ALG_HASH auditAlg = TPM2_ALG_SHA1;
221 TPML_CC clearList = {0};
222 TPML_CC setList = {0};
223
224 r = Esys_SetCommandCodeAuditStatus(
225 esys_context,
226 ESYS_TR_RH_PLATFORM,
227 ESYS_TR_PASSWORD,
228 ESYS_TR_NONE,
229 ESYS_TR_NONE,
230 auditAlg,
231 &setList,
232 &clearList);
233
234 if ((r & ~TPM2_RC_N_MASK) == TPM2_RC_BAD_AUTH) {
235 /* Platform authorization not possible test will be skipped */
236 LOG_WARNING("Platform authorization not possible.");
237 failure_return = EXIT_SKIP;
238 goto error;
239 }
240
241 goto_if_error(r, "Error: SetCommandCodeAuditStatus", error);
242
243 r = Esys_FlushContext(esys_context, signHandle);
244 goto_if_error(r, "Error: FlushContext", error);
245
246 signHandle = ESYS_TR_NONE;
247
248 r = Esys_FlushContext(esys_context, session);
249 goto_if_error(r, "Error during FlushContext", error);
250
251 Esys_Free(outPublic);
252 Esys_Free(creationData);
253 Esys_Free(creationHash);
254 Esys_Free(creationTicket);
255 Esys_Free(capabilityData);
256 Esys_Free(auditInfo);
257 Esys_Free(signature);
258 return EXIT_SUCCESS;
259
260 error:
261
262 if (session != ESYS_TR_NONE) {
263 if (Esys_FlushContext(esys_context, session) != TSS2_RC_SUCCESS) {
264 LOG_ERROR("Cleanup session failed.");
265 }
266 }
267
268 if (signHandle != ESYS_TR_NONE) {
269 if (Esys_FlushContext(esys_context, signHandle) != TSS2_RC_SUCCESS) {
270 LOG_ERROR("Cleanup signHandle failed.");
271 }
272 }
273 Esys_Free(outPublic);
274 Esys_Free(creationData);
275 Esys_Free(creationHash);
276 Esys_Free(creationTicket);
277 Esys_Free(capabilityData);
278 Esys_Free(auditInfo);
279 Esys_Free(signature);
280 return failure_return;
281 }
282
283 int
test_invoke_esapi(ESYS_CONTEXT * esys_context)284 test_invoke_esapi(ESYS_CONTEXT * esys_context) {
285 return test_esys_audit(esys_context);
286 }
287