1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*******************************************************************************
3 * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
4 * All rights reserved.
5 *******************************************************************************/
6
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10
11 #include <stdlib.h>
12
13 #include "tss2_esys.h"
14
15 #include "esys_iutil.h"
16 #include "test-esapi.h"
17 #define LOGMODULE test
18 #include "util/log.h"
19 #include "util/aux_util.h"
20
21 /** This test is intended to test the ESAPI command PolicyPassword.
22 *
23 * First in a trial session the policy value to ensure that auth value
24 * is included in the policy session used for authorization is
25 * computed.
26 * We start by creating a primary key (Esys_CreatePrimary) with this
27 * policy value and a certain authorization. Than a second key it created
28 * with a PoliyPassword policy session.
29 *
30 * Tested ESAPI commands:
31 * - Esys_Create() (M)
32 * - Esys_CreatePrimary() (M)
33 * - Esys_FlushContext() (M)
34 * - Esys_PolicyGetDigest() (M)
35 * - Esys_PolicyPassword() (M)
36 * - Esys_StartAuthSession() (M)
37 *
38 * @param[in,out] esys_context The ESYS_CONTEXT.
39 * @retval EXIT_FAILURE
40 * @retval EXIT_SUCCESS
41 */
42
43 int
test_esys_policy_password(ESYS_CONTEXT * esys_context)44 test_esys_policy_password(ESYS_CONTEXT * esys_context)
45 {
46 TSS2_RC r;
47 ESYS_TR primaryHandle = ESYS_TR_NONE;
48 ESYS_TR policySession = ESYS_TR_NONE;
49
50 TPM2B_PUBLIC *outPublic = NULL;
51 TPM2B_CREATION_DATA *creationData = NULL;
52 TPM2B_DIGEST *creationHash = NULL;
53 TPMT_TK_CREATION *creationTicket = NULL;
54
55 TPM2B_DIGEST *policyDigestTrial = NULL;
56
57 TPM2B_PUBLIC *outPublic2 = NULL;
58 TPM2B_PRIVATE *outPrivate2 = NULL;
59 TPM2B_CREATION_DATA *creationData2 = NULL;
60 TPM2B_DIGEST *creationHash2 = NULL;
61 TPMT_TK_CREATION *creationTicket2 = NULL;
62
63 /*
64 * Firth the policy value for changing the auth value of an NV index has to be
65 * determined with a policy trial session.
66 */
67 ESYS_TR sessionTrial = ESYS_TR_NONE;
68 TPMT_SYM_DEF symmetricTrial = {.algorithm = TPM2_ALG_AES,
69 .keyBits = {.aes = 128},
70 .mode = {.aes = TPM2_ALG_CFB}
71 };
72 TPM2B_NONCE nonceCallerTrial = {
73 .size = 20,
74 .buffer = {11, 12, 13, 14, 15, 16, 17, 18, 19, 11,
75 21, 22, 23, 24, 25, 26, 27, 28, 29, 30}
76 };
77
78 r = Esys_StartAuthSession(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
79 ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
80 &nonceCallerTrial,
81 TPM2_SE_TRIAL, &symmetricTrial,
82 TPM2_ALG_SHA1, &sessionTrial);
83 goto_if_error(r, "Error: During initialization of policy trial session",
84 error);
85
86 r = Esys_PolicyPassword(
87 esys_context,
88 sessionTrial,
89 ESYS_TR_NONE,
90 ESYS_TR_NONE,
91 ESYS_TR_NONE
92 );
93 goto_if_error(r, "Error: PolicyPassword", error);
94
95 r = Esys_PolicyGetDigest(
96 esys_context,
97 sessionTrial,
98 ESYS_TR_NONE,
99 ESYS_TR_NONE,
100 ESYS_TR_NONE,
101 &policyDigestTrial
102 );
103 goto_if_error(r, "Error: PolicyGetDigest", error);
104
105 TPM2B_PUBLIC inPublic = {
106 .size = 0,
107 .publicArea = {
108 .type = TPM2_ALG_RSA,
109 .nameAlg = TPM2_ALG_SHA1,
110 .objectAttributes = (TPMA_OBJECT_USERWITHAUTH |
111 TPMA_OBJECT_RESTRICTED |
112 TPMA_OBJECT_DECRYPT |
113 TPMA_OBJECT_FIXEDTPM |
114 TPMA_OBJECT_FIXEDPARENT |
115 TPMA_OBJECT_SENSITIVEDATAORIGIN),
116 .authPolicy = *policyDigestTrial,
117 .parameters.rsaDetail = {
118 .symmetric = {
119 .algorithm = TPM2_ALG_AES,
120 .keyBits.aes = 128,
121 .mode.aes = TPM2_ALG_CFB},
122 .scheme = {
123 .scheme = TPM2_ALG_NULL
124 },
125 .keyBits = 2048,
126 .exponent = 0,
127 },
128 .unique.rsa = {
129 .size = 0,
130 .buffer = {},
131 },
132 },
133 };
134
135 TPM2B_AUTH authValuePrimary = {
136 .size = 5,
137 .buffer = {1, 2, 3, 4, 5}
138 };
139
140 TPM2B_SENSITIVE_CREATE inSensitivePrimary = {
141 .size = 0,
142 .sensitive = {
143 .userAuth = {
144 .size = 0,
145 .buffer = {0 },
146 },
147 .data = {
148 .size = 0,
149 .buffer = {0},
150 },
151 },
152 };
153
154 inSensitivePrimary.sensitive.userAuth = authValuePrimary;
155
156 TPM2B_DATA outsideInfo = {
157 .size = 0,
158 .buffer = {},
159 };
160
161 TPML_PCR_SELECTION creationPCR = {
162 .count = 0,
163 };
164
165 TPM2B_AUTH authValue = {
166 .size = 0,
167 .buffer = {}
168 };
169
170 r = Esys_TR_SetAuth(esys_context, ESYS_TR_RH_OWNER, &authValue);
171 goto_if_error(r, "Error: TR_SetAuth", error);
172
173 r = Esys_CreatePrimary(esys_context, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD,
174 ESYS_TR_NONE, ESYS_TR_NONE, &inSensitivePrimary, &inPublic,
175 &outsideInfo, &creationPCR, &primaryHandle,
176 &outPublic, &creationData, &creationHash,
177 &creationTicket);
178 goto_if_error(r, "Error esys create primary", error);
179
180 TPMT_SYM_DEF policySymmetric = {.algorithm = TPM2_ALG_AES,
181 .keyBits = {.aes = 128},
182 .mode = {.aes = TPM2_ALG_CFB}
183 };
184 TPM2B_NONCE policyNonceCaller = {
185 .size = 20,
186 .buffer = {11, 12, 13, 14, 15, 16, 17, 18, 19, 11,
187 21, 22, 23, 24, 25, 26, 27, 28, 29, 30}
188 };
189 r = Esys_StartAuthSession(esys_context, ESYS_TR_NONE, ESYS_TR_NONE,
190 ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
191 &policyNonceCaller,
192 TPM2_SE_POLICY, &policySymmetric, TPM2_ALG_SHA1,
193 &policySession);
194 goto_if_error(r, "Error: During initialization of policy trial session", error);
195
196 r = Esys_PolicyPassword(
197 esys_context,
198 policySession,
199 ESYS_TR_NONE,
200 ESYS_TR_NONE,
201 ESYS_TR_NONE
202 );
203 goto_if_error(r, "Error: PolicyAuthValue", error);
204
205 r = Esys_TR_SetAuth(esys_context, primaryHandle, &authValuePrimary);
206 goto_if_error(r, "Error: TR_SetAuth", error);
207
208 TPM2B_AUTH authKey2 = {
209 .size = 6,
210 .buffer = {6, 7, 8, 9, 10, 11}
211 };
212
213 TPM2B_SENSITIVE_CREATE inSensitive2 = {
214 .size = 0,
215 .sensitive = {
216 .userAuth = authKey2,
217 .data = {
218 .size = 0,
219 .buffer = {}
220 }
221 }
222 };
223
224 TPM2B_PUBLIC inPublic2 = {
225 .size = 0,
226 .publicArea = {
227 .type = TPM2_ALG_RSA,
228 .nameAlg = TPM2_ALG_SHA1,
229 .objectAttributes = (TPMA_OBJECT_USERWITHAUTH |
230 TPMA_OBJECT_RESTRICTED |
231 TPMA_OBJECT_DECRYPT |
232 TPMA_OBJECT_FIXEDTPM |
233 TPMA_OBJECT_FIXEDPARENT |
234 TPMA_OBJECT_SENSITIVEDATAORIGIN),
235
236 .authPolicy = {
237 .size = 0,
238 },
239 .parameters.rsaDetail = {
240 .symmetric = {
241 .algorithm = TPM2_ALG_AES,
242 .keyBits.aes = 128,
243 .mode.aes = TPM2_ALG_CFB
244 },
245 .scheme = {
246 .scheme =
247 TPM2_ALG_NULL,
248 },
249 .keyBits = 2048,
250 .exponent = 0
251 },
252 .unique.rsa = {
253 .size = 0,
254 .buffer = {}
255 ,
256 }
257 }
258 };
259
260 TPM2B_DATA outsideInfo2 = {
261 .size = 0,
262 .buffer = {}
263 ,
264 };
265
266 TPML_PCR_SELECTION creationPCR2 = {
267 .count = 0,
268 };
269
270 r = Esys_Create(esys_context,
271 primaryHandle,
272 policySession, ESYS_TR_NONE, ESYS_TR_NONE,
273 &inSensitive2,
274 &inPublic2,
275 &outsideInfo2,
276 &creationPCR2,
277 &outPrivate2,
278 &outPublic2,
279 &creationData2, &creationHash2, &creationTicket2);
280 goto_if_error(r, "Error esys create ", error);
281
282 r = Esys_FlushContext(esys_context, primaryHandle);
283 goto_if_error(r, "Error: FlushContext", error);
284
285 r = Esys_FlushContext(esys_context, sessionTrial);
286 goto_if_error(r, "Flushing context", error);
287
288 r = Esys_FlushContext(esys_context, policySession);
289 goto_if_error(r, "Flushing context", error);
290
291 Esys_Free(outPublic);
292 Esys_Free(creationData);
293 Esys_Free(creationHash);
294 Esys_Free(creationTicket);
295
296 Esys_Free(policyDigestTrial);
297
298 Esys_Free(outPublic2);
299 Esys_Free(outPrivate2);
300 Esys_Free(creationData2);
301 Esys_Free(creationHash2);
302 Esys_Free(creationTicket2);
303 return EXIT_SUCCESS;
304
305 error:
306
307 if (policySession != ESYS_TR_NONE) {
308 if (Esys_FlushContext(esys_context, policySession) != TSS2_RC_SUCCESS) {
309 LOG_ERROR("Cleanup policySession failed.");
310 }
311 }
312
313 if (primaryHandle != ESYS_TR_NONE) {
314 if (Esys_FlushContext(esys_context, primaryHandle) != TSS2_RC_SUCCESS) {
315 LOG_ERROR("Cleanup primaryHandle failed.");
316 }
317 }
318
319 Esys_Free(outPublic);
320 Esys_Free(creationData);
321 Esys_Free(creationHash);
322 Esys_Free(creationTicket);
323
324 Esys_Free(policyDigestTrial);
325
326 Esys_Free(outPublic2);
327 Esys_Free(outPrivate2);
328 Esys_Free(creationData2);
329 Esys_Free(creationHash2);
330 Esys_Free(creationTicket2);
331 return EXIT_FAILURE;
332 }
333
334 int
test_invoke_esapi(ESYS_CONTEXT * esys_context)335 test_invoke_esapi(ESYS_CONTEXT * esys_context) {
336 return test_esys_policy_password(esys_context);
337 }
338