1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /***********************************************************************;
3 * Copyright (c) 2015, Intel Corporation
4 * All rights reserved.
5 ***********************************************************************;
6 */
7
8 #ifdef HAVE_CONFIG_H
9 #include <config.h>
10 #endif
11
12 #include <stdbool.h>
13 #include <inttypes.h>
14 #include <stdio.h>
15 #include <stdlib.h>
16 #include <string.h>
17
18 #include "tss2_sys.h"
19 #include "tss2_tcti_device.h"
20 #include "tss2_tcti_mssim.h"
21
22 #include "../integration/context-util.h"
23 #include "../integration/sapi-util.h"
24 #include "../integration/session-util.h"
25 #include "util/tss2_endian.h"
26 #include "sysapi_util.h"
27 #define LOGMODULE testtpmclient
28 #include "util/log.h"
29
30 /*
31 * TPM indices and sizes
32 */
33 #define NV_AUX_INDEX_SIZE 96
34 #define NV_PS_INDEX_SIZE 34
35
36 #define INDEX_AUX 0x01800003 /* NV Storage */
37 #define INDEX_LCP_OWN 0x01400001 /* Launch Policy Owner */
38 #define INDEX_LCP_SUP 0x01800001 /* Launch Policy Default (Supplier) */
39 #define TPM20_INDEX_TEST1 0x01500015
40 #define TPM20_INDEX_TEST2 0x01500016
41 #define TPM20_INDEX_PASSWORD_TEST 0x01500020
42
43 #define SESSIONS_COUNT 1
44
45
46 #define SET_PCR_SELECT_BIT( pcrSelection, pcr ) \
47 (pcrSelection).pcrSelect[( (pcr)/8 )] |= ( 1 << ( (pcr) % 8) );
48
49 #define CLEAR_PCR_SELECT_BITS( pcrSelection ) \
50 (pcrSelection).pcrSelect[0] = 0; \
51 (pcrSelection).pcrSelect[1] = 0; \
52 (pcrSelection).pcrSelect[2] = 0;
53
54 #define SET_PCR_SELECT_SIZE( pcrSelection, size ) \
55 (pcrSelection).sizeofSelect = size;
56
57
58 TSS2_SYS_CONTEXT *sysContext;
59
60 TSS2_TCTI_CONTEXT *resMgrTctiContext = 0;
61
62 #define INIT_SIMPLE_TPM2B_SIZE(type) (type).size = sizeof(type) - 2;
63 #define YES 1
64 #define NO 0
65
ErrorHandler(UINT32 rval,char * errorString,int errorStringSize)66 static void ErrorHandler(UINT32 rval, char *errorString, int errorStringSize)
67 {
68 UINT32 errorLevel = rval & TSS2_RC_LAYER_MASK;
69 char levelString[32];
70
71 switch (errorLevel)
72 {
73 case TSS2_TPM_RC_LAYER:
74 strcpy(levelString, "TPM");
75 break;
76 case TSS2_SYS_RC_LAYER:
77 strcpy(levelString, "System API");
78 break;
79 case TSS2_MU_RC_LAYER:
80 strcpy(levelString, "System API TPM encoded");
81 break;
82 case TSS2_TCTI_RC_LAYER:
83 strcpy(levelString, "TCTI");
84 break;
85 case TSS2_RESMGR_TPM_RC_LAYER:
86 strcpy(levelString, "Resource Mgr TPM encoded");
87 break;
88 case TSS2_RESMGR_RC_LAYER:
89 strcpy(levelString, "Resource Mgr");
90 break;
91 default:
92 strcpy(levelString, "Unknown Level");
93 break;
94 }
95
96 snprintf(errorString, errorStringSize, "%s Error: 0x%x\n", levelString, rval);
97 }
98
Cleanup()99 static void Cleanup()
100 {
101 if (resMgrTctiContext != NULL) {
102 tcti_platform_command(resMgrTctiContext, MS_SIM_POWER_OFF);
103 tcti_teardown(resMgrTctiContext);
104 resMgrTctiContext = NULL;
105 }
106
107 exit(1);
108 }
109
InitSysContextFailure()110 static void InitSysContextFailure()
111 {
112 LOG_ERROR("InitSysContext failed, exiting...");
113 Cleanup();
114 }
115
116 #define ERROR_STR_LEN 200
117 #define CheckPassed(rval) { \
118 char error_string[ERROR_STR_LEN]; \
119 if ((rval) != TPM2_RC_SUCCESS) { \
120 ErrorHandler((rval), error_string, ERROR_STR_LEN); \
121 LOG_INFO("passing case: \tFAILED! %s (%s@%u)", \
122 error_string, __FUNCTION__, __LINE__ ); \
123 Cleanup(); \
124 } else { \
125 LOG_INFO("passing case: \tPASSED! (%s@%u)", \
126 __FUNCTION__, __LINE__); \
127 } \
128 }
129
130 #define CheckFailed(rval, expected_rval) { \
131 char error_string[ERROR_STR_LEN]; \
132 if ((rval) != (expected_rval)) { \
133 ErrorHandler((rval), error_string, ERROR_STR_LEN); \
134 LOG_INFO("\tfailing case: FAILED! %s Ret code s/b: 0x%x, but was: 0x%x (%s@%u)", \
135 error_string, (expected_rval), (rval), __FUNCTION__, __LINE__ ); \
136 Cleanup(); \
137 } else { \
138 LOG_INFO("\tfailing case: PASSED! (%s@%u)", \
139 __FUNCTION__, __LINE__); \
140 } \
141 }
142
TpmReset()143 static TSS2_RC TpmReset()
144 {
145 TSS2_RC rval = TSS2_RC_SUCCESS;
146
147 rval = (TSS2_RC)tcti_platform_command( resMgrTctiContext, MS_SIM_POWER_OFF );
148 if( rval == TSS2_RC_SUCCESS )
149 {
150 rval = (TSS2_RC)tcti_platform_command( resMgrTctiContext, MS_SIM_POWER_ON );
151 }
152 return rval;
153 }
154
TestDictionaryAttackLockReset()155 static void TestDictionaryAttackLockReset()
156 {
157 UINT32 rval;
158 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
159
160 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths = {{
161 .sessionHandle = TPM2_RS_PW,
162 .sessionAttributes = 0,
163 .nonce={.size=0},
164 .hmac={.size=0}}}};
165
166 LOG_INFO("DICTIONARY ATTACK LOCK RESET TEST :" );
167
168 rval = Tss2_Sys_DictionaryAttackLockReset ( sysContext, TPM2_RH_LOCKOUT, &sessionsData, &sessionsDataOut );
169 CheckPassed( rval );
170 }
171
TestTpmStartup()172 static void TestTpmStartup()
173 {
174 UINT32 rval;
175
176 LOG_INFO("STARTUP TESTS:" );
177
178 /*
179 * First test the one-call interface.
180 */
181
182 /* First must do TPM reset. */
183 rval = TpmReset();
184 CheckPassed(rval);
185
186 /* This one should pass. */
187 rval = Tss2_Sys_Startup( sysContext, TPM2_SU_CLEAR );
188 CheckPassed(rval);
189
190 /* This one should fail. */
191 rval = Tss2_Sys_Startup( sysContext, TPM2_SU_CLEAR );
192 CheckFailed( rval, TPM2_RC_INITIALIZE );
193
194
195 /* Cycle power using simulator interface. */
196 rval = tcti_platform_command( resMgrTctiContext, MS_SIM_POWER_OFF );
197 CheckPassed( rval );
198 rval = tcti_platform_command( resMgrTctiContext, MS_SIM_POWER_ON );
199 CheckPassed( rval );
200
201
202 /*
203 * Now test the synchronous, non-one-call interface.
204 */
205 rval = Tss2_Sys_Startup_Prepare( sysContext, TPM2_SU_CLEAR );
206 CheckPassed(rval);
207
208 /* Execute the command synchronously. */
209 rval = Tss2_Sys_Execute( sysContext );
210 CheckPassed( rval );
211
212 /* Cycle power using simulator interface. */
213 rval = tcti_platform_command( resMgrTctiContext, MS_SIM_POWER_OFF );
214 CheckPassed( rval );
215 rval = tcti_platform_command( resMgrTctiContext, MS_SIM_POWER_ON );
216 CheckPassed( rval );
217
218
219 /*
220 * Now test the asynchronous, non-one-call interface.
221 */
222 rval = Tss2_Sys_Startup_Prepare( sysContext, TPM2_SU_CLEAR );
223 CheckPassed(rval);
224
225 /* Execute the command asynchronously. */
226 rval = Tss2_Sys_ExecuteAsync( sysContext );
227 CheckPassed(rval);
228
229 /*
230 * Get the command response. Wait a maximum of 20ms
231 * for response.
232 */
233 rval = Tss2_Sys_ExecuteFinish( sysContext, TSS2_TCTI_TIMEOUT_BLOCK );
234 CheckPassed(rval);
235 }
236
TestTpmGetCapability()237 static void TestTpmGetCapability()
238 {
239 UINT32 rval;
240
241 char manuID[5] = " ";
242 char *manuIDPtr = &manuID[0];
243 TPMI_YES_NO moreData;
244 TPMS_CAPABILITY_DATA capabilityData;
245
246 LOG_INFO("GET_CAPABILITY TESTS:" );
247
248 rval = Tss2_Sys_GetCapability( sysContext, 0, TPM2_CAP_TPM_PROPERTIES, TPM2_PT_MANUFACTURER, 1, &moreData, &capabilityData, 0 );
249 CheckPassed( rval );
250
251 *((UINT32 *)manuIDPtr) = BE_TO_HOST_32(capabilityData.data.tpmProperties.tpmProperty[0].value);
252 LOG_INFO("\t\tcount: %d, property: %x, manuId: %s",
253 capabilityData.data.tpmProperties.count,
254 capabilityData.data.tpmProperties.tpmProperty[0].property,
255 manuID );
256
257 rval = Tss2_Sys_GetCapability( sysContext, 0, TPM2_CAP_TPM_PROPERTIES, TPM2_PT_MAX_COMMAND_SIZE, 1, &moreData, &capabilityData, 0 );
258 CheckPassed( rval );
259 LOG_INFO("\t\tcount: %d, property: %x, max cmd size: %d",
260 capabilityData.data.tpmProperties.count,
261 capabilityData.data.tpmProperties.tpmProperty[0].property,
262 capabilityData.data.tpmProperties.tpmProperty[0].value );
263
264
265 rval = Tss2_Sys_GetCapability( sysContext, 0, TPM2_CAP_TPM_PROPERTIES, TPM2_PT_MAX_COMMAND_SIZE, 40, &moreData, &capabilityData, 0 );
266 CheckPassed( rval );
267 LOG_INFO("\t\tcount: %d, property: %x, max cmd size: %d",
268 capabilityData.data.tpmProperties.count,
269 capabilityData.data.tpmProperties.tpmProperty[0].property,
270 capabilityData.data.tpmProperties.tpmProperty[0].value );
271
272
273 rval = Tss2_Sys_GetCapability( sysContext, 0, TPM2_CAP_TPM_PROPERTIES, TPM2_PT_MAX_RESPONSE_SIZE, 1, &moreData, &capabilityData, 0 );
274 CheckPassed( rval );
275 LOG_INFO("\t count: %d, property: %x, max response size: %d",
276 capabilityData.data.tpmProperties.count,
277 capabilityData.data.tpmProperties.tpmProperty[0].property,
278 capabilityData.data.tpmProperties.tpmProperty[0].value );
279
280 rval = Tss2_Sys_GetCapability( sysContext, 0, 0xff, TPM2_PT_MANUFACTURER, 1, &moreData, &capabilityData, 0 );
281 CheckFailed(rval, TPM2_RC_VALUE+TPM2_RC_1+TPM2_RC_P);
282 }
283
TestTpmClear()284 static void TestTpmClear()
285 {
286 UINT32 rval;
287 TPM2B_AUTH hmac = { .size = 0 };
288 TPM2B_NONCE nonce = { .size = 0 };
289 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
290
291 TSS2L_SYS_AUTH_COMMAND sessionsDataIn = { .count = 1, .auths = {{
292 .sessionHandle = TPM2_RS_PW,
293 .sessionAttributes = 0,
294 .nonce=nonce,
295 .hmac=hmac}}};
296
297 LOG_INFO("CLEAR and CLEAR CONTROL TESTS:" );
298
299 rval = Tss2_Sys_Clear ( sysContext, TPM2_RH_PLATFORM, &sessionsDataIn, 0 );
300 CheckPassed( rval );
301
302 rval = Tss2_Sys_ClearControl ( sysContext, TPM2_RH_PLATFORM, &sessionsDataIn, YES, &sessionsDataOut );
303 CheckPassed( rval );
304
305 rval = Tss2_Sys_Clear ( sysContext, TPM2_RH_PLATFORM, &sessionsDataIn, 0 );
306 CheckFailed( rval, TPM2_RC_DISABLED );
307
308 rval = Tss2_Sys_ClearControl ( sysContext, TPM2_RH_PLATFORM, &sessionsDataIn, NO, &sessionsDataOut );
309 CheckPassed( rval );
310
311 sessionsDataIn.auths[0].sessionAttributes = 0xff;
312 rval = Tss2_Sys_Clear ( sysContext, TPM2_RH_PLATFORM, &sessionsDataIn, &sessionsDataOut );
313 CheckFailed( rval, TPM2_RC_9 + TPM2_RC_RESERVED_BITS );
314
315 rval = Tss2_Sys_ClearControl ( sysContext, TPM2_RH_PLATFORM, &sessionsDataIn, NO, &sessionsDataOut );
316 CheckFailed( rval, TPM2_RC_9 + TPM2_RC_RESERVED_BITS );
317 }
318
319 #define SESSIONS_ABOVE_MAX_ACTIVE 0
320 #define DEBUG_MAX_ACTIVE_SESSIONS 8
321 #define DEBUG_GAP_MAX 2*DEBUG_MAX_ACTIVE_SESSIONS
322
323 SESSION *sessions[SESSIONS_COUNT];
324
TestStartAuthSession()325 static void TestStartAuthSession()
326 {
327 UINT32 rval;
328 TPM2B_ENCRYPTED_SECRET encryptedSalt;
329 TPMT_SYM_DEF symmetric;
330 SESSION *authSession = NULL;
331 TPM2B_NONCE nonceCaller;
332 UINT16 i;
333 TPM2_HANDLE badSessionHandle = 0x03010000;
334
335 TPMS_AUTH_COMMAND sessionData;
336 TPM2B_NONCE nonce;
337
338
339 TPM2B_AUTH hmac;
340
341
342 /* Init sessionHandle */
343 sessionData.sessionHandle = badSessionHandle;
344
345 /* Init nonce. */
346 nonce.size = 0;
347 sessionData.nonce = nonce;
348
349 /* init hmac */
350 hmac.size = 0;
351 sessionData.hmac = hmac;
352
353 /* Init session attributes */
354 *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0;
355
356 encryptedSalt.size = 0;
357
358 LOG_INFO("START_AUTH_SESSION TESTS:" );
359
360 symmetric.algorithm = TPM2_ALG_NULL;
361 symmetric.keyBits.sym = 0;
362 symmetric.mode.sym = 0;
363
364 nonceCaller.size = 0;
365
366 encryptedSalt.size = 0;
367
368 /* Init session */
369 rval = create_auth_session(&authSession, TPM2_RH_NULL, 0, TPM2_RH_PLATFORM, 0, &nonceCaller, &encryptedSalt, TPM2_SE_POLICY, &symmetric, TPM2_ALG_SHA256, resMgrTctiContext );
370 CheckPassed( rval );
371
372 rval = Tss2_Sys_FlushContext( sysContext, authSession->sessionHandle );
373 CheckPassed( rval );
374 end_auth_session( authSession );
375
376 /* Init session */
377 rval = create_auth_session(&authSession, TPM2_RH_NULL, 0, TPM2_RH_PLATFORM, 0, &nonceCaller, &encryptedSalt, 0xff, &symmetric, TPM2_ALG_SHA256, resMgrTctiContext );
378 CheckFailed( rval, TPM2_RC_VALUE + TPM2_RC_P + TPM2_RC_3 );
379
380 /*
381 * Try starting a bunch to see if resource manager handles this correctly.
382 */
383 for( i = 0; i < ( sizeof(sessions) / sizeof (SESSION *) ); i++ )
384 {
385 /* Init session struct */
386 rval = create_auth_session(&sessions[i], TPM2_RH_NULL, 0, TPM2_RH_PLATFORM, 0, &nonceCaller, &encryptedSalt, TPM2_SE_POLICY, &symmetric, TPM2_ALG_SHA256, resMgrTctiContext );
387 CheckPassed( rval );
388 LOG_INFO("Number of sessions created: %d", i+1 );
389
390 }
391 /* clean up the sessions that I don't want here. */
392 for( i = 0; i < ( sizeof(sessions) / sizeof (SESSION *)); i++ )
393 {
394 rval = Tss2_Sys_FlushContext( sysContext, sessions[i]->sessionHandle );
395 CheckPassed( rval );
396
397 end_auth_session(sessions[i]);
398 }
399
400 /* Now do some gap tests. */
401 rval = create_auth_session(&sessions[0], TPM2_RH_NULL, 0, TPM2_RH_PLATFORM, 0, &nonceCaller, &encryptedSalt, TPM2_SE_POLICY, &symmetric, TPM2_ALG_SHA256, resMgrTctiContext );
402 CheckPassed( rval );
403
404 for( i = 1; i < ( sizeof(sessions) / sizeof (SESSION *) ); i++ )
405 {
406 rval = create_auth_session(&sessions[i], TPM2_RH_NULL, 0, TPM2_RH_PLATFORM, 0, &nonceCaller, &encryptedSalt, TPM2_SE_POLICY, &symmetric, TPM2_ALG_SHA256, resMgrTctiContext );
407 CheckPassed( rval );
408
409 rval = Tss2_Sys_FlushContext( sysContext, sessions[i]->sessionHandle );
410 CheckPassed( rval );
411
412 end_auth_session(sessions[i]);
413 }
414 end_auth_session(sessions[0]);
415
416 for( i = 0; i < ( sizeof(sessions) / sizeof (SESSION *) ); i++ )
417 {
418 rval = create_auth_session(&sessions[i], TPM2_RH_NULL, 0, TPM2_RH_PLATFORM, 0, &nonceCaller, &encryptedSalt, TPM2_SE_POLICY, &symmetric, TPM2_ALG_SHA256, resMgrTctiContext );
419 CheckPassed( rval );
420
421 rval = Tss2_Sys_FlushContext( sysContext, sessions[i]->sessionHandle );
422 CheckPassed( rval );
423
424 end_auth_session(sessions[i]);
425 }
426 }
427
TestChangeEps()428 static void TestChangeEps()
429 {
430 UINT32 rval;
431 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
432 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths = {{
433 .sessionHandle = TPM2_RS_PW,
434 .sessionAttributes = 0,
435 .nonce = {.size = 0},
436 .hmac = {.size = 0}}}};
437
438 LOG_INFO("CHANGE_EPS TESTS:" );
439
440 rval = Tss2_Sys_ChangeEPS( sysContext, TPM2_RH_PLATFORM, &sessionsData, &sessionsDataOut );
441 CheckPassed( rval );
442 }
443
TestChangePps()444 static void TestChangePps()
445 {
446 UINT32 rval;
447
448 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
449
450 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths = {{
451 .sessionHandle = TPM2_RS_PW,
452 .sessionAttributes = 0,
453 .nonce = {.size = 0},
454 .hmac = {.size = 0}}}};
455
456 LOG_INFO("CHANGE_PPS TESTS:" );
457
458 rval = Tss2_Sys_ChangePPS( sysContext, TPM2_RH_PLATFORM, &sessionsData, &sessionsDataOut );
459 CheckPassed( rval );
460 }
461
TestHierarchyChangeAuth()462 static void TestHierarchyChangeAuth()
463 {
464 UINT32 rval;
465 TPM2B_AUTH newAuth;
466 int i;
467
468 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths = {{
469 .sessionHandle = TPM2_RS_PW,
470 .sessionAttributes = 0,
471 .nonce = {.size = 0},
472 .hmac = {.size = 0}}}};
473
474 LOG_INFO("HIERARCHY_CHANGE_AUTH TESTS:" );
475
476 newAuth.size = 0;
477 rval = Tss2_Sys_HierarchyChangeAuth( sysContext, TPM2_RH_PLATFORM, &sessionsData, &newAuth, 0 );
478 CheckPassed( rval );
479
480 /* Init new auth */
481 newAuth.size = 20;
482 for( i = 0; i < newAuth.size; i++ )
483 newAuth.buffer[i] = i;
484
485 rval = Tss2_Sys_HierarchyChangeAuth( sysContext, TPM2_RH_PLATFORM, &sessionsData, &newAuth, 0 );
486 CheckPassed( rval );
487
488 sessionsData.auths[0].hmac = newAuth;
489 rval = Tss2_Sys_HierarchyChangeAuth( sysContext, TPM2_RH_PLATFORM, &sessionsData, &newAuth, 0 );
490 CheckPassed( rval );
491
492 /* Init new auth */
493 newAuth.size = 0;
494
495 rval = Tss2_Sys_HierarchyChangeAuth( sysContext, TPM2_RH_PLATFORM, &sessionsData, &newAuth, 0 );
496 CheckPassed( rval );
497
498 rval = Tss2_Sys_HierarchyChangeAuth( sysContext, TPM2_RH_PLATFORM, &sessionsData, &newAuth, 0 );
499 CheckFailed( rval, TPM2_RC_1 + TPM2_RC_S + TPM2_RC_BAD_AUTH );
500
501 rval = Tss2_Sys_HierarchyChangeAuth( sysContext, 0, &sessionsData, &newAuth, 0 );
502 CheckFailed( rval, TPM2_RC_1 + TPM2_RC_VALUE );
503 }
504
505 #define PCR_0 0
506 #define PCR_1 1
507 #define PCR_2 2
508 #define PCR_3 3
509 #define PCR_4 4
510 #define PCR_5 5
511 #define PCR_6 6
512 #define PCR_7 7
513 #define PCR_8 8
514 #define PCR_9 9
515 #define PCR_10 10
516 #define PCR_11 11
517 #define PCR_12 12
518 #define PCR_13 13
519 #define PCR_14 14
520 #define PCR_15 15
521 #define PCR_16 16
522 #define PCR_17 17
523 #define PCR_18 18
524 #define PCR_SIZE 20
525
TestPcrExtend()526 static void TestPcrExtend()
527 {
528 UINT32 rval;
529 UINT16 i, digestSize;
530 TPML_PCR_SELECTION pcrSelection;
531 UINT32 pcrUpdateCounterBeforeExtend;
532 UINT32 pcrUpdateCounterAfterExtend;
533 UINT8 pcrBeforeExtend[PCR_SIZE];
534 TPM2B_EVENT eventData;
535 TPML_DIGEST pcrValues;
536 TPML_DIGEST_VALUES digests;
537 TPML_PCR_SELECTION pcrSelectionOut;
538 UINT8 pcrAfterExtend[20];
539 TSS2_TCTI_CONTEXT *tctiContext;
540
541 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths = {{
542 .sessionHandle = TPM2_RS_PW,
543 .sessionAttributes = 0,
544 .nonce = {.size = 0},
545 .hmac = {.size = 0}}}};
546
547 LOG_INFO("PCR_EXTEND, PCR_EVENT, PCR_ALLOCATE, and PCR_READ TESTS:" );
548
549 /* Init digests */
550 digests.count = 1;
551 digests.digests[0].hashAlg = TPM2_ALG_SHA1;
552 digestSize = GetDigestSize( digests.digests[0].hashAlg );
553
554 for( i = 0; i < digestSize; i++ )
555 {
556 digests.digests[0].digest.sha1[i] = (UINT8)(i % 256);
557 }
558
559 pcrSelection.count = 1;
560 pcrSelection.pcrSelections[0].hash = TPM2_ALG_SHA1;
561 pcrSelection.pcrSelections[0].sizeofSelect = 3;
562
563 /* Clear out PCR select bit field */
564 pcrSelection.pcrSelections[0].pcrSelect[0] = 0;
565 pcrSelection.pcrSelections[0].pcrSelect[1] = 0;
566 pcrSelection.pcrSelections[0].pcrSelect[2] = 0;
567
568 /* Now set the PCR you want to read */
569 SET_PCR_SELECT_BIT( pcrSelection.pcrSelections[0], PCR_17 );
570
571 rval = Tss2_Sys_PCR_Read( sysContext, 0, &pcrSelection, &pcrUpdateCounterBeforeExtend, &pcrSelectionOut, &pcrValues, 0 );
572 CheckPassed( rval );
573
574 if( pcrValues.digests[0].size <= PCR_SIZE &&
575 pcrValues.digests[0].size <= sizeof( pcrValues.digests[0].buffer ) )
576 memcpy( &( pcrBeforeExtend[0] ), &( pcrValues.digests[0].buffer[0] ), pcrValues.digests[0].size );
577
578 /* Set locality 3 to enable PCR extend with PCR 17 */
579 rval = Tss2_Sys_GetTctiContext(sysContext, &tctiContext);
580 CheckPassed(rval);
581
582 rval = Tss2_Tcti_SetLocality(tctiContext, 3);
583 CheckPassed(rval);
584
585 rval = Tss2_Sys_PCR_Extend( sysContext, PCR_17, &sessionsData, &digests, 0 );
586 CheckPassed( rval );
587
588 rval = Tss2_Sys_PCR_Read( sysContext, 0, &pcrSelection, &pcrUpdateCounterAfterExtend, &pcrSelectionOut, &pcrValues, 0 );
589 CheckPassed( rval );
590
591 memcpy( &( pcrAfterExtend[0] ), &( pcrValues.digests[0].buffer[0] ), pcrValues.digests[0].size );
592
593 if( pcrUpdateCounterBeforeExtend == pcrUpdateCounterAfterExtend )
594 {
595 LOG_ERROR("ERROR!! pcrUpdateCounter didn't change value" );
596 Cleanup();
597 }
598
599 if( 0 == memcmp( &( pcrBeforeExtend[0] ), &( pcrAfterExtend[0] ), 20 ) )
600 {
601 LOG_ERROR("ERROR!! PCR didn't change value" );
602 Cleanup();
603 }
604
605 pcrSelection.pcrSelections[0].sizeofSelect = 255;
606
607 rval = Tss2_Sys_PCR_Read( sysContext, 0, &pcrSelection, &pcrUpdateCounterAfterExtend, 0, 0, 0 );
608 CheckFailed( rval, TSS2_SYS_RC_BAD_VALUE );
609
610 eventData.size = 4;
611 eventData.buffer[0] = 0;
612 eventData.buffer[1] = 0xff;
613 eventData.buffer[2] = 0x55;
614 eventData.buffer[3] = 0xaa;
615
616 rval = Tss2_Sys_PCR_Event( sysContext, PCR_18, &sessionsData, &eventData, &digests, 0 );
617 CheckPassed( rval );
618
619 /* Reset locality and check whether extend PCR 17 is no possible */
620 rval = Tss2_Tcti_SetLocality(tctiContext, 0);
621 CheckPassed( rval );
622
623 rval = Tss2_Sys_PCR_Extend( sysContext, PCR_17, &sessionsData, &digests, 0 );
624 CheckFailed( rval, TPM2_RC_LOCALITY );
625 }
626
TestShutdown()627 static void TestShutdown()
628 {
629 UINT32 rval;
630 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
631
632 LOG_INFO("SHUTDOWN TESTS:" );
633
634 rval = Tss2_Sys_Shutdown( sysContext, 0, TPM2_SU_STATE, &sessionsDataOut );
635 CheckPassed( rval );
636
637 rval = Tss2_Sys_Shutdown( sysContext, 0, TPM2_SU_CLEAR, &sessionsDataOut );
638 CheckPassed( rval );
639
640 rval = Tss2_Sys_Shutdown( sysContext, 0, 0xff, 0 );
641 CheckFailed( rval, TPM2_RC_VALUE+TPM2_RC_1+TPM2_RC_P );
642 }
643
TestNV()644 static void TestNV()
645 {
646 UINT32 rval;
647 TPM2B_NV_PUBLIC publicInfo;
648 TPM2B_AUTH nvAuth;
649 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
650 int i;
651 TPM2B_MAX_NV_BUFFER nvWriteData;
652 TPM2B_MAX_NV_BUFFER nvData;
653
654 TPM2B_NV_PUBLIC nvPublic;
655 TPM2B_NAME nvName;
656
657 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths = {{
658 .sessionHandle = TPM2_RS_PW,
659 .sessionAttributes = 0,
660 .nonce = {.size = 0},
661 .hmac = {.size = 0}}}};
662
663 LOG_INFO("NV INDEX TESTS:" );
664
665 nvAuth.size = 20;
666 for( i = 0; i < nvAuth.size; i++ ) {
667 nvAuth.buffer[i] = (UINT8)i;
668 }
669
670 publicInfo.size = 0;
671 publicInfo.nvPublic.nvIndex = TPM20_INDEX_TEST1;
672 publicInfo.nvPublic.nameAlg = TPM2_ALG_SHA1;
673
674 /* First zero out attributes. */
675 *(UINT32 *)&( publicInfo.nvPublic.attributes ) = 0;
676
677 /* Now set the attributes. */
678 publicInfo.nvPublic.attributes |= TPMA_NV_PPREAD;
679 publicInfo.nvPublic.attributes |= TPMA_NV_PPWRITE;
680 publicInfo.nvPublic.attributes |= TPMA_NV_WRITE_STCLEAR;
681 publicInfo.nvPublic.attributes |= TPMA_NV_PLATFORMCREATE;
682 publicInfo.nvPublic.attributes |= TPMA_NV_ORDERLY;
683 publicInfo.nvPublic.authPolicy.size = 0;
684 publicInfo.nvPublic.dataSize = 32;
685
686 INIT_SIMPLE_TPM2B_SIZE( nvData );
687 rval = Tss2_Sys_NV_Read( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, 32, 0, &nvData, &sessionsDataOut );
688 CheckFailed( rval, TPM2_RC_2 + TPM2_RC_HANDLE );
689
690 rval = Tss2_Sys_NV_DefineSpace( sysContext, TPM2_RH_PLATFORM, &sessionsData, &nvAuth, &publicInfo, &sessionsDataOut );
691 CheckPassed( rval );
692
693 nvPublic.size = 0;
694 INIT_SIMPLE_TPM2B_SIZE( nvName );
695 rval = Tss2_Sys_NV_ReadPublic( sysContext, TPM20_INDEX_TEST1, 0, &nvPublic, &nvName, 0 );
696 CheckPassed( rval );
697
698 INIT_SIMPLE_TPM2B_SIZE( nvData );
699 rval = Tss2_Sys_NV_Read( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, 32, 0, &nvData, &sessionsDataOut );
700 CheckFailed( rval, TPM2_RC_NV_UNINITIALIZED );
701
702 /* Should fail since index is already defined. */
703 rval = Tss2_Sys_NV_DefineSpace( sysContext, TPM2_RH_PLATFORM, &sessionsData, &nvAuth, &publicInfo, &sessionsDataOut );
704 CheckFailed( rval, TPM2_RC_NV_DEFINED );
705
706 nvWriteData.size = 4;
707 for( i = 0; i < nvWriteData.size; i++ )
708 nvWriteData.buffer[i] = 0xff - i;
709
710 #if 1
711 /*
712 * The following, at one point, was commented out so that NVDefine will
713 * work on successive invocations of client app.
714 *
715 * Noticed on 12/13/12, this doesn't seem to be necessary anymore.
716 * Maybe something else fixed it.
717 *
718 * Seems to be a bug in TPM 2.0 simulator that if:
719 * First pass of tpmclient.exe after restarting TPM 2.0 simulator will
720 * work fine.
721 * If NVWrite is done, subsequent invocations of tpmclient.exe will
722 * ALWAYS fail on the first call to Tpm2NVDefineSpace with 0x2cb error.
723 * Removing NVWrite fixes this.
724 * And restarting TPM 2.0 simulator will make it work the first time
725 * and fail subsequent times.
726 * Removing NVWrite works around this problem.
727 */
728 rval = Tss2_Sys_NV_Write( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, &nvWriteData, 0, &sessionsDataOut );
729 CheckPassed( rval );
730
731 INIT_SIMPLE_TPM2B_SIZE( nvData );
732 rval = Tss2_Sys_NV_Read( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, 32, 0, &nvData, &sessionsDataOut );
733 CheckPassed( rval );
734
735 rval = Tss2_Sys_NV_WriteLock( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, &sessionsDataOut );
736 CheckPassed( rval );
737
738 rval = Tss2_Sys_NV_Write( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, &nvWriteData, 0, &sessionsDataOut );
739 CheckFailed( rval, TPM2_RC_NV_LOCKED );
740 #endif
741
742 /* Now undefine the index. */
743 rval = Tss2_Sys_NV_UndefineSpace( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, 0 );
744 CheckPassed( rval );
745
746 rval = Tss2_Sys_NV_DefineSpace( sysContext, TPM2_RH_PLATFORM, &sessionsData, &nvAuth, &publicInfo, 0 );
747 CheckPassed( rval );
748
749 /* Now undefine the index so that next run will work correctly. */
750 rval = Tss2_Sys_NV_UndefineSpace( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, 0 );
751 CheckPassed( rval );
752
753 publicInfo.nvPublic.attributes &= ~TPMA_NV_PPREAD;
754 publicInfo.nvPublic.attributes &= ~TPMA_NV_PPWRITE;
755 publicInfo.nvPublic.attributes |= TPMA_NV_OWNERREAD;
756 publicInfo.nvPublic.attributes |= TPMA_NV_OWNERWRITE;
757 publicInfo.nvPublic.attributes &= ~TPMA_NV_PLATFORMCREATE;
758 publicInfo.nvPublic.attributes |= TPMA_NV_ORDERLY;
759 publicInfo.nvPublic.nvIndex = TPM20_INDEX_TEST2;
760 rval = Tss2_Sys_NV_DefineSpace( sysContext, TPM2_RH_OWNER, &sessionsData, &nvAuth, &publicInfo, 0 );
761 CheckPassed( rval );
762
763 nvPublic.size = 0;
764 INIT_SIMPLE_TPM2B_SIZE( nvName );
765 rval = Tss2_Sys_NV_ReadPublic( sysContext, TPM20_INDEX_TEST2, 0, &nvPublic, &nvName, 0 );
766 CheckPassed( rval );
767
768 INIT_SIMPLE_TPM2B_SIZE( nvData );
769 rval = Tss2_Sys_NV_Read( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST2, &sessionsData, 32, 0, &nvData, 0 );
770 CheckFailed( rval, TPM2_RC_NV_AUTHORIZATION );
771
772 /* Now undefine the index. */
773 rval = Tss2_Sys_NV_UndefineSpace( sysContext, TPM2_RH_OWNER, TPM20_INDEX_TEST2, &sessionsData, 0 );
774 CheckPassed( rval );
775
776 rval = Tss2_Sys_NV_DefineSpace( sysContext, TPM2_RH_OWNER, &sessionsData, &nvAuth, &publicInfo, 0 );
777 CheckPassed( rval );
778
779 /* Now undefine the index so that next run will work correctly. */
780 rval = Tss2_Sys_NV_UndefineSpace( sysContext, TPM2_RH_OWNER, TPM20_INDEX_TEST2, &sessionsData, 0 );
781 CheckPassed( rval );
782 }
783
TestHierarchyControl()784 static void TestHierarchyControl()
785 {
786 UINT32 rval;
787 TPM2B_NV_PUBLIC publicInfo;
788 TPM2B_AUTH nvAuth;
789 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
790 int i;
791 TPM2B_NAME nvName;
792 TPM2B_NV_PUBLIC nvPublic;
793 TPM2B_MAX_NV_BUFFER nvData;
794
795 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths = {{
796 .sessionHandle = TPM2_RS_PW,
797 .sessionAttributes = 0,
798 .nonce = {.size = 0},
799 .hmac = {.size = 0}}}};
800
801 LOG_INFO("HIERARCHY CONTROL TESTS:" );
802
803 nvAuth.size = 20;
804 for( i = 0; i < nvAuth.size; i++ ) {
805 nvAuth.buffer[i] = i;
806 }
807
808 publicInfo.size = 0;
809 publicInfo.nvPublic.nvIndex = TPM20_INDEX_TEST1;
810 publicInfo.nvPublic.nameAlg = TPM2_ALG_SHA1;
811
812 /* First zero out attributes. */
813 *(UINT32 *)&( publicInfo.nvPublic.attributes ) = 0;
814
815 /* Now set the attributes. */
816 publicInfo.nvPublic.attributes |= TPMA_NV_PPREAD;
817 publicInfo.nvPublic.attributes |= TPMA_NV_PPWRITE;
818 publicInfo.nvPublic.attributes |= TPMA_NV_PPWRITE;
819 publicInfo.nvPublic.attributes |= TPMA_NV_WRITE_STCLEAR;
820 publicInfo.nvPublic.attributes |= TPMA_NV_PLATFORMCREATE;
821 publicInfo.nvPublic.attributes |= TPMA_NV_ORDERLY;
822 publicInfo.nvPublic.authPolicy.size = 0;
823 publicInfo.nvPublic.dataSize = 32;
824
825 rval = Tss2_Sys_NV_DefineSpace( sysContext, TPM2_RH_PLATFORM, &sessionsData, &nvAuth, &publicInfo, 0 );
826 CheckPassed( rval );
827
828 /* Test SAPI for case where nvPublic.size != 0 */
829 nvPublic.size = 0xff;
830 INIT_SIMPLE_TPM2B_SIZE( nvName );
831 rval = Tss2_Sys_NV_ReadPublic( sysContext, TPM20_INDEX_TEST1, 0, &nvPublic, &nvName, 0 );
832 CheckFailed( rval, TSS2_SYS_RC_BAD_VALUE );
833
834 nvPublic.size = 0;
835 INIT_SIMPLE_TPM2B_SIZE( nvName );
836 rval = Tss2_Sys_NV_ReadPublic( sysContext, TPM20_INDEX_TEST1, 0, &nvPublic, &nvName, 0 );
837 CheckPassed( rval );
838
839 rval = Tss2_Sys_NV_Read( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, 32, 0, &nvData, &sessionsDataOut );
840 CheckFailed( rval, TPM2_RC_NV_UNINITIALIZED );
841
842 rval = Tss2_Sys_HierarchyControl( sysContext, TPM2_RH_PLATFORM, &sessionsData, TPM2_RH_PLATFORM, NO, &sessionsDataOut );
843 CheckPassed( rval );
844
845 rval = Tss2_Sys_NV_Read( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, 32, 0, &nvData, &sessionsDataOut );
846 CheckFailed( rval, TPM2_RC_1 + TPM2_RC_HIERARCHY );
847
848 rval = Tss2_Sys_HierarchyControl( sysContext, TPM2_RH_PLATFORM, &sessionsData, TPM2_RH_PLATFORM, YES, &sessionsDataOut );
849 CheckFailed( rval, TPM2_RC_1 + TPM2_RC_HIERARCHY );
850
851 /* Need to do TPM reset and Startup to re-enable platform hierarchy. */
852 rval = TpmReset();
853 CheckPassed(rval);
854
855 rval = Tss2_Sys_Startup ( sysContext, TPM2_SU_CLEAR );
856 CheckPassed( rval );
857
858 rval = Tss2_Sys_HierarchyControl( sysContext, TPM2_RH_PLATFORM, &sessionsData, TPM2_RH_PLATFORM, YES, &sessionsDataOut );
859 CheckPassed( rval );
860
861 /* Now undefine the index so that next run will work correctly. */
862 rval = Tss2_Sys_NV_UndefineSpace( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_TEST1, &sessionsData, 0 );
863 CheckPassed( rval );
864 }
865
866 typedef struct {
867 char name[50];
868 TSS2_RC (*buildPolicyFn )( TSS2_SYS_CONTEXT *sysContext, SESSION *trialPolicySession, TPM2B_DIGEST *policyDigest );
869 TSS2_RC (*createObjectFn )( TSS2_SYS_CONTEXT *sysContext, SESSION **policySession, TPM2B_DIGEST *policyDigest );
870 TSS2_RC (*testPolicyFn )( TSS2_SYS_CONTEXT *sysContext, SESSION *policySession );
871 } POLICY_TEST_SETUP;
872
BuildPolicy(TSS2_SYS_CONTEXT * sysContext,SESSION ** policySession,TSS2_RC (* buildPolicyFn)(TSS2_SYS_CONTEXT * sysContext,SESSION * policySession,TPM2B_DIGEST * policyDigest),TPM2B_DIGEST * policyDigest,bool trialSession)873 static TSS2_RC BuildPolicy( TSS2_SYS_CONTEXT *sysContext, SESSION **policySession,
874 TSS2_RC (*buildPolicyFn )( TSS2_SYS_CONTEXT *sysContext, SESSION *policySession, TPM2B_DIGEST *policyDigest ),
875 TPM2B_DIGEST *policyDigest, bool trialSession )
876 {
877 /*
878 * NOTE: this policySession will be either a trial or normal policy session
879 * depending on the value of the passed in trialSession parameter.
880 */
881 TPM2B_ENCRYPTED_SECRET encryptedSalt = {0,};
882 TPMT_SYM_DEF symmetric;
883 TSS2_RC rval;
884 TPM2B_NONCE nonceCaller;
885
886 nonceCaller.size = 0;
887
888 /* Start policy session. */
889 symmetric.algorithm = TPM2_ALG_NULL;
890 rval = create_auth_session(policySession, TPM2_RH_NULL, 0, TPM2_RH_NULL, 0, &nonceCaller, &encryptedSalt, trialSession ? TPM2_SE_TRIAL : TPM2_SE_POLICY , &symmetric, TPM2_ALG_SHA256, resMgrTctiContext );
891 if( rval != TPM2_RC_SUCCESS )
892 return rval;
893
894 /* Send policy command. */
895 rval = ( *buildPolicyFn )( sysContext, *policySession, policyDigest );
896 CheckPassed( rval );
897
898 /* Get policy hash. */
899 INIT_SIMPLE_TPM2B_SIZE( *policyDigest );
900 rval = Tss2_Sys_PolicyGetDigest( sysContext, (*policySession)->sessionHandle,
901 0, policyDigest, 0 );
902 CheckPassed( rval );
903
904 if( trialSession )
905 {
906 /* Need to flush the session here. */
907 rval = Tss2_Sys_FlushContext( sysContext, (*policySession)->sessionHandle );
908 CheckPassed( rval );
909
910 /* And remove the session from sessions table. */
911 end_auth_session( *policySession );
912 }
913
914 return rval;
915 }
916
CreateNVIndex(TSS2_SYS_CONTEXT * sysContext,SESSION ** policySession,TPM2B_DIGEST * policyDigest)917 static TSS2_RC CreateNVIndex( TSS2_SYS_CONTEXT *sysContext, SESSION **policySession, TPM2B_DIGEST *policyDigest )
918 {
919 TSS2_RC rval = TPM2_RC_SUCCESS;
920 TPMA_LOCALITY locality;
921 TPM2B_ENCRYPTED_SECRET encryptedSalt = {0};
922 TPMT_SYM_DEF symmetric;
923 TPMA_NV nvAttributes;
924 TPM2B_AUTH nvAuth;
925 TPM2B_NONCE nonceCaller;
926
927 nonceCaller.size = 0;
928
929 /*
930 * Since locality is a fairly simple command and we can guarantee
931 * its correctness, we don't need a trial session for this.
932 */
933
934 /* Start real policy session */
935 symmetric.algorithm = TPM2_ALG_NULL;
936 rval = create_auth_session(policySession, TPM2_RH_NULL,
937 0, TPM2_RH_NULL, 0, &nonceCaller, &encryptedSalt, TPM2_SE_POLICY,
938 &symmetric, TPM2_ALG_SHA256, resMgrTctiContext );
939 CheckPassed( rval );
940
941 /* Send PolicyLocality command */
942 *(UINT8 *)( (void *)&locality ) = 0;
943 locality |= TPMA_LOCALITY_TPM2_LOC_THREE;
944 rval = Tss2_Sys_PolicyLocality( sysContext, (*policySession)->sessionHandle,
945 0, locality, 0 );
946 CheckPassed( rval );
947
948 /* Read policyHash */
949 INIT_SIMPLE_TPM2B_SIZE( *policyDigest );
950 rval = Tss2_Sys_PolicyGetDigest( sysContext,
951 (*policySession)->sessionHandle, 0, policyDigest, 0 );
952 CheckPassed( rval );
953
954 nvAuth.size = 0;
955
956 /* Now set the attributes. */
957 *(UINT32 *)( (void *)&nvAttributes ) = 0;
958 nvAttributes |= TPMA_NV_POLICYREAD;
959 nvAttributes |= TPMA_NV_POLICYWRITE;
960 nvAttributes |= TPMA_NV_PLATFORMCREATE;
961
962 rval = DefineNvIndex( sysContext, TPM2_RH_PLATFORM, &nvAuth, policyDigest,
963 TPM20_INDEX_PASSWORD_TEST, TPM2_ALG_SHA256, nvAttributes, 32 );
964 CheckPassed( rval );
965
966 rval = AddEntity(TPM20_INDEX_PASSWORD_TEST, &nvAuth);
967 CheckPassed(rval);
968
969 return rval;
970 }
971
972
TestLocality(TSS2_SYS_CONTEXT * sysContext,SESSION * policySession)973 static TSS2_RC TestLocality( TSS2_SYS_CONTEXT *sysContext, SESSION *policySession )
974 {
975 TSS2_RC rval = TPM2_RC_SUCCESS;
976 TPM2B_MAX_NV_BUFFER nvWriteData;
977 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut = { 1, };
978 TSS2_TCTI_CONTEXT *tctiContext;
979 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths = {{
980 .sessionHandle = policySession->sessionHandle,
981 .sessionAttributes = TPMA_SESSION_CONTINUESESSION,
982 .nonce = {.size = 0},
983 .hmac = {.size = 0}}}};
984
985
986 /* Init write data. */
987 nvWriteData.size = 0;
988
989 rval = Tss2_Sys_GetTctiContext(sysContext, &tctiContext);
990 CheckPassed(rval);
991
992 rval = Tss2_Tcti_SetLocality(tctiContext, 2);
993 CheckPassed(rval);
994
995 /* Do NV write using open session's policy. */
996 rval = Tss2_Sys_NV_Write( sysContext, TPM20_INDEX_PASSWORD_TEST,
997 TPM20_INDEX_PASSWORD_TEST,
998 &sessionsData, &nvWriteData, 0, &sessionsDataOut );
999 CheckFailed( rval, TPM2_RC_LOCALITY );
1000
1001 rval = Tss2_Tcti_SetLocality(tctiContext, 3);
1002 CheckPassed( rval );
1003
1004 /* Do NV write using open session's policy. */
1005 rval = Tss2_Sys_NV_Write( sysContext, TPM20_INDEX_PASSWORD_TEST,
1006 TPM20_INDEX_PASSWORD_TEST,
1007 &sessionsData, &nvWriteData, 0, &sessionsDataOut );
1008 CheckPassed( rval );
1009
1010 /* Do another NV write using open session's policy. */
1011 rval = Tss2_Sys_NV_Write( sysContext, TPM20_INDEX_PASSWORD_TEST,
1012 TPM20_INDEX_PASSWORD_TEST,
1013 &sessionsData, &nvWriteData, 0, &sessionsDataOut );
1014 CheckFailed( rval, TPM2_RC_POLICY_FAIL + TPM2_RC_S + TPM2_RC_1 );
1015
1016 /* Delete NV index */
1017 sessionsData.auths[0].sessionHandle = TPM2_RS_PW;
1018 sessionsData.auths[0].nonce.size = 0;
1019 sessionsData.auths[0].nonce.buffer[0] = 0xa5;
1020 sessionsData.auths[0].hmac.size = 0;
1021
1022 /* Now undefine the index. */
1023 rval = Tss2_Sys_NV_UndefineSpace( sysContext, TPM2_RH_PLATFORM,
1024 TPM20_INDEX_PASSWORD_TEST, &sessionsData, 0 );
1025 CheckPassed( rval );
1026
1027 DeleteEntity(TPM20_INDEX_PASSWORD_TEST);
1028
1029 /* Reset locality */
1030 rval = Tss2_Tcti_SetLocality(tctiContext, 0);
1031 CheckPassed( rval );
1032
1033 return rval;
1034 }
1035
1036 UINT8 passwordPCRTestPassword[] = "password PCR";
1037 UINT8 dataBlob[] = "some data";
1038 TPM2_HANDLE blobHandle;
1039 TPM2B_AUTH blobAuth;
1040
BuildPasswordPolicy(TSS2_SYS_CONTEXT * sysContext,SESSION * policySession,TPM2B_DIGEST * policyDigest)1041 static TSS2_RC BuildPasswordPolicy( TSS2_SYS_CONTEXT *sysContext, SESSION *policySession, TPM2B_DIGEST *policyDigest )
1042 {
1043 TSS2_RC rval = TPM2_RC_SUCCESS;
1044
1045 rval = Tss2_Sys_PolicyPassword( sysContext, policySession->sessionHandle, 0, 0 );
1046 CheckPassed( rval );
1047
1048 return rval;
1049 }
1050
CreateDataBlob(TSS2_SYS_CONTEXT * sysContext,SESSION ** policySession,TPM2B_DIGEST * policyDigest)1051 static TSS2_RC CreateDataBlob( TSS2_SYS_CONTEXT *sysContext, SESSION **policySession, TPM2B_DIGEST *policyDigest )
1052 {
1053 TSS2_RC rval = TPM2_RC_SUCCESS;
1054 TPM2B_SENSITIVE_CREATE inSensitive;
1055 TPM2B_PUBLIC inPublic;
1056 TPM2B_DATA outsideInfo = {0,};
1057 TPML_PCR_SELECTION creationPcr = { 0 };
1058 TPM2B_PUBLIC outPublic;
1059 TPM2B_CREATION_DATA creationData;
1060 TPM2_HANDLE srkHandle;
1061 TPM2B_DIGEST creationHash;
1062 TPMT_TK_CREATION creationTicket;
1063 TPM2B_NAME srkName, blobName;
1064 TPM2B_DIGEST data;
1065 TPM2B_PRIVATE outPrivate;
1066
1067 TSS2L_SYS_AUTH_COMMAND cmdAuthArray = { .count = 1, .auths = {{
1068 .sessionHandle = TPM2_RS_PW,
1069 .sessionAttributes = 0,
1070 .nonce = {.size = 0},
1071 .hmac = {.size = 0}}}};
1072
1073 inSensitive.size = 0;
1074 inSensitive.sensitive.userAuth.size = 0;
1075 inSensitive.sensitive.data.size = 0;
1076
1077 inPublic.size = 0;
1078 inPublic.publicArea.type = TPM2_ALG_RSA;
1079 inPublic.publicArea.nameAlg = TPM2_ALG_SHA1;
1080 *(UINT32 *)&( inPublic.publicArea.objectAttributes) = 0;
1081 inPublic.publicArea.objectAttributes |= TPMA_OBJECT_RESTRICTED;
1082 inPublic.publicArea.objectAttributes |= TPMA_OBJECT_USERWITHAUTH;
1083 inPublic.publicArea.objectAttributes |= TPMA_OBJECT_DECRYPT;
1084 inPublic.publicArea.objectAttributes |= TPMA_OBJECT_FIXEDTPM;
1085 inPublic.publicArea.objectAttributes |= TPMA_OBJECT_FIXEDPARENT;
1086 inPublic.publicArea.objectAttributes |= TPMA_OBJECT_SENSITIVEDATAORIGIN;
1087 inPublic.publicArea.authPolicy.size = 0;
1088 inPublic.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM2_ALG_AES;
1089 inPublic.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 128;
1090 inPublic.publicArea.parameters.rsaDetail.symmetric.mode.aes = TPM2_ALG_CBC;
1091 inPublic.publicArea.parameters.rsaDetail.scheme.scheme = TPM2_ALG_NULL;
1092 inPublic.publicArea.parameters.rsaDetail.keyBits = 2048;
1093 inPublic.publicArea.parameters.rsaDetail.exponent = 0;
1094 inPublic.publicArea.unique.rsa.size = 0;
1095
1096 outPublic.size = 0;
1097 creationData.size = 0;
1098 INIT_SIMPLE_TPM2B_SIZE( creationHash );
1099 INIT_SIMPLE_TPM2B_SIZE( srkName );
1100 rval = Tss2_Sys_CreatePrimary( sysContext, TPM2_RH_PLATFORM, &cmdAuthArray,
1101 &inSensitive, &inPublic, &outsideInfo, &creationPcr,
1102 &srkHandle, &outPublic, &creationData, &creationHash,
1103 &creationTicket, &srkName, 0 );
1104 CheckPassed( rval );
1105
1106 cmdAuthArray.auths[0].sessionHandle = TPM2_RS_PW;
1107
1108 inSensitive.sensitive.userAuth.size = 0;
1109 blobAuth.size = sizeof( passwordPCRTestPassword );
1110 memcpy( &blobAuth.buffer, passwordPCRTestPassword, sizeof( passwordPCRTestPassword ) );
1111 CopySizedByteBuffer((TPM2B *)&inSensitive.sensitive.userAuth, (TPM2B *)&blobAuth);
1112 data.size = sizeof( dataBlob );
1113 memcpy( &data.buffer, dataBlob, sizeof( dataBlob ) );
1114 CopySizedByteBuffer((TPM2B *)&inSensitive.sensitive.data, (TPM2B *)&data);
1115
1116 inPublic.publicArea.type = TPM2_ALG_KEYEDHASH;
1117 inPublic.publicArea.nameAlg = TPM2_ALG_SHA256;
1118 inPublic.publicArea.objectAttributes &= ~TPMA_OBJECT_RESTRICTED;
1119 inPublic.publicArea.objectAttributes &= ~TPMA_OBJECT_DECRYPT;
1120 inPublic.publicArea.objectAttributes &= ~TPMA_OBJECT_SENSITIVEDATAORIGIN;
1121 CopySizedByteBuffer((TPM2B *)&inPublic.publicArea.authPolicy, (TPM2B *)policyDigest);
1122 inPublic.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM2_ALG_NULL;
1123 inPublic.publicArea.unique.keyedHash.size = 0;
1124
1125 outPublic.size = 0;
1126 creationData.size = 0;
1127 INIT_SIMPLE_TPM2B_SIZE( outPrivate );
1128 INIT_SIMPLE_TPM2B_SIZE( creationHash );
1129 rval = Tss2_Sys_Create( sysContext, srkHandle, &cmdAuthArray,
1130 &inSensitive, &inPublic, &outsideInfo, &creationPcr,
1131 &outPrivate, &outPublic, &creationData, &creationHash,
1132 &creationTicket, 0 );
1133 CheckPassed( rval );
1134
1135 /* Now we need to load the object. */
1136 INIT_SIMPLE_TPM2B_SIZE( blobName );
1137 rval = Tss2_Sys_Load( sysContext, srkHandle, &cmdAuthArray, &outPrivate, &outPublic, &blobHandle, &blobName, 0 );
1138 CheckPassed( rval );
1139
1140 return rval;
1141 }
1142
PasswordUnseal(TSS2_SYS_CONTEXT * sysContext,SESSION * policySession)1143 static TSS2_RC PasswordUnseal( TSS2_SYS_CONTEXT *sysContext, SESSION *policySession )
1144 {
1145 TSS2_RC rval = TPM2_RC_SUCCESS;
1146 TPM2B_SENSITIVE_DATA outData;
1147 TSS2L_SYS_AUTH_COMMAND cmdAuthArray = { .count = 1, .auths = {{
1148 .sessionHandle = policySession->sessionHandle,
1149 .sessionAttributes = TPMA_SESSION_CONTINUESESSION,
1150 .nonce = {.size = 0},
1151 .hmac = {.size = 0}}}};
1152
1153 /*
1154 * Now try to unseal the blob without setting the password.
1155 * This test should fail.
1156 */
1157 INIT_SIMPLE_TPM2B_SIZE( outData );
1158 rval = Tss2_Sys_Unseal( sysContext, blobHandle, &cmdAuthArray, &outData, 0 );
1159 CheckFailed( rval, TPM2_RC_S + TPM2_RC_1 + TPM2_RC_AUTH_FAIL );
1160
1161 /* Clear DA lockout. */
1162 TestDictionaryAttackLockReset();
1163
1164 /*
1165 * Now try to unseal the blob after setting the password.
1166 * This test should pass.
1167 */
1168 INIT_SIMPLE_TPM2B_SIZE( outData );
1169 cmdAuthArray.auths[0].hmac.size = sizeof( passwordPCRTestPassword );
1170 memcpy( &cmdAuthArray.auths[0].hmac.buffer, passwordPCRTestPassword, sizeof( passwordPCRTestPassword ) );
1171 rval = Tss2_Sys_Unseal( sysContext, blobHandle, &cmdAuthArray, &outData, 0 );
1172 CheckPassed( rval );
1173
1174 /* Add test to make sure we unsealed correctly. */
1175
1176 /*
1177 * Now we'll want to flush the data blob and remove it
1178 * from resource manager tables.
1179 */
1180 rval = Tss2_Sys_FlushContext( sysContext, blobHandle );
1181 CheckPassed( rval );
1182
1183 return rval;
1184 }
1185
1186 POLICY_TEST_SETUP policyTestSetups[] =
1187 {
1188 /*
1189 * NOTE: Since locality is a fairly simple command and we
1190 * can guarantee its correctness, we don't need a trial
1191 * session for this. buildPolicyFn pointer can be 0 in
1192 * this case.
1193 */
1194 { "LOCALITY", 0, CreateNVIndex, TestLocality },
1195 { "PASSWORD", BuildPasswordPolicy, CreateDataBlob, PasswordUnseal },
1196 };
1197
TestPolicy()1198 static void TestPolicy()
1199 {
1200 UINT32 rval;
1201 unsigned int i;
1202 SESSION *policySession = 0;
1203
1204 LOG_INFO("POLICY TESTS:" );
1205
1206 for( i = 0; i < ( sizeof( policyTestSetups ) / sizeof( POLICY_TEST_SETUP ) ); i++ )
1207 {
1208 TPM2B_DIGEST policyDigest;
1209
1210 policyDigest.size = 0;
1211
1212 rval = TPM2_RC_SUCCESS;
1213
1214 LOG_INFO("Policy Test: %s", policyTestSetups[i].name );
1215
1216 /* Create trial policy session and run policy commands, in order to create policyDigest. */
1217 if( policyTestSetups[i].buildPolicyFn != 0)
1218 {
1219 rval = BuildPolicy( sysContext, &policySession, policyTestSetups[i].buildPolicyFn, &policyDigest, true );
1220 CheckPassed( rval );
1221 LOGBLOB_DEBUG(&(policyDigest.buffer[0]), policyDigest.size, "Built policy digest:");
1222 }
1223
1224 /* Create entity that will use that policyDigest as authPolicy. */
1225 if( policyTestSetups[i].createObjectFn != 0 )
1226 {
1227 LOGBLOB_DEBUG(&(policyDigest.buffer[0]), policyDigest.size,
1228 "Policy digest used to create object:");
1229
1230 rval = ( *policyTestSetups[i].createObjectFn )( sysContext, &policySession, &policyDigest);
1231 CheckPassed( rval );
1232 }
1233
1234 /*
1235 * Create real policy session and run policy commands; after this
1236 * we're ready to authorize actions on the entity.
1237 */
1238 if( policyTestSetups[i].buildPolicyFn != 0)
1239 {
1240 rval = BuildPolicy( sysContext, &policySession, policyTestSetups[i].buildPolicyFn, &policyDigest, false );
1241 CheckPassed( rval );
1242 LOGBLOB_DEBUG(&(policyDigest.buffer[0]), policyDigest.size,
1243 "Command policy digest: ");
1244 }
1245
1246 if( policySession )
1247 {
1248 /* Now do tests by authorizing actions on the entity. */
1249 rval = ( *policyTestSetups[i].testPolicyFn)( sysContext, policySession );
1250 CheckPassed( rval );
1251
1252 /* Need to flush the session here. */
1253 rval = Tss2_Sys_FlushContext( sysContext, policySession->sessionHandle );
1254 CheckPassed( rval );
1255
1256 /* And remove the session from test app session table. */
1257 end_auth_session( policySession );
1258 }
1259 else
1260 {
1261 CheckFailed( rval, 0xffffffff );
1262 }
1263 }
1264 }
1265
1266 #define MAX_TEST_SEQUENCES 10
TestHash()1267 static void TestHash()
1268 {
1269 UINT32 rval;
1270 TPM2B_AUTH auth;
1271 TPMI_DH_OBJECT sequenceHandle[MAX_TEST_SEQUENCES];
1272 TSS2L_SYS_AUTH_COMMAND sessionsData;
1273 TPM2B_MAX_BUFFER dataToHash;
1274 TPM2B_DIGEST result;
1275 TPMT_TK_HASHCHECK validation;
1276 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
1277 UINT8 memoryToHash[] =
1278 {
1279 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1280 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1281 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1282 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1283 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1284 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1285 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1286 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1287 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1288 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1289 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1290 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1291 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1292 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1293 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1294 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1295 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1296 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1297 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1298 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1299 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1300 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1301 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1302 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1303 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1304 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1305 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1306 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1307 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1308 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1309 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1310 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1311 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1312 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1313 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1314 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1315 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1316 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1317 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1318 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1319 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1320 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1321 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1322 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1323 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1324 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1325 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1326 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1327 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1328 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1329 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1330 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1331 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1332 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1333 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1334 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1335 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1336 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1337 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1338 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1339 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1340 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1341 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1342 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1343 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
1344 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0,
1345 0xde, 0xad, 0xbe, 0xef };
1346
1347 UINT8 goodHashValue[] =
1348 { 0xB3, 0xFD, 0x6A, 0xD2, 0x9F, 0xD0, 0x13, 0x52, 0xBA, 0xFC,
1349 0x8B, 0x22, 0xC9, 0x6D, 0x88, 0x42, 0xA3, 0x3C, 0xB0, 0xC9 };
1350
1351 LOG_INFO("HASH TESTS:" );
1352
1353 auth.size = 2;
1354 auth.buffer[0] = 0;
1355 auth.buffer[1] = 0xff;
1356 rval = Tss2_Sys_HashSequenceStart ( sysContext, 0, &auth, TPM2_ALG_SHA1, &sequenceHandle[0], 0 );
1357 CheckPassed( rval );
1358
1359 sessionsData.auths[0].sessionHandle = TPM2_RS_PW;
1360 sessionsData.auths[0].nonce.size = 0;
1361 sessionsData.auths[0].hmac = auth;
1362 sessionsData.auths[0].sessionAttributes = 0;
1363 sessionsData.count = 1;
1364
1365 dataToHash.size = TPM2_MAX_DIGEST_BUFFER;
1366 memcpy( &dataToHash.buffer[0], &memoryToHash[0], dataToHash.size );
1367
1368 rval = Tss2_Sys_SequenceUpdate ( sysContext, sequenceHandle[0], &sessionsData, &dataToHash, &sessionsDataOut );
1369 CheckPassed( rval );
1370 dataToHash.size = sizeof( memoryToHash ) - TPM2_MAX_DIGEST_BUFFER;
1371 memcpy( &dataToHash.buffer[0], &memoryToHash[TPM2_MAX_DIGEST_BUFFER], dataToHash.size );
1372 INIT_SIMPLE_TPM2B_SIZE( result );
1373 rval = Tss2_Sys_SequenceComplete ( sysContext, sequenceHandle[0], &sessionsData, &dataToHash,
1374 TPM2_RH_PLATFORM, &result, &validation, &sessionsDataOut );
1375 CheckPassed( rval );
1376
1377 /* Test the resulting hash. */
1378 if (memcmp(result.buffer, goodHashValue, result.size)) {
1379 LOG_ERROR("ERROR!! resulting hash is incorrect." );
1380 Cleanup();
1381 }
1382 }
1383
TestQuote()1384 static void TestQuote()
1385 {
1386 UINT32 rval;
1387 TPM2B_DATA qualifyingData;
1388 UINT8 qualDataString[] = { 0x00, 0xff, 0x55, 0xaa };
1389 TPMT_SIG_SCHEME inScheme;
1390 TPML_PCR_SELECTION pcrSelection;
1391 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
1392 TPM2B_ATTEST quoted;
1393 TPMT_SIGNATURE signature;
1394 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1,
1395 .auths = {{
1396 .sessionHandle = TPM2_RS_PW,
1397 .sessionAttributes = 0,
1398 .nonce = { .size = 0 },
1399 .hmac = { .size = 0, .buffer={0x00} },
1400 }},
1401 };
1402 TPM2_HANDLE handle, handle_parent;
1403
1404 LOG_INFO("QUOTE CONTROL TESTS:" );
1405
1406 qualifyingData.size = sizeof( qualDataString );
1407 memcpy( &( qualifyingData.buffer[0] ), qualDataString, sizeof( qualDataString ) );
1408
1409 inScheme.scheme = TPM2_ALG_NULL;
1410
1411 pcrSelection.count = 1;
1412 pcrSelection.pcrSelections[0].hash = TPM2_ALG_SHA256;
1413 pcrSelection.pcrSelections[0].sizeofSelect = 3;
1414
1415 /* Clear out PCR select bit field */
1416 pcrSelection.pcrSelections[0].pcrSelect[0] = 0;
1417 pcrSelection.pcrSelections[0].pcrSelect[1] = 0;
1418 pcrSelection.pcrSelections[0].pcrSelect[2] = 0;
1419
1420 /* Now set the PCR you want */
1421 pcrSelection.pcrSelections[0].pcrSelect[( PCR_17/8 )] = ( 1 << ( PCR_18 % 8) );
1422
1423 rval = create_primary_rsa_2048_aes_128_cfb(sysContext, &handle_parent);
1424 CheckPassed( rval );
1425
1426 rval = create_keyedhash_key (sysContext, handle_parent, &handle);
1427 CheckPassed( rval );
1428
1429 /* Test with wrong type of key. */
1430 INIT_SIMPLE_TPM2B_SIZE( quoted );
1431 rval = Tss2_Sys_Quote ( sysContext, handle, &sessionsData, &qualifyingData, &inScheme,
1432 &pcrSelection, "ed, &signature, &sessionsDataOut );
1433 CheckPassed( rval );
1434
1435 rval = Tss2_Sys_FlushContext(sysContext, handle);
1436 CheckPassed( rval );
1437
1438 rval = Tss2_Sys_FlushContext(sysContext, handle_parent);
1439 CheckPassed( rval );
1440 }
1441
1442 TSS2L_SYS_AUTH_COMMAND nullSessionsData = { 1, { 0 } };
1443 TSS2L_SYS_AUTH_RESPONSE nullSessionsDataOut = { 0, { 0 } };
1444 TPM2B_NONCE nullSessionNonce, nullSessionNonceOut;
1445 TPM2B_AUTH nullSessionHmac;
1446
TestPcrAllocate()1447 static void TestPcrAllocate()
1448 {
1449 UINT32 rval;
1450 TPML_PCR_SELECTION pcrSelection;
1451 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
1452 TPMI_YES_NO allocationSuccess;
1453 UINT32 maxPcr;
1454 UINT32 sizeNeeded;
1455 UINT32 sizeAvailable;
1456
1457 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths= {{
1458 .sessionHandle = TPM2_RS_PW,
1459 .sessionAttributes = 0,
1460 .nonce={.size=0},
1461 .hmac={.size=0}}}};
1462
1463 LOG_INFO("PCR ALLOCATE TEST :" );
1464
1465 pcrSelection.count = 0;
1466
1467 rval = Tss2_Sys_PCR_Allocate( sysContext, TPM2_RH_PLATFORM, &sessionsData, &pcrSelection,
1468 &allocationSuccess, &maxPcr, &sizeNeeded, &sizeAvailable, &sessionsDataOut);
1469 CheckPassed( rval );
1470
1471 pcrSelection.count = 3;
1472 pcrSelection.pcrSelections[0].hash = TPM2_ALG_SHA256;
1473 CLEAR_PCR_SELECT_BITS( pcrSelection.pcrSelections[0] );
1474 SET_PCR_SELECT_SIZE( pcrSelection.pcrSelections[0], 3 );
1475 SET_PCR_SELECT_BIT( pcrSelection.pcrSelections[0], PCR_5 );
1476 SET_PCR_SELECT_BIT( pcrSelection.pcrSelections[0], PCR_7 );
1477 pcrSelection.pcrSelections[1].hash = TPM2_ALG_SHA384;
1478 CLEAR_PCR_SELECT_BITS( pcrSelection.pcrSelections[1] );
1479 SET_PCR_SELECT_SIZE( pcrSelection.pcrSelections[1], 3 );
1480 SET_PCR_SELECT_BIT( pcrSelection.pcrSelections[1], PCR_5 );
1481 SET_PCR_SELECT_BIT( pcrSelection.pcrSelections[1], PCR_8 );
1482 pcrSelection.pcrSelections[2].hash = TPM2_ALG_SHA256;
1483 CLEAR_PCR_SELECT_BITS( pcrSelection.pcrSelections[2] );
1484 SET_PCR_SELECT_SIZE( pcrSelection.pcrSelections[2], 3 );
1485 SET_PCR_SELECT_BIT( pcrSelection.pcrSelections[2], PCR_6 );
1486
1487 rval = Tss2_Sys_PCR_Allocate( sysContext, TPM2_RH_PLATFORM, &sessionsData, &pcrSelection,
1488 &allocationSuccess, &maxPcr, &sizeNeeded, &sizeAvailable, &sessionsDataOut);
1489 CheckPassed( rval );
1490 }
1491
TestUnseal()1492 static void TestUnseal()
1493 {
1494 UINT32 rval;
1495 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
1496 TPM2B_SENSITIVE_CREATE inSensitive;
1497 TPML_PCR_SELECTION creationPCR;
1498 TPM2B_DATA outsideInfo;
1499 TPM2B_PUBLIC inPublic;
1500 TPM2_HANDLE loadedObjectHandle, handle_parent;
1501
1502 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1,
1503 .auths= {{
1504 .sessionHandle = TPM2_RS_PW,
1505 .sessionAttributes = 0,
1506 .nonce={.size=0},
1507 .hmac={.size=0, .buffer={0x00}}
1508 }},
1509 };
1510
1511 TPM2B_PRIVATE outPrivate;
1512 TPM2B_PUBLIC outPublic;
1513 TPM2B_CREATION_DATA creationData;
1514 TPM2B_DIGEST creationHash;
1515 TPMT_TK_CREATION creationTicket;
1516 TPM2B_NAME name;
1517 TPM2B_SENSITIVE_DATA outData;
1518
1519
1520 const char authStr[] = "test";
1521 const char sensitiveData[] = "this is sensitive";
1522
1523 LOG_INFO("UNSEAL TEST :" );
1524
1525 inSensitive.size = 0;
1526 inSensitive.sensitive.userAuth.size = sizeof( authStr ) - 1;
1527 memcpy( &( inSensitive.sensitive.userAuth.buffer[0] ), authStr, sizeof( authStr ) - 1 );
1528 inSensitive.sensitive.data.size = sizeof( sensitiveData ) - 1;
1529 memcpy( &( inSensitive.sensitive.data.buffer[0] ), sensitiveData, sizeof( sensitiveData ) - 1 );
1530
1531 inPublic.size = 0;
1532 inPublic.publicArea.authPolicy.size = 0;
1533
1534 inPublic.publicArea.unique.keyedHash.size = 0;
1535
1536 outsideInfo.size = 0;
1537 creationPCR.count = 0;
1538
1539 inPublic.publicArea.type = TPM2_ALG_KEYEDHASH;
1540 inPublic.publicArea.nameAlg = TPM2_ALG_SHA1;
1541
1542 *(UINT32 *)&( inPublic.publicArea.objectAttributes) = 0;
1543 inPublic.publicArea.objectAttributes |= TPMA_OBJECT_USERWITHAUTH;
1544
1545 inPublic.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM2_ALG_NULL;
1546
1547 inPublic.publicArea.unique.keyedHash.size = 0;
1548
1549 outsideInfo.size = 0;
1550
1551 outPublic.size = 0;
1552 creationData.size = 0;
1553
1554 rval = create_primary_rsa_2048_aes_128_cfb(sysContext, &handle_parent);
1555 CheckPassed( rval );
1556
1557 INIT_SIMPLE_TPM2B_SIZE( creationHash );
1558 INIT_SIMPLE_TPM2B_SIZE( outPrivate );
1559 rval = Tss2_Sys_Create( sysContext, handle_parent, &sessionsData, &inSensitive, &inPublic,
1560 &outsideInfo, &creationPCR,
1561 &outPrivate, &outPublic, &creationData,
1562 &creationHash, &creationTicket, &sessionsDataOut );
1563 CheckPassed( rval );
1564
1565 INIT_SIMPLE_TPM2B_SIZE( name );
1566 rval = Tss2_Sys_LoadExternal ( sysContext, 0, 0, &outPublic,
1567 TPM2_RH_PLATFORM, &loadedObjectHandle, &name, 0 );
1568 CheckPassed( rval );
1569
1570 rval = Tss2_Sys_FlushContext( sysContext, loadedObjectHandle );
1571 CheckPassed( rval );
1572
1573 INIT_SIMPLE_TPM2B_SIZE( name );
1574 rval = Tss2_Sys_Load (sysContext, handle_parent, &sessionsData, &outPrivate, &outPublic,
1575 &loadedObjectHandle, &name, &sessionsDataOut);
1576 CheckPassed(rval);
1577
1578 sessionsData.auths[0].hmac.size = sizeof( authStr ) - 1;
1579 memcpy( &( sessionsData.auths[0].hmac.buffer[0] ), authStr, sizeof( authStr ) - 1 );
1580
1581 INIT_SIMPLE_TPM2B_SIZE( outData );
1582 rval = Tss2_Sys_Unseal( sysContext, loadedObjectHandle, &sessionsData, &outData, &sessionsDataOut );
1583 CheckPassed(rval);
1584
1585 rval = Tss2_Sys_FlushContext(sysContext, loadedObjectHandle);
1586 CheckPassed(rval);
1587
1588 rval = Tss2_Sys_FlushContext(sysContext, handle_parent);
1589 CheckPassed(rval);
1590 }
1591
1592
CreatePasswordTestNV(TPMI_RH_NV_INDEX nvIndex,char * password)1593 static void CreatePasswordTestNV( TPMI_RH_NV_INDEX nvIndex, char * password )
1594 {
1595 UINT32 rval;
1596 int i;
1597 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
1598 TPM2B_NV_PUBLIC publicInfo;
1599 TPM2B_AUTH nvAuth;
1600
1601
1602 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths= {{
1603 .sessionHandle = TPM2_RS_PW,
1604 .sessionAttributes = 0,
1605 .nonce={.size=0},
1606 .hmac={.size=0}}}};
1607
1608 nvAuth.size = strlen( password );
1609 for( i = 0; i < nvAuth.size; i++ ) {
1610 nvAuth.buffer[i] = password[i];
1611 }
1612
1613 publicInfo.size = 0;
1614 publicInfo.nvPublic.nvIndex = nvIndex;
1615 publicInfo.nvPublic.nameAlg = TPM2_ALG_SHA1;
1616
1617 /* First zero out attributes. */
1618 *(UINT32 *)&( publicInfo.nvPublic.attributes ) = 0;
1619
1620 /* Now set the attributes. */
1621 publicInfo.nvPublic.attributes |= TPMA_NV_AUTHREAD;
1622 publicInfo.nvPublic.attributes |= TPMA_NV_AUTHWRITE;
1623 publicInfo.nvPublic.attributes |= TPMA_NV_PLATFORMCREATE;
1624 publicInfo.nvPublic.attributes |= TPMA_NV_ORDERLY;
1625 publicInfo.nvPublic.authPolicy.size = 0;
1626 publicInfo.nvPublic.dataSize = 32;
1627
1628 rval = Tss2_Sys_NV_DefineSpace( sysContext, TPM2_RH_PLATFORM,
1629 &sessionsData, &nvAuth, &publicInfo, &sessionsDataOut );
1630 CheckPassed( rval );
1631 }
1632
PasswordTest()1633 static void PasswordTest()
1634 {
1635 char *password = "test password";
1636 UINT32 rval;
1637 int i;
1638
1639 /* Authorization array for response. */
1640 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
1641
1642 /* Authorization array for command (only has one auth structure). */
1643 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths= {{
1644 .sessionHandle = TPM2_RS_PW,
1645 .sessionAttributes = 0,
1646 .nonce={.size=0},
1647 .hmac={.size=0}}}};
1648
1649 TPM2B_MAX_NV_BUFFER nvWriteData;
1650
1651 LOG_INFO("PASSWORD TESTS:" );
1652
1653 /*
1654 * Create an NV index that will use password authorizations.
1655 * The password will be "test password".
1656 */
1657 CreatePasswordTestNV( TPM20_INDEX_PASSWORD_TEST, password );
1658
1659 /* Init password (HMAC field in authorization structure). */
1660 sessionsData.auths[0].hmac.size = strlen( password );
1661 memcpy( &( sessionsData.auths[0].hmac.buffer[0] ),
1662 &( password[0] ), sessionsData.auths[0].hmac.size );
1663
1664 /* Initialize write data. */
1665 nvWriteData.size = 4;
1666 for( i = 0; i < nvWriteData.size; i++ )
1667 nvWriteData.buffer[i] = 0xff - i;
1668
1669 /*
1670 * Attempt write with the correct password.
1671 * It should pass.
1672 */
1673 do {
1674 rval = Tss2_Sys_NV_Write( sysContext,
1675 TPM20_INDEX_PASSWORD_TEST,
1676 TPM20_INDEX_PASSWORD_TEST,
1677 &sessionsData, &nvWriteData, 0,
1678 &sessionsDataOut );
1679 } while (rval == TPM2_RC_RETRY);
1680 /*
1681 * Check that the function passed as
1682 * expected. Otherwise, exit.
1683 */
1684 CheckPassed( rval );
1685
1686 /* Alter the password so it's incorrect. */
1687 sessionsData.auths[0].hmac.buffer[4] = 0xff;
1688 rval = Tss2_Sys_NV_Write( sysContext,
1689 TPM20_INDEX_PASSWORD_TEST,
1690 TPM20_INDEX_PASSWORD_TEST,
1691 &sessionsData, &nvWriteData, 0,
1692 &sessionsDataOut );
1693 /*
1694 * Check that the function failed as expected,
1695 * since password was incorrect. If wrong
1696 * response code received, exit.
1697 */
1698 CheckFailed( rval,
1699 TPM2_RC_S + TPM2_RC_1 + TPM2_RC_AUTH_FAIL );
1700
1701 /*
1702 * Change hmac to null one, since null auth is
1703 * used to undefine the index.
1704 */
1705 sessionsData.auths[0].hmac.size = 0;
1706
1707 /* Now undefine the index. */
1708 rval = Tss2_Sys_NV_UndefineSpace( sysContext, TPM2_RH_PLATFORM,
1709 TPM20_INDEX_PASSWORD_TEST, &sessionsData, 0 );
1710 CheckPassed( rval );
1711 }
1712
GetSetDecryptParamTests()1713 static void GetSetDecryptParamTests()
1714 {
1715 TPM2B_MAX_NV_BUFFER nvWriteData = {4, { 0xde, 0xad, 0xbe, 0xef,} };
1716 TPM2B_MAX_NV_BUFFER nvWriteData1 = {4, { 0x01, 0x01, 0x02, 0x03,} };
1717 const uint8_t *decryptParamBuffer;
1718 size_t decryptParamSize;
1719 size_t cpBufferUsedSize1, cpBufferUsedSize2;
1720 const uint8_t *cpBuffer1, *cpBuffer2;
1721 TSS2_RC rval;
1722 int i;
1723 TSS2_SYS_CONTEXT *decryptParamTestSysContext;
1724
1725 LOG_INFO("GET/SET DECRYPT PARAM TESTS:" );
1726
1727 /* Create two sysContext structures. */
1728 decryptParamTestSysContext = sapi_init_from_tcti_ctx(resMgrTctiContext);
1729 if (decryptParamTestSysContext == NULL)
1730 InitSysContextFailure();
1731
1732 /* Test for bad sequence: Tss2_Sys_GetDecryptParam */
1733 rval = Tss2_Sys_GetDecryptParam( decryptParamTestSysContext, &decryptParamSize, &decryptParamBuffer );
1734 CheckFailed( rval, TSS2_SYS_RC_BAD_SEQUENCE );
1735
1736 /* Test for bad sequence: Tss2_Sys_SetDecryptParam */
1737 rval = Tss2_Sys_SetDecryptParam( decryptParamTestSysContext, 4, &( nvWriteData.buffer[0] ) );
1738 CheckFailed( rval, TSS2_SYS_RC_BAD_SEQUENCE );
1739
1740 /*
1741 * NOTE: Two tests for BAD_SEQUENCE for GetDecryptParam and
1742 * SetDecryptParam after ExecuteAsync are in the GetSetEncryptParamTests
1743 * function, just because it's easier to do this way.
1744 */
1745
1746 /* Do Prepare. */
1747 rval = Tss2_Sys_NV_Write_Prepare( decryptParamTestSysContext, TPM20_INDEX_PASSWORD_TEST,
1748 TPM20_INDEX_PASSWORD_TEST, &nvWriteData1, 0x55aa );
1749 CheckPassed( rval );
1750
1751 /* Test for bad reference: Tss2_Sys_GetDecryptParam */
1752 rval = Tss2_Sys_GetDecryptParam( 0, &decryptParamSize, &decryptParamBuffer );
1753 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE );
1754
1755 rval = Tss2_Sys_GetDecryptParam( decryptParamTestSysContext, 0, &decryptParamBuffer );
1756 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE );
1757
1758 rval = Tss2_Sys_GetDecryptParam( decryptParamTestSysContext, &decryptParamSize, 0 );
1759 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE );
1760
1761
1762 /* Test for bad reference: Tss2_Sys_SetDecryptParam */
1763 rval = Tss2_Sys_SetDecryptParam( decryptParamTestSysContext, 4, 0 );
1764 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE );
1765
1766 rval = Tss2_Sys_SetDecryptParam( 0, 4, 0 );
1767 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE );
1768
1769
1770 /* Test for bad size. */
1771 rval = Tss2_Sys_SetDecryptParam( decryptParamTestSysContext, 5, &( nvWriteData.buffer[0] ) );
1772 CheckFailed( rval, TSS2_SYS_RC_BAD_SIZE );
1773
1774 rval = Tss2_Sys_SetDecryptParam( decryptParamTestSysContext, 3, &( nvWriteData.buffer[0] ) );
1775 CheckFailed( rval, TSS2_SYS_RC_BAD_SIZE );
1776
1777 /* Test for good size. */
1778 rval = Tss2_Sys_SetDecryptParam( decryptParamTestSysContext, 4, &( nvWriteData.buffer[0] ) );
1779 CheckPassed( rval );
1780
1781 /* Make sure that the set operation really did the right thing. */
1782 rval = Tss2_Sys_GetDecryptParam( decryptParamTestSysContext, &decryptParamSize, &decryptParamBuffer );
1783 CheckPassed( rval );
1784 for( i = 0; i < 4; i++ )
1785 {
1786 if( decryptParamBuffer[i] != nvWriteData.buffer[i] )
1787 {
1788 LOG_ERROR("ERROR!! decryptParamBuffer[%d] s/b: %2.2x, was: %2.2x", i, nvWriteData.buffer[i], decryptParamBuffer[i] );
1789 Cleanup();
1790 }
1791 }
1792
1793 rval = Tss2_Sys_GetCpBuffer( decryptParamTestSysContext, &cpBufferUsedSize1, &cpBuffer1 );
1794 CheckPassed( rval );
1795
1796 LOGBLOB_DEBUG((UINT8 *)cpBuffer1, cpBufferUsedSize1, "cpBuffer = ");
1797
1798 /* Test for no decrypt param. */
1799 rval = Tss2_Sys_NV_Read_Prepare( decryptParamTestSysContext, TPM20_INDEX_PASSWORD_TEST, TPM20_INDEX_PASSWORD_TEST, sizeof( nvWriteData ) - 2, 0 );
1800 CheckPassed( rval );
1801
1802 rval = Tss2_Sys_GetDecryptParam( decryptParamTestSysContext, &decryptParamSize, &decryptParamBuffer );
1803 CheckFailed( rval, TSS2_SYS_RC_NO_DECRYPT_PARAM );
1804
1805 rval = Tss2_Sys_SetDecryptParam( decryptParamTestSysContext, 4, &( nvWriteData.buffer[0] ) );
1806 CheckFailed( rval, TSS2_SYS_RC_NO_DECRYPT_PARAM );
1807
1808 /* Null decrypt param. */
1809 rval = Tss2_Sys_NV_Write_Prepare( decryptParamTestSysContext, TPM20_INDEX_PASSWORD_TEST,
1810 TPM20_INDEX_PASSWORD_TEST, 0, 0x55aa );
1811 CheckPassed( rval );
1812
1813 rval = Tss2_Sys_GetDecryptParam( decryptParamTestSysContext, &decryptParamSize, &decryptParamBuffer );
1814 CheckPassed( rval );
1815
1816 /* Check that size == 0. */
1817 if( decryptParamSize != 0 )
1818 {
1819 LOG_ERROR("ERROR!! decryptParamSize s/b: 0, was: %u", (unsigned int)decryptParamSize );
1820 Cleanup();
1821 }
1822
1823 /* Test for insufficient size. */
1824 /* Create a buffer that is too large */
1825 size_t testBufferSize = TPM2_MAX_COMMAND_SIZE -
1826 BE_TO_HOST_32(((TPM20_Header_In *)(((_TSS2_SYS_CONTEXT_BLOB *)decryptParamTestSysContext)->cmdBuffer))->commandSize) + 1;
1827 UINT8 testBuffer [testBufferSize];
1828 memset(testBuffer, 0, testBufferSize);
1829 memcpy(testBuffer, nvWriteData.buffer, nvWriteData.size);
1830
1831 rval = Tss2_Sys_GetCpBuffer(decryptParamTestSysContext, &cpBufferUsedSize2, &cpBuffer2);
1832 CheckPassed(rval);
1833 rval = Tss2_Sys_SetDecryptParam(decryptParamTestSysContext, testBufferSize,
1834 testBuffer);
1835 CheckFailed(rval, TSS2_SYS_RC_INSUFFICIENT_CONTEXT);
1836
1837 /*
1838 * Test that one less will work.
1839 * This tests that we're checking the correct corner case.
1840 */
1841 testBufferSize -= 1;
1842 rval = Tss2_Sys_SetDecryptParam(decryptParamTestSysContext, testBufferSize,
1843 testBuffer);
1844 CheckPassed(rval);
1845
1846 rval = Tss2_Sys_NV_Write_Prepare( decryptParamTestSysContext, TPM20_INDEX_PASSWORD_TEST,
1847 TPM20_INDEX_PASSWORD_TEST, 0, 0x55aa );
1848 CheckPassed( rval );
1849
1850 rval = Tss2_Sys_GetDecryptParam( decryptParamTestSysContext, &decryptParamSize, &decryptParamBuffer );
1851 CheckPassed( rval );
1852
1853 rval = Tss2_Sys_SetDecryptParam( decryptParamTestSysContext, 4, &( nvWriteData.buffer[0] ) );
1854 CheckPassed( rval );
1855
1856 rval = Tss2_Sys_GetCpBuffer( decryptParamTestSysContext, &cpBufferUsedSize2, &cpBuffer2 );
1857 CheckPassed( rval );
1858
1859 LOGBLOB_INFO((UINT8 *)cpBuffer2, cpBufferUsedSize2, "cpBuffer = ");
1860
1861 if( cpBufferUsedSize1 != cpBufferUsedSize2 )
1862 {
1863 LOG_ERROR("ERROR!! cpBufferUsedSize1(%x) != cpBufferUsedSize2(%x)", (UINT32)cpBufferUsedSize1, (UINT32)cpBufferUsedSize2 );
1864 Cleanup();
1865 }
1866 for( i = 0; i < (int)cpBufferUsedSize1; i++ )
1867 {
1868 if( cpBuffer1[i] != cpBuffer2[i] )
1869 {
1870 LOG_ERROR("ERROR!! cpBufferUsedSize1[%d] s/b: %2.2x, was: %2.2x", i, cpBuffer1[i], cpBuffer2[i] );
1871 Cleanup();
1872 }
1873 }
1874
1875 /* Test case of zero sized decrypt param, another case of bad size. */
1876 nvWriteData1.size = 0;
1877 rval = Tss2_Sys_NV_Write_Prepare( decryptParamTestSysContext, TPM20_INDEX_PASSWORD_TEST,
1878 TPM20_INDEX_PASSWORD_TEST, &nvWriteData1, 0x55aa );
1879 CheckPassed( rval );
1880
1881 rval = Tss2_Sys_SetDecryptParam( decryptParamTestSysContext, 1, &( nvWriteData.buffer[0] ) );
1882 CheckFailed( rval, TSS2_SYS_RC_BAD_SIZE );
1883
1884 sapi_teardown(decryptParamTestSysContext);
1885 }
1886
SysFinalizeTests()1887 static void SysFinalizeTests()
1888 {
1889 LOG_INFO("SYS FINALIZE TESTS:" );
1890
1891 Tss2_Sys_Finalize( 0 );
1892
1893 /* Note: other cases tested by other tests. */
1894 }
1895
GetContextSizeTests()1896 static void GetContextSizeTests()
1897 {
1898 TSS2_RC rval = TSS2_RC_SUCCESS;
1899 TSS2_SYS_CONTEXT *testSysContext;
1900
1901 LOG_INFO("SYS GETCONTEXTSIZE TESTS:" );
1902
1903 testSysContext = sapi_init_from_tcti_ctx(resMgrTctiContext);
1904 if (testSysContext == NULL)
1905 InitSysContextFailure();
1906
1907 rval = Tss2_Sys_Startup(testSysContext, TPM2_SU_CLEAR);
1908 CheckPassed(rval);
1909
1910 rval = Tss2_Sys_GetTestResult_Prepare(testSysContext);
1911 CheckPassed(rval);
1912
1913 sapi_teardown(testSysContext);
1914 }
1915
GetTctiContextTests()1916 static void GetTctiContextTests()
1917 {
1918 TSS2_RC rval = TSS2_RC_SUCCESS;
1919 TSS2_SYS_CONTEXT *testSysContext;
1920 TSS2_TCTI_CONTEXT *tctiContext;
1921
1922 LOG_INFO("SYS GETTCTICONTEXT TESTS:" );
1923
1924 testSysContext = sapi_init_from_tcti_ctx(resMgrTctiContext);
1925 if (testSysContext == NULL)
1926 InitSysContextFailure();
1927
1928 rval = Tss2_Sys_GetTctiContext(testSysContext, 0);
1929 CheckFailed(rval, TSS2_SYS_RC_BAD_REFERENCE);
1930
1931 rval = Tss2_Sys_GetTctiContext(0, &tctiContext);
1932 CheckFailed(rval, TSS2_SYS_RC_BAD_REFERENCE);
1933
1934 sapi_teardown(testSysContext);
1935 }
1936
GetSetEncryptParamTests()1937 static void GetSetEncryptParamTests()
1938 {
1939 TPM2B_MAX_NV_BUFFER nvWriteData = {4, { 0xde, 0xad, 0xbe, 0xef,} };
1940 const uint8_t *encryptParamBuffer;
1941 const uint8_t encryptParamBuffer1[4] = { 01, 02, 03, 04 };
1942 size_t encryptParamSize;
1943 TSS2_RC rval;
1944 int i;
1945 TPM2B_DIGEST authPolicy;
1946 TPMA_NV nvAttributes;
1947 TPM2B_AUTH nvAuth;
1948
1949 TSS2L_SYS_AUTH_RESPONSE sessionsDataOut;
1950 TSS2L_SYS_AUTH_COMMAND sessionsData = { .count = 1, .auths= {{
1951 .sessionHandle = TPM2_RS_PW }}};
1952
1953 TPM2B_MAX_NV_BUFFER nvReadData;
1954 const uint8_t *cpBuffer;
1955 _TSS2_SYS_CONTEXT_BLOB *ctx = syscontext_cast(sysContext);
1956
1957 LOG_INFO("GET/SET ENCRYPT PARAM TESTS:" );
1958
1959 /* Do Prepare. */
1960 rval = Tss2_Sys_NV_Read_Prepare( sysContext, TPM20_INDEX_PASSWORD_TEST,
1961 TPM20_INDEX_PASSWORD_TEST, 0, 0 );
1962 CheckPassed( rval ); /* #1 */
1963
1964 resp_header_from_cxt(ctx)->tag = TPM2_ST_SESSIONS;
1965
1966 /* Test for bad sequence */
1967 rval = Tss2_Sys_GetEncryptParam( sysContext, &encryptParamSize, &encryptParamBuffer );
1968 CheckFailed( rval, TSS2_SYS_RC_BAD_SEQUENCE ); /* #2 */
1969
1970 rval = Tss2_Sys_SetEncryptParam( sysContext, 4, &( nvWriteData.buffer[0] ) );
1971 CheckFailed( rval, TSS2_SYS_RC_BAD_SEQUENCE ); /* #3 */
1972
1973 /* Create NV index */
1974
1975 /* Set empty policy and auth value. */
1976 authPolicy.size = 0;
1977 nvAuth.size = 0;
1978
1979 /* Now set the attributes. */
1980 *(UINT32 *)( (void *)&nvAttributes ) = 0;
1981 nvAttributes |= TPMA_NV_AUTHREAD;
1982 nvAttributes |= TPMA_NV_AUTHWRITE;
1983 nvAttributes |= TPMA_NV_PLATFORMCREATE;
1984
1985 rval = DefineNvIndex( sysContext, TPM2_RH_PLATFORM, &nvAuth, &authPolicy,
1986 TPM20_INDEX_PASSWORD_TEST, TPM2_ALG_SHA1, nvAttributes, 32 );
1987 CheckPassed( rval ); /* #4 */
1988
1989 /* Write the index. */
1990 retry:
1991 rval = Tss2_Sys_NV_Write_Prepare( sysContext, TPM20_INDEX_PASSWORD_TEST,
1992 TPM20_INDEX_PASSWORD_TEST, &nvWriteData, 0 );
1993 CheckPassed( rval ); /* #5 */
1994
1995 /* NOTE: add GetCpBuffer tests here, just because it's easier. */
1996 rval = Tss2_Sys_GetCpBuffer( 0, (size_t *)4, (const uint8_t **)4 );
1997 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE ); /* #6 */
1998
1999 rval = Tss2_Sys_GetCpBuffer( sysContext, (size_t *)0, (const uint8_t **)4 );
2000 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE ); /* #7 */
2001
2002 rval = Tss2_Sys_GetCpBuffer( sysContext, (size_t *)4, (const uint8_t **)0 );
2003 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE ); /* #8 */
2004
2005
2006 rval = Tss2_Sys_SetCmdAuths( sysContext, &sessionsData );
2007 CheckPassed( rval ); /* #9 */
2008
2009 rval = Tss2_Sys_ExecuteAsync( sysContext );
2010 CheckPassed( rval ); /* #10 */
2011
2012 /*
2013 * NOTE: Stick two tests for BAD_SEQUENCE for GetDecryptParam and
2014 * SetDecryptParam here, just because it's easier to do this way.
2015 */
2016 rval = Tss2_Sys_GetDecryptParam( sysContext, (size_t *)4, (const uint8_t **)4 );
2017 CheckFailed( rval, TSS2_SYS_RC_BAD_SEQUENCE ); /* #11 */
2018
2019 rval = Tss2_Sys_SetDecryptParam( sysContext, 10, (uint8_t *)4 );
2020 CheckFailed( rval, TSS2_SYS_RC_BAD_SEQUENCE ); /* #12 */
2021
2022 /*
2023 * NOTE: Stick test for BAD_SEQUENCE for GetCpBuffer here, just
2024 * because it's easier to do this way.
2025 */
2026 rval = Tss2_Sys_GetCpBuffer( sysContext, (size_t *)4, &cpBuffer );
2027 CheckFailed( rval, TSS2_SYS_RC_BAD_SEQUENCE ); /* #13 */
2028
2029 /*
2030 * Now finish the write command so that TPM isn't stuck trying
2031 * to send a response.
2032 */
2033 rval = Tss2_Sys_ExecuteFinish( sysContext, -1 );
2034 if (rval == TPM2_RC_RETRY) {
2035 LOG_INFO ("got TPM2_RC_RETRY, trying again");
2036 goto retry;
2037 }
2038 CheckPassed( rval ); /* #14 */
2039
2040 /* Test GetEncryptParam for no encrypt param case. */
2041 rval = Tss2_Sys_GetEncryptParam( sysContext, &encryptParamSize, &encryptParamBuffer );
2042 CheckFailed( rval, TSS2_SYS_RC_NO_ENCRYPT_PARAM ); /* #15 */
2043
2044 /* Test SetEncryptParam for no encrypt param case. */
2045 rval = Tss2_Sys_SetEncryptParam( sysContext, encryptParamSize, encryptParamBuffer1 );
2046 CheckFailed( rval, TSS2_SYS_RC_NO_ENCRYPT_PARAM ); /* #16 */
2047
2048 /* Now read it and do tests on get/set encrypt functions */
2049 rval = Tss2_Sys_NV_Read_Prepare( sysContext, TPM20_INDEX_PASSWORD_TEST, TPM20_INDEX_PASSWORD_TEST, 4, 0 );
2050 CheckPassed( rval ); /* #17 */
2051
2052 INIT_SIMPLE_TPM2B_SIZE( nvReadData );
2053 rval = Tss2_Sys_NV_Read( sysContext, TPM20_INDEX_PASSWORD_TEST,
2054 TPM20_INDEX_PASSWORD_TEST, &sessionsData, 4, 0, &nvReadData, &sessionsDataOut );
2055 CheckPassed( rval ); /* #18 */
2056
2057 rval = Tss2_Sys_GetEncryptParam( sysContext, &encryptParamSize, &encryptParamBuffer );
2058 CheckPassed( rval ); /* #19 */
2059
2060 /* Test case of encryptParamSize being too small. */
2061 encryptParamSize--;
2062 rval = Tss2_Sys_SetEncryptParam( sysContext, encryptParamSize, encryptParamBuffer1 );
2063 CheckFailed( rval, TSS2_SYS_RC_BAD_SIZE ); /* #20 */
2064 encryptParamSize += 2;
2065
2066 /* Size too large... */
2067 rval = Tss2_Sys_SetEncryptParam( sysContext, encryptParamSize, encryptParamBuffer1 );
2068 CheckFailed( rval, TSS2_SYS_RC_BAD_SIZE ); /* #21 */
2069
2070 encryptParamSize--;
2071 rval = Tss2_Sys_SetEncryptParam( sysContext, encryptParamSize, encryptParamBuffer1 );
2072 CheckPassed( rval ); /* #22 */
2073
2074 rval = Tss2_Sys_GetEncryptParam( sysContext, &encryptParamSize, &encryptParamBuffer );
2075 CheckPassed( rval ); /* #23 */
2076
2077 /* Test that encryptParamBuffer is the same as encryptParamBuffer1 */
2078 for( i = 0; i < 4; i++ )
2079 {
2080 if( encryptParamBuffer[i] != encryptParamBuffer1[i] )
2081 {
2082 LOG_ERROR("ERROR!! encryptParamBuffer[%d] s/b: %2.2x, was: %2.2x", i, encryptParamBuffer[i], encryptParamBuffer1[i] );
2083 Cleanup();
2084 }
2085 }
2086
2087 rval = Tss2_Sys_NV_UndefineSpace( sysContext, TPM2_RH_PLATFORM, TPM20_INDEX_PASSWORD_TEST, &sessionsData, 0 );
2088 CheckPassed( rval ); /* #24 */
2089
2090
2091 /* Test for bad reference */
2092 rval = Tss2_Sys_GetEncryptParam( 0, &encryptParamSize, &encryptParamBuffer );
2093 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE ); /* #25 */
2094
2095 rval = Tss2_Sys_GetEncryptParam( sysContext, 0, &encryptParamBuffer );
2096 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE ); /* #26 */
2097
2098 rval = Tss2_Sys_GetEncryptParam( sysContext, &encryptParamSize, 0 );
2099 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE ); /* #27 */
2100
2101 rval = Tss2_Sys_SetEncryptParam( sysContext, 4, 0 );
2102 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE ); /* #28 */
2103
2104 rval = Tss2_Sys_SetEncryptParam( 0, 4, encryptParamBuffer );
2105 CheckFailed( rval, TSS2_SYS_RC_BAD_REFERENCE ); /* #29 */
2106 }
2107
EcEphemeralTest()2108 static void EcEphemeralTest()
2109 {
2110 TSS2_RC rval = TSS2_RC_SUCCESS;
2111 TPM2B_ECC_POINT Q;
2112 UINT16 counter;
2113
2114 LOG_INFO("EC Ephemeral TESTS:" );
2115
2116 /* Test SAPI for case of Q size field not being set to 0. */
2117 INIT_SIMPLE_TPM2B_SIZE( Q );
2118 rval = Tss2_Sys_EC_Ephemeral( sysContext, 0, TPM2_ECC_BN_P256, &Q, &counter, 0 );
2119 CheckFailed( rval, TSS2_SYS_RC_BAD_VALUE );
2120
2121 Q.size = 0;
2122 rval = Tss2_Sys_EC_Ephemeral( sysContext, 0, TPM2_ECC_BN_P256, &Q, &counter, 0 );
2123 CheckPassed( rval );
2124 }
2125
2126 int
test_invoke(TSS2_SYS_CONTEXT * sapi_context)2127 test_invoke (TSS2_SYS_CONTEXT *sapi_context)
2128 {
2129 TSS2_RC rval = TSS2_RC_SUCCESS;
2130
2131 sysContext = sapi_context;
2132 rval = Tss2_Sys_GetTctiContext (sapi_context, &resMgrTctiContext);
2133 if (rval != TSS2_RC_SUCCESS) {
2134 printf ("Failed to get TCTI context from sapi_context: 0x%" PRIx32
2135 "\n", rval);
2136 return 1;
2137 }
2138
2139 nullSessionsData.auths[0].sessionHandle = TPM2_RS_PW;
2140 nullSessionsDataOut.count = 1;
2141 nullSessionsDataOut.auths[0].nonce = nullSessionNonceOut;
2142 nullSessionsDataOut.auths[0].hmac = nullSessionHmac;
2143 nullSessionNonceOut.size = 0;
2144 nullSessionNonce.size = 0;
2145
2146 rval = tcti_platform_command( resMgrTctiContext, MS_SIM_POWER_OFF );
2147 CheckPassed(rval);
2148
2149 rval = tcti_platform_command( resMgrTctiContext, MS_SIM_POWER_ON );
2150 CheckPassed(rval);
2151
2152 SysFinalizeTests();
2153
2154 GetContextSizeTests();
2155
2156 GetTctiContextTests();
2157
2158 GetSetDecryptParamTests();
2159
2160 TestTpmStartup();
2161
2162 /*
2163 * Run this directly after Startup tests to test for
2164 * a resource mgr corner case with SaveContext.
2165 */
2166 TestStartAuthSession();
2167 /* Clear DA lockout. */
2168 TestDictionaryAttackLockReset();
2169 TestDictionaryAttackLockReset();
2170 TestHierarchyControl();
2171 GetSetEncryptParamTests();
2172 TestTpmGetCapability();
2173 TestPcrExtend();
2174 TestHash();
2175 TestPolicy();
2176 TestTpmClear();
2177 TestChangeEps();
2178 TestChangePps();
2179 TestHierarchyChangeAuth();
2180 TestShutdown();
2181 TestNV();
2182 PasswordTest();
2183 TestQuote();
2184 TestDictionaryAttackLockReset();
2185 TestPcrAllocate();
2186 TestUnseal();
2187 EcEphemeralTest();
2188 return 0;
2189 }
2190