src/libpts/pts/pts.c

   1 /*
   2  * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "pts.h"
  17
  18 #include <debug.h>
  19 #include <crypto/hashers/hasher.h>
  20 #include <bio/bio_writer.h>
  21 #include <bio/bio_reader.h>
  22
  23 #include <trousers/tss.h>
  24 #include <trousers/trousers.h>
  25
  26 #include <sys/types.h>
  27 #include <sys/stat.h>
  28 #include <sys/utsname.h>
  29 #include <libgen.h>
  30 #include <unistd.h>
  31 #include <errno.h>
  32
  33 /**
  34  * Maximum number of PCR's of TPM, TPM Spec 1.2
  35  */
  36 #define PCR_MAX_NUM                             24
  37
  38 /**
  39  * Number of bytes that can be saved in a PCR of TPM, TPM Spec 1.2
  40  */
  41 #define PCR_LEN                                 20
  42
  43 typedef struct private_pts_t private_pts_t;
  44
  45 /**
  46  * Private data of a pts_t object.
  47  *
  48  */
  49 struct private_pts_t {
  50
  51         /**
  52          * Public pts_t interface.
  53          */
  54         pts_t public;
  55
  56         /**
  57          * PTS Protocol Capabilities
  58          */
  59         pts_proto_caps_flag_t proto_caps;
  60
  61         /**
  62          * PTS Measurement Algorithm
  63          */
  64         pts_meas_algorithms_t algorithm;
  65
  66         /**
  67          * DH Hash Algorithm
  68          */
  69         pts_meas_algorithms_t dh_hash_algorithm;
  70
  71         /**
  72          * PTS Diffie-Hellman Secret
  73          */
  74         diffie_hellman_t *dh;
  75
  76         /**
  77          * PTS Diffie-Hellman Initiator Nonce
  78          */
  79         chunk_t initiator_nonce;
  80
  81         /**
  82          * PTS Diffie-Hellman Responder Nonce
  83          */
  84         chunk_t responder_nonce;
  85
  86         /**
  87          * Secret assessment value to be used for TPM Quote as an external data
  88          */
  89         chunk_t secret;
  90
  91         /**
  92          * Platform and OS Info
  93          */
  94         char *platform_info;
  95
  96         /**
  97          * TRUE if IMC-PTS, FALSE if IMV-PTS
  98          */
  99         bool is_imc;
 100
 101         /**
 102          * Do we have an activated TPM
 103          */
 104         bool has_tpm;
 105
 106         /**
 107          * Contains a TPM_CAP_VERSION_INFO struct
 108          */
 109         chunk_t tpm_version_info;
 110
 111         /**
 112          * Contains TSS Blob structure for AIK
 113          */
 114         chunk_t aik_blob;
 115
 116         /**
 117          * Contains a Attestation Identity Key or Certificate
 118          */
 119         certificate_t *aik;
 120
 121         /**
 122          * Table of extended PCRs with corresponding values
 123          */
 124         u_char* pcrs[PCR_MAX_NUM];
 125
 126         /**
 127          * Length of PCR registers
 128          */
 129         size_t pcr_len;
 130
 131         /**
 132          * Number of extended PCR registers
 133          */
 134         u_int32_t pcr_count;
 135
 136         /**
 137          * Highest extended PCR register
 138          */
 139         u_int32_t pcr_max;
 140
 141         /**
 142          * Bitmap of extended PCR registers
 143          */
 144         u_int8_t pcr_select[PCR_MAX_NUM / 8];
 145
 146 };
 147
 148 METHOD(pts_t, get_proto_caps, pts_proto_caps_flag_t,
 149            private_pts_t *this)
 150 {
 151         return this->proto_caps;
 152 }
 153
 154 METHOD(pts_t, set_proto_caps, void,
 155         private_pts_t *this, pts_proto_caps_flag_t flags)
 156 {
 157         this->proto_caps = flags;
 158         DBG2(DBG_PTS, "supported PTS protocol capabilities: %s%s%s%s%s",
 159                  flags & PTS_PROTO_CAPS_C ? "C" : ".",
 160                  flags & PTS_PROTO_CAPS_V ? "V" : ".",
 161                  flags & PTS_PROTO_CAPS_D ? "D" : ".",
 162                  flags & PTS_PROTO_CAPS_T ? "T" : ".",
 163                  flags & PTS_PROTO_CAPS_X ? "X" : ".");
 164 }
 165
 166 METHOD(pts_t, get_meas_algorithm, pts_meas_algorithms_t,
 167         private_pts_t *this)
 168 {
 169         return this->algorithm;
 170 }
 171
 172 METHOD(pts_t, set_meas_algorithm, void,
 173         private_pts_t *this, pts_meas_algorithms_t algorithm)
 174 {
 175         hash_algorithm_t hash_alg;
 176
 177         hash_alg = pts_meas_algo_to_hash(algorithm);
 178         DBG2(DBG_PTS, "selected PTS measurement algorithm is %N",
 179                                    hash_algorithm_names, hash_alg);
 180         if (hash_alg != HASH_UNKNOWN)
 181         {
 182                 this->algorithm = algorithm;
 183         }
 184 }
 185
 186 METHOD(pts_t, get_dh_hash_algorithm, pts_meas_algorithms_t,
 187         private_pts_t *this)
 188 {
 189         return this->dh_hash_algorithm;
 190 }
 191
 192 METHOD(pts_t, set_dh_hash_algorithm, void,
 193         private_pts_t *this, pts_meas_algorithms_t algorithm)
 194 {
 195         hash_algorithm_t hash_alg;
 196
 197         hash_alg = pts_meas_algo_to_hash(algorithm);
 198         DBG2(DBG_PTS, "selected DH hash algorithm is %N",
 199                                    hash_algorithm_names, hash_alg);
 200         if (hash_alg != HASH_UNKNOWN)
 201         {
 202                 this->dh_hash_algorithm = algorithm;
 203         }
 204 }
 205
 206
 207 METHOD(pts_t, create_dh_nonce, bool,
 208         private_pts_t *this, pts_dh_group_t group, int nonce_len)
 209 {
 210         diffie_hellman_group_t dh_group;
 211         chunk_t *nonce;
 212         rng_t *rng;
 213
 214         dh_group = pts_dh_group_to_ike(group);
 215         DBG2(DBG_PTS, "selected PTS DH group is %N",
 216                                    diffie_hellman_group_names, dh_group);
 217         DESTROY_IF(this->dh);
 218         this->dh = lib->crypto->create_dh(lib->crypto, dh_group);
 219
 220         rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
 221         if (!rng)
 222         {
 223                 DBG1(DBG_PTS, "no rng available");
 224                 return FALSE;
 225         }
 226         DBG2(DBG_PTS, "nonce length is %d", nonce_len);
 227         nonce = this->is_imc ? &this->responder_nonce : &this->initiator_nonce;
 228         chunk_free(nonce);
 229         if (!rng->allocate_bytes(rng, nonce_len, nonce))
 230         {
 231                 DBG1(DBG_PTS, "failed to allocate nonce");
 232                 rng->destroy(rng);
 233                 return FALSE;
 234         }
 235         rng->destroy(rng);
 236         return TRUE;
 237 }
 238
 239 METHOD(pts_t, get_my_public_value, void,
 240         private_pts_t *this, chunk_t *value, chunk_t *nonce)
 241 {
 242         this->dh->get_my_public_value(this->dh, value);
 243         *nonce = this->is_imc ? this->responder_nonce : this->initiator_nonce;
 244 }
 245
 246 METHOD(pts_t, set_peer_public_value, void,
 247         private_pts_t *this, chunk_t value, chunk_t nonce)
 248 {
 249         this->dh->set_other_public_value(this->dh, value);
 250
 251         nonce = chunk_clone(nonce);
 252         if (this->is_imc)
 253         {
 254                 this->initiator_nonce = nonce;
 255         }
 256         else
 257         {
 258                 this->responder_nonce = nonce;
 259         }
 260 }
 261
 262 METHOD(pts_t, calculate_secret, bool,
 263         private_pts_t *this)
 264 {
 265         hasher_t *hasher;
 266         hash_algorithm_t hash_alg;
 267         chunk_t shared_secret;
 268
 269         /* Check presence of nonces */
 270         if (!this->initiator_nonce.len || !this->responder_nonce.len)
 271         {
 272                 DBG1(DBG_PTS, "initiator and/or responder nonce is not available");
 273                 return FALSE;
 274         }
 275         DBG3(DBG_PTS, "initiator nonce: %B", &this->initiator_nonce);
 276         DBG3(DBG_PTS, "responder nonce: %B", &this->responder_nonce);
 277
 278         /* Calculate the DH secret */
 279         if (this->dh->get_shared_secret(this->dh, &shared_secret) != SUCCESS)
 280         {
 281                 DBG1(DBG_PTS, "shared DH secret computation failed");
 282                 return FALSE;
 283         }
 284         DBG3(DBG_PTS, "shared DH secret: %B", &shared_secret);
 285
 286         /* Calculate the secret assessment value */
 287         hash_alg = pts_meas_algo_to_hash(this->dh_hash_algorithm);
 288         hasher = lib->crypto->create_hasher(lib->crypto, hash_alg);
 289
 290         if (!hasher ||
 291                 !hasher->get_hash(hasher, chunk_from_chars('1'), NULL) ||
 292                 !hasher->get_hash(hasher, this->initiator_nonce, NULL) ||
 293                 !hasher->get_hash(hasher, this->responder_nonce, NULL) ||
 294                 !hasher->allocate_hash(hasher, shared_secret, &this->secret))
 295         {
 296                 DESTROY_IF(hasher);
 297                 return FALSE;
 298         }
 299         hasher->destroy(hasher);
 300
 301         /* The DH secret must be destroyed */
 302         chunk_clear(&shared_secret);
 303
 304         /*
 305          * Truncate the hash to 20 bytes to fit the ExternalData
 306          * argument of the TPM Quote command
 307          */
 308         this->secret.len = min(this->secret.len, 20);
 309         DBG3(DBG_PTS, "secret assessment value: %B", &this->secret);
 310         return TRUE;
 311 }
 312
 313 /**
 314  * Print TPM 1.2 Version Info
 315  */
 316 static void print_tpm_version_info(private_pts_t *this)
 317 {
 318         TPM_CAP_VERSION_INFO versionInfo;
 319         UINT64 offset = 0;
 320         TSS_RESULT result;
 321
 322         result = Trspi_UnloadBlob_CAP_VERSION_INFO(&offset,
 323                                                 this->tpm_version_info.ptr, &versionInfo);
 324         if (result != TSS_SUCCESS)
 325         {
 326                 DBG1(DBG_PTS, "could not parse tpm version info: tss error 0x%x",
 327                          result);
 328         }
 329         else
 330         {
 331                 DBG2(DBG_PTS, "TPM 1.2 Version Info: Chip Version: %hhu.%hhu.%hhu.%hhu,"
 332                                           " Spec Level: %hu, Errata Rev: %hhu, Vendor ID: %.4s",
 333                                           versionInfo.version.major, versionInfo.version.minor,
 334                                           versionInfo.version.revMajor, versionInfo.version.revMinor,
 335                                           versionInfo.specLevel, versionInfo.errataRev,
 336                                           versionInfo.tpmVendorID);
 337         }
 338 }
 339
 340 METHOD(pts_t, get_platform_info, char*,
 341         private_pts_t *this)
 342 {
 343         return this->platform_info;
 344 }
 345
 346 METHOD(pts_t, set_platform_info, void,
 347         private_pts_t *this, char *info)
 348 {
 349         free(this->platform_info);
 350         this->platform_info = strdup(info);
 351 }
 352
 353 METHOD(pts_t, get_tpm_version_info, bool,
 354         private_pts_t *this, chunk_t *info)
 355 {
 356         if (!this->has_tpm)
 357         {
 358                 return FALSE;
 359         }
 360         *info = this->tpm_version_info;
 361         print_tpm_version_info(this);
 362         return TRUE;
 363 }
 364
 365 METHOD(pts_t, set_tpm_version_info, void,
 366         private_pts_t *this, chunk_t info)
 367 {
 368         this->tpm_version_info = chunk_clone(info);
 369         print_tpm_version_info(this);
 370 }
 371
 372 METHOD(pts_t, get_pcr_len, size_t,
 373         private_pts_t *this)
 374 {
 375         return this->pcr_len;
 376 }
 377
 378 /**
 379  * Load an AIK Blob (TSS_TSPATTRIB_KEYBLOB_BLOB attribute)
 380  */
 381 static void load_aik_blob(private_pts_t *this)
 382 {
 383         char *blob_path;
 384         FILE *fp;
 385         u_int32_t aikBlobLen;
 386
 387         blob_path = lib->settings->get_str(lib->settings,
 388                                                 "libimcv.plugins.imc-attestation.aik_blob", NULL);
 389
 390         if (blob_path)
 391         {
 392                 /* Read aik key blob from a file */
 393                 if ((fp = fopen(blob_path, "r")) == NULL)
 394                 {
 395                         DBG1(DBG_PTS, "unable to open AIK Blob file: %s", blob_path);
 396                         return;
 397                 }
 398
 399                 fseek(fp, 0, SEEK_END);
 400                 aikBlobLen = ftell(fp);
 401                 fseek(fp, 0L, SEEK_SET);
 402
 403                 this->aik_blob = chunk_alloc(aikBlobLen);
 404                 if (fread(this->aik_blob.ptr, 1, aikBlobLen, fp))
 405                 {
 406                         DBG2(DBG_PTS, "loaded AIK Blob from '%s'", blob_path);
 407                         DBG3(DBG_PTS, "AIK Blob: %B", &this->aik_blob);
 408                 }
 409                 else
 410                 {
 411                         DBG1(DBG_PTS, "unable to read AIK Blob file '%s'", blob_path);
 412                 }
 413                 fclose(fp);
 414                 return;
 415         }
 416
 417         DBG1(DBG_PTS, "AIK Blob is not available");
 418 }
 419
 420 /**
 421  * Load an AIK certificate or public key
 422  * the certificate having precedence over the public key if both are present
 423  */
 424 static void load_aik(private_pts_t *this)
 425 {
 426         char *cert_path, *key_path;
 427
 428         cert_path = lib->settings->get_str(lib->settings,
 429                                                 "libimcv.plugins.imc-attestation.aik_cert", NULL);
 430         key_path = lib->settings->get_str(lib->settings,
 431                                                 "libimcv.plugins.imc-attestation.aik_key", NULL);
 432
 433         if (cert_path)
 434         {
 435                 this->aik = lib->creds->create(lib->creds, CRED_CERTIFICATE,
 436                                                                            CERT_X509, BUILD_FROM_FILE,
 437                                                                            cert_path, BUILD_END);
 438                 if (this->aik)
 439                 {
 440                         DBG2(DBG_PTS, "loaded AIK certificate from '%s'", cert_path);
 441                         return;
 442                 }
 443         }
 444         if (key_path)
 445         {
 446                 this->aik = lib->creds->create(lib->creds, CRED_CERTIFICATE,
 447                                                                            CERT_TRUSTED_PUBKEY, BUILD_FROM_FILE,
 448                                                                            key_path, BUILD_END);
 449                 if (this->aik)
 450                 {
 451                         DBG2(DBG_PTS, "loaded AIK public key from '%s'", key_path);
 452                         return;
 453                 }
 454         }
 455
 456         DBG1(DBG_PTS, "neither AIK certificate nor public key is available");
 457 }
 458
 459 METHOD(pts_t, get_aik, certificate_t*,
 460         private_pts_t *this)
 461 {
 462         return this->aik;
 463 }
 464
 465 METHOD(pts_t, set_aik, void,
 466         private_pts_t *this, certificate_t *aik)
 467 {
 468         DESTROY_IF(this->aik);
 469         this->aik = aik->get_ref(aik);
 470 }
 471
 472 METHOD(pts_t, get_aik_keyid, bool,
 473         private_pts_t *this, chunk_t *keyid)
 474 {
 475         public_key_t *public;
 476         bool success;
 477
 478         if (!this->aik)
 479         {
 480                 DBG1(DBG_PTS, "no AIK certificate available");
 481                 return FALSE;
 482         }
 483         public = this->aik->get_public_key(this->aik);
 484         if (!public)
 485         {
 486                 DBG1(DBG_PTS, "no AIK public key available");
 487                 return FALSE;
 488         }
 489         success = public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1, keyid);
 490         if (!success)
 491         {
 492                 DBG1(DBG_PTS, "no SHA-1 AIK public key info ID available");
 493         }
 494         public->destroy(public);
 495
 496         return success;
 497 }
 498
 499 METHOD(pts_t, is_path_valid, bool,
 500         private_pts_t *this, char *path, pts_error_code_t *error_code)
 501 {
 502         struct stat st;
 503
 504         *error_code = 0;
 505
 506         if (!stat(path, &st))
 507         {
 508                 return TRUE;
 509         }
 510         else if (errno == ENOENT || errno == ENOTDIR)
 511         {
 512                 DBG1(DBG_PTS, "file/directory does not exist %s", path);
 513                 *error_code = TCG_PTS_FILE_NOT_FOUND;
 514         }
 515         else if (errno == EFAULT)
 516         {
 517                 DBG1(DBG_PTS, "bad address %s", path);
 518                 *error_code = TCG_PTS_INVALID_PATH;
 519         }
 520         else
 521         {
 522                 DBG1(DBG_PTS, "error: %s occurred while validating path: %s",
 523                                            strerror(errno), path);
 524                 return FALSE;
 525         }
 526
 527         return TRUE;
 528 }
 529
 530 /**
 531  * Obtain statistical information describing a file
 532  */
 533 static bool file_metadata(char *pathname, pts_file_metadata_t **entry)
 534 {
 535         struct stat st;
 536         pts_file_metadata_t *this;
 537
 538         this = malloc_thing(pts_file_metadata_t);
 539
 540         if (stat(pathname, &st))
 541         {
 542                 DBG1(DBG_PTS, "unable to obtain statistics about '%s'", pathname);
 543                 return FALSE;
 544         }
 545
 546         if (S_ISREG(st.st_mode))
 547         {
 548                 this->type = PTS_FILE_REGULAR;
 549         }
 550         else if (S_ISDIR(st.st_mode))
 551         {
 552                 this->type = PTS_FILE_DIRECTORY;
 553         }
 554         else if (S_ISCHR(st.st_mode))
 555         {
 556                 this->type = PTS_FILE_CHAR_SPEC;
 557         }
 558         else if (S_ISBLK(st.st_mode))
 559         {
 560                 this->type = PTS_FILE_BLOCK_SPEC;
 561         }
 562         else if (S_ISFIFO(st.st_mode))
 563         {
 564                 this->type = PTS_FILE_FIFO;
 565         }
 566         else if (S_ISLNK(st.st_mode))
 567         {
 568                 this->type = PTS_FILE_SYM_LINK;
 569         }
 570         else if (S_ISSOCK(st.st_mode))
 571         {
 572                 this->type = PTS_FILE_SOCKET;
 573         }
 574         else
 575         {
 576                 this->type = PTS_FILE_OTHER;
 577         }
 578
 579         this->filesize = st.st_size;
 580         this->created =  st.st_ctime;
 581         this->modified = st.st_mtime;
 582         this->accessed = st.st_atime;
 583         this->owner =    st.st_uid;
 584         this->group =    st.st_gid;
 585
 586         *entry = this;
 587         return TRUE;
 588 }
 589
 590 METHOD(pts_t, get_metadata, pts_file_meta_t*,
 591         private_pts_t *this, char *pathname, bool is_directory)
 592 {
 593         pts_file_meta_t *metadata;
 594         pts_file_metadata_t *entry;
 595
 596         /* Create a metadata object */
 597         metadata = pts_file_meta_create();
 598
 599         if (is_directory)
 600         {
 601                 enumerator_t *enumerator;
 602                 char *rel_name, *abs_name;
 603                 struct stat st;
 604
 605                 enumerator = enumerator_create_directory(pathname);
 606                 if (!enumerator)
 607                 {
 608                         DBG1(DBG_PTS,"  directory '%s' can not be opened, %s", pathname,
 609                                  strerror(errno));
 610                         metadata->destroy(metadata);
 611                         return NULL;
 612                 }
 613                 while (enumerator->enumerate(enumerator, &rel_name, &abs_name, &st))
 614                 {
 615                         /* measure regular files only */
 616                         if (S_ISREG(st.st_mode) && *rel_name != '.')
 617                         {
 618                                 if (!file_metadata(abs_name, &entry))
 619                                 {
 620                                         enumerator->destroy(enumerator);
 621                                         metadata->destroy(metadata);
 622                                         return NULL;
 623                                 }
 624                                 entry->filename = strdup(rel_name);
 625                                 metadata->add(metadata, entry);
 626                         }
 627                 }
 628                 enumerator->destroy(enumerator);
 629         }
 630         else
 631         {
 632                 if (!file_metadata(pathname, &entry))
 633                 {
 634                         metadata->destroy(metadata);
 635                         return NULL;
 636                 }
 637                 entry->filename = strdup(basename(pathname));
 638                 metadata->add(metadata, entry);
 639         }
 640
 641         return metadata;
 642 }
 643
 644 METHOD(pts_t, read_pcr, bool,
 645         private_pts_t *this, u_int32_t pcr_num, chunk_t *pcr_value)
 646 {
 647         TSS_HCONTEXT hContext;
 648         TSS_HTPM hTPM;
 649         TSS_RESULT result;
 650         chunk_t rgbPcrValue;
 651
 652         bool success = FALSE;
 653
 654         result = Tspi_Context_Create(&hContext);
 655         if (result != TSS_SUCCESS)
 656         {
 657                 DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x", result);
 658                 return FALSE;
 659         }
 660
 661         result = Tspi_Context_Connect(hContext, NULL);
 662         if (result != TSS_SUCCESS)
 663         {
 664                 goto err;
 665         }
 666         result = Tspi_Context_GetTpmObject (hContext, &hTPM);
 667         if (result != TSS_SUCCESS)
 668         {
 669                 goto err;
 670         }
 671         result = Tspi_TPM_PcrRead(hTPM, pcr_num, (UINT32*)&rgbPcrValue.len, &rgbPcrValue.ptr);
 672         if (result != TSS_SUCCESS)
 673         {
 674                 goto err;
 675         }
 676         *pcr_value = chunk_clone(rgbPcrValue);
 677         DBG3(DBG_PTS, "PCR %d value:%B", pcr_num, pcr_value);
 678         success = TRUE;
 679
 680 err:
 681         if (!success)
 682         {
 683                 DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
 684         }
 685         Tspi_Context_FreeMemory(hContext, NULL);
 686         Tspi_Context_Close(hContext);
 687
 688         return success;
 689 }
 690
 691 METHOD(pts_t, extend_pcr, bool,
 692         private_pts_t *this, u_int32_t pcr_num, chunk_t input, chunk_t *output)
 693 {
 694         TSS_HCONTEXT hContext;
 695         TSS_HTPM hTPM;
 696         TSS_RESULT result;
 697         u_int32_t pcr_length;
 698         chunk_t pcr_value;
 699
 700         result = Tspi_Context_Create(&hContext);
 701         if (result != TSS_SUCCESS)
 702         {
 703                 DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x",
 704                          result);
 705                 return FALSE;
 706         }
 707         result = Tspi_Context_Connect(hContext, NULL);
 708         if (result != TSS_SUCCESS)
 709         {
 710                 goto err;
 711         }
 712         result = Tspi_Context_GetTpmObject (hContext, &hTPM);
 713         if (result != TSS_SUCCESS)
 714         {
 715                 goto err;
 716         }
 717
 718         pcr_value = chunk_alloc(PCR_LEN);
 719         result = Tspi_TPM_PcrExtend(hTPM, pcr_num, PCR_LEN, input.ptr,
 720                                                                 NULL, &pcr_length, &pcr_value.ptr);
 721         if (result != TSS_SUCCESS)
 722         {
 723                 goto err;
 724         }
 725
 726         *output = pcr_value;
 727         *output = chunk_clone(*output);
 728
 729         DBG3(DBG_PTS, "PCR %d extended with:      %B", pcr_num, &input);
 730         DBG3(DBG_PTS, "PCR %d value after extend: %B", pcr_num, output);
 731
 732         chunk_clear(&pcr_value);
 733         Tspi_Context_FreeMemory(hContext, NULL);
 734         Tspi_Context_Close(hContext);
 735
 736         return TRUE;
 737
 738 err:
 739         DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
 740
 741         chunk_clear(&pcr_value);
 742         Tspi_Context_FreeMemory(hContext, NULL);
 743         Tspi_Context_Close(hContext);
 744
 745         return FALSE;
 746 }
 747
 748
 749 static void clear_pcrs(private_pts_t *this)
 750 {
 751         int i;
 752
 753         for (i = 0; i <= this->pcr_max; i++)
 754         {
 755                 free(this->pcrs[i]);
 756                 this->pcrs[i] = NULL;
 757         }
 758         this->pcr_count = 0;
 759         this->pcr_max = 0;
 760
 761         memset(this->pcr_select, 0x00, sizeof(this->pcr_select));
 762 }
 763
 764 METHOD(pts_t, quote_tpm, bool,
 765         private_pts_t *this, bool use_quote2, chunk_t *pcr_comp, chunk_t *quote_sig)
 766 {
 767         TSS_HCONTEXT hContext;
 768         TSS_HTPM hTPM;
 769         TSS_HKEY hAIK;
 770         TSS_HKEY hSRK;
 771         TSS_HPOLICY srkUsagePolicy;
 772         TSS_UUID SRK_UUID = TSS_UUID_SRK;
 773         BYTE secret[] = TSS_WELL_KNOWN_SECRET;
 774         TSS_HPCRS hPcrComposite;
 775         TSS_VALIDATION valData;
 776         TSS_RESULT result;
 777         chunk_t quote_info;
 778         BYTE* versionInfo;
 779         u_int32_t versionInfoSize, pcr, i = 0, f = 1;
 780         bool success = FALSE;
 781
 782         result = Tspi_Context_Create(&hContext);
 783         if (result != TSS_SUCCESS)
 784         {
 785                 DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x",
 786                          result);
 787                 return FALSE;
 788         }
 789         result = Tspi_Context_Connect(hContext, NULL);
 790         if (result != TSS_SUCCESS)
 791         {
 792                 goto err1;
 793         }
 794         result = Tspi_Context_GetTpmObject (hContext, &hTPM);
 795         if (result != TSS_SUCCESS)
 796         {
 797                 goto err1;
 798         }
 799
 800         /* Retrieve SRK from TPM and set the authentication to well known secret*/
 801         result = Tspi_Context_LoadKeyByUUID(hContext, TSS_PS_TYPE_SYSTEM,
 802                                                                         SRK_UUID, &hSRK);
 803         if (result != TSS_SUCCESS)
 804         {
 805                 goto err1;
 806         }
 807
 808         result = Tspi_GetPolicyObject(hSRK, TSS_POLICY_USAGE, &srkUsagePolicy);
 809         if (result != TSS_SUCCESS)
 810         {
 811                 goto err1;
 812         }
 813         result = Tspi_Policy_SetSecret(srkUsagePolicy, TSS_SECRET_MODE_SHA1,
 814                                         20, secret);
 815         if (result != TSS_SUCCESS)
 816         {
 817                 goto err1;
 818         }
 819
 820         result = Tspi_Context_LoadKeyByBlob (hContext, hSRK, this->aik_blob.len,
 821                                                                                  this->aik_blob.ptr, &hAIK);
 822         if (result != TSS_SUCCESS)
 823         {
 824                 goto err1;
 825         }
 826
 827         /* Create PCR composite object */
 828         result = use_quote2 ?
 829                         Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_PCRS,
 830                                                         TSS_PCRS_STRUCT_INFO_SHORT, &hPcrComposite) :
 831                         Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_PCRS,
 832                                                         TSS_PCRS_STRUCT_DEFAULT, &hPcrComposite);
 833         if (result != TSS_SUCCESS)
 834         {
 835                 goto err2;
 836         }
 837
 838         /* Select PCRs */
 839         for (pcr = 0; pcr <= this->pcr_max ; pcr++)
 840         {
 841                 if (f == 256)
 842                 {
 843                         i++;
 844                         f = 1;
 845                 }
 846                 if (this->pcr_select[i] & f)
 847                 {
 848                         result = use_quote2 ?
 849                                         Tspi_PcrComposite_SelectPcrIndexEx(hPcrComposite, pcr,
 850                                                                                                 TSS_PCRS_DIRECTION_RELEASE) :
 851                                         Tspi_PcrComposite_SelectPcrIndex(hPcrComposite, pcr);
 852                         if (result != TSS_SUCCESS)
 853                         {
 854                                 goto err3;
 855                         }
 856                 }
 857                 f <<= 1;
 858         }
 859
 860         /* Set the Validation Data */
 861         valData.ulExternalDataLength = this->secret.len;
 862         valData.rgbExternalData = (BYTE *)this->secret.ptr;
 863
 864
 865         /* TPM Quote */
 866         result = use_quote2 ?
 867                         Tspi_TPM_Quote2(hTPM, hAIK, FALSE, hPcrComposite, &valData,
 868                                                         &versionInfoSize, &versionInfo):
 869                         Tspi_TPM_Quote(hTPM, hAIK, hPcrComposite, &valData);
 870         if (result != TSS_SUCCESS)
 871         {
 872                 goto err4;
 873         }
 874
 875         /* Set output chunks */
 876         *pcr_comp = chunk_alloc(HASH_SIZE_SHA1);
 877
 878         if (use_quote2)
 879         {
 880                 /* TPM_Composite_Hash is last 20 bytes of TPM_Quote_Info2 structure */
 881                 memcpy(pcr_comp->ptr, valData.rgbData + valData.ulDataLength - HASH_SIZE_SHA1,
 882                            HASH_SIZE_SHA1);
 883         }
 884         else
 885         {
 886                 /* TPM_Composite_Hash is 8-28th bytes of TPM_Quote_Info structure */
 887                 memcpy(pcr_comp->ptr, valData.rgbData + 8, HASH_SIZE_SHA1);
 888         }
 889         DBG3(DBG_PTS, "Hash of PCR Composite: %#B", pcr_comp);
 890
 891         quote_info = chunk_create(valData.rgbData, valData.ulDataLength);
 892         DBG3(DBG_PTS, "TPM Quote Info: %B",&quote_info);
 893
 894         *quote_sig = chunk_clone(chunk_create(valData.rgbValidationData,
 895                                                                                    valData.ulValidationDataLength));
 896         DBG3(DBG_PTS, "TPM Quote Signature: %B",quote_sig);
 897
 898         success = TRUE;
 899
 900         /* Cleanup */
 901 err4:
 902         Tspi_Context_FreeMemory(hContext, NULL);
 903
 904 err3:
 905         Tspi_Context_CloseObject(hContext, hPcrComposite);
 906
 907 err2:
 908         Tspi_Context_CloseObject(hContext, hAIK);
 909
 910 err1:
 911         Tspi_Context_Close(hContext);
 912
 913         if (!success)
 914         {
 915                 DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
 916         }
 917         clear_pcrs(this);
 918
 919         return success;
 920 }
 921
 922 METHOD(pts_t, select_pcr, bool,
 923         private_pts_t *this, u_int32_t pcr)
 924 {
 925         u_int32_t i, f;
 926
 927         if (pcr >= PCR_MAX_NUM)
 928         {
 929                 DBG1(DBG_PTS, "PCR %u: number is larger than maximum of %u",
 930                                            pcr, PCR_MAX_NUM-1);
 931                 return FALSE;
 932         }
 933
 934         /* Determine PCR selection flag */
 935         i = pcr / 8;
 936         f = 1 << (pcr - 8*i);
 937
 938         /* Has this PCR already been selected? */
 939         if (!(this->pcr_select[i] & f))
 940         {
 941                 this->pcr_select[i] |= f;
 942                 this->pcr_max = max(this->pcr_max, pcr);
 943                 this->pcr_count++;
 944         }
 945
 946         return TRUE;
 947 }
 948
 949 METHOD(pts_t, add_pcr, bool,
 950         private_pts_t *this, u_int32_t pcr, chunk_t pcr_before, chunk_t pcr_after)
 951 {
 952         if (pcr >= PCR_MAX_NUM)
 953         {
 954                 DBG1(DBG_PTS, "PCR %u: number is larger than maximum of %u",
 955                                            pcr, PCR_MAX_NUM-1);
 956                 return FALSE;
 957         }
 958
 959         /* Is the length of the PCR registers already set? */
 960         if (this->pcr_len)
 961         {
 962                 if (pcr_after.len != this->pcr_len)
 963                 {
 964                         DBG1(DBG_PTS, "PCR %02u: length is %d bytes but should be %d bytes",
 965                                                    pcr_after.len, this->pcr_len);
 966                         return FALSE;
 967                 }
 968         }
 969         else
 970         {
 971                 this->pcr_len = pcr_after.len;
 972         }
 973
 974         /* Has the value of the PCR register already been assigned? */
 975         if (this->pcrs[pcr])
 976         {
 977                 if (!memeq(this->pcrs[pcr], pcr_before.ptr, this->pcr_len))
 978                 {
 979                         DBG1(DBG_PTS, "PCR %02u: new pcr_before value does not equal "
 980                                                   "old pcr_after value");
 981                 }
 982                 /* remove the old PCR value */
 983                 free(this->pcrs[pcr]);
 984         }
 985         else
 986         {
 987                 /* add extended PCR Register */
 988                 this->pcr_select[pcr / 8] |= 1 << (pcr % 8);
 989                 this->pcr_max = max(this->pcr_max, pcr);
 990                 this->pcr_count++;
 991         }
 992
 993         /* Duplicate and store current PCR value */
 994         pcr_after = chunk_clone(pcr_after);
 995         this->pcrs[pcr] = pcr_after.ptr;
 996
 997         return TRUE;
 998 }
 999
1000 /**
1001  * TPM_QUOTE_INFO structure:
1002  *      4 bytes of version
1003  *      4 bytes 'Q' 'U' 'O' 'T'
1004  *      20 byte SHA1 of TCPA_PCR_COMPOSITE
1005  *      20 byte nonce
1006  *
1007  * TPM_QUOTE_INFO2 structure:
1008  * 2 bytes Tag 0x0036 TPM_Tag_Quote_info2
1009  * 4 bytes 'Q' 'U' 'T' '2'
1010  * 20 bytes nonce
1011  * 26 bytes PCR_INFO_SHORT
1012  */
1013
1014 METHOD(pts_t, get_quote_info, bool,
1015         private_pts_t *this, bool use_quote2, bool use_ver_info,
1016         pts_meas_algorithms_t comp_hash_algo,
1017         chunk_t *out_pcr_comp, chunk_t *out_quote_info)
1018 {
1019         u_int8_t size_of_select;
1020         int pcr_comp_len, i;
1021         chunk_t pcr_comp, hash_pcr_comp;
1022         bio_writer_t *writer;
1023         hasher_t *hasher;
1024
1025         if (this->pcr_count == 0)
1026         {
1027                 DBG1(DBG_PTS, "No extended PCR entries available, "
1028                                           "unable to construct TPM Quote Info");
1029                 return FALSE;
1030         }
1031         if (!this->secret.ptr)
1032         {
1033                 DBG1(DBG_PTS, "Secret assessment value unavailable, ",
1034                                           "unable to construct TPM Quote Info");
1035                 return FALSE;
1036         }
1037         if (use_quote2 && use_ver_info && !this->tpm_version_info.ptr)
1038         {
1039                 DBG1(DBG_PTS, "TPM Version Information unavailable, ",
1040                                           "unable to construct TPM Quote Info2");
1041                 return FALSE;
1042         }
1043
1044         /**
1045          * A TPM v1.2 has 24 PCR Registers
1046          * so the bitmask field length used by TrouSerS is at least 3 bytes
1047          */
1048         size_of_select = max(PCR_MAX_NUM / 8, 1 + this->pcr_max / 8);
1049         pcr_comp_len = 2 + size_of_select + 4 + this->pcr_count * this->pcr_len;
1050
1051         writer = bio_writer_create(pcr_comp_len);
1052
1053         writer->write_uint16(writer, size_of_select);
1054         for (i = 0; i < size_of_select; i++)
1055         {
1056                 writer->write_uint8(writer, this->pcr_select[i]);
1057         }
1058
1059         writer->write_uint32(writer, this->pcr_count * this->pcr_len);
1060         for (i = 0; i < 8 * size_of_select; i++)
1061         {
1062                 if (this->pcrs[i])
1063                 {
1064                         writer->write_data(writer, chunk_create(this->pcrs[i], this->pcr_len));
1065                 }
1066         }
1067         pcr_comp = chunk_clone(writer->get_buf(writer));
1068         DBG3(DBG_PTS, "constructed PCR Composite: %B", &pcr_comp);
1069
1070         writer->destroy(writer);
1071
1072         /* Output the TPM_PCR_COMPOSITE expected from IMC */
1073         if (comp_hash_algo)
1074         {
1075                 hash_algorithm_t algo;
1076
1077                 algo = pts_meas_algo_to_hash(comp_hash_algo);
1078                 hasher = lib->crypto->create_hasher(lib->crypto, algo);
1079
1080                 /* Hash the PCR Composite Structure */
1081                 if (!hasher || !hasher->allocate_hash(hasher, pcr_comp, out_pcr_comp))
1082                 {
1083                         DESTROY_IF(hasher);
1084                         free(pcr_comp.ptr);
1085                         return FALSE;
1086                 }
1087                 DBG3(DBG_PTS, "constructed PCR Composite hash: %#B", out_pcr_comp);
1088                 hasher->destroy(hasher);
1089         }
1090         else
1091         {
1092                 *out_pcr_comp = chunk_clone(pcr_comp);
1093         }
1094
1095         /* SHA1 hash of PCR Composite to construct TPM_QUOTE_INFO */
1096         hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
1097         if (!hasher || !hasher->allocate_hash(hasher, pcr_comp, &hash_pcr_comp))
1098         {
1099                 DESTROY_IF(hasher);
1100                 chunk_free(out_pcr_comp);
1101                 free(pcr_comp.ptr);
1102                 return FALSE;
1103         }
1104         hasher->destroy(hasher);
1105
1106         /* Construct TPM_QUOTE_INFO/TPM_QUOTE_INFO2 structure */
1107         writer = bio_writer_create(TPM_QUOTE_INFO_LEN);
1108
1109         if (use_quote2)
1110         {
1111                 /* TPM Structure Tag */
1112                 writer->write_uint16(writer, TPM_TAG_QUOTE_INFO2);
1113
1114                 /* Magic QUT2 value */
1115                 writer->write_data(writer, chunk_create("QUT2", 4));
1116
1117                 /* Secret assessment value 20 bytes (nonce) */
1118                 writer->write_data(writer, this->secret);
1119
1120                 /* Length of the PCR selection field */
1121                 writer->write_uint16(writer, size_of_select);
1122
1123                 /* PCR selection */
1124                 for (i = 0; i < size_of_select ; i++)
1125                 {
1126                         writer->write_uint8(writer, this->pcr_select[i]);
1127                 }
1128
1129                 /* TPM Locality Selection */
1130                 writer->write_uint8(writer, TPM_LOC_ZERO);
1131
1132                 /* PCR Composite Hash */
1133                 writer->write_data(writer, hash_pcr_comp);
1134
1135                 if (use_ver_info)
1136                 {
1137                         /* TPM version Info */
1138                         writer->write_data(writer, this->tpm_version_info);
1139                 }
1140         }
1141         else
1142         {
1143                 /* Version number */
1144                 writer->write_data(writer, chunk_from_chars(1, 1, 0, 0));
1145
1146                 /* Magic QUOT value */
1147                 writer->write_data(writer, chunk_create("QUOT", 4));
1148
1149                 /* PCR Composite Hash */
1150                 writer->write_data(writer, hash_pcr_comp);
1151
1152                 /* Secret assessment value 20 bytes (nonce) */
1153                 writer->write_data(writer, this->secret);
1154         }
1155
1156         /* TPM Quote Info */
1157         *out_quote_info = chunk_clone(writer->get_buf(writer));
1158         DBG3(DBG_PTS, "constructed TPM Quote Info: %B", out_quote_info);
1159
1160         writer->destroy(writer);
1161         free(pcr_comp.ptr);
1162         free(hash_pcr_comp.ptr);
1163         clear_pcrs(this);
1164
1165         return TRUE;
1166 }
1167
1168 METHOD(pts_t, verify_quote_signature, bool,
1169                                 private_pts_t *this, chunk_t data, chunk_t signature)
1170 {
1171         public_key_t *aik_pub_key;
1172
1173         aik_pub_key = this->aik->get_public_key(this->aik);
1174         if (!aik_pub_key)
1175         {
1176                 DBG1(DBG_PTS, "failed to get public key from AIK certificate");
1177                 return FALSE;
1178         }
1179
1180         if (!aik_pub_key->verify(aik_pub_key, SIGN_RSA_EMSA_PKCS1_SHA1,
1181                 data, signature))
1182         {
1183                 DBG1(DBG_PTS, "signature verification failed for TPM Quote Info");
1184                 DESTROY_IF(aik_pub_key);
1185                 return FALSE;
1186         }
1187
1188         aik_pub_key->destroy(aik_pub_key);
1189         return TRUE;
1190 }
1191
1192 METHOD(pts_t, destroy, void,
1193         private_pts_t *this)
1194 {
1195         clear_pcrs(this);
1196         DESTROY_IF(this->aik);
1197         DESTROY_IF(this->dh);
1198         free(this->initiator_nonce.ptr);
1199         free(this->responder_nonce.ptr);
1200         free(this->secret.ptr);
1201         free(this->platform_info);
1202         free(this->aik_blob.ptr);
1203         free(this->tpm_version_info.ptr);
1204         free(this);
1205 }
1206
1207 #define RELEASE_LSB             0
1208 #define RELEASE_DEBIAN  1
1209
1210 /**
1211  * Determine Linux distribution and hardware platform
1212  */
1213 static char* extract_platform_info(void)
1214 {
1215         FILE *file;
1216         char buf[BUF_LEN], *pos = buf, *value = NULL;
1217         int i, len = BUF_LEN - 1;
1218         struct utsname uninfo;
1219
1220         /* Linux/Unix distribution release info (from http://linuxmafia.com) */
1221         const char* releases[] = {
1222                 "/etc/lsb-release",           "/etc/debian_version",
1223                 "/etc/SuSE-release",          "/etc/novell-release",
1224                 "/etc/sles-release",          "/etc/redhat-release",
1225                 "/etc/fedora-release",        "/etc/gentoo-release",
1226                 "/etc/slackware-version",     "/etc/annvix-release",
1227                 "/etc/arch-release",          "/etc/arklinux-release",
1228                 "/etc/aurox-release",         "/etc/blackcat-release",
1229                 "/etc/cobalt-release",        "/etc/conectiva-release",
1230                 "/etc/debian_release",        "/etc/immunix-release",
1231                 "/etc/lfs-release",           "/etc/linuxppc-release",
1232                 "/etc/mandrake-release",      "/etc/mandriva-release",
1233                 "/etc/mandrakelinux-release", "/etc/mklinux-release",
1234                 "/etc/pld-release",           "/etc/redhat_version",
1235                 "/etc/slackware-release",     "/etc/e-smith-release",
1236                 "/etc/release",               "/etc/sun-release",
1237                 "/etc/tinysofa-release",      "/etc/turbolinux-release",
1238                 "/etc/ultrapenguin-release",  "/etc/UnitedLinux-release",
1239                 "/etc/va-release",            "/etc/yellowdog-release"
1240         };
1241
1242         const char description[] = "DISTRIB_DESCRIPTION=\"";
1243         const char str_debian[] = "Debian ";
1244
1245         for (i = 0; i < countof(releases); i++)
1246         {
1247                 file = fopen(releases[i], "r");
1248                 if (!file)
1249                 {
1250                         continue;
1251                 }
1252
1253                 if (i == RELEASE_DEBIAN)
1254                 {
1255                         strcpy(buf, str_debian);
1256                         pos += strlen(str_debian);
1257                         len -= strlen(str_debian);
1258                 }
1259
1260                 fseek(file, 0, SEEK_END);
1261                 len = min(ftell(file), len);
1262                 rewind(file);
1263                 pos[len] = '\0';
1264                 if (fread(pos, 1, len, file) != len)
1265                 {
1266                         DBG1(DBG_PTS, "failed to read file '%s'", releases[i]);
1267                         fclose(file);
1268                         return NULL;
1269                 }
1270                 fclose(file);
1271
1272                 if (i == RELEASE_LSB)
1273                 {
1274                         pos = strstr(buf, description);
1275                         if (!pos)
1276                         {
1277                                 DBG1(DBG_PTS, "failed to find begin of lsb-release "
1278                                                           "DESCRIPTION field");
1279                                 return NULL;
1280                         }
1281                         value = pos + strlen(description);
1282                         pos = strchr(value, '"');
1283                         if (!pos)
1284                         {
1285                                 DBG1(DBG_PTS, "failed to find end of lsb-release "
1286                                                           "DESCRIPTION field");
1287                                 return NULL;
1288                          }
1289                 }
1290                 else
1291                 {
1292                         value = buf;
1293                         pos = strchr(pos, '\n');
1294                         if (!pos)
1295                         {
1296                                 DBG1(DBG_PTS, "failed to find end of release string");
1297                                 return NULL;
1298                          }
1299                 }
1300                 break;
1301         }
1302
1303         if (!value)
1304         {
1305                 DBG1(DBG_PTS, "no distribution release file found");
1306                 return NULL;
1307         }
1308
1309         if (uname(&uninfo) < 0)
1310         {
1311                 DBG1(DBG_PTS, "could not retrieve machine architecture");
1312                 return NULL;
1313         }
1314
1315         *pos++ = ' ';
1316         len = sizeof(buf)-1 + (pos - buf);
1317         strncpy(pos, uninfo.machine, len);
1318
1319         DBG1(DBG_PTS, "platform is '%s'", value);
1320         return strdup(value);
1321 }
1322
1323 /**
1324  * Check for a TPM by querying for TPM Version Info
1325  */
1326 static bool has_tpm(private_pts_t *this)
1327 {
1328         TSS_HCONTEXT hContext;
1329         TSS_HTPM hTPM;
1330         TSS_RESULT result;
1331         u_int32_t version_info_len;
1332
1333         result = Tspi_Context_Create(&hContext);
1334         if (result != TSS_SUCCESS)
1335         {
1336                 DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x",
1337                          result);
1338                 return FALSE;
1339         }
1340         result = Tspi_Context_Connect(hContext, NULL);
1341         if (result != TSS_SUCCESS)
1342         {
1343                 goto err;
1344         }
1345         result = Tspi_Context_GetTpmObject (hContext, &hTPM);
1346         if (result != TSS_SUCCESS)
1347         {
1348                 goto err;
1349         }
1350         result = Tspi_TPM_GetCapability(hTPM, TSS_TPMCAP_VERSION_VAL,  0, NULL,
1351                                                                         &version_info_len,
1352                                                                         &this->tpm_version_info.ptr);
1353         this->tpm_version_info.len = version_info_len;
1354         if (result != TSS_SUCCESS)
1355         {
1356                 goto err;
1357         }
1358         this->tpm_version_info = chunk_clone(this->tpm_version_info);
1359
1360         Tspi_Context_FreeMemory(hContext, NULL);
1361         Tspi_Context_Close(hContext);
1362         return TRUE;
1363
1364         err:
1365         DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
1366         Tspi_Context_FreeMemory(hContext, NULL);
1367         Tspi_Context_Close(hContext);
1368         return FALSE;
1369 }
1370
1371 /**
1372  * See header
1373  */
1374 pts_t *pts_create(bool is_imc)
1375 {
1376         private_pts_t *this;
1377
1378         INIT(this,
1379                 .public = {
1380                         .get_proto_caps = _get_proto_caps,
1381                         .set_proto_caps = _set_proto_caps,
1382                         .get_meas_algorithm = _get_meas_algorithm,
1383                         .set_meas_algorithm = _set_meas_algorithm,
1384                         .get_dh_hash_algorithm = _get_dh_hash_algorithm,
1385                         .set_dh_hash_algorithm = _set_dh_hash_algorithm,
1386                         .create_dh_nonce = _create_dh_nonce,
1387                         .get_my_public_value = _get_my_public_value,
1388                         .set_peer_public_value = _set_peer_public_value,
1389                         .calculate_secret = _calculate_secret,
1390                         .get_platform_info = _get_platform_info,
1391                         .set_platform_info = _set_platform_info,
1392                         .get_tpm_version_info = _get_tpm_version_info,
1393                         .set_tpm_version_info = _set_tpm_version_info,
1394                         .get_pcr_len = _get_pcr_len,
1395                         .get_aik = _get_aik,
1396                         .set_aik = _set_aik,
1397                         .get_aik_keyid = _get_aik_keyid,
1398                         .is_path_valid = _is_path_valid,
1399                         .get_metadata = _get_metadata,
1400                         .read_pcr = _read_pcr,
1401                         .extend_pcr = _extend_pcr,
1402                         .quote_tpm = _quote_tpm,
1403                         .select_pcr = _select_pcr,
1404                         .add_pcr = _add_pcr,
1405                         .get_quote_info = _get_quote_info,
1406                         .verify_quote_signature  = _verify_quote_signature,
1407                         .destroy = _destroy,
1408                 },
1409                 .is_imc = is_imc,
1410                 .proto_caps = PTS_PROTO_CAPS_V,
1411                 .algorithm = PTS_MEAS_ALGO_SHA256,
1412                 .dh_hash_algorithm = PTS_MEAS_ALGO_SHA256,
1413         );
1414
1415         if (is_imc)
1416         {
1417                 this->platform_info = extract_platform_info();
1418
1419                 if (has_tpm(this))
1420                 {
1421                         this->has_tpm = TRUE;
1422                         this->pcr_len = PCR_LEN;
1423                         this->proto_caps |= PTS_PROTO_CAPS_T | PTS_PROTO_CAPS_D;
1424                         load_aik(this);
1425                         load_aik_blob(this);
1426                 }
1427         }
1428         else
1429         {
1430                 this->proto_caps |= PTS_PROTO_CAPS_T | PTS_PROTO_CAPS_D;
1431         }
1432
1433         return &this->public;
1434 }