src/shared/tpm2-util.h

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2 #pragma once
   3
   4 #include <stdbool.h>
   5
   6 #include "bitfield.h"
   7 #include "io-util.h"
   8 #include "json.h"
   9 #include "macro.h"
  10 #include "openssl-util.h"
  11 #include "sha256.h"
  12 #include "tpm2-pcr.h"
  13
  14 typedef enum TPM2Flags {
  15         TPM2_FLAGS_USE_PIN = 1 << 0,
  16 } TPM2Flags;
  17
  18 /* As per https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf a
  19  * TPM2 on a Client PC must have at least 24 PCRs. This hardcodes our expectation of 24. */
  20 #define TPM2_PCRS_MAX 24U
  21 #define TPM2_PCRS_MASK ((UINT32_C(1) << TPM2_PCRS_MAX) - 1)
  22
  23 static inline bool TPM2_PCR_INDEX_VALID(unsigned pcr) {
  24         return pcr < TPM2_PCRS_MAX;
  25 }
  26 static inline bool TPM2_PCR_MASK_VALID(uint32_t pcr_mask) {
  27         return pcr_mask <= TPM2_PCRS_MASK;
  28 }
  29
  30 #define FOREACH_PCR_IN_MASK(pcr, mask) BIT_FOREACH(pcr, mask)
  31
  32 #if HAVE_TPM2
  33
  34 #include <tss2/tss2_esys.h>
  35 #include <tss2/tss2_mu.h>
  36 #include <tss2/tss2_rc.h>
  37
  38 int dlopen_tpm2(void);
  39
  40 typedef struct {
  41         unsigned n_ref;
  42
  43         void *tcti_dl;
  44         TSS2_TCTI_CONTEXT *tcti_context;
  45         ESYS_CONTEXT *esys_context;
  46
  47         /* Some selected cached capabilities of the TPM */
  48         TPMS_ALG_PROPERTY *capability_algorithms;
  49         size_t n_capability_algorithms;
  50         TPMA_CC *capability_commands;
  51         size_t n_capability_commands;
  52         TPML_PCR_SELECTION capability_pcrs;
  53 } Tpm2Context;
  54
  55 int tpm2_context_new(const char *device, Tpm2Context **ret_context);
  56 Tpm2Context *tpm2_context_ref(Tpm2Context *context);
  57 Tpm2Context *tpm2_context_unref(Tpm2Context *context);
  58 DEFINE_TRIVIAL_CLEANUP_FUNC(Tpm2Context*, tpm2_context_unref);
  59
  60 typedef struct {
  61         Tpm2Context *tpm2_context;
  62         ESYS_TR esys_handle;
  63
  64         bool flush;
  65 } Tpm2Handle;
  66
  67 #define _tpm2_handle(c, h) { .tpm2_context = (c), .esys_handle = (h), }
  68 static const Tpm2Handle TPM2_HANDLE_NONE = _tpm2_handle(NULL, ESYS_TR_NONE);
  69
  70 void Esys_Freep(void *p);
  71
  72 int tpm2_handle_new(Tpm2Context *context, Tpm2Handle **ret_handle);
  73 Tpm2Handle *tpm2_handle_free(Tpm2Handle *handle);
  74 DEFINE_TRIVIAL_CLEANUP_FUNC(Tpm2Handle*, tpm2_handle_free);
  75
  76 typedef struct {
  77         unsigned index;
  78         TPMI_ALG_HASH hash;
  79         TPM2B_DIGEST value;
  80 } Tpm2PCRValue;
  81
  82 #define TPM2_PCR_VALUE_MAKE(i, h, v)                                    \
  83         (Tpm2PCRValue) {                                                \
  84                 .index = (i),                                           \
  85                 .hash = (h),                                            \
  86                 .value = ((TPM2B_DIGEST) v),                            \
  87         }
  88
  89 bool tpm2_pcr_value_valid(const Tpm2PCRValue *pcr_value);
  90 bool tpm2_pcr_values_has_any_values(const Tpm2PCRValue *pcr_values, size_t n_pcr_values);
  91 bool tpm2_pcr_values_has_all_values(const Tpm2PCRValue *pcr_values, size_t n_pcr_values);
  92 int tpm2_pcr_value_from_string(const char *arg, Tpm2PCRValue *ret_pcr_value);
  93 char *tpm2_pcr_value_to_string(const Tpm2PCRValue *pcr_value);
  94
  95 bool tpm2_pcr_values_valid(const Tpm2PCRValue *pcr_values, size_t n_pcr_values);
  96 void tpm2_sort_pcr_values(Tpm2PCRValue *pcr_values, size_t n_pcr_values);
  97 int tpm2_pcr_values_from_mask(uint32_t mask, TPMI_ALG_HASH hash, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values);
  98 int tpm2_pcr_values_to_mask(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, TPMI_ALG_HASH hash, uint32_t *ret_mask);
  99 int tpm2_pcr_values_from_string(const char *arg, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values);
 100 char *tpm2_pcr_values_to_string(const Tpm2PCRValue *pcr_values, size_t n_pcr_values);
 101 int tpm2_pcr_values_hash_count(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, size_t *ret_count);
 102 int tpm2_tpml_pcr_selection_from_pcr_values(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, TPML_PCR_SELECTION *ret_selection, TPM2B_DIGEST **ret_values, size_t *ret_n_values);
 103
 104 int tpm2_create_primary(Tpm2Context *c, const Tpm2Handle *session, const TPM2B_PUBLIC *template, const TPM2B_SENSITIVE_CREATE *sensitive, TPM2B_PUBLIC **ret_public, Tpm2Handle **ret_handle);
 105 int tpm2_create(Tpm2Context *c, const Tpm2Handle *parent, const Tpm2Handle *session, const TPMT_PUBLIC *template, const TPMS_SENSITIVE_CREATE *sensitive, TPM2B_PUBLIC **ret_public, TPM2B_PRIVATE **ret_private);
 106 int tpm2_create_loaded(Tpm2Context *c, const Tpm2Handle *parent, const Tpm2Handle *session, const TPMT_PUBLIC *template, const TPMS_SENSITIVE_CREATE *sensitive, TPM2B_PUBLIC **ret_public, TPM2B_PRIVATE **ret_private, Tpm2Handle **ret_handle);
 107
 108 bool tpm2_supports_alg(Tpm2Context *c, TPM2_ALG_ID alg);
 109 bool tpm2_supports_command(Tpm2Context *c, TPM2_CC command);
 110
 111 bool tpm2_test_parms(Tpm2Context *c, TPMI_ALG_PUBLIC alg, const TPMU_PUBLIC_PARMS *parms);
 112
 113 int tpm2_get_good_pcr_banks(Tpm2Context *c, uint32_t pcr_mask, TPMI_ALG_HASH **ret_banks);
 114 int tpm2_get_good_pcr_banks_strv(Tpm2Context *c, uint32_t pcr_mask, char ***ret);
 115 int tpm2_get_best_pcr_bank(Tpm2Context *c, uint32_t pcr_mask, TPMI_ALG_HASH *ret);
 116
 117 const char *tpm2_userspace_log_path(void);
 118
 119 typedef enum Tpm2UserspaceEventType {
 120         TPM2_EVENT_PHASE,
 121         TPM2_EVENT_FILESYSTEM,
 122         TPM2_EVENT_VOLUME_KEY,
 123         TPM2_EVENT_MACHINE_ID,
 124         _TPM2_USERSPACE_EVENT_TYPE_MAX,
 125         _TPM2_USERSPACE_EVENT_TYPE_INVALID = -EINVAL,
 126 } Tpm2UserspaceEventType;
 127
 128 const char* tpm2_userspace_event_type_to_string(Tpm2UserspaceEventType type) _const_;
 129 Tpm2UserspaceEventType tpm2_userspace_event_type_from_string(const char *s) _pure_;
 130
 131 int tpm2_extend_bytes(Tpm2Context *c, char **banks, unsigned pcr_index, const void *data, size_t data_size, const void *secret, size_t secret_size, Tpm2UserspaceEventType event, const char *description);
 132
 133 uint32_t tpm2_tpms_pcr_selection_to_mask(const TPMS_PCR_SELECTION *s);
 134 void tpm2_tpms_pcr_selection_from_mask(uint32_t mask, TPMI_ALG_HASH hash, TPMS_PCR_SELECTION *ret);
 135 bool tpm2_tpms_pcr_selection_has_mask(const TPMS_PCR_SELECTION *s, uint32_t mask);
 136 void tpm2_tpms_pcr_selection_add_mask(TPMS_PCR_SELECTION *s, uint32_t mask);
 137 void tpm2_tpms_pcr_selection_sub_mask(TPMS_PCR_SELECTION *s, uint32_t mask);
 138 void tpm2_tpms_pcr_selection_add(TPMS_PCR_SELECTION *a, const TPMS_PCR_SELECTION *b);
 139 void tpm2_tpms_pcr_selection_sub(TPMS_PCR_SELECTION *a, const TPMS_PCR_SELECTION *b);
 140 void tpm2_tpms_pcr_selection_move(TPMS_PCR_SELECTION *a, TPMS_PCR_SELECTION *b);
 141 char *tpm2_tpms_pcr_selection_to_string(const TPMS_PCR_SELECTION *s);
 142 size_t tpm2_tpms_pcr_selection_weight(const TPMS_PCR_SELECTION *s);
 143 #define tpm2_tpms_pcr_selection_is_empty(s) (tpm2_tpms_pcr_selection_weight(s) == 0)
 144
 145 uint32_t tpm2_tpml_pcr_selection_to_mask(const TPML_PCR_SELECTION *l, TPMI_ALG_HASH hash);
 146 void tpm2_tpml_pcr_selection_from_mask(uint32_t mask, TPMI_ALG_HASH hash, TPML_PCR_SELECTION *ret);
 147 bool tpm2_tpml_pcr_selection_has_mask(const TPML_PCR_SELECTION *l, TPMI_ALG_HASH hash, uint32_t mask);
 148 void tpm2_tpml_pcr_selection_add_mask(TPML_PCR_SELECTION *l, TPMI_ALG_HASH hash, uint32_t mask);
 149 void tpm2_tpml_pcr_selection_sub_mask(TPML_PCR_SELECTION *l, TPMI_ALG_HASH hash, uint32_t mask);
 150 void tpm2_tpml_pcr_selection_add_tpms_pcr_selection(TPML_PCR_SELECTION *l, const TPMS_PCR_SELECTION *s);
 151 void tpm2_tpml_pcr_selection_sub_tpms_pcr_selection(TPML_PCR_SELECTION *l, const TPMS_PCR_SELECTION *s);
 152 void tpm2_tpml_pcr_selection_add(TPML_PCR_SELECTION *a, const TPML_PCR_SELECTION *b);
 153 void tpm2_tpml_pcr_selection_sub(TPML_PCR_SELECTION *a, const TPML_PCR_SELECTION *b);
 154 char *tpm2_tpml_pcr_selection_to_string(const TPML_PCR_SELECTION *l);
 155 size_t tpm2_tpml_pcr_selection_weight(const TPML_PCR_SELECTION *l);
 156 #define tpm2_tpml_pcr_selection_is_empty(l) (tpm2_tpml_pcr_selection_weight(l) == 0)
 157
 158 int tpm2_digest_many(TPMI_ALG_HASH alg, TPM2B_DIGEST *digest, const struct iovec data[], size_t count, bool extend);
 159 static inline int tpm2_digest_buffer(TPMI_ALG_HASH alg, TPM2B_DIGEST *digest, const void *data, size_t len, bool extend) {
 160         return tpm2_digest_many(alg, digest, &IOVEC_MAKE((void*) data, len), 1, extend);
 161 }
 162 int tpm2_digest_many_digests(TPMI_ALG_HASH alg, TPM2B_DIGEST *digest, const TPM2B_DIGEST data[], size_t count, bool extend);
 163 static inline int tpm2_digest_rehash(TPMI_ALG_HASH alg, TPM2B_DIGEST *digest) {
 164         return tpm2_digest_many(alg, digest, NULL, 0, true);
 165 }
 166 static inline int tpm2_digest_init(TPMI_ALG_HASH alg, TPM2B_DIGEST *digest) {
 167         return tpm2_digest_many(alg, digest, NULL, 0, false);
 168 }
 169
 170 void tpm2_log_debug_tpml_pcr_selection(const TPML_PCR_SELECTION *l, const char *msg);
 171 void tpm2_log_debug_pcr_value(const Tpm2PCRValue *pcr_value, const char *msg);
 172 void tpm2_log_debug_buffer(const void *buffer, size_t size, const char *msg);
 173 void tpm2_log_debug_digest(const TPM2B_DIGEST *digest, const char *msg);
 174 void tpm2_log_debug_name(const TPM2B_NAME *name, const char *msg);
 175
 176 int tpm2_index_to_handle(Tpm2Context *c, TPM2_HANDLE index, const Tpm2Handle *session, TPM2B_PUBLIC **ret_public, TPM2B_NAME **ret_name, TPM2B_NAME **ret_qname, Tpm2Handle **ret_handle);
 177 int tpm2_index_from_handle(Tpm2Context *c, const Tpm2Handle *handle, TPM2_HANDLE *ret_index);
 178
 179 int tpm2_read_public(Tpm2Context *c, const Tpm2Handle *session, const Tpm2Handle *handle, TPM2B_PUBLIC **ret_public, TPM2B_NAME **ret_name, TPM2B_NAME **ret_qname);
 180
 181 int tpm2_pcr_read(Tpm2Context *c, const TPML_PCR_SELECTION *pcr_selection, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values);
 182 int tpm2_pcr_read_missing_values(Tpm2Context *c, Tpm2PCRValue *pcr_values, size_t n_pcr_values);
 183
 184 int tpm2_calculate_name(const TPMT_PUBLIC *public, TPM2B_NAME *ret_name);
 185 int tpm2_calculate_policy_auth_value(TPM2B_DIGEST *digest);
 186 int tpm2_calculate_policy_authorize(const TPM2B_PUBLIC *public, const TPM2B_DIGEST *policy_ref, TPM2B_DIGEST *digest);
 187 int tpm2_calculate_policy_pcr(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, TPM2B_DIGEST *digest);
 188 int tpm2_calculate_sealing_policy(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, const TPM2B_PUBLIC *public, bool use_pin, TPM2B_DIGEST *digest);
 189
 190 int tpm2_marshal_blob(const TPM2B_PUBLIC *public, const TPM2B_PRIVATE *private, void **ret_blob, size_t *ret_blob_size);
 191 int tpm2_unmarshal_blob(const void *blob, size_t blob_size, TPM2B_PUBLIC *ret_public, TPM2B_PRIVATE *ret_private);
 192
 193 int tpm2_get_or_create_srk(Tpm2Context *c, const Tpm2Handle *session, TPM2B_PUBLIC **ret_public, TPM2B_NAME **ret_name, TPM2B_NAME **ret_qname, Tpm2Handle **ret_handle);
 194
 195 int tpm2_seal(Tpm2Context *c, const TPM2B_DIGEST *policy, const char *pin, void **ret_secret, size_t *ret_secret_size, void **ret_blob, size_t *ret_blob_size, uint16_t *ret_primary_alg, void **ret_srk_buf, size_t *ret_srk_buf_size);
 196 int tpm2_unseal(const char *device, uint32_t hash_pcr_mask, uint16_t pcr_bank, const void *pubkey, size_t pubkey_size, uint32_t pubkey_pcr_mask, JsonVariant *signature, const char *pin, uint16_t primary_alg, const void *blob, size_t blob_size, const void *policy_hash, size_t policy_hash_size, const void *srk_buf, size_t srk_buf_size, void **ret_secret, size_t *ret_secret_size);
 197
 198 #if HAVE_OPENSSL
 199 int tpm2_tpm2b_public_to_openssl_pkey(const TPM2B_PUBLIC *public, EVP_PKEY **ret);
 200 int tpm2_tpm2b_public_from_openssl_pkey(const EVP_PKEY *pkey, TPM2B_PUBLIC *ret);
 201 #endif
 202
 203 int tpm2_tpm2b_public_from_pem(const void *pem, size_t pem_size, TPM2B_PUBLIC *ret);
 204 int tpm2_tpm2b_public_to_fingerprint(const TPM2B_PUBLIC *public, void **ret_fingerprint, size_t *ret_fingerprint_size);
 205
 206 /* The tpm2-tss library has many structs that are simply a combination of an array (or object) and
 207  * size. These macros allow easily initializing or assigning instances of such structs from an existing
 208  * buffer/object and size, while also checking the size for safety with the struct buffer/object size. If the
 209  * provided buffer/object is NULL, the resulting struct's buffer/object will be 0s. If the provided size is
 210  * larger than the struct's buffer/object size, this results in assertion failure; to check the size, use one
 211  * of the TPM2B_*_CHECK_SIZE() macros. */
 212 #define TPM2B_AUTH_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_AUTH, buffer, size)
 213 #define TPM2B_DATA_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_DATA, buffer, size)
 214 #define TPM2B_DIGEST_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_DIGEST, buffer, size)
 215 #define TPM2B_ECC_PARAMETER_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_ECC_PARAMETER, buffer, size)
 216 #define TPM2B_ENCRYPTED_SECRET_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_ENCRYPTED_SECRET, secret, size)
 217 #define TPM2B_MAX_BUFFER_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_MAX_BUFFER, buffer, size)
 218 #define TPM2B_NAME_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_NAME, name, size)
 219 #define TPM2B_PRIVATE_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_PRIVATE, buffer, size)
 220 #define TPM2B_PRIVATE_KEY_RSA_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_PRIVATE_KEY_RSA, buffer, size)
 221 #define TPM2B_PUBLIC_KEY_RSA_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_PUBLIC_KEY_RSA, buffer, size)
 222 #define TPM2B_SENSITIVE_DATA_MAKE(b, s) TPM2B_BUF_SIZE_STRUCT_MAKE(b, s, TPM2B_SENSITIVE_DATA, buffer, size)
 223 #define TPM2B_BUF_SIZE_STRUCT_MAKE(buf, size, struct_type, buffer_field, size_field) \
 224         _TPM2B_BUF_SIZE_STRUCT_MAKE(buf, size, UNIQ, struct_type, buffer_field, size_field)
 225 #define _TPM2B_BUF_SIZE_STRUCT_MAKE(buf, size, uniq, struct_type, buffer_field, size_field) \
 226         ({                                                              \
 227                 typeof(buf) UNIQ_T(BUF, uniq) = (buf);                  \
 228                 typeof(size) UNIQ_T(SIZE, uniq) = (size);               \
 229                 struct_type UNIQ_T(STRUCT, uniq) = { .size_field = UNIQ_T(SIZE, uniq), }; \
 230                 assert(sizeof(UNIQ_T(STRUCT, uniq).buffer_field) >= (size_t) UNIQ_T(SIZE, uniq)); \
 231                 if (UNIQ_T(BUF, uniq))                                  \
 232                         memcpy_safe(UNIQ_T(STRUCT, uniq).buffer_field, UNIQ_T(BUF, uniq), UNIQ_T(SIZE, uniq)); \
 233                 UNIQ_T(STRUCT, uniq);                                   \
 234         })
 235
 236 /* Check if the size will fit in the TPM2B struct buffer. Returns 0 if the size will fit, otherwise this logs
 237  * a debug message and returns < 0. */
 238 #define TPM2B_AUTH_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_AUTH, buffer)
 239 #define TPM2B_DATA_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_DATA, buffer)
 240 #define TPM2B_DIGEST_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_DIGEST, buffer)
 241 #define TPM2B_ECC_PARAMETER_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_ECC_PARAMETER, buffer)
 242 #define TPM2B_ENCRYPTED_SECRET_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_ENCRYPTED_SECRET, buffer)
 243 #define TPM2B_MAX_BUFFER_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_MAX_BUFFER, buffer)
 244 #define TPM2B_NAME_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_NAME, name)
 245 #define TPM2B_PRIVATE_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_PRIVATE, buffer)
 246 #define TPM2B_PRIVATE_KEY_RSA_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_PRIVATE_KEY_RSA, buffer)
 247 #define TPM2B_PUBLIC_KEY_RSA_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_PUBLIC_KEY_RSA, buffer)
 248 #define TPM2B_SENSITIVE_DATA_CHECK_SIZE(s) TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(s, TPM2B_SENSITIVE_DATA, buffer)
 249 #define TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(size, struct_type, buffer_field) \
 250         _TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(size, UNIQ, struct_type, buffer_field)
 251 #define _TPM2B_BUF_SIZE_STRUCT_CHECK_SIZE(size, uniq, struct_type, buffer_field) \
 252         ({                                                              \
 253                 size_t UNIQ_T(SIZE, uniq) = (size_t) (size);            \
 254                 size_t UNIQ_T(BUFSIZE, uniq) = sizeof_field(struct_type, buffer_field); \
 255                 UNIQ_T(BUFSIZE, uniq) < UNIQ_T(SIZE, uniq) ?            \
 256                         log_debug_errno(SYNTHETIC_ERRNO(EINVAL),        \
 257                                         "Size %zu larger than " #struct_type " buffer size %zu.", \
 258                                         UNIQ_T(SIZE, uniq), UNIQ_T(BUFSIZE, uniq)) : \
 259                         0;                                              \
 260         })
 261
 262 #else /* HAVE_TPM2 */
 263 typedef struct {} Tpm2Context;
 264 typedef struct {} Tpm2Handle;
 265 typedef struct {} Tpm2PCRValue;
 266
 267 #define TPM2_PCR_VALUE_MAKE(i, h, v) (Tpm2PCRValue) {}
 268 #endif /* HAVE_TPM2 */
 269
 270 int tpm2_list_devices(void);
 271 int tpm2_find_device_auto(int log_level, char **ret);
 272
 273 int tpm2_make_pcr_json_array(uint32_t pcr_mask, JsonVariant **ret);
 274 int tpm2_parse_pcr_json_array(JsonVariant *v, uint32_t *ret);
 275
 276 int tpm2_make_luks2_json(int keyslot, uint32_t hash_pcr_mask, uint16_t pcr_bank, const void *pubkey, size_t pubkey_size, uint32_t pubkey_pcr_mask, uint16_t primary_alg, const void *blob, size_t blob_size, const void *policy_hash, size_t policy_hash_size, const void *salt, size_t salt_size, const void *srk_buf, size_t srk_buf_size, TPM2Flags flags, JsonVariant **ret);
 277 int tpm2_parse_luks2_json(JsonVariant *v, int *ret_keyslot, uint32_t *ret_hash_pcr_mask, uint16_t *ret_pcr_bank, void **ret_pubkey, size_t *ret_pubkey_size, uint32_t *ret_pubkey_pcr_mask, uint16_t *ret_primary_alg, void **ret_blob, size_t *ret_blob_size, void **ret_policy_hash, size_t *ret_policy_hash_size, void **ret_salt, size_t *ret_salt_size, void **ret_srk_buf, size_t *ret_srk_buf_size, TPM2Flags *ret_flags);
 278
 279 /* Default to PCR 7 only */
 280 #define TPM2_PCR_INDEX_DEFAULT UINT32_C(7)
 281 #define TPM2_PCR_MASK_DEFAULT INDEX_TO_MASK(uint32_t, TPM2_PCR_INDEX_DEFAULT)
 282
 283 /* We want the helpers below to work also if TPM2 libs are not available, hence define these four defines if
 284  * they are missing. */
 285 #ifndef TPM2_ALG_SHA1
 286 #define TPM2_ALG_SHA1 0x4
 287 #endif
 288
 289 #ifndef TPM2_ALG_SHA256
 290 #define TPM2_ALG_SHA256 0xB
 291 #endif
 292
 293 #ifndef TPM2_ALG_SHA384
 294 #define TPM2_ALG_SHA384 0xC
 295 #endif
 296
 297 #ifndef TPM2_ALG_SHA512
 298 #define TPM2_ALG_SHA512 0xD
 299 #endif
 300
 301 #ifndef TPM2_ALG_ECC
 302 #define TPM2_ALG_ECC 0x23
 303 #endif
 304
 305 #ifndef TPM2_ALG_RSA
 306 #define TPM2_ALG_RSA 0x1
 307 #endif
 308
 309 int tpm2_hash_alg_to_size(uint16_t alg);
 310
 311 const char *tpm2_hash_alg_to_string(uint16_t alg) _const_;
 312 int tpm2_hash_alg_from_string(const char *alg) _pure_;
 313
 314 const char *tpm2_asym_alg_to_string(uint16_t alg) _const_;
 315 int tpm2_asym_alg_from_string(const char *alg) _pure_;
 316
 317 char *tpm2_pcr_mask_to_string(uint32_t mask);
 318
 319 typedef struct {
 320         uint32_t search_pcr_mask;
 321         const char *device;
 322         const char *signature_path;
 323 } systemd_tpm2_plugin_params;
 324
 325 typedef enum Tpm2Support {
 326         /* NOTE! The systemd-creds tool returns these flags 1:1 as exit status. Hence these flags are pretty
 327          * much ABI! Hence, be extra careful when changing/extending these definitions. */
 328         TPM2_SUPPORT_NONE      = 0,       /* no support */
 329         TPM2_SUPPORT_FIRMWARE  = 1 << 0,  /* firmware reports TPM2 was used */
 330         TPM2_SUPPORT_DRIVER    = 1 << 1,  /* the kernel has a driver loaded for it */
 331         TPM2_SUPPORT_SYSTEM    = 1 << 2,  /* we support it ourselves */
 332         TPM2_SUPPORT_SUBSYSTEM = 1 << 3,  /* the kernel has the tpm subsystem enabled */
 333         TPM2_SUPPORT_LIBRARIES = 1 << 4,  /* we can dlopen the tpm2 libraries */
 334         TPM2_SUPPORT_FULL      = TPM2_SUPPORT_FIRMWARE|TPM2_SUPPORT_DRIVER|TPM2_SUPPORT_SYSTEM|TPM2_SUPPORT_SUBSYSTEM|TPM2_SUPPORT_LIBRARIES,
 335 } Tpm2Support;
 336
 337 Tpm2Support tpm2_support(void);
 338
 339 int tpm2_parse_pcr_argument(const char *arg, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values);
 340 int tpm2_parse_pcr_argument_append(const char *arg, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values);
 341 int tpm2_parse_pcr_argument_to_mask(const char *arg, uint32_t *mask);
 342
 343 int tpm2_load_pcr_signature(const char *path, JsonVariant **ret);
 344 int tpm2_load_pcr_public_key(const char *path, void **ret_pubkey, size_t *ret_pubkey_size);
 345
 346 int tpm2_util_pbkdf2_hmac_sha256(const void *pass,
 347                     size_t passlen,
 348                     const void *salt,
 349                     size_t saltlen,
 350                     uint8_t res[static SHA256_DIGEST_SIZE]);
 351
 352 enum {
 353         /* Additional defines for the PCR index naming enum from "fundamental/tpm2-pcr.h" */
 354         _TPM2_PCR_INDEX_MAX_DEFINED = TPM2_PCRS_MAX,
 355         _TPM2_PCR_INDEX_INVALID     = -EINVAL,
 356 };
 357
 358 int tpm2_pcr_index_from_string(const char *s) _pure_;
 359 const char *tpm2_pcr_index_to_string(int pcr) _const_;