/*
* Copyright (C) 2011-2012 Sansar Choinyambuu
- * Copyright (C) 2012-2014 Andreas Steffen
+ * Copyright (C) 2012-2016 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
#include <bio/bio_writer.h>
#include <bio/bio_reader.h>
-#ifdef TSS_TROUSERS
-#ifdef _BASETSD_H_
-/* MinGW defines _BASETSD_H_, but TSS checks for _BASETSD_H */
-# define _BASETSD_H
-#endif
-#include <trousers/tss.h>
-#include <trousers/trousers.h>
-#else
-#ifndef TPM_TAG_QUOTE_INFO2
-#define TPM_TAG_QUOTE_INFO2 0x0036
-#endif
-#ifndef TPM_LOC_ZERO
-#define TPM_LOC_ZERO 0x01
-#endif
-#endif
+#include <tpm_tss.h>
+#include <tpm_tss_trousers.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <errno.h>
+#ifndef TPM_TAG_QUOTE_INFO2
+#define TPM_TAG_QUOTE_INFO2 0x0036
+#endif
+#ifndef TPM_LOC_ZERO
+#define TPM_LOC_ZERO 0x01
+#endif
+
typedef struct private_pts_t private_pts_t;
/**
bool is_imc;
/**
- * Do we have an activated TPM
+ * Active TPM
*/
- bool has_tpm;
+ tpm_tss_t *tpm;
/**
* Contains a TPM_CAP_VERSION_INFO struct
chunk_t tpm_version_info;
/**
- * Contains TSS Blob structure for AIK
+ * AIK object handle
*/
- chunk_t aik_blob;
+ uint32_t aik_handle;
/**
- * Contains a Attestation Identity Key or Certificate
+ * Contains an Attestation Identity Key Certificate
*/
- certificate_t *aik;
+ certificate_t *aik_cert;
/**
* Primary key referening AIK in database
}
}
-
METHOD(pts_t, create_dh_nonce, bool,
private_pts_t *this, pts_dh_group_t group, int nonce_len)
{
return TRUE;
}
-#ifdef TSS_TROUSERS
-
-/**
- * Print TPM 1.2 Version Info
- */
-static void print_tpm_version_info(private_pts_t *this)
-{
- TPM_CAP_VERSION_INFO *info;
-
- info = (TPM_CAP_VERSION_INFO*)this->tpm_version_info.ptr;
-
- if (this->tpm_version_info.len >=
- sizeof(*info) - sizeof(info->vendorSpecific))
- {
- DBG2(DBG_PTS, "TPM Version Info: Chip Version: %u.%u.%u.%u, "
- "Spec Level: %u, Errata Rev: %u, Vendor ID: %.4s",
- info->version.major, info->version.minor,
- info->version.revMajor, info->version.revMinor,
- untoh16(&info->specLevel), info->errataRev, info->tpmVendorID);
- }
- else
- {
- DBG1(DBG_PTS, "could not parse tpm version info");
- }
-}
-
-#else
-
-static void print_tpm_version_info(private_pts_t *this)
-{
- DBG1(DBG_PTS, "unknown TPM version: no TSS implementation available");
-}
-
-#endif /* TSS_TROUSERS */
-
METHOD(pts_t, get_platform_id, int,
private_pts_t *this)
{
METHOD(pts_t, get_tpm_version_info, bool,
private_pts_t *this, chunk_t *info)
{
- if (!this->has_tpm)
- {
- return FALSE;
- }
- *info = this->tpm_version_info;
- print_tpm_version_info(this);
- return TRUE;
+ *info = this->tpm ? this->tpm->get_version_info(this->tpm) :
+ this->tpm_version_info;
+ return info->len > 0;
}
METHOD(pts_t, set_tpm_version_info, void,
private_pts_t *this, chunk_t info)
{
this->tpm_version_info = chunk_clone(info);
- print_tpm_version_info(this);
-}
-
-/**
- * Load an AIK Blob (TSS_TSPATTRIB_KEYBLOB_BLOB attribute)
- */
-static void load_aik_blob(private_pts_t *this)
-{
- char *path;
- chunk_t *map;
-
- path = lib->settings->get_str(lib->settings,
- "%s.plugins.imc-attestation.aik_blob", NULL, lib->ns);
- if (path)
- {
- map = chunk_map(path, FALSE);
- if (map)
- {
- DBG2(DBG_PTS, "loaded AIK Blob from '%s'", path);
- DBG3(DBG_PTS, "AIK Blob: %B", map);
- this->aik_blob = chunk_clone(*map);
- chunk_unmap(map);
- }
- else
- {
- DBG1(DBG_PTS, "unable to map AIK Blob file '%s': %s",
- path, strerror(errno));
- }
- }
- else
- {
- DBG1(DBG_PTS, "AIK Blob is not available");
- }
+ /* print_tpm_version_info(this); */
}
/**
- * Load an AIK certificate or public key
+ * Load an AIK handle and an optional AIK certificate and
+ * in the case of a TPM 1.2 an AIK private key blob plus matching public key,
* the certificate having precedence over the public key if both are present
*/
static void load_aik(private_pts_t *this)
{
- char *cert_path, *key_path;
+ char *handle_str, *cert_path, *key_path, *blob_path;
+ chunk_t aik_pubkey = chunk_empty;
+ handle_str = lib->settings->get_str(lib->settings,
+ "%s.plugins.imc-attestation.aik_handle", NULL, lib->ns);
cert_path = lib->settings->get_str(lib->settings,
"%s.plugins.imc-attestation.aik_cert", NULL, lib->ns);
key_path = lib->settings->get_str(lib->settings,
"%s.plugins.imc-attestation.aik_pubkey", NULL, lib->ns);
+ blob_path = lib->settings->get_str(lib->settings,
+ "%s.plugins.imc-attestation.aik_blob", NULL, lib->ns);
+ if (handle_str)
+ {
+ this->aik_handle = strtoll(handle_str, NULL, 16);
+ }
if (cert_path)
{
- this->aik = lib->creds->create(lib->creds, CRED_CERTIFICATE,
+ this->aik_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
CERT_X509, BUILD_FROM_FILE,
cert_path, BUILD_END);
- if (this->aik)
+ if (this->aik_cert)
{
DBG2(DBG_PTS, "loaded AIK certificate from '%s'", cert_path);
- return;
}
}
- if (key_path)
+
+ if (this->tpm->get_version(this->tpm) == TPM_VERSION_1_2)
{
- this->aik = lib->creds->create(lib->creds, CRED_CERTIFICATE,
- CERT_TRUSTED_PUBKEY, BUILD_FROM_FILE,
- key_path, BUILD_END);
- if (this->aik)
+ tpm_tss_trousers_t *tpm_12;
+ chunk_t aik_blob = chunk_empty;
+ chunk_t *map;
+
+ /* get AIK private key blob */
+ if (blob_path)
+ {
+ map = chunk_map(blob_path, FALSE);
+ if (map)
+ {
+ DBG2(DBG_PTS, "loaded AIK Blob from '%s'", blob_path);
+ DBG3(DBG_PTS, "AIK Blob: %B", map);
+ aik_blob = chunk_clone(*map);
+ chunk_unmap(map);
+ }
+ else
+ {
+ DBG1(DBG_PTS, "unable to map AIK Blob file '%s': %s",
+ blob_path, strerror(errno));
+ }
+ }
+ else
+ {
+ DBG1(DBG_PTS, "AIK Blob is not available");
+ }
+
+ /* get AIK public key */
+ if (key_path)
+ {
+ map = chunk_map(key_path, FALSE);
+ if (map)
+ {
+ DBG2(DBG_PTS, "loaded AIK public key from '%s'", key_path);
+ aik_pubkey = chunk_clone(*map);
+ chunk_unmap(map);
+ }
+ else
+ {
+ DBG1(DBG_PTS, "unable to map AIK public key file '%s': %s",
+ key_path, strerror(errno));
+ }
+ }
+ else
{
- DBG2(DBG_PTS, "loaded AIK public key from '%s'", key_path);
- return;
+ DBG1(DBG_PTS, "AIK public key is not available");
}
+
+ /* Load AIK item into TPM 1.2 object */
+ tpm_12 = (tpm_tss_trousers_t *)this->tpm;
+ tpm_12->load_aik(tpm_12, aik_blob, aik_pubkey, this->aik_handle);
}
- DBG1(DBG_PTS, "neither AIK certificate nor public key is available");
+ /* if no signed X.509 AIK certificate is available use public key instead */
+ if (!this->aik_cert)
+ {
+ aik_pubkey = this->tpm->get_public(this->tpm, this->aik_handle);
+ if (aik_pubkey.len > 0)
+ {
+ this->aik_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
+ CERT_TRUSTED_PUBKEY, BUILD_BLOB,
+ aik_pubkey, BUILD_END);
+ chunk_free(&aik_pubkey);
+ }
+ else
+ {
+ DBG1(DBG_PTS, "neither AIK certificate nor public key is available");
+ }
+ }
}
METHOD(pts_t, get_aik, certificate_t*,
private_pts_t *this)
{
- return this->aik;
+ return this->aik_cert;
}
METHOD(pts_t, set_aik, void,
private_pts_t *this, certificate_t *aik, int aik_id)
{
- DESTROY_IF(this->aik);
- this->aik = aik->get_ref(aik);
+ DESTROY_IF(this->aik_cert);
+ this->aik_cert = aik->get_ref(aik);
this->aik_id = aik_id;
}
return metadata;
}
-
-#ifdef TSS_TROUSERS
-
METHOD(pts_t, read_pcr, bool,
- private_pts_t *this, uint32_t pcr_num, chunk_t *pcr_value)
+ private_pts_t *this, uint32_t pcr_num, chunk_t *pcr_value,
+ hash_algorithm_t alg)
{
- TSS_HCONTEXT hContext;
- TSS_HTPM hTPM;
- TSS_RESULT result;
- BYTE *buf;
- UINT32 len;
-
- bool success = FALSE;
-
- result = Tspi_Context_Create(&hContext);
- if (result != TSS_SUCCESS)
- {
- DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x", result);
- return FALSE;
- }
-
- result = Tspi_Context_Connect(hContext, NULL);
- if (result != TSS_SUCCESS)
- {
- goto err;
- }
- result = Tspi_Context_GetTpmObject (hContext, &hTPM);
- if (result != TSS_SUCCESS)
- {
- goto err;
- }
- result = Tspi_TPM_PcrRead(hTPM, pcr_num, &len, &buf);
- if (result != TSS_SUCCESS)
- {
- goto err;
- }
- *pcr_value = chunk_clone(chunk_create(buf, len));
- DBG3(DBG_PTS, "PCR %d value:%B", pcr_num, pcr_value);
- success = TRUE;
-
-err:
- if (!success)
- {
- DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
- }
- Tspi_Context_FreeMemory(hContext, NULL);
- Tspi_Context_Close(hContext);
-
- return success;
+ return this->tpm ? this->tpm->read_pcr(this->tpm, pcr_num, pcr_value, alg)
+ : FALSE;
}
METHOD(pts_t, extend_pcr, bool,
- private_pts_t *this, uint32_t pcr_num, chunk_t input, chunk_t *output)
+ private_pts_t *this, uint32_t pcr_num, chunk_t *pcr_value, chunk_t data,
+ hash_algorithm_t alg)
{
- TSS_HCONTEXT hContext;
- TSS_HTPM hTPM;
- TSS_RESULT result;
- uint32_t pcr_length;
- chunk_t pcr_value = chunk_empty;
-
- result = Tspi_Context_Create(&hContext);
- if (result != TSS_SUCCESS)
+ if (!this->tpm->extend_pcr(this->tpm, pcr_num, pcr_value, data, alg))
{
- DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x",
- result);
return FALSE;
}
- result = Tspi_Context_Connect(hContext, NULL);
- if (result != TSS_SUCCESS)
- {
- goto err;
- }
- result = Tspi_Context_GetTpmObject (hContext, &hTPM);
- if (result != TSS_SUCCESS)
- {
- goto err;
- }
-
- pcr_value = chunk_alloc(PTS_PCR_LEN);
- result = Tspi_TPM_PcrExtend(hTPM, pcr_num, PTS_PCR_LEN, input.ptr,
- NULL, &pcr_length, &pcr_value.ptr);
- if (result != TSS_SUCCESS)
- {
- goto err;
- }
-
- *output = pcr_value;
- *output = chunk_clone(*output);
-
- DBG3(DBG_PTS, "PCR %d extended with: %B", pcr_num, &input);
- DBG3(DBG_PTS, "PCR %d value after extend: %B", pcr_num, output);
-
- chunk_clear(&pcr_value);
- Tspi_Context_FreeMemory(hContext, NULL);
- Tspi_Context_Close(hContext);
+ DBG3(DBG_PTS, "PCR %d extended with: %#B", pcr_num, &data);
+ DBG3(DBG_PTS, "PCR %d after extension: %#B", pcr_num, pcr_value);
return TRUE;
-
-err:
- DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
-
- chunk_clear(&pcr_value);
- Tspi_Context_FreeMemory(hContext, NULL);
- Tspi_Context_Close(hContext);
-
- return FALSE;
}
METHOD(pts_t, quote_tpm, bool,
- private_pts_t *this, bool use_quote2, chunk_t *pcr_comp, chunk_t *quote_sig)
+ private_pts_t *this, bool use_quote2, bool use_version_info,
+ chunk_t *pcr_comp, chunk_t *quote_sig)
{
- TSS_HCONTEXT hContext;
- TSS_HTPM hTPM;
- TSS_HKEY hAIK;
- TSS_HKEY hSRK;
- TSS_HPOLICY srkUsagePolicy;
- TSS_UUID SRK_UUID = TSS_UUID_SRK;
- BYTE secret[] = TSS_WELL_KNOWN_SECRET;
- TSS_HPCRS hPcrComposite;
- TSS_VALIDATION valData;
- TSS_RESULT result;
- chunk_t quote_info;
- BYTE* versionInfo;
- uint32_t versionInfoSize, pcr;
+ chunk_t pcr_value;
+ uint32_t pcr, pcr_sel = 0;
enumerator_t *enumerator;
- bool success = FALSE;
+ tpm_quote_mode_t quote_mode;
- result = Tspi_Context_Create(&hContext);
- if (result != TSS_SUCCESS)
- {
- DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x",
- result);
- return FALSE;
- }
- result = Tspi_Context_Connect(hContext, NULL);
- if (result != TSS_SUCCESS)
- {
- goto err1;
- }
- result = Tspi_Context_GetTpmObject (hContext, &hTPM);
- if (result != TSS_SUCCESS)
- {
- goto err1;
- }
-
- /* Retrieve SRK from TPM and set the authentication to well known secret*/
- result = Tspi_Context_LoadKeyByUUID(hContext, TSS_PS_TYPE_SYSTEM,
- SRK_UUID, &hSRK);
- if (result != TSS_SUCCESS)
- {
- goto err1;
- }
-
- result = Tspi_GetPolicyObject(hSRK, TSS_POLICY_USAGE, &srkUsagePolicy);
- if (result != TSS_SUCCESS)
- {
- goto err1;
- }
- result = Tspi_Policy_SetSecret(srkUsagePolicy, TSS_SECRET_MODE_SHA1,
- 20, secret);
- if (result != TSS_SUCCESS)
- {
- goto err1;
- }
-
- result = Tspi_Context_LoadKeyByBlob (hContext, hSRK, this->aik_blob.len,
- this->aik_blob.ptr, &hAIK);
- if (result != TSS_SUCCESS)
- {
- goto err1;
- }
-
- /* Create PCR composite object */
- result = use_quote2 ?
- Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_PCRS,
- TSS_PCRS_STRUCT_INFO_SHORT, &hPcrComposite) :
- Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_PCRS,
- TSS_PCRS_STRUCT_DEFAULT, &hPcrComposite);
- if (result != TSS_SUCCESS)
- {
- goto err2;
- }
-
- /* Select PCRs */
+ /* select PCRs */
+ DBG2(DBG_PTS, "PCR values hashed into PCR Composite:");
enumerator = this->pcrs->create_enumerator(this->pcrs);
while (enumerator->enumerate(enumerator, &pcr))
{
- result = use_quote2 ?
- Tspi_PcrComposite_SelectPcrIndexEx(hPcrComposite, pcr,
- TSS_PCRS_DIRECTION_RELEASE) :
- Tspi_PcrComposite_SelectPcrIndex(hPcrComposite, pcr);
- if (result != TSS_SUCCESS)
+ if (this->tpm->read_pcr(this->tpm, pcr, &pcr_value, HASH_SHA1))
{
- break;
- }
- }
- enumerator->destroy(enumerator);
+ DBG2(DBG_PTS, "PCR %2d %#B", pcr, &pcr_value);
+ chunk_free(&pcr_value);
+ };
- if (result != TSS_SUCCESS)
- {
- goto err3;
+ /* add PCR to selection list */
+ pcr_sel |= (1 << pcr);
}
+ enumerator->destroy(enumerator);
- /* Set the Validation Data */
- valData.ulExternalDataLength = this->secret.len;
- valData.rgbExternalData = (BYTE *)this->secret.ptr;
-
+ quote_mode = use_quote2 ? (use_version_info ? TPM_QUOTE2_VERSION_INFO :
+ TPM_QUOTE2) : TPM_QUOTE;
/* TPM Quote */
- result = use_quote2 ?
- Tspi_TPM_Quote2(hTPM, hAIK, FALSE, hPcrComposite, &valData,
- &versionInfoSize, &versionInfo):
- Tspi_TPM_Quote(hTPM, hAIK, hPcrComposite, &valData);
- if (result != TSS_SUCCESS)
- {
- goto err4;
- }
-
- /* Set output chunks */
- *pcr_comp = chunk_alloc(HASH_SIZE_SHA1);
-
- if (use_quote2)
- {
- /* TPM_Composite_Hash is last 20 bytes of TPM_Quote_Info2 structure */
- memcpy(pcr_comp->ptr, valData.rgbData + valData.ulDataLength - HASH_SIZE_SHA1,
- HASH_SIZE_SHA1);
- }
- else
- {
- /* TPM_Composite_Hash is 8-28th bytes of TPM_Quote_Info structure */
- memcpy(pcr_comp->ptr, valData.rgbData + 8, HASH_SIZE_SHA1);
- }
- DBG3(DBG_PTS, "Hash of PCR Composite: %#B", pcr_comp);
-
- quote_info = chunk_create(valData.rgbData, valData.ulDataLength);
- DBG3(DBG_PTS, "TPM Quote Info: %B","e_info);
-
- *quote_sig = chunk_clone(chunk_create(valData.rgbValidationData,
- valData.ulValidationDataLength));
- DBG3(DBG_PTS, "TPM Quote Signature: %B",quote_sig);
-
- success = TRUE;
-
- /* Cleanup */
-err4:
- Tspi_Context_FreeMemory(hContext, NULL);
-
-err3:
- Tspi_Context_CloseObject(hContext, hPcrComposite);
-
-err2:
- Tspi_Context_CloseObject(hContext, hAIK);
-
-err1:
- Tspi_Context_Close(hContext);
- if (!success)
- {
- DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
- }
- return success;
+ return this->tpm->quote(this->tpm, this->aik_handle, pcr_sel, HASH_SHA1,
+ this->secret, quote_mode, pcr_comp, quote_sig);
}
-#else /* TSS_TROUSERS */
-
-METHOD(pts_t, read_pcr, bool,
- private_pts_t *this, uint32_t pcr_num, chunk_t *pcr_value)
-{
- return FALSE;
-}
-
-METHOD(pts_t, extend_pcr, bool,
- private_pts_t *this, uint32_t pcr_num, chunk_t input, chunk_t *output)
-{
- return FALSE;
-}
-
-METHOD(pts_t, quote_tpm, bool,
- private_pts_t *this, bool use_quote2, chunk_t *pcr_comp, chunk_t *quote_sig)
-{
- return FALSE;
-}
-
-#endif /* TSS_TROUSERS */
-
/**
* TPM_QUOTE_INFO structure:
* 4 bytes of version
*/
METHOD(pts_t, get_quote_info, bool,
- private_pts_t *this, bool use_quote2, bool use_ver_info,
+ private_pts_t *this, bool use_quote2, bool use_version_info,
pts_meas_algorithms_t comp_hash_algo,
chunk_t *out_pcr_comp, chunk_t *out_quote_info)
{
"unable to construct TPM Quote Info");
return FALSE;
}
- if (use_quote2 && use_ver_info && !this->tpm_version_info.ptr)
+ if (use_quote2 && use_version_info && !this->tpm_version_info.ptr)
{
DBG1(DBG_PTS, "TPM Version Information unavailable, ",
"unable to construct TPM Quote Info2");
/* PCR Composite Hash */
writer->write_data(writer, hash_pcr_comp);
- if (use_ver_info)
+ if (use_version_info)
{
/* TPM version Info */
writer->write_data(writer, this->tpm_version_info);
METHOD(pts_t, verify_quote_signature, bool,
private_pts_t *this, chunk_t data, chunk_t signature)
{
- public_key_t *aik_pub_key;
+ public_key_t *aik_pubkey;
- aik_pub_key = this->aik->get_public_key(this->aik);
- if (!aik_pub_key)
+ aik_pubkey = this->aik_cert->get_public_key(this->aik_cert);
+ if (!aik_pubkey)
{
DBG1(DBG_PTS, "failed to get public key from AIK certificate");
return FALSE;
}
- if (!aik_pub_key->verify(aik_pub_key, SIGN_RSA_EMSA_PKCS1_SHA1,
+ if (!aik_pubkey->verify(aik_pubkey, SIGN_RSA_EMSA_PKCS1_SHA1,
data, signature))
{
DBG1(DBG_PTS, "signature verification failed for TPM Quote Info");
- DESTROY_IF(aik_pub_key);
+ DESTROY_IF(aik_pubkey);
return FALSE;
}
- aik_pub_key->destroy(aik_pub_key);
+ aik_pubkey->destroy(aik_pubkey);
return TRUE;
}
METHOD(pts_t, destroy, void,
private_pts_t *this)
{
+ DESTROY_IF(this->tpm);
DESTROY_IF(this->pcrs);
- DESTROY_IF(this->aik);
+ DESTROY_IF(this->aik_cert);
DESTROY_IF(this->dh);
free(this->initiator_nonce.ptr);
free(this->responder_nonce.ptr);
free(this->secret.ptr);
- free(this->aik_blob.ptr);
free(this->tpm_version_info.ptr);
free(this);
}
-
-#ifdef TSS_TROUSERS
-
-/**
- * Check for a TPM by querying for TPM Version Info
- */
-static bool has_tpm(private_pts_t *this)
-{
- TSS_HCONTEXT hContext;
- TSS_HTPM hTPM;
- TSS_RESULT result;
- uint32_t version_info_len;
-
- result = Tspi_Context_Create(&hContext);
- if (result != TSS_SUCCESS)
- {
- DBG1(DBG_PTS, "TPM context could not be created: tss error 0x%x",
- result);
- return FALSE;
- }
- result = Tspi_Context_Connect(hContext, NULL);
- if (result != TSS_SUCCESS)
- {
- goto err;
- }
- result = Tspi_Context_GetTpmObject (hContext, &hTPM);
- if (result != TSS_SUCCESS)
- {
- goto err;
- }
- result = Tspi_TPM_GetCapability(hTPM, TSS_TPMCAP_VERSION_VAL, 0, NULL,
- &version_info_len,
- &this->tpm_version_info.ptr);
- this->tpm_version_info.len = version_info_len;
- if (result != TSS_SUCCESS)
- {
- goto err;
- }
- this->tpm_version_info = chunk_clone(this->tpm_version_info);
-
- Tspi_Context_FreeMemory(hContext, NULL);
- Tspi_Context_Close(hContext);
- return TRUE;
-
- err:
- DBG1(DBG_PTS, "TPM not available: tss error 0x%x", result);
- Tspi_Context_FreeMemory(hContext, NULL);
- Tspi_Context_Close(hContext);
- return FALSE;
-}
-
-#else /* TSS_TROUSERS */
-
-static bool has_tpm(private_pts_t *this)
-{
- return FALSE;
-}
-
-#endif /* TSS_TROUSERS */
-
-
/**
* See header
*/
if (is_imc)
{
- if (has_tpm(this))
+ this->tpm = tpm_tss_probe(TPM_VERSION_ANY);
+ if (this->tpm)
{
- this->has_tpm = TRUE;
this->proto_caps |= PTS_PROTO_CAPS_T | PTS_PROTO_CAPS_D;
load_aik(this);
- load_aik_blob(this);
}
}
else
#ifdef TSS_TROUSERS
+#ifdef _BASETSD_H_
+/* MinGW defines _BASETSD_H_, but TSS checks for _BASETSD_H */
+# define _BASETSD_H
+#endif
+
#include <trousers/tss.h>
#include <trousers/trousers.h>
#define LABEL "TPM 1.2 -"
/* size in bytes of a TSS AIK public key blob */
-#define AIK_PUBKEY_BLOB_SIZE 284
+#define AIK_PUBKEY_BLOB_SIZE 284
+
+/* maximum number of PCR registers */
+#define PCR_NUM_MAX 24
typedef struct private_tpm_tss_trousers_t private_tpm_tss_trousers_t;
+typedef struct aik_t aik_t;
/**
* Private data of an tpm_tss_trousers_t object.
/**
* Public tpm_tss_trousers_t interface.
*/
- tpm_tss_t public;
+ tpm_tss_trousers_t interface;
/**
* TSS context
*/
TSS_HCONTEXT hContext;
+ /**
+ * TPM handle
+ */
+ TSS_HTPM hTPM;
+
/**
* TPM version info
*/
chunk_t version_info;
+ /**
+ * List of AIKs retrievable by an object handle
+ */
+ linked_list_t *aik_list;
+
};
+struct aik_t {
+ /** AIK object handle */
+ uint32_t handle;
+
+ /** AIK private key blob */
+ chunk_t blob;
+
+ /** AIK public key */
+ chunk_t pubkey;
+};
+
+static void free_aik(aik_t *this)
+{
+ free(this->blob.ptr);
+ free(this->pubkey.ptr);
+ free(this);
+}
+
/**
* Initialize TSS context
*
uint8_t *version_ptr;
uint32_t version_len;
- TSS_HTPM hTPM;
TSS_RESULT result;
TPM_CAP_VERSION_INFO *info;
return FALSE;
}
- result = Tspi_Context_GetTpmObject (this->hContext, &hTPM);
+ result = Tspi_Context_GetTpmObject (this->hContext, &this->hTPM);
if (result != TSS_SUCCESS)
{
DBG1(DBG_PTS, "%s could not get TPM object: 0x%x",
return FALSE;
}
- result = Tspi_TPM_GetCapability(hTPM, TSS_TPMCAP_VERSION_VAL, 0, NULL,
- &version_len, &version_ptr);
+ result = Tspi_TPM_GetCapability(this->hTPM, TSS_TPMCAP_VERSION_VAL, 0,
+ NULL, &version_len, &version_ptr);
if (result != TSS_SUCCESS)
{
DBG1(DBG_PTS, "%s Tspi_TPM_GetCapability failed: 0x%x",
chunk_t aik_exponent;
TSS_RESULT result;
- TSS_HTPM hTPM;
TSS_HKEY hSRK;
TSS_HKEY hPCAKey;
TSS_HPOLICY hSrkPolicy;
}
/* get TPM plus TPM policy and set TPM secret */
- result = Tspi_Context_GetTpmObject (this->hContext, &hTPM);
+ result = Tspi_Context_GetTpmObject (this->hContext, &this->hTPM);
if (result != TSS_SUCCESS)
{
DBG1(DBG_PTS, "%s Tspi_Context_GetTpmObject failed: 0x%x",
LABEL, result);
return FALSE;
}
- result = Tspi_GetPolicyObject(hTPM, TSS_POLICY_USAGE, &hTPMPolicy);
+ result = Tspi_GetPolicyObject(this->hTPM, TSS_POLICY_USAGE, &hTPMPolicy);
if (result != TSS_SUCCESS)
{
DBG1(DBG_PTS, "%s Tspi_GetPolicyObject for TPM failed: 0x%x",
/* generate AIK */
DBG1(DBG_LIB, "Generating identity key...");
- result = Tspi_TPM_CollateIdentityRequest(hTPM, hSRK, hPCAKey, 0, NULL,
+ result = Tspi_TPM_CollateIdentityRequest(this->hTPM, hSRK, hPCAKey, 0, NULL,
hIdentKey, TSS_ALG_AES, &IdentityReqLen, &IdentityReq);
if (result != TSS_SUCCESS)
{
METHOD(tpm_tss_t, get_public, chunk_t,
private_tpm_tss_trousers_t *this, uint32_t handle)
{
- return chunk_empty;
+ enumerator_t *enumerator;
+ chunk_t aik_pubkey = chunk_empty;
+ aik_t *aik;
+
+ enumerator = this->aik_list->create_enumerator(this->aik_list);
+ while (enumerator->enumerate(enumerator, &aik))
+ {
+ if (aik->handle == handle)
+ {
+ aik_pubkey = chunk_clone(aik->pubkey);
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ return aik_pubkey;
+}
+
+METHOD(tpm_tss_t, read_pcr, bool,
+ private_tpm_tss_trousers_t *this, uint32_t pcr_num, chunk_t *pcr_value,
+ hash_algorithm_t alg)
+{
+ TSS_RESULT result;
+ uint8_t *value;
+ uint32_t len;
+
+ result = Tspi_TPM_PcrRead(this->hTPM, pcr_num, &len, &value);
+ if (result != TSS_SUCCESS)
+ {
+ DBG1(DBG_PTS, "%s Tspi_TPM_PcrRead failed: 0x%x", LABEL, result);
+ return FALSE;
+ }
+ *pcr_value = chunk_clone(chunk_create(value, len));
+
+ return TRUE;
+}
+
+METHOD(tpm_tss_t, extend_pcr, bool,
+ private_tpm_tss_trousers_t *this, uint32_t pcr_num, chunk_t *pcr_value,
+ chunk_t data, hash_algorithm_t alg)
+{
+ TSS_RESULT result;
+ uint32_t pcr_len;
+ uint8_t *pcr_ptr;
+
+ result = Tspi_TPM_PcrExtend(this->hTPM, pcr_num, data.len, data.ptr,
+ NULL, &pcr_len, &pcr_ptr);
+ if (result != TSS_SUCCESS)
+ {
+ DBG1(DBG_PTS, "%s Tspi_TPM_PcrExtend failed: 0x%x", LABEL, result);
+ return FALSE;
+ }
+ *pcr_value = chunk_clone(chunk_create(pcr_ptr, pcr_len));
+
+ return TRUE;
+}
+
+METHOD(tpm_tss_t, quote, bool,
+ private_tpm_tss_trousers_t *this, uint32_t aik_handle, uint32_t pcr_sel,
+ hash_algorithm_t alg, chunk_t data, tpm_quote_mode_t mode, chunk_t *pcr_comp,
+ chunk_t *quote_sig)
+{
+ TSS_HKEY hAIK;
+ TSS_HKEY hSRK;
+ TSS_HPOLICY srkUsagePolicy;
+ TSS_UUID SRK_UUID = TSS_UUID_SRK;
+ TSS_HPCRS hPcrComposite;
+ TSS_VALIDATION valData;
+ TSS_RESULT result;
+ uint8_t secret[] = TSS_WELL_KNOWN_SECRET;
+ uint8_t *version_info, *comp_hash;
+ uint32_t version_info_size, pcr;
+ aik_t *aik;
+ chunk_t aik_blob = chunk_empty;
+ chunk_t quote_info;
+ enumerator_t *enumerator;
+ bool success = FALSE;
+
+ /* Retrieve SRK from TPM and set the authentication to well known secret*/
+ result = Tspi_Context_LoadKeyByUUID(this->hContext, TSS_PS_TYPE_SYSTEM,
+ SRK_UUID, &hSRK);
+ if (result != TSS_SUCCESS)
+ {
+ DBG1(DBG_PTS, "%s Tspi_Context_LoadKeyByUUID for SRK failed: 0x%x",
+ LABEL, result);
+ return FALSE;
+ }
+ result = Tspi_GetPolicyObject(hSRK, TSS_POLICY_USAGE, &srkUsagePolicy);
+ if (result != TSS_SUCCESS)
+ {
+ DBG1(DBG_PTS, "%s Tspi_GetPolicyObject for SRK failed: 0x%x",
+ LABEL, result);
+ return FALSE;
+ }
+ result = Tspi_Policy_SetSecret(srkUsagePolicy, TSS_SECRET_MODE_SHA1,
+ 20, secret);
+ if (result != TSS_SUCCESS)
+ {
+ DBG1(DBG_PTS, "%s Tspi_Policy_SetSecret for SRK failed: 0x%x",
+ LABEL, result);
+ return FALSE;
+ }
+
+ /* Retrieve AIK using its handle and load private key into TPM 1.2 */
+ enumerator = this->aik_list->create_enumerator(this->aik_list);
+ while (enumerator->enumerate(enumerator, &aik))
+ {
+ if (aik->handle == aik_handle)
+ {
+ aik_blob = aik->blob;
+ break;
+ }
+ }
+ enumerator->destroy(enumerator);
+
+ if (aik_blob.len == 0)
+ {
+ DBG1(DBG_PTS, "%s AIK private key for handle 0x%80x not found", LABEL);
+ return FALSE;
+ }
+ result = Tspi_Context_LoadKeyByBlob(this->hContext, hSRK, aik_blob.len,
+ aik_blob.ptr, &hAIK);
+ if (result != TSS_SUCCESS)
+ {
+ DBG1(DBG_PTS, "%s Tspi_Context_LoadKeyByBlob for AIK failed: 0x%x",
+ LABEL, result);
+ return FALSE;
+ }
+
+ /* Create PCR composite object */
+ result = Tspi_Context_CreateObject(this->hContext, TSS_OBJECT_TYPE_PCRS,
+ (mode == TPM_QUOTE) ? TSS_PCRS_STRUCT_INFO :
+ TSS_PCRS_STRUCT_INFO_SHORT,
+ &hPcrComposite);
+ if (result != TSS_SUCCESS)
+ {
+ DBG1(DBG_PTS, "%s Tspi_Context_CreateObject for pcrComposite failed: "
+ "0x%x", LABEL, result);
+ goto err1;
+ }
+
+ /* Select PCRs */
+ for (pcr = 0; pcr < PCR_NUM_MAX; pcr++)
+ {
+ if (pcr_sel & (1 << pcr))
+ {
+ result = (mode == TPM_QUOTE) ?
+ Tspi_PcrComposite_SelectPcrIndex(hPcrComposite, pcr) :
+ Tspi_PcrComposite_SelectPcrIndexEx(hPcrComposite, pcr,
+ TSS_PCRS_DIRECTION_RELEASE);
+ if (result != TSS_SUCCESS)
+ {
+ DBG1(DBG_PTS, "%s Tspi_PcrComposite_SelectPcrIndex failed: "
+ "0x%x", LABEL, result);
+ goto err2;
+ }
+ }
+ }
+
+ /* Set the Validation Data */
+ valData.ulExternalDataLength = data.len;
+ valData.rgbExternalData = data.ptr;
+
+ /* TPM Quote */
+ result = (mode == TPM_QUOTE) ?
+ Tspi_TPM_Quote (this->hTPM, hAIK, hPcrComposite, &valData) :
+ Tspi_TPM_Quote2(this->hTPM, hAIK, mode == TPM_QUOTE2_VERSION_INFO,
+ hPcrComposite, &valData, &version_info_size,
+ &version_info);
+ if (result != TSS_SUCCESS)
+ {
+ DBG1(DBG_PTS, "%s Tspi_TPM_Quote%s failed: 0x%x", LABEL,
+ (mode == TPM_QUOTE) ? "" : "2", result);
+ goto err2;
+ }
+
+ /* Extract TPM_Composite_Hash */
+ *pcr_comp = chunk_alloc(HASH_SIZE_SHA1);
+
+ if (mode == TPM_QUOTE)
+ {
+ /* TPM_Composite_Hash starts at byte 8 of TPM_Quote_Info structure */
+ comp_hash = valData.rgbData + 8;
+ }
+ else
+ {
+ /* TPM_Composite_Hash is last 20 bytes of TPM_Quote_Info2 structure */
+ comp_hash = valData.rgbData + valData.ulDataLength - version_info_size -
+ HASH_SIZE_SHA1;
+ }
+ memcpy(pcr_comp->ptr, comp_hash, HASH_SIZE_SHA1);
+ DBG3(DBG_PTS, "Hash of PCR Composite: %#B", pcr_comp);
+
+ quote_info = chunk_create(valData.rgbData, valData.ulDataLength);
+ DBG3(DBG_PTS, "TPM Quote Info: %B","e_info);
+
+ *quote_sig = chunk_clone(chunk_create(valData.rgbValidationData,
+ valData.ulValidationDataLength));
+ DBG3(DBG_PTS, "TPM Quote Signature: %B",quote_sig);
+
+ success = TRUE;
+
+err2:
+ Tspi_Context_CloseObject(this->hContext, hPcrComposite);
+err1:
+ Tspi_Context_CloseObject(this->hContext, hAIK);
+
+ return success;
}
METHOD(tpm_tss_t, destroy, void,
private_tpm_tss_trousers_t *this)
{
finalize_context(this);
+ this->aik_list->destroy_function(this->aik_list, (void*)free_aik);
free(this->version_info.ptr);
free(this);
}
+METHOD(tpm_tss_trousers_t, load_aik, void,
+ private_tpm_tss_trousers_t *this, chunk_t blob, chunk_t pubkey,
+ uint32_t handle)
+{
+ aik_t *item;
+
+ INIT(item,
+ .handle = handle,
+ .blob = blob,
+ .pubkey = pubkey,
+ );
+
+ this->aik_list->insert_last(this->aik_list, item);
+}
+
/**
* See header
*/
bool available;
INIT(this,
- .public = {
- .get_version = _get_version,
- .get_version_info = _get_version_info,
- .generate_aik = _generate_aik,
- .get_public = _get_public,
- .destroy = _destroy,
+ .interface = {
+ .public = {
+ .get_version = _get_version,
+ .get_version_info = _get_version_info,
+ .generate_aik = _generate_aik,
+ .get_public = _get_public,
+ .read_pcr = _read_pcr,
+ .quote = _quote,
+ .extend_pcr = _extend_pcr,
+ .destroy = _destroy,
+ },
+ .load_aik = _load_aik,
},
+ .aik_list = linked_list_create(),
);
available = initialize_context(this);
destroy(this);
return NULL;
}
- return &this->public;
+ return &this->interface.public;
}
#else /* TSS_TROUSERS */
projects / people / ms / strongswan.git / commitdiff
