@@ -596,6 +596,113 @@ impl Context {
596
596
597
597
/// Cause conditional gating of a policy based on an authorized policy
598
598
/// stored in non-volatile memory.
599
+ ///
600
+ /// # Arguments
601
+ /// * `policy_session` - The [policy session][PolicySession] being extended.
602
+ /// * `auth_handle` - Handle indicating the source of authorization value.
603
+ /// * `nv_index_handle` - The [NvIndexHandle] associated with NV memory
604
+ /// where the policy is stored.
605
+ ///
606
+ /// # Example
607
+ /// ```rust
608
+ /// # use std::convert::TryFrom;
609
+ /// # use tss_esapi::attributes::{NvIndexAttributes, SessionAttributes};
610
+ /// # use tss_esapi::constants::SessionType;
611
+ /// # use tss_esapi::handles::NvIndexTpmHandle;
612
+ /// # use tss_esapi::interface_types::{
613
+ /// # algorithm::HashingAlgorithm,
614
+ /// # resource_handles::{NvAuth, Provision},
615
+ /// # session_handles::PolicySession,
616
+ /// # };
617
+ /// # use tss_esapi::structures::{NvPublic, SymmetricDefinition};
618
+ /// # use tss_esapi::{Context, TctiNameConf};
619
+ /// #
620
+ /// # let mut context = // ...
621
+ /// # Context::new(
622
+ /// # TctiNameConf::from_environment_variable().expect("Failed to get TCTI"),
623
+ /// # ).expect("Failed to create Context");
624
+ /// #
625
+ /// # // Set owner session for NV space definition
626
+ /// # let owner_auth_session = context
627
+ /// # .start_auth_session(
628
+ /// # None,
629
+ /// # None,
630
+ /// # None,
631
+ /// # SessionType::Hmac,
632
+ /// # SymmetricDefinition::AES_256_CFB,
633
+ /// # tss_esapi::interface_types::algorithm::HashingAlgorithm::Sha256,
634
+ /// # )
635
+ /// # .expect("Failed to create session")
636
+ /// # .expect("Received invalid handle");
637
+ /// # let (session_attributes, session_attributes_mask) = SessionAttributes::builder()
638
+ /// # .with_decrypt(true)
639
+ /// # .with_encrypt(true)
640
+ /// # .build();
641
+ /// # context.tr_sess_set_attributes(owner_auth_session, session_attributes, session_attributes_mask)
642
+ /// # .expect("Failed to set attributes on session");
643
+ /// # context.set_sessions((Some(owner_auth_session), None, None));
644
+ /// #
645
+ /// # let trial_session = context
646
+ /// # .start_auth_session(
647
+ /// # None,
648
+ /// # None,
649
+ /// # None,
650
+ /// # SessionType::Trial,
651
+ /// # SymmetricDefinition::AES_256_CFB,
652
+ /// # HashingAlgorithm::Sha256,
653
+ /// # )
654
+ /// # .expect("Start auth session failed")
655
+ /// # .expect("Start auth session returned a NONE handle");
656
+ /// #
657
+ /// # let (policy_auth_session_attributes, policy_auth_session_attributes_mask) =
658
+ /// # SessionAttributes::builder()
659
+ /// # .with_decrypt(true)
660
+ /// # .with_encrypt(true)
661
+ /// # .build();
662
+ /// # context
663
+ /// # .tr_sess_set_attributes(
664
+ /// # trial_session,
665
+ /// # policy_auth_session_attributes,
666
+ /// # policy_auth_session_attributes_mask,
667
+ /// # )
668
+ /// # .expect("tr_sess_set_attributes call failed");
669
+ /// #
670
+ /// # let policy_session = PolicySession::try_from(trial_session)
671
+ /// # .expect("Failed to convert auth session into policy session");
672
+ /// #
673
+ /// # let nv_index = NvIndexTpmHandle::new(0x01500600)
674
+ /// # .expect("Failed to create NV index tpm handle");
675
+ /// #
676
+ /// # // Create NV index attributes
677
+ /// # let owner_nv_index_attributes = NvIndexAttributes::builder()
678
+ /// # .with_owner_write(true)
679
+ /// # .with_owner_read(true)
680
+ /// # .build()
681
+ /// # .expect("Failed to create owner nv index attributes");
682
+ /// #
683
+ /// # // Create owner nv public.
684
+ /// # let owner_nv_public = NvPublic::builder()
685
+ /// # .with_nv_index(nv_index)
686
+ /// # .with_index_name_algorithm(HashingAlgorithm::Sha256)
687
+ /// # .with_index_attributes(owner_nv_index_attributes)
688
+ /// # .with_data_area_size(32)
689
+ /// # .build()
690
+ /// # .expect("Failed to build NvPublic for owner");
691
+ /// #
692
+ /// let nv_index_handle = context
693
+ /// .nv_define_space(Provision::Owner, None, owner_nv_public)
694
+ /// .expect("Call to nv_define_space failed");
695
+ ///
696
+ /// context.policy_authorize_nv(
697
+ /// policy_session,
698
+ /// NvAuth::Owner,
699
+ /// nv_index_handle,
700
+ /// ).expect("failed to extend policy with policy_authorize_nv");;
701
+ ///
702
+ /// # context
703
+ /// # .nv_undefine_space(Provision::Owner, nv_index_handle)
704
+ /// # .expect("Call to nv_undefine_space failed");
705
+ /// ```
599
706
pub fn policy_authorize_nv (
600
707
& mut self ,
601
708
policy_session : PolicySession ,
0 commit comments