|
| 1 | +/* SPDX-License-Identifier: BSD-3-Clause */ |
| 2 | + |
| 3 | +#include <inttypes.h> |
| 4 | +#include <stdbool.h> |
| 5 | +#include <stdio.h> |
| 6 | +#include <string.h> |
| 7 | + |
| 8 | +#include <tss2/tss2_policy.h> |
| 9 | + |
| 10 | +#include "log.h" |
| 11 | +#include "tpm2_tool.h" |
| 12 | +#include "tpm2_util.h" |
| 13 | + |
| 14 | +typedef struct tpm2_policy_ctx tpm2_policy_ctx; |
| 15 | +struct tpm2_policy_ctx { |
| 16 | + ifapi_policyeval_INST_CB cb; |
| 17 | + const char *policy_file; |
| 18 | +}; |
| 19 | + |
| 20 | +static tpm2_policy_ctx ctx; |
| 21 | + |
| 22 | +static bool on_arg(int argc, char *argv[]) { |
| 23 | + |
| 24 | + if (argc != 1) { |
| 25 | + LOG_ERR("Expected single file path argument"); |
| 26 | + return false; |
| 27 | + } |
| 28 | + |
| 29 | + ctx.policy_file = argv[0]; |
| 30 | + |
| 31 | + return true; |
| 32 | +} |
| 33 | + |
| 34 | +static bool tpm2_tool_onstart(tpm2_options **opts) { |
| 35 | +// static const struct option topts[] = { |
| 36 | +// { "type", required_argument, NULL, 't' }, |
| 37 | +// { "format", required_argument, NULL, 'f' }, |
| 38 | +// }; |
| 39 | + |
| 40 | + *opts = tpm2_options_new(NULL, 0, NULL, NULL, on_arg, |
| 41 | + 0); |
| 42 | + |
| 43 | + return *opts != NULL; |
| 44 | +} |
| 45 | + |
| 46 | +static tool_rc tpm2_tool_onrun(ESYS_CONTEXT *ectx, tpm2_option_flags flags) { |
| 47 | + UNUSED(flags); |
| 48 | + |
| 49 | + TPMS_POLICY *policy_ctx; |
| 50 | + |
| 51 | + TSS2_RC rc = Tss2_PolicyInstantiate( |
| 52 | + ctx.policy_file, |
| 53 | + &ctx.cb, |
| 54 | + &policy_ctx); |
| 55 | + if (rc) { |
| 56 | + LOG_ERR("Instantiate failed"); |
| 57 | + return tool_rc_general_error; |
| 58 | + } |
| 59 | + |
| 60 | + rc = Tss2_PolicyCalculate( |
| 61 | + policy_ctx->policy, /* could we just pass context and drop these? */ |
| 62 | + &policy_ctx->policyDigests, /* same as above */ |
| 63 | + TPM2_ALG_SHA256, |
| 64 | + 32, /* this could be computed from alg... */ |
| 65 | + 0); /* I can't figure out what this is for, looks like some kind of recursion in the tss2 lib */ |
| 66 | + if (rc) { |
| 67 | + LOG_ERR("Calculate failed"); |
| 68 | + return tool_rc_general_error; |
| 69 | + } |
| 70 | + |
| 71 | + /* Why doesn't calculate give us the aggregate hash? */ |
| 72 | + printf("hash: "); |
| 73 | + tpm2_util_hexdump2(stdout, policy_ctx->policyDigests.digests[0].digest.sha256, 32); |
| 74 | + printf("\n"); |
| 75 | + |
| 76 | + /* TODO TAKE USER INPUTS */ |
| 77 | + TPM2B_SENSITIVE_CREATE inSensitivePrimary = { 0 }; |
| 78 | + |
| 79 | + TPM2B_PUBLIC inPublic = { |
| 80 | + .size = 0, |
| 81 | + .publicArea = { |
| 82 | + .type = TPM2_ALG_RSA, |
| 83 | + .nameAlg = TPM2_ALG_SHA256, |
| 84 | + .objectAttributes = (TPMA_OBJECT_USERWITHAUTH | |
| 85 | + TPMA_OBJECT_RESTRICTED | |
| 86 | + TPMA_OBJECT_DECRYPT | |
| 87 | + TPMA_OBJECT_FIXEDTPM | |
| 88 | + TPMA_OBJECT_FIXEDPARENT | |
| 89 | + TPMA_OBJECT_SENSITIVEDATAORIGIN), |
| 90 | + .authPolicy = { |
| 91 | + .size = 0, |
| 92 | + }, |
| 93 | + .parameters.rsaDetail = { |
| 94 | + .symmetric = { |
| 95 | + .algorithm = TPM2_ALG_AES, |
| 96 | + .keyBits.aes = 128, |
| 97 | + .mode.aes = TPM2_ALG_CFB}, |
| 98 | + .scheme = { |
| 99 | + .scheme = TPM2_ALG_NULL |
| 100 | + }, |
| 101 | + .keyBits = 2048, |
| 102 | + .exponent = 0, |
| 103 | + }, |
| 104 | + .unique.rsa = { |
| 105 | + .size = 0, |
| 106 | + .buffer = {}, |
| 107 | + }, |
| 108 | + }, |
| 109 | + }; |
| 110 | + |
| 111 | + TPMT_SYM_DEF symmetric = {.algorithm = TPM2_ALG_AES, |
| 112 | + .keyBits = {.aes = 128}, |
| 113 | + .mode = {.aes = TPM2_ALG_CFB} |
| 114 | + }; |
| 115 | + |
| 116 | + TPM2B_NONCE nonceCaller = { |
| 117 | + .size = 32, |
| 118 | + .buffer = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10,11, 12, 13, 14, 15, 16, 17, |
| 119 | + 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32} |
| 120 | + }; |
| 121 | + |
| 122 | + TPM2B_DATA outsideInfo = { 0 }; |
| 123 | + TPML_PCR_SELECTION creationPCR = { 0 }; |
| 124 | + ESYS_TR primaryHandle = ESYS_TR_NONE; |
| 125 | + TPM2B_PUBLIC *outPublic = NULL; |
| 126 | + TPM2B_CREATION_DATA *creationData = NULL; |
| 127 | + TPM2B_DIGEST *creationHash = NULL; |
| 128 | + TPMT_TK_CREATION *creationTicket = NULL; |
| 129 | + ESYS_TR session = ESYS_TR_NONE; |
| 130 | + |
| 131 | + rc = Esys_CreatePrimary(ectx, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD, |
| 132 | + ESYS_TR_NONE, ESYS_TR_NONE, &inSensitivePrimary, &inPublic, |
| 133 | + &outsideInfo, &creationPCR, &primaryHandle, |
| 134 | + &outPublic, &creationData, &creationHash, |
| 135 | + &creationTicket); |
| 136 | + if (rc) { |
| 137 | + LOG_ERR("CreatePrimary failed"); |
| 138 | + return tool_rc_general_error; |
| 139 | + } |
| 140 | + |
| 141 | + rc = Esys_StartAuthSession(ectx, |
| 142 | + primaryHandle, // tpm key |
| 143 | + ESYS_TR_NONE, // bind key |
| 144 | + ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, // sessions |
| 145 | + &nonceCaller, TPM2_SE_POLICY, &symmetric, TPM2_ALG_SHA256, &session); |
| 146 | + if (rc) { |
| 147 | + LOG_ERR("StartAuthSession failed"); |
| 148 | + return tool_rc_general_error; |
| 149 | + } |
| 150 | + |
| 151 | + rc = Tss2_PolicyExecute( |
| 152 | + TPM2_ALG_SHA256, |
| 153 | + policy_ctx, |
| 154 | + ectx, |
| 155 | + session); |
| 156 | + if (rc) { |
| 157 | + LOG_ERR("Execute failed"); |
| 158 | + return tool_rc_general_error; |
| 159 | + } |
| 160 | + |
| 161 | + return tool_rc_success; |
| 162 | +} |
| 163 | + |
| 164 | +// Register this tool with tpm2_tool.c |
| 165 | +TPM2_TOOL_REGISTER("policy", tpm2_tool_onstart, tpm2_tool_onrun, NULL, NULL) |
0 commit comments