Skip to content

Commit

Permalink
Refactor to eliminate confusing cast between TPMS_AUTH_COMMAND and TP…
Browse files Browse the repository at this point in the history 
…M2_AUTH_SESSION.
  • Loading branch information
@dgarske
dgarske committed May 8, 2024
1 parent e5da556 commit 81c8371
Show file tree
Hide file tree
Showing 6 changed files with 84 additions and 45 deletions.
4 changes: 2 additions & 2 deletions examples/run_examples.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -163,10 +163,10 @@ if [ $WOLFCRYPT_ENABLE -eq 1 ]; then

./examples/keygen/keygen ecckeyblobeh.bin -ecc -eh >> run.out 2>&1
RESULT=$?
[ $RESULT -ne 0 ] && echo -e "keygen endorsement rsa failed! $RESULT" && exit 1
[ $RESULT -ne 0 ] && echo -e "keygen endorsement ecc failed! $RESULT" && exit 1
./examples/keygen/keyload ecckeyblobeh.bin -ecc -eh >> run.out 2>&1
RESULT=$?
[ $RESULT -ne 0 ] && echo -e "keygen endorsement rsa failed! $RESULT" && exit 1
[ $RESULT -ne 0 ] && echo -e "keyload endorsement ecc failed! $RESULT" && exit 1
fi


Expand Down
37 changes: 26 additions & 11 deletions src/tpm2.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ static int TPM2_CommandProcess(TPM2_CTX* ctx, TPM2_Packet* packet,
BYTE *param, *encParam = NULL;
int paramSz, encParamSz = 0;
int i, authPos;
int tmpSz = 0; /* Used to calculate the new total size of the Auth Area */
int authTotalSzPos = 0;
#ifndef WOLFTPM2_NO_WOLFCRYPT
UINT32 handleValue1, handleValue2, handleValue3;
int handlePos;
Expand All @@ -120,8 +120,8 @@ static int TPM2_CommandProcess(TPM2_CTX* ctx, TPM2_Packet* packet,
/* Parse Auth */
TPM2_Packet_ParseU32(packet, &authSz);
packet->pos -= sizeof(authSz);
/* Later Auth Area size is updated */
TPM2_Packet_MarkU32(packet, &tmpSz);
/* Get position for total auth size to be updated later */
TPM2_Packet_MarkU32(packet, &authTotalSzPos);
/* Mark the position of the Auth Area data */
authPos = packet->pos;
packet->pos += authSz;
Expand Down Expand Up @@ -174,17 +174,32 @@ static int TPM2_CommandProcess(TPM2_CTX* ctx, TPM2_Packet* packet,
}
}

/* Note: Copy between TPM2_AUTH_SESSION and TPMS_AUTH_COMMAND is allowed */
XMEMCPY(&authCmd, session, sizeof(TPMS_AUTH_COMMAND));

if (TPM2_IS_HMAC_SESSION(session->sessionHandle) ||
TPM2_IS_POLICY_SESSION(session->sessionHandle))
/* Build auth */
XMEMSET(&authCmd, 0, sizeof(authCmd));
authCmd.sessionHandle = session->sessionHandle;
authCmd.sessionAttributes = session->sessionAttributes;
authCmd.nonce.size = session->nonceCaller.size;
XMEMCPY(authCmd.nonce.buffer, session->nonceCaller.buffer,
authCmd.nonce.size);

/* Password Auth */
if (session->sessionHandle == TPM_RS_PW) {
authCmd.hmac.size = session->auth.size;
XMEMCPY(authCmd.hmac.buffer, session->auth.buffer,
session->auth.size);
}
/* HMAC or Policy Session */
else if (TPM2_IS_HMAC_SESSION(session->sessionHandle) ||
TPM2_IS_POLICY_SESSION(session->sessionHandle))
{
#ifndef WOLFTPM2_NO_WOLFCRYPT
TPM2B_NAME name1, name2, name3;
TPM2B_DIGEST hash;
#endif

/* default is a HMAC output (using alg authHash) */
authCmd.hmac.size = TPM2_GetHashDigestSize(session->authHash);

/* if param enc is not supported for this command then clear flag */
/* session attribute flags are from TPM perspective */
if ((info->flags & (CMD_FLAG_ENC2 | CMD_FLAG_ENC4)) == 0) {
Expand Down Expand Up @@ -240,14 +255,14 @@ static int TPM2_CommandProcess(TPM2_CTX* ctx, TPM2_Packet* packet,
#endif /* !WOLFTPM2_NO_WOLFCRYPT && !NO_HMAC */
}

/* Replace auth in session */
/* Place session auth */
packet->pos = authPos;
TPM2_Packet_AppendAuthCmd(packet, &authCmd);
authPos = packet->pos; /* update auth position */
}

/* Update the Auth Area size in the command packet */
TPM2_Packet_PlaceU32(packet, tmpSz);
/* Update the Auth Area total size in the command packet */
TPM2_Packet_PlaceU32(packet, authTotalSzPos);

(void)cmdCode;
return rc;
Expand Down
58 changes: 46 additions & 12 deletions src/tpm2_packet.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -251,18 +251,14 @@ void TPM2_Packet_PlaceU32(TPM2_Packet* packet, int markSz)

void TPM2_Packet_AppendAuthCmd(TPM2_Packet* packet, TPMS_AUTH_COMMAND* authCmd)
{
if (packet == NULL || authCmd == NULL)
if (packet == NULL || authCmd == NULL) {
return;
}

#ifdef WOLFTPM_DEBUG_VERBOSE
TPM2_PrintAuth(authCmd);
#endif

/* make sure continueSession is set for TPM_RS_PW */
if (authCmd->sessionHandle == TPM_RS_PW &&
(authCmd->sessionAttributes & TPMA_SESSION_continueSession) == 0) {
authCmd->sessionAttributes |= TPMA_SESSION_continueSession;
}
TPM2_Packet_AppendU32(packet, authCmd->sessionHandle);
TPM2_Packet_AppendU16(packet, authCmd->nonce.size);
TPM2_Packet_AppendBytes(packet, authCmd->nonce.buffer, authCmd->nonce.size);
Expand Down Expand Up @@ -347,15 +343,53 @@ TPM_ST TPM2_Packet_AppendAuth(TPM2_Packet* packet, TPM2_CTX* ctx, CmdInfo_t* inf

info->authCnt = TPM2_GetCmdAuthCount(ctx, info);
if (info->authCnt > 0) {
int i, tmpSz = 0;
TPM2_Packet_MarkU32(packet, &tmpSz);
int i, authTotalSzPos = 0;
TPM2_Packet_MarkU32(packet, &authTotalSzPos);
for (i=0; i<info->authCnt; i++) {
/* Note: Casting a TPM2_AUTH_SESSION to TPMS_AUTH_COMMAND here,
* this is allowed because top of structure matches */
TPM2_Packet_AppendAuthCmd(packet, (TPMS_AUTH_COMMAND*)&ctx->session[i]);
TPM2_AUTH_SESSION* session = &ctx->session[i];

/* Determine auth size - appended later in TPM2_CommandProcess */

/* sessionHandle */
packet->pos += sizeof(UINT32);

/* Nonce size:
* Determined by us and TPM matches it on reply
* Typically use SHA2-256 digest size (16 bytes). The random nonce
* is populated in TPM2_CommandProcess */
packet->pos += sizeof(UINT16); /* nonceSz */
if (session->sessionHandle != TPM_RS_PW) {
session->nonceCaller.size =
TPM2_GetHashDigestSize(WOLFTPM2_WRAP_DIGEST);
packet->pos += session->nonceCaller.size;
}

/* sessionAttributes */
packet->pos += sizeof(UINT8);
if (session->sessionHandle == TPM_RS_PW) {
/* make sure continueSession is set for TPM_RS_PW */
session->sessionAttributes |= TPMA_SESSION_continueSession;
}

/* Password Auth */
packet->pos += sizeof(UINT16); /* hmac.size */
if (session->sessionHandle == TPM_RS_PW) {
packet->pos += session->auth.size;
}
/* HMAC or Policy Session */
else if (TPM2_IS_HMAC_SESSION(session->sessionHandle) ||
TPM2_IS_POLICY_SESSION(session->sessionHandle)) {
if (session->policyAuth && session->auth.size > 0) {
packet->pos += session->auth.size;
}
else {
/* auth is always HMAC result */
packet->pos += TPM2_GetHashDigestSize(session->authHash);
}
}
}
/* based on position difference places calculated size at marked U32 above */
TPM2_Packet_PlaceU32(packet, tmpSz);
TPM2_Packet_PlaceU32(packet, authTotalSzPos);
st = TPM_ST_SESSIONS;
}
return st;
Expand Down
18 changes: 3 additions & 15 deletions src/tpm2_wrap.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -936,9 +936,10 @@ int wolfTPM2_SetAuthHandle(WOLFTPM2_DEV* dev, int index,
}

if (handle) {
TPM2_AUTH_SESSION* session = &dev->session[index];
session->policyAuth = handle->policyAuth;
/* don't set auth for policy session, just name */
if (handle->policyAuth) {
TPM2_AUTH_SESSION* session = &dev->session[index];
session->name.size = handle->name.size;
XMEMCPY(session->name.name, handle->name.name, handle->name.size);
return TPM_RC_SUCCESS;
Expand All @@ -962,7 +963,7 @@ int wolfTPM2_SetAuthHandleName(WOLFTPM2_DEV* dev, int index,
name = &handle->name;
session = &dev->session[index];

if (session->auth.size == 0 && handle->auth.size > 0) {
if (session->sessionHandle == TPM_RS_PW && handle->auth.size > 0) {
session->auth.size = handle->auth.size;
XMEMCPY(session->auth.buffer, handle->auth.buffer, handle->auth.size);
}
Expand Down Expand Up @@ -1000,24 +1001,11 @@ int wolfTPM2_SetAuthSession(WOLFTPM2_DEV* dev, int index,
XMEMCPY(&session->symmetric, &tpmSession->handle.symmetric,
sizeof(TPMT_SYM_DEF));

/* fresh nonce generated in TPM2_CommandProcess based on this size */
session->nonceCaller.size = TPM2_GetHashDigestSize(WOLFTPM2_WRAP_DIGEST);

/* Capture TPM provided nonce */
session->nonceTPM.size = tpmSession->nonceTPM.size;
XMEMCPY(session->nonceTPM.buffer, tpmSession->nonceTPM.buffer,
session->nonceTPM.size);

/* Parameter Encryption or Policy session will have an HMAC added later.
* Reserve space, the same way it was done for nonceCaller above.
*/
if ((session->sessionHandle != TPM_RS_PW &&
((session->sessionAttributes & TPMA_SESSION_encrypt) ||
(session->sessionAttributes & TPMA_SESSION_decrypt)))
|| TPM2_IS_POLICY_SESSION(session->sessionHandle))
{
session->auth.size = TPM2_GetHashDigestSize(session->authHash);
}
}
return rc;
}
Expand Down
6 changes: 3 additions & 3 deletions wolftpm/tpm2.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1621,19 +1621,19 @@ typedef struct TPMS_AUTH_RESPONSE {

/* Implementation specific authorization session information */
typedef struct TPM2_AUTH_SESSION {
/* BEGIN */
/* This section should match TPMS_AUTH_COMMAND */
/* this section is used for TPMS_AUTH_COMMAND */
TPMI_SH_AUTH_SESSION sessionHandle;
TPM2B_NONCE nonceCaller;
TPMA_SESSION sessionAttributes;
TPM2B_AUTH auth;
/* END */

/* additional auth data required for implementation */
TPM2B_NONCE nonceTPM;
TPMT_SYM_DEF symmetric;
TPMI_ALG_HASH authHash;
TPM2B_NAME name;

unsigned int policyAuth : 1; /* if policy auth should be used */
} TPM2_AUTH_SESSION;

/* Macros to determine TPM 2.0 Session type */
Expand Down
6 changes: 4 additions & 2 deletions wolftpm/tpm2_wrap.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,12 @@

typedef struct WOLFTPM2_HANDLE {
TPM_HANDLE hndl;
TPM2B_AUTH auth; /* Used if policyAuth is not set */
TPM2B_AUTH auth;
TPMT_SYM_DEF symmetric;
TPM2B_NAME name;
int policyAuth; /* Handle requires Policy, not password Auth */

/* bit-fields */
unsigned int policyAuth : 1; /* Handle requires policy auth */
unsigned int nameLoaded : 1; /* flag to indicate if "name" was loaded and computed */
} WOLFTPM2_HANDLE;

Expand Down

0 comments on commit 81c8371

Please sign in to comment.