1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*******************************************************************************
3 * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
4 * All rights reserved.
5 *******************************************************************************/
6
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10
11 #include <stdlib.h>
12
13 #include "tss2_esys.h"
14
15 #include "esys_iutil.h"
16 #include "test-esys.h"
17 #define LOGMODULE test
18 #include "util/log.h"
19 #include "util/aux_util.h"
20
21 /** Test the ESYS function Esys_HierarchyControl.
22 *
23 * The owner hierarchy will be disabled and with Esys_CreatePrimary it will
24 * be checked whether the owner hierarchy is disabled.
25 *
26 *\b Note: platform authorization needed.
27 *
28 * Tested ESYS commands:
29 * - Esys_CreatePrimary() (M)
30 * - Esys_FlushContext() (M)
31 * - Esys_HierarchyControl() (M)
32 *
33 * @param[in,out] esys_context The ESYS_CONTEXT.
34 * @param[in] enable The hierarchy to enable or disable.
35 * @retval EXIT_FAILURE
36 * @retval EXIT_SKIP
37 * @retval EXIT_SUCCESS
38 */
39 int
test_esys_hierarchy_control(ESYS_CONTEXT * esys_context,ESYS_TR enable)40 test_esys_hierarchy_control(ESYS_CONTEXT * esys_context, ESYS_TR enable)
41 {
42 TSS2_RC r;
43
44 ESYS_TR authHandle_handle = ESYS_TR_RH_PLATFORM;
45 TPMI_YES_NO state = TPM2_NO;
46 ESYS_TR primaryHandle = ESYS_TR_NONE;
47 int failure_return = EXIT_FAILURE;
48
49 TPM2B_PUBLIC *outPublic = NULL;
50 TPM2B_CREATION_DATA *creationData = NULL;
51 TPM2B_DIGEST *creationHash = NULL;
52 TPMT_TK_CREATION *creationTicket = NULL;
53
54 r = Esys_HierarchyControl(
55 esys_context,
56 authHandle_handle,
57 ESYS_TR_PASSWORD,
58 ESYS_TR_NONE,
59 ESYS_TR_NONE,
60 enable,
61 state);
62
63 if (number_rc(r) == TPM2_RC_BAD_AUTH) {
64 /* Platform authorization not possible test will be skipped */
65 LOG_WARNING("Platform authorization not possible.");
66 return EXIT_SKIP;
67 }
68
69 goto_if_error(r, "Error: HierarchyControl", error);
70
71 TPM2B_SENSITIVE_CREATE inSensitivePrimary = {
72 .size = 0,
73 .sensitive = {
74 .userAuth = {
75 .size = 0,
76 .buffer = {0 },
77 },
78 .data = {
79 .size = 0,
80 .buffer = {0},
81 },
82 },
83 };
84
85 TPM2B_PUBLIC inPublic = {
86 .size = 0,
87 .publicArea = {
88 .type = TPM2_ALG_RSA,
89 .nameAlg = TPM2_ALG_SHA256,
90 .objectAttributes = (TPMA_OBJECT_USERWITHAUTH |
91 TPMA_OBJECT_RESTRICTED |
92 TPMA_OBJECT_DECRYPT |
93 TPMA_OBJECT_FIXEDTPM |
94 TPMA_OBJECT_FIXEDPARENT |
95 TPMA_OBJECT_SENSITIVEDATAORIGIN),
96 .authPolicy = {
97 .size = 0,
98 },
99 .parameters.rsaDetail = {
100 .symmetric = {
101 .algorithm = TPM2_ALG_AES,
102 .keyBits.aes = 128,
103 .mode.aes = TPM2_ALG_CFB},
104 .scheme = {
105 .scheme = TPM2_ALG_NULL
106 },
107 .keyBits = 2048,
108 .exponent = 0,
109 },
110 .unique.rsa = {
111 .size = 0,
112 .buffer = {},
113 },
114 },
115 };
116 LOG_INFO("\nRSA key will be created.");
117
118 TPM2B_DATA outsideInfo = {
119 .size = 0,
120 .buffer = {},
121 };
122
123 TPML_PCR_SELECTION creationPCR = {
124 .count = 0,
125 };
126
127 goto_if_error(r, "Error: TR_SetAuth", error);
128
129 r = Esys_CreatePrimary(esys_context, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD,
130 ESYS_TR_NONE, ESYS_TR_NONE, &inSensitivePrimary, &inPublic,
131 &outsideInfo, &creationPCR, &primaryHandle,
132 &outPublic, &creationData, &creationHash,
133 &creationTicket);
134
135 goto_error_if_not_failed(r, "Error: Create Primary", error);
136
137 state = TPM2_YES;
138
139 r = Esys_HierarchyControl(
140 esys_context,
141 authHandle_handle,
142 ESYS_TR_PASSWORD,
143 ESYS_TR_NONE,
144 ESYS_TR_NONE,
145 enable,
146 state);
147 goto_if_error(r, "Error: HierarchyControl", error);
148
149 r = Esys_CreatePrimary(esys_context, ESYS_TR_RH_OWNER, ESYS_TR_PASSWORD,
150 ESYS_TR_NONE, ESYS_TR_NONE, &inSensitivePrimary, &inPublic,
151 &outsideInfo, &creationPCR, &primaryHandle,
152 &outPublic, &creationData, &creationHash,
153 &creationTicket);
154 goto_if_error(r, "Error esys create primary", error);
155
156 r = Esys_FlushContext(esys_context, primaryHandle);
157 goto_if_error(r, "Error: FlushContext", error);
158
159 Esys_Free(outPublic);
160 Esys_Free(creationData);
161 Esys_Free(creationHash);
162 Esys_Free(creationTicket);
163 return EXIT_SUCCESS;
164
165 error:
166
167 if (primaryHandle != ESYS_TR_NONE) {
168 if (Esys_FlushContext(esys_context, primaryHandle) != TSS2_RC_SUCCESS) {
169 LOG_ERROR("Cleanup primaryHandle failed.");
170 }
171 }
172
173 Esys_Free(outPublic);
174 Esys_Free(creationData);
175 Esys_Free(creationHash);
176 Esys_Free(creationTicket);
177 return failure_return;
178 }
179
180 int
test_invoke_esys(ESYS_CONTEXT * esys_context)181 test_invoke_esys(ESYS_CONTEXT * esys_context) {
182 int rc = test_esys_hierarchy_control(esys_context, ESYS_TR_RH_OWNER);
183 if (rc)
184 return rc;
185
186 /*
187 * Test that backwards compat API change is still working, see:
188 * - https://github.com/tpm2-software/tpm2-tss/issues/1750
189 */
190 return test_esys_hierarchy_control(esys_context, TPM2_RH_OWNER);
191 }
192