3982

pending completion

Build # 3982

Build Type

Pull #716

travis-ci-com

Committed by

web-flow

Commit Message

<a href="https://github.com/stefanberger/swtpm/commit/<a class=hub.com/stefanberger/swtpm/commit/<a class="double-link" href="https://git"><a class=hub.com/stefanberger/swtpm/commit/<a class="double-link" href="https://git"><a class=hub.com/stefanberger/swtpm/commit/<a class="double-link" href="https://git"><a class=hub.com/stefanberger/swtpm/commit/54e793c8b21f6bf9a5d07affa7f7fec1d467ba00">54e793c8b">&lt;a href=&quot;https://github.com/stefanberger/swtpm/commit/</a><a class="double-link" href="https://github.com/stefanberger/swtpm/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/stefanberger/swtpm/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/stefanberger/swtpm/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/stefanberger/swtpm/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/stefanberger/swtpm/commit/54e793c8b21f6bf9a5d07affa7f7fec1d467ba00">54e793c8b</a><a href="https://github.com/stefanberger/swtpm/commit/54e793c8b21f6bf9a5d07affa7f7fec1d467ba00">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/stefanberger/swtpm/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/stefanberger/swtpm/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/stefanberger/swtpm/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/stefanberger/swtpm/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/stefanberger/swtpm/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/stefanberger/swtpm/commit/54e793c8b21f6bf9a5d07affa7f7fec1d467ba00&quot;&gt;54e793c8b&lt;/a&gt;&lt;a href=&quot;https://github.com/stefanberger/swtpm/commit/54e793c8b21f6bf9a5d07affa7f7fec1d467ba00&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/stefanberger/swtpm/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/stefanberger/swtpm/comm... (continued)

Pull Request Pull Request #716: WIP: Add support for setting of a profile for a TPM 2

Run Details

325 of 325 new or added lines in 14 files covered. (100.0%)

6376 of 8510 relevant lines covered (74.92%)

15141.02 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

76.47

/src/swtpm/tpmlib.c

/*
 * tpm_funcs.c -- interface with libtpms
 *
 * (c) Copyright IBM Corporation 2015.
 *
 * Author: Stefan Berger <stefanb@us.ibm.com>
 *
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 * Redistributions of source code must retain the above copyright notice,
 * this list of conditions and the following disclaimer.
 *
 * Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 *
 * Neither the names of the IBM Corporation nor the names of its
 * contributors may be used to endorse or promote products derived from
 * this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "config.h"

#include "sys_dependencies.h"

#include <assert.h>
#include <string.h>
#include <stdlib.h>

#include <libtpms/tpm_library.h>
#include <libtpms/tpm_error.h>
#include <libtpms/tpm_nvfilename.h>
#include <libtpms/tpm_memory.h>

#include <json-glib/json-glib.h>

#include "tpmlib.h"
#include "logging.h"
#include "tpm_ioctl.h"
#include "swtpm_nvstore.h"
#include "locality.h"
#ifdef WITH_VTPM_PROXY
#include "vtpm_proxy.h"
#endif
#include "utils.h"
#include "compiler_dependencies.h"
#include "swtpm_utils.h"
#include "fips.h"

/*
 * convert the blobtype integer into a string that libtpms
 * understands
 */
const char *tpmlib_get_blobname(uint32_t blobtype)
{
    switch (blobtype) {
    case PTM_BLOB_TYPE_PERMANENT:
        return TPM_PERMANENT_ALL_NAME;
    case PTM_BLOB_TYPE_VOLATILE:
        return TPM_VOLATILESTATE_NAME;
    case PTM_BLOB_TYPE_SAVESTATE:
        return TPM_SAVESTATE_NAME;
    default:
        return NULL;
    }
}

TPM_RESULT tpmlib_register_callbacks(struct libtpms_callbacks *cbs)
{
    TPM_RESULT res;

    if ((res = TPMLIB_RegisterCallbacks(cbs)) != TPM_SUCCESS) {
        logprintf(STDERR_FILENO,
                  "Error: Could not register the callbacks.\n");
    }
    return res;
}

TPM_RESULT tpmlib_choose_tpm_version(TPMLIB_TPMVersion tpmversion)
{
    TPM_RESULT res;

    if ((res = TPMLIB_ChooseTPMVersion(tpmversion)) != TPM_SUCCESS) {
        const char *version = "TPM 1.2";

        if (tpmversion == TPMLIB_TPM_VERSION_2)
            version = "TPM 2";
        logprintf(STDERR_FILENO,
                  "Error: %s is not supported by libtpms.\n", version);
    }
    return res;
}

/* This function only applies to TPM2: If FIPS mode was enabled on the host,
 * determine whether OpenSSL needs to deactivate FIPS mode. It doesn't need
 * to deactivate it if a profile was chosen that has no algorithms that FIPS
 * deactivates, otherwise it has to deactivate FIPS mode in the OpenSSL
 * instance being used.
 */
static bool tpmlib_check_need_disable_fips_mode(void)
{
    char *info_data = TPMLIB_GetInfo(/*TPMLIB_INFO_RUNTIME_ALGORITHMS*/ 8);
    g_autofree gchar *enabled = NULL;
    bool need_disable = false;
    gchar **algorithms;
    int ret;

    ret = json_get_submap_value(info_data, "RuntimeAlgorithms", "Enabled",
                                &enabled);
    if (ret) {
        need_disable = true;
        goto error;
    }

    algorithms = g_strsplit(enabled, ",", -1);

    need_disable = fips_algorithms_are_disabled(algorithms);

    fprintf(stderr, "oooo need_disable: %d\n", need_disable);

    g_strfreev(algorithms);
error:
    free(info_data);

    return need_disable;
}

/* Determine wheter FIPS mode is enabled in the crypto library. If FIPS mode is
 * enabled check wether any of the algorithms that the TPM 2 uses would need
 * FIPS mode to be disabled for the TPM 2 to work and try to disable it.
 */
static int tpmlib_maybe_disable_fips_mode(TPMLIB_TPMVersion tpmversion)
{
    bool disable_fips = false;
    int ret = 0;

    if (/*fips_mode_enabled() && */ 1) {
        switch (tpmversion) {
        case TPMLIB_TPM_VERSION_1_2:
            disable_fips = true;
            break;
        case TPMLIB_TPM_VERSION_2:
            disable_fips = tpmlib_check_need_disable_fips_mode();
            break;
        }
        if (disable_fips && fips_mode_disable())
            ret = 1;
    }
    return ret;
}

TPM_RESULT tpmlib_start(uint32_t flags, TPMLIB_TPMVersion tpmversion,
                        const char *json_profile)
{
    TPM_RESULT res;

    if ((res = tpmlib_choose_tpm_version(tpmversion)) != TPM_SUCCESS)
        return res;

#ifdef HAVE_LIBTPMS_SETPROFILE_API
    if (json_profile != NULL && tpmversion == TPMLIB_TPM_VERSION_2 &&
        (res = TPMLIB_SetProfile(json_profile)) != TPM_SUCCESS) {
        logprintf(STDERR_FILENO,
                  "Error: Could not set profile for TPM2.\n");
        return res;
    }
#endif

    if ((res = TPMLIB_MainInit()) != TPM_SUCCESS) {
        logprintf(STDERR_FILENO,
                  "Error: Could not initialize libtpms.\n");
        return res;
    }

    if (flags & PTM_INIT_FLAG_DELETE_VOLATILE) {
        uint32_t tpm_number = 0;
        char *name = TPM_VOLATILESTATE_NAME;
        res = SWTPM_NVRAM_DeleteName(tpm_number,
                                     name,
                                     FALSE);
        if (res != TPM_SUCCESS) {
            logprintf(STDERR_FILENO,
                      "Error: Could not delete the volatile "
                      "state of the TPM.\n");
            goto error_terminate;
        }
    }

    if (tpmlib_maybe_disable_fips_mode(tpmversion))
        goto error_terminate;

    return TPM_SUCCESS;

error_terminate:
    TPMLIB_Terminate();

    return res;
}

int tpmlib_get_tpm_property(enum TPMLIB_TPMProperty prop)
{
    int result = 0;
    TPM_RESULT res;

    res = TPMLIB_GetTPMProperty(prop, &result);

    assert(res == TPM_SUCCESS);

    return result;
}

bool tpmlib_is_request_cancelable(TPMLIB_TPMVersion tpmversion,
                                  const unsigned char *request, size_t req_len)
{
    struct tpm_req_header *hdr;
    uint32_t ordinal;

    if (req_len < sizeof(struct tpm_req_header))
        return false;

    hdr = (struct tpm_req_header *)request;
    ordinal = be32toh(hdr->ordinal);

    if (tpmversion == TPMLIB_TPM_VERSION_2)
        return (ordinal == TPMLIB_TPM2_CC_CreatePrimary ||
                ordinal == TPMLIB_TPM2_CC_Create);

    return (ordinal == TPMLIB_TPM_ORD_TakeOwnership ||
            ordinal == TPMLIB_TPM_ORD_CreateWrapKey);
}

static void tpmlib_write_error_response(unsigned char **rbuffer,
                                        uint32_t *rlength,
                                        uint32_t *rTotal,
                                        TPM_RESULT errcode,
                                        TPMLIB_TPMVersion tpmversion)
{
    struct tpm_resp_header errresp = {
        .tag = (tpmversion == TPMLIB_TPM_VERSION_2)
               ? htobe16(0x8001)
               : htobe16(0xc4),
        .size = htobe32(sizeof(errresp)),
        .errcode = htobe32(errcode),
    };

    if (*rbuffer == NULL ||
        *rTotal < sizeof(errresp)) {
        free(*rbuffer);

        *rbuffer = malloc(sizeof(errresp));
        if (*rbuffer)
            *rTotal = sizeof(errresp);
        else
            *rTotal = 0;
    }
    if (*rbuffer) {
        *rlength = sizeof(errresp);
        memcpy(*rbuffer, &errresp, sizeof(errresp));
    }
}

void tpmlib_write_fatal_error_response(unsigned char **rbuffer,
                                       uint32_t *rlength,
                                       uint32_t *rTotal,
                                       TPMLIB_TPMVersion tpmversion)
{
    TPM_RESULT errcode = (tpmversion == TPMLIB_TPM_VERSION_2)
                         ? TPM_RC_FAILURE
                         : TPM_FAIL;

    tpmlib_write_error_response(rbuffer, rlength, rTotal, errcode,
                                tpmversion);
}

void tpmlib_write_locality_error_response(unsigned char **rbuffer,
                                          uint32_t *rlength,
                                          uint32_t *rTotal,
                                          TPMLIB_TPMVersion tpmversion)
{
    TPM_RESULT errcode = (tpmversion == TPMLIB_TPM_VERSION_2)
                         ? TPM_RC_LOCALITY
                         : TPM_BAD_LOCALITY;

    tpmlib_write_error_response(rbuffer, rlength, rTotal, errcode,
                                tpmversion);
}

void tpmlib_write_success_response(unsigned char **rbuffer,
                                   uint32_t *rlength,
                                   uint32_t *rTotal,
                                   TPMLIB_TPMVersion tpmversion)
{
    tpmlib_write_error_response(rbuffer, rlength, rTotal, 0,
                                tpmversion);
}

#ifdef WITH_VTPM_PROXY
static void tpmlib_write_shortmsg_error_response(unsigned char **rbuffer,
                                                 uint32_t *rlength,
                                                 uint32_t *rTotal,
                                                 TPMLIB_TPMVersion tpmversion)
{
    TPM_RESULT errcode = (tpmversion == TPMLIB_TPM_VERSION_2)
                         ? TPM_RC_INSUFFICIENT
                         : TPM_BAD_PARAM_SIZE;

    tpmlib_write_error_response(rbuffer, rlength, rTotal, errcode,
                                tpmversion);
}

static TPM_RESULT tpmlib_process_setlocality(unsigned char **rbuffer,
                                             uint32_t *rlength,
                                             uint32_t *rTotal,
                                             unsigned char *command,
                                             uint32_t command_length,
                                             TPMLIB_TPMVersion tpmversion,
                                             uint32_t locality_flags,
                                             TPM_MODIFIER_INDICATOR *locality)
{
    TPM_MODIFIER_INDICATOR new_locality;

    if (command_length >= sizeof(struct tpm_req_header) + sizeof(char)) {
        if (!(locality_flags & LOCALITY_FLAG_ALLOW_SETLOCALITY)) {
            /* SETLOCALITY command is not allowed */
            tpmlib_write_fatal_error_response(rbuffer,
                                              rlength, rTotal,
                                              tpmversion);
        } else {
            new_locality = command[sizeof(struct tpm_req_header)];
            if (new_locality >=5 ||
                (new_locality == 4 &&
                 locality_flags & LOCALITY_FLAG_REJECT_LOCALITY_4)) {
                tpmlib_write_locality_error_response(rbuffer,
                                                     rlength, rTotal,
                                                    tpmversion);
            } else {
                tpmlib_write_success_response(rbuffer,
                                              rlength, rTotal,
                                              tpmversion);
                *locality = new_locality;
            }
        }
    } else {
        tpmlib_write_shortmsg_error_response(rbuffer,
                                             rlength, rTotal,
                                             tpmversion);
    }
    return TPM_SUCCESS;
}

TPM_RESULT tpmlib_process(unsigned char **rbuffer,
                          uint32_t *rlength,
                          uint32_t *rTotal,
                          unsigned char *command,
                          uint32_t command_length,
                          uint32_t locality_flags,
                          TPM_MODIFIER_INDICATOR *locality,
                          TPMLIB_TPMVersion tpmversion)
{
    /* process those commands we need to handle, e.g. SetLocality */
    struct tpm_req_header *req = (struct tpm_req_header *)command;
    uint32_t ordinal;

    if (command_length < sizeof(*req)) {
        tpmlib_write_shortmsg_error_response(rbuffer,
                                             rlength, rTotal,
                                             tpmversion);
        return TPM_SUCCESS;
    }

    ordinal = be32toh(req->ordinal);

    switch (tpmversion) {
    case TPMLIB_TPM_VERSION_1_2:
        switch (ordinal) {
        case TPM_CC_SET_LOCALITY:
            return tpmlib_process_setlocality(rbuffer, rlength, rTotal,
                                              command, command_length,
                                              tpmversion, locality_flags,
                                              locality);
        }
        break;

    case TPMLIB_TPM_VERSION_2:
        switch (ordinal) {
        case TPM2_CC_SET_LOCALITY:
            return tpmlib_process_setlocality(rbuffer, rlength, rTotal,
                                              command, command_length,
                                              tpmversion, locality_flags,
                                              locality);
        }
        break;
    }
    return TPM_SUCCESS;
}

#else

TPM_RESULT tpmlib_process(unsigned char **rbuffer SWTPM_ATTR_UNUSED,
                          uint32_t *rlength SWTPM_ATTR_UNUSED,
                          uint32_t *rTotal SWTPM_ATTR_UNUSED,
                          unsigned char *command SWTPM_ATTR_UNUSED,
                          uint32_t command_length SWTPM_ATTR_UNUSED,
                          uint32_t locality_flags SWTPM_ATTR_UNUSED,
                          TPM_MODIFIER_INDICATOR *locality SWTPM_ATTR_UNUSED,
                          TPMLIB_TPMVersion tpmversion SWTPM_ATTR_UNUSED)
{
    return TPM_SUCCESS;
}

#endif /* WITH_VTPM_PROXY */

enum TPMLIB_StateType tpmlib_blobtype_to_statetype(uint32_t blobtype)
{
    switch (blobtype) {
    case PTM_BLOB_TYPE_PERMANENT:
        return TPMLIB_STATE_PERMANENT;
    case PTM_BLOB_TYPE_VOLATILE:
        return TPMLIB_STATE_VOLATILE;
    case PTM_BLOB_TYPE_SAVESTATE:
        return TPMLIB_STATE_SAVE_STATE;
    }
    return 0;
}

/*
 * tpmlib_handle_tcg_tpm2_cmd_header
 *
 * Determine whether the given byte stream is a raw TPM 2 command or
 * whether it has a tcg_tpm2_cmd_header prefixed and if so return
 * the offset after the header where the actual command is. In all
 * other cases return 0.
 */
off_t tpmlib_handle_tcg_tpm2_cmd_header(const unsigned char *command,
                                        uint32_t command_length,
                                        TPM_MODIFIER_INDICATOR *locality)
{
    struct tpm_req_header *hdr = (struct tpm_req_header *)command;
    struct tpm2_send_command_prefix *tcgprefix;
    off_t ret = 0;

    /* return 0 for short packets or plain TPM 2 command */
    if (command_length < sizeof(*hdr) ||
        be16toh(hdr->tag) == TPM2_ST_NO_SESSION ||
        be16toh(hdr->tag) == TPM2_ST_SESSIONS ||
        command_length < sizeof(*tcgprefix))
        return 0;

    tcgprefix = (struct tpm2_send_command_prefix *)command;
    if (be32toh(tcgprefix->cmd) == TPM2_SEND_COMMAND) {
        ret = sizeof(*tcgprefix);
        *locality = tcgprefix->locality;
    }

    return ret;
}

/*
 * Create a Startup command with the given startupType for the
 * given TPM version.
 */
uint32_t tpmlib_create_startup_cmd(uint16_t startupType,
                                   TPMLIB_TPMVersion tpmversion,
                                   unsigned char *buffer,
                                   uint32_t buffersize)
{
    struct tpm_startup ts;
    uint32_t tocopy = min(sizeof(ts), buffersize);

    ts.hdr.size = htobe32(sizeof(ts));

    switch (tpmversion) {
    case TPMLIB_TPM_VERSION_1_2:
        ts.hdr.tag = htobe16(TPM_TAG_RQU_COMMAND);
        ts.hdr.ordinal = htobe32(TPMLIB_TPM_ORD_Startup);
        ts.startupType = htobe16(startupType);
        break;
    case TPMLIB_TPM_VERSION_2:
        ts.hdr.tag = htobe16(TPM2_ST_NO_SESSION);
        ts.hdr.ordinal = htobe32(TPMLIB_TPM2_CC_Startup);
        switch (startupType) {
        case TPM_ST_CLEAR:
            ts.startupType = htobe16(TPM2_SU_CLEAR);
            break;
        case TPM_ST_STATE:
            ts.startupType = htobe16(TPM2_SU_STATE);
            break;
        case TPM_ST_DEACTIVATED:
            tocopy = 0;
            logprintf(STDERR_FILENO,
                      "TPM 2 does not support startup deactivated.\n");
            break;
        default:
            tocopy = 0;
            logprintf(STDERR_FILENO,
                      "%s: internal error; unsupported startup type for TPM 2\n", __func__);
            break;
        }
        break;
    default:
        tocopy = 0;
        logprintf(STDERR_FILENO,
                  "%s: internal error; invalid TPM version\n", __func__);
        break;
    }

    if (tocopy)
        memcpy(buffer, &ts, tocopy);
    return tocopy;
}

1	/*
2	* tpm_funcs.c -- interface with libtpms
3	*
4	* (c) Copyright IBM Corporation 2015.
5	*
6	* Author: Stefan Berger <stefanb@us.ibm.com>
7	*
8	* All rights reserved.
9	*
10	* Redistribution and use in source and binary forms, with or without
11	* modification, are permitted provided that the following conditions are
12	* met:
13	*
14	* Redistributions of source code must retain the above copyright notice,
15	* this list of conditions and the following disclaimer.
16	*
17	* Redistributions in binary form must reproduce the above copyright
18	* notice, this list of conditions and the following disclaimer in the
19	* documentation and/or other materials provided with the distribution.
20	*
21	* Neither the names of the IBM Corporation nor the names of its
22	* contributors may be used to endorse or promote products derived from
23	* this software without specific prior written permission.
24	*
25	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
26	* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
27	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
28	* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
29	* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
30	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
31	* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
35	* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36	*/
37
38	#include "config.h"
39
40	#include "sys_dependencies.h"
41
42	#include <assert.h>
43	#include <string.h>
44	#include <stdlib.h>
45
46	#include <libtpms/tpm_library.h>
47	#include <libtpms/tpm_error.h>
48	#include <libtpms/tpm_nvfilename.h>
49	#include <libtpms/tpm_memory.h>
50
51	#include <json-glib/json-glib.h>
52
53	#include "tpmlib.h"
54	#include "logging.h"
55	#include "tpm_ioctl.h"
56	#include "swtpm_nvstore.h"
57	#include "locality.h"
58	#ifdef WITH_VTPM_PROXY
59	#include "vtpm_proxy.h"
60	#endif
61	#include "utils.h"
62	#include "compiler_dependencies.h"
63	#include "swtpm_utils.h"
64	#include "fips.h"
65
66	/*
67	* convert the blobtype integer into a string that libtpms
68	* understands
69	*/
70	const char *tpmlib_get_blobname(uint32_t blobtype)	199✔
71	{
72	switch (blobtype) {	199✔
73	case PTM_BLOB_TYPE_PERMANENT:
74	return TPM_PERMANENT_ALL_NAME;
75	case PTM_BLOB_TYPE_VOLATILE:	123✔
76	return TPM_VOLATILESTATE_NAME;	123✔
77	case PTM_BLOB_TYPE_SAVESTATE:	14✔
78	return TPM_SAVESTATE_NAME;	14✔
79	default:	×
80	return NULL;	×
81	}
82	}
83
84	TPM_RESULT tpmlib_register_callbacks(struct libtpms_callbacks *cbs)	426✔
85	{
86	TPM_RESULT res;
87
88	if ((res = TPMLIB_RegisterCallbacks(cbs)) != TPM_SUCCESS) {	426✔
89	logprintf(STDERR_FILENO,	×
90	"Error: Could not register the callbacks.\n");
91	}
92	return res;	426✔
93	}
94
95	TPM_RESULT tpmlib_choose_tpm_version(TPMLIB_TPMVersion tpmversion)	6,591✔
96	{
97	TPM_RESULT res;
98
99	if ((res = TPMLIB_ChooseTPMVersion(tpmversion)) != TPM_SUCCESS) {	6,591✔
100	const char *version = "TPM 1.2";	×
101
102	if (tpmversion == TPMLIB_TPM_VERSION_2)	×
103	version = "TPM 2";	×
104	logprintf(STDERR_FILENO,	×
105	"Error: %s is not supported by libtpms.\n", version);
106	}
107	return res;	6,591✔
108	}
109
110	/* This function only applies to TPM2: If FIPS mode was enabled on the host,
111	* determine whether OpenSSL needs to deactivate FIPS mode. It doesn't need
112	* to deactivate it if a profile was chosen that has no algorithms that FIPS
113	* deactivates, otherwise it has to deactivate FIPS mode in the OpenSSL
114	* instance being used.
115	*/
116	static bool tpmlib_check_need_disable_fips_mode(void)	5,851✔
117	{
118	char info_data = TPMLIB_GetInfo(/TPMLIB_INFO_RUNTIME_ALGORITHMS*/ 8);	5,851✔
119	g_autofree gchar *enabled = NULL;	11,702✔
120	bool need_disable = false;	5,851✔
121	gchar **algorithms;
122	int ret;
123
124	ret = json_get_submap_value(info_data, "RuntimeAlgorithms", "Enabled",	5,851✔
125	&enabled);
126	if (ret) {	5,851✔
127	need_disable = true;
128	goto error;
129	}
130
131	algorithms = g_strsplit(enabled, ",", -1);	5,851✔
132
133	need_disable = fips_algorithms_are_disabled(algorithms);	5,851✔
134
135	fprintf(stderr, "oooo need_disable: %d\n", need_disable);	11,702✔
136
137	g_strfreev(algorithms);	5,851✔
138	error:	5,851✔
139	free(info_data);	5,851✔
140
141	return need_disable;	11,702✔
142	}
143
144	/* Determine wheter FIPS mode is enabled in the crypto library. If FIPS mode is
145	* enabled check wether any of the algorithms that the TPM 2 uses would need
146	* FIPS mode to be disabled for the TPM 2 to work and try to disable it.
147	*/
148	static int tpmlib_maybe_disable_fips_mode(TPMLIB_TPMVersion tpmversion)	6,039✔
149	{
150	bool disable_fips = false;	6,039✔
151	int ret = 0;	6,039✔
152
153	if (/fips_mode_enabled() && / 1) {
154	switch (tpmversion) {	6,039✔
155	case TPMLIB_TPM_VERSION_1_2:
156	disable_fips = true;
157	break;
158	case TPMLIB_TPM_VERSION_2:	5,851✔
159	disable_fips = tpmlib_check_need_disable_fips_mode();	5,851✔
160	break;
161	}
162	if (disable_fips && fips_mode_disable())	5,851✔
163	ret = 1;	×
164	}
165	return ret;	6,039✔
166	}
167
168	TPM_RESULT tpmlib_start(uint32_t flags, TPMLIB_TPMVersion tpmversion,	6,059✔
169	const char *json_profile)
170	{
171	TPM_RESULT res;
172
173	if ((res = tpmlib_choose_tpm_version(tpmversion)) != TPM_SUCCESS)	6,059✔
174	return res;
175
176	#ifdef HAVE_LIBTPMS_SETPROFILE_API
177	if (json_profile != NULL && tpmversion == TPMLIB_TPM_VERSION_2 &&	6,059✔
178	(res = TPMLIB_SetProfile(json_profile)) != TPM_SUCCESS) {
179	logprintf(STDERR_FILENO,	×
180	"Error: Could not set profile for TPM2.\n");
181	return res;	×
182	}
183	#endif
184
185	if ((res = TPMLIB_MainInit()) != TPM_SUCCESS) {	6,059✔
186	logprintf(STDERR_FILENO,	20✔
187	"Error: Could not initialize libtpms.\n");
188	return res;	20✔
189	}
190
191	if (flags & PTM_INIT_FLAG_DELETE_VOLATILE) {	6,039✔
192	uint32_t tpm_number = 0;	5,903✔
193	char *name = TPM_VOLATILESTATE_NAME;	5,903✔
194	res = SWTPM_NVRAM_DeleteName(tpm_number,	5,903✔
195	name,
196	FALSE);
197	if (res != TPM_SUCCESS) {	5,903✔
198	logprintf(STDERR_FILENO,	×
199	"Error: Could not delete the volatile "
200	"state of the TPM.\n");
201	goto error_terminate;	×
202	}
203	}
204
205	if (tpmlib_maybe_disable_fips_mode(tpmversion))	6,039✔
206	goto error_terminate;
207
208	return TPM_SUCCESS;
209
210	error_terminate:	×
211	TPMLIB_Terminate();	×
212
213	return res;	×
214	}
215
216	int tpmlib_get_tpm_property(enum TPMLIB_TPMProperty prop)	318✔
217	{
218	int result = 0;	318✔
219	TPM_RESULT res;
220
221	res = TPMLIB_GetTPMProperty(prop, &result);	318✔
222
223	assert(res == TPM_SUCCESS);	318✔
224
225	return result;	318✔
226	}
227
228	bool tpmlib_is_request_cancelable(TPMLIB_TPMVersion tpmversion,	318✔
229	const unsigned char *request, size_t req_len)
230	{
231	struct tpm_req_header *hdr;
232	uint32_t ordinal;
233
234	if (req_len < sizeof(struct tpm_req_header))	318✔
235	return false;
236
237	hdr = (struct tpm_req_header *)request;	318✔
238	ordinal = be32toh(hdr->ordinal);	636✔
239
240	if (tpmversion == TPMLIB_TPM_VERSION_2)	318✔
241	return (ordinal == TPMLIB_TPM2_CC_CreatePrimary \|\|	336✔
242	ordinal == TPMLIB_TPM2_CC_Create);	168✔
243
244	return (ordinal == TPMLIB_TPM_ORD_TakeOwnership \|\|	300✔
245	ordinal == TPMLIB_TPM_ORD_CreateWrapKey);	150✔
246	}
247
248	static void tpmlib_write_error_response(unsigned char **rbuffer,	25✔
249	uint32_t *rlength,
250	uint32_t *rTotal,
251	TPM_RESULT errcode,
252	TPMLIB_TPMVersion tpmversion)
253	{
254	struct tpm_resp_header errresp = {	100✔
255	.tag = (tpmversion == TPMLIB_TPM_VERSION_2)
256	? htobe16(0x8001)
257	: htobe16(0xc4),	13✔
258	.size = htobe32(sizeof(errresp)),	25✔
259	.errcode = htobe32(errcode),	25✔
260	};
261
262	if (*rbuffer == NULL \|\|	30✔
263	*rTotal < sizeof(errresp)) {	5✔
264	free(*rbuffer);	20✔
265
266	*rbuffer = malloc(sizeof(errresp));	20✔
267	if (*rbuffer)	20✔
268	*rTotal = sizeof(errresp);	20✔
269	else
270	*rTotal = 0;	×
271	}
272	if (*rbuffer) {	25✔
273	*rlength = sizeof(errresp);	25✔
274	memcpy(*rbuffer, &errresp, sizeof(errresp));	25✔
275	}
276	}	25✔
277
278	void tpmlib_write_fatal_error_response(unsigned char **rbuffer,	23✔
279	uint32_t *rlength,
280	uint32_t *rTotal,
281	TPMLIB_TPMVersion tpmversion)
282	{
283	TPM_RESULT errcode = (tpmversion == TPMLIB_TPM_VERSION_2)	23✔
284	? TPM_RC_FAILURE
285	: TPM_FAIL;	23✔
286
287	tpmlib_write_error_response(rbuffer, rlength, rTotal, errcode,	23✔
288	tpmversion);
289	}	23✔
290
291	void tpmlib_write_locality_error_response(unsigned char **rbuffer,	×
292	uint32_t *rlength,
293	uint32_t *rTotal,
294	TPMLIB_TPMVersion tpmversion)
295	{
296	TPM_RESULT errcode = (tpmversion == TPMLIB_TPM_VERSION_2)	×
297	? TPM_RC_LOCALITY
298	: TPM_BAD_LOCALITY;	×
299
300	tpmlib_write_error_response(rbuffer, rlength, rTotal, errcode,	×
301	tpmversion);
302	}
303
304	void tpmlib_write_success_response(unsigned char **rbuffer,	2✔
305	uint32_t *rlength,
306	uint32_t *rTotal,
307	TPMLIB_TPMVersion tpmversion)
308	{
309	tpmlib_write_error_response(rbuffer, rlength, rTotal, 0,	2✔
310	tpmversion);
311	}	2✔
312
313	#ifdef WITH_VTPM_PROXY
314	static void tpmlib_write_shortmsg_error_response(unsigned char **rbuffer,
315	uint32_t *rlength,
316	uint32_t *rTotal,
317	TPMLIB_TPMVersion tpmversion)
318	{
319	TPM_RESULT errcode = (tpmversion == TPMLIB_TPM_VERSION_2)	×
320	? TPM_RC_INSUFFICIENT
321	: TPM_BAD_PARAM_SIZE;	×
322
323	tpmlib_write_error_response(rbuffer, rlength, rTotal, errcode,	×
324	tpmversion);
325	}
326
327	static TPM_RESULT tpmlib_process_setlocality(unsigned char **rbuffer,	2✔
328	uint32_t *rlength,
329	uint32_t *rTotal,
330	unsigned char *command,
331	uint32_t command_length,
332	TPMLIB_TPMVersion tpmversion,
333	uint32_t locality_flags,
334	TPM_MODIFIER_INDICATOR *locality)
335	{
336	TPM_MODIFIER_INDICATOR new_locality;
337
338	if (command_length >= sizeof(struct tpm_req_header) + sizeof(char)) {	2✔
339	if (!(locality_flags & LOCALITY_FLAG_ALLOW_SETLOCALITY)) {	2✔
340	/* SETLOCALITY command is not allowed */
341	tpmlib_write_fatal_error_response(rbuffer,	×
342	rlength, rTotal,
343	tpmversion);
344	} else {
345	new_locality = command[sizeof(struct tpm_req_header)];	2✔
346	if (new_locality >=5 \|\|	2✔
347	(new_locality == 4 &&	×
348	locality_flags & LOCALITY_FLAG_REJECT_LOCALITY_4)) {	×
349	tpmlib_write_locality_error_response(rbuffer,	×
350	rlength, rTotal,
351	tpmversion);
352	} else {
353	tpmlib_write_success_response(rbuffer,	2✔
354	rlength, rTotal,
355	tpmversion);
356	*locality = new_locality;	2✔
357	}
358	}
359	} else {
360	tpmlib_write_shortmsg_error_response(rbuffer,
361	rlength, rTotal,
362	tpmversion);
363	}
364	return TPM_SUCCESS;	2✔
365	}
366
367	TPM_RESULT tpmlib_process(unsigned char **rbuffer,	21,084✔
368	uint32_t *rlength,
369	uint32_t *rTotal,
370	unsigned char *command,
371	uint32_t command_length,
372	uint32_t locality_flags,
373	TPM_MODIFIER_INDICATOR *locality,
374	TPMLIB_TPMVersion tpmversion)
375	{
376	/* process those commands we need to handle, e.g. SetLocality */
377	struct tpm_req_header req = (struct tpm_req_header )command;	21,084✔
378	uint32_t ordinal;
379
380	if (command_length < sizeof(*req)) {	21,084✔
381	tpmlib_write_shortmsg_error_response(rbuffer,	×
382	rlength, rTotal,
383	tpmversion);
384	return TPM_SUCCESS;	×
385	}
386
387	ordinal = be32toh(req->ordinal);	42,168✔
388
389	switch (tpmversion) {	21,084✔
390	case TPMLIB_TPM_VERSION_1_2:	12,264✔
391	switch (ordinal) {	12,264✔
392	case TPM_CC_SET_LOCALITY:	1✔
393	return tpmlib_process_setlocality(rbuffer, rlength, rTotal,	1✔
394	command, command_length,
395	tpmversion, locality_flags,
396	locality);
397	}
398	break;
399
400	case TPMLIB_TPM_VERSION_2:	8,820✔
401	switch (ordinal) {	8,820✔
402	case TPM2_CC_SET_LOCALITY:	1✔
403	return tpmlib_process_setlocality(rbuffer, rlength, rTotal,	1✔
404	command, command_length,
405	tpmversion, locality_flags,
406	locality);
407	}
408	break;
409	}
410	return TPM_SUCCESS;
411	}
412
413	#else
414
415	TPM_RESULT tpmlib_process(unsigned char **rbuffer SWTPM_ATTR_UNUSED,
416	uint32_t *rlength SWTPM_ATTR_UNUSED,
417	uint32_t *rTotal SWTPM_ATTR_UNUSED,
418	unsigned char *command SWTPM_ATTR_UNUSED,
419	uint32_t command_length SWTPM_ATTR_UNUSED,
420	uint32_t locality_flags SWTPM_ATTR_UNUSED,
421	TPM_MODIFIER_INDICATOR *locality SWTPM_ATTR_UNUSED,
422	TPMLIB_TPMVersion tpmversion SWTPM_ATTR_UNUSED)
423	{
424	return TPM_SUCCESS;
425	}
426
427	#endif /* WITH_VTPM_PROXY */
428
429	enum TPMLIB_StateType tpmlib_blobtype_to_statetype(uint32_t blobtype)	91✔
430	{
431	switch (blobtype) {
432	case PTM_BLOB_TYPE_PERMANENT:
433	return TPMLIB_STATE_PERMANENT;
434	case PTM_BLOB_TYPE_VOLATILE:
435	return TPMLIB_STATE_VOLATILE;
436	case PTM_BLOB_TYPE_SAVESTATE:
437	return TPMLIB_STATE_SAVE_STATE;
438	}
439	return 0;
440	}
441
442	/*
443	* tpmlib_handle_tcg_tpm2_cmd_header
444	*
445	* Determine whether the given byte stream is a raw TPM 2 command or
446	* whether it has a tcg_tpm2_cmd_header prefixed and if so return
447	* the offset after the header where the actual command is. In all
448	* other cases return 0.
449	*/
450	off_t tpmlib_handle_tcg_tpm2_cmd_header(const unsigned char *command,	8,659✔
451	uint32_t command_length,
452	TPM_MODIFIER_INDICATOR *locality)
453	{
454	struct tpm_req_header hdr = (struct tpm_req_header )command;	8,659✔
455	struct tpm2_send_command_prefix *tcgprefix;
456	off_t ret = 0;	8,659✔
457
458	/* return 0 for short packets or plain TPM 2 command */
459	if (command_length < sizeof(*hdr) \|\|	17,318✔
460	be16toh(hdr->tag) == TPM2_ST_NO_SESSION \|\|	16,475✔
461	be16toh(hdr->tag) == TPM2_ST_SESSIONS \|\|	7,816✔
462	command_length < sizeof(*tcgprefix))
463	return 0;
464
465	tcgprefix = (struct tpm2_send_command_prefix *)command;	5,378✔
466	if (be32toh(tcgprefix->cmd) == TPM2_SEND_COMMAND) {	10,756✔
467	ret = sizeof(*tcgprefix);	5,378✔
468	*locality = tcgprefix->locality;	5,378✔
469	}
470
471	return ret;
472	}
473
474	/*
475	* Create a Startup command with the given startupType for the
476	* given TPM version.
477	*/
478	uint32_t tpmlib_create_startup_cmd(uint16_t startupType,	119✔
479	TPMLIB_TPMVersion tpmversion,
480	unsigned char *buffer,
481	uint32_t buffersize)
482	{
483	struct tpm_startup ts;
484	uint32_t tocopy = min(sizeof(ts), buffersize);	119✔
485
486	ts.hdr.size = htobe32(sizeof(ts));	119✔
487
488	switch (tpmversion) {	119✔
489	case TPMLIB_TPM_VERSION_1_2:
490	ts.hdr.tag = htobe16(TPM_TAG_RQU_COMMAND);	28✔
491	ts.hdr.ordinal = htobe32(TPMLIB_TPM_ORD_Startup);	28✔
492	ts.startupType = htobe16(startupType);	28✔
493	break;	28✔
494	case TPMLIB_TPM_VERSION_2:
495	ts.hdr.tag = htobe16(TPM2_ST_NO_SESSION);	91✔
496	ts.hdr.ordinal = htobe32(TPMLIB_TPM2_CC_Startup);	91✔
497	switch (startupType) {	91✔
498	case TPM_ST_CLEAR:
499	ts.startupType = htobe16(TPM2_SU_CLEAR);	91✔
500	break;	91✔
501	case TPM_ST_STATE:
502	ts.startupType = htobe16(TPM2_SU_STATE);	×
503	break;	×
504	case TPM_ST_DEACTIVATED:	×
505	tocopy = 0;	×
506	logprintf(STDERR_FILENO,	×
507	"TPM 2 does not support startup deactivated.\n");
508	break;
509	default:	×
510	tocopy = 0;	×
511	logprintf(STDERR_FILENO,	×
512	"%s: internal error; unsupported startup type for TPM 2\n", __func__);
513	break;
514	}
515	break;
516	default:	×
517	tocopy = 0;	×
518	logprintf(STDERR_FILENO,	×
519	"%s: internal error; invalid TPM version\n", __func__);
520	break;
521	}
522
523	if (tocopy)	119✔
524	memcpy(buffer, &ts, tocopy);	119✔
525	return tocopy;	119✔
526	}

stefanberger / swtpm / 3982

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous