Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix use of PCR16 #2879

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Fix use of PCR16 #2879

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cc18b1a
Test: Reset PCR16 upon test exit
AndreasFuchsTPM Jul 31, 2024
6a78aa7
Test: Add pre and post check for PCR16 to be empty
AndreasFuchsTPM Jul 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions test/integration/esys-event-sequence-complete.int.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,14 @@ test_esys_event_sequence_complete(ESYS_CONTEXT * esys_context)
&results);
goto_if_error(r, "Error: EventSequenceComplete", error);

r = Esys_PCR_Reset(
esys_context,
pcrHandle_handle,
ESYS_TR_PASSWORD,
ESYS_TR_NONE,
ESYS_TR_NONE);
goto_if_error(r, "Error: PCR_Reset", error);

Esys_Free(results);
return EXIT_SUCCESS;

Expand Down
7 changes: 7 additions & 0 deletions test/integration/esys-pcr-basic.int.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,14 @@ test_esys_pcr_basic(ESYS_CONTEXT * esys_context)
ESYS_TR_NONE,
&eventData,
&digestsEvent);
goto_if_error(r, "Error: PCR_Reset", error);

r = Esys_PCR_Reset(
esys_context,
pcrHandle_handle,
ESYS_TR_PASSWORD,
ESYS_TR_NONE,
ESYS_TR_NONE);
goto_if_error(r, "Error: PCR_Reset", error);

TPMI_YES_NO allocationSuccess;
Expand Down
7 changes: 4 additions & 3 deletions test/integration/fapi-quote-destructive-eventlog.int.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1043,9 +1043,6 @@ test_fapi_quote_destructive(FAPI_CONTEXT *context)
0x00, 0x00,
};

r = pcr_reset(context, 16);
goto_if_error(r, "Error pcr_reset", error);

r = Fapi_PcrExtend(context, 16, data, EVENT_SIZE, "{ \"test\": \"myfile\" }");
goto_if_error(r, "Error Fapi_PcrExtend", error);

Expand Down Expand Up @@ -1118,6 +1115,9 @@ test_fapi_quote_destructive(FAPI_CONTEXT *context)
ASSERT(pathlist != NULL);
ASSERT(strlen(pathlist) > ASSERT_SIZE);

r = pcr_reset(context, 16);
goto_if_error(r, "Error pcr_reset", error);

r = Fapi_Delete(context, "/");
goto_if_error(r, "Error Fapi_Delete", error);

Expand All @@ -1136,6 +1136,7 @@ test_fapi_quote_destructive(FAPI_CONTEXT *context)
return EXIT_SUCCESS;

error:
pcr_reset(context, 16);
Fapi_Delete(context, "/");
SAFE_FREE(pubkey_pem);
SAFE_FREE(signature);
Expand Down
7 changes: 4 additions & 3 deletions test/integration/fapi-quote-with-primary.int.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,9 +80,6 @@ test_fapi_quote(FAPI_CONTEXT *context)
0x00, 0x00,
};

r = pcr_reset(context, 16);
goto_if_error(r, "Error pcr_reset", error);

r = Fapi_PcrExtend(context, 16, data, EVENT_SIZE, "{ \"test\": \"myfile\" }");
goto_if_error(r, "Error Fapi_PcrExtend", error);

Expand Down Expand Up @@ -289,6 +286,9 @@ test_fapi_quote(FAPI_CONTEXT *context)
ASSERT(strlen(pathlist) > ASSERT_SIZE);
LOG_INFO("\nPathlist: %s\n", pathlist);

r = pcr_reset(context, 16);
goto_if_error(r, "Error pcr_reset", error);

r = Fapi_Delete(context, "/");
goto_if_error(r, "Error Fapi_Delete", error);

Expand All @@ -305,6 +305,7 @@ test_fapi_quote(FAPI_CONTEXT *context)
return EXIT_SUCCESS;

error:
pcr_reset(context, 16);
Fapi_Delete(context, "/");
if (jso)
json_object_put(jso);
Expand Down
7 changes: 4 additions & 3 deletions test/integration/fapi-quote.int.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,9 +81,6 @@ test_fapi_quote(FAPI_CONTEXT *context)
0x00, 0x00,
};

r = pcr_reset(context, 16);
goto_if_error(r, "Error pcr_reset", error);

r = Fapi_PcrExtend(context, 16, data, EVENT_SIZE, "{ \"test\": \"myfile\" }");
goto_if_error(r, "Error Fapi_PcrExtend", error);

Expand Down Expand Up @@ -341,6 +338,9 @@ test_fapi_quote(FAPI_CONTEXT *context)
goto error;
}

r = pcr_reset(context, 16);
goto_if_error(r, "Error pcr_reset", error);

r = Fapi_Delete(context, "/");
goto_if_error(r, "Error Fapi_Delete", error);

Expand All @@ -357,6 +357,7 @@ test_fapi_quote(FAPI_CONTEXT *context)
return EXIT_SUCCESS;

error:
pcr_reset(context, 16);
Fapi_Delete(context, "/");
if (jso)
json_object_put(jso);
Expand Down
80 changes: 79 additions & 1 deletion test/integration/test-common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@
*
* All rights reserved.
***********************************************************************/
#include "tss2_sys.h"

#ifdef HAVE_CONFIG_H
#include "config.h" // IWYU pragma: keep
#endif
Expand Down Expand Up @@ -44,7 +46,7 @@ struct {
};

struct tpm_state {
TPMS_CAPABILITY_DATA capabilities[7];
TPMS_CAPABILITY_DATA capabilities[sizeof(capabilities_to_dump) / sizeof(capabilities_to_dump[0])];
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ARRAY_LEN() is defined in src/util/aux_util.h

};

/** Define a proxy tcti that returns yielded on every second invocation
Expand Down Expand Up @@ -235,6 +237,40 @@ transient_empty(TSS2_SYS_CONTEXT *sys_ctx)
return EXIT_SUCCESS;
}

int
pcr16_empty(TSS2_SYS_CONTEXT *sys_ctx)
{
TSS2_RC rc;
TPML_DIGEST pcr_values = { 0 };
TPML_PCR_SELECTION pcr_selection = { .count=1, .pcrSelections = { { .hash = TPM2_ALG_SHA256, .sizeofSelect = 3, .pcrSelect = { 0 } } } };
pcr_selection.pcrSelections[0].pcrSelect[(16 / 8)] = 1 << (16 % 8);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we not have a macro for this?


do {
rc = Tss2_Sys_PCR_Read(sys_ctx, NULL,
&pcr_selection, NULL, NULL,
&pcr_values,
NULL);
} while (rc == TPM2_RC_YIELDED); // TODO also for other cmds?
if (rc != TSS2_RC_SUCCESS) {
LOG_ERROR("TPM2_PCR_Read failed: 0x%" PRIx32, rc);
return EXIT_ERROR;
}

if (pcr_values.count != 1) {
LOG_ERROR("TPM2_PCR_Read for PCR 16 in SHA256 did not return a value");
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you forget a return EXIT_ERROR; here?

}

for (UINT16 i = 0; i < pcr_values.digests[0].size; i++) {
if (pcr_values.digests[0].buffer[i] != 0x00) {
LOGBLOB_ERROR(&pcr_values.digests[0].buffer[0], pcr_values.digests[0].size,
"PCR 16 in SHA256 is not 0x000..000");
return EXIT_ERROR;
}
}

return EXIT_SUCCESS;
}

int
dumpstate(TSS2_SYS_CONTEXT *sys_ctx, tpm_state *state_first, bool compare)
{
Expand Down Expand Up @@ -390,6 +426,13 @@ test_sys_checks_pre(TSS2_TEST_SYS_CONTEXT *test_ctx)
return ret;
}

LOG_DEBUG("Running System API pre-test checks: pcr16 empty");
ret = pcr16_empty(test_ctx->sys_ctx);
if (ret != EXIT_SUCCESS) {
LOG_ERROR("PCR16 is not empty");
return ret;
}

return EXIT_SUCCESS;
}

Expand All @@ -398,13 +441,27 @@ test_sys_checks_post(TSS2_TEST_SYS_CONTEXT *test_ctx)
{
int ret;

LOG_DEBUG("Running System API pre-test checks: transient handles empty");
ret = transient_empty(test_ctx->sys_ctx);
if (ret != EXIT_SUCCESS) {
LOG_ERROR("TPM contains transient objects.");
return ret;
}

LOG_DEBUG("Running System API post-test checks: dump capabilities");
ret = dumpstate(test_ctx->sys_ctx, test_ctx->tpm_state, 1);
if (ret != EXIT_SUCCESS) {
LOG_ERROR("Error while performing TPM state checks.");
return ret;
}

LOG_DEBUG("Running System API post-test checks: pcr16 empty");
ret = pcr16_empty(test_ctx->sys_ctx);
if (ret != EXIT_SUCCESS) {
LOG_ERROR("PCR16 is not empty");
return ret;
}

return EXIT_SUCCESS;
}

Expand Down Expand Up @@ -533,6 +590,13 @@ test_esys_checks_pre(TSS2_TEST_ESYS_CONTEXT *test_ctx)
return ret;
}

LOG_DEBUG("Running System API pre-test checks: pcr16 empty");
ret = pcr16_empty(sys_context);
if (ret != EXIT_SUCCESS) {
LOG_ERROR("PCR16 is not empty");
return ret;
}

return EXIT_SUCCESS;
}

Expand All @@ -549,13 +613,27 @@ test_esys_checks_post(TSS2_TEST_ESYS_CONTEXT *test_ctx)
return EXIT_ERROR;
}

LOG_DEBUG("Running System API pre-test checks: transient handles empty");
ret = transient_empty(sys_context);
if (ret != EXIT_SUCCESS) {
LOG_ERROR("TPM contains transient objects.");
return ret;
}

LOG_DEBUG("Running System API post-test checks: dump capabilities");
ret = dumpstate(sys_context, test_ctx->tpm_state, 1);
if (ret != EXIT_SUCCESS) {
LOG_ERROR("Error while performing TPM state checks.");
return ret;
}

LOG_DEBUG("Running System API pre-test checks: pcr16 empty");
ret = pcr16_empty(sys_context);
if (ret != EXIT_SUCCESS) {
LOG_ERROR("PCR16 is not empty");
return ret;
}

return EXIT_SUCCESS;
}

Expand Down
Loading