diff --git a/src/tss2-esys/api/Esys_HierarchyChangeAuth.c b/src/tss2-esys/api/Esys_HierarchyChangeAuth.c index 70f7210f0..1ab4c9343 100644 --- a/src/tss2-esys/api/Esys_HierarchyChangeAuth.c +++ b/src/tss2-esys/api/Esys_HierarchyChangeAuth.c @@ -26,11 +26,13 @@ static void store_input_parameters ( const TPM2B_AUTH *newAuth) { esysContext->in.HierarchyChangeAuth.authHandle = authHandle; - if (newAuth == NULL) + if (newAuth == NULL) { memset(&esysContext->in.HierarchyChangeAuth.newAuth, 0, sizeof(esysContext->in.HierarchyChangeAuth.newAuth)); - else + } else { esysContext->in.HierarchyChangeAuth.newAuth = *newAuth; + iesys_strip_trailing_zeros(&esysContext->in.HierarchyChangeAuth.newAuth); + } } /** One-Call function for TPM2_HierarchyChangeAuth @@ -175,7 +177,9 @@ Esys_HierarchyChangeAuth_Async( /* Check input parameters */ r = check_session_feasibility(shandle1, shandle2, shandle3, 1); return_state_if_error(r, _ESYS_STATE_INIT, "Check session usage"); + store_input_parameters(esysContext, authHandle, newAuth); + iesys_strip_trailing_zeros(&esysContext->in.HierarchyChangeAuth.newAuth); /* Retrieve the metadata objects for provided handles */ r = esys_GetResourceObject(esysContext, authHandle, &authHandleNode); @@ -186,7 +190,7 @@ Esys_HierarchyChangeAuth_Async( (authHandleNode == NULL) ? TPM2_RH_NULL : authHandleNode->rsrc.handle, - newAuth); + &esysContext->in.HierarchyChangeAuth.newAuth); return_state_if_error(r, _ESYS_STATE_INIT, "SAPI Prepare returned error."); /* Calculate the cpHash Values */ diff --git a/src/tss2-esys/api/Esys_NV_ChangeAuth.c b/src/tss2-esys/api/Esys_NV_ChangeAuth.c index d555adb1f..cbd9b6670 100644 --- a/src/tss2-esys/api/Esys_NV_ChangeAuth.c +++ b/src/tss2-esys/api/Esys_NV_ChangeAuth.c @@ -159,6 +159,8 @@ Esys_NV_ChangeAuth_Async( esysContext, nvIndex, newAuth); TSS2L_SYS_AUTH_COMMAND auths; RSRC_NODE_T *nvIndexNode; + TPM2B_AUTH *authCopy; + TPMI_ALG_HASH hashAlg; /* Check context, sequence correctness and set state to error for now */ if (esysContext == NULL) { @@ -174,10 +176,14 @@ Esys_NV_ChangeAuth_Async( r = check_session_feasibility(shandle1, shandle2, shandle3, 1); return_state_if_error(r, _ESYS_STATE_INIT, "Check session usage"); store_input_parameters(esysContext, nvIndex, newAuth); + authCopy = &esysContext->in.HierarchyChangeAuth.newAuth; /* Retrieve the metadata objects for provided handles */ r = esys_GetResourceObject(esysContext, nvIndex, &nvIndexNode); return_state_if_error(r, _ESYS_STATE_INIT, "nvIndex unknown."); + hashAlg = nvIndexNode->rsrc.misc.rsrc_nv_pub.nvPublic.nameAlg; + r = iesys_adapt_auth_value(&esysContext->crypto_backend, authCopy, hashAlg); + return_state_if_error(r, _ESYS_STATE_INIT, "Adapt auth value"); /* Initial invocation of SAPI to prepare the command buffer with parameters */ r = Tss2_Sys_NV_ChangeAuth_Prepare(esysContext->sys, diff --git a/src/tss2-esys/api/Esys_ObjectChangeAuth.c b/src/tss2-esys/api/Esys_ObjectChangeAuth.c index c2b95d04a..04152fae6 100644 --- a/src/tss2-esys/api/Esys_ObjectChangeAuth.c +++ b/src/tss2-esys/api/Esys_ObjectChangeAuth.c @@ -148,6 +148,11 @@ Esys_ObjectChangeAuth_Async( TSS2L_SYS_AUTH_COMMAND auths; RSRC_NODE_T *objectHandleNode; RSRC_NODE_T *parentHandleNode; + TPM2B_AUTH authCopy = + { .size = 0, + .buffer = {} + }; + TPMI_ALG_HASH hashAlg = 0; /* Check context, sequence correctness and set state to error for now */ if (esysContext == NULL) { @@ -169,6 +174,17 @@ Esys_ObjectChangeAuth_Async( r = esys_GetResourceObject(esysContext, parentHandle, &parentHandleNode); return_state_if_error(r, _ESYS_STATE_INIT, "parentHandle unknown."); + if (objectHandleNode->rsrc.rsrcType == IESYSC_KEY_RSRC) { + hashAlg = objectHandleNode->rsrc.misc.rsrc_key_pub.publicArea.nameAlg; + } + + if (newAuth) { + authCopy = *newAuth; + }; + + r = iesys_adapt_auth_value(&esysContext->crypto_backend, &authCopy, hashAlg); + return_state_if_error(r, _ESYS_STATE_INIT, "Adapt auth value"); + /* Initial invocation of SAPI to prepare the command buffer with parameters */ r = Tss2_Sys_ObjectChangeAuth_Prepare(esysContext->sys, (objectHandleNode == NULL) @@ -177,7 +193,7 @@ Esys_ObjectChangeAuth_Async( (parentHandleNode == NULL) ? TPM2_RH_NULL : parentHandleNode->rsrc.handle, - newAuth); + &authCopy); return_state_if_error(r, _ESYS_STATE_INIT, "SAPI Prepare returned error."); /* Calculate the cpHash Values */ diff --git a/test/integration/esys-check-auth-with-trailing-zero.int.c b/test/integration/esys-check-auth-with-trailing-zero.int.c index 908b0b2dd..a9f52e587 100644 --- a/test/integration/esys-check-auth-with-trailing-zero.int.c +++ b/test/integration/esys-check-auth-with-trailing-zero.int.c @@ -21,13 +21,26 @@ * The key is created again. * The creation of an session where an bind key with a trailing * zero in the auth value is tested. + * A session where the owner hierarchy is used as bind key in + * combination with Esys_HierarchyChangeAuth is tested. + * An nv index with trailing zeros in the auth value with + * trailing zeros in combination with Esys_NV_ChangeAuth + * is tested. * * Tested ESYS commands: * - Esys_Create() (M) * - Esys_CreatePrimary() (M) * - Esys_FlushContext() (M) * - Esys_StartAuthSession() (M) - * + * - Esys_PolicyAuthValue() (M) + * - Esys_PolicyCommandcode() (M) + * - Esys_PolicyGetDigest() (M) + * - Esys_NV_DefineSpace() (M) + * - Esys_NV_Write() (M) + * - Esys_NV_Read() (M) + * - Esys_NV_UndefineSpace() (M) + * - Esys_NV_ChangeAuth() (M) + * @param[in,out] esys_context The ESYS_CONTEXT. * @retval EXIT_FAILURE * @retval EXIT_SUCCESS @@ -41,6 +54,11 @@ test_esys_trailing_zeros_in_auth(ESYS_CONTEXT * esys_context) ESYS_TR session = ESYS_TR_NONE; ESYS_TR enc_session = ESYS_TR_NONE; ESYS_TR bind_key = ESYS_TR_NONE; + ESYS_TR key = ESYS_TR_NONE; + ESYS_TR key_sign = ESYS_TR_NONE; + ESYS_TR policySession = ESYS_TR_NONE; + ESYS_TR sessionTrial = ESYS_TR_NONE; + ESYS_TR nvHandle = ESYS_TR_NONE; TPM2B_PUBLIC *outPublic = NULL; TPM2B_CREATION_DATA *creationData = NULL; @@ -216,8 +234,375 @@ test_esys_trailing_zeros_in_auth(ESYS_CONTEXT * esys_context) goto_if_error(r, "Error Esys_FlushContext", error); bind_key = ESYS_TR_NONE; + /* Test HierarchyChangeAuth */ + + TPM2B_AUTH authKey2 = { + .size = 6, + .buffer = { 6, 7, 8, 9, 10, 0 } + }; + + TPM2B_SENSITIVE_CREATE inSensitive2 = { + .size = 0, + .sensitive = { + .userAuth = { + .size = 0, + .buffer = {0} + }, + .data = { + .size = 0, + .buffer = {} + } + } + }; + + inSensitive2.sensitive.userAuth = authKey2; + + + TPM2B_AUTH newAuth = { + .size = 6, + .buffer = {6, 7, 8, 9, 10, 0 } + }; + + TPM2B_AUTH newAuth2 = { + .size = 6, + .buffer = {11, 12, 13, 14, 15, 0 } + }; + + TPM2B_PUBLIC template_parent = { + .size = 0, + .publicArea = { + .type = TPM2_ALG_RSA, + .nameAlg = TPM2_ALG_SHA256, + .objectAttributes = (TPMA_OBJECT_USERWITHAUTH | + TPMA_OBJECT_RESTRICTED | + TPMA_OBJECT_DECRYPT | + TPMA_OBJECT_FIXEDTPM | + TPMA_OBJECT_FIXEDPARENT | + TPMA_OBJECT_SENSITIVEDATAORIGIN), + + .authPolicy = { + .size = 0, + }, + .parameters.rsaDetail = { + .symmetric = { + .algorithm = TPM2_ALG_AES, + .keyBits.aes = 128, + .mode.aes = TPM2_ALG_CFB + }, + .scheme = { + .scheme = + TPM2_ALG_NULL, + }, + .keyBits = 2048, + .exponent = 0 + }, + .unique.rsa = { + .size = 0, + .buffer = {} + , + } + } + }; + + Esys_Free(outPublic3); + outPublic3 = NULL; + Esys_Free(outPrivate3); + outPrivate3 = NULL; + + r = Esys_Create(esys_context, primaryHandle, ESYS_TR_PASSWORD, ESYS_TR_NONE, + ESYS_TR_NONE, &inSensitive2, &template_parent, NULL, &(TPML_PCR_SELECTION) {}, + &outPrivate3 , &outPublic3, NULL, NULL, NULL); + goto_if_error(r, "Error Esys_Create", error); + + r = Esys_HierarchyChangeAuth(esys_context, + ESYS_TR_RH_OWNER, + ESYS_TR_PASSWORD, + ESYS_TR_NONE, + ESYS_TR_NONE, + &newAuth); + + r = Esys_StartAuthSession(esys_context, primaryHandle, ESYS_TR_RH_OWNER, ESYS_TR_NONE, + ESYS_TR_NONE, ESYS_TR_NONE, NULL, TPM2_SE_HMAC, + &SESSION_TEMPLATE_SYM_AES_128_CFB, + TPM2_ALG_SHA256, &session); + goto_if_error(r, "Error Esys_StartAuthSession", error); + + r = Esys_TRSess_SetAttributes(esys_context, session, sessionAttributes, 0xff); + goto_if_error(r, "Error Esys_TRSess_SetAttributes", error); + + r = Esys_Load(esys_context, primaryHandle, session, ESYS_TR_NONE, ESYS_TR_NONE, + outPrivate3, outPublic3, &key); + goto_if_error(r, "Error Esys_Load", error); + + r = Esys_HierarchyChangeAuth(esys_context, + ESYS_TR_RH_OWNER, + ESYS_TR_PASSWORD, + ESYS_TR_NONE, + ESYS_TR_NONE, + &newAuth2); + goto_if_error(r, "Error: HierarchyChangeAuth", error); + + Esys_Free(outPublic3); + Esys_Free(outPrivate3); + + TPM2B_PUBLIC template_sign = { + .size = 0, + .publicArea = { + .type = TPM2_ALG_ECC, + .nameAlg = TPM2_ALG_SHA256, + .objectAttributes = (TPMA_OBJECT_USERWITHAUTH | + TPMA_OBJECT_RESTRICTED | + TPMA_OBJECT_DECRYPT | + TPMA_OBJECT_FIXEDTPM | + TPMA_OBJECT_FIXEDPARENT | + TPMA_OBJECT_SENSITIVEDATAORIGIN), + .authPolicy = { + .size = 0, + }, + .parameters.eccDetail = { + .symmetric ={ + .algorithm = TPM2_ALG_AES, + .keyBits.aes = 128, + .mode.aes = TPM2_ALG_CFB}, + .scheme = { + .scheme = TPM2_ALG_NULL + }, + .curveID = TPM2_ECC_NIST_P256, + .kdf = { + .scheme = TPM2_ALG_NULL, + .details = {}} + }, + .unique.ecc = { + .x = {.size = 0,.buffer = {}}, + .y = {.size = 0,.buffer = {}}, + }, + }, + }; + + Esys_FlushContext(esys_context, primaryHandle); + primaryHandle = ESYS_TR_NONE; + + r = Esys_TR_SetAuth(esys_context, key, &authKey2); + goto_if_error(r, "Error Esys_", error); + + r = Esys_Create(esys_context, key, ESYS_TR_PASSWORD, session, + ESYS_TR_NONE, &inSensitive2, &template_sign, NULL, &(TPML_PCR_SELECTION) {}, + &outPrivate3 , &outPublic3, NULL, NULL, NULL); + goto_if_error(r, "Error Esys_Create", error); + + r = Esys_Load(esys_context, key, session, ESYS_TR_NONE, ESYS_TR_NONE, + outPrivate3, outPublic3, &key_sign); + goto_if_error(r, "Error Esys_Load", error); + + /* Reset auth value for storage hierarchy */ + r = Esys_HierarchyChangeAuth(esys_context, + ESYS_TR_RH_OWNER, + ESYS_TR_PASSWORD, + ESYS_TR_NONE, + ESYS_TR_NONE, + NULL); + goto_if_error(r, "Error: HierarchyChangeAuth", error); + + /* Test NV_ChangeAuth */ + + TPM2B_NV_PUBLIC *nvPublic = NULL; + TPM2B_NAME *nvName = NULL; + TPM2B_MAX_NV_BUFFER *nv_test_data2 = NULL; + TPM2B_DIGEST *policyDigestTrial = NULL; + TPMT_SYM_DEF symmetricTrial = {.algorithm = TPM2_ALG_AES, + .keyBits = {.aes = 128}, + .mode = {.aes = TPM2_ALG_CFB} + }; + TPM2B_NONCE nonceCallerTrial = { + .size = 20, + .buffer = {11, 12, 13, 14, 15, 16, 17, 18, 19, 11, + 21, 22, 23, 24, 25, 26, 27, 28, 29, 30} + }; + + r = Esys_StartAuthSession(esys_context, ESYS_TR_NONE, ESYS_TR_NONE, + ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, + &nonceCallerTrial, + TPM2_SE_TRIAL, &symmetricTrial, TPM2_ALG_SHA256, + &sessionTrial); + goto_if_error(r, "Error: During initialization of policy trial session", error); + + r = Esys_PolicyAuthValue(esys_context, + sessionTrial, + ESYS_TR_NONE, + ESYS_TR_NONE, + ESYS_TR_NONE + ); + goto_if_error(r, "Error: PolicyAuthValue", error); + + r = Esys_PolicyCommandCode(esys_context, + sessionTrial, + ESYS_TR_NONE, + ESYS_TR_NONE, + ESYS_TR_NONE, + TPM2_CC_NV_ChangeAuth + ); + goto_if_error(r, "Error: PolicyCommandCode", error); + + r = Esys_PolicyGetDigest(esys_context, + sessionTrial, + ESYS_TR_NONE, + ESYS_TR_NONE, + ESYS_TR_NONE, + &policyDigestTrial + ); + goto_if_error(r, "Error: PolicyGetDigest", error); + + r = Esys_FlushContext(esys_context, sessionTrial); + goto_if_error(r, "Flushing context", error); + sessionTrial = ESYS_TR_NONE; + + TPM2B_AUTH auth = {.size = 20, + .buffer={10, 11, 12, 13, 14, 15, 16, 17, 18, 19, + 20, 21, 22, 23, 24, 25, 26, 27, 28, 0}}; + + TPM2B_AUTH new_auth = {.size = 20, + .buffer={30, 31, 32, 33, 34, 35, 36, 37, 38, 39, + 40, 41, 42, 43, 44, 45, 46, 47, 48, 0}}; + + TPM2B_NV_PUBLIC publicInfo = { + .size = 0, + .nvPublic = { + .nvIndex =TPM2_NV_INDEX_FIRST, + .nameAlg = TPM2_ALG_SHA256, + .attributes = ( + TPMA_NV_OWNERWRITE | + TPMA_NV_AUTHWRITE | + TPMA_NV_WRITE_STCLEAR | + TPMA_NV_READ_STCLEAR | + TPMA_NV_AUTHREAD | + TPMA_NV_OWNERREAD + ), + .authPolicy = *policyDigestTrial, + .dataSize = 32, + } + }; + + Esys_Free(policyDigestTrial); + policyDigestTrial = NULL; + + r = Esys_NV_DefineSpace(esys_context, + ESYS_TR_RH_OWNER, + session, + ESYS_TR_NONE, + ESYS_TR_NONE, + &auth, + &publicInfo, + &nvHandle); + + goto_if_error(r, "Error esys define nv space", error); + + UINT16 offset = 0; + TPM2B_MAX_NV_BUFFER nv_test_data = + { .size = 20, + .buffer= {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, + 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0}}; + + r = Esys_NV_Write(esys_context, + nvHandle, + nvHandle, + session, + ESYS_TR_NONE, + ESYS_TR_NONE, + &nv_test_data, + offset); + + goto_if_error(r, "Error esys nv write", error); + + r = Esys_NV_Read(esys_context, + nvHandle, + nvHandle, + session, + ESYS_TR_NONE, + ESYS_TR_NONE, + 20, + 0, + &nv_test_data2); + + goto_if_error(r, "Error esys nv read", error); + + Esys_Free(nvPublic); + Esys_Free(nvName); + Esys_Free(nv_test_data2); + nv_test_data2 = NULL; + + TPMT_SYM_DEF policySymmetric = + {.algorithm = TPM2_ALG_AES, + .keyBits = {.aes = 128}, + .mode = {.aes = TPM2_ALG_CFB} + }; + + TPM2B_NONCE policyNonceCaller = { + .size = 20, + .buffer = {11, 12, 13, 14, 15, 16, 17, 18, 19, 11, + 21, 22, 23, 24, 25, 26, 27, 28, 29, 30} + }; + + r = Esys_StartAuthSession(esys_context, ESYS_TR_NONE, ESYS_TR_NONE, + ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, + &policyNonceCaller, + TPM2_SE_POLICY, &policySymmetric, TPM2_ALG_SHA256, + &policySession); + goto_if_error(r, "Error: During initialization of policy trial session", error); + + r = Esys_PolicyAuthValue(esys_context, + policySession, + ESYS_TR_NONE, + ESYS_TR_NONE, + ESYS_TR_NONE + ); + goto_if_error(r, "Error: PolicyAuthValue", error); + + r = Esys_PolicyCommandCode(esys_context, + policySession, + ESYS_TR_NONE, + ESYS_TR_NONE, + ESYS_TR_NONE, + TPM2_CC_NV_ChangeAuth + ); + goto_if_error(r, "Error: PolicyCommandCode", error); + + r = Esys_NV_ChangeAuth(esys_context, nvHandle, policySession, + ESYS_TR_NONE, ESYS_TR_NONE, &new_auth); + goto_if_error(r, "Error Esys_NV_ChangeAuth", error); + + r = Esys_NV_Read(esys_context, + nvHandle, + nvHandle, + session, + ESYS_TR_NONE, + ESYS_TR_NONE, + 20, + 0, + &nv_test_data2); + + goto_if_error(r, "Error esys nv read", error); + + Esys_Free(nv_test_data2); + nv_test_data2 = NULL; + + r = Esys_NV_UndefineSpace(esys_context, + ESYS_TR_RH_OWNER, + nvHandle, + session, + ESYS_TR_NONE, + ESYS_TR_NONE); + goto_if_error(r, "Error: NV_UndefineSpace", error); + + nvHandle = ESYS_TR_NONE; + error: + if (session != ESYS_TR_NONE) { + if (Esys_FlushContext(esys_context, policySession) != TSS2_RC_SUCCESS) { + LOG_ERROR("Cleanup session failed."); + } + } + if (session != ESYS_TR_NONE) { if (Esys_FlushContext(esys_context, session) != TSS2_RC_SUCCESS) { LOG_ERROR("Cleanup session failed."); @@ -242,6 +627,29 @@ test_esys_trailing_zeros_in_auth(ESYS_CONTEXT * esys_context) } } + if (key != ESYS_TR_NONE) { + if (Esys_FlushContext(esys_context, key) != TSS2_RC_SUCCESS) { + LOG_ERROR("Cleanup key."); + } + } + + if (key_sign != ESYS_TR_NONE) { + if (Esys_FlushContext(esys_context, key_sign) != TSS2_RC_SUCCESS) { + LOG_ERROR("Cleanup key2 failed."); + } + } + + if (nvHandle != ESYS_TR_NONE) { + if (Esys_NV_UndefineSpace(esys_context, + ESYS_TR_RH_OWNER, + nvHandle, + session, + ESYS_TR_NONE, + ESYS_TR_NONE) != TSS2_RC_SUCCESS) { + LOG_ERROR("Cleanup nvHandle failed."); + } + } + Esys_Free(outPublic); Esys_Free(creationData); Esys_Free(creationHash);