1 /* SPDX-License-Identifier: BSD-2-Clause */
2 /*******************************************************************************
3 * Copyright 2017-2018, Fraunhofer SIT sponsored by Infineon Technologies AG
4 * All rights reserved.
5 *******************************************************************************/
6
7 #ifdef HAVE_CONFIG_H
8 #include <config.h>
9 #endif
10
11 #include <stdlib.h>
12 #include <stdio.h>
13 #include <string.h>
14 #include <errno.h>
15 #include <fcntl.h>
16 #include <unistd.h>
17
18 #include "tss2_fapi.h"
19
20 #define LOGMODULE test
21 #include "util/log.h"
22 #include "util/aux_util.h"
23 #include "test-fapi.h"
24
25 #ifdef TEST_PASSWORD
26 #define PASSWORD "abc"
27 #else
28 #define PASSWORD ""
29 #endif
30
31 static TSS2_RC
auth_callback(FAPI_CONTEXT * context,char const * description,char ** auth,void * userData)32 auth_callback(
33 FAPI_CONTEXT *context,
34 char const *description,
35 char **auth,
36 void *userData)
37 {
38 (void)description;
39 (void)userData;
40 *auth = strdup(PASSWORD);
41 return_if_null(*auth, "Out of memory.", TSS2_FAPI_RC_MEMORY);
42 return TSS2_RC_SUCCESS;
43 }
44 #define SIGN_TEMPLATE "sign,noDa"
45
46 /** Test several FAPI policies by usage of signing key.
47 *
48 * Which test case will be executed is determined by the compiler switches:
49 * TEST_POLICY_PASSWORD, TEST_POLICY_AUTH_VALUE, TEST_POLICY_LOCALITY
50 * TEST_POLICY_PHYSICAL_PRESENCE, TEST_POLICY_COMMAND_CODE, TEST_POLICY_COUNTERTIMER.
51 *
52 * Tested FAPI commands:
53 * - Fapi_Provision()
54 * - Fapi_Import()
55 * - Fapi_CreateKey()
56 * - Fapi_SetAuthCB()
57 * - Fapi_Sign()
58 * - Fapi_Delete()
59 *
60 * Tested Policies:
61 * - PolicyPassword
62 * - PolicyAuthValue
63 * - PolicyLocality
64 * - PolicyPhysicalPresence
65 * - PolicyCommandCode
66 * - PolicyCounterTimer
67 *
68 * @param[in,out] context The FAPI_CONTEXT.
69 * @retval EXIT_FAILURE
70 * @retval EXIT_SUCCESS
71 */
72 int
test_fapi_key_create_policies_sign(FAPI_CONTEXT * context)73 test_fapi_key_create_policies_sign(FAPI_CONTEXT *context)
74 {
75 TSS2_RC r;
76
77 #if defined(TEST_POLICY_PASSWORD)
78 char *policy_name = "/policy/pol_password";
79 char *policy_file = FAPI_POLICIES "/policy/pol_password.json";
80 #elif defined(TEST_POLICY_AUTH_VALUE)
81 char *policy_name = "/policy/pol_auth_value";
82 char *policy_file = FAPI_POLICIES "/policy/pol_auth_value.json";
83 #elif defined(TEST_POLICY_LOCALITY)
84 char *policy_name = "/policy/pol_locality";
85 char *policy_file = FAPI_POLICIES "/policy/pol_locality.json";
86 #elif defined(TEST_POLICY_PHYSICAL_PRESENCE)
87 char *policy_name = "/policy/pol_physical_presence";
88 char *policy_file = FAPI_POLICIES "/policy/pol_physical_presence.json";
89 #elif defined(TEST_POLICY_COMMAND_CODE)
90 char *policy_name = "/policy/pol_command_code";
91 char *policy_file = FAPI_POLICIES "/policy/pol_command_code.json";
92 #elif defined(TEST_POLICY_COUNTERTIMER)
93 char *policy_name = "/policy/pol_countertimer";
94 char *policy_file = FAPI_POLICIES "/policy/pol_countertimer.json";
95 #else
96 #error "Please define POLICY_PASSWORD,_AUTH_VALUE,_LOCALITY,_PHYSICAL_PRESENCE,_COMMAND_CODE,_COUNTERTIMER"
97 #endif
98
99 FILE *stream = NULL;
100 uint8_t *signature =NULL;
101 char *publicKey = NULL;
102 char *json_policy = NULL;
103 long policy_size;
104
105 r = Fapi_Provision(context, NULL, NULL, NULL);
106 goto_if_error(r, "Error Fapi_Provision", error);
107
108 r = pcr_reset(context, 16);
109 goto_if_error(r, "Error pcr_reset", error);
110
111 stream = fopen(policy_file, "r");
112 if (!stream) {
113 LOG_ERROR("File %s does not exist", policy_file);
114 goto error;
115 }
116 fseek(stream, 0L, SEEK_END);
117 policy_size = ftell(stream);
118 fclose(stream);
119 json_policy = malloc(policy_size + 1);
120 goto_if_null(json_policy,
121 "Could not allocate memory for the JSON policy",
122 TSS2_FAPI_RC_MEMORY, error);
123 stream = fopen(policy_file, "r");
124 ssize_t ret = read(fileno(stream), json_policy, policy_size);
125 if (ret != policy_size) {
126 LOG_ERROR("IO error %s.", policy_file);
127 goto error;
128 }
129 json_policy[policy_size] = '\0';
130
131 r = Fapi_Import(context, policy_name, json_policy);
132 goto_if_error(r, "Error Fapi_Import", error);
133
134 r = Fapi_CreateKey(context, "HS/SRK/mySignKey", SIGN_TEMPLATE,
135 policy_name, PASSWORD);
136 goto_if_error(r, "Error Fapi_CreateKey", error);
137 size_t signatureSize = 0;
138
139 TPM2B_DIGEST digest = {
140 .size = 20,
141 .buffer = {
142 0x67, 0x68, 0x03, 0x3e, 0x21, 0x64, 0x68, 0x24, 0x7b, 0xd0,
143 0x31, 0xa0, 0xa2, 0xd9, 0x87, 0x6d, 0x79, 0x81, 0x8f, 0x8f
144 }
145 };
146
147 r = Fapi_SetAuthCB(context, auth_callback, "");
148 goto_if_error(r, "Error SetPolicyAuthCallback", error);
149
150 r = Fapi_Sign(context, "HS/SRK/mySignKey", NULL,
151 &digest.buffer[0], digest.size, &signature, &signatureSize,
152 &publicKey, NULL);
153
154 #if defined(TEST_POLICY_PHYSICAL_PRESENCE)
155 if ((r & ~TPM2_RC_N_MASK) == TPM2_RC_PP) {
156 LOG_WARNING("Test requires physical presence.");
157 goto skip;
158 } else if (r == TPM2_RC_COMMAND_CODE) {
159 LOG_WARNING("Command not supported, probably PolicyPhysicalPresence");
160 goto skip;
161 }
162 #endif /* TEST_POLICY_PHYSICAL_PRESENCE */
163 goto_if_error(r, "Error Fapi_Sign", error);
164
165 r = Fapi_Delete(context, "/HS/SRK/mySignKey");
166 goto_if_error(r, "Error Fapi_Delete", error);
167
168 r = Fapi_Delete(context, "/HS/SRK");
169 goto_if_error(r, "Error Fapi_Delete", error);
170
171 SAFE_FREE(json_policy);
172 SAFE_FREE(signature);
173 SAFE_FREE(publicKey);
174 return EXIT_SUCCESS;
175
176 #if defined(TEST_POLICY_PHYSICAL_PRESENCE)
177 r = Fapi_Delete(context, "/HS/SRK/mySignKey");
178 goto_if_error(r, "Error Fapi_Delete", error);
179
180 r = Fapi_Delete(context, "/HS/SRK");
181 goto_if_error(r, "Error Fapi_Delete", error);
182
183 skip:
184 Fapi_Delete(context, "/HS/SRK");
185 SAFE_FREE(json_policy);
186 SAFE_FREE(signature);
187 SAFE_FREE(publicKey);
188 return EXIT_SKIP;
189 #endif /* TEST_POLICY_PHYSICAL_PRESENCE */
190
191 error:
192 Fapi_Delete(context, "/HS/SRK");
193
194 SAFE_FREE(json_policy);
195 SAFE_FREE(signature);
196 SAFE_FREE(publicKey);
197 return EXIT_FAILURE;
198 }
199
200 int
test_invoke_fapi(FAPI_CONTEXT * fapi_context)201 test_invoke_fapi(FAPI_CONTEXT *fapi_context)
202 {
203 return test_fapi_key_create_policies_sign(fapi_context);
204 }
205