SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #24368 from poettering/tpm2-json-pcr-array-rework

Browse Source 
tpm2: add helpers for building/parsing JSON arrays of PCR indexes
This commit is contained in:
Lennart Poettering
2022-08-19 21:51:47 +02:00
committed by GitHub
parent 3093b158bc 8de8ec88da
commit 82b0039eb0
4 changed files with 72 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cryptsetup/cryptsetup-tokens/luks2-tpm2.c
+6 -15
View File
@@ -66,8 +66,8 @@ int parse_luks2_tpm2_data(
TPM2Flags *ret_flags) {
int r;
JsonVariant *w, *e;
uint32_t pcr_mask = 0;
JsonVariant *w;
uint32_t pcr_mask;
uint16_t pcr_bank = UINT16_MAX, primary_alg = TPM2_ALG_ECC;
_cleanup_free_ char *base64_blob = NULL, *hex_policy_hash = NULL;
_cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
@@ -85,21 +85,12 @@ int parse_luks2_tpm2_data(
return -EINVAL;
w = json_variant_by_key(v, "tpm2-pcrs");
if (!w || !json_variant_is_array(w))
if (!w)
return -EINVAL;
JSON_VARIANT_ARRAY_FOREACH(e, w) {
uint64_t u;
if (!json_variant_is_number(e))
return -EINVAL;
u = json_variant_unsigned(e);
if (u >= TPM2_PCRS_MAX)
return -EINVAL;
pcr_mask |= UINT32_C(1) << u;
}
r = tpm2_parse_pcr_json_array(w, &pcr_mask);
if (r < 0)
return r;
if (search_pcr_mask != UINT32_MAX &&
search_pcr_mask != pcr_mask)
src/cryptsetup/cryptsetup-tpm2.c
+5 -17
View File
@@ -185,7 +185,7 @@ int find_tpm2_auto_data(
for (token = start_token; token < sym_crypt_token_max(CRYPT_LUKS2); token++) {
_cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
JsonVariant *w, *e;
JsonVariant *w;
int ks;
r = cryptsetup_get_token_as_json(cd, token, "systemd-tpm2", &v);
@@ -203,25 +203,13 @@ int find_tpm2_auto_data(
}
w = json_variant_by_key(v, "tpm2-pcrs");
if (!w || !json_variant_is_array(w))
if (!w)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"TPM2 token data lacks 'tpm2-pcrs' field.");
assert(pcr_mask == 0);
JSON_VARIANT_ARRAY_FOREACH(e, w) {
uint64_t u;
if (!json_variant_is_number(e))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"TPM2 PCR is not a number.");
u = json_variant_unsigned(e);
if (u >= TPM2_PCRS_MAX)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"TPM2 PCR number out of range.");
pcr_mask |= UINT32_C(1) << u;
}
r = tpm2_parse_pcr_json_array(w, &pcr_mask);
if (r < 0)
return log_error_errno(r, "Failed to parse TPM2 PCR mask: %m");
if (search_pcr_mask != UINT32_MAX &&
search_pcr_mask != pcr_mask) /* PCR mask doesn't match what is configured, ignore this entry */