From d412b1629c54a6cc40dff225394661e09d20c461 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 3 Jun 2024 17:44:15 +0200 Subject: [PATCH] =?UTF-8?q?tpm2-util:=20rename=20tpm2=5Fextend=5Fbytes()?= =?UTF-8?q?=E2=86=92tpm2=5Fpcr=5Fextend=5Fbytes()=20and=20make=20it=20take?= =?UTF-8?q?=20struct=20iovec?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We soon want to add the ability to extend into nvindexes in addition to PCRs, hence rename the function to make clear it is about pcr extension. While we are at it, switch things over to "struct iovec" as we generally try to do it now in tpm2-util.[ch] these days. --- src/cryptsetup/cryptsetup.c | 2 +- src/pcrextend/pcrextend.c | 2 +- src/shared/tpm2-util.c | 26 +++++++++++--------------- src/shared/tpm2-util.h | 2 +- 4 files changed, 14 insertions(+), 18 deletions(-) diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index 7351e5dc2a..09939bfa48 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -1047,7 +1047,7 @@ static int measure_volume_key( if (!s) return log_oom(); - r = tpm2_extend_bytes(c, l ?: arg_tpm2_measure_banks, arg_tpm2_measure_pcr, s, SIZE_MAX, volume_key, volume_key_size, TPM2_EVENT_VOLUME_KEY, s); + r = tpm2_pcr_extend_bytes(c, l ?: arg_tpm2_measure_banks, arg_tpm2_measure_pcr, &IOVEC_MAKE_STRING(s), &IOVEC_MAKE(volume_key, volume_key_size), TPM2_EVENT_VOLUME_KEY, s); if (r < 0) return log_error_errno(r, "Could not extend PCR: %m"); diff --git a/src/pcrextend/pcrextend.c b/src/pcrextend/pcrextend.c index 75b561da90..cc50ad3ff7 100644 --- a/src/pcrextend/pcrextend.c +++ b/src/pcrextend/pcrextend.c @@ -233,7 +233,7 @@ static int extend_now(unsigned pcr, const void *data, size_t size, Tpm2Userspace log_debug("Measuring '%s' into PCR index %u, banks %s.", safe, pcr, joined_banks); - r = tpm2_extend_bytes(c, arg_banks, pcr, data, size, /* secret= */ NULL, /* secret_size= */ 0, event, safe); + r = tpm2_pcr_extend_bytes(c, arg_banks, pcr, &IOVEC_MAKE(data, size), /* secret= */ NULL, event, safe); if (r < 0) return log_error_errno(r, "Could not extend PCR: %m"); diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c index ba6171f15f..38c1d73dc7 100644 --- a/src/shared/tpm2-util.c +++ b/src/shared/tpm2-util.c @@ -6321,14 +6321,12 @@ static int tpm2_userspace_log( } #endif -int tpm2_extend_bytes( +int tpm2_pcr_extend_bytes( Tpm2Context *c, char **banks, unsigned pcr_index, - const void *data, - size_t data_size, - const void *secret, - size_t secret_size, + const struct iovec *data, + const struct iovec *secret, Tpm2UserspaceEventType event_type, const char *description) { @@ -6338,17 +6336,15 @@ int tpm2_extend_bytes( TSS2_RC rc; assert(c); - assert(data || data_size == 0); - assert(secret || secret_size == 0); - - if (data_size == SIZE_MAX) - data_size = strlen(data); - if (secret_size == SIZE_MAX) - secret_size = strlen(secret); + assert(iovec_is_valid(data)); + assert(iovec_is_valid(secret)); if (pcr_index >= TPM2_PCRS_MAX) return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Can't measure into unsupported PCR %u, refusing.", pcr_index); + if (!iovec_is_set(data)) + data = &iovec_empty; + if (strv_isempty(banks)) return 0; @@ -6376,10 +6372,10 @@ int tpm2_extend_bytes( * secret for other purposes, maybe because it needs a shorter secret derived from it for * some unrelated purpose, who knows). Hence we instead measure an HMAC signature of a * private non-secret string instead. */ - if (secret_size > 0) { - if (!HMAC(implementation, secret, secret_size, data, data_size, (unsigned char*) &values.digests[values.count].digest, NULL)) + if (iovec_is_set(secret) > 0) { + if (!HMAC(implementation, secret->iov_base, secret->iov_len, data->iov_base, data->iov_len, (unsigned char*) &values.digests[values.count].digest, NULL)) return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to calculate HMAC of data to measure."); - } else if (EVP_Digest(data, data_size, (unsigned char*) &values.digests[values.count].digest, NULL, implementation, NULL) != 1) + } else if (EVP_Digest(data->iov_base, data->iov_len, (unsigned char*) &values.digests[values.count].digest, NULL, implementation, NULL) != 1) return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to hash data to measure."); values.count++; diff --git a/src/shared/tpm2-util.h b/src/shared/tpm2-util.h index b051c8435e..0fc3b55050 100644 --- a/src/shared/tpm2-util.h +++ b/src/shared/tpm2-util.h @@ -149,7 +149,7 @@ typedef enum Tpm2UserspaceEventType { const char* tpm2_userspace_event_type_to_string(Tpm2UserspaceEventType type) _const_; Tpm2UserspaceEventType tpm2_userspace_event_type_from_string(const char *s) _pure_; -int tpm2_extend_bytes(Tpm2Context *c, char **banks, unsigned pcr_index, const void *data, size_t data_size, const void *secret, size_t secret_size, Tpm2UserspaceEventType event, const char *description); +int tpm2_pcr_extend_bytes(Tpm2Context *c, char **banks, unsigned pcr_index, const struct iovec *data, const struct iovec *secret, Tpm2UserspaceEventType event, const char *description); uint32_t tpm2_tpms_pcr_selection_to_mask(const TPMS_PCR_SELECTION *s); void tpm2_tpms_pcr_selection_from_mask(uint32_t mask, TPMI_ALG_HASH hash, TPMS_PCR_SELECTION *ret);