SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
a0deef9ce58c4a4f9bdb46b9b0807dea14b8dd9d
systemd/src/shared/tpm2-util.c
T
Chris Coulson a0deef9ce5 report: Don't create TPM2 attestation key with adminWithPolicy 
The default attestation key for the TPM2 report signer is currently
created with an empty policy but with the adminWithPolicy attribute set.
This makes it impossible to authorize use of the key for the ADMIN role,
which is required by TPM2_Certify.

This drops the adminWithPolicy attribute so that it can be authorized
using its (empty) authorization value. This is appropriate for local
style attestation keys ("LAKs"). I've been working on an interface for
managing attestation keys which will support creating an IAK, and this
will have both the adminWithPolicy attribute set and a policy defined as
specified in the TCG "TPM 2.0 Keys for Device Identity and Attestation"
spec.

(cherry picked from commit fc5875d137)
2026-10-15 17:56:21 +01:00

12150 lines
489 KiB
C
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
/* SPDX-License-Identifier: LGPL-2.1-or-later */
#include <sys/file.h>
#include <unistd.h>
#include "sd-device.h"
#include "alloc-util.h"
#include "ansi-color.h"
#include "bitfield.h"
#include "conf-files.h"
#include "constants.h"
#include "creds-util.h"
#include "crypto-util.h"
#include "cryptsetup-util.h"
#include "device-private.h"
#include "device-util.h"
#include "dirent-util.h"
#include "dlfcn-util.h"
#include "efi-api.h"
#include "errno-util.h"
#include "extract-word.h"
#include "fd-util.h"
#include "fileio.h"
#include "format-table.h"
#include "fs-util.h"
#include "hexdecoct.h"
#include "hmac.h"
#include "initrd-util.h"
#include "io-util.h"
#include "json-util.h"
#include "limits-util.h"
#include "log.h"
#include "logarithm.h"
#include "memory-util.h"
#include "memstream-util.h"
#include "mkdir.h"
#include "ordered-set.h"
#include "random-util.h"
#include "recurse-dir.h"
#include "siphash24.h"
#include "sort-util.h"
#include "sparse-endian.h"
#include "stat-util.h"
#include "string-table.h"
#include "string-util.h"
#include "strv.h"
#include "sync-util.h"
#include "time-util.h"
#include "tpm2-pcr.h"
#include "tpm2-util.h"
#include "unaligned.h"
#include "virt.h"
/* The PCR banks we are willing to bind policies to, in order of preference. We keep SHA256 as the top
* preference for backwards compatibility (systems that already bind to it keep using the same bank, so
* existing TPM2-sealed secrets remain valid), then prefer SHA384 over SHA512: SHA384 is computed in 64-bit
* words like SHA512 but produces a shorter digest, so it takes up less room in the TPM event log, whose
* memory is usually bounded. SHA512 comes next, and we only fall back to the weak SHA1 as a last resort. */
static const uint16_t tpm2_pcr_bank_preference[] = {
TPM2_ALG_SHA256,
TPM2_ALG_SHA384,
TPM2_ALG_SHA512,
TPM2_ALG_SHA1,
};
/* The reduced preference list used when re-deriving the bank for legacy enrollments that did not record one
* (see tpm2_get_best_pcr_bank_legacy()). Such enrollments were sealed by code that only ever considered
* SHA256 and SHA1, so they can only be bound to one of those two banks. We must restrict the choice to exactly this set. */
static const uint16_t tpm2_pcr_bank_preference_legacy[] = {
TPM2_ALG_SHA256,
TPM2_ALG_SHA1,
};
static int pcr_bank_from_efi_active(
const uint16_t *banks,
size_t n_banks,
uint32_t active_banks,
uint16_t *ret) {
assert(banks);
assert(ret);
FOREACH_ARRAY(bank, banks, n_banks)
if (BIT_SET(active_banks, *bank)) {
*ret = *bank;
return 0;
}
return -EOPNOTSUPP;
}
int tpm2_pcr_bank_from_efi_active(uint32_t active_banks, uint16_t *ret) {
return pcr_bank_from_efi_active(tpm2_pcr_bank_preference, ELEMENTSOF(tpm2_pcr_bank_preference), active_banks, ret);
}
int tpm2_pcr_bank_from_efi_active_legacy(uint32_t active_banks, uint16_t *ret) {
return pcr_bank_from_efi_active(tpm2_pcr_bank_preference_legacy, ELEMENTSOF(tpm2_pcr_bank_preference_legacy), active_banks, ret);
}
#if HAVE_TPM2
static DLSYM_PROTOTYPE(Esys_ContextLoad) = NULL;
static DLSYM_PROTOTYPE(Esys_ContextSave) = NULL;
static DLSYM_PROTOTYPE(Esys_Create) = NULL;
static DLSYM_PROTOTYPE(Esys_CreateLoaded) = NULL;
static DLSYM_PROTOTYPE(Esys_CreatePrimary) = NULL;
static DLSYM_PROTOTYPE(Esys_EvictControl) = NULL;
static DLSYM_PROTOTYPE(Esys_Finalize) = NULL;
static DLSYM_PROTOTYPE(Esys_FlushContext) = NULL;
DLSYM_PROTOTYPE(Esys_Free) = NULL;
static DLSYM_PROTOTYPE(Esys_GetCapability) = NULL;
static DLSYM_PROTOTYPE(Esys_GetRandom) = NULL;
static DLSYM_PROTOTYPE(Esys_GetSessionAuditDigest) = NULL;
static DLSYM_PROTOTYPE(Esys_Import) = NULL;
static DLSYM_PROTOTYPE(Esys_Initialize) = NULL;
static DLSYM_PROTOTYPE(Esys_Load) = NULL;
static DLSYM_PROTOTYPE(Esys_LoadExternal) = NULL;
static DLSYM_PROTOTYPE(Esys_NV_Certify) = NULL;
static DLSYM_PROTOTYPE(Esys_NV_DefineSpace) = NULL;
static DLSYM_PROTOTYPE(Esys_NV_Extend) = NULL;
static DLSYM_PROTOTYPE(Esys_NV_Read) = NULL;
static DLSYM_PROTOTYPE(Esys_NV_ReadPublic) = NULL;
static DLSYM_PROTOTYPE(Esys_NV_UndefineSpace) = NULL;
static DLSYM_PROTOTYPE(Esys_NV_Write) = NULL;
static DLSYM_PROTOTYPE(Esys_PCR_Extend) = NULL;
static DLSYM_PROTOTYPE(Esys_PCR_Read) = NULL;
static DLSYM_PROTOTYPE(Esys_PolicyAuthValue) = NULL;
static DLSYM_PROTOTYPE(Esys_PolicyAuthorize) = NULL;
static DLSYM_PROTOTYPE(Esys_PolicyAuthorizeNV) = NULL;
static DLSYM_PROTOTYPE(Esys_PolicyGetDigest) = NULL;
static DLSYM_PROTOTYPE(Esys_PolicyNvWritten) = NULL;
static DLSYM_PROTOTYPE(Esys_PolicyOR) = NULL;
static DLSYM_PROTOTYPE(Esys_PolicyPCR) = NULL;
static DLSYM_PROTOTYPE(Esys_PolicySecret) = NULL;
static DLSYM_PROTOTYPE(Esys_PolicySigned) = NULL;
static DLSYM_PROTOTYPE(Esys_Quote) = NULL;
static DLSYM_PROTOTYPE(Esys_ReadPublic) = NULL;
static DLSYM_PROTOTYPE(Esys_StartAuthSession) = NULL;
static DLSYM_PROTOTYPE(Esys_Startup) = NULL;
static DLSYM_PROTOTYPE(Esys_TestParms) = NULL;
static DLSYM_PROTOTYPE(Esys_TR_Close) = NULL;
static DLSYM_PROTOTYPE(Esys_TR_Deserialize) = NULL;
static DLSYM_PROTOTYPE(Esys_TR_FromTPMPublic) = NULL;
static DLSYM_PROTOTYPE(Esys_TR_GetName) = NULL;
static DLSYM_PROTOTYPE(Esys_TR_GetTpmHandle) = NULL;
static DLSYM_PROTOTYPE(Esys_TR_Serialize) = NULL;
static DLSYM_PROTOTYPE(Esys_TR_SetAuth) = NULL;
static DLSYM_PROTOTYPE(Esys_TRSess_GetAttributes) = NULL;
static DLSYM_PROTOTYPE(Esys_TRSess_GetNonceTPM) = NULL;
static DLSYM_PROTOTYPE(Esys_TRSess_SetAttributes) = NULL;
static DLSYM_PROTOTYPE(Esys_Unseal) = NULL;
static DLSYM_PROTOTYPE(Esys_VerifySignature) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2_CC_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2_HANDLE_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_DIGEST_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_ENCRYPTED_SECRET_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_ENCRYPTED_SECRET_Unmarshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_NAME_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_PRIVATE_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_PRIVATE_Unmarshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_PUBLIC_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_PUBLIC_Unmarshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_SENSITIVE_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPML_PCR_SELECTION_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPMS_ATTEST_Unmarshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPMS_CONTEXT_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPMS_CONTEXT_Unmarshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPMS_NV_PUBLIC_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_NV_PUBLIC_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPM2B_NV_PUBLIC_Unmarshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPMS_ECC_POINT_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPMT_HA_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPMT_PUBLIC_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_TPMT_PUBLIC_Unmarshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_MU_UINT32_Marshal) = NULL;
static DLSYM_PROTOTYPE(Tss2_RC_Decode) = NULL;
_dlopen_loader_
static int dlopen_tpm2_esys(int log_level) {
static void *libtss2_esys_dl = NULL;
int r;
LIBTSS2_ESYS_NOTE(suggested);
r = dlopen_many_sym_or_warn(
&libtss2_esys_dl, "libtss2-esys.so.0", log_level,
DLSYM_ARG(Esys_ContextLoad),
DLSYM_ARG(Esys_ContextSave),
DLSYM_ARG(Esys_Create),
DLSYM_ARG(Esys_CreateLoaded),
DLSYM_ARG(Esys_CreatePrimary),
DLSYM_ARG(Esys_EvictControl),
DLSYM_ARG(Esys_Finalize),
DLSYM_ARG(Esys_FlushContext),
DLSYM_ARG(Esys_Free),
DLSYM_ARG(Esys_GetCapability),
DLSYM_ARG(Esys_GetRandom),
DLSYM_ARG(Esys_GetSessionAuditDigest),
DLSYM_ARG(Esys_Import),
DLSYM_ARG(Esys_Initialize),
DLSYM_ARG(Esys_Load),
DLSYM_ARG(Esys_LoadExternal),
DLSYM_ARG(Esys_NV_Certify),
DLSYM_ARG(Esys_NV_DefineSpace),
DLSYM_ARG(Esys_NV_Extend),
DLSYM_ARG(Esys_NV_Read),
DLSYM_ARG(Esys_NV_ReadPublic),
DLSYM_ARG(Esys_NV_UndefineSpace),
DLSYM_ARG(Esys_NV_Write),
DLSYM_ARG(Esys_PCR_Extend),
DLSYM_ARG(Esys_PCR_Read),
DLSYM_ARG(Esys_PolicyAuthValue),
DLSYM_ARG(Esys_PolicyAuthorize),
DLSYM_ARG(Esys_PolicyAuthorizeNV),
DLSYM_ARG(Esys_PolicyGetDigest),
DLSYM_ARG(Esys_PolicyNvWritten),
DLSYM_ARG(Esys_PolicyOR),
DLSYM_ARG(Esys_PolicyPCR),
DLSYM_ARG(Esys_PolicySecret),
DLSYM_ARG(Esys_PolicySigned),
DLSYM_ARG(Esys_Quote),
DLSYM_ARG(Esys_ReadPublic),
DLSYM_ARG(Esys_StartAuthSession),
DLSYM_ARG(Esys_Startup),
DLSYM_ARG(Esys_TestParms),
DLSYM_ARG(Esys_TR_Close),
DLSYM_ARG(Esys_TR_Deserialize),
DLSYM_ARG(Esys_TR_FromTPMPublic),
DLSYM_ARG(Esys_TR_GetName),
DLSYM_ARG(Esys_TR_Serialize),
DLSYM_ARG(Esys_TR_SetAuth),
DLSYM_ARG(Esys_TRSess_GetAttributes),
DLSYM_ARG(Esys_TRSess_GetNonceTPM),
DLSYM_ARG(Esys_TRSess_SetAttributes),
DLSYM_ARG(Esys_Unseal),
DLSYM_ARG(Esys_VerifySignature));
if (r < 0)
return r;
/* Esys_TR_GetTpmHandle was added to tpm2-tss in version 2.4.0. Once we can set a minimum tpm2-tss
* version of 2.4.0 this sym can be moved up to the normal list above. */
r = dlsym_many_or_warn(libtss2_esys_dl, LOG_DEBUG, DLSYM_ARG_FORCE(Esys_TR_GetTpmHandle));
if (r < 0)
log_debug("libtss2-esys too old, does not include Esys_TR_GetTpmHandle.");
return 0;
}
_dlopen_loader_
static int dlopen_tpm2_rc(int log_level) {
static void *libtss2_rc_dl = NULL;
LIBTSS2_RC_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libtss2_rc_dl, "libtss2-rc.so.0", log_level,
DLSYM_ARG(Tss2_RC_Decode));
}
_dlopen_loader_
static int dlopen_tpm2_mu(int log_level) {
static void *libtss2_mu_dl = NULL;
LIBTSS2_MU_NOTE(suggested);
return dlopen_many_sym_or_warn(
&libtss2_mu_dl, "libtss2-mu.so.0", log_level,
DLSYM_ARG(Tss2_MU_TPM2_CC_Marshal),
DLSYM_ARG(Tss2_MU_TPM2_HANDLE_Marshal),
DLSYM_ARG(Tss2_MU_TPM2B_DIGEST_Marshal),
DLSYM_ARG(Tss2_MU_TPM2B_ENCRYPTED_SECRET_Marshal),
DLSYM_ARG(Tss2_MU_TPM2B_ENCRYPTED_SECRET_Unmarshal),
DLSYM_ARG(Tss2_MU_TPM2B_NAME_Marshal),
DLSYM_ARG(Tss2_MU_TPM2B_PRIVATE_Marshal),
DLSYM_ARG(Tss2_MU_TPM2B_PRIVATE_Unmarshal),
DLSYM_ARG(Tss2_MU_TPM2B_PUBLIC_Marshal),
DLSYM_ARG(Tss2_MU_TPM2B_PUBLIC_Unmarshal),
DLSYM_ARG(Tss2_MU_TPM2B_SENSITIVE_Marshal),
DLSYM_ARG(Tss2_MU_TPML_PCR_SELECTION_Marshal),
DLSYM_ARG(Tss2_MU_TPMS_ATTEST_Unmarshal),
DLSYM_ARG(Tss2_MU_TPMS_CONTEXT_Marshal),
DLSYM_ARG(Tss2_MU_TPMS_CONTEXT_Unmarshal),
DLSYM_ARG(Tss2_MU_TPMS_NV_PUBLIC_Marshal),
DLSYM_ARG(Tss2_MU_TPM2B_NV_PUBLIC_Marshal),
DLSYM_ARG(Tss2_MU_TPM2B_NV_PUBLIC_Unmarshal),
DLSYM_ARG(Tss2_MU_TPMS_ECC_POINT_Marshal),
DLSYM_ARG(Tss2_MU_TPMT_HA_Marshal),
DLSYM_ARG(Tss2_MU_TPMT_PUBLIC_Marshal),
DLSYM_ARG(Tss2_MU_TPMT_PUBLIC_Unmarshal),
DLSYM_ARG(Tss2_MU_UINT32_Marshal));
}
_dlopen_loader_
static int dlopen_tpm2_tcti_device(int log_level) {
static void *libtss2_tcti_device_dl = NULL;
/* The "device" TCTI is the most relevant one, let's also load it explicitly on dlopen_tpm2(), even
* if we don't resolve any symbols here. */
LIBTSS2_TCTI_DEVICE_NOTE(suggested);
return dlopen_verbose(
&libtss2_tcti_device_dl,
"libtss2-tcti-device.so.0",
log_level);
}
#endif
int dlopen_tpm2(int log_level) {
#if HAVE_TPM2
int r;
r = dlopen_tpm2_esys(log_level);
if (r < 0)
return r;
r = dlopen_tpm2_rc(log_level);
if (r < 0)
return r;
r = dlopen_tpm2_mu(log_level);
if (r < 0)
return r;
r = dlopen_tpm2_tcti_device(log_level);
if (r < 0)
return r;
return 0;
#else
return log_full_errno(log_level, SYNTHETIC_ERRNO(EOPNOTSUPP),
"TPM2 support is not compiled in.");
#endif
}
#if HAVE_TPM2
void Esys_Freep(void *p) {
assert(p);
if (*(void**) p)
sym_Esys_Free(*(void**) p);
}
static void tpm2b_sensitive_data_erase_and_esys_freep(TPM2B_SENSITIVE_DATA **p) {
assert(p);
if (!*p)
return;
explicit_bzero_safe((*p)->buffer, (*p)->size);
sym_Esys_Free(*p);
}
/* Get a specific TPM capability (or capabilities).
*
* Returns 0 if there are no more capability properties of the requested type, or 1 if there are more, or < 0
* on any error. Both 0 and 1 indicate this completed successfully, but do not indicate how many capability
* properties were provided in 'ret_capability_data'. To find the number of provided properties, check the
* specific type's 'count' field (e.g. for TPM2_CAP_ALGS, check ret_capability_data->algorithms.count).
*
* This calls TPM2_GetCapability() and does not alter the provided data, so it is important to understand how
* that TPM function works. It is recommended to check the TCG TPM specification Part 3 ("Commands") section
* on TPM2_GetCapability() for full details, but a short summary is: if this returns 0, all available
* properties have been provided in ret_capability_data, or no properties were available. If this returns 1,
* there are between 1 and "count" properties provided in ret_capability_data, and there are more available.
* Note that this may provide less than "count" properties even if the TPM has more available. Also, each
* capability category may have more specific requirements than described here; see the spec for exact
* details. */
static int tpm2_get_capability(
Tpm2Context *c,
TPM2_CAP capability,
uint32_t property,
uint32_t count,
TPMU_CAPABILITIES *ret_capability_data) {
_cleanup_(Esys_Freep) TPMS_CAPABILITY_DATA *capabilities = NULL;
TPMI_YES_NO more;
TSS2_RC rc;
assert(c);
log_debug("Getting TPM2 capability 0x%04" PRIx32 " property 0x%04" PRIx32 " count %" PRIu32 ".",
capability, property, count);
rc = sym_Esys_GetCapability(
c->esys_context,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
capability,
property,
count,
&more,
&capabilities);
if (rc == TPM2_RC_VALUE)
return log_debug_errno(SYNTHETIC_ERRNO(ENXIO),
"Requested TPM2 capability 0x%04" PRIx32 " property 0x%04" PRIx32 " apparently doesn't exist: %s",
capability, property, sym_Tss2_RC_Decode(rc));
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to get TPM2 capability 0x%04" PRIx32 " property 0x%04" PRIx32 ": %s",
capability, property, sym_Tss2_RC_Decode(rc));
if (capabilities->capability != capability)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"TPM provided wrong capability: 0x%04" PRIx32 " instead of 0x%04" PRIx32 ".",
capabilities->capability, capability);
if (ret_capability_data)
*ret_capability_data = capabilities->data;
return more == TPM2_YES;
}
static int tpm2_get_capability_property(Tpm2Context *c, uint32_t property, uint32_t *ret_value) {
int r;
assert(c);
assert(ret_value);
TPMU_CAPABILITIES capabilities = {};
r = tpm2_get_capability(c, TPM2_CAP_TPM_PROPERTIES, property, 1, &capabilities);
if (r < 0)
return r;
if (capabilities.tpmProperties.count == 0 ||
capabilities.tpmProperties.tpmProperty[0].property != property)
return log_debug_errno(SYNTHETIC_ERRNO(ENOENT), "TPM property 0x%04" PRIx32 " does not exist", property);
*ret_value = capabilities.tpmProperties.tpmProperty[0].value;
return 0;
}
int tpm2_vendor_info_to_modalias(const Tpm2VendorInfo *info, char **ret) {
_cleanup_free_ char *m = NULL;
assert(info);
assert(ret);
/* Closely inspired by kernel modalias strings, this distills information from the TPM vendor data
* into a string suitable for matching hwdb */
if (asprintf(&m,
"fi%s:"
"lv%" PRIu32 ":"
"rv%" PRIu32 ".%" PRIu32 ":"
"sy%" PRIu32 ":"
"sd%" PRIu32 ":"
"mf%s:"
"vs%s:"
"ty%" PRIx32 ":"
"fw%" PRIu16 ".%" PRIu16 ".%" PRIu32 ":",
info->family_indicator,
info->level,
info->revision_major,
info->revision_minor,
info->year,
info->day_of_year,
info->manufacturer,
info->vendor_string,
info->vendor_tpm_type,
info->firmware_version_major,
info->firmware_version_minor,
info->firmware_version2) < 0)
return -ENOMEM;
*ret = TAKE_PTR(m);
return 0;
}
static char *mangle_vendor_chars(char *c, size_t n) {
char *end = c;
assert(c || n == 0);
/* Suppress all control characters, whitespace and non-ASCII bytes */
for (char *x = c; x < c + n; x++) {
if (!IN_SET(*x, ' ', 0))
end = x + 1;
if ((unsigned char) *x <= (unsigned char) ' ' ||
(unsigned char) *x >= 127)
*x = '_';
}
/* Drop trailing spaces and NUL bytes */
*end = 0;
return c;
}
int tpm2_get_vendor_info(
Tpm2Context *c,
Tpm2VendorInfo *ret) {
int r;
assert(c);
assert(ret);
TPMU_CAPABILITIES capabilities = {};
r = tpm2_get_capability(
c,
TPM2_CAP_TPM_PROPERTIES,
TPM2_PT_FAMILY_INDICATOR,
TPM2_PT_FIRMWARE_VERSION_2 - TPM2_PT_FAMILY_INDICATOR + 1, /* get all relevant fields at once */
&capabilities);
if (r < 0)
return r;
Tpm2VendorInfo info = {};
for (uint32_t i = 0; i < capabilities.tpmProperties.count; i++) {
TPMS_TAGGED_PROPERTY *p = capabilities.tpmProperties.tpmProperty + i;
switch (p->property) {
case TPM2_PT_FAMILY_INDICATOR:
unaligned_write_be32(info.family_indicator, p->value);
mangle_vendor_chars(info.family_indicator, sizeof(info.family_indicator));
break;
case TPM2_PT_LEVEL:
info.level = p->value;
break;
case TPM2_PT_REVISION:
info.revision_major = p->value / 100;
info.revision_minor = p->value % 100;
break;
case TPM2_PT_DAY_OF_YEAR:
info.day_of_year = p->value;
break;
case TPM2_PT_YEAR:
info.year = p->value;
break;
case TPM2_PT_MANUFACTURER:
unaligned_write_be32(info.manufacturer, p->value);
mangle_vendor_chars(info.manufacturer, sizeof(info.manufacturer));
break;
case TPM2_PT_VENDOR_STRING_1:
unaligned_write_be32(info.vendor_string+0, p->value);
break;
case TPM2_PT_VENDOR_STRING_2:
unaligned_write_be32(info.vendor_string+4, p->value);
break;
case TPM2_PT_VENDOR_STRING_3:
unaligned_write_be32(info.vendor_string+8, p->value);
break;
case TPM2_PT_VENDOR_STRING_4:
unaligned_write_be32(info.vendor_string+12, p->value);
break;
case TPM2_PT_VENDOR_TPM_TYPE:
info.vendor_tpm_type = p->value;
break;
case TPM2_PT_FIRMWARE_VERSION_1:
info.firmware_version_major = p->value >> 16;
info.firmware_version_minor = p->value & 0xFFFFU;
break;
case TPM2_PT_FIRMWARE_VERSION_2:
info.firmware_version2 = p->value;
break;
}
}
mangle_vendor_chars(info.vendor_string, sizeof(info.vendor_string));
*ret = TAKE_STRUCT(info);
return 0;
}
#define TPMA_CC_TO_TPM2_CC(cca) (((cca) & TPMA_CC_COMMANDINDEX_MASK) >> TPMA_CC_COMMANDINDEX_SHIFT)
/* The TCG reference library spec (part 2) doesn't guarantee a minimum size for the
* TPM2B_MAX_NV_BUFFER type. However, the PC-Client PTP spec does set a minimum value of 512,
* so we'll just assume this if the TPM didn't report a value or reports an implausible value. */
#define FALLBACK_MAX_NV_BUFFER_SIZE 512u
static int tpm2_cache_capabilities(Tpm2Context *c) {
TPMU_CAPABILITIES capability;
int r;
assert(c);
/* Cache the algorithms. The spec indicates supported algorithms can only be modified during runtime
* by the SetAlgorithmSet() command. Unfortunately, the spec doesn't require a TPM reinitialization
* after changing the algorithm set (unless the PCR algorithms are changed). However, the spec also
* indicates the TPM behavior after SetAlgorithmSet() is "vendor-dependent", giving the example of
* flushing sessions and objects, erasing policies, etc. So, if the algorithm set is programmatically
* changed while we are performing some operation, it's reasonable to assume it will break us even if
* we don't cache the algorithms, thus they should be "safe" to cache. */
TPM2_ALG_ID current_alg = TPM2_ALG_FIRST;
for (;;) {
r = tpm2_get_capability(
c,
TPM2_CAP_ALGS,
(uint32_t) current_alg, /* The spec states to cast TPM2_ALG_ID to uint32_t. */
TPM2_MAX_CAP_ALGS,
&capability);
if (r < 0)
return r;
TPML_ALG_PROPERTY algorithms = capability.algorithms;
/* We should never get 0; the TPM must support some algorithms, and it must not set 'more' if
* there are no more. */
assert(algorithms.count > 0);
if (!GREEDY_REALLOC_APPEND(
c->capability_algorithms,
c->n_capability_algorithms,
algorithms.algProperties,
algorithms.count))
return log_oom_debug();
if (r == 0)
break;
/* Set current_alg to alg id after last alg id the TPM provided */
current_alg = algorithms.algProperties[algorithms.count - 1].alg + 1;
}
/* Cache the command capabilities. The spec isn't actually clear if commands can be added/removed
* while running, but that would be crazy, so let's hope it is not possible. */
TPM2_CC current_cc = TPM2_CC_FIRST;
for (;;) {
r = tpm2_get_capability(
c,
TPM2_CAP_COMMANDS,
current_cc,
TPM2_MAX_CAP_CC,
&capability);
if (r < 0)
return r;
TPML_CCA commands = capability.command;
/* We should never get 0; the TPM must support some commands, and it must not set 'more' if
* there are no more. */
assert(commands.count > 0);
if (!GREEDY_REALLOC_APPEND(
c->capability_commands,
c->n_capability_commands,
commands.commandAttributes,
commands.count))
return log_oom_debug();
if (r == 0)
break;
/* Set current_cc to index after last cc the TPM provided */
current_cc = TPMA_CC_TO_TPM2_CC(commands.commandAttributes[commands.count - 1]) + 1;
}
/* Cache the ECC curves. The spec isn't actually clear if ECC curves can be added/removed
* while running, but that would be crazy, so let's hope it is not possible. */
TPM2_ECC_CURVE current_ecc_curve = TPM2_ECC_NONE;
for (;;) {
r = tpm2_get_capability(
c,
TPM2_CAP_ECC_CURVES,
current_ecc_curve,
TPM2_MAX_ECC_CURVES,
&capability);
if (r == -ENXIO) /* If the TPM doesn't support ECC, it might return TPM2_RC_VALUE rather than capability.eccCurves == 0 */
break;
if (r < 0)
return r;
TPML_ECC_CURVE ecc_curves = capability.eccCurves;
/* ECC support isn't required */
if (ecc_curves.count == 0)
break;
if (!GREEDY_REALLOC_APPEND(
c->capability_ecc_curves,
c->n_capability_ecc_curves,
ecc_curves.eccCurves,
ecc_curves.count))
return log_oom_debug();
if (r == 0)
break;
/* Set current_ecc_curve to index after last ecc curve the TPM provided */
current_ecc_curve = ecc_curves.eccCurves[ecc_curves.count - 1] + 1;
}
/* Cache the PCR capabilities, which are safe to cache, as the only way they can change is
* TPM2_PCR_Allocate(), which changes the allocation after the next _TPM_Init(). If the TPM is
* reinitialized while we are using it, all our context and sessions will be invalid, so we can
* safely assume the TPM PCR allocation will not change while we are using it. */
r = tpm2_get_capability(
c,
TPM2_CAP_PCRS,
/* property= */ 0,
/* count= */ 1,
&capability);
if (r < 0)
return r;
if (r == 1)
/* This should never happen. Part 3 ("Commands") of the TCG TPM2 spec in the section for
* TPM2_GetCapability states: "TPM_CAP_PCRS – Returns the current allocation of PCR in a
* TPML_PCR_SELECTION. The property parameter shall be zero. The TPM will always respond to
* this command with the full PCR allocation and moreData will be NO." */
log_debug("TPM bug: reported multiple PCR sets; using only first set.");
c->capability_pcrs = capability.assignedPCR;
/* Cache the value of TPM_PT_NV_BUFFER_MAX, which defines the maximum size of TPM2B_MAX_NV_BUFFER and
* which limits the amount of data that TPM2_NV_Read can return in a single command. This may be
* smaller than the size of a NV index payload, particularly if that payload contains a X509
* certificate with a RSA public key. */
uint32_t max_nv_buffer_size = 0;
r = tpm2_get_capability_property(c, TPM2_PT_NV_BUFFER_MAX, &max_nv_buffer_size);
if (r == -ENOENT) {
log_debug("TPM bug: didn't report a value for TPM_PT_NV_BUFFER_MAX; using %"PRIu32".", FALLBACK_MAX_NV_BUFFER_SIZE);
max_nv_buffer_size = FALLBACK_MAX_NV_BUFFER_SIZE;
} else if (r < 0)
return r;
if (max_nv_buffer_size == 0 || max_nv_buffer_size > UINT16_MAX) {
/* TPM2B types have a uint16 size field. If the TPM reported a maximum size that is larger
* than this, or 0, then consider this as implausible and pick the default fallback. */
log_debug("TPM bug: reported implausible value for TPM_PT_NV_BUFFER_MAX; using %"PRIu32".", FALLBACK_MAX_NV_BUFFER_SIZE);
max_nv_buffer_size = FALLBACK_MAX_NV_BUFFER_SIZE;
}
c->max_nv_buffer_size = (uint16_t) max_nv_buffer_size;
return 0;
}
/* Get the TPMA_ALGORITHM for a TPM2_ALG_ID. Returns true if the TPM supports the algorithm and the
* TPMA_ALGORITHM is provided, otherwise false. */
static bool tpm2_get_capability_alg(Tpm2Context *c, TPM2_ALG_ID alg, TPMA_ALGORITHM *ret) {
assert(c);
FOREACH_ARRAY(alg_prop, c->capability_algorithms, c->n_capability_algorithms)
if (alg_prop->alg == alg) {
if (ret)
*ret = alg_prop->algProperties;
return true;
}
log_debug("TPM does not support alg 0x%02" PRIx16 ".", alg);
if (ret)
*ret = 0;
return false;
}
bool tpm2_supports_alg(Tpm2Context *c, TPM2_ALG_ID alg) {
return tpm2_get_capability_alg(c, alg, NULL);
}
/* Get the TPMA_CC for a TPM2_CC. Returns true if the TPM supports the command and the TPMA_CC is provided,
* otherwise false. */
static bool tpm2_get_capability_command(Tpm2Context *c, TPM2_CC command, TPMA_CC *ret) {
assert(c);
FOREACH_ARRAY(cca, c->capability_commands, c->n_capability_commands)
if (TPMA_CC_TO_TPM2_CC(*cca) == command) {
if (ret)
*ret = *cca;
return true;
}
log_debug("TPM does not support command 0x%04" PRIx32 ".", command);
if (ret)
*ret = 0;
return false;
}
bool tpm2_supports_command(Tpm2Context *c, TPM2_CC command) {
return tpm2_get_capability_command(c, command, NULL);
}
/* Returns true if the TPM supports the ECC curve, otherwise false. */
bool tpm2_supports_ecc_curve(Tpm2Context *c, TPM2_ECC_CURVE ecc_curve) {
assert(c);
FOREACH_ARRAY(curve, c->capability_ecc_curves, c->n_capability_ecc_curves)
if (*curve == ecc_curve)
return true;
log_debug("TPM does not support ECC curve 0x%" PRIx16 ".", ecc_curve);
return false;
}
/* Return the maximum size of a TPM2B_DATA structure. This structure is intended to be able to
* store a TPMT_HA structure, so the maximum size is the value of TPM_PT_MAX_DIGEST (the maximum size
* of a TPMU_HA structure) + the size of TPM_ALG_ID. */
int tpm2_max_data_size(Tpm2Context *c) {
int r;
assert(c);
uint32_t max_digest_size = 0;
r = tpm2_get_capability_property(c, TPM2_PT_MAX_DIGEST, &max_digest_size);
if (r < 0)
return r;
if (max_digest_size > (UINT16_MAX - sizeof(TPM2_ALG_ID)))
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"TPM bug: reported implausible value for TPM_PT_MAX_DIGEST");
return (int) max_digest_size + sizeof(TPM2_ALG_ID);
}
/* Query the TPM for populated handles.
*
* This provides an array of handle indexes populated in the TPM, starting at the requested handle. The array will
* contain only populated handle addresses (which might not include the requested handle). The number of
* handles will be no more than the 'max' number requested. This will not search past the end of the handle
* range (i.e. handle & 0xff000000).
*
* Returns 0 if all populated handles in the range (starting at the requested handle) were provided (or no
* handles were in the range), or 1 if there are more populated handles in the range, or < 0 on any error. */
static int tpm2_get_capability_handles(
Tpm2Context *c,
TPM2_HANDLE start,
size_t max,
TPM2_HANDLE **ret_handles,
size_t *ret_n_handles) {
_cleanup_free_ TPM2_HANDLE *handles = NULL;
size_t n_handles = 0;
TPM2_HANDLE current = start;
int r = 0;
assert(c);
assert(ret_handles);
assert(ret_n_handles);
max = MIN(max, UINT32_MAX);
while (max > 0) {
TPMU_CAPABILITIES capability;
r = tpm2_get_capability(c, TPM2_CAP_HANDLES, current, (uint32_t) max, &capability);
if (r < 0)
return r;
TPML_HANDLE handle_list = capability.handles;
if (handle_list.count == 0)
break;
assert(handle_list.count <= max);
if (n_handles > SIZE_MAX - handle_list.count)
return log_oom_debug();
if (!GREEDY_REALLOC_APPEND(handles, n_handles, handle_list.handle, handle_list.count))
return log_oom_debug();
max -= handle_list.count;
/* Update current to the handle index after the last handle in the list. */
current = handles[n_handles - 1] + 1;
if (r == 0)
/* No more handles in this range. */
break;
}
*ret_handles = TAKE_PTR(handles);
*ret_n_handles = n_handles;
return r;
}
#define TPM2_HANDLE_RANGE(h) ((TPM2_HANDLE)((h) & TPM2_HR_RANGE_MASK))
#define TPM2_HANDLE_TYPE(h) ((TPM2_HT)(TPM2_HANDLE_RANGE(h) >> TPM2_HR_SHIFT))
/* Returns 1 if the handle is populated in the TPM, 0 if not, and < 0 on any error. */
static int tpm2_get_capability_handle(Tpm2Context *c, TPM2_HANDLE handle) {
_cleanup_free_ TPM2_HANDLE *handles = NULL;
size_t n_handles = 0;
int r;
r = tpm2_get_capability_handles(c, handle, 1, &handles, &n_handles);
if (r < 0)
return r;
return n_handles == 0 ? false : handles[0] == handle;
}
/* Returns 1 if the TPM supports the parms, or 0 if the TPM does not support the parms. */
bool tpm2_test_parms(Tpm2Context *c, TPMI_ALG_PUBLIC alg, const TPMU_PUBLIC_PARMS *parms) {
TSS2_RC rc;
assert(c);
assert(parms);
TPMT_PUBLIC_PARMS parameters = {
.type = alg,
.parameters = *parms,
};
rc = sym_Esys_TestParms(c->esys_context, ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, &parameters);
if (rc != TSS2_RC_SUCCESS)
/* The spec says if the parms are not supported the TPM returns "...the appropriate
* unmarshaling error if a parameter is not valid". Since the spec (currently) defines 15
* unmarshaling errors, instead of checking for them all here, let's just assume any error
* indicates unsupported parms, and log the specific error text. */
log_debug("TPM does not support tested parms: %s", sym_Tss2_RC_Decode(rc));
return rc == TSS2_RC_SUCCESS;
}
static bool tpm2_supports_tpmt_public(Tpm2Context *c, const TPMT_PUBLIC *public) {
assert(c);
assert(public);
return tpm2_test_parms(c, public->type, &public->parameters);
}
static bool tpm2_supports_tpmt_sym_def_object(Tpm2Context *c, const TPMT_SYM_DEF_OBJECT *parameters) {
assert(c);
assert(parameters);
TPMU_PUBLIC_PARMS parms = {
.symDetail.sym = *parameters,
};
return tpm2_test_parms(c, TPM2_ALG_SYMCIPHER, &parms);
}
static bool tpm2_supports_tpmt_sym_def(Tpm2Context *c, const TPMT_SYM_DEF *parameters) {
assert(c);
assert(parameters);
/* Unfortunately, TPMT_SYM_DEF and TPMT_SYM_DEF_OBJECT are separately defined, even though they are
* functionally identical. */
TPMT_SYM_DEF_OBJECT object = {
.algorithm = parameters->algorithm,
.keyBits = parameters->keyBits,
.mode = parameters->mode,
};
return tpm2_supports_tpmt_sym_def_object(c, &object);
}
static Tpm2Context *tpm2_context_free(Tpm2Context *c) {
if (!c)
return NULL;
if (c->esys_context)
sym_Esys_Finalize(&c->esys_context);
c->tcti_context = mfree(c->tcti_context);
c->tcti_dl = safe_dlclose(c->tcti_dl);
c->capability_algorithms = mfree(c->capability_algorithms);
c->capability_commands = mfree(c->capability_commands);
c->capability_ecc_curves = mfree(c->capability_ecc_curves);
c->tcti_driver = mfree(c->tcti_driver);
c->tcti_param = mfree(c->tcti_param);
return mfree(c);
}
DEFINE_TRIVIAL_REF_UNREF_FUNC(Tpm2Context, tpm2_context, tpm2_context_free);
static const TPMT_SYM_DEF SESSION_TEMPLATE_SYM_AES_128_CFB = {
.algorithm = TPM2_ALG_AES,
.keyBits.aes = 128,
.mode.aes = TPM2_ALG_CFB, /* The spec requires sessions to use CFB. */
};
static const TPMT_SYM_DEF SESSION_TEMPLATE_SYM_NULL = {
.algorithm = TPM2_ALG_NULL,
};
int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
_cleanup_(tpm2_context_unrefp) Tpm2Context *context = NULL;
TSS2_RC rc;
int r;
assert(ret_context);
context = new(Tpm2Context, 1);
if (!context)
return log_oom_debug();
*context = (Tpm2Context) {
.n_ref = 1,
};
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
if (!device) {
device = secure_getenv("SYSTEMD_TPM2_DEVICE");
if (device)
/* Setting the env var to an empty string forces tpm2-tss' own device picking
* logic to be used. */
device = empty_to_null(device);
else
/* If nothing was specified explicitly, we'll use a hardcoded default: the "device" tcti
* driver and the "/dev/tpmrm0" device. We do this since on some distributions the tpm2-abrmd
* might be used and we really don't want that, since it is a system service and that creates
* various ordering issues/deadlocks during early boot. */
device = "device:/dev/tpmrm0";
}
if (device) {
_cleanup_free_ char *_driver = NULL;
const char *param, *driver;
const TSS2_TCTI_INFO* info;
TSS2_TCTI_INFO_FUNC func;
size_t sz = 0;
param = strchr(device, ':');
if (param) {
/* Syntax #1: Pair of driver string and arbitrary parameter */
driver = _driver = strndup(device, param - device);
if (!driver)
return log_oom_debug();
if (isempty(driver))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name is empty, refusing.");
param++;
} else if (path_is_absolute(device) && path_is_valid(device)) {
/* Syntax #2: TPM device node */
driver = "device";
param = device;
} else
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid TPM2 driver string, refusing.");
log_debug("Using TPM2 TCTI driver '%s' with device '%s'.", driver, param);
_cleanup_free_ char *fn = strjoin("libtss2-tcti-", driver, ".so.0");
if (!fn)
return log_oom_debug();
/* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
if (!filename_is_valid(fn))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
const char *dle = NULL;
r = dlopen_safe(fn, &context->tcti_dl, &dle);
if (r < 0) {
log_debug_errno(r, "Failed to load %s: %s", fn, dle ?: STRERROR(r));
return -ENOPKG; /* Turn into recognizable error */
}
log_debug("Loaded '%s' via dlopen()", fn);
func = dlsym(context->tcti_dl, TSS2_TCTI_INFO_SYMBOL);
if (!func)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to find TCTI info symbol " TSS2_TCTI_INFO_SYMBOL ": %s",
dlerror());
info = func();
if (!info)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Unable to get TCTI info data.");
log_debug("Loaded TCTI module '%s' (%s) [Version %" PRIu32 "]", info->name, info->description, info->version);
rc = info->init(/* context= */ NULL, &sz, /* param= */ NULL);
if (rc != TPM2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to initialize TCTI context: %s", sym_Tss2_RC_Decode(rc));
context->tcti_context = malloc0(sz);
if (!context->tcti_context)
return log_oom_debug();
rc = info->init(context->tcti_context, &sz, param);
if (rc != TPM2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to initialize TCTI context: %s", sym_Tss2_RC_Decode(rc));
context->tcti_driver = strdup(driver);
if (!context->tcti_driver)
return log_oom_debug();
context->tcti_param = strdup(param);
if (!context->tcti_param)
return log_oom_debug();
}
rc = sym_Esys_Initialize(&context->esys_context, context->tcti_context, NULL);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to initialize TPM context: %s", sym_Tss2_RC_Decode(rc));
rc = sym_Esys_Startup(context->esys_context, TPM2_SU_CLEAR);
if (rc == TPM2_RC_INITIALIZE)
log_debug("TPM already started up.");
else if (rc == TSS2_RC_SUCCESS)
log_debug("TPM successfully started up.");
else
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to start up TPM: %s", sym_Tss2_RC_Decode(rc));
r = tpm2_cache_capabilities(context);
if (r < 0)
return log_debug_errno(r, "Failed to cache TPM capabilities: %m");
/* We require AES and CFB support for session encryption. */
if (!tpm2_supports_alg(context, TPM2_ALG_AES))
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "TPM does not support AES.");
if (!tpm2_supports_alg(context, TPM2_ALG_CFB))
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "TPM does not support CFB.");
if (!tpm2_supports_tpmt_sym_def(context, &SESSION_TEMPLATE_SYM_AES_128_CFB))
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "TPM does not support AES-128-CFB.");
*ret_context = TAKE_PTR(context);
return 0;
}
int tpm2_context_new_or_warn(const char *device, Tpm2Context **ret_context) {
int r;
assert(ret_context);
r = tpm2_context_new(device, ret_context);
if (r == -EOPNOTSUPP)
return log_error_errno(r, "TPM device not usable as it does not support the required functionality (AES-128-CFB missing?).");
if (r == -ENOPKG)
return log_error_errno(r, "TPM TCTI driver not available.");
if (r == -ENOENT)
return log_error_errno(r, "TPM device not found.");
if (r < 0)
return log_error_errno(r, "Failed to create TPM2 context: %m");
return 0;
}
static void tpm2_handle_cleanup(ESYS_CONTEXT *esys_context, ESYS_TR esys_handle, bool flush) {
TSS2_RC rc;
if (!esys_context || esys_handle == ESYS_TR_NONE)
return;
/* Closing the handle removes its reference from the esys_context, but leaves the corresponding
* handle in the actual TPM. Flushing the handle removes its reference from the esys_context as well
* as removing its corresponding handle from the actual TPM. */
if (flush)
rc = sym_Esys_FlushContext(esys_context, esys_handle);
else
/* We can't use Esys_TR_Close() because the tpm2-tss library does not use reference counting
* for handles, and a single Esys_TR_Close() will remove the handle (internal to the tpm2-tss
* library) that might be in use by other code that is using the same ESYS_CONTEXT. This
* directly affects us; for example the src/test/test-tpm2.c test function
* check_seal_unseal() will encounter this issue and will result in a failure when trying to
* cleanup (i.e. Esys_FlushContext) the transient primary key that the test function
* generates. However, not calling Esys_TR_Close() here should be ok, since any leaked handle
* references will be cleaned up when we free our ESYS_CONTEXT.
*
* An upstream bug is open here: https://github.com/tpm2-software/tpm2-tss/issues/2693 */
rc = TSS2_RC_SUCCESS; // FIXME: restore sym_Esys_TR_Close() use once tpm2-tss is fixed and adopted widely enough
if (rc != TSS2_RC_SUCCESS)
/* We ignore failures here (besides debug logging), since this is called in error paths,
* where we cannot do anything about failures anymore. And when it is called in successful
* codepaths by this time we already did what we wanted to do, and got the results we wanted
* so there's no reason to make this fail more loudly than necessary. */
log_debug("Failed to %s TPM handle, ignoring: %s", flush ? "flush" : "close", sym_Tss2_RC_Decode(rc));
}
Tpm2Handle *tpm2_handle_free(Tpm2Handle *handle) {
if (!handle)
return NULL;
_cleanup_(tpm2_context_unrefp) Tpm2Context *context = handle->tpm2_context;
if (context)
tpm2_handle_cleanup(context->esys_context, handle->esys_handle, handle->flush);
return mfree(handle);
}
int tpm2_handle_new(Tpm2Context *context, Tpm2Handle **ret_handle) {
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
assert(ret_handle);
handle = new(Tpm2Handle, 1);
if (!handle)
return log_oom_debug();
*handle = (Tpm2Handle) {
.tpm2_context = tpm2_context_ref(context),
.esys_handle = ESYS_TR_NONE,
.flush = true,
};
*ret_handle = TAKE_PTR(handle);
return 0;
}
int tpm2_read_public(
Tpm2Context *c,
const Tpm2Handle *session,
const Tpm2Handle *handle,
TPM2B_PUBLIC **ret_public,
TPM2B_NAME **ret_name,
TPM2B_NAME **ret_qname) {
TSS2_RC rc;
assert(c);
assert(handle);
rc = sym_Esys_ReadPublic(
c->esys_context,
handle->esys_handle,
session ? session->esys_handle : ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
ret_public,
ret_name,
ret_qname);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to read public info: %s", sym_Tss2_RC_Decode(rc));
return 0;
}
static int tpm2_read_nv_public(
Tpm2Context *c,
const Tpm2Handle *session,
const Tpm2Handle *handle,
TPM2B_NV_PUBLIC **ret_nv_public,
TPM2B_NAME **ret_name) {
TSS2_RC rc;
assert(c);
assert(handle);
rc = sym_Esys_NV_ReadPublic(
c->esys_context,
handle->esys_handle,
session ? session->esys_handle : ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
ret_nv_public,
ret_name);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to read NV public info: %s", sym_Tss2_RC_Decode(rc));
return 0;
}
/* Create a Tpm2Handle object that references a pre-existing handle in the TPM, at the handle index provided.
* This should be used only for persistent, transient, or NV handles; and the handle must already exist in
* the TPM at the specified handle index. The handle index should not be 0. Returns 1 if found, 0 if the
* index is empty, or < 0 on error. Also see tpm2_get_srk() below; the SRK is a commonly used persistent
* Tpm2Handle. */
int tpm2_index_to_handle(
Tpm2Context *c,
TPM2_HANDLE index,
const Tpm2Handle *session,
TPM2B_NAME **ret_name,
Tpm2Handle **ret_handle) {
TSS2_RC rc;
int r;
assert(c);
/* Only allow persistent, transient, or NV index handle types. */
switch (TPM2_HANDLE_TYPE(index)) {
case TPM2_HT_PERSISTENT:
case TPM2_HT_NV_INDEX:
case TPM2_HT_TRANSIENT:
break;
case TPM2_HT_PCR:
/* PCR handles are referenced by their actual index number and do not need a Tpm2Handle */
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Invalid handle 0x%08" PRIx32 " (in PCR range).", index);
case TPM2_HT_HMAC_SESSION:
case TPM2_HT_POLICY_SESSION:
/* Session indexes are only used internally by tpm2-tss (or lower code) */
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Invalid handle 0x%08" PRIx32 " (in session range).", index);
case TPM2_HT_PERMANENT:
/* Permanent handles are defined, e.g. ESYS_TR_RH_OWNER. */
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Invalid handle 0x%08" PRIx32 " (in permanent range).", index);
default:
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Invalid handle 0x%08" PRIx32 " (in unknown range).", index);
}
/* For transient handles, the kernel tpm "resource manager" (i.e. /dev/tpmrm0) performs mapping
* which breaks GetCapability requests, so only check GetCapability if it's not a transient handle.
* https://bugzilla.kernel.org/show_bug.cgi?id=218009 */
if (TPM2_HANDLE_TYPE(index) != TPM2_HT_TRANSIENT) { // FIXME: once kernel bug is fixed, check transient handles too
r = tpm2_get_capability_handle(c, index);
if (r < 0)
return r;
if (r == 0) {
log_debug("TPM handle 0x%08" PRIx32 " not populated.", index);
if (ret_name)
*ret_name = NULL;
if (ret_handle)
*ret_handle = NULL;
return 0;
}
}
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
r = tpm2_handle_new(c, &handle);
if (r < 0)
return r;
/* Since we didn't create this handle in the TPM (this is only creating an ESYS_TR handle for the
* pre-existing TPM handle), we shouldn't flush (or evict) it on cleanup. */
handle->flush = false;
rc = sym_Esys_TR_FromTPMPublic(
c->esys_context,
index,
session ? session->esys_handle : ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
&handle->esys_handle);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to read public info: %s", sym_Tss2_RC_Decode(rc));
if (ret_name) {
r = tpm2_get_name(c, handle, ret_name);
if (r < 0)
return r;
}
if (ret_handle)
*ret_handle = TAKE_PTR(handle);
return 1;
}
/* Create a Tpm2Handle object that references a pre-existing persistent or transient object in the TPM, at
* the handle index provided. The handle index should not be 0. Returns 1 if found, 0 if the index is empty,
* or < 0 on error. Also see tpm2_get_srk() below; the SRK is a commonly used persistent Tpm2Handle. */
int tpm2_object_index_to_handle(
Tpm2Context *c,
TPM2_HANDLE index,
const Tpm2Handle *session,
TPM2B_PUBLIC **ret_public,
TPM2B_NAME **ret_name,
TPM2B_NAME **ret_qname,
Tpm2Handle **ret_handle) {
int r;
assert(c);
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
_cleanup_(Esys_Freep) TPM2B_NAME *name = NULL;
r = tpm2_index_to_handle(c, index, session, ret_name ? &name : NULL, &handle);
if (r < 0)
return r;
if (r == 0) {
if (ret_public)
*ret_public = NULL;
if (ret_name)
*ret_name = NULL;
if (ret_qname)
*ret_qname = NULL;
if (ret_handle)
*ret_handle = NULL;
return 0;
}
if (ret_public || ret_qname) {
sym_Esys_Free(name);
name = NULL;
r = tpm2_read_public(c, session, handle, ret_public, &name, ret_qname);
if (r < 0)
return r;
}
if (ret_name)
*ret_name = TAKE_PTR(name);
if (ret_handle)
*ret_handle = TAKE_PTR(handle);
return 1;
}
/* Create a Tpm2Handle object that references a pre-existing NV index in the TPM, at the handle index
* provided. The handle index should not be 0. Returns 1 if found, 0 if the index is empty, or < 0 on
* error. */
int tpm2_nv_index_to_handle(
Tpm2Context *c,
TPM2_HANDLE index,
const Tpm2Handle *session,
TPM2B_NV_PUBLIC **ret_nv_public,
TPM2B_NAME **ret_name,
Tpm2Handle **ret_handle) {
int r;
assert(c);
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
_cleanup_(Esys_Freep) TPM2B_NAME *name = NULL;
r = tpm2_index_to_handle(c, index, session, ret_name ? &name : NULL, &handle);
if (r < 0)
return r;
if (r == 0) {
if (ret_nv_public)
*ret_nv_public = NULL;
if (ret_name)
*ret_name = NULL;
if (ret_handle)
*ret_handle = NULL;
return 0;
}
if (ret_nv_public) {
sym_Esys_Free(name);
name = NULL;
r = tpm2_read_nv_public(c, session, handle, ret_nv_public, &name);
if (r < 0)
return r;
}
if (ret_name)
*ret_name = TAKE_PTR(name);
if (ret_handle)
*ret_handle = TAKE_PTR(handle);
return 1;
}
/* Get the handle index for the provided Tpm2Handle. */
int tpm2_index_from_handle(Tpm2Context *c, const Tpm2Handle *handle, TPM2_HANDLE *ret_index) {
TSS2_RC rc;
assert(c);
assert(handle);
assert(ret_index);
/* Esys_TR_GetTpmHandle was added to tpm2-tss in version 2.4.0. Once we can set a minimum tpm2-tss
* version of 2.4.0 this check can be removed. */
if (!sym_Esys_TR_GetTpmHandle)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"libtss2-esys too old, does not include Esys_TR_GetTpmHandle.");
rc = sym_Esys_TR_GetTpmHandle(c->esys_context, handle->esys_handle, ret_index);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to get handle index: %s", sym_Tss2_RC_Decode(rc));
return 0;
}
int tpm2_marshal_saved_handle_context(TPMS_CONTEXT *context, void **ret, size_t *ret_size) {
size_t max_size = SIZEOF(*context), blob_size = 0;
_cleanup_free_ void *blob = NULL;
TSS2_RC rc;
assert(context);
assert(ret);
assert(ret_size);
blob = malloc0(max_size);
if (!blob)
return log_oom_debug();
rc = sym_Tss2_MU_TPMS_CONTEXT_Marshal(context, blob, max_size, &blob_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal saved context structure: %s", sym_Tss2_RC_Decode(rc));
*ret = TAKE_PTR(blob);
*ret_size = blob_size;
return 0;
}
int tpm2_unmarshal_saved_handle_context(const void *data, size_t size, TPMS_CONTEXT *ret) {
size_t offset = 0;
TPMS_CONTEXT context = {};
TSS2_RC rc;
int r;
assert(data);
assert(ret);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
rc = sym_Tss2_MU_TPMS_CONTEXT_Unmarshal(data, size, &offset, &context);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unmarshal saved context structure: %s", sym_Tss2_RC_Decode(rc));
if (offset != size)
return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Garbage at end of saved context structure data.");
*ret = context;
return 0;
}
int tpm2_load_saved_handle_context(Tpm2Context *c, const TPMS_CONTEXT *context, TPM2B_NAME **ret_name, Tpm2Handle **ret_handle) {
TSS2_RC rc;
int r;
assert(c);
assert(context);
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
r = tpm2_handle_new(c, &handle);
if (r < 0)
return r;
rc = sym_Esys_ContextLoad(c->esys_context, context, &handle->esys_handle);
if (rc != TPM2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to load handle context: %s", sym_Tss2_RC_Decode(rc));
if (ret_name) {
r = tpm2_get_name(c, handle, ret_name);
if (r < 0)
return r;
}
if (ret_handle)
*ret_handle = TAKE_PTR(handle);
return 0;
}
int tpm2_save_handle_context(Tpm2Context *c, const Tpm2Handle *handle, TPMS_CONTEXT **ret_context) {
TSS2_RC rc;
assert(c);
assert(handle);
assert(ret_context);
_cleanup_(Esys_Freep) TPMS_CONTEXT *context = NULL;
rc = sym_Esys_ContextSave(c->esys_context, handle->esys_handle, &context);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to save handle context: %s", sym_Tss2_RC_Decode(rc));
*ret_context = TAKE_PTR(context);
return 0;
}
/* Copy an object in the TPM at a transient handle to a persistent handle.
*
* The provided transient handle must exist in the TPM in the transient range. The persistent handle may be 0
* or any handle in the persistent range. If 0, this will try each handle in the persistent range, in
* ascending order, until an available one is found. If non-zero, only the requested persistent handle will
* be used.
*
* Note that the persistent handle parameter is an handle index (i.e. number), while the transient handle is
* a Tpm2Handle object. The returned persistent handle will be a Tpm2Handle object that is located in the TPM
* at the requested persistent handle index (or the first available if none was requested).
*
* Returns 1 if the object was successfully persisted, or 0 if there is already a key at the requested
* handle, or < 0 on error. Theoretically, this would also return 0 if no specific persistent handle is
* requested but all persistent handles are used, but it is extremely unlikely the TPM has enough internal
* memory to store the entire persistent range, in which case an error will be returned if the TPM is out of
* memory for persistent storage. The persistent handle is only provided when returning 1. */
static int tpm2_persist_handle(
Tpm2Context *c,
const Tpm2Handle *transient_handle,
const Tpm2Handle *session,
TPMI_DH_PERSISTENT persistent_handle_index,
Tpm2Handle **ret_persistent_handle) {
/* We don't use TPM2_PERSISTENT_FIRST and TPM2_PERSISTENT_LAST here due to:
* https://github.com/systemd/systemd/pull/27713#issuecomment-1591864753 */
TPMI_DH_PERSISTENT first = UINT32_C(0x81000000), last = UINT32_C(0x81ffffff);
TSS2_RC rc;
int r;
assert(c);
assert(transient_handle);
/* If persistent handle index specified, only try that. */
if (persistent_handle_index != 0) {
if (TPM2_HANDLE_TYPE(persistent_handle_index) != TPM2_HT_PERSISTENT)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Handle not in persistent range: 0x%x", persistent_handle_index);
first = last = persistent_handle_index;
}
for (TPMI_DH_PERSISTENT requested = first; requested <= last; requested++) {
_cleanup_(tpm2_handle_freep) Tpm2Handle *persistent_handle = NULL;
r = tpm2_handle_new(c, &persistent_handle);
if (r < 0)
return r;
/* Since this is a persistent handle, don't flush it. */
persistent_handle->flush = false;
rc = sym_Esys_EvictControl(
c->esys_context,
ESYS_TR_RH_OWNER,
transient_handle->esys_handle,
session ? session->esys_handle : ESYS_TR_PASSWORD,
ESYS_TR_NONE,
ESYS_TR_NONE,
requested,
&persistent_handle->esys_handle);
if (rc == TSS2_RC_SUCCESS) {
if (ret_persistent_handle)
*ret_persistent_handle = TAKE_PTR(persistent_handle);
return 1;
}
if ((rc & ~TPM2_RC_N_MASK) == TPM2_RC_BAD_AUTH)
return log_debug_errno(SYNTHETIC_ERRNO(EDEADLK), "Authorization failure while attempting to persist handle.");
if (rc != TPM2_RC_NV_DEFINED)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to persist handle: %s", sym_Tss2_RC_Decode(rc));
}
if (ret_persistent_handle)
*ret_persistent_handle = NULL;
return 0;
}
#define TPM2_CREDIT_RANDOM_FLAG_PATH "/run/systemd/tpm-rng-credited"
static int tpm2_credit_random(Tpm2Context *c) {
size_t rps, done = 0;
TSS2_RC rc;
usec_t t;
int r;
assert(c);
/* Pulls some entropy from the TPM and adds it into the kernel RNG pool. That way we can say that the
* key we will ultimately generate with the kernel random pool is at least as good as the TPM's RNG,
* but likely better. Note that we don't trust the TPM RNG very much, hence do not actually credit
* any entropy. */
if (access(TPM2_CREDIT_RANDOM_FLAG_PATH, F_OK) < 0) {
if (errno != ENOENT)
log_debug_errno(errno, "Failed to detect if '" TPM2_CREDIT_RANDOM_FLAG_PATH "' exists, ignoring: %m");
} else {
log_debug("Not adding TPM2 entropy to the kernel random pool again.");
return 0; /* Already done */
}
t = now(CLOCK_MONOTONIC);
for (rps = random_pool_size(); rps > 0;) {
_cleanup_(Esys_Freep) TPM2B_DIGEST *buffer = NULL;
rc = sym_Esys_GetRandom(
c->esys_context,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
MIN(rps, 32U), /* 32 is supposedly a safe choice, given that AES 256bit keys are this long, and TPM2 baseline requires support for those. */
&buffer);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to acquire entropy from TPM: %s", sym_Tss2_RC_Decode(rc));
if (buffer->size == 0)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Zero-sized entropy returned from TPM.");
r = random_write_entropy(-1, buffer->buffer, buffer->size, /* credit= */ false);
if (r < 0)
return log_debug_errno(r, "Failed to write entropy to kernel: %m");
done += buffer->size;
rps = LESS_BY(rps, buffer->size);
}
log_debug("Added %zu bytes of TPM2 entropy to the kernel random pool in %s.", done, FORMAT_TIMESPAN(now(CLOCK_MONOTONIC) - t, 0));
r = touch(TPM2_CREDIT_RANDOM_FLAG_PATH);
if (r < 0)
log_debug_errno(r, "Failed to touch '" TPM2_CREDIT_RANDOM_FLAG_PATH "', ignoring: %m");
return 0;
}
/* Get one of the legacy primary key templates.
*
* The legacy templates should only be used for older sealed data that did not use the SRK. Instead of a
* persistent SRK, a transient key was created to seal the data and then flushed; and the exact same template
* must be used to recreate the same transient key to unseal the data. The alg parameter must be TPM2_ALG_RSA
* or TPM2_ALG_ECC. This does not check if the alg is actually supported on this TPM. */
static int tpm2_get_legacy_template(TPMI_ALG_PUBLIC alg, TPMT_PUBLIC *ret_template) {
/* Do not modify. */
static const TPMT_PUBLIC legacy_ecc = {
.type = TPM2_ALG_ECC,
.nameAlg = TPM2_ALG_SHA256,
.objectAttributes =
TPMA_OBJECT_RESTRICTED|
TPMA_OBJECT_DECRYPT|
TPMA_OBJECT_FIXEDTPM|
TPMA_OBJECT_FIXEDPARENT|
TPMA_OBJECT_SENSITIVEDATAORIGIN|
TPMA_OBJECT_USERWITHAUTH,
.parameters.eccDetail = {
.symmetric = {
.algorithm = TPM2_ALG_AES,
.keyBits.aes = 128,
.mode.aes = TPM2_ALG_CFB,
},
.scheme.scheme = TPM2_ALG_NULL,
.curveID = TPM2_ECC_NIST_P256,
.kdf.scheme = TPM2_ALG_NULL,
},
};
/* Do not modify. */
static const TPMT_PUBLIC legacy_rsa = {
.type = TPM2_ALG_RSA,
.nameAlg = TPM2_ALG_SHA256,
.objectAttributes = TPMA_OBJECT_RESTRICTED|TPMA_OBJECT_DECRYPT|TPMA_OBJECT_FIXEDTPM|TPMA_OBJECT_FIXEDPARENT|TPMA_OBJECT_SENSITIVEDATAORIGIN|TPMA_OBJECT_USERWITHAUTH,
.parameters.rsaDetail = {
.symmetric = {
.algorithm = TPM2_ALG_AES,
.keyBits.aes = 128,
.mode.aes = TPM2_ALG_CFB,
},
.scheme.scheme = TPM2_ALG_NULL,
.keyBits = 2048,
},
};
assert(ret_template);
if (alg == TPM2_ALG_ECC)
*ret_template = legacy_ecc;
else if (alg == TPM2_ALG_RSA)
*ret_template = legacy_rsa;
else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"Unsupported legacy SRK alg: 0x%x", alg);
return 0;
}
int tpm2_get_best_attestation_key_template(Tpm2Context *c, TPMT_PUBLIC *ret) {
assert(c);
assert(ret);
static const struct {
TPMI_ALG_PUBLIC alg;
TPMI_ALG_HASH name_alg;
TPMT_ASYM_SCHEME asym_scheme;
union {
TPMI_RSA_KEY_BITS rsa_key_bits;
TPMI_ECC_CURVE ecc_curve_id;
} asym_params;
} template_params[] = {
{
.alg = TPM2_ALG_ECC,
.name_alg = TPM2_ALG_SHA384,
.asym_scheme = {
.scheme = TPM2_ALG_ECDSA,
.details.ecdsa.hashAlg = TPM2_ALG_SHA384,
},
.asym_params.ecc_curve_id = TPM2_ECC_NIST_P384,
},
{
.alg = TPM2_ALG_ECC,
.name_alg = TPM2_ALG_SHA256,
.asym_scheme = {
.scheme = TPM2_ALG_ECDSA,
.details.ecdsa.hashAlg = TPM2_ALG_SHA256,
},
.asym_params.ecc_curve_id = TPM2_ECC_NIST_P256,
},
{
.alg = TPM2_ALG_RSA,
.name_alg = TPM2_ALG_SHA384,
.asym_scheme = {
.scheme = TPM2_ALG_RSAPSS,
.details.rsapss.hashAlg = TPM2_ALG_SHA384,
},
.asym_params.rsa_key_bits = 3072,
},
{
.alg = TPM2_ALG_RSA,
.name_alg = TPM2_ALG_SHA384,
.asym_scheme = {
.scheme = TPM2_ALG_RSASSA,
.details.rsassa.hashAlg = TPM2_ALG_SHA384,
},
.asym_params.rsa_key_bits = 3072,
},
{
.alg = TPM2_ALG_RSA,
.name_alg = TPM2_ALG_SHA256,
.asym_scheme = {
.scheme = TPM2_ALG_RSAPSS,
.details.rsapss.hashAlg = TPM2_ALG_SHA256,
},
.asym_params.rsa_key_bits = 2048,
},
{
.alg = TPM2_ALG_RSA,
.name_alg = TPM2_ALG_SHA256,
.asym_scheme = {
.scheme = TPM2_ALG_RSASSA,
.details.rsassa.hashAlg = TPM2_ALG_SHA256,
},
.asym_params.rsa_key_bits = 2048,
},
};
FOREACH_ELEMENT(p, template_params) {
TPMT_PUBLIC template = {
.type = p->alg,
.nameAlg = p->name_alg,
.objectAttributes =
TPMA_OBJECT_FIXEDTPM |
TPMA_OBJECT_FIXEDPARENT |
TPMA_OBJECT_SENSITIVEDATAORIGIN |
TPMA_OBJECT_USERWITHAUTH |
TPMA_OBJECT_RESTRICTED |
TPMA_OBJECT_SIGN_ENCRYPT,
.parameters.asymDetail = {
.symmetric.algorithm = TPM2_ALG_NULL,
.scheme = p->asym_scheme,
},
};
switch (template.type) {
case TPM2_ALG_RSA:
template.parameters.rsaDetail.keyBits = p->asym_params.rsa_key_bits;
break;
case TPM2_ALG_ECC:
template.parameters.eccDetail.curveID = p->asym_params.ecc_curve_id;
template.parameters.eccDetail.kdf.scheme = TPM2_ALG_NULL;
break;
default:
assert_not_reached();
}
if (!tpm2_supports_alg(c, template.type))
continue;
if (!tpm2_supports_tpmt_public(c, &template))
continue;
if (template.type == TPM2_ALG_ECC && !tpm2_supports_ecc_curve(c, template.parameters.eccDetail.curveID))
continue;
*ret = template;
return 0;
}
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "No supported attestation key template");
}
/* Get a Storage Root Key (SRK) template.
*
* The SRK template values are recommended by the "TCG TPM v2.0 Provisioning Guidance" document in section
* 7.5.1 "Storage Primary Key (SRK) Templates", referencing "TCG EK Credential Profile for TPM Family 2.0".
* The EK Credential Profile version 2.0 provides only a single template each for RSA and ECC, while later EK
* Credential Profile versions provide more templates, and keep the original templates as "L-1" (for RSA) and
* "L-2" (for ECC).
*
* https://trustedcomputinggroup.org/resource/tcg-tpm-v2-0-provisioning-guidance
* https://trustedcomputinggroup.org/resource/http-trustedcomputinggroup-org-wp-content-uploads-tcg-ek-credential-profile
*
* These templates are only needed to create a new persistent SRK (or a new transient key that is
* SRK-compatible). Preferably, the TPM should contain a shared SRK located at the reserved shared SRK handle
* (see TPM2_SRK_HANDLE in tpm2-util.h, and tpm2_get_srk() below).
*
* Returns 0 if the specified algorithm is ECC or RSA, otherwise -EOPNOTSUPP. */
int tpm2_get_srk_template(TPMI_ALG_PUBLIC alg, TPMT_PUBLIC *ret_template) {
/* The attributes are the same between ECC and RSA templates. This has the changes specified in the
* Provisioning Guidance document, specifically:
* TPMA_OBJECT_USERWITHAUTH is added.
* TPMA_OBJECT_ADMINWITHPOLICY is removed.
* TPMA_OBJECT_NODA is added. */
TPMA_OBJECT srk_attributes =
TPMA_OBJECT_DECRYPT |
TPMA_OBJECT_FIXEDPARENT |
TPMA_OBJECT_FIXEDTPM |
TPMA_OBJECT_NODA |
TPMA_OBJECT_RESTRICTED |
TPMA_OBJECT_SENSITIVEDATAORIGIN |
TPMA_OBJECT_USERWITHAUTH;
/* The symmetric configuration is the same between ECC and RSA templates. */
TPMT_SYM_DEF_OBJECT srk_symmetric = {
.algorithm = TPM2_ALG_AES,
.keyBits.aes = 128,
.mode.aes = TPM2_ALG_CFB,
};
/* Both templates have an empty authPolicy as specified by the Provisioning Guidance document. */
/* From the EK Credential Profile template "L-2". */
TPMT_PUBLIC srk_ecc = {
.type = TPM2_ALG_ECC,
.nameAlg = TPM2_ALG_SHA256,
.objectAttributes = srk_attributes,
.parameters.eccDetail = {
.symmetric = srk_symmetric,
.scheme.scheme = TPM2_ALG_NULL,
.curveID = TPM2_ECC_NIST_P256,
.kdf.scheme = TPM2_ALG_NULL,
},
};
/* From the EK Credential Profile template "L-1". */
TPMT_PUBLIC srk_rsa = {
.type = TPM2_ALG_RSA,
.nameAlg = TPM2_ALG_SHA256,
.objectAttributes = srk_attributes,
.parameters.rsaDetail = {
.symmetric = srk_symmetric,
.scheme.scheme = TPM2_ALG_NULL,
.keyBits = 2048,
},
};
assert(ret_template);
switch (alg) {
case TPM2_ALG_ECC:
*ret_template = srk_ecc;
return 0;
case TPM2_ALG_RSA:
*ret_template = srk_rsa;
return 0;
}
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "No SRK for algorithm 0x%" PRIx16, alg);
}
/* Get the best supported SRK template. ECC is preferred, then RSA. */
int tpm2_get_best_srk_template(Tpm2Context *c, TPMT_PUBLIC *ret_template) {
TPMT_PUBLIC template;
int r;
assert(c);
assert(ret_template);
r = tpm2_get_srk_template(TPM2_ALG_ECC, &template);
if (r < 0)
return r;
if (!tpm2_supports_alg(c, TPM2_ALG_ECC))
log_debug("TPM does not support ECC.");
else if (!tpm2_supports_ecc_curve(c, template.parameters.eccDetail.curveID))
log_debug("TPM does not support ECC-NIST-P256 curve.");
else if (!tpm2_supports_tpmt_public(c, &template))
log_debug("TPM does not support SRK ECC template L-2.");
else {
*ret_template = template;
return 0;
}
r = tpm2_get_srk_template(TPM2_ALG_RSA, &template);
if (r < 0)
return r;
if (!tpm2_supports_alg(c, TPM2_ALG_RSA))
log_debug("TPM does not support RSA.");
else if (!tpm2_supports_tpmt_public(c, &template))
log_debug("TPM does not support SRK RSA template L-1.");
else {
*ret_template = template;
return 0;
}
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"TPM does not support either SRK template L-1 (RSA) or L-2 (ECC).");
}
/* Get the SRK. Returns 1 if SRK is found, 0 if there is no SRK, or < 0 on error. Also see
* tpm2_get_or_create_srk() below. */
int tpm2_get_srk(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2B_PUBLIC **ret_public,
TPM2B_NAME **ret_name,
TPM2B_NAME **ret_qname,
Tpm2Handle **ret_handle) {
return tpm2_object_index_to_handle(c, TPM2_SRK_HANDLE, session, ret_public, ret_name, ret_qname, ret_handle);
}
/* Get the SRK, creating one if needed. Returns 1 if a new SRK was created and persisted, 0 if an SRK already
* exists, or < 0 on error. */
int tpm2_get_or_create_srk(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2B_PUBLIC **ret_public,
TPM2B_NAME **ret_name,
TPM2B_NAME **ret_qname,
Tpm2Handle **ret_handle) {
int r;
r = tpm2_get_srk(c, session, ret_public, ret_name, ret_qname, ret_handle);
if (r < 0)
return r;
if (r == 1)
return 0; /* 0 → SRK already set up */
/* No SRK, create and persist one */
TPM2B_PUBLIC template = {
.size = sizeof(TPMT_PUBLIC),
};
r = tpm2_get_best_srk_template(c, &template.publicArea);
if (r < 0)
return log_debug_errno(r, "Could not get best SRK template: %m");
_cleanup_(tpm2_handle_freep) Tpm2Handle *transient_handle = NULL;
r = tpm2_create_primary(
c,
session,
ESYS_TR_RH_OWNER,
&template,
/* sensitive= */ NULL,
/* ret_public= */ NULL,
&transient_handle);
if (r < 0)
return r;
/* Try to persist the transient SRK we created. No locking needed; if multiple threads are trying to
* persist SRKs concurrently, only one will succeed (r == 1) while the rest will fail (r == 0). In
* either case, all threads will get the persistent SRK below. */
r = tpm2_persist_handle(c, transient_handle, session, TPM2_SRK_HANDLE, /* ret_persistent_handle= */ NULL);
if (r < 0)
return r;
/* The SRK should exist now. */
r = tpm2_get_srk(c, session, ret_public, ret_name, ret_qname, ret_handle);
if (r < 0)
return r;
if (r == 0)
/* This should never happen. */
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "SRK we just persisted couldn't be found.");
return 1; /* > 0 → SRK newly set up */
}
static bool has_expected_ek_cert_attributes(const TPM2B_NV_PUBLIC *nv_pub) {
/* Determine whether the supplied NV index has the expected attributes for an EK certificate. These
* attributes are defined in the "TCG PC Client Platform TPM Profile Specification for TPM 2.0" spec,
* section 4.6.3.1 (Preprovisioned EK Certificates).
*
* TPMA_NV_OWNERREAD isn't required because some TPMs ship EK certs with only TPMA_NV_AUTHREAD.
*
* https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/ */
if ((nv_pub->nvPublic.attributes & TPMA_NV_TPM2_NT_MASK) != (TPM2_NT_ORDINARY << TPMA_NV_TPM2_NT_SHIFT))
return false;
static const TPMA_NV expected_clear_attrs =
TPMA_NV_AUTHWRITE |
TPMA_NV_OWNERWRITE |
TPMA_NV_GLOBALLOCK |
TPMA_NV_CLEAR_STCLEAR |
TPMA_NV_ORDERLY |
TPMA_NV_READ_STCLEAR;
static const TPMA_NV expected_set_attrs =
TPMA_NV_PLATFORMCREATE |
TPMA_NV_AUTHREAD |
TPMA_NV_NO_DA;
return (((nv_pub->nvPublic.attributes & expected_set_attrs) == expected_set_attrs) &&
((nv_pub->nvPublic.attributes & expected_clear_attrs) == 0));
}
/* A mapping of each EK profile to the NV index handle where the corresponding EK certificate is expected to
* be stored. Each EK profile has a dedicated NV index. See the "TCG EK Credential Profile for TPM Family
* 2.0" spec, sections 2.2.2.4 (low range) and 2.2.2.5 (high range).
*
* https://trustedcomputinggroup.org/resource/http-trustedcomputinggroup-org-wp-content-uploads-tcg-ek-credential-profile/ */
static const TPM2_HANDLE ek_cert_nv_indexes[_TPM2_EK_TEMPLATE_MAX] = {
[TPM2_EK_TEMPLATE_RSA_2048_LEGACY] = 0x01C00002,
[TPM2_EK_TEMPLATE_ECC_NIST_P256_LEGACY] = 0x01C0000A,
[TPM2_EK_TEMPLATE_RSA_2048] = 0x01C00012,
[TPM2_EK_TEMPLATE_ECC_NIST_P256] = 0x01C00014,
[TPM2_EK_TEMPLATE_ECC_NIST_P384] = 0x01C00016,
[TPM2_EK_TEMPLATE_RSA_3072] = 0x01C0001C,
};
#if HAVE_OPENSSL
static const char* const ek_template_names[_TPM2_EK_TEMPLATE_MAX] = {
[TPM2_EK_TEMPLATE_RSA_2048_LEGACY] = "RSA 2048 (L-1)",
[TPM2_EK_TEMPLATE_ECC_NIST_P256_LEGACY] = "ECC NIST P256 (L-2)",
[TPM2_EK_TEMPLATE_RSA_2048] = "RSA 2048 (H-1)",
[TPM2_EK_TEMPLATE_ECC_NIST_P256] = "ECC NIST P256 (H-2)",
[TPM2_EK_TEMPLATE_ECC_NIST_P384] = "ECC NIST P384 (H-3)",
[TPM2_EK_TEMPLATE_RSA_3072] = "RSA 3072 (H-6)",
};
/* Read the EK certificate from its NV index for the specified EK profile. This returns 1 if there is a
* valid certificate, 0 if no valid NV index exists, or < 0 if an error occurs. Note that this doesn't check
* that the obtained certificate has the expected public key algorithm. */
static int tpm2_read_ek_cert(
Tpm2Context *c,
const Tpm2Handle *session,
Tpm2EKTemplateProfile profile,
X509 **ret_cert) {
int r;
assert(c);
assert(profile >= 0);
assert(profile < _TPM2_EK_TEMPLATE_MAX);
assert(ret_cert);
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
TPM2_HANDLE cert_index = ek_cert_nv_indexes[profile];
_cleanup_(tpm2_handle_freep) Tpm2Handle *cert_handle = NULL;
_cleanup_(Esys_Freep) TPM2B_NV_PUBLIC *cert_nvpub = NULL;
r = tpm2_nv_index_to_handle(c, cert_index, session, &cert_nvpub, /* ret_name= */ NULL, &cert_handle);
if (r < 0)
return r;
if (r == 0) {
*ret_cert = NULL;
return r;
}
/* Ignore any NV index that doesn't have the expected attributes, to ensure that we don't generate
* erroneous errors if we encounter some arbitrary owner-created index. */
if (!has_expected_ek_cert_attributes(cert_nvpub)) {
*ret_cert = NULL;
return 0;
}
_cleanup_(iovec_done) struct iovec cert_data = {};
r = tpm2_read_nv_index(c, session, cert_index, cert_handle, &cert_data);
if (r < 0)
return r;
const unsigned char *p = cert_data.iov_base;
_cleanup_(X509_freep) X509 *cert = sym_d2i_X509(NULL, &p, (long) cert_data.iov_len);
if (!cert)
return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG),
"Failed to parse EK certificate for template '%s' from NV index 0x%08" PRIx32 ": %s",
ek_template_names[profile], cert_index, sym_ERR_error_string(sym_ERR_get_error(), NULL));
*ret_cert = TAKE_PTR(cert);
return 1;
}
#endif
/* Obtain a custom EK template for the specified EK profile. The "TCG EK Credential Profile for TPM Family
* 2.0" spec details how a TPM manufacturer can certify endorsement keys with templates that differ from the
* default ones by storing a template in a NV index. Returns 1 if there is a custom template, 0 if there is
* no custom template, or < 0 if an error occurred.
*
* https://trustedcomputinggroup.org/resource/http-trustedcomputinggroup-org-wp-content-uploads-tcg-ek-credential-profile/ */
static int tpm2_get_custom_ek_template(
Tpm2Context *c,
const Tpm2Handle *session,
Tpm2EKTemplateProfile profile,
TPMT_PUBLIC *ret_template) {
int r;
assert(c);
assert(profile >= 0);
assert(profile < _TPM2_EK_TEMPLATE_MAX);
assert(ret_template);
TPM2_HANDLE cert_index = ek_cert_nv_indexes[profile];
/* Handle 0x01c00012 is the start of the "High Range" EK certs, with those lower than this being the
* legacy "Low Range" ones. Low range certs can have an optional nonce as well as a custom template.
* High range certs can only have a custom template, defined at the next subsequent (odd) NV index.
* See sections 2.2.2.4 and 2.2.2.5 of the "TCG EK Credential Profile for TPM Family 2.0" spec. */
TPM2_HANDLE template_index = cert_index >= 0x01C00012 ? cert_index + 1 : cert_index + 2;
TPM2_HANDLE nonce_index = cert_index >= 0x01C00012 ? 0 : cert_index + 1;
/* First check if there is a custom EK template NV index defined. */
_cleanup_(tpm2_handle_freep) Tpm2Handle *template_handle = NULL;
_cleanup_(Esys_Freep) TPM2B_NV_PUBLIC *template_nvpub = NULL;
r = tpm2_nv_index_to_handle(c, template_index, session, &template_nvpub, /* ret_name= */ NULL, &template_handle);
if (r < 0)
return r;
if (r > 0 && !has_expected_ek_cert_attributes(template_nvpub))
/* Ignore this NV index because it doesn't have the expected attributes. */
template_handle = tpm2_handle_free(template_handle);
/* Now check if there is a nonce NV index defined. Table 1 of the "TCG EK Credential Profile for TPM
* Family 2.0" spec suggests this combination (EKnonce without EKtemplate) must not appear, but
* apparently this configuration did ship with Intel PTT. */
_cleanup_(tpm2_handle_freep) Tpm2Handle *nonce_handle = NULL;
_cleanup_(Esys_Freep) TPM2B_NV_PUBLIC *nonce_nvpub = NULL;
if (nonce_index != 0) {
r = tpm2_nv_index_to_handle(c, nonce_index, session, &nonce_nvpub, /* ret_name= */ NULL, &nonce_handle);
if (r < 0)
return r;
if (r > 0 && !has_expected_ek_cert_attributes(nonce_nvpub))
/* Ignore this NV index because it doesn't have the expected attributes. */
nonce_handle = tpm2_handle_free(nonce_handle);
}
if (!template_handle && !nonce_handle) {
/* There is no custom template. */
*ret_template = (TPMT_PUBLIC){};
return 0;
}
TPMT_PUBLIC template = {};
if (template_handle) {
_cleanup_(iovec_done) struct iovec template_data = {};
r = tpm2_read_nv_index(c, session, template_index, template_handle, &template_data);
if (r < 0)
return r;
size_t offset = 0;
TSS2_RC rc = sym_Tss2_MU_TPMT_PUBLIC_Unmarshal(template_data.iov_base, template_data.iov_len, &offset, &template);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG), "Failed to unmarshal EK template from NV index 0x%08" PRIx32 ": %s",
template_index, sym_Tss2_RC_Decode(rc));
if (offset != template_data.iov_len)
return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG),
"Garbage at end of custom template data.");
} else
tpm2_get_default_ek_template(profile, &template);
if (nonce_handle) {
/* We have a nonce. Section 2.2.2.6 of the "TCG EK Credential Profile for TPM Family 2.0"
* spec explains how to construct the template from this. */
_cleanup_(iovec_done) struct iovec nonce_data = {};
r = tpm2_read_nv_index(c, session, nonce_index, nonce_handle, &nonce_data);
if (r < 0)
return r;
zero(template.unique);
switch (profile) {
case TPM2_EK_TEMPLATE_RSA_2048_LEGACY:
/* For the RSA-2048 (L-1) template, set unique.rsa to the nonce and append zero
* bytes to pad it to a size of 256-bytes. */
if (nonce_data.iov_len > 256)
return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG),
"Invalid RSA EK nonce length from NV index 0x%08" PRIx32, nonce_index);
template.unique.rsa.size = 256;
memcpy_safe(template.unique.rsa.buffer, nonce_data.iov_base, nonce_data.iov_len);
break;
case TPM2_EK_TEMPLATE_ECC_NIST_P256_LEGACY:
/* For the ECC NIST P256 (L-2) template, set unique.ecc.x to the nonce and append
* zero bytes to pad it to a size of 32-bytes. Set unique.ecc.y to 32-bytes of
* zeroes. */
if (nonce_data.iov_len > 32)
return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG),
"Invalid ECC EK nonce length from NV index 0x%08" PRIx32, nonce_index);
template.unique.ecc.x.size = template.unique.ecc.y.size = 32;
memcpy_safe(template.unique.ecc.x.buffer, nonce_data.iov_base, nonce_data.iov_len);
break;
default:
assert_not_reached();
}
}
*ret_template = template;
return 1;
}
/* This is the default authorization policy for low-range endorsement keys. It is:
*
* TPM2_PolicySecret(TPM_RH_ENDORSEMENT).
*
* See section 5.3 of the "TCG EK Credential Profile for TPM Family 2.0" spec. */
#define TPM2_EK_AUTH_POLICY_A \
{ .size = TPM2_SHA256_DIGEST_SIZE, \
.buffer = { \
0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xB3, 0xF8, \
0x1A, 0x90, 0xCC, 0x8D, 0x46, 0xA5, 0xD7, 0x24, \
0xFD, 0x52, 0xD7, 0x6E, 0x06, 0x52, 0x0B, 0x64, \
0xF2, 0xA1, 0xDA, 0x1B, 0x33, 0x14, 0x69, 0xAA, \
}, \
}
/* This is the default SHA-256 authorization policy for high-range endorsement keys. High-range EKs
* define a policy that permits the privacy administrator to delegate admin usage of the endorsement key via
* TPM2_PolicyAuthorizeNV. There is one NV index defined per name algorithm. These and their public
* attributes are specified in section A.1 of the "TCG EK Credential Profile for TPM Family 2.0" spec.
*
* This policy is:
*
* TPM2_PolicySecret(TPM_RH_ENDORSEMENT) OR TPM2_PolicyAuthorizeNV(0x01C07F01). */
#define TPM2_EK_AUTH_POLICY_B_SHA256 \
{ .size = TPM2_SHA256_DIGEST_SIZE, \
.buffer = { \
0xCA, 0x3D, 0x0A, 0x99, 0xA2, 0xB9, 0x39, 0x06, \
0xF7, 0xA3, 0x34, 0x24, 0x14, 0xEF, 0xCF, 0xB3, \
0xA3, 0x85, 0xD4, 0x4C, 0xD1, 0xFD, 0x45, 0x90, \
0x89, 0xD1, 0x9B, 0x50, 0x71, 0xC0, 0xB7, 0xA0, \
}, \
}
/* This is the default SHA-384 authorization policy for high-range endorsement keys. High-range EKs
* define a policy that permits the privacy administrator to delegate admin usage of the endorsement key via
* TPM2_PolicyAuthorizeNV. There is one NV index defined per name algorithm. These and their public
* attributes are specified in section A.1 of the "TCG EK Credential Profile for TPM Family 2.0" spec.
*
* This policy is:
*
* TPM2_PolicySecret(TPM_RH_ENDORSEMENT) OR TPM2_PolicyAuthorizeNV(0x01C07F02). */
#define TPM2_EK_AUTH_POLICY_B_SHA384 \
{ .size = TPM2_SHA384_DIGEST_SIZE, \
.buffer = { \
0xB2, 0x6E, 0x7D, 0x28, 0xD1, 0x1A, 0x50, 0xBC, \
0x53, 0xD8, 0x82, 0xBC, 0xF5, 0xFD, 0x3A, 0x1A, \
0x07, 0x41, 0x48, 0xBB, 0x35, 0xD3, 0xB4, 0xE4, \
0xCB, 0x1C, 0x0A, 0xD9, 0xBD, 0xE4, 0x19, 0xCA, \
0xCB, 0x47, 0xBA, 0x09, 0x69, 0x96, 0x46, 0x15, \
0x0F, 0x9F, 0xC0, 0x00, 0xF3, 0xF8, 0x0E, 0x12 \
}, \
}
/* Get the default Endorsement Key (EK) template for the specified EK profile.
*
* EK template values are defined in the "TCG EK Credential Profile for TPM Family 2.0" spec in sections
* 5.3 (low-range) and 5.4 (high-range). There are multiple templates for both RSA and ECC keys, with varying
* key sizes or curves. The high-range also defines templates for storage and signing keys, although we only
* support storage EKs. There are templates for PQC algorithms, although these aren't supported here yet. The
* supported templates are the storage RSA and ECC templates required by the "TCG PC Client Platform TPM
* Profile (PTP)" spec.
*
* https://trustedcomputinggroup.org/resource/http-trustedcomputinggroup-org-wp-content-uploads-tcg-ek-credential-profile
* https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/ */
void tpm2_get_default_ek_template(Tpm2EKTemplateProfile profile, TPMT_PUBLIC *ret_template) {
assert(profile >= 0);
assert(profile < _TPM2_EK_TEMPLATE_MAX);
assert(ret_template);
static const TPMA_OBJECT attributes_a =
TPMA_OBJECT_FIXEDTPM |
TPMA_OBJECT_FIXEDPARENT |
TPMA_OBJECT_SENSITIVEDATAORIGIN |
TPMA_OBJECT_ADMINWITHPOLICY |
TPMA_OBJECT_RESTRICTED |
TPMA_OBJECT_DECRYPT;
static const TPMA_OBJECT attributes_b = attributes_a | TPMA_OBJECT_USERWITHAUTH;
static const struct {
TPMI_ALG_PUBLIC alg;
TPMI_ALG_HASH name_alg;
TPMA_OBJECT attrs;
TPM2B_DIGEST auth_policy;
union {
TPMI_RSA_KEY_BITS rsa_key_bits;
TPMI_ECC_CURVE ecc_curve_id;
} asym;
TPMU_PUBLIC_ID unique;
TPMI_AES_KEY_BITS sym_key_bits;
} template_params[_TPM2_EK_TEMPLATE_MAX] = {
[TPM2_EK_TEMPLATE_RSA_2048_LEGACY] = {
.alg = TPM2_ALG_RSA,
.name_alg = TPM2_ALG_SHA256,
.attrs = attributes_a,
.auth_policy = TPM2_EK_AUTH_POLICY_A,
.asym.rsa_key_bits = 2048,
.unique.rsa.size = 256,
.sym_key_bits = 128,
},
[TPM2_EK_TEMPLATE_ECC_NIST_P256_LEGACY] = {
.alg = TPM2_ALG_ECC,
.name_alg = TPM2_ALG_SHA256,
.attrs = attributes_a,
.auth_policy = TPM2_EK_AUTH_POLICY_A,
.asym.ecc_curve_id = TPM2_ECC_NIST_P256,
.unique.ecc.x.size = 32,
.unique.ecc.y.size = 32,
.sym_key_bits = 128,
},
[TPM2_EK_TEMPLATE_RSA_2048] = {
.alg = TPM2_ALG_RSA,
.name_alg = TPM2_ALG_SHA256,
.attrs = attributes_b,
.auth_policy = TPM2_EK_AUTH_POLICY_B_SHA256,
.asym.rsa_key_bits = 2048,
.unique.rsa.size = 0,
.sym_key_bits = 128,
},
[TPM2_EK_TEMPLATE_ECC_NIST_P256] = {
.alg = TPM2_ALG_ECC,
.name_alg = TPM2_ALG_SHA256,
.attrs = attributes_b,
.auth_policy = TPM2_EK_AUTH_POLICY_B_SHA256,
.asym.ecc_curve_id = TPM2_ECC_NIST_P256,
.unique.ecc.x.size = 0,
.unique.ecc.y.size = 0,
.sym_key_bits = 128,
},
[TPM2_EK_TEMPLATE_ECC_NIST_P384] = {
.alg = TPM2_ALG_ECC,
.name_alg = TPM2_ALG_SHA384,
.attrs = attributes_b,
.auth_policy = TPM2_EK_AUTH_POLICY_B_SHA384,
.asym.ecc_curve_id = TPM2_ECC_NIST_P384,
.unique.ecc.x.size = 0,
.unique.ecc.y.size = 0,
.sym_key_bits = 256,
},
[TPM2_EK_TEMPLATE_RSA_3072] = {
.alg = TPM2_ALG_RSA,
.name_alg = TPM2_ALG_SHA384,
.attrs = attributes_b,
.auth_policy = TPM2_EK_AUTH_POLICY_B_SHA384,
.asym.rsa_key_bits = 3072,
.unique.rsa.size = 0,
.sym_key_bits = 256,
},
};
const typeof(template_params[0]) *params = &template_params[profile];
TPMT_PUBLIC template = {
.type = params->alg,
.nameAlg = params->name_alg,
.objectAttributes = params->attrs,
.authPolicy = params->auth_policy,
.parameters.asymDetail = (TPMS_ASYM_PARMS){
.symmetric = (TPMT_SYM_DEF_OBJECT){
.algorithm = TPM2_ALG_AES,
.keyBits.aes = params->sym_key_bits,
.mode.aes = TPM2_ALG_CFB,
},
.scheme.scheme = TPM2_ALG_NULL,
},
.unique = params->unique,
};
switch (template.type) {
case TPM2_ALG_RSA:
template.parameters.rsaDetail.keyBits = params->asym.rsa_key_bits;
break;
case TPM2_ALG_ECC:
template.parameters.eccDetail.curveID = params->asym.ecc_curve_id;
template.parameters.eccDetail.kdf.scheme = TPM2_ALG_NULL;
break;
default:
assert_not_reached();
}
*ret_template = template;
}
/* Get the Endorsement Key (EK) template for the specified EK profile.
*
* EK template values are defined in the "TCG EK Credential Profile for TPM Family 2.0" spec in sections
* 5.3 (low-range) and 5.4 (high-range). There are multiple templates for both RSA and ECC keys, with varying
* key sizes or curves. The high-range also defines templates for storage and signing keys, although we only
* support storage EKs. There are templates for PQC algorithms, although these aren't supported here yet. The
* supported templates are the storage RSA and ECC templates required by the "TCG PC Client Platform TPM
* Profile (PTP)" spec.
*
* This will return a custom template for the specified profile if one is defined, else it will return the
* default template. Returns 0 on success, or < 0 if an error occurred.
*
* https://trustedcomputinggroup.org/resource/http-trustedcomputinggroup-org-wp-content-uploads-tcg-ek-credential-profile
* https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/ */
int tpm2_get_ek_template(
Tpm2Context *c,
const Tpm2Handle *session,
Tpm2EKTemplateProfile profile,
TPMT_PUBLIC *ret_template) {
int r;
r = tpm2_get_custom_ek_template(c, session, profile, ret_template);
if (r < 0)
return r;
if (r == 0)
tpm2_get_default_ek_template(profile, ret_template);
return 0;
}
/* Get the EK. Returns 1 if found, 0 if there is no EK, or < 0 on error. Also see
* tpm2_get_or_create_ek() below. */
int tpm2_get_ek(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2B_PUBLIC **ret_public,
TPM2B_NAME **ret_name,
TPM2B_NAME **ret_qname,
Tpm2Handle **ret_handle) {
return tpm2_object_index_to_handle(c, TPM2_EK_HANDLE, session, ret_public, ret_name, ret_qname, ret_handle);
}
/* Get the EK, creating one if needed. This tries each of the supported templates in order of preference,
* and will persist and return an EK created with the first template that has an EK certificate, and where
* the created EK matches the certificate's public key.
*
* Returns 1 if a new EK was created and persisted, 0 if an EK already exists, or < 0 on error. */
int tpm2_get_or_create_ek(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2B_PUBLIC **ret_public,
TPM2B_NAME **ret_name,
TPM2B_NAME **ret_qname,
Tpm2Handle **ret_handle) {
#if HAVE_OPENSSL
int r;
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
r = tpm2_get_ek(c, session, ret_public, ret_name, ret_qname, ret_handle);
if (r < 0)
return r;
if (r == 1)
return 0; /* 0 → EK already set up */
/* No EK, create and persist one */
static const Tpm2EKTemplateProfile profile_preferences[] = {
TPM2_EK_TEMPLATE_ECC_NIST_P384,
TPM2_EK_TEMPLATE_ECC_NIST_P256,
TPM2_EK_TEMPLATE_RSA_3072,
TPM2_EK_TEMPLATE_RSA_2048,
TPM2_EK_TEMPLATE_ECC_NIST_P256_LEGACY,
TPM2_EK_TEMPLATE_RSA_2048_LEGACY,
};
FOREACH_ELEMENT(p, profile_preferences) {
Tpm2EKTemplateProfile profile = *p;
log_debug("Trying to create EK with template '%s'", ek_template_names[profile]);
/* Check if there is a certificate for this profile. */
_cleanup_(X509_freep) X509 *cert = NULL;
r = tpm2_read_ek_cert(c, session, profile, &cert);
if (r == -EBADMSG)
continue; /* Certificate populated but invalid. */
if (r < 0)
return r;
if (r == 0)
continue; /* No certificate populated. */
EVP_PKEY *cert_pkey = sym_X509_get0_pubkey(cert);
if (!cert_pkey) {
log_debug("Skipping EK creation with template '%s': cannot get EKcert public key", ek_template_names[profile]);
continue;
}
/* Obtain the template for this profile. */
TPM2B_PUBLIC template = {
.size = sizeof(TPMT_PUBLIC),
};
r = tpm2_get_ek_template(c, session, profile, &template.publicArea);
if (r == -EBADMSG)
continue; /* Custom template or nonce is invalid. */
if (r < 0)
return r;
/* Check that this profile is supported. */
if (!tpm2_supports_alg(c, template.publicArea.type)) {
log_debug("Skipping EK creation with template '%s': unsupported object type", ek_template_names[profile]);
continue;
}
if (!tpm2_supports_tpmt_public(c, &template.publicArea)) {
log_debug("Skipping EK creation with template '%s': unsupported template", ek_template_names[profile]);
continue;
}
if (template.publicArea.type == TPM2_ALG_ECC && !tpm2_supports_ecc_curve(c, template.publicArea.parameters.eccDetail.curveID)) {
log_debug("Skipping EK creation with template '%s': unsupported curve", ek_template_names[profile]);
continue;
}
/* Create the transient EK now. */
_cleanup_(tpm2_handle_freep) Tpm2Handle *transient_handle = NULL;
r = tpm2_create_primary(
c,
session,
ESYS_TR_RH_ENDORSEMENT,
&template,
/* sensitive= */ NULL,
/* ret_public= */ NULL,
&transient_handle);
if (r < 0)
return r;
_cleanup_(Esys_Freep) TPM2B_PUBLIC *public = NULL;
r = tpm2_read_public(c, session, transient_handle, &public, /* ret_name= */ NULL, /* ret_qname= */ NULL);
if (r < 0)
return r;
/* Check that the created EK has a public key that matches the one in the certificate. */
_cleanup_(EVP_PKEY_freep) EVP_PKEY *tpm_pkey = NULL;
r = tpm2_tpm2b_public_to_openssl_pkey(public, &tpm_pkey);
if (r < 0)
return r;
if (sym_EVP_PKEY_eq(tpm_pkey, cert_pkey) != 1) {
log_debug("EK created with template '%s' does not match EKcert public key", ek_template_names[profile]);
continue;
}
/* We've created a valid EK that is consistent with the supplied certificate, so persist this
* one and return it. */
r = tpm2_persist_handle(c, transient_handle, session, TPM2_EK_HANDLE, /* ret_persistent_handle= */ NULL);
if (r < 0)
return r;
r = tpm2_get_ek(c, session, ret_public, ret_name, ret_qname, ret_handle);
if (r < 0)
return r;
if (r == 0)
/* This should never happen. */
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "EK we just persisted couldn't be found.");
return 1; /* > 0 → EK newly set up */
}
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"No usable EK certificate found for any supported template.");
#else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
/* Opens a policy session for the EK associated with the supplied handle and executes the
* TPM2_PolicySecret(TPM_RH_ENDORSEMENT) branch, leaving the session ready to use for the user auth role.
*
* This isn't very flexible - it doesn't support delegated policies and assumes that the endorsement
* hierarchy auth is empty (or at least known by the caller). If the object has the userWithAuth attribute
* set, it doesn't create a policy session, which assumes that the object's auth value is empty. The EK
* template is designed in such a way that the use of the key can be locked down via a delegated policy by
* setting the endorsement hierarchy auth and setting the persistent EKauth to a random value. In the future,
* if we adopt the JSON policy language which will make it nicer to execute arbitrary policies, we might
* want to support these use cases via systemd-tpm2-setup.
*
* Returns 1 if a policy session was opened, 0 if the object at the supplied handle doesn't need a policy for
* the user auth role (in which case, no policy session is returned), or < 0 on error. */
int tpm2_open_ek_user_policy_session(
Tpm2Context *c,
const Tpm2Handle *session,
const Tpm2Handle *ek_handle,
const Tpm2Handle *tpm_key,
Tpm2Handle **ret_session) {
int r;
assert(c);
assert(ek_handle);
_cleanup_(Esys_Freep) TPM2B_PUBLIC *public = NULL;
r = tpm2_read_public(c, /* session= */ NULL, ek_handle, &public, /* ret_name= */ NULL, /* ret_qname= */ NULL);
if (r < 0)
return r;
if ((public->publicArea.objectAttributes & TPMA_OBJECT_USERWITHAUTH) != 0) {
/* Prefer HMAC or passphrase auth for this object. This catches
* the case where ek_handle is actually the SRK, and also all
* high-range EKs. */
if (ret_session)
*ret_session = NULL;
return 0;
}
/* We need a policy session. The only EKs we require this for today are low-range ones. */
if (public->publicArea.nameAlg != TPM2_ALG_SHA256)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to open EK user policy session: unsupported name algorithm");
TPM2B_DIGEST expected_policy = TPM2_EK_AUTH_POLICY_A;
if (memcmp_nn(expected_policy.buffer, expected_policy.size,
public->publicArea.authPolicy.buffer, public->publicArea.authPolicy.size) != 0)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to open EK user policy session: unrecognized policy digest");
/* Note that tpm2_make_policy_session is currently hardcoded to SHA256. That's ok for now because
* we only get this far if the supplied ek_handle has a name algorithm of SHA256. */
_cleanup_(tpm2_handle_freep) Tpm2Handle *policy_session = NULL;
r = tpm2_make_policy_session(c, tpm_key, /* encryption_session= */ NULL, &policy_session);
if (r < 0)
return r;
r = tpm2_policy_secret(c, session, policy_session, &TPM2_HANDLE_RH_ENDORSEMENT, /* policy_ref= */ NULL, /* ret_policy_digest= */ NULL);
if (r < 0)
return r;
if (ret_session)
*ret_session = TAKE_PTR(policy_session);
return 1;
}
/* Utility functions for TPMS_PCR_SELECTION. */
/* Convert a TPMS_PCR_SELECTION object to a mask. */
uint32_t tpm2_tpms_pcr_selection_to_mask(const TPMS_PCR_SELECTION *s) {
assert(s);
assert(s->sizeofSelect <= sizeof(s->pcrSelect));
uint32_t mask = 0;
for (unsigned i = 0; i < s->sizeofSelect; i++)
SET_FLAG(mask, (uint32_t)s->pcrSelect[i] << (i * 8), true);
return mask;
}
/* Convert a mask and hash alg to a TPMS_PCR_SELECTION object. */
void tpm2_tpms_pcr_selection_from_mask(uint32_t mask, TPMI_ALG_HASH hash_alg, TPMS_PCR_SELECTION *ret) {
assert(ret);
/* This is currently hardcoded at 24 PCRs, above. */
if (!TPM2_PCR_MASK_VALID(mask))
log_debug("PCR mask selections (%x) out of range, ignoring.",
mask & ~((uint32_t)TPM2_PCRS_MASK));
*ret = (TPMS_PCR_SELECTION){
.hash = hash_alg,
.sizeofSelect = TPM2_PCRS_MAX / 8,
.pcrSelect[0] = mask & 0xff,
.pcrSelect[1] = (mask >> 8) & 0xff,
.pcrSelect[2] = (mask >> 16) & 0xff,
};
}
/* Test if all bits in the mask are set in the TPMS_PCR_SELECTION. */
bool tpm2_tpms_pcr_selection_has_mask(const TPMS_PCR_SELECTION *s, uint32_t mask) {
assert(s);
return FLAGS_SET(tpm2_tpms_pcr_selection_to_mask(s), mask);
}
static void tpm2_tpms_pcr_selection_update_mask(TPMS_PCR_SELECTION *s, uint32_t mask, bool b) {
assert(s);
tpm2_tpms_pcr_selection_from_mask(UPDATE_FLAG(tpm2_tpms_pcr_selection_to_mask(s), mask, b), s->hash, s);
}
/* Add all PCR selections in the mask. */
void tpm2_tpms_pcr_selection_add_mask(TPMS_PCR_SELECTION *s, uint32_t mask) {
tpm2_tpms_pcr_selection_update_mask(s, mask, 1);
}
/* Remove all PCR selections in the mask. */
void tpm2_tpms_pcr_selection_sub_mask(TPMS_PCR_SELECTION *s, uint32_t mask) {
tpm2_tpms_pcr_selection_update_mask(s, mask, 0);
}
/* Add all PCR selections in 'b' to 'a'. Both must have the same hash alg. */
void tpm2_tpms_pcr_selection_add(TPMS_PCR_SELECTION *a, const TPMS_PCR_SELECTION *b) {
assert(a);
assert(b);
assert(a->hash == b->hash);
tpm2_tpms_pcr_selection_add_mask(a, tpm2_tpms_pcr_selection_to_mask(b));
}
/* Remove all PCR selections in 'b' from 'a'. Both must have the same hash alg. */
void tpm2_tpms_pcr_selection_sub(TPMS_PCR_SELECTION *a, const TPMS_PCR_SELECTION *b) {
assert(a);
assert(b);
assert(a->hash == b->hash);
tpm2_tpms_pcr_selection_sub_mask(a, tpm2_tpms_pcr_selection_to_mask(b));
}
/* Move all PCR selections in 'b' to 'a'. Both must have the same hash alg. */
void tpm2_tpms_pcr_selection_move(TPMS_PCR_SELECTION *a, TPMS_PCR_SELECTION *b) {
if (a == b)
return;
tpm2_tpms_pcr_selection_add(a, b);
tpm2_tpms_pcr_selection_from_mask(0, b->hash, b);
}
#define FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(tpms, tpml) \
_FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(tpms, tpml, UNIQ_T(l, UNIQ))
#define _FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(tpms, tpml, l) \
for (typeof(tpml) (l) = (tpml); (l); (l) = NULL) \
FOREACH_ARRAY(tpms, (l)->pcrSelections, (l)->count)
#define FOREACH_PCR_IN_TPMS_PCR_SELECTION(pcr, tpms) \
FOREACH_PCR_IN_MASK(pcr, tpm2_tpms_pcr_selection_to_mask(tpms))
#define FOREACH_PCR_IN_TPML_PCR_SELECTION(pcr, tpms, tpml) \
FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(tpms, tpml) \
FOREACH_PCR_IN_TPMS_PCR_SELECTION(pcr, tpms)
char* tpm2_tpms_pcr_selection_to_string(const TPMS_PCR_SELECTION *s) {
assert(s);
const char *algstr = strna(tpm2_hash_alg_to_string(s->hash));
_cleanup_free_ char *mask = tpm2_pcr_mask_to_string(tpm2_tpms_pcr_selection_to_mask(s));
if (!mask)
return NULL;
return strjoin(algstr, "(", mask, ")");
}
size_t tpm2_tpms_pcr_selection_weight(const TPMS_PCR_SELECTION *s) {
assert(s);
return popcount(tpm2_tpms_pcr_selection_to_mask(s));
}
/* Utility functions for TPML_PCR_SELECTION. */
/* Remove the (0-based) index entry from 'l', shift all following entries, and update the count. */
static void tpm2_tpml_pcr_selection_remove_index(TPML_PCR_SELECTION *l, uint32_t index) {
assert(l);
assert(l->count <= ELEMENTSOF(l->pcrSelections));
assert(index < l->count);
size_t s = l->count - (index + 1);
memmove(&l->pcrSelections[index], &l->pcrSelections[index + 1], s * sizeof(l->pcrSelections[0]));
l->count--;
}
/* Get a TPMS_PCR_SELECTION from a TPML_PCR_SELECTION for the given hash alg. Returns NULL if there is no
* entry for the hash alg. This guarantees the returned entry contains all the PCR selections for the given
* hash alg, which may require modifying the TPML_PCR_SELECTION by removing duplicate entries. */
static TPMS_PCR_SELECTION *tpm2_tpml_pcr_selection_get_tpms_pcr_selection(
TPML_PCR_SELECTION *l,
TPMI_ALG_HASH hash_alg) {
assert(l);
assert(l->count <= ELEMENTSOF(l->pcrSelections));
TPMS_PCR_SELECTION *selection = NULL;
FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(s, l)
if (s->hash == hash_alg) {
selection = s;
break;
}
if (!selection)
return NULL;
/* Iterate backwards through the entries, removing any other entries for the hash alg. */
for (uint32_t i = l->count - 1; i > 0; i--) {
TPMS_PCR_SELECTION *s = &l->pcrSelections[i];
if (selection == s)
break;
if (s->hash == hash_alg) {
tpm2_tpms_pcr_selection_move(selection, s);
tpm2_tpml_pcr_selection_remove_index(l, i);
}
}
return selection;
}
/* Combine all duplicate (same hash alg) TPMS_PCR_SELECTION entries in 'l'. */
static void tpm2_tpml_pcr_selection_cleanup(TPML_PCR_SELECTION *l) {
/* Can't use FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION() because we might modify l->count */
for (uint32_t i = 0; i < l->count; i++)
/* This removes all duplicate TPMS_PCR_SELECTION entries for this hash. */
(void) tpm2_tpml_pcr_selection_get_tpms_pcr_selection(l, l->pcrSelections[i].hash);
}
/* Convert a TPML_PCR_SELECTION object to a mask. Returns empty mask (i.e. 0) if 'hash_alg' is not in the object. */
uint32_t tpm2_tpml_pcr_selection_to_mask(const TPML_PCR_SELECTION *l, TPMI_ALG_HASH hash_alg) {
assert(l);
/* Make a copy, as tpm2_tpml_pcr_selection_get_tpms_pcr_selection() will modify the object if there
* are multiple entries with the requested hash alg. */
TPML_PCR_SELECTION lcopy = *l;
TPMS_PCR_SELECTION *s;
s = tpm2_tpml_pcr_selection_get_tpms_pcr_selection(&lcopy, hash_alg);
if (!s)
return 0;
return tpm2_tpms_pcr_selection_to_mask(s);
}
/* Convert a mask and hash alg to a TPML_PCR_SELECTION object. */
void tpm2_tpml_pcr_selection_from_mask(uint32_t mask, TPMI_ALG_HASH hash_alg, TPML_PCR_SELECTION *ret) {
assert(ret);
TPMS_PCR_SELECTION s;
tpm2_tpms_pcr_selection_from_mask(mask, hash_alg, &s);
*ret = (TPML_PCR_SELECTION){
.count = 1,
.pcrSelections[0] = s,
};
}
/* Add the PCR selections in 's' to the corresponding hash alg TPMS_PCR_SELECTION entry in 'l'. Adds a new
* TPMS_PCR_SELECTION entry for the hash alg if needed. This may modify the TPML_PCR_SELECTION by combining
* entries with the same hash alg. */
void tpm2_tpml_pcr_selection_add_tpms_pcr_selection(TPML_PCR_SELECTION *l, const TPMS_PCR_SELECTION *s) {
assert(l);
assert(s);
if (tpm2_tpms_pcr_selection_is_empty(s))
return;
TPMS_PCR_SELECTION *selection = tpm2_tpml_pcr_selection_get_tpms_pcr_selection(l, s->hash);
if (selection) {
tpm2_tpms_pcr_selection_add(selection, s);
return;
}
/* It's already broken if the count is higher than the array has size for. */
assert(l->count <= ELEMENTSOF(l->pcrSelections));
/* If full, the cleanup should result in at least one available entry. */
if (l->count == ELEMENTSOF(l->pcrSelections))
tpm2_tpml_pcr_selection_cleanup(l);
assert(l->count < ELEMENTSOF(l->pcrSelections));
l->pcrSelections[l->count++] = *s;
}
/* Remove the PCR selections in 's' from the corresponding hash alg TPMS_PCR_SELECTION entry in 'l'. This
* will combine all entries for 's->hash' in 'l'. */
void tpm2_tpml_pcr_selection_sub_tpms_pcr_selection(TPML_PCR_SELECTION *l, const TPMS_PCR_SELECTION *s) {
assert(l);
assert(s);
if (tpm2_tpms_pcr_selection_is_empty(s))
return;
TPMS_PCR_SELECTION *selection = tpm2_tpml_pcr_selection_get_tpms_pcr_selection(l, s->hash);
if (selection)
tpm2_tpms_pcr_selection_sub(selection, s);
}
/* Test if all bits in the mask for the hash are set in the TPML_PCR_SELECTION. */
bool tpm2_tpml_pcr_selection_has_mask(const TPML_PCR_SELECTION *l, TPMI_ALG_HASH hash, uint32_t mask) {
assert(l);
return FLAGS_SET(tpm2_tpml_pcr_selection_to_mask(l, hash), mask);
}
/* Add the PCR selections in the mask, with the provided hash. */
void tpm2_tpml_pcr_selection_add_mask(TPML_PCR_SELECTION *l, TPMI_ALG_HASH hash, uint32_t mask) {
TPMS_PCR_SELECTION tpms;
assert(l);
tpm2_tpms_pcr_selection_from_mask(mask, hash, &tpms);
tpm2_tpml_pcr_selection_add_tpms_pcr_selection(l, &tpms);
}
/* Add all PCR selections in 'b' to 'a'. */
void tpm2_tpml_pcr_selection_add(TPML_PCR_SELECTION *a, const TPML_PCR_SELECTION *b) {
assert(a);
assert(b);
FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(selection_b, b)
tpm2_tpml_pcr_selection_add_tpms_pcr_selection(a, selection_b);
}
/* Remove all PCR selections in 'b' from 'a'. */
void tpm2_tpml_pcr_selection_sub(TPML_PCR_SELECTION *a, const TPML_PCR_SELECTION *b) {
assert(a);
assert(b);
FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(selection_b, b)
tpm2_tpml_pcr_selection_sub_tpms_pcr_selection(a, selection_b);
}
char* tpm2_tpml_pcr_selection_to_string(const TPML_PCR_SELECTION *l) {
assert(l);
_cleanup_free_ char *banks = NULL;
FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(s, l) {
if (tpm2_tpms_pcr_selection_is_empty(s))
continue;
_cleanup_free_ char *str = tpm2_tpms_pcr_selection_to_string(s);
if (!str || !strextend_with_separator(&banks, ",", str))
return NULL;
}
return strjoin("[", strempty(banks), "]");
}
size_t tpm2_tpml_pcr_selection_weight(const TPML_PCR_SELECTION *l) {
assert(l);
assert(l->count <= ELEMENTSOF(l->pcrSelections));
size_t weight = 0;
FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(s, l) {
size_t w = tpm2_tpms_pcr_selection_weight(s);
assert(weight <= SIZE_MAX - w);
weight += w;
}
return weight;
}
bool tpm2_pcr_value_valid(const Tpm2PCRValue *pcr_value) {
int r;
if (!pcr_value)
return false;
if (!TPM2_PCR_INDEX_VALID(pcr_value->index)) {
log_debug("PCR index %u invalid.", pcr_value->index);
return false;
}
/* If it contains a value, the value size must match the hash size. */
if (pcr_value->value.size > 0) {
r = tpm2_hash_alg_to_size(pcr_value->hash);
if (r < 0)
return false;
if (pcr_value->value.size != (size_t) r) {
log_debug("PCR hash 0x%" PRIx16 " expected size %d does not match actual size %" PRIu16 ".",
pcr_value->hash, r, pcr_value->value.size);
return false;
}
}
return true;
}
/* Verify all entries are valid, and consistent with each other. The requirements for consistency are:
*
* 1) all entries must be sorted in ascending order (e.g. using tpm2_sort_pcr_values())
* 2) all entries must be unique, i.e. there cannot be 2 entries with the same hash and index
*
* Returns true if all entries are valid (or if no entries are provided), false otherwise.
*/
bool tpm2_pcr_values_valid(const Tpm2PCRValue *pcr_values, size_t n_pcr_values) {
if (!pcr_values && n_pcr_values > 0)
return false;
const Tpm2PCRValue *previous = NULL;
FOREACH_ARRAY(current, pcr_values, n_pcr_values) {
if (!tpm2_pcr_value_valid(current))
return false;
if (!previous) {
previous = current;
continue;
}
/* Hashes must be sorted in ascending order */
if (current->hash < previous->hash) {
log_debug("PCR values not in ascending order, hash %" PRIu16 " is after %" PRIu16 ".",
current->hash, previous->hash);
return false;
}
if (current->hash == previous->hash) {
/* Indexes (for the same hash) must be sorted in ascending order */
if (current->index < previous->index) {
log_debug("PCR values not in ascending order, hash %" PRIu16 " index %u is after %u.",
current->hash, current->index, previous->index);
return false;
}
/* Indexes (for the same hash) must not be duplicates */
if (current->index == previous->index) {
log_debug("PCR values contain duplicates for hash %" PRIu16 " index %u.",
current->hash, previous->index);
return false;
}
}
}
return true;
}
/* Returns true if any of the provided PCR values has an actual hash value included, false otherwise. */
bool tpm2_pcr_values_has_any_values(const Tpm2PCRValue *pcr_values, size_t n_pcr_values) {
assert(pcr_values || n_pcr_values == 0);
FOREACH_ARRAY(v, pcr_values, n_pcr_values)
if (v->value.size > 0)
return true;
return false;
}
/* Returns true if all of the provided PCR values has an actual hash value included, false otherwise. */
bool tpm2_pcr_values_has_all_values(const Tpm2PCRValue *pcr_values, size_t n_pcr_values) {
assert(pcr_values || n_pcr_values == 0);
FOREACH_ARRAY(v, pcr_values, n_pcr_values)
if (v->value.size == 0)
return false;
return true;
}
static int cmp_pcr_values(const Tpm2PCRValue *a, const Tpm2PCRValue *b) {
assert(a);
assert(b);
return CMP(a->hash, b->hash) ?: CMP(a->index, b->index);
}
/* Sort the array of Tpm2PCRValue entries in-place. This sorts first in ascending order of hash algorithm
* (sorting simply by the TPM2 hash algorithm number), and then sorting by pcr index. */
void tpm2_sort_pcr_values(Tpm2PCRValue *pcr_values, size_t n_pcr_values) {
typesafe_qsort(pcr_values, n_pcr_values, cmp_pcr_values);
}
int tpm2_pcr_values_to_mask(
const Tpm2PCRValue *pcr_values,
size_t n_pcr_values,
TPMI_ALG_HASH hash,
uint32_t *ret_mask) {
assert(pcr_values || n_pcr_values == 0);
assert(ret_mask);
if (!tpm2_pcr_values_valid(pcr_values, n_pcr_values))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid PCR values.");
uint32_t mask = 0;
FOREACH_ARRAY(v, pcr_values, n_pcr_values)
if (hash == 0 || v->hash == hash)
SET_BIT(mask, v->index);
*ret_mask = mask;
return 0;
}
int tpm2_tpml_pcr_selection_from_pcr_values(
const Tpm2PCRValue *pcr_values,
size_t n_pcr_values,
TPML_PCR_SELECTION *ret_selection,
TPM2B_DIGEST **ret_values,
size_t *ret_n_values) {
TPML_PCR_SELECTION selection = {};
_cleanup_free_ TPM2B_DIGEST *values = NULL;
size_t n_values = 0;
assert(pcr_values || n_pcr_values == 0);
if (!tpm2_pcr_values_valid(pcr_values, n_pcr_values))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "PCR values are not valid.");
FOREACH_ARRAY(v, pcr_values, n_pcr_values) {
tpm2_tpml_pcr_selection_add_mask(&selection, v->hash, INDEX_TO_MASK(uint32_t, v->index));
if (!GREEDY_REALLOC_APPEND(values, n_values, &v->value, 1))
return log_oom_debug();
}
if (ret_selection)
*ret_selection = selection;
if (ret_values)
*ret_values = TAKE_PTR(values);
if (ret_n_values)
*ret_n_values = n_values;
return 0;
}
/* Count the number of different hash algorithms for all the entries. */
int tpm2_pcr_values_hash_count(const Tpm2PCRValue *pcr_values, size_t n_pcr_values, size_t *ret_count) {
TPML_PCR_SELECTION selection;
int r;
assert(pcr_values);
assert(ret_count);
r = tpm2_tpml_pcr_selection_from_pcr_values(
pcr_values,
n_pcr_values,
&selection,
/* ret_values= */ NULL,
/* ret_n_values= */ NULL);
if (r < 0)
return r;
*ret_count = selection.count;
return 0;
}
/* Parse a string argument into a Tpm2PCRValue object.
*
* The format is <index>[:hash[=value]] where index is the index number (or name) of the PCR, e.g. 0 (or
* platform-code), hash is the name of the hash algorithm (e.g. sha256) and value is the hex hash digest
* value, optionally with a leading 0x. This does not check for validity of the fields. */
int tpm2_pcr_value_from_string(const char *arg, Tpm2PCRValue *ret_pcr_value) {
Tpm2PCRValue pcr_value = {};
const char *p = arg;
int r;
assert(arg);
assert(ret_pcr_value);
_cleanup_free_ char *index = NULL;
r = extract_first_word(&p, &index, ":", /* flags= */ 0);
if (r < 1)
return log_debug_errno(r, "Could not parse pcr value '%s': %m", p);
r = tpm2_pcr_index_from_string(index);
if (r < 0)
return log_debug_errno(r, "Invalid pcr index '%s': %m", index);
pcr_value.index = (unsigned) r;
if (!isempty(p)) {
_cleanup_free_ char *hash = NULL;
r = extract_first_word(&p, &hash, "=", /* flags= */ 0);
if (r < 1)
return log_debug_errno(r, "Could not parse pcr hash algorithm '%s': %m", p);
r = tpm2_hash_alg_from_string(hash);
if (r < 0)
return log_debug_errno(r, "Invalid pcr hash algorithm '%s': %m", hash);
pcr_value.hash = (TPMI_ALG_HASH) r;
if (!isempty(p)) {
/* Remove leading 0x if present */
p = startswith_no_case(p, "0x") ?: p;
_cleanup_free_ void *buf = NULL;
size_t buf_size = 0;
r = unhexmem(p, &buf, &buf_size);
if (r < 0)
return log_debug_errno(r, "Invalid pcr hash value '%s': %m", p);
r = TPM2B_DIGEST_CHECK_SIZE(buf_size);
if (r < 0)
return log_debug_errno(r, "PCR hash value size %zu too large.", buf_size);
pcr_value.value = TPM2B_DIGEST_MAKE(buf, buf_size);
}
}
*ret_pcr_value = pcr_value;
return 0;
}
/* Return a string for the PCR value. The format is described in tpm2_pcr_value_from_string(). Note that if
* the hash algorithm is not recognized, neither hash name nor hash digest value is included in the
* string. This does not check for validity. */
char* tpm2_pcr_value_to_string(const Tpm2PCRValue *pcr_value) {
_cleanup_free_ char *index = NULL, *value = NULL;
if (asprintf(&index, "%u", pcr_value->index) < 0)
return NULL;
const char *hash = pcr_value->hash > 0 ? tpm2_hash_alg_to_string(pcr_value->hash) : NULL;
if (hash && pcr_value->value.size > 0) {
value = hexmem(pcr_value->value.buffer, pcr_value->value.size);
if (!value)
return NULL;
}
return strjoin(index, hash ? ":" : "", strempty(hash), value ? "=" : "", strempty(value));
}
/* Parse a string argument into an array of Tpm2PCRValue objects.
*
* The format is zero or more entries separated by ',' or '+'. The format of each entry is described in
* tpm2_pcr_value_from_string(). This does not check for validity of the entries. */
int tpm2_pcr_values_from_string(const char *arg, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values) {
const char *p = arg;
int r;
assert(arg);
assert(ret_pcr_values);
assert(ret_n_pcr_values);
_cleanup_free_ Tpm2PCRValue *pcr_values = NULL;
size_t n_pcr_values = 0;
for (;;) {
_cleanup_free_ char *pcr_arg = NULL;
r = extract_first_word(&p, &pcr_arg, ",+", /* flags= */ 0);
if (r < 0)
return log_debug_errno(r, "Could not parse pcr values '%s': %m", p);
if (r == 0)
break;
Tpm2PCRValue pcr_value;
r = tpm2_pcr_value_from_string(pcr_arg, &pcr_value);
if (r < 0)
return r;
if (!GREEDY_REALLOC_APPEND(pcr_values, n_pcr_values, &pcr_value, 1))
return log_oom_debug();
}
*ret_pcr_values = TAKE_PTR(pcr_values);
*ret_n_pcr_values = n_pcr_values;
return 0;
}
void tpm2_log_debug_tpml_pcr_selection(const TPML_PCR_SELECTION *l, const char *msg) {
if (!DEBUG_LOGGING || !l)
return;
_cleanup_free_ char *s = tpm2_tpml_pcr_selection_to_string(l);
log_debug("%s: %s", msg ?: "PCR selection", strna(s));
}
void tpm2_log_debug_pcr_value(const Tpm2PCRValue *pcr_value, const char *msg) {
if (!DEBUG_LOGGING || !pcr_value)
return;
_cleanup_free_ char *s = tpm2_pcr_value_to_string(pcr_value);
log_debug("%s: %s", msg ?: "PCR value", strna(s));
}
void tpm2_log_debug_buffer(const void *buffer, size_t size, const char *msg) {
if (!DEBUG_LOGGING || !buffer || size == 0)
return;
_cleanup_free_ char *h = hexmem(buffer, size);
log_debug("%s: %s", msg ?: "Buffer", strna(h));
}
void tpm2_log_debug_digest(const TPM2B_DIGEST *digest, const char *msg) {
if (digest)
tpm2_log_debug_buffer(digest->buffer, digest->size, msg ?: "Digest");
}
void tpm2_log_debug_name(const TPM2B_NAME *name, const char *msg) {
if (name)
tpm2_log_debug_buffer(name->name, name->size, msg ?: "Name");
}
static int tpm2_get_policy_digest(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2B_DIGEST **ret_policy_digest) {
TSS2_RC rc;
if (!DEBUG_LOGGING && !ret_policy_digest)
return 0;
assert(c);
assert(session);
log_debug("Acquiring policy digest.");
_cleanup_(Esys_Freep) TPM2B_DIGEST *policy_digest = NULL;
rc = sym_Esys_PolicyGetDigest(
c->esys_context,
session->esys_handle,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
&policy_digest);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to get policy digest from TPM: %s", sym_Tss2_RC_Decode(rc));
tpm2_log_debug_digest(policy_digest, "Session policy digest");
if (ret_policy_digest)
*ret_policy_digest = TAKE_PTR(policy_digest);
return 0;
}
int tpm2_create_primary(
Tpm2Context *c,
const Tpm2Handle *session,
ESYS_TR hierarchy,
const TPM2B_PUBLIC *template,
const TPM2B_SENSITIVE_CREATE *sensitive,
TPM2B_PUBLIC **ret_public,
Tpm2Handle **ret_handle) {
usec_t ts;
TSS2_RC rc;
int r;
assert(c);
assert(template);
log_debug("Creating primary key on TPM.");
ts = now(CLOCK_MONOTONIC);
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
r = tpm2_handle_new(c, &handle);
if (r < 0)
return r;
_cleanup_(Esys_Freep) TPM2B_PUBLIC *public = NULL;
rc = sym_Esys_CreatePrimary(
c->esys_context,
hierarchy,
session ? session->esys_handle : ESYS_TR_PASSWORD,
ESYS_TR_NONE,
ESYS_TR_NONE,
sensitive ?: &(TPM2B_SENSITIVE_CREATE) {},
template,
/* outsideInfo= */ NULL,
&(TPML_PCR_SELECTION) {},
&handle->esys_handle,
&public,
/* creationData= */ NULL,
/* creationHash= */ NULL,
/* creationTicket= */ NULL);
if ((rc & ~TPM2_RC_N_MASK) == TPM2_RC_BAD_AUTH)
return log_debug_errno(SYNTHETIC_ERRNO(EDEADLK), "Authorization failure while attempting to create primary key.");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to generate primary key in TPM: %s",
sym_Tss2_RC_Decode(rc));
log_debug("Successfully created primary key on TPM in %s.",
FORMAT_TIMESPAN(now(CLOCK_MONOTONIC) - ts, USEC_PER_MSEC));
if (ret_public)
*ret_public = TAKE_PTR(public);
if (ret_handle)
*ret_handle = TAKE_PTR(handle);
return 0;
}
/* Create a TPM object. Do not use this to create primary keys, because some HW TPMs refuse to allow that;
* instead use tpm2_create_primary(). */
int tpm2_create(Tpm2Context *c,
const Tpm2Handle *parent,
const Tpm2Handle *session,
const TPMT_PUBLIC *template,
const TPMS_SENSITIVE_CREATE *sensitive,
TPM2B_PUBLIC **ret_public,
TPM2B_PRIVATE **ret_private) {
usec_t ts;
TSS2_RC rc;
assert(c);
assert(parent);
assert(template);
log_debug("Creating object on TPM.");
ts = now(CLOCK_MONOTONIC);
TPM2B_PUBLIC tpm2b_public = {
.size = sizeof(*template) - sizeof(template->unique),
.publicArea = *template,
};
/* Zero the unique area. */
zero(tpm2b_public.publicArea.unique);
TPM2B_SENSITIVE_CREATE tpm2b_sensitive;
if (sensitive)
tpm2b_sensitive = (TPM2B_SENSITIVE_CREATE) {
.size = sizeof(*sensitive),
.sensitive = *sensitive,
};
else
tpm2b_sensitive = (TPM2B_SENSITIVE_CREATE) {};
_cleanup_(Esys_Freep) TPM2B_PUBLIC *public = NULL;
_cleanup_(Esys_Freep) TPM2B_PRIVATE *private = NULL;
rc = sym_Esys_Create(
c->esys_context,
parent->esys_handle,
session ? session->esys_handle : ESYS_TR_PASSWORD,
ESYS_TR_NONE,
ESYS_TR_NONE,
&tpm2b_sensitive,
&tpm2b_public,
/* outsideInfo= */ NULL,
&(TPML_PCR_SELECTION) {},
&private,
&public,
/* creationData= */ NULL,
/* creationHash= */ NULL,
/* creationTicket= */ NULL);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to generate object in TPM: %s",
sym_Tss2_RC_Decode(rc));
log_debug("Successfully created object on TPM in %s.",
FORMAT_TIMESPAN(now(CLOCK_MONOTONIC) - ts, USEC_PER_MSEC));
if (ret_public)
*ret_public = TAKE_PTR(public);
if (ret_private)
*ret_private = TAKE_PTR(private);
return 0;
}
int tpm2_load(
Tpm2Context *c,
const Tpm2Handle *parent,
const Tpm2Handle *session,
const TPM2B_PUBLIC *public,
const TPM2B_PRIVATE *private,
Tpm2Handle **ret_handle) {
TSS2_RC rc;
int r;
assert(c);
assert(public);
assert(private);
assert(ret_handle);
log_debug("Loading object into TPM.");
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
r = tpm2_handle_new(c, &handle);
if (r < 0)
return r;
rc = sym_Esys_Load(
c->esys_context,
parent ? parent->esys_handle : ESYS_TR_RH_OWNER,
session ? session->esys_handle : ESYS_TR_PASSWORD,
ESYS_TR_NONE,
ESYS_TR_NONE,
private,
public,
&handle->esys_handle);
if (rc == TPM2_RC_LOCKOUT)
return log_debug_errno(SYNTHETIC_ERRNO(ENOLCK),
"TPM2 device is in dictionary attack lockout mode.");
if (TPM2_RC_IS_FOREIGN_KEY(rc))
return log_debug_errno(SYNTHETIC_ERRNO(EREMOTE),
"Key invalid or does not belong to current TPM.");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to load key into TPM: %s", sym_Tss2_RC_Decode(rc));
*ret_handle = TAKE_PTR(handle);
return 0;
}
static int tpm2_load_external(
Tpm2Context *c,
const Tpm2Handle *session,
const TPM2B_PUBLIC *public,
const TPM2B_SENSITIVE *private,
Tpm2Handle **ret_handle) {
TSS2_RC rc;
int r;
assert(c);
assert(ret_handle);
log_debug("Loading external key into TPM.");
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
r = tpm2_handle_new(c, &handle);
if (r < 0)
return r;
rc = sym_Esys_LoadExternal(
c->esys_context,
session ? session->esys_handle : ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
private,
public,
#if HAVE_TSS2_ESYS3
/* tpm2-tss >= 3.0.0 requires a ESYS_TR_RH_* constant specifying the requested
* hierarchy, older versions need TPM2_RH_* instead. */
private ? ESYS_TR_RH_NULL : ESYS_TR_RH_OWNER,
#else
private ? TPM2_RH_NULL : TPM2_RH_OWNER,
#endif
&handle->esys_handle);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to load public key into TPM: %s", sym_Tss2_RC_Decode(rc));
*ret_handle = TAKE_PTR(handle);
return 0;
}
int tpm2_marshal_private(const TPM2B_PRIVATE *private, void **ret, size_t *ret_size) {
size_t max_size = SIZEOF(*private), blob_size = 0;
_cleanup_free_ void *blob = NULL;
TSS2_RC rc;
assert(private);
assert(ret);
assert(ret_size);
blob = malloc0(max_size);
if (!blob)
return log_oom_debug();
rc = sym_Tss2_MU_TPM2B_PRIVATE_Marshal(private, blob, max_size, &blob_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal private key: %s", sym_Tss2_RC_Decode(rc));
*ret = TAKE_PTR(blob);
*ret_size = blob_size;
return 0;
}
int tpm2_unmarshal_private(const void *data, size_t size, TPM2B_PRIVATE *ret_private) {
TPM2B_PRIVATE private = {};
size_t offset = 0;
TSS2_RC rc;
assert(data || size == 0);
assert(ret_private);
rc = sym_Tss2_MU_TPM2B_PRIVATE_Unmarshal(data, size, &offset, &private);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unmarshal private key: %s", sym_Tss2_RC_Decode(rc));
if (offset != size)
return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Garbage at end of private key marshal data.");
*ret_private = private;
return 0;
}
int tpm2_marshal_public(const TPM2B_PUBLIC *public, void **ret, size_t *ret_size) {
size_t max_size = SIZEOF(*public), blob_size = 0;
_cleanup_free_ void *blob = NULL;
TSS2_RC rc;
assert(public);
assert(ret);
assert(ret_size);
blob = malloc0(max_size);
if (!blob)
return log_oom_debug();
rc = sym_Tss2_MU_TPM2B_PUBLIC_Marshal(public, blob, max_size, &blob_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal public key: %s", sym_Tss2_RC_Decode(rc));
*ret = TAKE_PTR(blob);
*ret_size = blob_size;
return 0;
}
int tpm2_unmarshal_public(const void *data, size_t size, TPM2B_PUBLIC *ret_public) {
TPM2B_PUBLIC public = {};
size_t offset = 0;
TSS2_RC rc;
assert(data || size == 0);
assert(ret_public);
rc = sym_Tss2_MU_TPM2B_PUBLIC_Unmarshal(data, size, &offset, &public);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unmarshal public key: %s", sym_Tss2_RC_Decode(rc));
if (offset != size)
return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Garbage at end of public key marshal data.");
*ret_public = public;
return 0;
}
int tpm2_marshal_nv_public(const TPM2B_NV_PUBLIC *nv_public, void **ret, size_t *ret_size) {
size_t max_size = SIZEOF(*nv_public), blob_size = 0;
_cleanup_free_ void *blob = NULL;
TSS2_RC rc;
assert(nv_public);
assert(ret);
assert(ret_size);
blob = malloc0(max_size);
if (!blob)
return log_oom_debug();
rc = sym_Tss2_MU_TPM2B_NV_PUBLIC_Marshal(nv_public, blob, max_size, &blob_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal NV public structure: %s", sym_Tss2_RC_Decode(rc));
*ret = TAKE_PTR(blob);
*ret_size = blob_size;
return 0;
}
int tpm2_unmarshal_nv_public(const void *data, size_t size, TPM2B_NV_PUBLIC *ret_nv_public) {
TPM2B_NV_PUBLIC nv_public = {};
size_t offset = 0;
TSS2_RC rc;
assert(data || size == 0);
assert(ret_nv_public);
rc = sym_Tss2_MU_TPM2B_NV_PUBLIC_Unmarshal(data, size, &offset, &nv_public);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unmarshal NV public structure: %s", sym_Tss2_RC_Decode(rc));
if (offset != size)
return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Garbage at end of NV public structure marshal data.");
*ret_nv_public = nv_public;
return 0;
}
static int tpm2_import(
Tpm2Context *c,
const Tpm2Handle *parent,
const Tpm2Handle *session,
const TPM2B_PUBLIC *public,
const TPM2B_PRIVATE *private,
const TPM2B_ENCRYPTED_SECRET *seed,
const TPM2B_DATA *encryption_key,
const TPMT_SYM_DEF_OBJECT *symmetric,
TPM2B_PRIVATE **ret_private) {
TSS2_RC rc;
assert(c);
assert(parent);
assert(!!encryption_key == !!symmetric);
assert(public);
assert(private);
assert(seed);
assert(ret_private);
log_debug("Importing key into TPM.");
rc = sym_Esys_Import(
c->esys_context,
parent->esys_handle,
session ? session->esys_handle : ESYS_TR_PASSWORD,
ESYS_TR_NONE,
ESYS_TR_NONE,
encryption_key,
public,
private,
seed,
symmetric ?: &(TPMT_SYM_DEF_OBJECT){ .algorithm = TPM2_ALG_NULL, },
ret_private);
if (TPM2_RC_IS_FOREIGN_KEY(rc))
return log_debug_errno(SYNTHETIC_ERRNO(EREMOTE),
"Key invalid or does not belong to current TPM.");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to import key into TPM: %s", sym_Tss2_RC_Decode(rc));
return 0;
}
/* Read hash values from the specified PCR selection. Provides a Tpm2PCRValue array that contains all
* requested PCR values, in the order provided by the TPM. Normally, the provided pcr values will match
* exactly what is in the provided selection, but the TPM may ignore some selected PCRs (for example, if an
* unimplemented PCR index is requested), in which case those PCRs will be absent from the provided pcr
* values. */
int tpm2_pcr_read(
Tpm2Context *c,
const TPML_PCR_SELECTION *pcr_selection,
Tpm2PCRValue **ret_pcr_values,
size_t *ret_n_pcr_values) {
_cleanup_free_ Tpm2PCRValue *pcr_values = NULL;
size_t n_pcr_values = 0;
TSS2_RC rc;
assert(c);
assert(pcr_selection);
assert(ret_pcr_values);
assert(ret_n_pcr_values);
TPML_PCR_SELECTION remaining = *pcr_selection;
while (!tpm2_tpml_pcr_selection_is_empty(&remaining)) {
_cleanup_(Esys_Freep) TPML_PCR_SELECTION *current_read = NULL;
_cleanup_(Esys_Freep) TPML_DIGEST *current_values = NULL;
tpm2_log_debug_tpml_pcr_selection(&remaining, "Reading PCR selection");
/* Unfortunately, PCR_Read will not return more than 8 values. */
rc = sym_Esys_PCR_Read(
c->esys_context,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
&remaining,
NULL,
&current_read,
&current_values);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to read TPM2 PCRs: %s", sym_Tss2_RC_Decode(rc));
tpm2_log_debug_tpml_pcr_selection(current_read, "Read PCR selection");
if (tpm2_tpml_pcr_selection_is_empty(current_read)) {
log_debug("TPM2 refused to read possibly unimplemented PCRs, ignoring.");
break;
}
unsigned i = 0;
FOREACH_PCR_IN_TPML_PCR_SELECTION(index, tpms, current_read) {
assert(i < current_values->count);
Tpm2PCRValue pcr_value = {
.index = index,
.hash = tpms->hash,
.value = current_values->digests[i++],
};
tpm2_log_debug_pcr_value(&pcr_value, /* msg= */ NULL);
if (!GREEDY_REALLOC_APPEND(pcr_values, n_pcr_values, &pcr_value, 1))
return log_oom_debug();
}
assert(i == current_values->count);
tpm2_tpml_pcr_selection_sub(&remaining, current_read);
}
tpm2_sort_pcr_values(pcr_values, n_pcr_values);
if (!tpm2_pcr_values_valid(pcr_values, n_pcr_values))
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "PCR values read from TPM are not valid.");
*ret_pcr_values = TAKE_PTR(pcr_values);
*ret_n_pcr_values = n_pcr_values;
return 0;
}
/* Read the PCR value for each TPM2PCRValue entry in the array that does not have a value set. If all entries
* have an unset hash (i.e. hash == 0), this first detects the "best" PCR bank to use; otherwise, all entries
* must have a valid hash set. All entries must have a valid index. If this cannot read a PCR value for all
* appropriate entries, this returns an error. This does not check the array for validity. */
int tpm2_pcr_read_missing_values(Tpm2Context *c, Tpm2PCRValue *pcr_values, size_t n_pcr_values) {
TPMI_ALG_HASH pcr_bank = 0;
int r;
assert(c);
assert(pcr_values || n_pcr_values == 0);
if (n_pcr_values > 0) {
size_t hash_count;
r = tpm2_pcr_values_hash_count(pcr_values, n_pcr_values, &hash_count);
if (r < 0)
return log_debug_errno(r, "Could not get hash count from pcr values: %m");
if (hash_count == 1 && pcr_values[0].hash == 0) {
uint32_t mask;
r = tpm2_pcr_values_to_mask(pcr_values, n_pcr_values, 0, &mask);
if (r < 0)
return r;
r = tpm2_get_best_pcr_bank(c, mask, &pcr_bank);
if (r < 0)
return r;
}
}
FOREACH_ARRAY(v, pcr_values, n_pcr_values) {
if (v->hash == 0)
v->hash = pcr_bank;
if (v->value.size > 0)
continue;
TPML_PCR_SELECTION selection;
r = tpm2_tpml_pcr_selection_from_pcr_values(v, 1, &selection, NULL, NULL);
if (r < 0)
return r;
_cleanup_free_ Tpm2PCRValue *read_values = NULL;
size_t n_read_values;
r = tpm2_pcr_read(c, &selection, &read_values, &n_read_values);
if (r < 0)
return r;
if (n_read_values == 0)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Could not read PCR hash 0x%" PRIu16 " index %u",
v->hash, v->index);
assert(n_read_values == 1);
assert(read_values[0].hash == v->hash);
assert(read_values[0].index == v->index);
v->value = read_values[0].value;
}
return 0;
}
static int tpm2_pcr_mask_good(
Tpm2Context *c,
TPMI_ALG_HASH bank,
uint32_t mask) {
TPML_PCR_SELECTION selection;
int r;
assert(c);
/* So we have the problem that some systems might have working TPM2 chips, but the firmware doesn't
* actually measure into them, or only into a suboptimal bank. If so, the PCRs should be all zero or
* all 0xFF. Detect that, so that we can warn and maybe pick a better bank. */
tpm2_tpml_pcr_selection_from_mask(mask, bank, &selection);
_cleanup_free_ Tpm2PCRValue *pcr_values = NULL;
size_t n_pcr_values;
r = tpm2_pcr_read(c, &selection, &pcr_values, &n_pcr_values);
if (r < 0)
return r;
/* If at least one of the selected PCR values is something other than all 0x00 or all 0xFF we are happy. */
FOREACH_ARRAY(v, pcr_values, n_pcr_values)
if (!memeqbyte(0x00, v->value.buffer, v->value.size) &&
!memeqbyte(0xFF, v->value.buffer, v->value.size))
return true;
return false;
}
static int tpm2_bank_has24(const TPMS_PCR_SELECTION *selection) {
assert(selection);
/* As per https://trustedcomputinggroup.org/wp-content/uploads/TCG_PCClient_PFP_r1p05_v23_pub.pdf a
* TPM2 on a Client PC must have at least 24 PCRs. If this TPM has less, just skip over it. */
if (selection->sizeofSelect < TPM2_PCRS_MAX/8) {
log_debug("Skipping TPM2 PCR bank %s with fewer than 24 PCRs.",
strna(tpm2_hash_alg_to_string(selection->hash)));
return false;
}
assert_cc(TPM2_PCRS_MAX % 8 == 0);
/* It's not enough to check how many PCRs there are, we also need to check that the 24 are
* enabled for this bank. Otherwise this TPM doesn't qualify. */
bool valid = true;
for (size_t j = 0; j < TPM2_PCRS_MAX/8; j++)
if (selection->pcrSelect[j] != 0xFF) {
valid = false;
break;
}
if (!valid)
log_debug("TPM2 PCR bank %s has fewer than 24 PCR bits enabled, ignoring.",
strna(tpm2_hash_alg_to_string(selection->hash)));
return valid;
}
static char* pcr_bank_preference_to_string(const uint16_t *banks, size_t n_banks) {
_cleanup_free_ char *s = NULL;
assert(banks);
FOREACH_ARRAY(bank, banks, n_banks)
if (!strextend_with_separator(&s, ", ", tpm2_hash_alg_to_string(*bank)))
return NULL;
return TAKE_PTR(s);
}
static int get_best_pcr_bank(
Tpm2Context *c,
uint32_t pcr_mask,
const uint16_t *banks,
size_t n_banks,
TPMI_ALG_HASH *ret) {
TPMI_ALG_HASH supported_hash = 0, hash_with_valid_pcr = 0;
int r;
assert(c);
assert(ret);
assert(banks);
assert(n_banks > 0);
uint32_t efi_banks;
r = efi_get_active_pcr_banks(&efi_banks);
if (r < 0) {
if (!IN_SET(r, -ENOENT, -EOPNOTSUPP))
return r;
/* If variable is not set use guesswork below */
log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable or EFI support is unavailable, we have to guess the used PCR banks.");
} else if (efi_banks == UINT32_MAX)
log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to indicate that the GetActivePcrBanks() API is not available in the firmware. We have to guess the used PCR banks.");
else if (efi_banks == 0)
log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to zero to indicate that TPM support is not available in the firmware. We'll have to guess the used PCR banks.");
else {
r = pcr_bank_from_efi_active(banks, n_banks, efi_banks, ret);
if (r == -EOPNOTSUPP) {
_cleanup_free_ char *bank_list = pcr_bank_preference_to_string(banks, n_banks);
return log_debug_errno(r, "Firmware reports none of the PCR banks we can use (%s), cannot operate.", strna(bank_list));
}
if (r < 0)
return r;
if (*ret == TPM2_ALG_SHA1)
log_notice("Firmware reports SHA1 as the best active PCR bank, binding policy to it. This reduces the security level substantially.");
else
log_debug("Picked best PCR bank %s based on firmware reported banks.", tpm2_hash_alg_to_string(*ret));
return 0;
}
if (pcr_mask == 0) {
log_debug("Asked to pick best PCR bank but no PCRs selected we could derive this from. Defaulting to SHA256.");
*ret = TPM2_ALG_SHA256; /* if no PCRs are selected this doesn't matter anyway... */
return 0;
}
/* Walk our banks in order of preference. Because the list is already sorted best-first, the first
* bank that qualifies is the most preferred one — no ranking needed. */
FOREACH_ARRAY(bank, banks, n_banks) {
int good;
/* Skip banks the TPM doesn't expose with a full set of 24 PCRs. */
if (!tpm2_tpml_pcr_selection_has_mask(&c->capability_pcrs, *bank, TPM2_PCRS_MASK))
continue;
/* First supported bank we reach is the most preferred supported one. */
if (supported_hash == 0)
supported_hash = *bank;
good = tpm2_pcr_mask_good(c, *bank, pcr_mask);
if (good < 0)
return good;
if (good) {
/* First supported bank with initialized PCRs is the most preferred such bank; we
* cannot do any better, so we are done. */
hash_with_valid_pcr = *bank;
break;
}
}
/* Prefer a bank whose selected PCRs are actually initialized. If none of the supported banks has
* initialized PCRs we still proceed with the most preferred supported bank, but the resulting PCR
* policy is then effectively unenforced. */
if (hash_with_valid_pcr != 0) {
if (hash_with_valid_pcr == TPM2_ALG_SHA1)
log_notice("Only the weak SHA1 PCR bank has initialized PCRs, binding policy to it. This reduces the security level substantially.");
else if (hash_with_valid_pcr != supported_hash)
log_notice("Preferred %s PCR bank has uninitialized PCRs, binding policy to the %s bank instead.",
tpm2_hash_alg_to_string(supported_hash), tpm2_hash_alg_to_string(hash_with_valid_pcr));
else
log_debug("Binding policy to %s PCR bank with initialized PCRs.", tpm2_hash_alg_to_string(hash_with_valid_pcr));
*ret = hash_with_valid_pcr;
} else if (supported_hash != 0) {
log_notice("TPM2 device supports the %s PCR bank but none of the selected PCRs are initialized! Firmware apparently did not measure into any of them. Proceeding anyway, but the PCR policy is effectively unenforced!",
tpm2_hash_alg_to_string(supported_hash));
*ret = supported_hash;
} else {
_cleanup_free_ char *bank_list = pcr_bank_preference_to_string(banks, n_banks);
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"TPM2 module supports none of the PCR banks we can use (%s), cannot operate.", strna(bank_list));
}
return 0;
}
int tpm2_get_best_pcr_bank(Tpm2Context *c, uint32_t pcr_mask, TPMI_ALG_HASH *ret) {
return get_best_pcr_bank(c, pcr_mask, tpm2_pcr_bank_preference, ELEMENTSOF(tpm2_pcr_bank_preference), ret);
}
int tpm2_get_best_pcr_bank_legacy(Tpm2Context *c, uint32_t pcr_mask, TPMI_ALG_HASH *ret) {
return get_best_pcr_bank(c, pcr_mask, tpm2_pcr_bank_preference_legacy, ELEMENTSOF(tpm2_pcr_bank_preference_legacy), ret);
}
int tpm2_get_good_pcr_banks(
Tpm2Context *c,
uint32_t pcr_mask,
TPMI_ALG_HASH **ret) {
_cleanup_free_ TPMI_ALG_HASH *good_banks = NULL, *fallback_banks = NULL;
size_t n_good_banks = 0, n_fallback_banks = 0;
int r;
assert(c);
assert(ret);
uint32_t efi_banks;
r = efi_get_active_pcr_banks(&efi_banks);
if (r < 0) {
if (!IN_SET(r, -ENOENT, -EOPNOTSUPP))
return r;
/* If the variable is not set we have to guess via the code below */
log_debug("Boot loader didn't set the LoaderTpm2ActivePcrBanks EFI variable or EFI support is unavailable, we have to guess the used PCR banks.");
} else if (efi_banks == UINT32_MAX)
log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to indicate that the GetActivePcrBanks() API is not available in the firmware. We have to guess the used PCR banks.");
else if (efi_banks == 0)
log_debug("Boot loader set the LoaderTpm2ActivePcrBanks EFI variable to zero to indicate that TPM support is not available in the firmware. We'll have to guess the used PCR banks.");
else {
FOREACH_ARRAY(hash, tpm2_hash_algorithms, TPM2_N_HASH_ALGORITHMS) {
if (!BIT_SET(efi_banks, *hash))
continue;
if (!GREEDY_REALLOC(good_banks, n_good_banks+1))
return log_oom_debug();
good_banks[n_good_banks++] = *hash;
}
log_debug("Found %zu initialized TPM2 banks reported by firmware.", n_good_banks);
*ret = TAKE_PTR(good_banks);
return (int) n_good_banks;
}
FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(selection, &c->capability_pcrs) {
TPMI_ALG_HASH hash = selection->hash;
/* Let's see if this bank is superficially OK, i.e. has at least 24 enabled registers */
r = tpm2_bank_has24(selection);
if (r < 0)
return r;
if (!r)
continue;
/* Let's now see if this bank has any of the selected PCRs actually initialized */
r = tpm2_pcr_mask_good(c, hash, pcr_mask);
if (r < 0)
return r;
if (n_good_banks + n_fallback_banks >= INT_MAX)
return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), "Too many good TPM2 banks?");
if (r) {
if (!GREEDY_REALLOC(good_banks, n_good_banks+1))
return log_oom_debug();
good_banks[n_good_banks++] = hash;
} else {
if (!GREEDY_REALLOC(fallback_banks, n_fallback_banks+1))
return log_oom_debug();
fallback_banks[n_fallback_banks++] = hash;
}
}
/* Preferably, use the good banks (i.e. the ones the PCR values are actually initialized so
* far). Otherwise use the fallback banks (i.e. which exist and are enabled, but so far not used. */
if (n_good_banks > 0) {
log_debug("Found %zu fully initialized TPM2 banks.", n_good_banks);
*ret = TAKE_PTR(good_banks);
return (int) n_good_banks;
}
if (n_fallback_banks > 0) {
log_debug("Found %zu enabled but un-initialized TPM2 banks.", n_fallback_banks);
*ret = TAKE_PTR(fallback_banks);
return (int) n_fallback_banks;
}
/* No suitable banks found. */
*ret = NULL;
return 0;
}
int tpm2_get_good_pcr_banks_strv(
Tpm2Context *c,
uint32_t pcr_mask,
char ***ret) {
#if HAVE_OPENSSL
_cleanup_free_ TPMI_ALG_HASH *algs = NULL;
_cleanup_strv_free_ char **l = NULL;
int n_algs, r;
assert(c);
assert(ret);
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
n_algs = tpm2_get_good_pcr_banks(c, pcr_mask, &algs);
if (n_algs < 0)
return n_algs;
FOREACH_ARRAY(a, algs, n_algs) {
_cleanup_free_ char *n = NULL;
const EVP_MD *implementation;
const char *salg;
salg = tpm2_hash_alg_to_string(*a);
if (!salg)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "TPM2 operates with unknown PCR algorithm, can't measure.");
implementation = sym_EVP_get_digestbyname(salg);
if (!implementation)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "TPM2 operates with unsupported PCR algorithm, can't measure.");
n = strdup(ASSERT_PTR(sym_EVP_MD_get0_name(implementation)));
if (!n)
return log_oom_debug();
ascii_strlower(n); /* OpenSSL uses uppercase digest names, we prefer them lower case. */
if (strv_consume(&l, TAKE_PTR(n)) < 0)
return log_oom_debug();
}
*ret = TAKE_PTR(l);
return 0;
#else /* HAVE_OPENSSL */
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
static int tpm2_tpmt_ha_to_data(TPMT_HA *ha, TPM2B_DATA *ret) {
TSS2_RC rc;
int r;
assert(ha);
assert(ret);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
TPM2B_DATA data = {};
size_t written = 0;
rc = sym_Tss2_MU_TPMT_HA_Marshal(ha, data.buffer, sizeof(data.buffer), &written);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to marshal digest.");
data.size = written;
*ret = data;
return 0;
}
int tpm2_digest_buf_to_data(TPMI_ALG_HASH alg, void *digest, size_t digest_sz, TPM2B_DATA *ret) {
assert(digest);
assert(ret);
if (digest_sz != (size_t) tpm2_hash_alg_to_size(alg))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid digest size");
TPMT_HA ha = {
.hashAlg = alg,
};
assert(digest_sz <= sizeof_field(TPMT_HA, digest));
memcpy_safe(&ha.digest, digest, digest_sz);
return tpm2_tpmt_ha_to_data(&ha, ret);
}
int tpm2_digest_iovec_to_data(TPMI_ALG_HASH alg, const struct iovec *digest, TPM2B_DATA *ret) {
assert(iovec_is_valid(digest));
assert(ret);
return tpm2_digest_buf_to_data(alg, digest->iov_base, digest->iov_len, ret);
}
/* Hash data into the digest.
*
* If 'extend' is true, the hashing operation starts with the existing digest hash (and the digest is
* required to have a hash and its size must be correct). If 'extend' is false, the digest size is
* initialized to the correct size for 'alg' and the hashing operation does not include any existing digest
* hash. If 'extend' is false and no data is provided, the digest is initialized to a zero digest.
*
* On success, the digest hash will be updated with the hashing operation result and the digest size will be
* correct for 'alg'.
*
* This currently only provides SHA256, so 'alg' must be TPM2_ALG_SHA256. */
int tpm2_digest_many(
TPMI_ALG_HASH alg,
TPM2B_DIGEST *digest,
const struct iovec data[],
size_t n_data,
bool extend) {
struct sha256_ctx ctx;
assert(digest);
assert(data || n_data == 0);
if (alg != TPM2_ALG_SHA256)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"Hash algorithm not supported: 0x%x", alg);
if (extend && digest->size != SHA256_DIGEST_SIZE)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"Digest size 0x%x, require 0x%x",
digest->size, (unsigned)SHA256_DIGEST_SIZE);
/* Since we're hardcoding SHA256 (for now), we can check this at compile time. */
assert_cc(sizeof(digest->buffer) >= SHA256_DIGEST_SIZE);
CLEANUP_ERASE(ctx);
sha256_init_ctx(&ctx);
if (extend)
sha256_process_bytes(digest->buffer, digest->size, &ctx);
else {
*digest = (TPM2B_DIGEST) {
.size = SHA256_DIGEST_SIZE,
};
if (n_data == 0) /* If not extending and no data, return zero hash */
return 0;
}
FOREACH_ARRAY(d, data, n_data)
sha256_process_bytes(d->iov_base, d->iov_len, &ctx);
sha256_finish_ctx(&ctx, digest->buffer);
return 0;
}
/* Same as tpm2_digest_many() but data is contained in TPM2B_DIGEST[]. The digests may be any size digests. */
int tpm2_digest_many_digests(
TPMI_ALG_HASH alg,
TPM2B_DIGEST *digest,
const TPM2B_DIGEST data[],
size_t n_data,
bool extend) {
_cleanup_free_ struct iovec *iovecs = NULL;
assert(data || n_data == 0);
iovecs = new(struct iovec, n_data);
if (!iovecs)
return log_oom_debug();
for (size_t i = 0; i < n_data; i++)
iovecs[i] = IOVEC_MAKE((void*) data[i].buffer, data[i].size);
return tpm2_digest_many(alg, digest, iovecs, n_data, extend);
}
/* This hashes the provided pin into a digest value, but also verifies that the final byte is not 0, because
* the TPM specification Part 1 ("Architecture") section Authorization Values (subsection "Authorization Size
* Convention") states "Trailing octets of zero are to be removed from any string before it is used as an
* authValue". Since the TPM doesn't know if the auth value is a "string" or just a hash digest, any hash
* digest that randomly happens to end in 0 must have the final 0(s) trimmed.
*
* This is required at 2 points. First, when setting the authValue during creation of new sealed objects, in
* tpm2_seal(). This only applies to newly created objects, of course. Second, when using a previously
* created sealed object that has an authValue set, we use the sealed objects as the session bind key. This
* requires calling SetAuth so tpm2-tss can correctly calculate the HMAC to use for the encryption session.
*
* TPM implementations will perform the trimming for any authValue for existing sealed objects, so the
* tpm2-tss library must also perform the trimming before HMAC calculation, but it does not yet; this bug is
* open to add the trimming: https://github.com/tpm2-software/tpm2-tss/issues/2664
*
* Until our minimum tpm2-tss version contains a fix for that bug, we must perform the trimming
* ourselves. Note that since we are trimming, which is exactly what a TPM implementation would do, this will
* work for both existing objects with a authValue ending in 0(s) as well as new sealed objects we create,
* which we will trim the 0(s) from before sending to the TPM.
*/
static void tpm2_trim_auth_value(TPM2B_AUTH *auth) {
bool trimmed = false;
assert(auth);
while (auth->size > 0 && auth->buffer[auth->size - 1] == 0) {
trimmed = true;
auth->size--;
}
if (trimmed)
log_debug("authValue ends in 0, trimming as required by the TPM2 specification Part 1 section 'HMAC Computation' authValue Note 2.");
}
int tpm2_auth_value_from_pin(TPMI_ALG_HASH hash, const char *pin, TPM2B_AUTH *ret_auth) {
TPM2B_AUTH auth = {};
int r;
assert(pin);
assert(ret_auth);
r = tpm2_digest_buffer(hash, &auth, pin, strlen(pin), /* extend= */ false);
if (r < 0)
return r;
tpm2_trim_auth_value(&auth);
*ret_auth = TAKE_STRUCT(auth);
return 0;
}
int tpm2_set_auth_binary(Tpm2Context *c, const Tpm2Handle *handle, const TPM2B_AUTH *auth) {
TSS2_RC rc;
assert(c);
assert(handle);
if (!auth)
return 0;
rc = sym_Esys_TR_SetAuth(c->esys_context, handle->esys_handle, auth);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to load PIN in TPM: %s", sym_Tss2_RC_Decode(rc));
return 0;
}
int tpm2_set_auth(Tpm2Context *c, const Tpm2Handle *handle, const char *pin) {
TPM2B_AUTH auth = {};
int r;
assert(c);
assert(handle);
if (!pin)
return 0;
CLEANUP_ERASE(auth);
r = tpm2_auth_value_from_pin(TPM2_ALG_SHA256, pin, &auth);
if (r < 0)
return r;
return tpm2_set_auth_binary(c, handle, &auth);
}
static bool tpm2_is_encryption_session(Tpm2Context *c, const Tpm2Handle *session) {
TPMA_SESSION flags = 0;
TSS2_RC rc;
assert(c);
assert(session);
rc = sym_Esys_TRSess_GetAttributes(c->esys_context, session->esys_handle, &flags);
if (rc != TSS2_RC_SUCCESS)
return false;
return (flags & TPMA_SESSION_DECRYPT) && (flags & TPMA_SESSION_ENCRYPT);
}
int tpm2_make_encryption_session(
Tpm2Context *c,
const Tpm2Handle *primary,
const Tpm2Handle *bind_key,
Tpm2Handle **ret_session) {
const TPMA_SESSION sessionAttributes = TPMA_SESSION_DECRYPT | TPMA_SESSION_ENCRYPT |
TPMA_SESSION_CONTINUESESSION;
TSS2_RC rc;
int r;
assert(c);
assert(primary);
assert(ret_session);
log_debug("Starting HMAC encryption session.");
/* Start a salted, unbound HMAC session with a well-known key (e.g. primary key) as tpmKey, which
* means that the random salt will be encrypted with the well-known key. That way, only the TPM can
* recover the salt, which is then used for key derivation. */
_cleanup_(tpm2_handle_freep) Tpm2Handle *session = NULL;
r = tpm2_handle_new(c, &session);
if (r < 0)
return r;
rc = sym_Esys_StartAuthSession(
c->esys_context,
primary->esys_handle,
bind_key ? bind_key->esys_handle : ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
NULL,
TPM2_SE_HMAC,
&SESSION_TEMPLATE_SYM_AES_128_CFB,
TPM2_ALG_SHA256,
&session->esys_handle);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to open session in TPM: %s", sym_Tss2_RC_Decode(rc));
/* Enable parameter encryption/decryption with AES in CFB mode. Together with HMAC digests (which are
* always used for sessions), this provides confidentiality, integrity and replay protection for
* operations that use this session. */
rc = sym_Esys_TRSess_SetAttributes(c->esys_context, session->esys_handle, sessionAttributes, 0xff);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to configure TPM session: %s", sym_Tss2_RC_Decode(rc));
*ret_session = TAKE_PTR(session);
return 0;
}
static bool tpm2_is_audit_session(Tpm2Context *c, const Tpm2Handle *session) {
TPMA_SESSION flags = 0;
TSS2_RC rc;
assert(c);
assert(session);
rc = sym_Esys_TRSess_GetAttributes(c->esys_context, session->esys_handle, &flags);
if (rc != TSS2_RC_SUCCESS)
return false;
return flags & TPMA_SESSION_AUDIT;
}
int tpm2_make_exclusive_audit_session(Tpm2Context *c, Tpm2Handle **ret_session) {
TSS2_RC rc;
int r;
assert(c);
assert(ret_session);
log_debug("Starting HMAC exclusive audit session.");
_cleanup_(tpm2_handle_freep) Tpm2Handle *session = NULL;
r = tpm2_handle_new(c, &session);
if (r < 0)
return r;
rc = sym_Esys_StartAuthSession(
c->esys_context,
/* tpmKey= */ ESYS_TR_NONE,
/* bind= */ ESYS_TR_NONE,
/* shandle1= */ ESYS_TR_NONE,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
/* nonceCaller= */ NULL,
TPM2_SE_HMAC,
&SESSION_TEMPLATE_SYM_NULL,
TPM2_ALG_SHA256,
&session->esys_handle);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to open session in TPM: %s", sym_Tss2_RC_Decode(rc));
const TPMA_SESSION sessionAttributes = TPMA_SESSION_AUDIT | TPMA_SESSION_AUDITEXCLUSIVE | TPMA_SESSION_CONTINUESESSION;
rc = sym_Esys_TRSess_SetAttributes(c->esys_context, session->esys_handle, sessionAttributes, 0xff);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to configure TPM session: %s", sym_Tss2_RC_Decode(rc));
*ret_session = TAKE_PTR(session);
return 0;
}
int tpm2_make_policy_session(
Tpm2Context *c,
const Tpm2Handle *primary,
const Tpm2Handle *encryption_session,
Tpm2Handle **ret_session) {
TSS2_RC rc;
int r;
assert(c);
assert(ret_session);
if (encryption_session && !tpm2_is_encryption_session(c, encryption_session))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Invalid encryption session");
log_debug("Starting policy session.");
_cleanup_(tpm2_handle_freep) Tpm2Handle *session = NULL;
r = tpm2_handle_new(c, &session);
if (r < 0)
return r;
rc = sym_Esys_StartAuthSession(
c->esys_context,
primary ? primary->esys_handle : ESYS_TR_NONE,
ESYS_TR_NONE,
encryption_session ? encryption_session->esys_handle : ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
NULL,
TPM2_SE_POLICY,
&SESSION_TEMPLATE_SYM_AES_128_CFB,
TPM2_ALG_SHA256,
&session->esys_handle);
if ((rc & ~TPM2_RC_N_MASK) == TPM2_RC_AUTH_FAIL)
return log_debug_errno(SYNTHETIC_ERRNO(EILSEQ),
"Authorization failure from TPM: %s", sym_Tss2_RC_Decode(rc));
if (rc == TPM2_RC_LOCKOUT)
return log_debug_errno(SYNTHETIC_ERRNO(ENOLCK),
"TPM2 device is in dictionary attack lockout mode.");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to open session in TPM: %s", sym_Tss2_RC_Decode(rc));
*ret_session = TAKE_PTR(session);
return 0;
}
static int find_signature(
sd_json_variant *v,
const TPML_PCR_SELECTION *pcr_selection,
const void *fp,
size_t fp_size,
const char *policy_ref,
const void *policy,
size_t policy_size,
void *ret_signature,
size_t *ret_signature_size) {
#if HAVE_OPENSSL
sd_json_variant *b, *i;
const char *k;
int r;
/* Searches for a signature blob in the specified JSON object. Search keys are PCR bank, PCR mask,
* public key, and policy digest. */
if (!sd_json_variant_is_object(v))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Signature is not a JSON object.");
uint16_t pcr_bank = pcr_selection->pcrSelections[0].hash;
uint32_t pcr_mask = tpm2_tpml_pcr_selection_to_mask(pcr_selection, pcr_bank);
k = tpm2_hash_alg_to_string(pcr_bank);
if (!k)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Don't know PCR bank %" PRIu16, pcr_bank);
/* First, find field by bank */
b = sd_json_variant_by_key(v, k);
if (!b)
return log_debug_errno(SYNTHETIC_ERRNO(ENOSTR), "Signature lacks data for PCR bank '%s'.", k);
if (!sd_json_variant_is_array(b))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Bank data is not a JSON array.");
/* Now iterate through all signatures known for this bank */
JSON_VARIANT_ARRAY_FOREACH(i, b) {
_cleanup_free_ void *fpj_data = NULL, *polj_data = NULL;
const char *refj_data = NULL;
sd_json_variant *maskj, *fpj, *sigj, *polj, *refj;
size_t fpj_size, polj_size;
uint32_t parsed_mask;
if (!sd_json_variant_is_object(i))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Bank data element is not a JSON object");
/* Check if the PCR mask matches our expectations */
maskj = sd_json_variant_by_key(i, "pcrs");
if (!maskj)
continue;
r = tpm2_parse_pcr_json_array(maskj, &parsed_mask);
if (r < 0)
return log_debug_errno(r, "Failed to parse JSON PCR mask");
if (parsed_mask != pcr_mask)
continue; /* Not for this PCR mask */
/* Then check if this is for the public key we operate with */
fpj = sd_json_variant_by_key(i, "pkfp");
if (!fpj)
continue;
r = sd_json_variant_unhex(fpj, &fpj_data, &fpj_size);
if (r < 0)
return log_debug_errno(r, "Failed to decode fingerprint in JSON data: %m");
if (memcmp_nn(fp, fp_size, fpj_data, fpj_size) != 0)
continue; /* Not for this public key */
refj = sd_json_variant_by_key(i, "ref");
if (refj) {
refj_data = sd_json_variant_string(refj);
if (!refj_data)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Policy reference is not a string.");
}
if (!streq_ptr(policy_ref, refj_data))
continue;
/* Finally, check if this is for the PCR policy we expect this to be */
polj = sd_json_variant_by_key(i, "pol");
if (!polj)
continue;
r = sd_json_variant_unhex(polj, &polj_data, &polj_size);
if (r < 0)
return log_debug_errno(r, "Failed to decode policy hash JSON data: %m");
if (memcmp_nn(policy, policy_size, polj_data, polj_size) != 0)
continue;
/* This entry matches all our expectations, now return the signature included in it */
sigj = sd_json_variant_by_key(i, "sig");
if (!sigj)
continue;
return sd_json_variant_unbase64(sigj, ret_signature, ret_signature_size);
}
return log_debug_errno(SYNTHETIC_ERRNO(ENOSTR), "Couldn't find signature for this PCR bank, PCR index and public key.");
#else /* HAVE_OPENSSL */
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
/* Calculates the "name" of a public key.
*
* As specified in TPM2 spec "Part 1: Architecture", a key's "name" is its nameAlg value followed by a hash
* of its TPM2 public area, all properly marshalled. This allows a key's "name" to be dependent not only on
* the key fingerprint, but also on the TPM2-specific fields that associated with the key (i.e. all fields in
* TPMT_PUBLIC). Note that this means an existing key may not change any of its TPMT_PUBLIC fields, since
* that would also change the key name.
*
* Since we (currently) hardcode to always using SHA256 for hashing, this returns an error if the public key
* nameAlg is not TPM2_ALG_SHA256. */
int tpm2_calculate_pubkey_name(const TPMT_PUBLIC *public, TPM2B_NAME *ret_name) {
TSS2_RC rc;
int r;
assert(public);
assert(ret_name);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
if (public->nameAlg != TPM2_ALG_SHA256)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"Unsupported nameAlg: 0x%x",
public->nameAlg);
_cleanup_free_ uint8_t *buf = NULL;
size_t size = 0;
buf = (uint8_t*) new(TPMT_PUBLIC, 1);
if (!buf)
return log_oom_debug();
rc = sym_Tss2_MU_TPMT_PUBLIC_Marshal(public, buf, sizeof(TPMT_PUBLIC), &size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal public key: %s", sym_Tss2_RC_Decode(rc));
TPM2B_DIGEST digest = {};
r = tpm2_digest_buffer(TPM2_ALG_SHA256, &digest, buf, size, /* extend= */ false);
if (r < 0)
return r;
TPMT_HA ha = {
.hashAlg = TPM2_ALG_SHA256,
};
assert(digest.size <= sizeof(ha.digest.sha256));
memcpy_safe(ha.digest.sha256, digest.buffer, digest.size);
TPM2B_NAME name;
size = 0;
rc = sym_Tss2_MU_TPMT_HA_Marshal(&ha, name.name, sizeof(name.name), &size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal key name: %s", sym_Tss2_RC_Decode(rc));
name.size = size;
tpm2_log_debug_name(&name, "Calculated public key name");
*ret_name = name;
return 0;
}
/* Get the "name" of a key from the TPM.
*
* The "name" of a key is explained above in tpm2_calculate_pubkey_name().
*
* The handle must reference a key already present in the TPM. It may be either a public key only, or a
* public/private keypair. */
int tpm2_get_name(
Tpm2Context *c,
const Tpm2Handle *handle,
TPM2B_NAME **ret_name) {
_cleanup_(Esys_Freep) TPM2B_NAME *name = NULL;
TSS2_RC rc;
assert(c);
assert(handle);
assert(ret_name);
rc = sym_Esys_TR_GetName(c->esys_context, handle->esys_handle, &name);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to get name of public key from TPM: %s", sym_Tss2_RC_Decode(rc));
tpm2_log_debug_name(name, "Object name");
*ret_name = TAKE_PTR(name);
return 0;
}
int tpm2_calculate_nv_index_name(const TPMS_NV_PUBLIC *nvpublic, TPM2B_NAME *ret_name) {
TSS2_RC rc;
int r;
assert(nvpublic);
assert(ret_name);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
if (nvpublic->nameAlg != TPM2_ALG_SHA256)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"Unsupported nameAlg: 0x%x",
nvpublic->nameAlg);
_cleanup_free_ uint8_t *buf = NULL;
size_t size = 0;
buf = (uint8_t*) new(TPMS_NV_PUBLIC, 1);
if (!buf)
return log_oom_debug();
rc = sym_Tss2_MU_TPMS_NV_PUBLIC_Marshal(nvpublic, buf, sizeof(TPMS_NV_PUBLIC), &size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal NV index: %s", sym_Tss2_RC_Decode(rc));
TPM2B_DIGEST digest = {};
r = tpm2_digest_buffer(TPM2_ALG_SHA256, &digest, buf, size, /* extend= */ false);
if (r < 0)
return r;
TPMT_HA ha = {
.hashAlg = TPM2_ALG_SHA256,
};
assert(digest.size <= sizeof(ha.digest.sha256));
memcpy_safe(ha.digest.sha256, digest.buffer, digest.size);
TPM2B_NAME name;
size = 0;
rc = sym_Tss2_MU_TPMT_HA_Marshal(&ha, name.name, sizeof(name.name), &size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal NV index name: %s", sym_Tss2_RC_Decode(rc));
name.size = size;
tpm2_log_debug_name(&name, "Calculated NV index name");
*ret_name = name;
return 0;
}
/* Extend 'digest' with the PolicyAuthValue calculated hash. */
int tpm2_calculate_policy_auth_value(TPM2B_DIGEST *digest) {
TPM2_CC command = TPM2_CC_PolicyAuthValue;
TSS2_RC rc;
int r;
assert(digest);
assert(digest->size == SHA256_DIGEST_SIZE);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
uint8_t buf[sizeof(command)];
size_t offset = 0;
rc = sym_Tss2_MU_TPM2_CC_Marshal(command, buf, sizeof(buf), &offset);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal PolicyAuthValue command: %s", sym_Tss2_RC_Decode(rc));
if (offset != sizeof(command))
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Offset 0x%zx wrong after marshalling PolicyAuthValue command", offset);
r = tpm2_digest_buffer(TPM2_ALG_SHA256, digest, buf, offset, /* extend= */ true);
if (r < 0)
return r;
tpm2_log_debug_digest(digest, "PolicyAuthValue calculated digest");
return 0;
}
int tpm2_policy_auth_value(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2B_DIGEST **ret_policy_digest) {
TSS2_RC rc;
assert(c);
assert(session);
log_debug("Submitting AuthValue policy.");
rc = sym_Esys_PolicyAuthValue(
c->esys_context,
session->esys_handle,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to add authValue policy to TPM: %s",
sym_Tss2_RC_Decode(rc));
return tpm2_get_policy_digest(c, session, ret_policy_digest);
}
/* Extend 'digest' with the PolicyNvWritten calculated hash. */
int tpm2_calculate_policy_nv_written(bool written_set, TPM2B_DIGEST *digest) {
TPM2_CC command = TPM2_CC_PolicyNvWritten;
TSS2_RC rc;
int r;
assert(digest);
assert(digest->size == SHA256_DIGEST_SIZE);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
uint8_t buf[sizeof(command)];
size_t offset = 0;
rc = sym_Tss2_MU_TPM2_CC_Marshal(command, buf, sizeof(buf), &offset);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal PolicyNvWritten command: %s", sym_Tss2_RC_Decode(rc));
if (offset != sizeof(command))
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Offset 0x%zx wrong after marshalling PolicyNvWritten command", offset);
uint8_t written_byte = written_set ? TPM2_YES : TPM2_NO;
struct iovec data[] = {
IOVEC_MAKE(buf, offset),
IOVEC_MAKE(&written_byte, sizeof(written_byte)),
};
r = tpm2_digest_many(TPM2_ALG_SHA256, digest, data, ELEMENTSOF(data), /* extend= */ true);
if (r < 0)
return r;
tpm2_log_debug_digest(digest, "PolicyNvWritten calculated digest");
return 0;
}
int tpm2_policy_nv_written(
Tpm2Context *c,
const Tpm2Handle *session,
bool written_set,
TPM2B_DIGEST **ret_policy_digest) {
TSS2_RC rc;
assert(c);
assert(session);
log_debug("Submitting NvWritten policy.");
rc = sym_Esys_PolicyNvWritten(
c->esys_context,
session->esys_handle,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
written_set ? TPM2_YES : TPM2_NO);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to add NvWritten policy to TPM: %s",
sym_Tss2_RC_Decode(rc));
return tpm2_get_policy_digest(c, session, ret_policy_digest);
}
/* Extend 'digest' with the PolicySigned calculated hash. */
int tpm2_calculate_policy_signed(TPM2B_DIGEST *digest, const TPM2B_NAME *name) {
TPM2_CC command = TPM2_CC_PolicySigned;
TSS2_RC rc;
int r;
assert(digest);
assert(digest->size == SHA256_DIGEST_SIZE);
assert(name);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
uint8_t buf[sizeof(command)];
size_t offset = 0;
rc = sym_Tss2_MU_TPM2_CC_Marshal(command, buf, sizeof(buf), &offset);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal PolicySigned command: %s", sym_Tss2_RC_Decode(rc));
if (offset != sizeof(command))
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Offset 0x%zx wrong after marshalling PolicySigned command", offset);
struct iovec data[] = {
IOVEC_MAKE(buf, offset),
IOVEC_MAKE(name->name, name->size),
};
r = tpm2_digest_many(TPM2_ALG_SHA256, digest, data, ELEMENTSOF(data), /* extend= */ true);
if (r < 0)
return r;
const TPM2B_NONCE policyRef = {}; /* For now, we do not make use of the policyRef stuff */
r = tpm2_digest_buffer(TPM2_ALG_SHA256, digest, policyRef.buffer, policyRef.size, /* extend= */ true);
if (r < 0)
return r;
tpm2_log_debug_digest(digest, "PolicySigned calculated digest");
return 0;
}
int tpm2_policy_signed_hmac_sha256(
Tpm2Context *c,
const Tpm2Handle *session,
const Tpm2Handle *hmac_key_handle,
const struct iovec *hmac_key,
TPM2B_DIGEST **ret_policy_digest) {
#if HAVE_OPENSSL
TSS2_RC rc;
int r;
assert(c);
assert(session);
assert(hmac_key_handle);
assert(iovec_is_set(hmac_key));
/* This sends a TPM2_PolicySigned command to the tpm. As signature key we use an HMAC-SHA256 key
* specified in the hmac_key parameter. The secret key must be loaded into the TPM already and
* referenced in hmac_key_handle. */
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
log_debug("Submitting PolicySigned policy for HMAC-SHA256.");
/* Acquire the nonce from the TPM that we shall sign */
_cleanup_(Esys_Freep) TPM2B_NONCE *nonce = NULL;
rc = sym_Esys_TRSess_GetNonceTPM(
c->esys_context,
session->esys_handle,
&nonce);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to determine NoneTPM of auth session: %s",
sym_Tss2_RC_Decode(rc));
be32_t expiration = htobe64(0);
const TPM2B_DIGEST cpHashA = {}; /* For now, we do not make use of the cpHashA stuff */
const TPM2B_NONCE policyRef = {}; /* ditto, we do not bother with policyRef */
/* Put together the data to sign, as per TPM2 Spec Part 3, 23.3.1 */
struct iovec data_to_sign[] = {
IOVEC_MAKE(nonce->buffer, nonce->size),
IOVEC_MAKE(&expiration, sizeof(expiration)),
IOVEC_MAKE(cpHashA.buffer, cpHashA.size),
IOVEC_MAKE(policyRef.buffer, policyRef.size),
};
/* Now calculate the digest of the data we put together */
TPM2B_DIGEST digest_to_sign;
r = tpm2_digest_many(TPM2_ALG_SHA256, &digest_to_sign, data_to_sign, ELEMENTSOF(data_to_sign), /* extend= */ false);
if (r < 0)
return r;
unsigned char hmac_signature[SHA256_DIGEST_SIZE];
unsigned hmac_signature_size = sizeof(hmac_signature);
/* And sign this with our key */
if (!sym_HMAC(sym_EVP_sha256(),
hmac_key->iov_base,
hmac_key->iov_len,
digest_to_sign.buffer,
digest_to_sign.size,
hmac_signature,
&hmac_signature_size))
return -ENOTRECOVERABLE;
/* Now bring the signature into a format that the TPM understands */
TPMT_SIGNATURE sig = {
.sigAlg = TPM2_ALG_HMAC,
.signature.hmac.hashAlg = TPM2_ALG_SHA256,
};
assert(hmac_signature_size == sizeof(sig.signature.hmac.digest.sha256));
memcpy(sig.signature.hmac.digest.sha256, hmac_signature, hmac_signature_size);
/* And submit the whole shebang to the TPM */
rc = sym_Esys_PolicySigned(
c->esys_context,
hmac_key_handle->esys_handle,
session->esys_handle,
/* shandle1= */ ESYS_TR_NONE,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
nonce,
&cpHashA,
&policyRef,
expiration,
&sig,
/* timeout= */ NULL,
/* policyTicket= */ NULL);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to add PolicySigned policy to TPM: %s",
sym_Tss2_RC_Decode(rc));
return tpm2_get_policy_digest(c, session, ret_policy_digest);
#else /* HAVE_OPENSSL */
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
int tpm2_policy_secret(
Tpm2Context *c,
const Tpm2Handle *auth_session,
const Tpm2Handle *session,
const Tpm2Handle *handle,
const TPM2B_NONCE *policy_ref,
TPM2B_DIGEST **ret_policy_digest) {
TSS2_RC rc;
assert(c);
assert(session);
assert(handle);
log_debug("Submitting PolicySecret policy.");
rc = sym_Esys_PolicySecret(
c->esys_context,
handle->esys_handle,
session->esys_handle,
auth_session ? auth_session->esys_handle : ESYS_TR_PASSWORD,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
/* nonceTPM= */ NULL,
/* cpHashA= */ NULL,
policy_ref,
/* expiration= */ 0,
/* timeout= */ NULL,
/* policyTicket= */ NULL);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to add PolicySecret policy to TPM: %s",
sym_Tss2_RC_Decode(rc));
return tpm2_get_policy_digest(c, session, ret_policy_digest);
}
int tpm2_calculate_policy_authorize_nv(
const TPM2B_NV_PUBLIC *public_info,
TPM2B_DIGEST *digest) {
TPM2_CC command = TPM2_CC_PolicyAuthorizeNV;
TSS2_RC rc;
int r;
assert(public_info);
assert(digest);
assert(digest->size == SHA256_DIGEST_SIZE);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
uint8_t buf[sizeof(command)];
size_t offset = 0;
rc = sym_Tss2_MU_TPM2_CC_Marshal(command, buf, sizeof(buf), &offset);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal PolicyAuthorizeNV command: %s", sym_Tss2_RC_Decode(rc));
if (offset != sizeof(command))
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Offset 0x%zx wrong after marshalling PolicyAuthorizeNV command", offset);
TPM2B_NV_PUBLIC public_info_copy = *public_info; /* Make a copy, since we must set TPMA_NV_WRITTEN for the calculation */
public_info_copy.nvPublic.attributes |= TPMA_NV_WRITTEN;
TPM2B_NAME name = {};
r = tpm2_calculate_nv_index_name(&public_info_copy.nvPublic, &name);
if (r < 0)
return r;
struct iovec data[] = {
IOVEC_MAKE(buf, offset),
IOVEC_MAKE(name.name, name.size),
};
r = tpm2_digest_many(TPM2_ALG_SHA256, digest, data, ELEMENTSOF(data), /* extend= */ true);
if (r < 0)
return r;
tpm2_log_debug_digest(digest, "PolicyAuthorizeNV calculated digest");
return 0;
}
int tpm2_policy_authorize_nv(
Tpm2Context *c,
const Tpm2Handle *session,
const Tpm2Handle *nv_handle,
TPM2B_DIGEST **ret_policy_digest) {
TSS2_RC rc;
assert(c);
assert(session);
log_debug("Submitting AuthorizeNV policy.");
rc = sym_Esys_PolicyAuthorizeNV(
c->esys_context,
ESYS_TR_RH_OWNER,
nv_handle->esys_handle,
session->esys_handle,
ESYS_TR_PASSWORD,
ESYS_TR_NONE,
ESYS_TR_NONE);
if ((rc & ~(TPM2_RC_N_MASK|TPM2_RC_P)) == TPM2_RC_VALUE) /* Return a recognizable error if the policy
* in the NV index does not match what we
* just put together */
return log_debug_errno(SYNTHETIC_ERRNO(EREMCHG),
"Submitted policy does not match policy stored in PolicyAuthorizeNV.");
if ((rc & ~(TPM2_RC_N_MASK|TPM2_RC_P)) == TPM2_RC_HANDLE ||
rc == TPM2_RC_NV_UNINITIALIZED) /* NV index is missing, unwritten, or otherwise unusable for this policy (or: wrong authHandle/policySession). */
return log_debug_errno(SYNTHETIC_ERRNO(EADDRNOTAVAIL),
"NV index referenced by token is missing, unwritten, or unusable, it could be for another system.");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to add AuthorizeNV policy to TPM: %s",
sym_Tss2_RC_Decode(rc));
return tpm2_get_policy_digest(c, session, ret_policy_digest);
}
int tpm2_policy_or(
Tpm2Context *c,
const Tpm2Handle *session,
const TPM2B_DIGEST *branches, size_t n_branches,
TPM2B_DIGEST **ret_policy_digest) {
TPML_DIGEST hash_list;
TSS2_RC rc;
assert(c);
assert(session);
if (n_branches > ELEMENTSOF(hash_list.digests))
return -EOPNOTSUPP;
log_debug("Submitting OR policy.");
hash_list = (TPML_DIGEST) {
.count = n_branches,
};
memcpy(hash_list.digests, branches, n_branches * sizeof(TPM2B_DIGEST));
if (DEBUG_LOGGING)
for (size_t i = 0; i < hash_list.count; i++) {
_cleanup_free_ char *h = hexmem(hash_list.digests[i].buffer, hash_list.digests[i].size);
log_debug("Submitting OR Branch #%zu: %s", i, h);
}
rc = sym_Esys_PolicyOR(
c->esys_context,
session->esys_handle,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
&hash_list);
if ((rc & ~(TPM2_RC_N_MASK|TPM2_RC_P)) == TPM2_RC_VALUE) /* Return a recognizable error if none of the OR branches matched */
return log_debug_errno(SYNTHETIC_ERRNO(ENOANO),
"None of the PolicyOR branches matched the current policy state.");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to add OR policy to TPM: %s",
sym_Tss2_RC_Decode(rc));
return tpm2_get_policy_digest(c, session, ret_policy_digest);
}
/* Extend 'digest' with the PolicyOR calculated hash. */
int tpm2_calculate_policy_or(const TPM2B_DIGEST *branches, size_t n_branches, TPM2B_DIGEST *digest) {
TPM2_CC command = TPM2_CC_PolicyOR;
TSS2_RC rc;
int r;
assert(digest);
assert(digest->size == SHA256_DIGEST_SIZE);
if (n_branches == 0)
return -EINVAL;
if (n_branches == 1)
log_warning("PolicyOR with a single branch submitted, this is weird.");
if (n_branches > 8)
return -E2BIG;
r = dlopen_tpm2(LOG_ERR);
if (r < 0)
return r;
uint8_t buf[sizeof(command)];
size_t offset = 0;
rc = sym_Tss2_MU_TPM2_CC_Marshal(command, buf, sizeof(buf), &offset);
if (rc != TSS2_RC_SUCCESS)
return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal PolicyOR command: %s", sym_Tss2_RC_Decode(rc));
if (offset != sizeof(command))
return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Offset 0x%zx wrong after marshalling PolicyOR command", offset);
_cleanup_free_ struct iovec *data = new(struct iovec, 1 + n_branches);
if (!data)
return log_oom();
data[0] = IOVEC_MAKE(buf, offset);
for (size_t i = 0; i < n_branches; i++) {
data[1 + i] = IOVEC_MAKE((void*) branches[i].buffer, branches[i].size);
if (DEBUG_LOGGING) {
_cleanup_free_ char *h = hexmem(branches[i].buffer, branches[i].size);
log_debug("OR Branch #%zu: %s", i, h);
}
}
/* PolicyOR does not use the previous hash value; we must zero and then extend it. */
zero(digest->buffer);
r = tpm2_digest_many(TPM2_ALG_SHA256, digest, data, 1 + n_branches, /* extend= */ true);
if (r < 0)
return r;
tpm2_log_debug_digest(digest, "PolicyOR calculated digest");
return 0;
}
/* Extend 'digest' with the PolicyPCR calculated hash. */
int tpm2_calculate_policy_pcr(
const Tpm2PCRValue *pcr_values,
size_t n_pcr_values,
TPM2B_DIGEST *digest) {
TPM2_CC command = TPM2_CC_PolicyPCR;
TSS2_RC rc;
int r;
assert(pcr_values || n_pcr_values == 0);
assert(digest);
assert(digest->size == SHA256_DIGEST_SIZE);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
TPML_PCR_SELECTION pcr_selection;
_cleanup_free_ TPM2B_DIGEST *values = NULL;
size_t n_values;
r = tpm2_tpml_pcr_selection_from_pcr_values(pcr_values, n_pcr_values, &pcr_selection, &values, &n_values);
if (r < 0)
return log_debug_errno(r, "Could not convert PCR values to TPML_PCR_SELECTION: %m");
TPM2B_DIGEST hash = {};
r = tpm2_digest_many_digests(TPM2_ALG_SHA256, &hash, values, n_values, /* extend= */ false);
if (r < 0)
return r;
_cleanup_free_ uint8_t *buf = NULL;
size_t size = 0, maxsize = sizeof(command) + sizeof(pcr_selection);
buf = malloc(maxsize);
if (!buf)
return log_oom_debug();
rc = sym_Tss2_MU_TPM2_CC_Marshal(command, buf, maxsize, &size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal PolicyPCR command: %s", sym_Tss2_RC_Decode(rc));
rc = sym_Tss2_MU_TPML_PCR_SELECTION_Marshal(&pcr_selection, buf, maxsize, &size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal PCR selection: %s", sym_Tss2_RC_Decode(rc));
struct iovec data[] = {
IOVEC_MAKE(buf, size),
IOVEC_MAKE(hash.buffer, hash.size),
};
r = tpm2_digest_many(TPM2_ALG_SHA256, digest, data, ELEMENTSOF(data), /* extend= */ true);
if (r < 0)
return r;
tpm2_log_debug_digest(digest, "PolicyPCR calculated digest");
return 0;
}
int tpm2_policy_pcr(
Tpm2Context *c,
const Tpm2Handle *session,
const TPML_PCR_SELECTION *pcr_selection,
TPM2B_DIGEST **ret_policy_digest) {
TSS2_RC rc;
assert(c);
assert(session);
assert(pcr_selection);
log_debug("Submitting PCR hash policy.");
rc = sym_Esys_PolicyPCR(
c->esys_context,
session->esys_handle,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
NULL,
pcr_selection);
if (rc == TPM2_RC_PCR_CHANGED)
return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN),
"Failed to add PCR policy to TPM: %s", sym_Tss2_RC_Decode(rc));
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to add PCR policy to TPM: %s", sym_Tss2_RC_Decode(rc));
return tpm2_get_policy_digest(c, session, ret_policy_digest);
}
/* Extend 'digest' with the PolicyAuthorize calculated hash. */
int tpm2_calculate_policy_authorize(
const TPM2B_PUBLIC *public,
const TPM2B_NONCE *policy_ref,
TPM2B_DIGEST *digest) {
TPM2_CC command = TPM2_CC_PolicyAuthorize;
TSS2_RC rc;
int r;
assert(public);
assert(digest);
assert(digest->size == SHA256_DIGEST_SIZE);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
uint8_t buf[sizeof(command)];
size_t offset = 0;
rc = sym_Tss2_MU_TPM2_CC_Marshal(command, buf, sizeof(buf), &offset);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal PolicyAuthorize command: %s", sym_Tss2_RC_Decode(rc));
if (offset != sizeof(command))
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Offset 0x%zx wrong after marshalling PolicyAuthorize command", offset);
TPM2B_NAME name = {};
r = tpm2_calculate_pubkey_name(&public->publicArea, &name);
if (r < 0)
return r;
/* PolicyAuthorize does not use the previous hash value; we must zero and then extend it. */
zero(digest->buffer);
struct iovec data[] = {
IOVEC_MAKE(buf, offset),
IOVEC_MAKE(name.name, name.size),
};
r = tpm2_digest_many(TPM2_ALG_SHA256, digest, data, ELEMENTSOF(data), /* extend= */ true);
if (r < 0)
return r;
/* PolicyAuthorize requires hashing twice; this is either an extension or rehashing. */
if (policy_ref)
r = tpm2_digest_many_digests(TPM2_ALG_SHA256, digest, policy_ref, 1, /* extend= */ true);
else
r = tpm2_digest_rehash(TPM2_ALG_SHA256, digest);
if (r < 0)
return r;
tpm2_log_debug_digest(digest, "PolicyAuthorize calculated digest");
return 0;
}
static void tpm2_make_policy_ref(const char *policy_ref, TPM2B_NONCE *ret_policy_ref) {
assert(ret_policy_ref);
assert(SHA256_DIGEST_SIZE <= sizeof(ret_policy_ref->buffer));
/* A policy reference is represented by the TPM2B_NONCE type, which has a maximum size equivalent
* to the largest digest supported by the TPM. Because of this, digest the policy reference string.
* As we don't know what the maximum digest size supported by the TPM is when publishing a
* signed policy, we pick SHA256 which is universally supported on PC-Client devices. Ideally the
* algorithm ID would be prepended to the digest, but we don't know if the TPM2B_NONCE type can
* accommodate this. For this reason, the digest algorithm here should match the one used to create
* the approved digest for the corresponding policy, which is always SHA256 at the moment.
*
* Note that we return a policy ref size of 0 if no string is supplied in order to maintain
* backwards compatibility with previous systemd releases. */
if (isempty(policy_ref)) {
ret_policy_ref->size = 0;
return;
}
sha256_direct(policy_ref, strlen(policy_ref), ret_policy_ref->buffer);
ret_policy_ref->size = SHA256_DIGEST_SIZE;
}
static int tpm2_policy_authorize(
Tpm2Context *c,
const Tpm2Handle *session,
TPML_PCR_SELECTION *pcr_selection,
const TPM2B_PUBLIC *public,
const char *policy_ref,
const void *fp,
size_t fp_size,
sd_json_variant *signature_json,
TPM2B_DIGEST **ret_policy_digest) {
TSS2_RC rc;
int r;
assert(c);
assert(session);
assert(pcr_selection);
assert(public);
assert(fp && fp_size > 0);
log_debug("Adding PCR signature policy.");
_cleanup_(tpm2_handle_freep) Tpm2Handle *pubkey_handle = NULL;
r = tpm2_load_external(c, NULL, public, NULL, &pubkey_handle);
if (r < 0)
return r;
/* Acquire the "name" of what we just loaded */
_cleanup_(Esys_Freep) TPM2B_NAME *pubkey_name = NULL;
r = tpm2_get_name(c, pubkey_handle, &pubkey_name);
if (r < 0)
return r;
/* If we have a signature, proceed with verifying the PCR digest */
const TPMT_TK_VERIFIED *check_ticket;
_cleanup_(Esys_Freep) TPMT_TK_VERIFIED *check_ticket_buffer = NULL;
_cleanup_(Esys_Freep) TPM2B_DIGEST *approved_policy = NULL;
if (signature_json) {
r = tpm2_policy_pcr(
c,
session,
pcr_selection,
&approved_policy);
if (r < 0)
return r;
_cleanup_free_ void *signature_raw = NULL;
size_t signature_size;
r = find_signature(
signature_json,
pcr_selection,
fp, fp_size,
policy_ref,
approved_policy->buffer,
approved_policy->size,
&signature_raw,
&signature_size);
if (r < 0)
return r;
/* TPM2_VerifySignature() will only verify the RSA part of the RSA+SHA256 signature,
* hence we need to do the SHA256 part ourselves, first */
_cleanup_(iovec_done) struct iovec tbs_data = {};
r = tpm2_make_policy_authorize_tbs_data(approved_policy, policy_ref, &tbs_data);
if (r < 0)
return r;
TPM2B_DIGEST signature_hash;
r = tpm2_digest_buffer(TPM2_ALG_SHA256, &signature_hash, tbs_data.iov_base, tbs_data.iov_len, /* extend= */ false);
if (r < 0)
return r;
r = TPM2B_PUBLIC_KEY_RSA_CHECK_SIZE(signature_size);
if (r < 0)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Signature larger than buffer.");
TPMT_SIGNATURE policy_signature = {
.sigAlg = TPM2_ALG_RSASSA,
.signature.rsassa = {
.hash = TPM2_ALG_SHA256,
.sig = TPM2B_PUBLIC_KEY_RSA_MAKE(signature_raw, signature_size),
},
};
rc = sym_Esys_VerifySignature(
c->esys_context,
pubkey_handle->esys_handle,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
&signature_hash,
&policy_signature,
&check_ticket_buffer);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to validate signature in TPM: %s", sym_Tss2_RC_Decode(rc));
check_ticket = check_ticket_buffer;
} else {
/* When enrolling, we pass a NULL ticket */
static const TPMT_TK_VERIFIED check_ticket_null = {
.tag = TPM2_ST_VERIFIED,
.hierarchy = TPM2_RH_OWNER,
};
check_ticket = &check_ticket_null;
}
TPM2B_NONCE policy_ref_tpm2b;
tpm2_make_policy_ref(policy_ref, &policy_ref_tpm2b);
rc = sym_Esys_PolicyAuthorize(
c->esys_context,
session->esys_handle,
ESYS_TR_NONE,
ESYS_TR_NONE,
ESYS_TR_NONE,
approved_policy,
&policy_ref_tpm2b,
pubkey_name,
check_ticket);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to push Authorize policy into TPM: %s", sym_Tss2_RC_Decode(rc));
return tpm2_get_policy_digest(c, session, ret_policy_digest);
}
/* Extend 'digest' with the calculated policy hash. */
int tpm2_calculate_sealing_policy(
const Tpm2PCRValue *pcr_values,
size_t n_pcr_values,
const TPM2B_PUBLIC *public,
const char *pubkey_policy_ref,
bool use_pin,
const Tpm2PCRLockPolicy *pcrlock_policy,
TPM2B_DIGEST *digest) {
int r;
assert(pcr_values || n_pcr_values == 0);
assert(digest);
/* The combination of signed PCR policies and pcrlock is not supported (because we cannot combine
* PolicyAuthorize and PolicyAuthorizeNV in one policy). Callers need to use "sharding" of the
* symmetric FDE unlock key to make policies like that work. */
if (public && pcrlock_policy)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Policies that combined signed PCR and pcrlock are not supported.");
if (public) {
TPM2B_NONCE policy_ref;
tpm2_make_policy_ref(pubkey_policy_ref, &policy_ref);
r = tpm2_calculate_policy_authorize(public, &policy_ref, digest);
if (r < 0)
return r;
}
if (pcrlock_policy) {
TPM2B_NV_PUBLIC nv_public;
r = tpm2_unmarshal_nv_public(
pcrlock_policy->nv_public.iov_base,
pcrlock_policy->nv_public.iov_len,
&nv_public);
if (r < 0)
return r;
r = tpm2_calculate_policy_authorize_nv(&nv_public, digest);
if (r < 0)
return r;
}
if (n_pcr_values > 0) {
r = tpm2_calculate_policy_pcr(pcr_values, n_pcr_values, digest);
if (r < 0)
return r;
}
if (use_pin) {
r = tpm2_calculate_policy_auth_value(digest);
if (r < 0)
return r;
}
return 0;
}
static int tpm2_build_sealing_policy(
Tpm2Context *c,
const Tpm2Handle *session,
uint32_t hash_pcr_mask,
uint16_t pcr_bank,
const TPM2B_PUBLIC *public,
const char *pubkey_policy_ref,
const void *fp,
size_t fp_size,
uint32_t pubkey_pcr_mask,
sd_json_variant *signature_json,
bool use_pin,
const Tpm2PCRLockPolicy *pcrlock_policy,
TPM2B_DIGEST **ret_policy_digest) {
int r;
assert(c);
assert(session);
assert(pubkey_pcr_mask == 0 || public);
assert(!pubkey_policy_ref || public);
log_debug("Building sealing policy.");
if ((hash_pcr_mask | pubkey_pcr_mask) != 0) {
r = tpm2_pcr_mask_good(c, pcr_bank, hash_pcr_mask|pubkey_pcr_mask);
if (r < 0)
return r;
if (r == 0)
log_debug("Selected TPM2 PCRs are not initialized on this system.");
}
if (pubkey_pcr_mask != 0 && pcrlock_policy)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Policies with both signed PCR and pcrlock are currently not supported.");
if (pubkey_pcr_mask != 0) {
TPML_PCR_SELECTION pcr_selection;
tpm2_tpml_pcr_selection_from_mask(pubkey_pcr_mask, (TPMI_ALG_HASH)pcr_bank, &pcr_selection);
r = tpm2_policy_authorize(c, session, &pcr_selection, public, pubkey_policy_ref, fp, fp_size, signature_json, NULL);
if (r < 0)
return r;
}
if (pcrlock_policy) {
_cleanup_(tpm2_handle_freep) Tpm2Handle *nv_handle = NULL;
r = tpm2_policy_super_pcr(
c,
session,
&pcrlock_policy->prediction,
pcrlock_policy->algorithm);
if (r < 0)
return r;
r = tpm2_deserialize(
c,
&pcrlock_policy->nv_handle,
&nv_handle);
if (r < 0)
return r;
r = tpm2_policy_authorize_nv(
c,
session,
nv_handle,
NULL);
if (r < 0)
return r;
}
if (hash_pcr_mask != 0) {
TPML_PCR_SELECTION pcr_selection;
tpm2_tpml_pcr_selection_from_mask(hash_pcr_mask, (TPMI_ALG_HASH)pcr_bank, &pcr_selection);
r = tpm2_policy_pcr(c, session, &pcr_selection, NULL);
if (r < 0)
return r;
}
if (use_pin) {
r = tpm2_policy_auth_value(c, session, NULL);
if (r < 0)
return r;
}
r = tpm2_get_policy_digest(c, session, ret_policy_digest);
if (r < 0)
return r;
return 0;
}
#if HAVE_OPENSSL
static const struct {
TPM2_ECC_CURVE tpm2_ecc_curve_id;
int openssl_ecc_curve_id;
} tpm2_openssl_ecc_curve_table[] = {
{ TPM2_ECC_NIST_P192, NID_X9_62_prime192v1, },
{ TPM2_ECC_NIST_P224, NID_secp224r1, },
{ TPM2_ECC_NIST_P256, NID_X9_62_prime256v1, },
{ TPM2_ECC_NIST_P384, NID_secp384r1, },
{ TPM2_ECC_NIST_P521, NID_secp521r1, },
{ TPM2_ECC_SM2_P256, NID_sm2, },
};
static int tpm2_ecc_curve_from_openssl_curve_id(int openssl_ecc_curve_id, TPM2_ECC_CURVE *ret) {
assert(ret);
FOREACH_ELEMENT(t, tpm2_openssl_ecc_curve_table)
if (t->openssl_ecc_curve_id == openssl_ecc_curve_id) {
*ret = t->tpm2_ecc_curve_id;
return 0;
}
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"OpenSSL ECC curve id %d not supported.", openssl_ecc_curve_id);
}
static int tpm2_ecc_curve_to_openssl_curve_id(TPM2_ECC_CURVE tpm2_ecc_curve_id, int *ret) {
assert(ret);
FOREACH_ELEMENT(t, tpm2_openssl_ecc_curve_table)
if (t->tpm2_ecc_curve_id == tpm2_ecc_curve_id) {
*ret = t->openssl_ecc_curve_id;
return 0;
}
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"TPM2 ECC curve %u not supported.", tpm2_ecc_curve_id);
}
#define TPM2_RSA_DEFAULT_EXPONENT UINT32_C(0x10001)
int tpm2_tpm2b_public_to_openssl_pkey(const TPM2B_PUBLIC *public, EVP_PKEY **ret) {
int r;
assert(public);
assert(ret);
const TPMT_PUBLIC *p = &public->publicArea;
switch (p->type) {
case TPM2_ALG_ECC: {
int curve_id;
r = tpm2_ecc_curve_to_openssl_curve_id(p->parameters.eccDetail.curveID, &curve_id);
if (r < 0)
return r;
const TPMS_ECC_POINT *point = &p->unique.ecc;
return ecc_pkey_from_curve_x_y(
curve_id,
point->x.buffer,
point->x.size,
point->y.buffer,
point->y.size,
ret);
}
case TPM2_ALG_RSA: {
/* TPM specification Part 2 ("Structures") section for TPMS_RSA_PARAMS states "An exponent of
* zero indicates that the exponent is the default of 2^16 + 1". */
uint32_t exponent = htobe32(p->parameters.rsaDetail.exponent ?: TPM2_RSA_DEFAULT_EXPONENT);
return rsa_pkey_from_n_e(
p->unique.rsa.buffer,
p->unique.rsa.size,
&exponent,
sizeof(exponent),
ret);
}
default:
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"TPM2 asymmetric algorithm 0x%" PRIx16 " not supported.", p->type);
}
}
/* Be careful before changing anything in this function, as the TPM key "name" is calculated using the entire
* TPMT_PUBLIC (after marshalling), and that "name" is used (for example) to calculate the policy hash for
* the Authorize policy. So we must ensure this conversion of a PEM to TPM2B_PUBLIC does not change the
* "name", because it would break unsealing of previously-sealed objects that used (for example)
* tpm2_calculate_policy_authorize(). See bug #30546. */
int tpm2_tpm2b_public_from_openssl_pkey(const EVP_PKEY *pkey, TPM2B_PUBLIC *ret) {
int r;
assert(pkey);
assert(ret);
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
TPMT_PUBLIC public = {
.nameAlg = TPM2_ALG_SHA256,
.objectAttributes = TPMA_OBJECT_DECRYPT | TPMA_OBJECT_SIGN_ENCRYPT | TPMA_OBJECT_USERWITHAUTH,
.parameters.asymDetail = {
.symmetric.algorithm = TPM2_ALG_NULL,
.scheme.scheme = TPM2_ALG_NULL,
},
};
int key_id = sym_EVP_PKEY_get_id(pkey);
switch (key_id) {
case EVP_PKEY_EC: {
public.type = TPM2_ALG_ECC;
int curve_id;
_cleanup_free_ void *x = NULL, *y = NULL;
size_t x_size, y_size;
r = ecc_pkey_to_curve_x_y(pkey, &curve_id, &x, &x_size, &y, &y_size);
if (r < 0)
return log_debug_errno(r, "Could not get ECC key curve/x/y: %m");
TPM2_ECC_CURVE curve;
r = tpm2_ecc_curve_from_openssl_curve_id(curve_id, &curve);
if (r < 0)
return r;
public.parameters.eccDetail.curveID = curve;
public.parameters.eccDetail.kdf.scheme = TPM2_ALG_NULL;
r = TPM2B_ECC_PARAMETER_CHECK_SIZE(x_size);
if (r < 0)
return log_debug_errno(r, "ECC key x size %zu too large.", x_size);
public.unique.ecc.x = TPM2B_ECC_PARAMETER_MAKE(x, x_size);
r = TPM2B_ECC_PARAMETER_CHECK_SIZE(y_size);
if (r < 0)
return log_debug_errno(r, "ECC key y size %zu too large.", y_size);
public.unique.ecc.y = TPM2B_ECC_PARAMETER_MAKE(y, y_size);
break;
}
case EVP_PKEY_RSA: {
public.type = TPM2_ALG_RSA;
_cleanup_free_ void *n = NULL, *e = NULL;
size_t n_size, e_size;
r = rsa_pkey_to_n_e(pkey, &n, &n_size, &e, &e_size);
if (r < 0)
return log_debug_errno(r, "Could not get RSA key n/e: %m");
r = TPM2B_PUBLIC_KEY_RSA_CHECK_SIZE(n_size);
if (r < 0)
return log_debug_errno(r, "RSA key n size %zu too large.", n_size);
public.unique.rsa = TPM2B_PUBLIC_KEY_RSA_MAKE(n, n_size);
public.parameters.rsaDetail.keyBits = n_size * 8;
if (sizeof(uint32_t) < e_size)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"RSA key e size %zu too large.", e_size);
uint32_t exponent = 0;
memcpy(&exponent, e, e_size);
exponent = be32toh(exponent) >> (32 - e_size * 8);
/* TPM specification Part 2 ("Structures") section for TPMS_RSA_PARAMS states "An exponent of
* zero indicates that the exponent is the default of 2^16 + 1". However, we have no reason
* to special case it in our PEM->TPM2B_PUBLIC conversion, and doing so could break backwards
* compatibility, so even if it is the "default" value of 0x10001, we do not set it to 0. */
public.parameters.rsaDetail.exponent = exponent;
break;
}
default:
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"EVP_PKEY type %d not supported.", key_id);
}
*ret = (TPM2B_PUBLIC) {
.size = sizeof(public),
.publicArea = public,
};
return 0;
}
#endif
int tpm2_tpm2b_public_to_fingerprint(
const TPM2B_PUBLIC *public,
void **ret_fingerprint,
size_t *ret_fingerprint_size) {
#if HAVE_OPENSSL
int r;
assert(public);
assert(ret_fingerprint);
assert(ret_fingerprint_size);
_cleanup_(EVP_PKEY_freep) EVP_PKEY *pkey = NULL;
r = tpm2_tpm2b_public_to_openssl_pkey(public, &pkey);
if (r < 0)
return r;
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
/* Hardcode fingerprint to SHA256 */
return pubkey_fingerprint(pkey, sym_EVP_sha256(), ret_fingerprint, ret_fingerprint_size);
#else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
int tpm2_tpm2b_public_from_pem(const void *pem, size_t pem_size, TPM2B_PUBLIC *ret) {
#if HAVE_OPENSSL
int r;
assert(pem);
assert(ret);
_cleanup_(EVP_PKEY_freep) EVP_PKEY *pkey = NULL;
r = openssl_pubkey_from_pem(pem, pem_size, &pkey);
if (r < 0)
return r;
return tpm2_tpm2b_public_from_openssl_pkey(pkey, ret);
#else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
/* Marshal the public, private, and seed objects into a single nonstandard 'blob'. The public and private
* objects are required, while the seed is optional. This is not a (publicly) standard format, this is
* specific to how we currently store the sealed object. This 'blob' can be unmarshalled by
* tpm2_unmarshal_blob(). */
int tpm2_marshal_blob(
const TPM2B_PUBLIC *public,
const TPM2B_PRIVATE *private,
const TPM2B_ENCRYPTED_SECRET *seed,
void **ret_blob,
size_t *ret_blob_size) {
TSS2_RC rc;
assert(public);
assert(private);
assert(ret_blob);
assert(ret_blob_size);
size_t max_size = sizeof(*private) + sizeof(*public);
if (seed)
max_size += sizeof(*seed);
_cleanup_free_ void *blob = malloc(max_size);
if (!blob)
return log_oom_debug();
size_t blob_size = 0;
rc = sym_Tss2_MU_TPM2B_PRIVATE_Marshal(private, blob, max_size, &blob_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal private key: %s", sym_Tss2_RC_Decode(rc));
rc = sym_Tss2_MU_TPM2B_PUBLIC_Marshal(public, blob, max_size, &blob_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal public key: %s", sym_Tss2_RC_Decode(rc));
if (seed) {
rc = sym_Tss2_MU_TPM2B_ENCRYPTED_SECRET_Marshal(seed, blob, max_size, &blob_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal encrypted seed: %s", sym_Tss2_RC_Decode(rc));
}
*ret_blob = TAKE_PTR(blob);
*ret_blob_size = blob_size;
return 0;
}
/* Unmarshal the 'blob' into public, private, and seed objects. The public and private objects are required
* in the 'blob', while the seed is optional. This is not a (publicly) standard format, this is specific to
* how we currently store the sealed object. This expects the 'blob' to have been created by
* tpm2_marshal_blob(). */
int tpm2_unmarshal_blob(
const void *blob,
size_t blob_size,
TPM2B_PUBLIC *ret_public,
TPM2B_PRIVATE *ret_private,
TPM2B_ENCRYPTED_SECRET *ret_seed) {
TSS2_RC rc;
assert(blob);
assert(ret_public);
assert(ret_private);
assert(ret_seed);
TPM2B_PRIVATE private = {};
size_t offset = 0;
rc = sym_Tss2_MU_TPM2B_PRIVATE_Unmarshal(blob, blob_size, &offset, &private);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unmarshal private key: %s", sym_Tss2_RC_Decode(rc));
TPM2B_PUBLIC public = {};
rc = sym_Tss2_MU_TPM2B_PUBLIC_Unmarshal(blob, blob_size, &offset, &public);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unmarshal public key: %s", sym_Tss2_RC_Decode(rc));
TPM2B_ENCRYPTED_SECRET seed = {};
if (blob_size > offset) {
rc = sym_Tss2_MU_TPM2B_ENCRYPTED_SECRET_Unmarshal(blob, blob_size, &offset, &seed);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unmarshal encrypted seed: %s", sym_Tss2_RC_Decode(rc));
}
*ret_public = public;
*ret_private = private;
*ret_seed = seed;
return 0;
}
/* Calculate a serialized handle. Once the upstream tpm2-tss library provides an api to do this, we can
* remove this function. The addition of this functionality in tpm2-tss may be tracked here:
* https://github.com/tpm2-software/tpm2-tss/issues/2575 */
int tpm2_calculate_serialize(
TPM2_HANDLE handle,
const TPM2B_NAME *name,
const TPM2B_PUBLIC *public,
void **ret_serialized,
size_t *ret_serialized_size) {
TSS2_RC rc;
assert(name);
assert(public);
assert(ret_serialized);
assert(ret_serialized_size);
size_t max_size = sizeof(TPM2_HANDLE) + sizeof(TPM2B_NAME) + sizeof(uint32_t) + sizeof(TPM2B_PUBLIC);
_cleanup_free_ void *serialized = malloc(max_size);
if (!serialized)
return log_oom_debug();
size_t serialized_size = 0;
rc = sym_Tss2_MU_TPM2_HANDLE_Marshal(handle, serialized, max_size, &serialized_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal tpm handle: %s", sym_Tss2_RC_Decode(rc));
rc = sym_Tss2_MU_TPM2B_NAME_Marshal(name, serialized, max_size, &serialized_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal name: %s", sym_Tss2_RC_Decode(rc));
/* This is defined (non-publicly) in the tpm2-tss source as IESYSC_KEY_RSRC, to a value of "1". */
rc = sym_Tss2_MU_UINT32_Marshal(UINT32_C(1), serialized, max_size, &serialized_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal esys resource id: %s", sym_Tss2_RC_Decode(rc));
rc = sym_Tss2_MU_TPM2B_PUBLIC_Marshal(public, serialized, max_size, &serialized_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal public: %s", sym_Tss2_RC_Decode(rc));
*ret_serialized = TAKE_PTR(serialized);
*ret_serialized_size = serialized_size;
return 0;
}
/* Serialize a handle. This produces a binary object that can be later deserialized (by the same TPM), even
* across restarts of the TPM or reboots (assuming the handle is persistent). */
int tpm2_serialize(
Tpm2Context *c,
const Tpm2Handle *handle,
struct iovec *ret) {
TSS2_RC rc;
assert(c);
assert(handle);
assert(ret);
_cleanup_(Esys_Freep) unsigned char *serialized = NULL;
size_t size = 0;
rc = sym_Esys_TR_Serialize(c->esys_context, handle->esys_handle, &serialized, &size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to serialize: %s", sym_Tss2_RC_Decode(rc));
/* Make a copy since we don't want the caller to understand that ESYS allocated the pointer.
* It would make tracking what deallocator to use for the result in which context a PITA. */
struct iovec v;
v.iov_base = memdup(serialized, size);
if (!v.iov_base)
return log_oom_debug();
v.iov_len = size;
*ret = v;
return 0;
}
int tpm2_deserialize(
Tpm2Context *c,
const struct iovec *serialized,
Tpm2Handle **ret_handle) {
TSS2_RC rc;
int r;
assert(c);
assert(ret_handle);
if (!iovec_is_set(serialized)) {
*ret_handle = NULL;
return 0;
}
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
r = tpm2_handle_new(c, &handle);
if (r < 0)
return r;
/* Since this is an existing handle in the TPM we should not implicitly flush it. */
handle->flush = false;
rc = sym_Esys_TR_Deserialize(c->esys_context, serialized->iov_base, serialized->iov_len, &handle->esys_handle);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to deserialize: %s", sym_Tss2_RC_Decode(rc));
*ret_handle = TAKE_PTR(handle);
return 1;
}
#if HAVE_OPENSSL
/* KDFa() as defined by the TPM spec. */
static int tpm2_kdfa(
TPMI_ALG_HASH hash_alg,
const void *key,
size_t key_len,
const char *label,
const void *context,
size_t context_len,
size_t bits,
void **ret_key,
size_t *ret_key_len) {
int r;
assert(key);
assert(label);
assert(context || context_len == 0);
assert(bits > 0);
assert(bits <= SIZE_MAX - 7);
assert(ret_key);
assert(ret_key_len);
log_debug("Calculating KDFa().");
size_t len = DIV_ROUND_UP(bits, 8);
const char *hash_alg_name = tpm2_hash_alg_to_string(hash_alg);
if (!hash_alg_name)
return -EOPNOTSUPP;
_cleanup_(erase_and_freep) void *buf = NULL;
r = kdf_kb_hmac_derive(
"COUNTER",
hash_alg_name,
key,
key_len,
label,
strlen(label),
context,
context_len,
/* seed= */ NULL,
/* seed_size= */ 0,
len,
&buf);
if (r < 0)
return r;
/* If the number of bits results in a partial byte, the TPM spec requires we zero the unrequested
* bits in the MSB (i.e. at index 0). From the spec Part 1 ("Architecture") section on Key
* Derivation Function, specifically KDFa():
*
* "The implied return from this function is a sequence of octets with a length equal to (bits + 7) /
* 8. If bits is not an even multiple of 8, then the returned value occupies the least significant
* bits of the returned octet array, and the additional, high-order bits in the 0th octet are
* CLEAR. The unused bits of the most significant octet (MSO) are masked off and not shifted." */
size_t partial = bits % 8;
if (partial > 0)
((uint8_t*) buf)[0] &= 0xffu >> (8 - partial);
*ret_key = TAKE_PTR(buf);
*ret_key_len = len;
return 0;
}
/* KDFe() as defined by the TPM spec. */
static int tpm2_kdfe(
TPMI_ALG_HASH hash_alg,
const void *shared_secret,
size_t shared_secret_len,
const char *label,
const void *context_u,
size_t context_u_size,
const void *context_v,
size_t context_v_size,
size_t bits,
void **ret_key,
size_t *ret_key_len) {
int r;
assert(shared_secret);
assert(label);
assert(context_u);
assert(context_v);
assert(bits > 0);
assert(bits <= SIZE_MAX - 7);
assert(ret_key);
assert(ret_key_len);
log_debug("Calculating KDFe().");
size_t len = DIV_ROUND_UP(bits, 8);
const char *hash_alg_name = tpm2_hash_alg_to_string(hash_alg);
if (!hash_alg_name)
return -EOPNOTSUPP;
size_t info_len = strlen(label) + 1 + context_u_size + context_v_size;
_cleanup_free_ void *info = malloc(info_len);
if (!info)
return log_oom_debug();
_unused_ void *end = mempcpy(mempcpy(stpcpy(info, label) + 1, context_u, context_u_size),
context_v, context_v_size);
/* assert we copied exactly the right amount that we allocated */
assert(end > info && (uintptr_t) end - (uintptr_t) info == info_len);
_cleanup_(erase_and_freep) void *buf = NULL;
r = kdf_ss_derive(
hash_alg_name,
shared_secret,
shared_secret_len,
/* salt= */ NULL,
/* salt_size= */ 0,
info,
info_len,
len,
&buf);
if (r < 0)
return r;
*ret_key = TAKE_PTR(buf);
*ret_key_len = len;
return 0;
}
static int tpm2_calculate_seal_public(
const TPM2B_PUBLIC *parent,
const TPMA_OBJECT *attributes,
const TPM2B_DIGEST *policy,
const TPM2B_DIGEST *seed,
const void *secret,
size_t secret_size,
TPM2B_PUBLIC *ret) {
int r;
assert(parent);
POINTER_MAY_BE_NULL(attributes);
POINTER_MAY_BE_NULL(policy);
assert(seed);
assert(secret);
assert(ret);
log_debug("Calculating public part of sealed object.");
struct iovec data[] = {
IOVEC_MAKE((void*) seed->buffer, seed->size),
IOVEC_MAKE((void*) secret, secret_size),
};
TPM2B_DIGEST unique;
r = tpm2_digest_many(
parent->publicArea.nameAlg,
&unique,
data,
ELEMENTSOF(data),
/* extend= */ false);
if (r < 0)
return r;
*ret = (TPM2B_PUBLIC) {
.size = sizeof(TPMT_PUBLIC),
.publicArea = {
.type = TPM2_ALG_KEYEDHASH,
.nameAlg = parent->publicArea.nameAlg,
.objectAttributes = attributes ? *attributes : 0,
.authPolicy = policy ? *policy : TPM2B_DIGEST_MAKE(NULL, unique.size),
.parameters.keyedHashDetail.scheme.scheme = TPM2_ALG_NULL,
.unique.keyedHash = unique,
},
};
return 0;
}
static int tpm2_calculate_seal_private(
const TPM2B_PUBLIC *parent,
const TPM2B_NAME *name,
const char *pin,
const TPM2B_DIGEST *seed,
const void *secret,
size_t secret_size,
TPM2B_PRIVATE *ret) {
TSS2_RC rc;
int r;
assert(parent);
assert(name);
assert(seed);
assert(secret);
assert(ret);
log_debug("Calculating private part of sealed object.");
_cleanup_(erase_and_freep) void *storage_key = NULL;
size_t storage_key_size;
r = tpm2_kdfa(parent->publicArea.nameAlg,
seed->buffer,
seed->size,
"STORAGE",
name->name,
name->size,
(size_t) parent->publicArea.parameters.asymDetail.symmetric.keyBits.sym,
&storage_key,
&storage_key_size);
if (r < 0)
return log_debug_errno(r, "Could not calculate storage key KDFa: %m");
r = tpm2_hash_alg_to_size(parent->publicArea.nameAlg);
if (r < 0)
return -EOPNOTSUPP;
size_t bits = (size_t) r * 8;
_cleanup_(erase_and_freep) void *integrity_key = NULL;
size_t integrity_key_size;
r = tpm2_kdfa(parent->publicArea.nameAlg,
seed->buffer,
seed->size,
"INTEGRITY",
/* context= */ NULL,
/* context_len= */ 0,
bits,
&integrity_key,
&integrity_key_size);
if (r < 0)
return log_debug_errno(r, "Could not calculate integrity key KDFa: %m");
TPM2B_AUTH auth = {};
CLEANUP_ERASE(auth);
if (pin) {
r = tpm2_auth_value_from_pin(parent->publicArea.nameAlg, pin, &auth);
if (r < 0)
return r;
}
TPM2B_SENSITIVE sensitive = {
.size = sizeof(TPMT_SENSITIVE),
.sensitiveArea = {
.sensitiveType = TPM2_ALG_KEYEDHASH,
.authValue = auth,
.seedValue = *seed,
.sensitive.bits = TPM2B_SENSITIVE_DATA_MAKE(secret, secret_size),
},
};
CLEANUP_ERASE(sensitive);
_cleanup_(erase_and_freep) void *marshalled_sensitive = malloc(sizeof(sensitive));
if (!marshalled_sensitive)
return log_oom_debug();
size_t marshalled_sensitive_size = 0;
rc = sym_Tss2_MU_TPM2B_SENSITIVE_Marshal(
&sensitive,
marshalled_sensitive,
sizeof(sensitive),
&marshalled_sensitive_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal sensitive: %s", sym_Tss2_RC_Decode(rc));
const char *sym_alg = tpm2_sym_alg_to_string(parent->publicArea.parameters.asymDetail.symmetric.algorithm);
if (!sym_alg)
return -EOPNOTSUPP;
const char *sym_mode = tpm2_sym_mode_to_string(parent->publicArea.parameters.asymDetail.symmetric.mode.sym);
if (!sym_mode)
return -EOPNOTSUPP;
_cleanup_free_ void *encrypted_sensitive = NULL;
size_t encrypted_sensitive_size;
r = openssl_cipher(
sym_alg,
parent->publicArea.parameters.asymDetail.symmetric.keyBits.sym,
sym_mode,
storage_key, storage_key_size,
/* iv= */ NULL, /* iv_size= */ 0,
marshalled_sensitive, marshalled_sensitive_size,
&encrypted_sensitive, &encrypted_sensitive_size);
if (r < 0)
return r;
const char *hash_alg_name = tpm2_hash_alg_to_string(parent->publicArea.nameAlg);
if (!hash_alg_name)
return -EOPNOTSUPP;
_cleanup_free_ void *hmac_buffer = NULL;
size_t hmac_size = 0;
struct iovec hmac_data[] = {
IOVEC_MAKE((void*) encrypted_sensitive, encrypted_sensitive_size),
IOVEC_MAKE((void*) name->name, name->size),
};
r = openssl_hmac_many(
hash_alg_name,
integrity_key,
integrity_key_size,
hmac_data,
ELEMENTSOF(hmac_data),
&hmac_buffer,
&hmac_size);
if (r < 0)
return r;
TPM2B_DIGEST outer_hmac = TPM2B_DIGEST_MAKE(hmac_buffer, hmac_size);
TPM2B_PRIVATE private = {};
size_t private_size = 0;
rc = sym_Tss2_MU_TPM2B_DIGEST_Marshal(
&outer_hmac,
private.buffer,
sizeof(private.buffer),
&private_size);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal digest: %s", sym_Tss2_RC_Decode(rc));
private.size = private_size;
assert(sizeof(private.buffer) - private.size >= encrypted_sensitive_size);
memcpy_safe(&private.buffer[private.size], encrypted_sensitive, encrypted_sensitive_size);
private.size += encrypted_sensitive_size;
*ret = private;
return 0;
}
static int tpm2_calculate_seal_rsa_seed(
const TPM2B_PUBLIC *parent,
void **ret_seed,
size_t *ret_seed_size,
void **ret_encrypted_seed,
size_t *ret_encrypted_seed_size) {
int r;
assert(parent);
assert(ret_seed);
assert(ret_seed_size);
assert(ret_encrypted_seed);
assert(ret_encrypted_seed_size);
log_debug("Calculating encrypted seed for RSA sealed object.");
_cleanup_(EVP_PKEY_freep) EVP_PKEY *parent_pkey = NULL;
r = tpm2_tpm2b_public_to_openssl_pkey(parent, &parent_pkey);
if (r < 0)
return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to OpenSSL PKEY: %m");
r = tpm2_hash_alg_to_size(parent->publicArea.nameAlg);
if (r < 0)
return -EOPNOTSUPP;
size_t seed_size = (size_t) r;
_cleanup_(erase_and_freep) void *seed = malloc(seed_size);
if (!seed)
return log_oom_debug();
r = crypto_random_bytes(seed, seed_size);
if (r < 0)
return log_debug_errno(r, "Failed to generate random seed: %m");
const char *hash_alg_name = tpm2_hash_alg_to_string(parent->publicArea.nameAlg);
if (!hash_alg_name)
return -EOPNOTSUPP;
_cleanup_free_ void *encrypted_seed = NULL;
size_t encrypted_seed_size;
r = rsa_oaep_encrypt_bytes(
parent_pkey,
hash_alg_name,
"DUPLICATE",
seed,
seed_size,
&encrypted_seed,
&encrypted_seed_size);
if (r < 0)
return log_debug_errno(r, "Could not RSA-OAEP encrypt random seed: %m");
*ret_seed = TAKE_PTR(seed);
*ret_seed_size = seed_size;
*ret_encrypted_seed = TAKE_PTR(encrypted_seed);
*ret_encrypted_seed_size = encrypted_seed_size;
return 0;
}
static int tpm2_calculate_seal_ecc_seed(
const TPM2B_PUBLIC *parent,
void **ret_seed,
size_t *ret_seed_size,
void **ret_encrypted_seed,
size_t *ret_encrypted_seed_size) {
TSS2_RC rc;
int r;
assert(parent);
assert(ret_seed);
assert(ret_seed_size);
assert(ret_encrypted_seed);
assert(ret_encrypted_seed_size);
log_debug("Calculating encrypted seed for ECC sealed object.");
_cleanup_(EVP_PKEY_freep) EVP_PKEY *parent_pkey = NULL;
r = tpm2_tpm2b_public_to_openssl_pkey(parent, &parent_pkey);
if (r < 0)
return log_debug_errno(r, "Could not convert TPM2B_PUBLIC to OpenSSL PKEY: %m");
int curve_id;
r = ecc_pkey_to_curve_x_y(
parent_pkey,
&curve_id,
/* ret_x= */ NULL, /* ret_x_size= */ NULL,
/* ret_y= */ NULL, /* ret_y_size= */ NULL);
if (r < 0)
return r;
_cleanup_(EVP_PKEY_freep) EVP_PKEY *pkey = NULL;
r = ecc_pkey_new(curve_id, &pkey);
if (r < 0)
return r;
_cleanup_(erase_and_freep) void *shared_secret = NULL;
size_t shared_secret_size;
r = ecc_ecdh(pkey, parent_pkey, &shared_secret, &shared_secret_size);
if (r < 0)
return log_debug_errno(r, "Could not generate ECC shared secret: %m");
_cleanup_free_ void *x = NULL, *y = NULL;
size_t x_size, y_size;
r = ecc_pkey_to_curve_x_y(pkey, /* ret_curve_id= */ NULL, &x, &x_size, &y, &y_size);
if (r < 0)
return log_debug_errno(r, "Could not get ECC get x/y: %m");
r = TPM2B_ECC_PARAMETER_CHECK_SIZE(x_size);
if (r < 0)
return log_debug_errno(r, "ECC point x size %zu is too large: %m", x_size);
r = TPM2B_ECC_PARAMETER_CHECK_SIZE(y_size);
if (r < 0)
return log_debug_errno(r, "ECC point y size %zu is too large: %m", y_size);
TPMS_ECC_POINT point = {
.x = TPM2B_ECC_PARAMETER_MAKE(x, x_size),
.y = TPM2B_ECC_PARAMETER_MAKE(y, y_size),
};
_cleanup_free_ void *encrypted_seed = malloc(sizeof(point));
if (!encrypted_seed)
return log_oom_debug();
size_t encrypted_seed_size = 0;
rc = sym_Tss2_MU_TPMS_ECC_POINT_Marshal(&point, encrypted_seed, sizeof(point), &encrypted_seed_size);
if (rc != TPM2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal ECC point: %s", sym_Tss2_RC_Decode(rc));
r = tpm2_hash_alg_to_size(parent->publicArea.nameAlg);
if (r < 0)
return -EOPNOTSUPP;
size_t bits = (size_t) r * 8;
_cleanup_(erase_and_freep) void *seed = NULL;
size_t seed_size = 0; /* Explicit initialization to appease gcc */
r = tpm2_kdfe(parent->publicArea.nameAlg,
shared_secret,
shared_secret_size,
"DUPLICATE",
x,
x_size,
parent->publicArea.unique.ecc.x.buffer,
parent->publicArea.unique.ecc.x.size,
bits,
&seed,
&seed_size);
if (r < 0)
return log_debug_errno(r, "Could not calculate KDFe: %m");
*ret_seed = TAKE_PTR(seed);
*ret_seed_size = seed_size;
*ret_encrypted_seed = TAKE_PTR(encrypted_seed);
*ret_encrypted_seed_size = encrypted_seed_size;
return 0;
}
static int tpm2_calculate_seal_seed(
const TPM2B_PUBLIC *parent,
TPM2B_DIGEST *ret_seed,
TPM2B_ENCRYPTED_SECRET *ret_encrypted_seed) {
int r;
assert(parent);
assert(ret_seed);
assert(ret_encrypted_seed);
log_debug("Calculating encrypted seed for sealed object.");
_cleanup_(erase_and_freep) void *seed = NULL;
_cleanup_free_ void *encrypted_seed = NULL;
size_t seed_size = 0, encrypted_seed_size = 0; /* Explicit initialization to appease gcc */
if (parent->publicArea.type == TPM2_ALG_RSA)
r = tpm2_calculate_seal_rsa_seed(parent, &seed, &seed_size, &encrypted_seed, &encrypted_seed_size);
else if (parent->publicArea.type == TPM2_ALG_ECC)
r = tpm2_calculate_seal_ecc_seed(parent, &seed, &seed_size, &encrypted_seed, &encrypted_seed_size);
else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"Unsupported parent key type 0x%" PRIx16, parent->publicArea.type);
if (r < 0)
return log_debug_errno(r, "Could not calculate encrypted seed: %m");
*ret_seed = TPM2B_DIGEST_MAKE(seed, seed_size);
*ret_encrypted_seed = TPM2B_ENCRYPTED_SECRET_MAKE(encrypted_seed, encrypted_seed_size);
return 0;
}
#endif /* HAVE_OPENSSL */
int tpm2_calculate_seal(
TPM2_HANDLE parent_handle,
const TPM2B_PUBLIC *parent_public,
const TPMA_OBJECT *attributes,
const struct iovec *secret,
const TPM2B_DIGEST *policy,
const char *pin,
struct iovec *ret_secret,
struct iovec *ret_blob,
struct iovec *ret_serialized_parent) {
#if HAVE_OPENSSL
int r;
assert(parent_public);
assert(iovec_is_valid(secret));
assert(secret || ret_secret);
assert(!(secret && ret_secret)); /* Either provide a secret, or we create one, but not both */
assert(ret_blob);
assert(ret_serialized_parent);
log_debug("Calculating sealed object.");
/* Default to the SRK. */
if (parent_handle == 0)
parent_handle = TPM2_SRK_HANDLE;
switch (TPM2_HANDLE_TYPE(parent_handle)) {
case TPM2_HT_PERSISTENT:
case TPM2_HT_NV_INDEX:
break;
case TPM2_HT_TRANSIENT:
log_warning("Handle is transient, sealed secret may not be recoverable.");
break;
default:
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Handle 0x%" PRIx32 " not persistent, transient, or NV.",
parent_handle);
}
_cleanup_(iovec_done_erase) struct iovec generated_secret = {};
if (!secret) {
/* No secret provided, generate a random secret. We use SHA256 digest length, though it can
* be up to TPM2_MAX_SEALED_DATA. The secret length is not limited to the nameAlg hash
* size. */
r = crypto_random_bytes_allocate_iovec(TPM2_SHA256_DIGEST_SIZE, &generated_secret);
if (r < 0)
return log_debug_errno(r, "Failed to generate secret key: %m");
secret = &generated_secret;
}
if (secret->iov_len > TPM2_MAX_SEALED_DATA)
return log_debug_errno(SYNTHETIC_ERRNO(EOVERFLOW),
"Secret size %zu too large, limit is %d bytes.",
secret->iov_len, TPM2_MAX_SEALED_DATA);
TPM2B_DIGEST random_seed;
TPM2B_ENCRYPTED_SECRET seed;
r = tpm2_calculate_seal_seed(parent_public, &random_seed, &seed);
if (r < 0)
return r;
TPM2B_PUBLIC public;
r = tpm2_calculate_seal_public(parent_public, attributes, policy, &random_seed, secret->iov_base, secret->iov_len, &public);
if (r < 0)
return r;
TPM2B_NAME name;
r = tpm2_calculate_pubkey_name(&public.publicArea, &name);
if (r < 0)
return r;
TPM2B_PRIVATE private;
r = tpm2_calculate_seal_private(parent_public, &name, pin, &random_seed, secret->iov_base, secret->iov_len, &private);
if (r < 0)
return r;
_cleanup_(iovec_done) struct iovec blob = {};
r = tpm2_marshal_blob(&public, &private, &seed, &blob.iov_base, &blob.iov_len);
if (r < 0)
return log_debug_errno(r, "Could not create sealed blob: %m");
TPM2B_NAME parent_name;
r = tpm2_calculate_pubkey_name(&parent_public->publicArea, &parent_name);
if (r < 0)
return r;
_cleanup_(iovec_done) struct iovec serialized_parent = {};
r = tpm2_calculate_serialize(
parent_handle,
&parent_name,
parent_public,
&serialized_parent.iov_base,
&serialized_parent.iov_len);
if (r < 0)
return r;
if (ret_secret)
*ret_secret = TAKE_STRUCT(generated_secret);
*ret_blob = TAKE_STRUCT(blob);
*ret_serialized_parent = TAKE_STRUCT(serialized_parent);
return 0;
#else /* HAVE_OPENSSL */
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
int tpm2_make_policy_authorize_tbs_data(
const TPM2B_DIGEST *approved_digest,
const char *policy_ref_data,
struct iovec *ret_tbs_data) {
TPM2B_NONCE policy_ref;
assert(approved_digest);
assert(ret_tbs_data);
tpm2_make_policy_ref(policy_ref_data, &policy_ref);
/* The data to be signed for a TPM2_PolicyAuthorize() is the concatenation of the approved policy
* digest and the policy reference, as per TPM2 Spec Part 3, 23.16. */
_cleanup_(iovec_done) struct iovec tbs_data = {};
if (!iovec_append(&tbs_data, &IOVEC_MAKE(approved_digest->buffer, approved_digest->size)))
return log_oom_debug();
if (!iovec_append(&tbs_data, &IOVEC_MAKE(policy_ref.buffer, policy_ref.size)))
return log_oom_debug();
*ret_tbs_data = TAKE_STRUCT(tbs_data);
return 0;
}
int tpm2_seal(Tpm2Context *c,
uint32_t seal_key_handle,
const TPM2B_DIGEST policy[],
size_t n_policy,
const char *pin,
struct iovec *ret_secret,
struct iovec **ret_blobs,
size_t *ret_n_blobs,
uint16_t *ret_primary_alg,
struct iovec *ret_srk) {
uint16_t primary_alg = 0;
int r;
assert(ret_secret);
assert(ret_blobs);
assert(ret_n_blobs);
/* So here's what we do here: we connect to the TPM2 chip. It persistently contains a "seed" key that
* is randomized when the TPM2 is first initialized or reset and remains stable across boots. We
* generate a "primary" key pair derived from that (ECC if possible, RSA as fallback). Given the seed
* remains fixed this will result in the same key pair whenever we specify the exact same parameters
* for it. We then create a PCR-bound policy session, which calculates a hash on the current PCR
* values of the indexes we specify. We then generate a randomized key on the host (which is the key
* we actually enroll in the LUKS2 keyslots), which we upload into the TPM2, where it is encrypted
* with the "primary" key, taking the PCR policy session into account. We then download the encrypted
* key from the TPM2 ("sealing") and marshall it into binary form, which is ultimately placed in the
* LUKS2 JSON header.
*
* The TPM2 "seed" key and "primary" keys never leave the TPM2 chip (and cannot be extracted at
* all). The random key we enroll in LUKS2 we generate on the host using the Linux random device. It
* is stored in the LUKS2 JSON only in encrypted form with the "primary" key of the TPM2 chip, thus
* binding the unlocking to the TPM2 chip. */
usec_t start = now(CLOCK_MONOTONIC);
TPMA_OBJECT hmac_attributes =
TPMA_OBJECT_FIXEDTPM |
TPMA_OBJECT_FIXEDPARENT;
/* If protected by PIN, a user-selected low-entropy password, enable DA protection.
Without a PIN, the key's left protected only by a PCR policy, which does not benefit
from DA protection. */
hmac_attributes |= pin ? 0 : TPMA_OBJECT_NODA;
/* We use a keyed hash object (i.e. HMAC) to store the secret key we want to use for unlocking the
* LUKS2 volume with. We don't ever use for HMAC/keyed hash operations however, we just use it
* because it's a key type that is universally supported and suitable for symmetric binary blobs. */
TPMT_PUBLIC hmac_template = {
.type = TPM2_ALG_KEYEDHASH,
.nameAlg = TPM2_ALG_SHA256,
.objectAttributes = hmac_attributes,
.parameters.keyedHashDetail.scheme.scheme = TPM2_ALG_NULL,
.unique.keyedHash.size = SHA256_DIGEST_SIZE,
};
TPMS_SENSITIVE_CREATE hmac_sensitive = {
.data.size = hmac_template.unique.keyedHash.size,
};
CLEANUP_ERASE(hmac_sensitive);
if (pin) {
r = tpm2_auth_value_from_pin(TPM2_ALG_SHA256, pin, &hmac_sensitive.userAuth);
if (r < 0)
return r;
}
assert(sizeof(hmac_sensitive.data.buffer) >= hmac_sensitive.data.size);
(void) tpm2_credit_random(c);
_cleanup_(tpm2_handle_freep) Tpm2Handle *primary_handle = NULL;
if (ret_srk) {
_cleanup_(Esys_Freep) TPM2B_PUBLIC *primary_public = NULL;
if (IN_SET(seal_key_handle, 0, TPM2_SRK_HANDLE)) {
r = tpm2_get_or_create_srk(
c,
/* session= */ NULL,
&primary_public,
/* ret_name= */ NULL,
/* ret_qname= */ NULL,
&primary_handle);
if (r < 0)
return r;
} else if (IN_SET(TPM2_HANDLE_TYPE(seal_key_handle), TPM2_HT_TRANSIENT, TPM2_HT_PERSISTENT)) {
r = tpm2_object_index_to_handle(
c,
seal_key_handle,
/* session= */ NULL,
&primary_public,
/* ret_name= */ NULL,
/* ret_qname= */ NULL,
&primary_handle);
if (r < 0)
return r;
if (r == 0)
/* We do NOT automatically create anything other than the SRK */
return log_debug_errno(SYNTHETIC_ERRNO(ENOENT),
"No handle found at index 0x%" PRIx32, seal_key_handle);
} else
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Seal key handle 0x%" PRIx32 " is neither transient nor persistent.",
seal_key_handle);
primary_alg = primary_public->publicArea.type;
/* Propagate fixedTPM/fixedParent flags from sealing key to hmac key */
hmac_template.objectAttributes = (hmac_template.objectAttributes & ~(TPMA_OBJECT_FIXEDTPM|TPMA_OBJECT_FIXEDPARENT)) |
(primary_public->publicArea.objectAttributes & (TPMA_OBJECT_FIXEDTPM|TPMA_OBJECT_FIXEDPARENT));
} else {
if (seal_key_handle != 0)
log_debug("Using primary alg sealing, but seal key handle also provided; ignoring seal key handle.");
/* TODO: force all callers to provide ret_srk, so we can stop sealing with the legacy templates. */
primary_alg = TPM2_ALG_ECC;
TPM2B_PUBLIC template = {
.size = sizeof(TPMT_PUBLIC),
};
r = tpm2_get_legacy_template(primary_alg, &template.publicArea);
if (r < 0)
return log_debug_errno(r, "Could not get legacy ECC template: %m");
if (!tpm2_supports_tpmt_public(c, &template.publicArea)) {
primary_alg = TPM2_ALG_RSA;
r = tpm2_get_legacy_template(primary_alg, &template.publicArea);
if (r < 0)
return log_debug_errno(r, "Could not get legacy RSA template: %m");
if (!tpm2_supports_tpmt_public(c, &template.publicArea))
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"TPM does not support either ECC or RSA legacy template.");
}
r = tpm2_create_primary(
c,
/* session= */ NULL,
ESYS_TR_RH_OWNER,
&template,
/* sensitive= */ NULL,
/* ret_public= */ NULL,
&primary_handle);
if (r < 0)
return r;
}
_cleanup_(tpm2_handle_freep) Tpm2Handle *encryption_session = NULL;
r = tpm2_make_encryption_session(c, primary_handle, /* bind_key= */ NULL, &encryption_session);
if (r < 0)
return r;
log_debug("Generating secret key data.");
/* At least one shard, and if we have multiple policies, then we need one shard for each */
size_t n_shards = MAX(n_policy, 1U);
/* Create a large secret which covers all shards we need */
_cleanup_(iovec_done_erase) struct iovec secret = {};
r = crypto_random_bytes_allocate_iovec(hmac_sensitive.data.size * n_shards, &secret);
if (r < 0)
return log_debug_errno(r, "Failed to generate secret key: %m");
struct iovec *blobs = new0(struct iovec, n_shards);
size_t n_blobs = 0;
CLEANUP_ARRAY(blobs, n_blobs, iovec_array_free);
for (size_t shard = 0; shard < n_shards; shard++) {
/* Patch this shard's policy into the template */
if (shard < n_policy)
hmac_template.authPolicy = policy[shard];
else
hmac_template.authPolicy = TPM2B_DIGEST_MAKE(NULL, TPM2_SHA256_DIGEST_SIZE);
/* Copy in this shard's secret key */
memcpy(hmac_sensitive.data.buffer,
(const uint8_t*) secret.iov_base + (hmac_sensitive.data.size * shard),
hmac_sensitive.data.size);
log_debug("Creating HMAC key on TPM for shard %zu.", shard);
_cleanup_(Esys_Freep) TPM2B_PUBLIC *public = NULL;
_cleanup_(Esys_Freep) TPM2B_PRIVATE *private = NULL;
r = tpm2_create(c, primary_handle, encryption_session, &hmac_template, &hmac_sensitive, &public, &private);
if (r < 0)
return r;
log_debug("Marshalling private and public part of HMAC key for shard %zu.", shard);
r = tpm2_marshal_blob(public, private, /* seed= */ NULL, &blobs[n_blobs].iov_base, &blobs[n_blobs].iov_len);
if (r < 0)
return log_debug_errno(r, "Could not create sealed blob: %m");
n_blobs++;
}
if (DEBUG_LOGGING)
log_debug("Completed TPM2 key sealing in %s.", FORMAT_TIMESPAN(now(CLOCK_MONOTONIC) - start, 1));
if (ret_srk) {
r = tpm2_serialize(c, primary_handle, ret_srk);
if (r < 0)
return r;
}
*ret_secret = TAKE_STRUCT(secret);
*ret_blobs = TAKE_PTR(blobs);
*ret_n_blobs = n_blobs;
if (ret_primary_alg)
*ret_primary_alg = primary_alg;
return 0;
}
#define RETRY_UNSEAL_MAX 30u
int tpm2_unseal(Tpm2Context *c,
uint32_t hash_pcr_mask,
uint16_t pcr_bank,
const struct iovec *pubkey,
const char *pubkey_policy_ref,
uint32_t pubkey_pcr_mask,
sd_json_variant *signature,
const char *pin,
const Tpm2PCRLockPolicy *pcrlock_policy,
uint16_t primary_alg,
const struct iovec blobs[],
size_t n_blobs,
const struct iovec known_policy_hash[],
size_t n_known_policy_hash,
const struct iovec *srk,
struct iovec *ret_secret) {
/* Returns the following errors:
*
* -EREMOTE → blob is from a different TPM
* -EADDRNOTAVAIL → NV index referenced by policy is missing, unwritten, or unusable
* -ENOSTR → signature JSON has no matching entry for the current PCR policy
* -EDEADLK → couldn't create primary key because authorization failure
* -ENOLCK → TPM is in dictionary lockout mode
* -EREMCHG → submitted policy doesn't match NV index stored policy (in case of PolicyAuthorizeNV)
* -ENOANO → none of the PolicyOR branches of a policy matched current state
* -EUCLEAN → PCR state doesn't match expectations
* -EPERM → stored policy does not match TPM state
* -ENOTRECOVERABLE → all other kinds of TPM errors
* -EILSEQ → bad PIN
*
* Of these all four of EREMCHG, ENOANO, EUCLEAN, EPERM can all mean that PCR state is not matching
* expectations. */
TSS2_RC rc;
int r;
assert(n_blobs > 0);
assert(blobs);
assert(iovec_is_valid(pubkey));
assert(!pubkey_policy_ref || iovec_is_set(pubkey));
assert(ret_secret);
assert(TPM2_PCR_MASK_VALID(hash_pcr_mask));
assert(TPM2_PCR_MASK_VALID(pubkey_pcr_mask));
/* So here's what we do here: We connect to the TPM2 chip. As we do when sealing we generate a
* "primary" key on the TPM2 chip, with the same parameters as well as a PCR-bound policy session.
* Given we pass the same parameters, this will result in the same "primary" key, and same policy
* hash (the latter of course, only if the PCR values didn't change in between). We unmarshal the
* encrypted key we stored in the LUKS2 JSON token header and upload it into the TPM2, where it is
* decrypted if the seed and the PCR policy were right ("unsealing"). We then download the result,
* and use it to unlock the LUKS2 volume. */
usec_t start = now(CLOCK_MONOTONIC);
size_t n_shards = pcrlock_policy && iovec_is_set(pubkey) ? 2 : 1;
if (n_blobs != n_shards)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Number of provided key blobs (%zu) does not match policy requirements (%zu).", n_blobs, n_shards);
if (n_known_policy_hash > 0 && n_known_policy_hash != n_shards)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Number of provided known policy hashes (%zu) does not match policy requirements (%zu or 0).", n_known_policy_hash, n_shards);
/* Older code did not save the pcr_bank, and unsealing needed to detect the best pcr bank to use,
* so we need to handle that legacy situation. Use the legacy variant, which only ever picks SHA256 or SHA1. */
if (pcr_bank == UINT16_MAX) {
r = tpm2_get_best_pcr_bank_legacy(c, hash_pcr_mask|pubkey_pcr_mask, &pcr_bank);
if (r < 0)
return r;
}
_cleanup_(tpm2_handle_freep) Tpm2Handle *primary_handle = NULL;
r = tpm2_deserialize(c, srk, &primary_handle);
if (r < 0)
return r;
if (r == 0) {
/* ECC was the only supported algorithm in systemd < 250, use that as implied default, for compatibility */
if (primary_alg == 0)
primary_alg = TPM2_ALG_ECC;
TPM2B_PUBLIC template = {
.size = sizeof(TPMT_PUBLIC),
};
r = tpm2_get_legacy_template(primary_alg, &template.publicArea);
if (r < 0)
return log_debug_errno(r, "Could not get legacy template: %m");
r = tpm2_create_primary(
c,
/* session= */ NULL,
ESYS_TR_RH_OWNER,
&template,
/* sensitive= */ NULL,
/* ret_public= */ NULL,
&primary_handle);
if (r < 0)
return r;
}
TPM2B_PUBLIC pubkey_tpm2b;
_cleanup_(iovec_done) struct iovec fp = {};
if (iovec_is_set(pubkey)) {
r = tpm2_tpm2b_public_from_pem(pubkey->iov_base, pubkey->iov_len, &pubkey_tpm2b);
if (r < 0)
return log_debug_errno(r, "Could not create TPMT_PUBLIC: %m");
r = tpm2_tpm2b_public_to_fingerprint(&pubkey_tpm2b, &fp.iov_base, &fp.iov_len);
if (r < 0)
return log_debug_errno(r, "Could not get key fingerprint: %m");
}
_cleanup_(iovec_done_erase) struct iovec secret = {};
for (unsigned i = RETRY_UNSEAL_MAX;; i--) {
bool retry = false;
iovec_done_erase(&secret); /* clear data from previous unseal attempt */
for (size_t shard = 0; shard < n_blobs; shard++) {
TPM2B_PUBLIC public;
TPM2B_PRIVATE private;
TPM2B_ENCRYPTED_SECRET seed = {};
r = tpm2_unmarshal_blob(blobs[shard].iov_base, blobs[shard].iov_len, &public, &private, &seed);
if (r < 0)
return log_debug_errno(r, "Could not extract parts from blob: %m");
if (seed.size > 0) {
/* This is a calculated (or duplicated) sealed object, and must be imported. */
_cleanup_free_ TPM2B_PRIVATE *imported_private = NULL;
r = tpm2_import(c,
primary_handle,
/* session= */ NULL,
&public,
&private,
&seed,
/* encryption_key= */ NULL,
/* symmetric= */ NULL,
&imported_private);
if (r < 0)
return r;
private = *imported_private;
}
log_debug("Loading HMAC key into TPM for shard %zu.", shard);
/* Nothing sensitive on the bus, no need for encryption. Even if an attacker gives
* you back a different key, the session initiation will fail. In the SRK model, the
* tpmKey is verified. In the non-srk model, with pin, the bindKey provides
* protections. */
_cleanup_(tpm2_handle_freep) Tpm2Handle *hmac_key = NULL;
r = tpm2_load(c, primary_handle, NULL, &public, &private, &hmac_key);
if (r < 0)
return r;
/* If a PIN is set for the seal object, use it to bind the session key to that
* object. This prevents active bus interposers from faking a TPM and seeing the
* unsealed value. An active interposer could fake a TPM, satisfying the encrypted
* session, and just forward everything to the *real* TPM. */
r = tpm2_set_auth(c, hmac_key, pin);
if (r < 0)
return r;
_cleanup_(tpm2_handle_freep) Tpm2Handle *encryption_session = NULL;
r = tpm2_make_encryption_session(c, primary_handle, hmac_key, &encryption_session);
if (r < 0)
return r;
_cleanup_(tpm2_handle_freep) Tpm2Handle *policy_session = NULL;
_cleanup_(Esys_Freep) TPM2B_DIGEST *policy_digest = NULL;
r = tpm2_make_policy_session(
c,
primary_handle,
encryption_session,
&policy_session);
if (r < 0)
return r; /* Will return EILSEQ on auth failure (i.e. bad PIN) */
/* If both public PCR key and pcrlock policies are requested, then generate the
* public PCR policy for the first shared, and the pcrlock policy for the 2nd */
r = tpm2_build_sealing_policy(
c,
policy_session,
hash_pcr_mask,
pcr_bank,
shard == 0 && iovec_is_set(pubkey) ? &pubkey_tpm2b : NULL,
shard == 0 ? pubkey_policy_ref : NULL,
fp.iov_base, fp.iov_len,
shard == 0 ? pubkey_pcr_mask : 0,
signature,
!!pin,
(shard == 1 || !iovec_is_set(pubkey)) ? pcrlock_policy : NULL,
&policy_digest);
if (r == -EUCLEAN && i > 0) {
log_debug("A PCR value changed during the TPM2 policy session, restarting HMAC key unsealing (%u tries left).", i);
retry = true;
break;
}
if (r < 0)
return r;
/* If we know the policy hash to expect, and it doesn't match, we can shortcut things here, and not
* wait until the TPM2 tells us to go away. */
if (n_known_policy_hash > 0 && memcmp_nn(policy_digest->buffer,
policy_digest->size,
known_policy_hash[shard].iov_base,
known_policy_hash[shard].iov_len) != 0) {
#if HAVE_OPENSSL
if (shard == 0 &&
iovec_is_set(pubkey) &&
pubkey_tpm2b.publicArea.type == TPM2_ALG_RSA &&
pubkey_tpm2b.publicArea.parameters.rsaDetail.exponent == TPM2_RSA_DEFAULT_EXPONENT) {
/* Due to bug #30546, if using RSA pubkey with the default exponent, we may
* need to set the exponent to the TPM special-case value of 0 and retry. */
log_debug("Policy hash mismatch, retrying with RSA pubkey exponent set to 0.");
pubkey_tpm2b.publicArea.parameters.rsaDetail.exponent = 0;
retry = true;
break;
}
#endif
return log_debug_errno(SYNTHETIC_ERRNO(EPERM),
"Current policy digest does not match stored policy digest, cancelling "
"TPM2 authentication attempt.");
}
log_debug("Unsealing HMAC key for shard %zu.", shard);
_cleanup_(tpm2b_sensitive_data_erase_and_esys_freep) TPM2B_SENSITIVE_DATA* unsealed = NULL;
rc = sym_Esys_Unseal(
c->esys_context,
hmac_key->esys_handle,
policy_session->esys_handle,
encryption_session->esys_handle, /* use HMAC session to enable parameter encryption */
ESYS_TR_NONE,
&unsealed);
if (rc == TPM2_RC_PCR_CHANGED && i > 0) {
log_debug("A PCR value changed during the TPM2 policy session, restarting HMAC key unsealing (%u tries left).", i);
retry = true;
break;
}
if (rc != TPM2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unseal HMAC key in TPM: %s", sym_Tss2_RC_Decode(rc));
if (!iovec_append(&secret, &IOVEC_MAKE(unsealed->buffer, unsealed->size)))
return log_oom_debug();
}
if (!retry)
break;
}
if (DEBUG_LOGGING)
log_debug("Completed TPM2 key unsealing in %s.", FORMAT_TIMESPAN(now(CLOCK_MONOTONIC) - start, 1));
*ret_secret = TAKE_STRUCT(secret);
return 0;
}
static TPM2_HANDLE generate_random_nv_index(void) {
return TPM2_NV_INDEX_UNASSIGNED_FIRST +
(TPM2_HANDLE) random_u64_range(TPM2_NV_INDEX_UNASSIGNED_LAST - TPM2_NV_INDEX_UNASSIGNED_FIRST + 1);
}
int tpm2_define_policy_nv_index(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2_HANDLE requested_nv_index,
const TPM2B_DIGEST *write_policy,
TPM2_HANDLE *ret_nv_index,
Tpm2Handle **ret_nv_handle,
TPM2B_NV_PUBLIC *ret_nv_public) {
_cleanup_(tpm2_handle_freep) Tpm2Handle *new_handle = NULL;
TSS2_RC rc;
int r;
assert(c);
/* Allocates an nvindex to store a policy for use in PolicyAuthorizeNV in. This is where pcrlock then
* stores its predicted PCR policies in. If 'requested_nv_index' will try to allocate the specified
* nvindex, otherwise will find a free one, and use that. */
r = tpm2_handle_new(c, &new_handle);
if (r < 0)
return r;
new_handle->flush = false; /* This is a persistent NV index, don't flush hence */
for (unsigned try = 0; try < 25U; try++) {
TPM2_HANDLE nv_index;
if (requested_nv_index != 0)
nv_index = requested_nv_index;
else
nv_index = generate_random_nv_index();
TPM2B_NV_PUBLIC public_info = {
.size = sizeof_field(TPM2B_NV_PUBLIC, nvPublic),
.nvPublic = {
.nvIndex = nv_index,
.nameAlg = TPM2_ALG_SHA256,
.attributes = TPM2_NT_ORDINARY | TPMA_NV_WRITEALL | TPMA_NV_POLICYWRITE | TPMA_NV_OWNERREAD,
.dataSize = offsetof(TPMT_HA, digest) + tpm2_hash_alg_to_size(TPM2_ALG_SHA256),
},
};
if (write_policy)
public_info.nvPublic.authPolicy = *write_policy;
rc = sym_Esys_NV_DefineSpace(
c->esys_context,
/* authHandle= */ ESYS_TR_RH_OWNER,
/* shandle1= */ session ? session->esys_handle : ESYS_TR_PASSWORD,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
/* auth= */ NULL,
&public_info,
&new_handle->esys_handle);
if (rc == TSS2_RC_SUCCESS) {
log_debug("NV Index 0x%" PRIx32 " successfully allocated.", nv_index);
if (ret_nv_index)
*ret_nv_index = nv_index;
if (ret_nv_handle)
*ret_nv_handle = TAKE_PTR(new_handle);
if (ret_nv_public)
*ret_nv_public = public_info;
return 0;
}
if (rc != TPM2_RC_NV_DEFINED)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to allocate NV index: %s", sym_Tss2_RC_Decode(rc));
if (requested_nv_index != 0) {
assert(nv_index == requested_nv_index);
return log_debug_errno(SYNTHETIC_ERRNO(EEXIST),
"Requested NV index 0x%" PRIx32 " already taken.", requested_nv_index);
}
log_debug("NV index 0x%" PRIu32 " already taken, trying another one (%u tries left)", nv_index, try);
}
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Too many attempts trying to allocate NV index: %s", sym_Tss2_RC_Decode(rc));
}
int tpm2_write_policy_nv_index(
Tpm2Context *c,
const Tpm2Handle *policy_session,
TPM2_HANDLE nv_index,
const Tpm2Handle *nv_handle,
const TPM2B_DIGEST *policy_digest) {
TSS2_RC rc;
assert(c);
assert(policy_session);
assert(nv_handle);
assert(policy_digest);
if (policy_digest->size != tpm2_hash_alg_to_size(TPM2_ALG_SHA256))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Policy to store in NV index has wrong size.");
TPMT_HA ha = {
.hashAlg = TPM2_ALG_SHA256,
};
assert(policy_digest->size <= sizeof_field(TPMT_HA, digest));
memcpy_safe(&ha.digest, policy_digest->buffer, policy_digest->size);
TPM2B_MAX_NV_BUFFER buffer = {};
size_t written = 0;
rc = sym_Tss2_MU_TPMT_HA_Marshal(&ha, buffer.buffer, sizeof(buffer.buffer), &written);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to marshal policy digest.");
buffer.size = written;
rc = sym_Esys_NV_Write(
c->esys_context,
/* authHandle= */ nv_handle->esys_handle,
/* nvIndex= */ nv_handle->esys_handle,
/* shandle1= */ policy_session->esys_handle,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
&buffer,
/* offset= */ 0);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to write NV index: %s", sym_Tss2_RC_Decode(rc));
if (DEBUG_LOGGING) {
_cleanup_free_ char *h = NULL;
h = hexmem(policy_digest->buffer, policy_digest->size);
log_debug("Written policy digest %s to NV index 0x%x", strnull(h), nv_index);
}
return 0;
}
#if HAVE_OPENSSL
/* Calculates the write policy of a NvPCR, which is TPM2_PolicyAuthorize OR TPM2_PolicyNvWritten(true),
* where the authorized policy is bound to the supplied public key and policy ref. Returns the overall write
* policy, and optionally, the PolicyAuthorize branch digest (which the extend path needs later on in order
* to reconstruct the PolicyOR). */
static int tpm2_nvpcr_calculate_write_policy(
const TPM2B_PUBLIC *public,
const char *pubkey_policy_ref,
TPM2B_DIGEST *ret_authorize_policy,
TPM2B_DIGEST *ret_write_policy) {
int r;
assert(public);
assert(ret_write_policy);
TPM2B_NONCE policy_ref;
tpm2_make_policy_ref(pubkey_policy_ref, &policy_ref);
/* Branch order matters here and must match the reconstruction in tpm2_nvpcr_open_write_session. */
TPM2B_DIGEST branches[2] = {
TPM2B_DIGEST_MAKE(NULL, SHA256_DIGEST_SIZE), /* PolicyAuthorize branch */
TPM2B_DIGEST_MAKE(NULL, SHA256_DIGEST_SIZE), /* PolicyNvWritten branch */
};
r = tpm2_calculate_policy_authorize(public, &policy_ref, &branches[0]);
if (r < 0)
return r;
r = tpm2_calculate_policy_nv_written(/* written_set= */ true, &branches[1]);
if (r < 0)
return r;
TPM2B_DIGEST write_policy = TPM2B_DIGEST_MAKE(NULL, SHA256_DIGEST_SIZE);
r = tpm2_calculate_policy_or(branches, ELEMENTSOF(branches), &write_policy);
if (r < 0)
return r;
if (ret_authorize_policy)
*ret_authorize_policy = branches[0];
*ret_write_policy = write_policy;
return 0;
}
#endif
int tpm2_define_data_nv_index(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2_HANDLE requested_nv_index,
const struct iovec *data,
TPM2_HANDLE *ret_nv_index,
Tpm2Handle **ret_nv_handle) {
_cleanup_(tpm2_handle_freep) Tpm2Handle *new_handle = NULL;
TPM2_HANDLE nv_index = 0;
TSS2_RC rc;
int r;
assert(c);
assert(iovec_is_set(data));
/* Allocates an ordinary NV index sized to hold 'data' and writes 'data' into it. The index is created
* with AUTHREAD/AUTHWRITE attributes so it can be read back with tpm2_read_nv_index(). */
if (data->iov_len == 0 || data->iov_len > UINT16_MAX)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Invalid NV index data size %zu.", data->iov_len);
r = tpm2_handle_new(c, &new_handle);
if (r < 0)
return r;
new_handle->flush = false; /* This is a persistent NV index, don't flush hence */
for (unsigned try = 0;; try++) {
if (requested_nv_index != 0)
nv_index = requested_nv_index;
else
nv_index = generate_random_nv_index();
TPM2B_NV_PUBLIC public_info = {
.size = sizeof_field(TPM2B_NV_PUBLIC, nvPublic),
.nvPublic = {
.nvIndex = nv_index,
.nameAlg = TPM2_ALG_SHA256,
.attributes = TPM2_NT_ORDINARY | TPMA_NV_AUTHWRITE | TPMA_NV_AUTHREAD | TPMA_NV_NO_DA,
.dataSize = data->iov_len,
},
};
rc = sym_Esys_NV_DefineSpace(
c->esys_context,
/* authHandle= */ ESYS_TR_RH_OWNER,
/* shandle1= */ session ? session->esys_handle : ESYS_TR_PASSWORD,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
/* auth= */ NULL,
&public_info,
&new_handle->esys_handle);
if (rc == TSS2_RC_SUCCESS)
break;
if (rc != TPM2_RC_NV_DEFINED)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to allocate NV index: %s", sym_Tss2_RC_Decode(rc));
if (requested_nv_index != 0) {
assert(nv_index == requested_nv_index);
return log_debug_errno(SYNTHETIC_ERRNO(EEXIST),
"Requested NV index 0x%" PRIx32 " already taken.", requested_nv_index);
}
if (try >= 24U)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Too many attempts trying to allocate NV index: %s", sym_Tss2_RC_Decode(rc));
log_debug("NV index 0x%" PRIx32 " already taken, trying another one (%u tries left)", nv_index, 24U - try);
}
log_debug("NV index 0x%" PRIx32 " successfully allocated.", nv_index);
/* TPM2_NV_Write is bounded by TPM_PT_NV_BUFFER_MAX just like TPM2_NV_Read, so write in chunks no
* larger than what the TPM accepts in a single command. */
size_t max_buffer_size = MIN((size_t) c->max_nv_buffer_size, (size_t) TPM2_MAX_NV_BUFFER_SIZE);
assert(max_buffer_size > 0);
for (size_t offset = 0; offset < data->iov_len;) {
size_t chunk_size = MIN(data->iov_len - offset, max_buffer_size);
TPM2B_MAX_NV_BUFFER buffer = { .size = chunk_size };
memcpy(buffer.buffer, (const uint8_t*) data->iov_base + offset, chunk_size);
rc = sym_Esys_NV_Write(
c->esys_context,
/* authHandle= */ new_handle->esys_handle,
/* nvIndex= */ new_handle->esys_handle,
/* shandle1= */ session ? session->esys_handle : ESYS_TR_PASSWORD,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
&buffer,
/* offset= */ offset);
if (rc != TSS2_RC_SUCCESS) {
(void) tpm2_undefine_nv_index(c, session, nv_index, new_handle);
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to write NV index 0x%" PRIx32 ": %s", nv_index, sym_Tss2_RC_Decode(rc));
}
offset += chunk_size;
}
if (ret_nv_index)
*ret_nv_index = nv_index;
if (ret_nv_handle)
*ret_nv_handle = TAKE_PTR(new_handle);
return 0;
}
int tpm2_undefine_nv_index(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2_HANDLE nv_index,
const Tpm2Handle *nv_handle) {
TSS2_RC rc;
assert(c);
assert(nv_handle);
rc = sym_Esys_NV_UndefineSpace(
c->esys_context,
/* authHandle= */ ESYS_TR_RH_OWNER,
/* nvIndex= */ nv_handle->esys_handle,
/* shandle1= */ session ? session->esys_handle : ESYS_TR_PASSWORD,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to undefine NV index: %s", sym_Tss2_RC_Decode(rc));
log_debug("Successfully undefined NV index 0x%x.", nv_index);
return 0;
}
#if HAVE_OPENSSL
static int tpm2_reuse_or_redefine_nvpcr_nv_index(
Tpm2Context *c,
const Tpm2Handle *session,
bool exhausted,
TPM2_HANDLE nv_index,
const TPM2B_NV_PUBLIC *nv_public_info,
Tpm2Handle **ret_nv_handle) {
int r;
TSS2_RC rc;
assert(c);
assert(nv_public_info);
assert(ret_nv_handle);
log_debug("Checking if there is an existing NV index 0x%" PRIx32 " that can be reused as the requested NvPCR.", nv_index);
_cleanup_(Esys_Freep) TPM2B_NV_PUBLIC *nv_public_real = NULL;
_cleanup_(Esys_Freep) TPM2B_NAME *nv_name_real = NULL;
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
r = tpm2_nv_index_to_handle(
c,
nv_index,
session,
&nv_public_real,
&nv_name_real,
&handle);
if (r <= 0)
return log_debug_errno(r < 0 ? r : SYNTHETIC_ERRNO(ENOENT),
"Failed to acquire handle to NV index 0x%" PRIx32 ".", nv_index);
/* Check if the existing index has the same name as the one we're trying to define. We expect
* this on any system where this NvPCR was created with the current pubkey on a previous
* boot, and it should always be uninitialized (ie, TPMA_NV_WRITTEN unset) at this point. */
TPM2B_NAME nv_name_expected;
r = tpm2_calculate_nv_index_name(&nv_public_info->nvPublic, &nv_name_expected);
if (r < 0)
return log_debug_errno(r, "Failed to compute expected NvPCR index name");
if (memcmp_nn(nv_name_expected.name, nv_name_expected.size, nv_name_real->name, nv_name_real->size) == 0) {
log_debug("NV index 0x%" PRIx32 " for NvPCR already exists and not yet initialized, reusing.", nv_index);
*ret_nv_handle = TAKE_PTR(handle);
return 0;
}
/* If space for this orderly type is exhausted, don't try to redefine the index if the one we're
* going to create has a size that is larger than the one we need to undefine. Note that this only
* considers the data size of the 2 indices. Whilst the size of the authorization policy and the
* maximum size of the authorization value are dependent on the name algorithm, the reference TPM
* implementation stores the TPMS_NV_PUBLIC and TPM2B_AUTH structures using a fixed size. */
if (exhausted &&
(nv_public_info->nvPublic.attributes & TPMA_NV_ORDERLY) == (nv_public_real->nvPublic.attributes & TPMA_NV_ORDERLY) &&
nv_public_info->nvPublic.dataSize > nv_public_real->nvPublic.dataSize)
return log_debug_errno(SYNTHETIC_ERRNO(ENOBUFS),
"NV space is exhausted and undefining the existing NV index 0x%" PRIx32 " won't "
"free sufficient space to allocate the NvPCR.", nv_index);
/* Check if the existing index looks like it might have been a NvPCR - it might have a
* policy that's different because the signing key for the PolicyAuthorize assertion changed,
* or it might be an old style NvPCR. In this case, we'll undefine it and create a new one.
* This handles updates from old style NvPCRs, and rotation of the authorized policy signing
* key. We just check the attributes here - we know that the nvIndex is the same, and the
* dataSize for a valid extend index matches the size of nameAlg so we don't need to check that. */
const TPMA_NV old_expected_attrs =
TPMA_NV_CLEAR_STCLEAR |
TPMA_NV_OWNERWRITE |
TPMA_NV_AUTHWRITE |
TPMA_NV_OWNERREAD |
TPMA_NV_AUTHREAD |
(TPM2_NT_EXTEND << TPMA_NV_TPM2_NT_SHIFT);
if ((((nv_public_real->nvPublic.attributes ^ nv_public_info->nvPublic.attributes) & ~(TPMA_NV_WRITTEN | TPMA_NV_ORDERLY)) != 0) &&
(((nv_public_real->nvPublic.attributes ^ old_expected_attrs) & ~(TPMA_NV_WRITTEN | TPMA_NV_ORDERLY)) != 0))
return log_debug_errno(SYNTHETIC_ERRNO(EEXIST),
"Existing nvindex 0x%" PRIx32 " does not have the attributes expected for a NvPCR.", nv_index);
/* At this point, the existing index looks like a NvPCR - either one that was authenticated using a
* previous signing key or an old style NvPCR. We'll attempt to replace it with a new one. As we are
* replacing an existing one, we do this regardless of whether a previous call indicated that NV
* space is exhausted because it might still work. */
log_debug("Public info for nvindex 0x%" PRIx32 " looks like an existing NvPCR, replacing.", nv_index);
/* Undefine the existing index. */
r = tpm2_undefine_nv_index(c, session, nv_index, handle);
if (r < 0)
return log_debug_errno(r, "Failed to undefine existing nvindex 0x%" PRIx32 ".", nv_index);
/* Try to create the replacement index. */
_cleanup_(tpm2_handle_freep) Tpm2Handle *new_handle = NULL;
r = tpm2_handle_new(c, &new_handle);
if (r < 0)
return r;
new_handle->flush = false;
rc = sym_Esys_NV_DefineSpace(
c->esys_context,
/* authHandle= */ ESYS_TR_RH_OWNER,
/* shandle1= */ session ? session->esys_handle : ESYS_TR_PASSWORD,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
/* auth= */ NULL,
nv_public_info,
&new_handle->esys_handle);
if (rc == TPM2_RC_NV_SPACE)
return log_debug_errno(SYNTHETIC_ERRNO(ENOBUFS),
"NV index space on TPM exhausted, cannot allocate NvPCR.");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to allocate NvPCR index: %s", sym_Tss2_RC_Decode(rc));
*ret_nv_handle = TAKE_PTR(new_handle);
return 1;
}
static int tpm2_define_nvpcr_nv_index(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2_HANDLE nv_index,
TPMI_ALG_HASH algorithm,
const TPM2B_PUBLIC *public,
const char *pubkey_policy_ref,
bool orderly,
TPM2B_DIGEST *ret_authorize_policy,
Tpm2Handle **ret_nv_handle) {
TSS2_RC rc;
int r;
assert(c);
assert(public);
/* Allocates an nvindex to use as a "fake" PCR. We call these "NvPCR" in our codebase. The index is
* created to require a policy for writing, so that the first write (which sets TPMA_NV_WRITTEN)
* requires a signed PolicyAuthorize authorization, while all subsequent writes can be performed using
* a PolicyNvWritten(true) branch without any further authorization. The intention here is that a
* NvPCR can only be defined and initialized for as long as the authorized policy can be satisfied
* (ie, during an early boot phase). Once the authorized policy can no longer be satisfied (ie, after
* the early boot has ended), it is no longer possible to redefine and initialize the same NvPCR in
* order to spoof its measurements. */
log_debug("Allocating NvPCR index 0x%" PRIx32 ".", nv_index);
if (algorithm == 0)
algorithm = TPM2_ALG_SHA256;
int digest_size = tpm2_hash_alg_to_size(algorithm);
if (digest_size < 0)
return digest_size;
if ((size_t) digest_size > sizeof_field(TPM2B_MAX_NV_BUFFER, buffer))
return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), "Digest too large for extension.");
/* If we already ran into NV index space exhaustion for this orderly mode during this boot, don't
* bother trying again — the situation is unlikely to improve until reboot. We track this via a flag
* file in /run/, with a separate file for orderly and non-orderly NvPCRs, since the two draw on
* different TPM resources (RAM-backed vs. NVRAM-backed). */
const char *exhausted_flag = orderly ?
"/run/systemd/tpm2-nv-space-exhausted-orderly" :
"/run/systemd/tpm2-nv-space-exhausted-non-orderly";
/* Calculate the write policy, which is TPM2_PolicyAuthorize() OR TPM2_PolicyNvWritten(true). The
* PolicyAuthorize() branch is used for the first write, but we need to retain the digest of that so
* that we can reconstruct the digests used for the TPM2_PolicyOR() assertion on subsequent writes. */
TPM2B_DIGEST authorize_policy, write_policy;
r = tpm2_nvpcr_calculate_write_policy(public, pubkey_policy_ref, &authorize_policy, &write_policy);
if (r < 0)
return r;
TPM2B_NV_PUBLIC public_info = {
.size = sizeof_field(TPM2B_NV_PUBLIC, nvPublic),
.nvPublic = {
.nvIndex = nv_index,
.nameAlg = algorithm,
.attributes = TPMA_NV_CLEAR_STCLEAR |
(orderly ? TPMA_NV_ORDERLY : 0) |
TPMA_NV_POLICYWRITE |
TPMA_NV_OWNERREAD |
TPMA_NV_AUTHREAD |
(TPM2_NT_EXTEND << TPMA_NV_TPM2_NT_SHIFT),
.dataSize = digest_size,
.authPolicy = write_policy,
},
};
if (access(exhausted_flag, F_OK) == 0) {
log_debug("TPM NV index space previously found exhausted (%s exists), refusing to allocate %s NvPCR, but checking if it already exists.",
exhausted_flag, orderly ? "orderly" : "non-orderly");
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
r = tpm2_reuse_or_redefine_nvpcr_nv_index(c, session, /* exhausted= */ true, nv_index, &public_info, &handle);
if (r == -ENOENT)
r = -ENOBUFS;
if (r < 0)
return log_debug_errno(r, "No existing NvPCR index 0x%" PRIx32 " and NV space is exhausted.", nv_index);
log_debug("NV index 0x%" PRIx32 " successfully %s for NvPCR.", nv_index, r == 0 ? "reused" : "reallocated");
if (ret_authorize_policy)
*ret_authorize_policy = authorize_policy;
if (ret_nv_handle)
*ret_nv_handle = TAKE_PTR(handle);
return r;
}
if (errno != ENOENT)
log_debug_errno(errno, "Failed to check whether %s exists, assuming it does not: %m", exhausted_flag);
_cleanup_(tpm2_handle_freep) Tpm2Handle *new_handle = NULL;
r = tpm2_handle_new(c, &new_handle);
if (r < 0)
return r;
new_handle->flush = false; /* This is a persistent NV index, don't flush hence */
rc = sym_Esys_NV_DefineSpace(
c->esys_context,
/* authHandle= */ ESYS_TR_RH_OWNER,
/* shandle1= */ session ? session->esys_handle : ESYS_TR_PASSWORD,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
/* auth= */ NULL,
&public_info,
&new_handle->esys_handle);
if (rc == TPM2_RC_NV_SPACE) {
/* Remember that we ran out of NV index space for this orderly mode, so that we don't keep
* retrying the (doomed) allocation until reboot. */
r = touch(exhausted_flag);
if (r < 0)
log_debug_errno(r, "Failed to create %s flag file, ignoring: %m", exhausted_flag);
return log_debug_errno(SYNTHETIC_ERRNO(ENOBUFS),
"NV index space on TPM exhausted, cannot allocate NvPCR.");
}
if (rc == TSS2_RC_SUCCESS) {
log_debug("NV index 0x%" PRIx32 " successfully allocated for NvPCR.", nv_index);
if (ret_authorize_policy)
*ret_authorize_policy = authorize_policy;
if (ret_nv_handle)
*ret_nv_handle = TAKE_PTR(new_handle);
return 1;
}
if (rc != TPM2_RC_NV_DEFINED)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to allocate NV index: %s", sym_Tss2_RC_Decode(rc));
log_debug("NV index 0x%" PRIx32 " already registered.", nv_index);
_cleanup_(tpm2_handle_freep) Tpm2Handle *handle = NULL;
r = tpm2_reuse_or_redefine_nvpcr_nv_index(c, session, /* exhausted= */ false, nv_index, &public_info, &handle);
if (r == -ENOBUFS) {
/* Remember that we ran out of NV index space for this orderly mode, so that we don't keep
* retrying the (doomed) allocation until reboot. */
r = touch(exhausted_flag);
if (r < 0)
log_debug_errno(r, "Failed to create %s flag file, ignoring: %m", exhausted_flag);
return log_debug_errno(SYNTHETIC_ERRNO(ENOBUFS),
"NV index space on TPM exhausted, cannot re-allocate NvPCR.");
}
if (r < 0)
return r;
log_debug("NV index 0x%" PRIx32 " successfully %s for NvPCR.", nv_index, r == 0 ? "reused" : "reallocated");
if (ret_authorize_policy)
*ret_authorize_policy = authorize_policy;
if (ret_nv_handle)
*ret_nv_handle = TAKE_PTR(handle);
return r;
}
static int tpm2_extend_nvpcr_nv_index(
Tpm2Context *c,
TPM2_HANDLE nv_index,
const Tpm2Handle *nv_handle,
const Tpm2Handle *policy_session,
const struct iovec *digest) {
TPM2_RC rc;
assert(c);
assert(nv_index);
assert(nv_handle);
assert(policy_session);
assert(iovec_is_set(digest));
if (digest->iov_len > sizeof_field(TPM2B_MAX_NV_BUFFER, buffer))
return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), "Hash value to extend too long.");
TPM2B_MAX_NV_BUFFER buf = {
.size = digest->iov_len,
};
memcpy(buf.buffer, digest->iov_base, digest->iov_len);
rc = sym_Esys_NV_Extend(
c->esys_context,
/* authHandle= */ nv_handle->esys_handle,
/* nvIndex= */ nv_handle->esys_handle,
/* shandle1= */ policy_session->esys_handle,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
&buf);
if (rc == TPM2_RC_PCR_CHANGED)
return log_debug_errno(SYNTHETIC_ERRNO(ESTALE),
"PCR changed while extending NV index.");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to extend NV index: %s", sym_Tss2_RC_Decode(rc));
if (DEBUG_LOGGING) {
_cleanup_free_ char *h = NULL;
h = hexmem(digest->iov_base, digest->iov_len);
log_debug("Written hash %s to NV index 0x%x", strnull(h), nv_index);
}
return 0;
}
#endif
int tpm2_read_nv_index(
Tpm2Context *c,
const Tpm2Handle *session,
TPM2_HANDLE nv_index,
const Tpm2Handle *nv_handle,
struct iovec *ret_value) {
TPM2_RC rc;
int r;
assert(c);
assert(nv_index);
assert(nv_handle);
_cleanup_(Esys_Freep) TPM2B_NV_PUBLIC *nv_public = NULL;
r = tpm2_read_nv_public(c, /* session= */ NULL, nv_handle, &nv_public, /* ret_name= */ NULL);
if (r < 0)
return r;
size_t data_size = nv_public->nvPublic.dataSize;
log_debug("Read public info for nvindex 0x%x, value size is %zu", nv_index, data_size);
/* TPM2_NV_Read returns the data in a TPM2B_MAX_NV_BUFFER, whose maximum size is bounded by the value
* of the TPM_PT_NV_BUFFER_MAX property. This limits the amount of data that can be read in a single
* command. As this limit can be smaller than the size of the NV index payload (particularly if the
* payload contains a X509 certificate with a RSA public key), we read the contents in chunks no
* larger than what the TPM reports it can return in a single command. */
/* Never ask for more than the buffer the TPM library hands back can hold. */
size_t max_buffer_size = MIN((size_t) c->max_nv_buffer_size, (size_t) TPM2_MAX_NV_BUFFER_SIZE);
assert(max_buffer_size > 0); /* tpm2_cache_capabilities sets this to 512 if the TPM reported 0. */
_cleanup_(iovec_done) struct iovec result = {};
if (data_size > 0) {
result.iov_base = malloc(data_size);
if (!result.iov_base)
return log_oom_debug();
}
while (result.iov_len < data_size) {
size_t chunk_size = MIN(data_size - result.iov_len, max_buffer_size);
_cleanup_(Esys_Freep) TPM2B_MAX_NV_BUFFER *chunk = NULL;
rc = sym_Esys_NV_Read(
c->esys_context,
/* authHandle= */ nv_handle->esys_handle,
/* nvIndex= */ nv_handle->esys_handle,
/* shandle1= */ session ? session->esys_handle : ESYS_TR_PASSWORD,
/* shandle2= */ ESYS_TR_NONE,
/* shandle3= */ ESYS_TR_NONE,
chunk_size,
/* offset= */ result.iov_len,
&chunk);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed read contents of nvindex 0x%x: %s", nv_index, sym_Tss2_RC_Decode(rc));
assert(chunk);
if (chunk->size != chunk_size)
/* On success, TPM2_NV_Read should return exactly what we asked for. */
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"TPM returned an unexpected amount of data (%" PRIu16 ") reading nvindex 0x%x.",
chunk->size, nv_index);
memcpy((uint8_t*) result.iov_base + result.iov_len, chunk->buffer, chunk->size);
result.iov_len += chunk->size;
}
if (ret_value)
*ret_value = TAKE_STRUCT(result);
return 0;
}
int tpm2_seal_data(
Tpm2Context *c,
const struct iovec *data,
const Tpm2Handle *primary_handle,
const Tpm2Handle *encryption_session,
const TPM2B_DIGEST *policy,
struct iovec *ret_public,
struct iovec *ret_private) {
int r;
assert(c);
assert(data);
assert(primary_handle);
POINTER_MAY_BE_NULL(policy);
/* This is a generic version of tpm2_seal(), that doesn't imply any policy or any specific
* combination of the two keypairs in their marshalling. tpm2_seal() is somewhat specific to the FDE
* usecase. We probably should migrate tpm2_seal() to use tpm2_seal_data() eventually. */
if (data->iov_len >= sizeof_field(TPMS_SENSITIVE_CREATE, data.buffer))
return -E2BIG;
TPMT_PUBLIC hmac_template = {
.type = TPM2_ALG_KEYEDHASH,
.nameAlg = TPM2_ALG_SHA256,
.objectAttributes = TPMA_OBJECT_FIXEDTPM | TPMA_OBJECT_FIXEDPARENT,
.parameters.keyedHashDetail.scheme.scheme = TPM2_ALG_NULL,
.unique.keyedHash.size = data->iov_len,
.authPolicy = policy ? *policy : TPM2B_DIGEST_MAKE(NULL, TPM2_SHA256_DIGEST_SIZE),
};
TPMS_SENSITIVE_CREATE hmac_sensitive = {
.data.size = hmac_template.unique.keyedHash.size,
};
CLEANUP_ERASE(hmac_sensitive);
memcpy_safe(hmac_sensitive.data.buffer, data->iov_base, data->iov_len);
_cleanup_(Esys_Freep) TPM2B_PUBLIC *public = NULL;
_cleanup_(Esys_Freep) TPM2B_PRIVATE *private = NULL;
r = tpm2_create(c, primary_handle, encryption_session, &hmac_template, &hmac_sensitive, &public, &private);
if (r < 0)
return r;
_cleanup_(iovec_done) struct iovec public_blob = {}, private_blob = {};
r = tpm2_marshal_private(private, &private_blob.iov_base, &private_blob.iov_len);
if (r < 0)
return r;
r = tpm2_marshal_public(public, &public_blob.iov_base, &public_blob.iov_len);
if (r < 0)
return r;
if (ret_public)
*ret_public = TAKE_STRUCT(public_blob);
if (ret_private)
*ret_private = TAKE_STRUCT(private_blob);
return 0;
}
int tpm2_unseal_data(
Tpm2Context *c,
const struct iovec *public_blob,
const struct iovec *private_blob,
const Tpm2Handle *primary_handle,
const Tpm2Handle *policy_session,
const Tpm2Handle *encryption_session,
struct iovec *ret_data) {
TSS2_RC rc;
int r;
assert(c);
assert(public_blob);
assert(private_blob);
assert(primary_handle);
assert(ret_data);
TPM2B_PUBLIC public;
r = tpm2_unmarshal_public(public_blob->iov_base, public_blob->iov_len, &public);
if (r < 0)
return r;
TPM2B_PRIVATE private;
r = tpm2_unmarshal_private(private_blob->iov_base, private_blob->iov_len, &private);
if (r < 0)
return r;
_cleanup_(tpm2_handle_freep) Tpm2Handle *what = NULL;
r = tpm2_load(c, primary_handle, NULL, &public, &private, &what);
if (r < 0)
return r;
_cleanup_(tpm2b_sensitive_data_erase_and_esys_freep) TPM2B_SENSITIVE_DATA* unsealed = NULL;
rc = sym_Esys_Unseal(
c->esys_context,
what->esys_handle,
policy_session ? policy_session->esys_handle : ESYS_TR_NONE,
encryption_session ? encryption_session->esys_handle : ESYS_TR_NONE,
ESYS_TR_NONE,
&unsealed);
if (rc == TPM2_RC_PCR_CHANGED)
return log_debug_errno(SYNTHETIC_ERRNO(ESTALE),
"PCR changed while unsealing.");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unseal data: %s", sym_Tss2_RC_Decode(rc));
_cleanup_(iovec_done) struct iovec d = {
.iov_base = memdup(unsealed->buffer, unsealed->size),
.iov_len = unsealed->size,
};
if (!d.iov_base)
return log_oom_debug();
*ret_data = TAKE_STRUCT(d);
return 0;
}
#endif /* HAVE_TPM2 */
int tpm2_list_devices(bool legend, bool quiet) {
#if HAVE_TPM2
_cleanup_(table_unrefp) Table *t = NULL;
_cleanup_closedir_ DIR *d = NULL;
int r;
r = dlopen_tpm2(LOG_ERR);
if (r < 0)
return r;
t = table_new("path", "device", "driver");
if (!t)
return log_oom();
table_set_header(t, legend);
d = opendir("/sys/class/tpmrm");
if (!d) {
log_full_errno(errno == ENOENT ? LOG_DEBUG : LOG_ERR, errno, "Failed to open %s: %m", "/sys/class/tpmrm");
if (errno != ENOENT)
return -errno;
} else {
for (;;) {
_cleanup_free_ char *device_path = NULL, *device = NULL, *driver_path = NULL, *driver = NULL, *node = NULL;
struct dirent *de;
de = readdir_no_dot(d);
if (!de)
break;
device_path = path_join("/sys/class/tpmrm", de->d_name, "device");
if (!device_path)
return log_oom();
r = readlink_malloc(device_path, &device);
if (r < 0)
log_debug_errno(r, "Failed to read device symlink %s, ignoring: %m", device_path);
else {
driver_path = path_join(device_path, "driver");
if (!driver_path)
return log_oom();
r = readlink_malloc(driver_path, &driver);
if (r < 0)
log_debug_errno(r, "Failed to read driver symlink %s, ignoring: %m", driver_path);
}
node = path_join("/dev", de->d_name);
if (!node)
return log_oom();
r = table_add_many(
t,
TABLE_PATH, node,
TABLE_STRING, device ? last_path_component(device) : NULL,
TABLE_STRING, driver ? last_path_component(driver) : NULL);
if (r < 0)
return table_log_add_error(r);
}
}
if (table_isempty(t) && !quiet) {
log_info("No suitable TPM2 devices found.");
return 0;
}
return table_print_or_warn(t);
#else
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"TPM2 not supported on this build.");
#endif
}
int tpm2_find_device_auto(char **ret) {
#if HAVE_TPM2
_cleanup_closedir_ DIR *d = NULL;
int r;
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
d = opendir("/sys/class/tpmrm");
if (!d) {
log_debug_errno(errno, "Failed to open %s: %m", "/sys/class/tpmrm");
if (errno != ENOENT)
return -errno;
} else {
_cleanup_free_ char *node = NULL;
for (;;) {
struct dirent *de;
de = readdir_no_dot(d);
if (!de)
break;
if (node)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTUNIQ),
"More than one TPM2 (tpmrm) device found.");
node = path_join("/dev", de->d_name);
if (!node)
return log_oom_debug();
}
if (node) {
*ret = TAKE_PTR(node);
return 0;
}
}
return log_debug_errno(SYNTHETIC_ERRNO(ENODEV), "No TPM2 (tpmrm) device found.");
#else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
"TPM2 not supported on this build.");
#endif
}
#if HAVE_TPM2
const uint16_t tpm2_hash_algorithms[] = {
TPM2_ALG_SHA1,
TPM2_ALG_SHA256,
TPM2_ALG_SHA384,
TPM2_ALG_SHA512,
0,
};
assert_cc(ELEMENTSOF(tpm2_hash_algorithms) == TPM2_N_HASH_ALGORITHMS + 1);
static size_t tpm2_hash_algorithm_index(uint16_t algorithm) {
for (size_t i = 0; i < TPM2_N_HASH_ALGORITHMS; i++)
if (tpm2_hash_algorithms[i] == algorithm)
return i;
return SIZE_MAX;
}
static int json_dispatch_tpm2_algorithm(const char *name, sd_json_variant *variant, sd_json_dispatch_flags_t flags, void *userdata) {
uint16_t *algorithm = ASSERT_PTR(userdata);
int r;
r = tpm2_hash_alg_from_string(sd_json_variant_string(variant));
if (r < 0 || tpm2_hash_algorithm_index(r) == SIZE_MAX)
return json_log(variant, flags, SYNTHETIC_ERRNO(EINVAL), "Invalid hash algorithm: %s", sd_json_variant_string(variant));
*algorithm = r;
return 0;
}
static const char* tpm2_userspace_event_type_table[_TPM2_USERSPACE_EVENT_TYPE_MAX] = {
[TPM2_EVENT_PHASE] = "phase",
[TPM2_EVENT_FILESYSTEM] = "filesystem",
[TPM2_EVENT_VOLUME_KEY] = "volume-key",
[TPM2_EVENT_MACHINE_ID] = "machine-id",
[TPM2_EVENT_PRODUCT_ID] = "product-id",
[TPM2_EVENT_KEYSLOT] = "keyslot",
[TPM2_EVENT_NVPCR_INIT] = "nvpcr-init",
[TPM2_EVENT_NVPCR_SEPARATOR] = "nvpcr-separator",
[TPM2_EVENT_DM_VERITY] = "dm-verity",
[TPM2_EVENT_IMDS_USERDATA] = "imds-userdata",
[TPM2_EVENT_OS_SEPARATOR] = "os-separator",
[TPM2_EVENT_LOGIN] = "login",
};
DEFINE_STRING_TABLE_LOOKUP(tpm2_userspace_event_type, Tpm2UserspaceEventType);
const char* tpm2_userspace_log_path(void) {
return secure_getenv("SYSTEMD_MEASURE_LOG_USERSPACE") ?: "/run/log/systemd/tpm2-measure.log";
}
const char* tpm2_firmware_log_path(void) {
return secure_getenv("SYSTEMD_MEASURE_LOG_FIRMWARE") ?: "/sys/kernel/security/tpm0/binary_bios_measurements";
}
#if HAVE_OPENSSL
static int tpm2_userspace_log_open(void) {
_cleanup_close_ int fd = -EBADF;
const char *e;
int r;
e = tpm2_userspace_log_path();
(void) mkdir_parents(e, 0755);
/* We use access mode 0600 here (even though the measurements should not strictly be confidential),
* because we use BSD file locking on it, and if anyone but root can access the file they can also
* lock it, which we want to avoid. */
fd = open(e, O_CREAT|O_WRONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0600);
if (fd < 0)
return log_debug_errno(errno, "Failed to open TPM log file '%s' for writing, ignoring: %m", e);
if (flock(fd, LOCK_EX) < 0)
return log_debug_errno(errno, "Failed to lock TPM log file '%s', ignoring: %m", e);
r = fd_verify_regular(fd);
if (r < 0)
return log_debug_errno(r, "TPM log file '%s' is not regular, ignoring: %m", e);
return TAKE_FD(fd);
}
static int tpm2_userspace_log_dirty(int fd) {
struct stat st;
if (fd < 0) /* Apparently tpm2_local_log_open() failed earlier, let's not complain again */
return 0;
/* We set the sticky bit when we are about to append to the log file. We'll unset it afterwards
* again. If we manage to take a lock on a file that has it set we know we didn't write it fully and
* it is corrupted. We return -ESTALE then; callers shall not reset the marker when they are done,
* so that the incompleteness remains detectable. Ideally we'd like to use user xattrs for this, but
* unfortunately tmpfs (which is our assumed backend fs) doesn't know user xattrs. */
if (fstat(fd, &st) < 0)
return log_debug_errno(errno, "Failed to fstat TPM log file, ignoring: %m");
if (st.st_mode & S_ISVTX)
return log_debug_errno(SYNTHETIC_ERRNO(ESTALE), "TPM log file aborted, ignoring.");
if (fchmod(fd, 0600 | S_ISVTX) < 0)
return log_debug_errno(errno, "Failed to chmod() TPM log file, ignoring: %m");
return 0;
}
static int tpm2_userspace_log_clean(int fd, bool reset_marker) {
int r;
if (fd < 0) /* Apparently tpm2_local_log_open() failed earlier, let's not complain again */
return 0;
if (fsync(fd) < 0)
return log_debug_errno(errno, "Failed to sync JSON data: %m");
/* If the dirty marker was already set when we acquired the log, an earlier writer died before
* writing its record, i.e. the log is missing a record. Keep the marker then, so that the
* incompleteness remains detectable. */
if (!reset_marker)
return 0;
/* Unset S_ISVTX again */
if (fchmod(fd, 0600) < 0)
return log_debug_errno(errno, "Failed to chmod() TPM log file, ignoring: %m");
r = fsync_full(fd);
if (r < 0)
return log_debug_errno(r, "Failed to sync JSON log: %m");
return 0;
}
static int tpm2_userspace_log(
int fd,
unsigned pcr_index,
uint32_t nv_index,
const char *nv_index_name,
const TPML_DIGEST_VALUES *values,
Tpm2UserspaceEventType event_type,
const char *description,
bool reset_marker) {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL, *array = NULL;
_cleanup_free_ char *f = NULL;
sd_id128_t boot_id;
int r;
assert(values);
assert(values->count > 0);
/* We maintain a local PCR measurement log. This implements a subset of the TCG Canonical Event Log
* Format – the JSON flavour –
* (https://trustedcomputinggroup.org/resource/canonical-event-log-format/), but departs in certain
* ways from it, specifically:
*
* - We don't write out a recnum. It's a bit too vaguely defined which means we'd have to read
* through the whole logs (include firmware logs) before knowing what the next value is we should
* use. Hence we simply don't write this out as append-time, and instead expect a consumer to add
* it in when it uses the data.
*
* - We write this out in RFC 7464 application/json-seq rather than as a JSON array. Writing this as
* JSON array would mean that for each appending we'd have to read the whole log file fully into
* memory before writing it out again. We prefer a strictly append-only write pattern however. (RFC
* 7464 is what jq --seq eats.) Conversion into a proper JSON array is trivial.
*
* It should be possible to convert this format in a relatively straight-forward way into the
* official TCG Canonical Event Log Format on read, by simply adding in a few more fields that can be
* determined from the full dataset.
*
* We set the 'content_type' field to "systemd" to make clear this data is generated by us, and
* include various interesting fields in the 'content' subobject, including a CLOCK_BOOTTIME
* timestamp which can be used to order this measurement against possibly other measurements
* independently done by other subsystems on the system.
*/
if (fd < 0) /* Apparently tpm2_local_log_open() failed earlier, let's not complain again */
return 0;
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
for (size_t i = 0; i < values->count; i++) {
const EVP_MD *implementation;
const char *a;
assert_se(a = tpm2_hash_alg_to_string(values->digests[i].hashAlg));
assert_se(implementation = sym_EVP_get_digestbyname(a));
r = sd_json_variant_append_arraybo(
&array,
SD_JSON_BUILD_PAIR_STRING("hashAlg", a),
SD_JSON_BUILD_PAIR_HEX("digest", &values->digests[i].digest, sym_EVP_MD_get_size(implementation)));
if (r < 0)
return log_debug_errno(r, "Failed to append digest object to JSON array: %m");
}
assert(array);
r = sd_id128_get_boot(&boot_id);
if (r < 0)
return log_debug_errno(r, "Failed to acquire boot ID: %m");
r = sd_json_buildo(
&v,
SD_JSON_BUILD_PAIR_CONDITION(pcr_index != UINT_MAX, "pcr", SD_JSON_BUILD_UNSIGNED(pcr_index)),
SD_JSON_BUILD_PAIR_CONDITION(nv_index != UINT32_MAX, "nv_index", SD_JSON_BUILD_UNSIGNED(nv_index)),
SD_JSON_BUILD_PAIR_VARIANT("digests", array),
SD_JSON_BUILD_PAIR_STRING("content_type", "systemd"),
SD_JSON_BUILD_PAIR("content", SD_JSON_BUILD_OBJECT(
SD_JSON_BUILD_PAIR_CONDITION(!!nv_index_name, "nvIndexName", SD_JSON_BUILD_STRING(nv_index_name)),
SD_JSON_BUILD_PAIR_CONDITION(!!description, "string", SD_JSON_BUILD_STRING(description)),
SD_JSON_BUILD_PAIR_ID128("bootId", boot_id),
SD_JSON_BUILD_PAIR_UNSIGNED("timestamp", now(CLOCK_BOOTTIME)),
SD_JSON_BUILD_PAIR_CONDITION(event_type >= 0, "eventType", SD_JSON_BUILD_STRING(tpm2_userspace_event_type_to_string(event_type))))));
if (r < 0)
return log_debug_errno(r, "Failed to build log record JSON: %m");
r = sd_json_variant_format(v, SD_JSON_FORMAT_SEQ, &f);
if (r < 0)
return log_debug_errno(r, "Failed to format JSON: %m");
if (lseek(fd, 0, SEEK_END) < 0)
return log_debug_errno(errno, "Failed to seek to end of JSON log: %m");
r = loop_write(fd, f, SIZE_MAX);
if (r < 0)
return log_debug_errno(r, "Failed to write JSON data to log: %m");
r = tpm2_userspace_log_clean(fd, reset_marker);
if (r < 0)
return r;
return 1;
}
#endif
int tpm2_pcr_extend_bytes(
Tpm2Context *c,
char **banks,
unsigned pcr_index,
const struct iovec *data,
const struct iovec *secret,
Tpm2UserspaceEventType event_type,
const char *description) {
#if HAVE_OPENSSL
_cleanup_close_ int log_fd = -EBADF;
TPML_DIGEST_VALUES values = {};
TSS2_RC rc;
int r;
assert(c);
assert(iovec_is_valid(data));
assert(iovec_is_valid(secret));
if (pcr_index >= TPM2_PCRS_MAX)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Can't measure into unsupported PCR %u, refusing.", pcr_index);
if (!iovec_is_set(data))
data = &iovec_empty;
if (strv_isempty(banks))
return 0;
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
STRV_FOREACH(bank, banks) {
const EVP_MD *implementation;
int id;
assert_se(implementation = sym_EVP_get_digestbyname(*bank));
if (values.count >= ELEMENTSOF(values.digests))
return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), "Too many banks selected.");
if ((size_t) sym_EVP_MD_get_size(implementation) > sizeof(values.digests[values.count].digest))
return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), "Hash result too large for TPM2.");
id = tpm2_hash_alg_from_string(sym_EVP_MD_get0_name(implementation));
if (id < 0)
return log_debug_errno(id, "Can't map hash name to TPM2.");
values.digests[values.count].hashAlg = id;
/* So here's a twist: sometimes we want to measure secrets (e.g. root file system volume
* key), but we'd rather not leak a literal hash of the secret to the TPM (given that the
* wire is unprotected, and some other subsystem might use the simple, literal hash of the
* secret for other purposes, maybe because it needs a shorter secret derived from it for
* some unrelated purpose, who knows). Hence we instead measure an HMAC signature of a
* private non-secret string instead. */
if (iovec_is_set(secret) > 0) {
if (!sym_HMAC(implementation, secret->iov_base, secret->iov_len, data->iov_base, data->iov_len, (unsigned char*) &values.digests[values.count].digest, NULL))
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to calculate HMAC of data to measure.");
} else if (sym_EVP_Digest(data->iov_base, data->iov_len, (unsigned char*) &values.digests[values.count].digest, NULL, implementation, NULL) != 1)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to hash data to measure.");
values.count++;
}
/* Open + lock the log file *before* we start measuring, so that no one else can come between our log
* and our measurement and change either */
log_fd = tpm2_userspace_log_open();
bool reset_marker = tpm2_userspace_log_dirty(log_fd) >= 0;
rc = sym_Esys_PCR_Extend(
c->esys_context,
ESYS_TR_PCR0 + pcr_index,
ESYS_TR_PASSWORD,
ESYS_TR_NONE,
ESYS_TR_NONE,
&values);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(
SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to measure into PCR %u: %s",
pcr_index,
sym_Tss2_RC_Decode(rc));
/* Now, write what we just extended to the log, too. */
(void) tpm2_userspace_log(
log_fd,
pcr_index,
/* nv_index= */ UINT32_MAX,
/* nv_index_name= */ NULL,
&values,
event_type,
description,
reset_marker);
return 0;
#else /* HAVE_OPENSSL */
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
typedef struct NvPCRData {
char *name;
uint16_t algorithm;
uint32_t nv_index;
uint64_t priority;
bool orderly;
} NvPCRData;
static void nvpcr_data_done(NvPCRData *d) {
assert(d);
free(d->name);
}
static int nvpcr_data_load(const char *name, NvPCRData *ret) {
int r;
assert(ret);
if (!tpm2_nvpcr_name_is_valid(name))
return -EINVAL;
const char *fname = strjoina(name, ".nvpcr");
_cleanup_free_ char *path = NULL;
_cleanup_fclose_ FILE *f = NULL;
r = search_and_fopen_nulstr(fname, "re", /* root= */ NULL, CONF_PATHS_NULSTR("nvpcr"), &f, &path);
if (r < 0)
return r;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_parse_file(
f,
path,
/* flags= */ 0,
&v,
/* reterr_line= */ NULL,
/* reterr_column= */ NULL);
if (r < 0)
return log_debug_errno(r, "Failed to load '%s': %m", path);
static const sd_json_dispatch_field dispatch_table[] = {
{ "name", SD_JSON_VARIANT_STRING, sd_json_dispatch_string, offsetof(NvPCRData, name), SD_JSON_MANDATORY },
{ "algorithm", _SD_JSON_VARIANT_TYPE_INVALID, json_dispatch_tpm2_algorithm, offsetof(NvPCRData, algorithm), 0 },
{ "nvIndex", _SD_JSON_VARIANT_TYPE_INVALID, sd_json_dispatch_uint32, offsetof(NvPCRData, nv_index), SD_JSON_MANDATORY },
{ "priority", _SD_JSON_VARIANT_TYPE_INVALID, sd_json_dispatch_uint64, offsetof(NvPCRData, priority), 0 },
{ "orderly", SD_JSON_VARIANT_BOOLEAN, sd_json_dispatch_stdbool, offsetof(NvPCRData, orderly), 0 },
{},
};
_cleanup_(nvpcr_data_done) NvPCRData p = {
.algorithm = TPM2_ALG_SHA256,
.priority = TPM2_NVPCR_PRIORITY_DEFAULT,
.orderly = true,
};
r = sd_json_dispatch(v, dispatch_table, SD_JSON_ALLOW_EXTENSIONS, &p);
if (r < 0)
return r;
if (!streq_ptr(p.name, name))
return log_debug_errno(SYNTHETIC_ERRNO(ESTALE), "NvPCR name doesn't match filename, refusing.");
*ret = TAKE_STRUCT(p);
return 0;
}
int tpm2_nvpcr_all_names(char ***ret_names) {
int r;
_cleanup_strv_free_ char **paths = NULL;
r = conf_files_list_nulstr(&paths, ".nvpcr", /* root= */ NULL, CONF_FILES_WARN, CONF_PATHS_NULSTR("nvpcr"));
if (r < 0)
return r;
_cleanup_strv_free_ char **names = NULL;
STRV_FOREACH(p, paths) {
_cleanup_free_ char *fname = NULL;
r = path_extract_filename(*p, &fname);
if (r < 0)
return r;
char *e = endswith(fname, ".nvpcr");
if (!e)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Unexpected nvpcr config file name '%s'", fname);
*e = 0;
if (!tpm2_nvpcr_name_is_valid(fname))
continue;
r = strv_consume(&names, TAKE_PTR(fname));
if (r < 0)
return r;
}
if (ret_names)
*ret_names = TAKE_PTR(names);
return 0;
}
int tpm2_nvpcr_get_index(const char *name, uint32_t *ret_nv_index, uint64_t *ret_priority) {
int r;
_cleanup_(nvpcr_data_done) NvPCRData p = {};
r = nvpcr_data_load(name, &p);
if (r < 0)
return r;
if (ret_nv_index)
*ret_nv_index = p.nv_index;
if (ret_priority)
*ret_priority = p.priority;
return 0;
}
#if HAVE_OPENSSL
static int tpm2_nvpcr_load_pcr_public_key(
const char *path,
TPM2B_PUBLIC *ret_public,
struct iovec *ret_fingerprint) {
int r;
assert(ret_public);
assert(ret_fingerprint);
_cleanup_(iovec_done) struct iovec pubkey = {};
r = tpm2_load_pcr_public_key(path, &pubkey.iov_base, &pubkey.iov_len);
if (r < 0)
return log_debug_errno(r, "Failed to load PCR public key for NvPCR: %m");
TPM2B_PUBLIC public;
r = tpm2_tpm2b_public_from_pem(pubkey.iov_base, pubkey.iov_len, &public);
if (r < 0)
return log_debug_errno(r, "Failed to convert PCR public key to TPM2B_PUBLIC: %m");
_cleanup_(iovec_done) struct iovec fp = {};
r = tpm2_tpm2b_public_to_fingerprint(&public, &fp.iov_base, &fp.iov_len);
if (r < 0)
return log_debug_errno(r, "Failed to calculate fingerprint of PCR public key: %m");
*ret_public = public;
*ret_fingerprint = TAKE_STRUCT(fp);
return 0;
}
/* Reads the stored PolicyAuthorize branch digest of a previously initialized NvPCR. This is written by
* tpm2_nvpcr_initialize() and is needed to reconstruct the TPM2_PolicyOR for runtime extends. */
static int tpm2_nvpcr_read_authorize_policy(const char *name, TPM2B_DIGEST *ret) {
int r;
assert(name);
assert(ret);
const char *fname = strjoina("/run/systemd/nvpcr/", name, ".auth");
_cleanup_free_ char *h = NULL;
r = read_one_line_file(fname, &h);
if (r == -ENOENT)
return log_debug_errno(SYNTHETIC_ERRNO(ENETDOWN), "NvPCR '%s' not initialized yet, refusing.", name);
if (r < 0)
return log_debug_errno(r, "Failed to read NvPCR authorize policy '%s': %m", fname);
_cleanup_free_ void *d = NULL;
size_t d_size;
r = unhexmem(strstrip(h), &d, &d_size);
if (r < 0)
return log_debug_errno(r, "Failed to decode NvPCR authorize policy from '%s': %m", fname);
if (d_size != SHA256_DIGEST_SIZE)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "NvPCR authorize policy in '%s' has unexpected size.", fname);
*ret = TPM2B_DIGEST_MAKE(d, d_size);
return 0;
}
/* Opens and executes a policy session that satisfies an NvPCR's write policy, leaving it ready for a
* subsequent extend. If 'signature_json' is provided, the PolicyAuthorize branch is used (for the
* initializing write that sets TPMA_NV_WRITTEN); otherwise the PolicyNvWritten(true) branch is used (for
* all later writes). */
static int tpm2_nvpcr_open_write_session(
Tpm2Context *c,
const TPM2B_PUBLIC *public,
const char *pubkey_policy_ref,
uint32_t pubkey_pcr_mask,
const struct iovec *fingerprint,
sd_json_variant *signature_json,
const TPM2B_DIGEST *authorize_policy,
Tpm2Handle **ret_session) {
int r;
assert(c);
assert(authorize_policy);
assert(ret_session);
_cleanup_(tpm2_handle_freep) Tpm2Handle *session = NULL;
r = tpm2_make_policy_session(c, /* primary= */ NULL, /* encryption_session= */ NULL, &session);
if (r < 0)
return r;
if (signature_json) {
assert(public);
assert(fingerprint);
/* Initializing write: satisfy the PolicyAuthorize branch using the signed PCR policy. */
TPML_PCR_SELECTION pcr_selection;
tpm2_tpml_pcr_selection_from_mask(pubkey_pcr_mask, TPM2_ALG_SHA256, &pcr_selection);
r = tpm2_policy_authorize(
c,
session,
&pcr_selection,
public,
pubkey_policy_ref,
fingerprint->iov_base, fingerprint->iov_len,
signature_json,
/* ret_policy_digest= */ NULL);
if (r < 0)
return r;
} else {
/* Subsequent write: the NvPCR is already written, so the PolicyNvWritten(true) branch can be
* satisfied without any authorization. */
r = tpm2_policy_nv_written(c, session, /* written_set= */ true, /* ret_policy_digest= */ NULL);
if (r < 0)
return r;
}
/* Branch order must match tpm2_nvpcr_calculate_write_policy(). */
TPM2B_DIGEST branches[2] = {
*authorize_policy,
TPM2B_DIGEST_MAKE(NULL, SHA256_DIGEST_SIZE), /* PolicyNvWritten branch */
};
r = tpm2_calculate_policy_nv_written(/* written_set= */ true, &branches[1]);
if (r < 0)
return r;
r = tpm2_policy_or(c, session, branches, ELEMENTSOF(branches), /* ret_policy_digest= */ NULL);
if (r < 0)
return r;
*ret_session = TAKE_PTR(session);
return 0;
}
#endif
static int nvpcr_extend_bytes(
Tpm2Context *c,
const Tpm2Handle *session,
const char *name,
const struct iovec *data,
const struct iovec *secret,
Tpm2UserspaceEventType event_type,
const char *description) {
#if HAVE_OPENSSL
_cleanup_close_ int log_fd = -EBADF;
int r;
assert(c);
assert(name);
assert(iovec_is_valid(data));
assert(iovec_is_valid(secret));
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
_cleanup_(nvpcr_data_done) NvPCRData p = {};
r = nvpcr_data_load(name, &p);
if (r < 0)
return r;
/* Open + lock the log file *before* we start measuring, so that no one else can come between our log
* and our measurement and change either */
log_fd = tpm2_userspace_log_open();
/* Read the stored PolicyAuthorize branch digest. Its presence also tells us this NvPCR has been
* initialized; we need it to reconstruct the TPM2_PolicyOR below. */
TPM2B_DIGEST authorize_policy;
r = tpm2_nvpcr_read_authorize_policy(name, &authorize_policy);
if (r < 0)
return r;
const char *an = tpm2_hash_alg_to_string(p.algorithm);
if (!an)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Unsupported algorithm for NvPCR, refusing.");
const EVP_MD *implementation;
assert_se(implementation = sym_EVP_get_digestbyname(an));
_cleanup_(iovec_done) struct iovec digest = {
.iov_len = sym_EVP_MD_get_size(implementation),
};
digest.iov_base = malloc(digest.iov_len);
if (!digest.iov_base)
return log_oom_debug();
if (!iovec_is_set(data))
data = &iovec_empty;
if (iovec_is_set(secret)) {
if (!sym_HMAC(implementation, secret->iov_base, secret->iov_len, data->iov_base, data->iov_len, digest.iov_base, NULL))
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to calculate HMAC of data to measure.");
} else if (sym_EVP_Digest(data->iov_base, data->iov_len, digest.iov_base, NULL, implementation, NULL) != 1)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to hash data to measure.");
_cleanup_(tpm2_handle_freep) Tpm2Handle *nv_handle = NULL;
r = tpm2_index_to_handle(
c,
p.nv_index,
session,
/* ret_name= */ NULL,
&nv_handle);
if (r < 0)
return log_debug_errno(r, "Failed to acquire handle to NV index 0x%" PRIu32 ".", p.nv_index);
if (r == 0)
return log_debug_errno(SYNTHETIC_ERRNO(ENODEV),
"NvPCR '%s' is anchored but its NV index 0x%" PRIx32 " is no longer present on the TPM, refusing extend.",
name, p.nv_index);
log_debug("Successfully acquired handle to existing NV index 0x%" PRIx32 ".", p.nv_index);
/* Open a policy session that satisfies the write policy via the PolicyNvWritten(true) branch
* (the index was already written during initialization). */
_cleanup_(tpm2_handle_freep) Tpm2Handle *policy_session = NULL;
r = tpm2_nvpcr_open_write_session(
c,
/* public= */ NULL,
/* pubkey_policy_ref= */ NULL,
/* pubkey_pcr_mask= */ 0,
/* fingerprint= */ NULL,
/* signature_json= */ NULL,
&authorize_policy,
&policy_session);
if (r < 0)
return r;
bool reset_marker = tpm2_userspace_log_dirty(log_fd) >= 0;
r = tpm2_extend_nvpcr_nv_index(
c,
p.nv_index,
nv_handle,
policy_session,
&digest);
if (r < 0)
return r;
TPML_DIGEST_VALUES digest_values = {
.count = 1,
.digests[0].hashAlg = p.algorithm,
};
memcpy(&digest_values.digests[0].digest, digest.iov_base, digest.iov_len);
/* Now, write what we just extended to the log, too. */
(void) tpm2_userspace_log(
log_fd,
/* pcr_index= */ UINT_MAX,
p.nv_index,
name,
&digest_values,
event_type,
description,
reset_marker);
return 0;
#else /* HAVE_OPENSSL */
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
int tpm2_nvpcr_extend_bytes(
Tpm2Context *c,
const Tpm2Handle *session,
const char *name,
const struct iovec *data,
const struct iovec *secret,
Tpm2UserspaceEventType event_type,
const char *description) {
int r;
r = nvpcr_extend_bytes(c, session, name, data, secret, event_type, description);
if (r != -ENETDOWN)
return r;
/* The NvPCR isn't initialized yet, i.e. systemd-tpm2-setup hasn't run.
* Initialize it now and extend again. */
r = tpm2_nvpcr_initialize(c, session, name);
if (r < 0)
return log_debug_errno(r, "Failed to initialize NvPCR '%s': %m", name);
return nvpcr_extend_bytes(c, session, name, data, secret, event_type, description);
}
#if HAVE_OPENSSL
static int tpm2_context_can_nvindex(Tpm2Context *c) {
int r;
assert(c);
if (!streq_ptr(c->tcti_driver, "device")) {
log_debug("Not checking udev database, because not using 'device' TCTI.");
return 1;
}
if (!c->tcti_param) {
log_debug("No device specified, not checking udev database.");
return 1;
}
_cleanup_(sd_device_unrefp) sd_device *d = NULL;
r = sd_device_new_from_devname(&d, c->tcti_param);
if (r < 0)
return log_debug_errno(r, "Failed to acquire udev entry for device '%s': %m", c->tcti_param);
r = device_get_property_bool(d, "TPM2_BROKEN_NVPCR");
if (r == -ENOENT) {
log_device_debug_errno(d, r, "No TPM2_BROKEN_NVPCR property for '%s', assuming NvPCRs work.", c->tcti_param);
return 1;
}
if (r < 0)
return log_device_debug_errno(d, r, "Failed to query TPM2_BROKEN_NVPCR for '%s': %m", c->tcti_param);
if (r > 0) {
log_device_debug(d, "TPM2_BROKEN_NVPCR property for '%s' explicitly set, NvPCRs do not work.", c->tcti_param);
return 0;
}
log_device_debug(d, "TPM2_BROKEN_NVPCR property for '%s' explicitly set to false, hence NvPCRs work.", c->tcti_param);
return 1;
}
#endif
/* Policy reference for the PolicyAuthorize assertion that guards the first write to an NvPCR. */
#define NVPCR_INIT_POLICY_REF "initrd"
/* PCR mask for the policy that guards the first write to an NvPCR, via the signed policy and PolicyAuthorize. */
#define NVPCR_PUBKEY_PCRMASK (UINT32_C(1) << TPM2_PCR_KERNEL_BOOT)
/* The maximum number of times to try initializing a NvPCR before failing if PCR values change under our feet. */
#define RETRY_NVPCR_INIT_MAX 30u
int tpm2_nvpcr_initialize(
Tpm2Context *c,
const Tpm2Handle *session,
const char *name) {
#if HAVE_OPENSSL
int r;
assert(c);
assert(name);
r = tpm2_context_can_nvindex(c);
if (r < 0)
return r;
if (r == 0)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "TPM2 device does not support NvPCRs, not initializing.");
_cleanup_(nvpcr_data_done) NvPCRData p = {};
r = nvpcr_data_load(name, &p);
if (r < 0)
return r;
/* Open + lock the log file *before* we check for the *.auth flag file. */
_cleanup_close_ int log_fd = tpm2_userspace_log_open();
_cleanup_close_ int dfd = open_mkdir("/run/systemd/nvpcr", O_CLOEXEC, 0755);
if (dfd < 0)
return log_debug_errno(dfd, "Failed to open directory '/run/systemd/nvpcr': %m");
const char *auth_fname = strjoina(name, ".auth");
if (faccessat(dfd, auth_fname, F_OK, AT_SYMLINK_NOFOLLOW) < 0) {
if (errno != ENOENT)
return log_debug_errno(errno, "Failed to check if /run/systemd/nvpcr/%s exists: %m", auth_fname);
} else {
log_debug("NvPCR '%s' is already initialized.", name);
return 0;
}
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
/* XXX: As NvPCRs use a write policy with PolicyAuthorize, the name algorithm and signed policy
* algorithm must match. Currently, signed policies are restricted to SHA256, so reject anything else
* for now. This can only be relaxed when:
* - The various tpm2_calculate_policy_* and tpm2_digest_* functions support more than SHA256.
* - Signed policies have a new policy algorithm field in the JSON metadata.
* - systemd-measure has a new argument to select the policy algorithm.
* - the name algorithm is plumbed through to tpm2_make_policy_session, tpm2_policy_authorize and
* find_signature.
* - find_signature filters on the new policy algorithm field.
*
* Note that the policy algorithm is distinct from the signing algorithm. For PolicyAuthorize
* signatures, the signature algorithm has to match the name algorithm of the signing key, but this
* doesn't have to be the same as the algorithm of the signed policy. Signature algorithms are
* currently hardcoded to SHA256 too. */
if (p.algorithm != TPM2_ALG_SHA256)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Only SHA256 is currently supported for NvPCR, refusing.");
int digest_size = tpm2_hash_alg_to_size(p.algorithm);
if (digest_size < 0)
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Unsupported algorithm for NvPCR, refusing.");
if ((size_t) digest_size > sizeof_field(TPM2B_MAX_NV_BUFFER, buffer))
return log_debug_errno(SYNTHETIC_ERRNO(E2BIG), "Hash function result too large for TPM, refusing.");
/* Load the PCR public key. Its signatures authorize the initializing write to the NvPCR via the
* PolicyAuthorize branch of the write policy. */
TPM2B_PUBLIC public;
_cleanup_(iovec_done) struct iovec fingerprint = {};
r = tpm2_nvpcr_load_pcr_public_key(/* path= */ NULL, &public, &fingerprint);
if (r < 0)
return r;
TPM2B_DIGEST authorize_policy;
_cleanup_(tpm2_handle_freep) Tpm2Handle *nv_handle = NULL;
r = tpm2_define_nvpcr_nv_index(
c,
session,
p.nv_index,
p.algorithm,
&public,
NVPCR_INIT_POLICY_REF,
p.orderly,
&authorize_policy,
&nv_handle);
if (r < 0)
return r;
log_debug("Successfully acquired handle to NV index 0x%" PRIx32 ".", p.nv_index);
/* Load the signed PCR policy, which authorizes the initializing write. */
_cleanup_(sd_json_variant_unrefp) sd_json_variant *signature_json = NULL;
r = tpm2_load_pcr_signature(/* path= */ NULL, &signature_json);
if (r < 0)
return log_debug_errno(r, "Failed to load PCR signature for NvPCR initialization: %m");
bool reset_marker;
for (unsigned i = RETRY_NVPCR_INIT_MAX;; i--) {
/* Open a policy session to perform the initializing write. */
_cleanup_(tpm2_handle_freep) Tpm2Handle *policy_session = NULL;
r = tpm2_nvpcr_open_write_session(
c,
&public,
NVPCR_INIT_POLICY_REF,
NVPCR_PUBKEY_PCRMASK,
&fingerprint,
signature_json,
&authorize_policy,
&policy_session);
if (r < 0)
return r;
_cleanup_free_ void *zero = malloc0(digest_size);
if (!zero)
return log_oom_debug();
reset_marker = tpm2_userspace_log_dirty(log_fd) >= 0;
r = tpm2_extend_nvpcr_nv_index(
c,
p.nv_index,
nv_handle,
policy_session,
&IOVEC_MAKE(zero, digest_size));
if (r == -ESTALE) {
/* PCR values changed under our feet. This shouldn't happen from userspace
* measurements because we hold the measurement log lock, but the kernel can still
* perform IMA measurements. */
tpm2_userspace_log_clean(log_fd, reset_marker);
if (i > 0)
continue;
}
if (r < 0)
return r;
log_debug("Successfully performed initializing write to NvPCR '%s'.", name);
break;
}
/* Persist the PolicyAuthorize branch digest. The extend path needs it to reconstruct the
* TPM2_PolicyOR, and its presence doubles as an indication that this NvPCR is initialized. */
_cleanup_free_ char *h = hexmem(authorize_policy.buffer, authorize_policy.size);
if (!h)
return log_oom_debug();
r = write_string_file_at(dfd, auth_fname, h, WRITE_STRING_FILE_CREATE|WRITE_STRING_FILE_ATOMIC);
if (r < 0)
return log_debug_errno(r, "Failed to write auth file: %m");
(void) tpm2_userspace_log_clean(log_fd, reset_marker);
log_fd = safe_close(log_fd);
/* Acquire the name of the newly created index. This is done after the first write when the
* TPMA_NV_WRITTEN flag is already set. */
_cleanup_(Esys_Freep) TPM2B_NAME *nv_name = NULL;
r = tpm2_get_name(c, nv_handle, &nv_name);
if (r < 0)
return r;
/* Now also measure the initialization into PCR 9, so that there's a trace of it in regular PCRs. You
* might wonder why PCR 9? Well, we have very few PCRs available, and PCR 9 appears to be the least
* bad for this. It typically contains stuff that in our world is hard to predict anyway
* (i.e. possibly some overly verbose Grub stuff, as well as all initrds – those generated on-the-fly
* and those prepared beforehand – mangled into one), quite differently from all other PCRs we could
* use. Moreover PCR 11 already contains most stuff from PCR 9, as it contains the same data
* (i.e. initrds) in a more sensible fashion, clearly separated from on-the-fly generated ones. Note
* that we only do all this measurement stuff if we are booted as UKI, and hence when PCR 11 is
* available, but PCR 9 is not predictable. */
_cleanup_strv_free_ char **banks = NULL;
r = tpm2_get_good_pcr_banks_strv(c, UINT32_C(1) << TPM2_PCR_KERNEL_INITRD, &banks);
if (r < 0)
return log_error_errno(r, "Could not verify PCR banks: %m");
_cleanup_free_ char *nv_name_h = hexmem(nv_name->name, nv_name->size);
if (!nv_name_h)
return log_oom_debug();
_cleanup_free_ char *word = NULL;
if (asprintf(&word, "nvpcr-init:%s:0x%x:%s", name, p.nv_index, nv_name_h) < 0)
return log_oom();
r = tpm2_pcr_extend_bytes(
c,
banks,
TPM2_PCR_KERNEL_INITRD,
&IOVEC_MAKE_STRING(word),
/* secret= */ NULL,
TPM2_EVENT_NVPCR_INIT,
word);
if (r < 0)
return log_error_errno(r, "Could not extend PCR %i: %m", TPM2_PCR_KERNEL_INITRD);
return 1;
#else /* HAVE_OPENSSL */
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
int tpm2_nvpcr_read(
Tpm2Context *c,
const Tpm2Handle *session,
const char *name,
struct iovec *ret_value,
uint32_t *ret_nv_index,
uint64_t *ret_priority) {
#if HAVE_OPENSSL
int r;
assert(c);
assert(name);
if (!tpm2_nvpcr_name_is_valid(name))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Attempt to read from NvPCR with invalid name, refusing: %s", name);
_cleanup_(nvpcr_data_done) NvPCRData p = {};
r = nvpcr_data_load(name, &p);
if (r < 0)
return r;
/* Check if the NvPCR is already initialized */
const char *auth_fname = strjoina("/run/systemd/nvpcr/", name, ".auth");
r = access_nofollow(auth_fname, F_OK);
if (r < 0) {
if (r != -ENOENT)
return log_debug_errno(r, "Failed to check if '%s' exists: %m", auth_fname);
/* valid, but not initialized */
*ret_value = (struct iovec) {};
if (ret_nv_index)
*ret_nv_index = p.nv_index;
if (ret_priority)
*ret_priority = p.priority;
return 0;
}
_cleanup_(tpm2_handle_freep) Tpm2Handle *nv_handle = NULL;
r = tpm2_index_to_handle(
c,
p.nv_index,
session,
/* ret_name= */ NULL,
&nv_handle);
if (r < 0)
return log_debug_errno(r, "Failed to acquire handle to NV index 0x%" PRIu32 ".", p.nv_index);
log_debug("Successfully acquired handle to NV index 0x%" PRIx32 ".", p.nv_index);
if (r > 0) {
r = tpm2_read_nv_index(
c,
/* session= */ NULL,
p.nv_index,
nv_handle,
ret_value);
if (r < 0)
return r;
r = 1;
} else {
*ret_value = (struct iovec) {};
r = 0;
}
if (ret_nv_index)
*ret_nv_index = p.nv_index;
if (ret_priority)
*ret_priority = p.priority;
return r;
#else /* HAVE_OPENSSL */
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
TPM2B_DIGEST *tpm2_pcr_prediction_result_get_hash(Tpm2PCRPredictionResult *result, uint16_t alg) {
size_t alg_idx;
assert(result);
alg_idx = tpm2_hash_algorithm_index(alg);
if (alg_idx == SIZE_MAX) /* Algorithm not known? */
return NULL;
if (result->hash[alg_idx].size <= 0) /* No hash value for this algorithm? */
return NULL;
return result->hash + alg_idx;
}
void tpm2_pcr_prediction_done(Tpm2PCRPrediction *p) {
assert(p);
for (uint32_t pcr = 0; pcr < TPM2_PCRS_MAX; pcr++)
ordered_set_free(p->results[pcr]);
}
static void tpm2_pcr_prediction_result_hash_func(const Tpm2PCRPredictionResult *banks, struct siphash *state) {
assert(banks);
for (size_t i = 0; i < TPM2_N_HASH_ALGORITHMS; i++)
siphash24_compress_safe(banks->hash[i].buffer, banks->hash[i].size, state);
}
static int tpm2_pcr_prediction_result_compare_func(const Tpm2PCRPredictionResult *a, const Tpm2PCRPredictionResult *b) {
int r;
assert(a);
assert(b);
for (size_t i = 0; i < TPM2_N_HASH_ALGORITHMS; i++) {
r = memcmp_nn(a->hash[i].buffer, a->hash[i].size,
b->hash[i].buffer, b->hash[i].size);
if (r != 0)
return r;
}
return 0;
}
DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(
tpm2_pcr_prediction_result_hash_ops,
Tpm2PCRPredictionResult,
tpm2_pcr_prediction_result_hash_func,
tpm2_pcr_prediction_result_compare_func,
Tpm2PCRPredictionResult,
free);
static Tpm2PCRPredictionResult *find_prediction_result_by_algorithm(OrderedSet *set, Tpm2PCRPredictionResult *result, size_t alg_idx) {
Tpm2PCRPredictionResult *f;
assert(result);
assert(alg_idx != SIZE_MAX);
f = ordered_set_get(set, result); /* Full match? */
if (f)
return f;
/* If this doesn't match full, then see if there an entry that at least matches by the relevant
* algorithm (we are fine if predictions are "incomplete" in some algorithms) */
ORDERED_SET_FOREACH(f, set)
if (memcmp_nn(result->hash[alg_idx].buffer, result->hash[alg_idx].size,
f->hash[alg_idx].buffer, f->hash[alg_idx].size) == 0)
return f;
return NULL;
}
bool tpm2_pcr_prediction_equal(
Tpm2PCRPrediction *a,
Tpm2PCRPrediction *b,
uint16_t algorithm) {
if (a == b)
return true;
if (!a || !b)
return false;
if (a->pcrs != b->pcrs)
return false;
size_t alg_idx = tpm2_hash_algorithm_index(algorithm);
if (alg_idx == SIZE_MAX)
return false;
for (uint32_t pcr = 0; pcr < TPM2_PCRS_MAX; pcr++) {
Tpm2PCRPredictionResult *banks;
ORDERED_SET_FOREACH(banks, a->results[pcr])
if (!find_prediction_result_by_algorithm(b->results[pcr], banks, alg_idx))
return false;
ORDERED_SET_FOREACH(banks, b->results[pcr])
if (!find_prediction_result_by_algorithm(a->results[pcr], banks, alg_idx))
return false;
}
return true;
}
int tpm2_pcr_prediction_to_json(
const Tpm2PCRPrediction *prediction,
uint16_t algorithm,
sd_json_variant **ret) {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *aj = NULL;
int r;
assert(prediction);
assert(ret);
for (uint32_t pcr = 0; pcr < TPM2_PCRS_MAX; pcr++) {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *vj = NULL;
Tpm2PCRPredictionResult *banks;
if (!BIT_SET(prediction->pcrs, pcr))
continue;
ORDERED_SET_FOREACH(banks, prediction->results[pcr]) {
TPM2B_DIGEST *hash = tpm2_pcr_prediction_result_get_hash(banks, algorithm);
if (!hash)
continue;
r = sd_json_variant_append_arrayb(
&vj,
SD_JSON_BUILD_HEX(hash->buffer, hash->size));
if (r < 0)
return log_error_errno(r, "Failed to append hash variant to JSON array: %m");
}
if (!vj)
continue;
r = sd_json_variant_append_arraybo(
&aj,
SD_JSON_BUILD_PAIR_INTEGER("pcr", pcr),
SD_JSON_BUILD_PAIR_VARIANT("values", vj));
if (r < 0)
return log_error_errno(r, "Failed to append PCR variants to JSON array: %m");
}
if (!aj) {
r = sd_json_variant_new_array(&aj, NULL, 0);
if (r < 0)
return r;
}
*ret = TAKE_PTR(aj);
return 0;
}
int tpm2_pcr_prediction_from_json(
Tpm2PCRPrediction *prediction,
uint16_t algorithm,
sd_json_variant *aj) {
int r;
assert(prediction);
size_t alg_index = tpm2_hash_algorithm_index(algorithm);
assert(alg_index < TPM2_N_HASH_ALGORITHMS);
if (!sd_json_variant_is_array(aj))
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "PCR variant array is not an array.");
sd_json_variant *pcr;
JSON_VARIANT_ARRAY_FOREACH(pcr, aj) {
sd_json_variant *nr, *values;
nr = sd_json_variant_by_key(pcr, "pcr");
if (!nr)
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "PCR array entry lacks PCR index field");
if (!sd_json_variant_is_unsigned(nr) ||
sd_json_variant_unsigned(nr) >= TPM2_PCRS_MAX)
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "PCR array entry PCR index is not an integer in the range 0…23");
values = sd_json_variant_by_key(pcr, "values");
if (!values)
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "PCR array entry lacks values field");
if (!sd_json_variant_is_array(values))
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "PCR array entry values field is not an array");
prediction->pcrs |= UINT32_C(1) << sd_json_variant_unsigned(nr);
sd_json_variant *v;
JSON_VARIANT_ARRAY_FOREACH(v, values) {
_cleanup_free_ void *buffer = NULL;
size_t size;
r = sd_json_variant_unhex(v, &buffer, &size);
if (r < 0)
return log_error_errno(r, "Failed to decode PCR policy array hash value");
if (size <= 0)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "PCR policy array hash value is zero.");
if (size > sizeof_field(TPM2B_DIGEST, buffer))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "PCR policy array hash value is too large.");
_cleanup_free_ Tpm2PCRPredictionResult *banks = new0(Tpm2PCRPredictionResult, 1);
if (!banks)
return log_oom();
memcpy(banks->hash[alg_index].buffer, buffer, size);
banks->hash[alg_index].size = size;
r = ordered_set_ensure_put(prediction->results + sd_json_variant_unsigned(nr), &tpm2_pcr_prediction_result_hash_ops, banks);
if (r == -EEXIST) /* Let's allow duplicates */
continue;
if (r < 0)
return log_error_errno(r, "Failed to insert result into set: %m");
TAKE_PTR(banks);
}
}
return 0;
}
int tpm2_calculate_policy_super_pcr(
Tpm2PCRPrediction *prediction,
uint16_t algorithm,
TPM2B_DIGEST *pcr_policy) {
int r;
assert_se(prediction);
assert_se(pcr_policy);
/* Start with a zero policy if not specified otherwise. */
TPM2B_DIGEST super_pcr_policy_digest = *pcr_policy;
/* First we look for all PCRs that have exactly one allowed hash value, and generate a single PolicyPCR policy from them */
_cleanup_free_ Tpm2PCRValue *single_values = NULL;
size_t n_single_values = 0;
BIT_FOREACH(pcr, prediction->pcrs) {
if (ordered_set_size(prediction->results[pcr]) != 1)
continue;
log_debug("Including PCR %i in single value PolicyPCR expression", pcr);
Tpm2PCRPredictionResult *banks = ASSERT_PTR(ordered_set_first(prediction->results[pcr]));
TPM2B_DIGEST *hash = tpm2_pcr_prediction_result_get_hash(banks, algorithm);
if (!hash)
continue;
if (!GREEDY_REALLOC(single_values, n_single_values + 1))
return -ENOMEM;
single_values[n_single_values++] = TPM2_PCR_VALUE_MAKE(pcr, algorithm, *hash);
}
if (n_single_values > 0) {
/* Evolve policy based on the expected PCR value for what we found. */
r = tpm2_calculate_policy_pcr(
single_values,
n_single_values,
&super_pcr_policy_digest);
if (r < 0)
return r;
}
/* Now deal with the PCRs for which we have variants, i.e. more than one allowed values */
for (uint32_t pcr = 0; pcr < TPM2_PCRS_MAX; pcr++) {
_cleanup_free_ TPM2B_DIGEST *pcr_policy_digest_variants = NULL;
size_t n_pcr_policy_digest_variants = 0;
Tpm2PCRPredictionResult *banks;
if (!BIT_SET(prediction->pcrs, pcr))
continue;
if (ordered_set_size(prediction->results[pcr]) <= 1) /* We only care for PCRs with 2 or more variants in this loop */
continue;
if (ordered_set_size(prediction->results[pcr]) > 8)
return log_error_errno(SYNTHETIC_ERRNO(E2BIG), "PCR policies with more than 8 alternatives per PCR are currently not supported.");
ORDERED_SET_FOREACH(banks, prediction->results[pcr]) {
/* Start from the super PCR policy from the previous PCR we looked at so far. */
TPM2B_DIGEST pcr_policy_digest = super_pcr_policy_digest;
TPM2B_DIGEST *hash = tpm2_pcr_prediction_result_get_hash(banks, algorithm);
if (!hash)
continue;
/* Evolve it based on the expected PCR value for this PCR */
r = tpm2_calculate_policy_pcr(
&TPM2_PCR_VALUE_MAKE(
pcr,
algorithm,
*hash),
/* n_pcr_values= */ 1,
&pcr_policy_digest);
if (r < 0)
return r;
/* Store away this new variant */
if (!GREEDY_REALLOC(pcr_policy_digest_variants, n_pcr_policy_digest_variants + 1))
return log_oom();
pcr_policy_digest_variants[n_pcr_policy_digest_variants++] = pcr_policy_digest;
log_debug("Calculated PCR policy variant %zu for PCR %" PRIu32, n_pcr_policy_digest_variants, pcr);
}
assert_se(n_pcr_policy_digest_variants >= 2);
assert_se(n_pcr_policy_digest_variants <= 8);
/* Now combine all our variant into one OR policy */
r = tpm2_calculate_policy_or(
pcr_policy_digest_variants,
n_pcr_policy_digest_variants,
&super_pcr_policy_digest);
if (r < 0)
return r;
log_debug("Combined %zu variants in OR policy.", n_pcr_policy_digest_variants);
}
*pcr_policy = super_pcr_policy_digest;
return 0;
}
int tpm2_policy_super_pcr(
Tpm2Context *c,
const Tpm2Handle *session,
const Tpm2PCRPrediction *prediction,
uint16_t algorithm) {
int r;
assert_se(c);
assert_se(session);
assert_se(prediction);
TPM2B_DIGEST previous_policy_digest = TPM2B_DIGEST_MAKE(NULL, TPM2_SHA256_DIGEST_SIZE);
uint32_t single_value_pcrs = 0;
/* Look for all PCRs that have only a singled allowed hash value, and synthesize a single PolicyPCR policy item for them */
for (uint32_t pcr = 0; pcr < TPM2_PCRS_MAX; pcr++) {
if (!BIT_SET(prediction->pcrs, pcr))
continue;
if (ordered_set_size(prediction->results[pcr]) != 1)
continue;
log_debug("Including PCR %" PRIu32 " in single value PolicyPCR expression", pcr);
single_value_pcrs |= UINT32_C(1) << pcr;
}
if (single_value_pcrs != 0) {
TPML_PCR_SELECTION pcr_selection;
tpm2_tpml_pcr_selection_from_mask(single_value_pcrs, algorithm, &pcr_selection);
_cleanup_free_ TPM2B_DIGEST *current_policy_digest = NULL;
r = tpm2_policy_pcr(
c,
session,
&pcr_selection,
&current_policy_digest);
if (r == -EUCLEAN) {
_cleanup_free_ char *j = NULL;
for (uint32_t pcr = 0; pcr < TPM2_PCRS_MAX; pcr++)
if (single_value_pcrs & (UINT32_C(1) << pcr))
(void) strextendf_with_separator(&j, ", ", "%" PRIu32, pcr);
return log_error_errno(r, "Combined value for PCR(s) %s encoded in policy does not match the current TPM state. Either the system has been tampered with or the provided policy is incorrect.", strna(j));
}
if (r < 0)
return log_error_errno(r, "Failed to submit PCR policy to TPM: %m");
previous_policy_digest = *current_policy_digest;
}
for (uint32_t pcr = 0; pcr < TPM2_PCRS_MAX; pcr++) {
size_t n_branches;
if (!BIT_SET(prediction->pcrs, pcr))
continue;
n_branches = ordered_set_size(prediction->results[pcr]);
if (n_branches < 1 || n_branches > 8)
return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Number of variants per PCR not in range 1…8");
if (n_branches == 1) /* Single choice PCRs are already covered by the loop above */
continue;
log_debug("Submitting PCR/OR policy for PCR %" PRIu32, pcr);
TPML_PCR_SELECTION pcr_selection;
tpm2_tpml_pcr_selection_from_mask(UINT32_C(1) << pcr, algorithm, &pcr_selection);
_cleanup_free_ TPM2B_DIGEST *current_policy_digest = NULL;
r = tpm2_policy_pcr(
c,
session,
&pcr_selection,
&current_policy_digest);
if (r == -EUCLEAN)
return log_error_errno(r, "Value for PCR %" PRIu32 " encoded in policy does not match the current TPM state. Either the system has been tampered with or the provided policy is incorrect.", pcr);
if (r < 0)
return log_error_errno(r, "Failed to submit PCR policy to TPM: %m");
_cleanup_free_ TPM2B_DIGEST *branches = NULL;
branches = new0(TPM2B_DIGEST, n_branches);
if (!branches)
return log_oom();
Tpm2PCRPredictionResult *banks;
size_t i = 0;
ORDERED_SET_FOREACH(banks, prediction->results[pcr]) {
TPM2B_DIGEST pcr_policy_digest = previous_policy_digest;
TPM2B_DIGEST *hash = tpm2_pcr_prediction_result_get_hash(banks, algorithm);
if (!hash)
continue;
/* Evolve it based on the expected PCR value for this PCR */
r = tpm2_calculate_policy_pcr(
&TPM2_PCR_VALUE_MAKE(
pcr,
algorithm,
*hash),
/* n_pcr_values= */ 1,
&pcr_policy_digest);
if (r < 0)
return log_error_errno(r, "Failed to calculate PolicyPCR: %m");
branches[i++] = pcr_policy_digest;
}
assert_se(i == n_branches);
current_policy_digest = mfree(current_policy_digest);
r = tpm2_policy_or(
c,
session,
branches,
n_branches,
&current_policy_digest);
if (r == -ENOANO)
return log_error_errno(r, "None of the alternative values for PCR %" PRIu32 " encoded in policy match the current TPM state. Either the system has been tampered with or the provided policy is incorrect.", pcr);
if (r < 0)
return log_error_errno(r, "Failed to submit OR policy to TPM: %m");
previous_policy_digest = *current_policy_digest;
}
return 0;
}
void tpm2_pcrlock_policy_done(Tpm2PCRLockPolicy *data) {
assert(data);
data->prediction_json = sd_json_variant_unref(data->prediction_json);
tpm2_pcr_prediction_done(&data->prediction);
iovec_done(&data->nv_handle);
iovec_done(&data->nv_public);
iovec_done(&data->srk_handle);
iovec_done(&data->pin_public);
iovec_done(&data->pin_private);
}
int tpm2_pcrlock_search_file(const char *path, FILE **ret_file, char **ret_path) {
static const char search[] =
"/run/systemd\0"
"/var/lib/systemd\0";
int r;
if (!path)
path = "pcrlock.json";
r = search_and_fopen_nulstr(path, ret_file ? "re" : NULL, NULL, search, ret_file, ret_path);
if (r < 0)
return log_debug_errno(r, "Failed to find TPM2 pcrlock policy file '%s': %m", path);
return 0;
}
int tpm2_pcrlock_policy_from_json(
sd_json_variant *v,
Tpm2PCRLockPolicy *ret_policy) {
/* We use a type check of _JSON_VARIANT_TYPE_INVALID for the integer fields to allow
* json_dispatch_uint32() to parse strings as integers to work around the integer type weakness of
* JSON's design. */
static const sd_json_dispatch_field policy_dispatch[] = {
{ "pcrBank", SD_JSON_VARIANT_STRING, json_dispatch_tpm2_algorithm, offsetof(Tpm2PCRLockPolicy, algorithm), SD_JSON_MANDATORY },
{ "pcrValues", SD_JSON_VARIANT_ARRAY, sd_json_dispatch_variant, offsetof(Tpm2PCRLockPolicy, prediction_json), SD_JSON_MANDATORY },
{ "nvIndex", _SD_JSON_VARIANT_TYPE_INVALID, sd_json_dispatch_uint32, offsetof(Tpm2PCRLockPolicy, nv_index), SD_JSON_MANDATORY },
{ "nvHandle", SD_JSON_VARIANT_STRING, json_dispatch_unbase64_iovec, offsetof(Tpm2PCRLockPolicy, nv_handle), SD_JSON_MANDATORY },
{ "nvPublic", SD_JSON_VARIANT_STRING, json_dispatch_unbase64_iovec, offsetof(Tpm2PCRLockPolicy, nv_public), SD_JSON_MANDATORY },
{ "srkHandle", SD_JSON_VARIANT_STRING, json_dispatch_unbase64_iovec, offsetof(Tpm2PCRLockPolicy, srk_handle), SD_JSON_MANDATORY },
{ "pinPublic", SD_JSON_VARIANT_STRING, json_dispatch_unbase64_iovec, offsetof(Tpm2PCRLockPolicy, pin_public), SD_JSON_MANDATORY },
{ "pinPrivate", SD_JSON_VARIANT_STRING, json_dispatch_unbase64_iovec, offsetof(Tpm2PCRLockPolicy, pin_private), SD_JSON_MANDATORY },
{}
};
_cleanup_(tpm2_pcrlock_policy_done) Tpm2PCRLockPolicy policy = {};
int r;
assert(v);
assert(ret_policy);
r = sd_json_dispatch(v, policy_dispatch, SD_JSON_LOG, &policy);
if (r < 0)
return r;
r = tpm2_pcr_prediction_from_json(&policy.prediction, policy.algorithm, policy.prediction_json);
if (r < 0)
return r;
*ret_policy = TAKE_STRUCT(policy);
return 1;
}
int tpm2_pcrlock_policy_load(
const char *path,
Tpm2PCRLockPolicy *ret_policy) {
_cleanup_free_ char *discovered_path = NULL;
_cleanup_fclose_ FILE *f = NULL;
int r;
assert(ret_policy);
r = tpm2_pcrlock_search_file(path, &f, &discovered_path);
if (r == -ENOENT) {
*ret_policy = (Tpm2PCRLockPolicy) {};
return 0;
}
if (r < 0)
return log_error_errno(r, "Failed to load TPM2 pcrlock policy file: %m");
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_parse_file(
f,
discovered_path,
/* flags= */ 0,
&v,
/* reterr_line= */ NULL,
/* ret_column= */ NULL);
if (r < 0)
return log_error_errno(r, "Failed to parse existing pcrlock policy file '%s': %m", discovered_path);
return tpm2_pcrlock_policy_from_json(v, ret_policy);
}
static int pcrlock_policy_load_credential(
const char *name,
const struct iovec *data,
Tpm2PCRLockPolicy *ret) {
_cleanup_free_ char *c = NULL;
int r;
assert(name);
c = strdup(name);
if (!c)
return log_oom();
ascii_strlower(c); /* Lowercase, to match what we did at encryption time */
_cleanup_(iovec_done) struct iovec decoded = {};
r = decrypt_credential_and_warn(
c,
now(CLOCK_REALTIME),
/* tpm2_device= */ NULL,
/* tpm2_signature_path= */ NULL,
UID_INVALID,
data,
CREDENTIAL_ALLOW_NULL,
&decoded);
if (r < 0)
return r;
if (memchr(decoded.iov_base, 0, decoded.iov_len))
return log_error_errno(r, "Credential '%s' contains embedded NUL byte, refusing.", name);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_parse(decoded.iov_base,
/* flags= */ 0,
&v,
/* reterr_line= */ NULL,
/* ret_column= */ NULL);
if (r < 0)
return log_error_errno(r, "Failed to parse pcrlock policy: %m");
r = tpm2_pcrlock_policy_from_json(v, ret);
if (r < 0)
return r;
return 0;
}
int tpm2_pcrlock_policy_from_credentials(
const struct iovec *srk,
const struct iovec *nv,
Tpm2PCRLockPolicy *ret) {
_cleanup_close_ int dfd = -EBADF;
int r;
assert(ret);
/* During boot we'll not have access to the pcrlock.json file in /var/. In order to support
* pcrlock-bound root file systems we'll store a copy of the JSON data, wrapped in an (plaintext)
* credential in the ESP or XBOOTLDR partition. There might be multiple of those however (because of
* multi-boot), hence we use the SRK and NV data from the LUKS2 header as search key, and parse all
* such JSON policies until we find a matching one. */
const char *dp;
r = get_encrypted_system_credentials_dir(&dp);
if (r < 0)
return log_error_errno(r, "Failed to get encrypted system credentials directory: %m");
dfd = open(dp, O_CLOEXEC|O_DIRECTORY);
if (dfd < 0) {
if (errno == ENOENT) {
log_debug("No encrypted system credentials passed.");
return 0;
}
return log_error_errno(errno, "Failed to open system credentials directory.");
}
_cleanup_free_ DirectoryEntries *de = NULL;
r = readdir_all(dfd, RECURSE_DIR_IGNORE_DOT, &de);
if (r < 0)
return log_error_errno(r, "Failed to enumerate system credentials: %m");
FOREACH_ARRAY(i, de->entries, de->n_entries) {
_cleanup_(iovec_done) struct iovec data = {};
struct dirent *d = *i;
if (!startswith_no_case(d->d_name, "pcrlock.")) /* VFAT is case-insensitive, hence don't be too strict here */
continue;
r = read_full_file_full(
dfd, d->d_name,
/* offset= */ UINT64_MAX,
/* size= */ CREDENTIAL_ENCRYPTED_SIZE_MAX,
READ_FULL_FILE_UNBASE64|READ_FULL_FILE_FAIL_WHEN_LARGER,
/* bind_name= */ NULL,
(char**) &data.iov_base,
&data.iov_len);
if (r == -ENOENT)
continue;
if (r < 0) {
log_warning_errno(r, "Failed to read credentials file %s/%s, skipping: %m", dp, d->d_name);
continue;
}
_cleanup_(tpm2_pcrlock_policy_done) Tpm2PCRLockPolicy loaded_policy = {};
r = pcrlock_policy_load_credential(
d->d_name,
&data,
&loaded_policy);
if (r < 0) {
log_warning_errno(r, "Loading of pcrlock policy from credential '%s/%s' failed, skipping.", ENCRYPTED_SYSTEM_CREDENTIALS_DIRECTORY, d->d_name);
continue;
}
if ((!srk || iovec_equal(srk, &loaded_policy.srk_handle)) &&
(!nv || iovec_equal(nv, &loaded_policy.nv_handle))) {
*ret = TAKE_STRUCT(loaded_policy);
return 1;
}
}
log_info("No pcrlock policy found among system credentials.");
*ret = (Tpm2PCRLockPolicy) {};
return 0;
}
int tpm2_load_public_key_file(const char *path, TPM2B_PUBLIC *ret) {
_cleanup_free_ char *device_key_buffer = NULL;
TPM2B_PUBLIC device_key_public = {};
size_t device_key_buffer_size;
TSS2_RC rc;
int r;
assert(path);
assert(ret);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
r = read_full_file(path, &device_key_buffer, &device_key_buffer_size);
if (r < 0)
return log_error_errno(r, "Failed to read device key from file '%s': %m", path);
size_t offset = 0;
rc = sym_Tss2_MU_TPM2B_PUBLIC_Unmarshal(
(uint8_t*) device_key_buffer,
device_key_buffer_size,
&offset,
&device_key_public);
if (rc != TSS2_RC_SUCCESS)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Could not unmarshal public key from file.");
assert(offset <= device_key_buffer_size);
if (offset != device_key_buffer_size)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Found %zu bytes of trailing garbage in public key file.",
device_key_buffer_size - offset);
*ret = device_key_public;
return 0;
}
int tpm2_hmac_key_from_pin(Tpm2Context *c, const Tpm2Handle *session, const TPM2B_AUTH *pin, Tpm2Handle **ret) {
int r;
assert(c);
assert(pin);
assert(ret);
log_debug("Converting PIN into TPM2 HMAC-SHA256 object.");
/* Load the PIN (which we have stored in the "auth" TPM2B_AUTH) into the TPM as an HMAC key so that
* we can use it in a TPM2_PolicySigned() to write to the nvindex. For that we'll prep a pair of
* TPM2B_PUBLIC and TPM2B_SENSITIVE that defines an HMAC-SHA256 keyed hash function, and initialize
* it based on the provided PIN data. */
TPM2B_PUBLIC auth_hmac_public = {
.publicArea = {
.type = TPM2_ALG_KEYEDHASH,
.nameAlg = TPM2_ALG_SHA256,
.objectAttributes = TPMA_OBJECT_SIGN_ENCRYPT,
.parameters.keyedHashDetail.scheme = {
.scheme = TPM2_ALG_HMAC,
.details.hmac.hashAlg = TPM2_ALG_SHA256,
},
.unique.keyedHash.size = SHA256_DIGEST_SIZE,
},
};
TPM2B_SENSITIVE auth_hmac_private = {
.sensitiveArea = {
.sensitiveType = TPM2_ALG_KEYEDHASH,
.sensitive.bits.size = pin->size,
.seedValue.size = SHA256_DIGEST_SIZE,
},
};
/* Copy in the key data */
memcpy_safe(auth_hmac_private.sensitiveArea.sensitive.bits.buffer, pin->buffer, pin->size);
/* NB: We initialize the seed of the TPMT_SENSITIVE structure to all zeroes, since we want a stable
* "name" of the PIN object */
/* Now calculate the "unique" field for the public area, based on the sensitive data, according to
* the algorithm in the TPM2 spec, part 1, Section 27.5.3.2 */
struct iovec sensitive_data[] = {
IOVEC_MAKE(auth_hmac_private.sensitiveArea.seedValue.buffer, auth_hmac_private.sensitiveArea.seedValue.size),
IOVEC_MAKE(auth_hmac_private.sensitiveArea.sensitive.bits.buffer, auth_hmac_private.sensitiveArea.sensitive.bits.size),
};
r = tpm2_digest_many(
auth_hmac_public.publicArea.nameAlg,
&auth_hmac_public.publicArea.unique.keyedHash,
sensitive_data,
ELEMENTSOF(sensitive_data),
/* extend= */ false);
if (r < 0)
return r;
/* And now load the public/private parts into the TPM and get a handle back */
r = tpm2_load_external(
c,
session,
&auth_hmac_public,
&auth_hmac_private,
ret);
if (r < 0)
return log_error_errno(r, "Failed to load PIN into TPM2: %m");
return 0;
}
static int tpm2_unmarshal_attestation(const void *data, size_t size, TPMS_ATTEST *ret) {
size_t offset = 0;
TPMS_ATTEST attest = {};
TSS2_RC rc;
int r;
assert(data);
assert(ret);
r = dlopen_tpm2(LOG_DEBUG);
if (r < 0)
return r;
rc = sym_Tss2_MU_TPMS_ATTEST_Unmarshal(data, size, &offset, &attest);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to unmarshal attestation structure: %s", sym_Tss2_RC_Decode(rc));
if (offset != size)
return log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Garbage at end of attestation structure data.");
*ret = attest;
return 0;
}
/* Convert a TPM signature to PEM. This only supports RSASSA, RSAPSS and ECDSA signatures. */
int tpm2_tpmt_signature_to_pem(const TPMT_SIGNATURE *signature, char **ret) {
#if HAVE_OPENSSL
int r;
assert(signature);
assert(ret);
r = dlopen_libcrypto(LOG_DEBUG);
if (r < 0)
return r;
const char *label = NULL;
_cleanup_free_ void *sig = NULL;
size_t sig_len = 0;
switch (signature->sigAlg) {
case TPM2_ALG_RSASSA:
label = "RSA SIGNATURE";
sig_len = signature->signature.rsassa.sig.size;
sig = memdup(signature->signature.rsassa.sig.buffer, sig_len);
if (!sig)
return log_oom_debug();
break;
case TPM2_ALG_RSAPSS:
label = "RSA SIGNATURE";
sig_len = signature->signature.rsapss.sig.size;
sig = memdup(signature->signature.rsapss.sig.buffer, sig_len);
if (!sig)
return log_oom_debug();
break;
case TPM2_ALG_ECDSA: {
label = "ECDSA SIGNATURE";
_cleanup_(BN_freep) BIGNUM *bn_r = sym_BN_bin2bn(
signature->signature.ecdsa.signatureR.buffer,
signature->signature.ecdsa.signatureR.size, NULL);
if (!bn_r)
return log_openssl_errors(LOG_DEBUG, "Failed to convert ECDSA signature r to BIGNUM");
_cleanup_(BN_freep) BIGNUM *bn_s = sym_BN_bin2bn(
signature->signature.ecdsa.signatureS.buffer,
signature->signature.ecdsa.signatureS.size, NULL);
if (!bn_s)
return log_openssl_errors(LOG_DEBUG, "Failed to convert ECDSA signature s to BIGNUM");
_cleanup_(ECDSA_SIG_freep) ECDSA_SIG *ecdsaSig = sym_ECDSA_SIG_new();
if (!ecdsaSig)
return log_oom_debug();
if (sym_ECDSA_SIG_set0(ecdsaSig, bn_r, bn_s) <= 0)
return log_openssl_errors(LOG_DEBUG, "Failed to set ECDSA signature");
TAKE_PTR(bn_r);
TAKE_PTR(bn_s);
/* We want to allocate our own buffer so we can have a common cleanup path for this
* and RSA signatures. */
r = sym_i2d_ECDSA_SIG(ecdsaSig, NULL);
if (r <= 0)
return log_openssl_errors(LOG_DEBUG, "Failed to determine ECDSA signature size");
sig_len = r;
sig = malloc(sig_len);
if (!sig)
return log_oom_debug();
unsigned char *p = sig;
r = sym_i2d_ECDSA_SIG(ecdsaSig, &p);
if (r <= 0)
return log_openssl_errors(LOG_DEBUG, "Failed to DER encode ECDSA signature");
break;
}
case TPM2_ALG_NULL:
*ret = NULL;
return 0;
default:
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Unknown signature algorithm id 0x%" PRIx16, signature->sigAlg);
}
_cleanup_(memstream_done) MemStream m = {};
FILE *f = memstream_init(&m);
if (!f)
return -ENOMEM;
if (sym_PEM_write(f, label, /* header= */ NULL, sig, sig_len) <= 0)
return log_openssl_errors(LOG_DEBUG, "Failed to write signature in PEM format");
return memstream_finalize(&m, ret, /* ret_size= */ NULL);
#else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
/* Convert a TPM public key to a SubjectPublicKeyInfo PEM sequence. */
int tpm2_tpmt_public_to_pem(const TPMT_PUBLIC *public, char **ret) {
#if HAVE_OPENSSL
int r;
assert(public);
assert(ret);
TPM2B_PUBLIC public2b = {
.size = sizeof(TPMT_PUBLIC),
.publicArea = *public,
};
_cleanup_(EVP_PKEY_freep) EVP_PKEY *pkey = NULL;
r = tpm2_tpm2b_public_to_openssl_pkey(&public2b, &pkey);
if (r < 0)
return r;
return openssl_pubkey_to_pem(pkey, ret);
#else
return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "OpenSSL support is disabled.");
#endif
}
static const char* tpm2_hash_alg_to_string_tss2(TPMI_ALG_HASH alg) {
/* Note that this is different to tpm2_hash_alg_to_string because it
* returns a string that aligns with those produced by TSS2 and compatible
* with the TCG TSS2 JSON format. The JSON format is actually not case
* sensitive, but this is here just to be consistent with the signature
* algorithm. */
switch (alg) {
case TPM2_ALG_SHA1:
return "SHA1";
case TPM2_ALG_SHA256:
return "SHA256";
case TPM2_ALG_SHA384:
return "SHA384";
case TPM2_ALG_SHA512:
return "SHA512";
default:
log_debug("Unknown hash algorithm id 0x%" PRIx16, alg);
return NULL;
}
}
static const char* tpm2_sig_alg_to_string(TPMI_ALG_SIG_SCHEME alg) {
switch (alg) {
case TPM2_ALG_RSASSA:
return "RSASSA";
case TPM2_ALG_RSAPSS:
return "RSAPSS";
case TPM2_ALG_ECDSA:
return "ECDSA";
case TPM2_ALG_NULL:
return "NULL";
default:
log_debug("Unknown signature algorithm id 0x%" PRIx16, alg);
return NULL;
}
}
/* Convert a TPM signature to JSON, in a format compatible with the TCG TSS2 JSON data format,
* and which is compatible with the TSS2 implementation. This only supports RSASSA, RSAPSS and ECDSA
* signatures.
*
* See https://trustedcomputinggroup.org/wp-content/uploads/TSS_JSON_Policy_v0p7_r08_pub.pdf */
int tpm2_tpmt_signature_to_json(const TPMT_SIGNATURE *signature, sd_json_variant **ret) {
int r = 0;
assert(signature);
assert(ret);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *siginnerj = NULL;
switch (signature->sigAlg) {
case TPM2_ALG_RSASSA:
r = sd_json_buildo(
&siginnerj,
SD_JSON_BUILD_PAIR_STRING("hash", tpm2_hash_alg_to_string_tss2(signature->signature.rsassa.hash)),
SD_JSON_BUILD_PAIR_HEX("sig", signature->signature.rsassa.sig.buffer, signature->signature.rsassa.sig.size));
break;
case TPM2_ALG_RSAPSS:
r = sd_json_buildo(
&siginnerj,
SD_JSON_BUILD_PAIR_STRING("hash", tpm2_hash_alg_to_string_tss2(signature->signature.rsapss.hash)),
SD_JSON_BUILD_PAIR_HEX("sig", signature->signature.rsapss.sig.buffer, signature->signature.rsapss.sig.size));
break;
case TPM2_ALG_ECDSA:
r = sd_json_buildo(
&siginnerj,
SD_JSON_BUILD_PAIR_STRING("hash", tpm2_hash_alg_to_string_tss2(signature->signature.ecdsa.hash)),
SD_JSON_BUILD_PAIR_HEX("signatureR", signature->signature.ecdsa.signatureR.buffer, signature->signature.ecdsa.signatureR.size),
SD_JSON_BUILD_PAIR_HEX("signatureS", signature->signature.ecdsa.signatureS.buffer, signature->signature.ecdsa.signatureS.size));
break;
case TPM2_ALG_NULL:
break;
default:
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Unknown signature algorithm id 0x%" PRIx16, signature->sigAlg);
}
if (r < 0)
return r;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *sigj = NULL;
r = sd_json_buildo(
&sigj,
SD_JSON_BUILD_PAIR_STRING("sigAlg", tpm2_sig_alg_to_string(signature->sigAlg)),
JSON_BUILD_PAIR_VARIANT_NON_NULL("signature", siginnerj));
if (r < 0)
return r;
*ret = TAKE_PTR(sigj);
return 0;
}
static const char* tpm2_st_attest_to_string(TPMI_ST_ATTEST attest) {
switch (attest) {
case TPM2_ST_ATTEST_NV:
return "ATTEST_NV";
case TPM2_ST_ATTEST_SESSION_AUDIT:
return "ATTEST_SESSION_AUDIT";
case TPM2_ST_ATTEST_QUOTE:
return "ATTEST_QUOTE";
default:
log_debug("Unknown attestation type 0x%" PRIx16, attest);
return NULL;
}
}
/* Convert a TPMS_CLOCK_INFO to JSON, in a format compatible with the TCG TSS2 JSON data format,
* and which is compatible with the TSS2 implementation.
*
* See https://trustedcomputinggroup.org/wp-content/uploads/TSS_JSON_Policy_v0p7_r08_pub.pdf */
static int tpm2_tpms_clock_info_to_json(const TPMS_CLOCK_INFO *clock_info, sd_json_variant **ret) {
int r;
assert(clock_info);
assert(ret);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_buildo(
&v,
/* tss2-fapi serializes a uint64_t that doesn't fit into a signed 54-bits as an
* array of 2 integers, but the deserialize path handles decoding this just fine. */
SD_JSON_BUILD_PAIR_UNSIGNED("clock", clock_info->clock),
SD_JSON_BUILD_PAIR_UNSIGNED("resetCount", clock_info->resetCount),
SD_JSON_BUILD_PAIR_UNSIGNED("restartCount", clock_info->restartCount),
/* tss2-fapi doesn't handle this being a boolean when deserializing. */
SD_JSON_BUILD_PAIR_STRING("safe", clock_info->safe == TPM2_YES ? "YES" : "NO"));
if (r < 0)
return r;
*ret = TAKE_PTR(v);
return 0;
}
/* Convert TPML_PCR_SELECTION to JSON, in a format compatible with the TCG TSS2 JSON data format,
* and which is compatible with the TSS2 implementation.
*
* See https://trustedcomputinggroup.org/wp-content/uploads/TSS_JSON_Policy_v0p7_r08_pub.pdf */
static int tpm2_tpml_pcr_selection_to_json(const TPML_PCR_SELECTION *pcrs, sd_json_variant **ret) {
int r;
assert(pcrs);
assert(ret);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
FOREACH_TPMS_PCR_SELECTION_IN_TPML_PCR_SELECTION(s, pcrs) {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *sv = NULL;
FOREACH_PCR_IN_TPMS_PCR_SELECTION(pcr, s) {
r = sd_json_variant_append_arrayb(&sv, SD_JSON_BUILD_INTEGER(pcr));
if (r < 0)
return r;
}
r = sd_json_variant_append_arraybo(
&v,
/* As documented in the TCG TSS2 JSON data format spec, the sizeOfSelect
* field isn't represented in the encoding. */
SD_JSON_BUILD_PAIR_STRING("hash", tpm2_hash_alg_to_string_tss2(s->hash)),
SD_JSON_BUILD_PAIR_VARIANT("pcrSelect", sv));
if (r < 0)
return r;
}
*ret = TAKE_PTR(v);
return 0;
}
/* Convert TPMS_ATTEST to JSON, in a format compatible with the TCG TSS2 JSON data format, and which is
* compatible with the TSS2 implementation.
*
* See https://trustedcomputinggroup.org/wp-content/uploads/TSS_JSON_Policy_v0p7_r08_pub.pdf */
static int tpm2_tpms_attest_to_json(const TPMS_ATTEST *attest, sd_json_variant **ret) {
int r;
assert(attest);
assert(ret);
if (attest->magic != TPM2_GENERATED_VALUE)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Invalid magic value %" PRIu32, attest->magic);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *cv = NULL;
r = tpm2_tpms_clock_info_to_json(&attest->clockInfo, &cv);
if (r < 0)
return r;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *av = NULL;
switch (attest->type) {
case TPM2_ST_ATTEST_NV:
r = sd_json_buildo(
&av,
SD_JSON_BUILD_PAIR_HEX("indexName", attest->attested.nv.indexName.name, attest->attested.nv.indexName.size),
SD_JSON_BUILD_PAIR_UNSIGNED("offset", attest->attested.nv.offset),
SD_JSON_BUILD_PAIR_HEX("nvContents", attest->attested.nv.nvContents.buffer, attest->attested.nv.nvContents.size));
break;
case TPM2_ST_ATTEST_SESSION_AUDIT:
r = sd_json_buildo(
&av,
/* tss2-fapi doesn't handle this being a boolean when deserializing. */
SD_JSON_BUILD_PAIR_STRING("exclusiveSession", attest->attested.sessionAudit.exclusiveSession == TPM2_YES ? "YES" : "NO"),
SD_JSON_BUILD_PAIR_HEX("sessionDigest", attest->attested.sessionAudit.sessionDigest.buffer, attest->attested.sessionAudit.sessionDigest.size));
break;
case TPM2_ST_ATTEST_QUOTE: {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *sv = NULL;
r = tpm2_tpml_pcr_selection_to_json(&attest->attested.quote.pcrSelect, &sv);
if (r < 0)
return r;
r = sd_json_buildo(
&av,
SD_JSON_BUILD_PAIR_VARIANT("pcrSelect", sv),
SD_JSON_BUILD_PAIR_HEX("pcrDigest", attest->attested.quote.pcrDigest.buffer, attest->attested.quote.pcrDigest.size));
break;
}
default:
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Unknown attestation type id 0x%" PRIx16, attest->type);
}
if (r < 0)
return r;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_buildo(
&v,
SD_JSON_BUILD_PAIR_STRING("magic", "VALUE"),
SD_JSON_BUILD_PAIR_STRING("type", tpm2_st_attest_to_string(attest->type)),
SD_JSON_BUILD_PAIR_HEX("qualifiedSigner", attest->qualifiedSigner.name, attest->qualifiedSigner.size),
SD_JSON_BUILD_PAIR_HEX("extraData", attest->extraData.buffer, attest->extraData.size),
SD_JSON_BUILD_PAIR_VARIANT("clockInfo", cv),
/* tss2-fapi serializes a uint64_t that doesn't fit into a signed 54-bits as an
* array of 2 integers, but the deserialize path handles decoding this just fine. */
SD_JSON_BUILD_PAIR_UNSIGNED("firmwareVersion", attest->firmwareVersion),
SD_JSON_BUILD_PAIR_VARIANT("attested", av));
if (r < 0)
return r;
*ret = TAKE_PTR(v);
return 0;
}
/* Convert a signature scheme to JSON, in a format compatible with the TCG TSS2 JSON data format,
* and which is compatible with the TSS2 implementation. This only supports RSASSA, RSAPSS and ECDSA
* signatures.
*
* See https://trustedcomputinggroup.org/wp-content/uploads/TSS_JSON_Policy_v0p7_r08_pub.pdf */
static int tpm2_tpmt_sig_scheme_to_json(const TPMT_SIG_SCHEME *scheme, sd_json_variant **ret) {
int r;
assert(scheme);
assert(ret);
TPMI_ALG_SIG_SCHEME alg = scheme->scheme;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *dv = NULL;
if (IN_SET(alg, TPM2_ALG_RSASSA, TPM2_ALG_RSAPSS, TPM2_ALG_ECDSA)) {
r = sd_json_buildo(
&dv,
SD_JSON_BUILD_PAIR_STRING("hashAlg", tpm2_hash_alg_to_string_tss2(scheme->details.any.hashAlg)));
if (r < 0)
return r;
} else if (alg != TPM2_ALG_NULL)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Unknown signature algorithm id 0x%" PRIx16, alg);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_buildo(
&v,
SD_JSON_BUILD_PAIR_STRING("scheme", tpm2_sig_alg_to_string(alg)),
JSON_BUILD_PAIR_VARIANT_NON_NULL("details", dv));
if (r < 0)
return r;
*ret = TAKE_PTR(v);
return 0;
}
/* Convert a signature scheme and attestation structure to JSON in a format that is compatible with the
* "QuoteInfo encoding" described in the TCG FAPI spec and which matches the TSS2 FAPI implementation. Note
* that this is generic - supporting also the result from NV_Certify and GetSessionAuditDigest. Note that
* only RSASSA, RSAPSS and ECDSA signature schemes are supported.
*
* See https://trustedcomputinggroup.org/wp-content/uploads/TSS_JSON_Policy_v0p7_r08_pub.pdf and
* https://trustedcomputinggroup.org/wp-content/uploads/TSS_FAPI_v0p94_r09_pub.pdf */
int tpm2_attest_info_to_json(const TPMT_SIG_SCHEME *scheme, const TPMS_ATTEST *attest, sd_json_variant **ret) {
int r;
assert(attest);
assert(ret);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *sv = NULL;
r = tpm2_tpmt_sig_scheme_to_json(scheme, &sv);
if (r < 0)
return r;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *av = NULL;
r = tpm2_tpms_attest_to_json(attest, &av);
if (r < 0)
return r;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_buildo(
&v,
SD_JSON_BUILD_PAIR_VARIANT("sig_scheme", sv),
SD_JSON_BUILD_PAIR_VARIANT("attest", av));
if (r < 0)
return r;
*ret = TAKE_PTR(v);
return 0;
}
static const char* tpm2_public_alg_to_string(TPMI_ALG_PUBLIC alg) {
switch (alg) {
case TPM2_ALG_RSA:
return "RSA";
case TPM2_ALG_ECC:
return "ECC";
case TPM2_ALG_SYMCIPHER:
return "SYMCIPHER";
case TPM2_ALG_KEYEDHASH:
return "KEYEDHASH";
default:
log_debug("Unknown public object type 0x%" PRIx16, alg);
return NULL;
}
}
static const char* tpm2_ecc_curve_to_string(TPMI_ECC_CURVE curve) {
switch (curve) {
case TPM2_ECC_NIST_P192:
return "NIST_P192";
case TPM2_ECC_NIST_P224:
return "NIST_P224";
case TPM2_ECC_NIST_P256:
return "NIST_P256";
case TPM2_ECC_NIST_P384:
return "NIST_P384";
case TPM2_ECC_NIST_P521:
return "NIST_P521";
case TPM2_ECC_BN_P256:
return "BN_P256";
case TPM2_ECC_BN_P638:
return "BN_P638";
case TPM2_ECC_SM2_P256:
return "SM2_P256";
default:
log_debug("Unknown ECC curve ID 0x%" PRIx16, curve);
return NULL;
}
}
/* Convert an asymmetric scheme to JSON, in a format compatible with the TCG TSS2 JSON data format,
* and which is compatible with the TSS2 implementation. This only supports the signature schemes RSASSA,
* RSAPSS and ECDSA.
*
* See https://trustedcomputinggroup.org/wp-content/uploads/TSS_JSON_Policy_v0p7_r08_pub.pdf */
static int tpm2_tpmt_asym_scheme_to_json(const TPMT_ASYM_SCHEME *scheme, sd_json_variant **ret) {
int r;
assert(scheme);
assert(ret);
TPMI_ALG_ASYM_SCHEME alg = scheme->scheme;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *dv = NULL;
if (IN_SET(alg, TPM2_ALG_RSASSA, TPM2_ALG_RSAPSS, TPM2_ALG_ECDSA)) {
r = sd_json_buildo(
&dv,
SD_JSON_BUILD_PAIR_STRING("hashAlg", tpm2_hash_alg_to_string_tss2(scheme->details.anySig.hashAlg)));
if (r < 0)
return r;
} else if (alg != TPM2_ALG_NULL)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Unknown asymmetric scheme id 0x%" PRIx16, alg);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_buildo(
&v,
SD_JSON_BUILD_PAIR_STRING("scheme", tpm2_sig_alg_to_string(alg)),
SD_JSON_BUILD_PAIR_VARIANT("details", dv));
if (r < 0)
return r;
*ret = TAKE_PTR(v);
return 0;
}
/* Convert a TPM public key to JSON, in a format compatible with the TCG TSS2 JSON data format, and which
* is compatible with the TSS2 implementation. This only supports restricted asymmetric signing keys with
* the signing scheme RSASSA, RSAPSS or ECDSA.
*
* See https://trustedcomputinggroup.org/wp-content/uploads/TSS_JSON_Policy_v0p7_r08_pub.pdf */
int tpm2_tpmt_public_to_json(const TPMT_PUBLIC *public, sd_json_variant **ret) {
int r;
assert(public);
assert(ret);
if (!IN_SET(public->type, TPM2_ALG_RSA, TPM2_ALG_ECC))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Unsupported object type 0x%" PRIx16, public->type);
/* We're currently only serializing restricted signing keys which never have a symmetric algorithm,
* so to avoid implementing the JSON encoding for this, just reject anything with a symmetric
* algorithm. */
if (public->parameters.asymDetail.symmetric.algorithm != TPM2_ALG_NULL)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Unsupported object symmetric algorithm 0x%" PRIx16,
public->parameters.asymDetail.symmetric.algorithm);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *sv = NULL;
r = tpm2_tpmt_asym_scheme_to_json(&public->parameters.asymDetail.scheme, &sv);
if (r < 0)
return r;
/* Marshal the public parameters. */
_cleanup_(sd_json_variant_unrefp) sd_json_variant *pv = NULL;
switch (public->type) {
case TPM2_ALG_RSA:
r = sd_json_buildo(
&pv,
SD_JSON_BUILD_PAIR_OBJECT("symmetric",
SD_JSON_BUILD_PAIR_STRING("algorithm", "NULL")),
SD_JSON_BUILD_PAIR_VARIANT("scheme", sv),
SD_JSON_BUILD_PAIR_UNSIGNED("keyBits", public->parameters.rsaDetail.keyBits),
SD_JSON_BUILD_PAIR_UNSIGNED("exponent", public->parameters.rsaDetail.exponent));
break;
case TPM2_ALG_ECC:
/* No valid key has anything other than NULL here, so reject anything else to avoid
* having to implement the JSON encoding. */
if (public->parameters.eccDetail.kdf.scheme != TPM2_ALG_NULL)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Unsupported ECC object KDF algorithm 0x%" PRIx16,
public->parameters.eccDetail.kdf.scheme);
r = sd_json_buildo(
&pv,
SD_JSON_BUILD_PAIR_OBJECT("symmetric",
SD_JSON_BUILD_PAIR_STRING("algorithm", "NULL")),
SD_JSON_BUILD_PAIR_VARIANT("scheme", sv),
SD_JSON_BUILD_PAIR_STRING("curveID", tpm2_ecc_curve_to_string(public->parameters.eccDetail.curveID)),
SD_JSON_BUILD_PAIR_OBJECT("kdf",
SD_JSON_BUILD_PAIR_STRING("scheme", "NULL")));
break;
default:
/* We've already checked the type. */
assert_not_reached();
}
if (r < 0)
return r;
/* Marshal the public key. */
_cleanup_(sd_json_variant_unrefp) sd_json_variant *uv = NULL;
switch (public->type) {
case TPM2_ALG_RSA:
r = sd_json_variant_new_hex(&uv, public->unique.rsa.buffer, public->unique.rsa.size);
break;
case TPM2_ALG_ECC:
r = sd_json_buildo(
&uv,
SD_JSON_BUILD_PAIR_HEX("x", public->unique.ecc.x.buffer, public->unique.ecc.x.size),
SD_JSON_BUILD_PAIR_HEX("y", public->unique.ecc.y.buffer, public->unique.ecc.y.size));
break;
default:
/* We've already checked the type. */
assert_not_reached();
}
if (r < 0)
return r;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_buildo(
&v,
SD_JSON_BUILD_PAIR_STRING("type", tpm2_public_alg_to_string(public->type)),
SD_JSON_BUILD_PAIR_STRING("nameAlg", tpm2_hash_alg_to_string_tss2(public->nameAlg)),
/* tss2-fapi serializes these as an object with pretty names, but it can deserialize
* an integer here. */
SD_JSON_BUILD_PAIR_INTEGER("objectAttributes", public->objectAttributes),
SD_JSON_BUILD_PAIR_HEX("authPolicy", public->authPolicy.buffer, public->authPolicy.size),
SD_JSON_BUILD_PAIR_VARIANT("parameters", pv),
SD_JSON_BUILD_PAIR_VARIANT("unique", uv));
if (r < 0)
return r;
*ret = TAKE_PTR(v);
return 0;
}
/* Convert a NV public area to JSON, in a format compatible with the TCG TSS2 JSON data format, and which
* is compatible with the TSS2 implementation.
*
* See https://trustedcomputinggroup.org/wp-content/uploads/TSS_JSON_Policy_v0p7_r08_pub.pdf */
int tpm2_tpms_nv_public_to_json(const TPMS_NV_PUBLIC *nv_public, sd_json_variant **ret) {
int r;
assert(nv_public);
assert(ret);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = sd_json_buildo(
&v,
SD_JSON_BUILD_PAIR_INTEGER("nvIndex", nv_public->nvIndex),
SD_JSON_BUILD_PAIR_STRING("nameAlg", tpm2_hash_alg_to_string_tss2(nv_public->nameAlg)),
/* tss2-fapi serializes these as an object with pretty names, but it can deserialize
* an integer here. */
SD_JSON_BUILD_PAIR_INTEGER("attributes", nv_public->attributes),
SD_JSON_BUILD_PAIR_HEX("authPolicy", nv_public->authPolicy.buffer, nv_public->authPolicy.size),
SD_JSON_BUILD_PAIR_INTEGER("dataSize", nv_public->dataSize));
if (r < 0)
return r;
*ret = TAKE_PTR(v);
return 0;
}
static const TPMT_SIG_SCHEME SIG_SCHEME_TEMPLATE_NULL = {
.scheme = TPM2_ALG_NULL,
};
int tpm2_quote(
Tpm2Context *c,
const Tpm2Handle *sign_session,
const Tpm2Handle *audit_session,
const Tpm2Handle *sign_key,
const TPM2B_DATA *qualifying_data,
const TPML_PCR_SELECTION *pcr_select,
TPMS_ATTEST **ret_quoted,
TPMT_SIGNATURE **ret_signature) {
TSS2_RC rc;
int r;
assert(c);
assert(pcr_select);
tpm2_log_debug_tpml_pcr_selection(pcr_select, "Fetching TPM PCR quote for selection");
if (audit_session && !tpm2_is_audit_session(c, audit_session))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Supplied session handle is not an audit session.");
_cleanup_(Esys_Freep) TPM2B_ATTEST *quoted = NULL;
_cleanup_(Esys_Freep) TPMT_SIGNATURE *signature = NULL;
rc = sym_Esys_Quote(
c->esys_context,
sign_key ? sign_key->esys_handle : ESYS_TR_NONE,
sign_session ? sign_session->esys_handle : ESYS_TR_PASSWORD,
audit_session ? audit_session->esys_handle : ESYS_TR_NONE,
ESYS_TR_NONE,
qualifying_data,
&SIG_SCHEME_TEMPLATE_NULL,
pcr_select,
&quoted,
ret_signature ? &signature : NULL);
if (rc == TPM2_RC_EXCLUSIVE)
return log_debug_errno(SYNTHETIC_ERRNO(EBUSY),
"Failed to obtain TPM quote: audit session required exclusivity");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to obtain TPM quote: %s", sym_Tss2_RC_Decode(rc));
if (ret_quoted) {
_cleanup_free_ TPMS_ATTEST *quoted_decoded = new0(TPMS_ATTEST, 1);
if (!quoted_decoded)
return log_oom_debug();
r = tpm2_unmarshal_attestation(quoted->attestationData, quoted->size, quoted_decoded);
if (r < 0)
return r;
*ret_quoted = TAKE_PTR(quoted_decoded);
}
if (ret_signature)
*ret_signature = TAKE_PTR(signature);
return 0;
}
int tpm2_nv_certify(
Tpm2Context *c,
const Tpm2Handle *sign_session,
const Tpm2Handle *auth_session,
const Tpm2Handle *audit_session,
const Tpm2Handle *sign_key,
const TPMS_NV_PUBLIC *nv_public,
const Tpm2Handle *nv_handle,
const TPM2B_DATA *qualifying_data,
TPMS_ATTEST **ret_certify_info,
TPMT_SIGNATURE **ret_signature) {
TSS2_RC rc;
int r;
assert(c);
assert(nv_public);
assert(nv_handle);
log_debug("Fetching TPM attestation for NV index 0x%" PRIx32 ".", nv_public->nvIndex);
if (audit_session && !tpm2_is_audit_session(c, audit_session))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL),
"Supplied session handle is not an audit session.");
TPM2_HANDLE nv_index;
r = tpm2_index_from_handle(c, nv_handle, &nv_index);
if (r == -EOPNOTSUPP)
nv_index = nv_public->nvIndex;
else if (r < 0)
return log_debug_errno(r, "Failed to get index from TPM handle");
if (nv_index != nv_public->nvIndex)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Inconsistent TPMS_NV_PUBLIC and Tpm2Handle arguments supplied");
_cleanup_(Esys_Freep) TPM2B_ATTEST *certify_info = NULL;
_cleanup_(Esys_Freep) TPMT_SIGNATURE *signature = NULL;
rc = sym_Esys_NV_Certify(
c->esys_context,
sign_key ? sign_key->esys_handle : ESYS_TR_NONE,
nv_handle->esys_handle,
nv_handle->esys_handle,
sign_session ? sign_session->esys_handle : ESYS_TR_PASSWORD,
auth_session ? auth_session->esys_handle : ESYS_TR_PASSWORD,
audit_session ? audit_session->esys_handle : ESYS_TR_NONE,
qualifying_data,
&SIG_SCHEME_TEMPLATE_NULL,
nv_public->dataSize, 0,
&certify_info,
ret_signature ? &signature : NULL);
if (rc == TPM2_RC_EXCLUSIVE)
return log_debug_errno(SYNTHETIC_ERRNO(EBUSY),
"Failed to obtain TPM attestation for NV index: audit session required exclusivity");
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to obtain TPM attestation for NV index: %s", sym_Tss2_RC_Decode(rc));
if (ret_certify_info) {
_cleanup_free_ TPMS_ATTEST *certify_info_decoded = new0(TPMS_ATTEST, 1);
if (!certify_info_decoded)
return log_oom_debug();
r = tpm2_unmarshal_attestation(certify_info->attestationData, certify_info->size, certify_info_decoded);
if (r < 0)
return r;
*ret_certify_info = TAKE_PTR(certify_info_decoded);
}
if (ret_signature)
*ret_signature = TAKE_PTR(signature);
return 0;
}
int tpm2_get_session_audit_digest(
Tpm2Context *c,
const Tpm2Handle *eh_session,
const Tpm2Handle *sign_session,
const Tpm2Handle *audit_session,
const Tpm2Handle *sign_key,
const TPM2B_DATA *qualifying_data,
TPMS_ATTEST **ret_audit_info,
TPMT_SIGNATURE **ret_signature) {
TSS2_RC rc;
int r;
assert(c);
assert(audit_session);
log_debug("Fetching TPM attestation for audit session.");
_cleanup_(Esys_Freep) TPM2B_ATTEST *audit_info = NULL;
_cleanup_(Esys_Freep) TPMT_SIGNATURE *signature = NULL;
rc = sym_Esys_GetSessionAuditDigest(
c->esys_context,
ESYS_TR_RH_ENDORSEMENT,
sign_key ? sign_key->esys_handle : ESYS_TR_NONE,
audit_session->esys_handle,
eh_session ? eh_session->esys_handle : ESYS_TR_PASSWORD,
sign_session ? sign_session->esys_handle : ESYS_TR_PASSWORD,
ESYS_TR_NONE,
qualifying_data,
&SIG_SCHEME_TEMPLATE_NULL,
&audit_info,
ret_signature ? &signature : NULL);
if (rc != TSS2_RC_SUCCESS)
return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE),
"Failed to obtain TPM attestation for audit session: %s", sym_Tss2_RC_Decode(rc));
if (ret_audit_info) {
_cleanup_free_ TPMS_ATTEST *audit_info_decoded = new0(TPMS_ATTEST, 1);
if (!audit_info_decoded)
return log_oom_debug();
r = tpm2_unmarshal_attestation(audit_info->attestationData, audit_info->size, audit_info_decoded);
if (r < 0)
return r;
*ret_audit_info = TAKE_PTR(audit_info_decoded);
}
if (ret_signature)
*ret_signature = TAKE_PTR(signature);
return 0;
}
#endif
int tpm2_argon2id_derive_split(
const char *pin,
const struct iovec *salt,
const Argon2IdParameters *argon2id_params,
struct iovec *ret_key1,
char **ret_b64_pin) {
int r;
_cleanup_(iovec_done_erase) struct iovec derived = {};
assert(pin);
assert(salt);
assert(argon2id_params);
assert(ret_key1);
assert(ret_b64_pin);
r = kdf_argon2id_derive(
&IOVEC_MAKE(pin, strlen(pin)),
salt,
argon2id_params,
/* derive_size= */ 64, &derived);
if (r < 0)
return r;
assert(derived.iov_len == 64);
const uint8_t *derived_bytes = derived.iov_base;
ret_key1->iov_base = memdup(derived_bytes, 32);
if (!ret_key1->iov_base)
return log_oom();
ret_key1->iov_len = 32;
ssize_t n = base64mem(derived_bytes + 32, 32, ret_b64_pin);
if (n < 0)
return log_oom();
return 0;
}
int tpm2_argon2id_hkdf(
const struct iovec *key1,
const struct iovec *unsealed,
struct iovec *ret_volume_key) {
assert(key1);
assert(key1->iov_len > 0);
assert(unsealed);
assert(ret_volume_key);
return kdf_hkdf_sha256(
key1,
unsealed,
&IOVEC_MAKE_STRING("systemd-tpm2-argon2id-lock"),
/* derive_size= */ 32, ret_volume_key);
}
char* tpm2_pcr_mask_to_string(uint32_t mask) {
_cleanup_free_ char *s = NULL;
FOREACH_PCR_IN_MASK(n, mask)
if (strextendf_with_separator(&s, "+", "%d", n) < 0)
return NULL;
if (!s)
return strdup("");
return TAKE_PTR(s);
}
int tpm2_make_pcr_json_array(uint32_t pcr_mask, sd_json_variant **ret) {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *a = NULL;
int r;
assert(ret);
for (size_t i = 0; i < TPM2_PCRS_MAX; i++) {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *e = NULL;
if ((pcr_mask & (UINT32_C(1) << i)) == 0)
continue;
r = sd_json_variant_new_integer(&e, i);
if (r < 0)
return r;
r = sd_json_variant_append_array(&a, e);
if (r < 0)
return r;
}
if (!a)
return sd_json_variant_new_array(ret, NULL, 0);
*ret = TAKE_PTR(a);
return 0;
}
int tpm2_parse_pcr_json_array(sd_json_variant *v, uint32_t *ret) {
sd_json_variant *e;
uint32_t mask = 0;
if (!sd_json_variant_is_array(v))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 PCR array is not a JSON array.");
JSON_VARIANT_ARRAY_FOREACH(e, v) {
uint64_t u;
if (!sd_json_variant_is_unsigned(e))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 PCR is not an unsigned integer.");
u = sd_json_variant_unsigned(e);
if (u >= TPM2_PCRS_MAX)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 PCR number out of range: %" PRIu64, u);
mask |= UINT32_C(1) << u;
}
if (ret)
*ret = mask;
return 0;
}
static int tpm2_make_shard_array(
const struct iovec data[],
size_t n_data,
int (*encode_iovec)(sd_json_variant **, const void*, size_t n), /* pass sd_json_variant_new_base64() or sd_json_variant_new_hex() */
sd_json_variant **ret) {
int r;
/* Turns a series of struct iovec into either an array of base64/hex strings, or a single string
* thereof. Used for generated "tpm2-blob" or "tpm2-policy-hash" fields. */
assert(data);
assert(n_data > 0);
assert(encode_iovec);
assert(ret);
/* Only one item? Then create only one encoded string, for compatibility with older versions which
* didn't support the "sharding" scheme */
if (n_data == 1)
return encode_iovec(ret, data[0].iov_base, data[0].iov_len);
/* Multiple items? Then generate an array of encoded strings */
_cleanup_(sd_json_variant_unrefp) sd_json_variant *j = NULL;
FOREACH_ARRAY(d, data, n_data) {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *item = NULL;
r = encode_iovec(&item, d->iov_base, d->iov_len);
if (r < 0)
return r;
r = sd_json_variant_append_array(&j, item);
if (r < 0)
return r;
}
*ret = TAKE_PTR(j);
return 0;
}
int tpm2_make_luks2_json(
int keyslot,
uint32_t hash_pcr_mask,
uint16_t pcr_bank,
const struct iovec *pubkey,
const char *pubkey_policy_ref,
uint32_t pubkey_pcr_mask,
uint16_t primary_alg,
const struct iovec blobs[],
size_t n_blobs,
const struct iovec policy_hash[],
size_t n_policy_hash,
const struct iovec *salt,
const struct iovec *srk,
const struct iovec *pcrlock_nv,
TPM2Flags flags,
const Argon2IdParameters *argon2id_params,
sd_json_variant **ret) {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL, *hmj = NULL, *pkmj = NULL;
_cleanup_free_ char *keyslot_as_string = NULL;
int r;
assert(iovec_is_valid(pubkey));
assert(!pubkey_policy_ref || iovec_is_set(pubkey));
assert(n_blobs >= 1);
assert(n_policy_hash >= 1);
POINTER_MAY_BE_NULL(argon2id_params);
if (asprintf(&keyslot_as_string, "%i", keyslot) < 0)
return -ENOMEM;
r = tpm2_make_pcr_json_array(hash_pcr_mask, &hmj);
if (r < 0)
return r;
if (pubkey_pcr_mask != 0) {
r = tpm2_make_pcr_json_array(pubkey_pcr_mask, &pkmj);
if (r < 0)
return r;
}
_cleanup_(sd_json_variant_unrefp) sd_json_variant *phj = NULL;
r = tpm2_make_shard_array(policy_hash, n_policy_hash, sd_json_variant_new_hex, &phj);
if (r < 0)
return r;
_cleanup_(sd_json_variant_unrefp) sd_json_variant *bj = NULL;
r = tpm2_make_shard_array(blobs, n_blobs, sd_json_variant_new_base64, &bj);
if (r < 0)
return r;
const Argon2IdParameters argon2id_params_safe =
FLAGS_SET(flags, TPM2_FLAGS_USE_ARGON2ID) && argon2id_params
? *argon2id_params
: (Argon2IdParameters) {};
/* Note: We made the mistake of using "-" in the field names, which isn't particular compatible with
* other programming languages. Let's not make things worse though, i.e. future additions to the JSON
* object should use "_" rather than "-" in field names. */
r = sd_json_buildo(
&v,
SD_JSON_BUILD_PAIR("type", JSON_BUILD_CONST_STRING("systemd-tpm2")),
SD_JSON_BUILD_PAIR("keyslots", SD_JSON_BUILD_ARRAY(SD_JSON_BUILD_STRING(keyslot_as_string))),
SD_JSON_BUILD_PAIR_VARIANT("tpm2-blob", bj),
SD_JSON_BUILD_PAIR_VARIANT("tpm2-pcrs", hmj),
SD_JSON_BUILD_PAIR_CONDITION(pcr_bank != 0 && tpm2_hash_alg_to_string(pcr_bank), "tpm2-pcr-bank", SD_JSON_BUILD_STRING(tpm2_hash_alg_to_string(pcr_bank))),
SD_JSON_BUILD_PAIR_CONDITION(primary_alg != 0 && tpm2_asym_alg_to_string(primary_alg), "tpm2-primary-alg", SD_JSON_BUILD_STRING(tpm2_asym_alg_to_string(primary_alg))),
SD_JSON_BUILD_PAIR_VARIANT("tpm2-policy-hash", phj),
SD_JSON_BUILD_PAIR_CONDITION(FLAGS_SET(flags, TPM2_FLAGS_USE_PIN), "tpm2-pin", SD_JSON_BUILD_BOOLEAN(true)),
SD_JSON_BUILD_PAIR_CONDITION(FLAGS_SET(flags, TPM2_FLAGS_USE_PCRLOCK), "tpm2_pcrlock", SD_JSON_BUILD_BOOLEAN(true)),
SD_JSON_BUILD_PAIR_CONDITION(pubkey_pcr_mask != 0, "tpm2_pubkey_pcrs", SD_JSON_BUILD_VARIANT(pkmj)),
SD_JSON_BUILD_PAIR_CONDITION(iovec_is_set(pubkey), "tpm2_pubkey", JSON_BUILD_IOVEC_BASE64(pubkey)),
SD_JSON_BUILD_PAIR_CONDITION(pubkey_policy_ref != NULL, "tpm2_pubkey_ref", SD_JSON_BUILD_STRING(pubkey_policy_ref)),
SD_JSON_BUILD_PAIR_CONDITION(iovec_is_set(salt), "tpm2_salt", JSON_BUILD_IOVEC_BASE64(salt)),
SD_JSON_BUILD_PAIR_CONDITION(iovec_is_set(srk), "tpm2_srk", JSON_BUILD_IOVEC_BASE64(srk)),
SD_JSON_BUILD_PAIR_CONDITION(iovec_is_set(pcrlock_nv), "tpm2_pcrlock_nv", JSON_BUILD_IOVEC_BASE64(pcrlock_nv)),
SD_JSON_BUILD_PAIR_CONDITION(FLAGS_SET(flags, TPM2_FLAGS_USE_ARGON2ID), "tpm2_argon2id_memcost", SD_JSON_BUILD_UNSIGNED(argon2id_params_safe.memcost_bytes)),
SD_JSON_BUILD_PAIR_CONDITION(FLAGS_SET(flags, TPM2_FLAGS_USE_ARGON2ID), "tpm2_argon2id_iterations", SD_JSON_BUILD_UNSIGNED(argon2id_params_safe.iterations)),
SD_JSON_BUILD_PAIR_CONDITION(FLAGS_SET(flags, TPM2_FLAGS_USE_ARGON2ID), "tpm2_argon2id_lanes", SD_JSON_BUILD_UNSIGNED(argon2id_params_safe.lanes)));
if (r < 0)
return r;
if (ret)
*ret = TAKE_PTR(v);
return keyslot;
}
static int tpm2_parse_shard_array(
sd_json_variant *v,
const char *name,
int (*decode_iovec)(sd_json_variant*, struct iovec *ret), /* pass json_variant_unbase64_iovec() or json_variant_unhex_iovec() */
struct iovec **ret_data,
size_t *ret_n_data) {
int r;
assert(v);
assert(name);
assert(decode_iovec);
assert(ret_data);
assert(ret_n_data);
/* Parses the "tpm2-blob" or "tpm2-policy-hash" fields of our LUKS JSON serialization. This can
* either be an array of base64/hex strings, or a single such string. The former to allow for sharded
* keys. The latter mostly for compatibility with older versions where we didn't support sharded
* keys. */
struct iovec *data = NULL;
size_t n_data = 0;
CLEANUP_ARRAY(data, n_data, iovec_array_free);
if (sd_json_variant_is_array(v)) {
if (sd_json_variant_elements(v) == 0)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 token data contains empty '%s' array.", name);
data = new0(struct iovec, sd_json_variant_elements(v));
if (!data)
return log_oom_debug();
sd_json_variant *i;
JSON_VARIANT_ARRAY_FOREACH(i, v) {
r = decode_iovec(i, data + n_data);
if (r < 0)
return log_debug_errno(r, "Invalid data in '%s' field.", name);
n_data++;
}
} else {
data = new0(struct iovec, 1);
if (!data)
return log_oom_debug();
r = decode_iovec(v, data + 0);
if (r < 0)
return log_debug_errno(r, "Invalid data in '%s' field.", name);
n_data = 1;
}
*ret_data = TAKE_PTR(data);
*ret_n_data = n_data;
return 0;
}
int tpm2_parse_luks2_json(
sd_json_variant *v,
int *ret_keyslot,
uint32_t *ret_hash_pcr_mask,
uint16_t *ret_pcr_bank,
struct iovec *ret_pubkey,
char **ret_pubkey_policy_ref,
uint32_t *ret_pubkey_pcr_mask,
uint16_t *ret_primary_alg,
struct iovec **ret_blobs,
size_t *ret_n_blobs,
struct iovec **ret_policy_hash,
size_t *ret_n_policy_hash,
struct iovec *ret_salt,
struct iovec *ret_srk,
struct iovec *ret_pcrlock_nv,
TPM2Flags *ret_flags,
Argon2IdParameters *ret_argon2id_params) {
_cleanup_(iovec_done) struct iovec pubkey = {}, salt = {}, srk = {}, pcrlock_nv = {};
_cleanup_free_ char *pubkey_ref = NULL;
uint32_t hash_pcr_mask = 0, pubkey_pcr_mask = 0;
uint16_t primary_alg = 0;
uint16_t pcr_bank = UINT16_MAX; /* default: pick automatically */
int r, keyslot = -1;
TPM2Flags flags = 0;
sd_json_variant *w;
assert(v);
if (ret_keyslot) {
keyslot = cryptsetup_get_keyslot_from_token(v);
if (keyslot < 0) {
/* Return a recognizable error when parsing this field, so that callers can handle parsing
* errors of the keyslots field gracefully, since it's not 'owned' by us, but by the LUKS2
* spec */
log_debug_errno(keyslot, "Failed to extract keyslot index from TPM2 JSON data token, skipping: %m");
return -EUCLEAN;
}
}
w = sd_json_variant_by_key(v, "tpm2-pcrs");
if (!w)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 token data lacks 'tpm2-pcrs' field.");
r = tpm2_parse_pcr_json_array(w, &hash_pcr_mask);
if (r < 0)
return log_debug_errno(r, "Failed to parse TPM2 PCR mask: %m");
/* The bank field is optional, since it was added in systemd 250 only. Before the bank was hardcoded
* to SHA256. */
w = sd_json_variant_by_key(v, "tpm2-pcr-bank");
if (w) {
/* The PCR bank field is optional */
if (!sd_json_variant_is_string(w))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 PCR bank is not a string.");
r = tpm2_hash_alg_from_string(sd_json_variant_string(w));
if (r < 0)
return log_debug_errno(r, "TPM2 PCR bank invalid or not supported: %s", sd_json_variant_string(w));
pcr_bank = r;
}
/* The primary key algorithm field is optional, since it was also added in systemd 250 only. Before
* the algorithm was hardcoded to ECC. */
w = sd_json_variant_by_key(v, "tpm2-primary-alg");
if (w) {
/* The primary key algorithm is optional */
if (!sd_json_variant_is_string(w))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 primary key algorithm is not a string.");
r = tpm2_asym_alg_from_string(sd_json_variant_string(w));
if (r < 0)
return log_debug_errno(r, "TPM2 asymmetric algorithm invalid or not supported: %s", sd_json_variant_string(w));
primary_alg = r;
}
w = sd_json_variant_by_key(v, "tpm2-blob");
if (!w)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 token data lacks 'tpm2-blob' field.");
struct iovec *blobs = NULL;
size_t n_blobs = 0;
CLEANUP_ARRAY(blobs, n_blobs, iovec_array_free);
r = tpm2_parse_shard_array(w, "tpm2-blob", json_variant_unbase64_iovec, &blobs, &n_blobs);
if (r < 0)
return r;
w = sd_json_variant_by_key(v, "tpm2-policy-hash");
if (!w)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 token data lacks 'tpm2-policy-hash' field.");
struct iovec *policy_hash = NULL;
size_t n_policy_hash = 0;
CLEANUP_ARRAY(policy_hash, n_policy_hash, iovec_array_free);
r = tpm2_parse_shard_array(w, "tpm2-policy-hash", json_variant_unhex_iovec, &policy_hash, &n_policy_hash);
if (r < 0)
return r;
w = sd_json_variant_by_key(v, "tpm2-pin");
if (w) {
if (!sd_json_variant_is_boolean(w))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 PIN policy is not a boolean.");
SET_FLAG(flags, TPM2_FLAGS_USE_PIN, sd_json_variant_boolean(w));
}
w = sd_json_variant_by_key(v, "tpm2_pcrlock");
if (w) {
if (!sd_json_variant_is_boolean(w))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 pclock policy is not a boolean.");
SET_FLAG(flags, TPM2_FLAGS_USE_PCRLOCK, sd_json_variant_boolean(w));
}
w = sd_json_variant_by_key(v, "tpm2_salt");
if (w) {
r = json_variant_unbase64_iovec(w, &salt);
if (r < 0)
return log_debug_errno(r, "Invalid base64 data in 'tpm2_salt' field.");
}
w = sd_json_variant_by_key(v, "tpm2_pubkey_pcrs");
if (w) {
r = tpm2_parse_pcr_json_array(w, &pubkey_pcr_mask);
if (r < 0)
return r;
}
w = sd_json_variant_by_key(v, "tpm2_pubkey");
if (w) {
r = json_variant_unbase64_iovec(w, &pubkey);
if (r < 0)
return log_debug_errno(r, "Failed to decode PCR public key.");
} else if (pubkey_pcr_mask != 0)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Public key PCR mask set, but not public key included in JSON data, refusing.");
w = sd_json_variant_by_key(v, "tpm2_pubkey_ref");
if (w) {
const char *s = sd_json_variant_string(w);
if (!s)
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Public key policy reference is not a string.");
pubkey_ref = strdup(s);
if (!pubkey_ref)
return log_oom_debug();
}
w = sd_json_variant_by_key(v, "tpm2_srk");
if (w) {
r = json_variant_unbase64_iovec(w, &srk);
if (r < 0)
return log_debug_errno(r, "Invalid base64 data in 'tpm2_srk' field.");
}
w = sd_json_variant_by_key(v, "tpm2_pcrlock_nv");
if (w) {
r = json_variant_unbase64_iovec(w, &pcrlock_nv);
if (r < 0)
return log_debug_errno(r, "Invalid base64 data in 'tpm2_pcrlock_nv' field.");
}
Argon2IdParameters ap = {};
w = sd_json_variant_by_key(v, "tpm2_argon2id_memcost");
if (w) {
if (!sd_json_variant_is_unsigned(w))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "tpm2_argon2id_memcost is not an unsigned integer.");
ap.memcost_bytes = sd_json_variant_unsigned(w);
if (ap.memcost_bytes == 0)
return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN), "tpm2_argon2id_memcost must be non-zero.");
}
w = sd_json_variant_by_key(v, "tpm2_argon2id_iterations");
if (w) {
uint64_t raw_iterations;
if (!sd_json_variant_is_unsigned(w))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "tpm2_argon2id_iterations is not an unsigned integer.");
raw_iterations = sd_json_variant_unsigned(w);
if (raw_iterations == 0 || raw_iterations > UINT32_MAX)
return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN), "tpm2_argon2id_iterations value out of range.");
ap.iterations = (uint32_t) raw_iterations;
}
w = sd_json_variant_by_key(v, "tpm2_argon2id_lanes");
if (w) {
uint64_t raw_lanes;
if (!sd_json_variant_is_unsigned(w))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "tpm2_argon2id_lanes is not an unsigned integer.");
raw_lanes = sd_json_variant_unsigned(w);
if (raw_lanes == 0 || raw_lanes > UINT32_MAX)
return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN), "tpm2_argon2id_lanes value out of range.");
ap.lanes = (uint32_t) raw_lanes;
}
if (ap.memcost_bytes > 0 && ap.iterations > 0 && ap.lanes > 0) {
if (!iovec_is_set(&salt))
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Argon2id PIN requires salt in LUKS2 token.");
if (ap.memcost_bytes > physical_memory())
return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN), "Argon2id memory cost exceeds physical memory.");
SET_FLAG(flags, TPM2_FLAGS_USE_ARGON2ID, true);
} else if (ap.memcost_bytes > 0 || ap.iterations > 0 || ap.lanes > 0)
return log_debug_errno(SYNTHETIC_ERRNO(EUCLEAN), "Incomplete Argon2id parameters in LUKS2 token.");
if (ret_keyslot)
*ret_keyslot = keyslot;
if (ret_hash_pcr_mask)
*ret_hash_pcr_mask = hash_pcr_mask;
if (ret_pcr_bank)
*ret_pcr_bank = pcr_bank;
if (ret_pubkey)
*ret_pubkey = TAKE_STRUCT(pubkey);
if (ret_pubkey_policy_ref)
*ret_pubkey_policy_ref = TAKE_PTR(pubkey_ref);
if (ret_pubkey_pcr_mask)
*ret_pubkey_pcr_mask = pubkey_pcr_mask;
if (ret_primary_alg)
*ret_primary_alg = primary_alg;
if (ret_blobs)
*ret_blobs = TAKE_PTR(blobs);
if (ret_n_blobs)
*ret_n_blobs = n_blobs;
if (ret_policy_hash)
*ret_policy_hash = TAKE_PTR(policy_hash);
if (ret_n_policy_hash)
*ret_n_policy_hash = n_policy_hash;
if (ret_salt)
*ret_salt = TAKE_STRUCT(salt);
if (ret_srk)
*ret_srk = TAKE_STRUCT(srk);
if (ret_pcrlock_nv)
*ret_pcrlock_nv = TAKE_STRUCT(pcrlock_nv);
if (ret_flags)
*ret_flags = flags;
if (ret_argon2id_params)
*ret_argon2id_params = ap;
return 0;
}
int tpm2_hash_alg_to_size(uint16_t alg) {
switch (alg) {
case TPM2_ALG_SHA1:
return 20;
case TPM2_ALG_SHA256:
return 32;
case TPM2_ALG_SHA384:
return 48;
case TPM2_ALG_SHA512:
return 64;
default:
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown hash algorithm id 0x%" PRIx16, alg);
}
}
const char* tpm2_hash_alg_to_string(uint16_t alg) {
switch (alg) {
case TPM2_ALG_SHA1:
return "sha1";
case TPM2_ALG_SHA256:
return "sha256";
case TPM2_ALG_SHA384:
return "sha384";
case TPM2_ALG_SHA512:
return "sha512";
default:
log_debug("Unknown hash algorithm id 0x%" PRIx16, alg);
return NULL;
}
}
int tpm2_hash_alg_from_string(const char *alg) {
if (strcaseeq_ptr(alg, "sha1"))
return TPM2_ALG_SHA1;
if (strcaseeq_ptr(alg, "sha256"))
return TPM2_ALG_SHA256;
if (strcaseeq_ptr(alg, "sha384"))
return TPM2_ALG_SHA384;
if (strcaseeq_ptr(alg, "sha512"))
return TPM2_ALG_SHA512;
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown hash algorithm name '%s'", alg);
}
const char* tpm2_asym_alg_to_string(uint16_t alg) {
switch (alg) {
case TPM2_ALG_ECC:
return "ecc";
case TPM2_ALG_RSA:
return "rsa";
default:
log_debug("Unknown asymmetric algorithm id 0x%" PRIx16, alg);
return NULL;
}
}
int tpm2_asym_alg_from_string(const char *alg) {
if (strcaseeq_ptr(alg, "ecc"))
return TPM2_ALG_ECC;
if (strcaseeq_ptr(alg, "rsa"))
return TPM2_ALG_RSA;
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown asymmetric algorithm name '%s'", alg);
}
const char* tpm2_sym_alg_to_string(uint16_t alg) {
switch (alg) {
#if HAVE_TPM2
case TPM2_ALG_AES:
return "aes";
#endif
default:
log_debug("Unknown symmetric algorithm id 0x%" PRIx16, alg);
return NULL;
}
}
const char* tpm2_sym_mode_to_string(uint16_t mode) {
switch (mode) {
#if HAVE_TPM2
case TPM2_ALG_CTR:
return "ctr";
case TPM2_ALG_OFB:
return "ofb";
case TPM2_ALG_CBC:
return "cbc";
case TPM2_ALG_CFB:
return "cfb";
case TPM2_ALG_ECB:
return "ecb";
#endif
default:
log_debug("Unknown symmetric mode id 0x%" PRIx16, mode);
return NULL;
}
}
int tpm2_sym_mode_from_string(const char *mode) {
#if HAVE_TPM2
if (strcaseeq_ptr(mode, "ctr"))
return TPM2_ALG_CTR;
if (strcaseeq_ptr(mode, "ofb"))
return TPM2_ALG_OFB;
if (strcaseeq_ptr(mode, "cbc"))
return TPM2_ALG_CBC;
if (strcaseeq_ptr(mode, "cfb"))
return TPM2_ALG_CFB;
if (strcaseeq_ptr(mode, "ecb"))
return TPM2_ALG_ECB;
#endif
return log_debug_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown symmetric mode name '%s'", mode);
}
Tpm2Support tpm2_support_full(Tpm2Support mask) {
Tpm2Support support = TPM2_SUPPORT_NONE;
int r;
if (((mask & (TPM2_SUPPORT_SUBSYSTEM|TPM2_SUPPORT_DRIVER)) != 0) && detect_container() <= 0) {
/* Check if there's a /dev/tpmrm* device via sysfs. If we run in a container we likely just
* got the host sysfs mounted. Since devices are generally not virtualized for containers,
* let's assume containers never have a TPM, at least for now. */
r = dir_is_empty("/sys/class/tpmrm", /* ignore_hidden_or_backup= */ false);
if (r < 0) {
if (r != -ENOENT)
log_debug_errno(r, "Unable to test whether /sys/class/tpmrm/ exists and is populated, assuming it is not: %m");
} else if (r == 0) /* populated! */
support |= TPM2_SUPPORT_SUBSYSTEM|TPM2_SUPPORT_DRIVER;
else
/* If the directory exists but is empty, we know the subsystem is enabled but no
* driver has been loaded yet. */
support |= TPM2_SUPPORT_SUBSYSTEM;
}
if (FLAGS_SET(mask, TPM2_SUPPORT_FIRMWARE) && efi_has_tpm2())
support |= TPM2_SUPPORT_FIRMWARE;
#if HAVE_TPM2
support |= TPM2_SUPPORT_SYSTEM;
if ((mask & (TPM2_SUPPORT_LIBRARIES|TPM2_SUPPORT_LIBTSS2_ALL)) != 0) {
r = dlopen_tpm2_esys(LOG_DEBUG);
if (r >= 0)
support |= TPM2_SUPPORT_LIBTSS2_ESYS;
r = dlopen_tpm2_rc(LOG_DEBUG);
if (r >= 0)
support |= TPM2_SUPPORT_LIBTSS2_RC;
r = dlopen_tpm2_mu(LOG_DEBUG);
if (r >= 0)
support |= TPM2_SUPPORT_LIBTSS2_MU;
if (FLAGS_SET(support, TPM2_SUPPORT_LIBTSS2_ALL))
support |= TPM2_SUPPORT_LIBRARIES;
}
#endif
return support & mask;
}
static void print_field(const char *prefix, const char *s, bool supported) {
printf("%s%s%s%s%s\n", strempty(prefix), supported ? ansi_green() : ansi_red(), plus_minus(supported), s, ansi_normal());
}
int verb_has_tpm2_generic(bool quiet) {
Tpm2Support s;
s = tpm2_support();
if (!quiet) {
if (s == TPM2_SUPPORT_FULL)
printf("%syes%s\n", ansi_green(), ansi_normal());
else if (s == TPM2_SUPPORT_NONE)
printf("%sno%s\n", ansi_red(), ansi_normal());
else
printf("%spartial%s\n", ansi_yellow(), ansi_normal());
print_field(NULL, "firmware", FLAGS_SET(s, TPM2_SUPPORT_FIRMWARE));
print_field(NULL, "driver", FLAGS_SET(s, TPM2_SUPPORT_DRIVER));
print_field(NULL, "system", FLAGS_SET(s, TPM2_SUPPORT_SYSTEM));
print_field(NULL, "subsystem", FLAGS_SET(s, TPM2_SUPPORT_SUBSYSTEM));
print_field(NULL, "libraries", FLAGS_SET(s, TPM2_SUPPORT_LIBRARIES));
print_field(" ", "libtss2-esys.so.0", FLAGS_SET(s, TPM2_SUPPORT_LIBTSS2_ESYS));
print_field(" ", "libtss2-rc.so.0", FLAGS_SET(s, TPM2_SUPPORT_LIBTSS2_RC));
print_field(" ", "libtss2-mu.so.0", FLAGS_SET(s, TPM2_SUPPORT_LIBTSS2_MU));
}
assert_cc(TPM2_SUPPORT_API <= 255); /* make sure this is safe to use as process exit status */
/* Return inverted bit flags. So that TPM2_SUPPORT_FULL becomes EXIT_SUCCESS and the other values
* become some reasonable values 1…7. i.e. the flags we return here tell what is missing rather than
* what is there, acknowledging the fact that for process exit statuses it is customary to return
* zero (EXIT_FAILURE) when all is good, instead of all being bad. */
return ~s & TPM2_SUPPORT_API;
}
#if HAVE_TPM2
static void tpm2_pcr_values_apply_default_hash_alg(Tpm2PCRValue *pcr_values, size_t n_pcr_values) {
TPMI_ALG_HASH default_hash = 0;
FOREACH_ARRAY(v, pcr_values, n_pcr_values)
if (v->hash != 0) {
default_hash = v->hash;
break;
}
if (default_hash != 0)
FOREACH_ARRAY(v, pcr_values, n_pcr_values)
if (v->hash == 0)
v->hash = default_hash;
}
#endif
/* The following tpm2_parse_pcr_argument*() functions all log errors, to match the behavior of system-wide
* parse_*_argument() functions. */
/* Parse the PCR selection/value arg(s) and return a corresponding array of Tpm2PCRValue objects.
*
* The format is the same as tpm2_pcr_values_from_string(). The first provided entry with a hash algorithm
* set will be used as the 'default' hash algorithm. All entries with an unset hash algorithm will be updated
* with the 'default' hash algorithm. The resulting array will be sorted and checked for validity.
*
* This will replace *ret_pcr_values with the new array of pcr values; to append to an existing array, use
* tpm2_parse_pcr_argument_append(). */
int tpm2_parse_pcr_argument(const char *arg, Tpm2PCRValue **ret_pcr_values, size_t *ret_n_pcr_values) {
#if HAVE_TPM2
int r;
assert(arg);
assert(ret_pcr_values);
assert(ret_n_pcr_values);
_cleanup_free_ Tpm2PCRValue *pcr_values = NULL;
size_t n_pcr_values = 0;
r = tpm2_pcr_values_from_string(arg, &pcr_values, &n_pcr_values);
if (r < 0)
return log_error_errno(r, "Could not parse PCR values from '%s': %m", arg);
tpm2_pcr_values_apply_default_hash_alg(pcr_values, n_pcr_values);
tpm2_sort_pcr_values(pcr_values, n_pcr_values);
if (!tpm2_pcr_values_valid(pcr_values, n_pcr_values))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Parsed PCR values are not valid.");
*ret_pcr_values = TAKE_PTR(pcr_values);
*ret_n_pcr_values = n_pcr_values;
return 0;
#else
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "TPM2 support is disabled.");
#endif
}
/* Same as tpm2_parse_pcr_argument(), but the pcr values array is appended to. If the provided pcr values
* array is not NULL, it must point to an allocated pcr values array and the provided number of pcr values
* must be correct.
*
* Note that 'arg' is parsed into a new array of pcr values independently of any previous pcr values,
* including application of the default hash algorithm. Then the two arrays are combined, the default hash
* algorithm check applied again (in case either the previous or current array had no default hash
* algorithm), and then the resulting array is sorted and rechecked for validity. */
int tpm2_parse_pcr_argument_append(const char *arg, Tpm2PCRValue **pcr_values, size_t *n_pcr_values) {
#if HAVE_TPM2
int r;
assert(arg);
assert(pcr_values);
assert(n_pcr_values);
_cleanup_free_ Tpm2PCRValue *more_pcr_values = NULL;
size_t n_more_pcr_values;
r = tpm2_parse_pcr_argument(arg, &more_pcr_values, &n_more_pcr_values);
if (r < 0)
return r;
/* If we got previous values, append them. */
if (*pcr_values && !GREEDY_REALLOC_APPEND(more_pcr_values, n_more_pcr_values, *pcr_values, *n_pcr_values))
return log_oom();
tpm2_pcr_values_apply_default_hash_alg(more_pcr_values, n_more_pcr_values);
tpm2_sort_pcr_values(more_pcr_values, n_more_pcr_values);
if (!tpm2_pcr_values_valid(more_pcr_values, n_more_pcr_values))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Parsed PCR values are not valid.");
SWAP_TWO(*pcr_values, more_pcr_values);
*n_pcr_values = n_more_pcr_values;
return 0;
#else
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "TPM2 support is disabled.");
#endif
}
int tpm2_parse_pcr_argument_to_mask(const char *arg, uint32_t *mask) {
#if HAVE_TPM2
int r;
/* Same as tpm2_parse_pcr_argument() but converts the pcr values to a pcr mask. If a hash algorithm or
* hash value is specified an error is generated (after all we only return the mask here, nothing
* else). This retains the previous behavior of tpm2_parse_pcr_argument() of clearing the mask if
* 'arg' is empty, replacing the mask if it is set to UINT32_MAX, and or-ing the mask otherwise. */
assert(arg);
assert(mask);
_cleanup_free_ Tpm2PCRValue *pcr_values = NULL;
size_t n_pcr_values;
r = tpm2_parse_pcr_argument(arg, &pcr_values, &n_pcr_values);
if (r < 0)
return r;
if (n_pcr_values == 0) {
/* This retains the previous behavior of clearing the mask if the arg is empty */
*mask = 0;
return 0;
}
FOREACH_ARRAY(v, pcr_values, n_pcr_values) {
if (v->hash != 0)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Not expecting hash algorithm specification in PCR mask value, refusing: %s", arg);
if (v->value.size != 0)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Not expecting hash value specification in PCR mask value, refusing: %s", arg);
}
uint32_t new_mask;
r = tpm2_pcr_values_to_mask(pcr_values, n_pcr_values, /* hash= */ 0, &new_mask);
if (r < 0)
return log_error_errno(r, "Could not get pcr values mask: %m");
if (*mask == UINT32_MAX)
*mask = new_mask;
else
*mask |= new_mask;
return 0;
#else
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "TPM2 support is disabled.");
#endif
}
int tpm2_load_pcr_signature(const char *path, sd_json_variant **ret) {
_cleanup_strv_free_ char **search = NULL;
_cleanup_free_ char *discovered_path = NULL;
_cleanup_fclose_ FILE *f = NULL;
int r;
/* Tries to load a JSON PCR signature file. Takes an absolute path, a simple file name or NULL. In
* the latter two cases searches in /etc/, /usr/lib/, /run/, as usual. */
search = strv_new(CONF_PATHS("systemd"));
if (!search)
return log_oom_debug();
if (!path) {
/* If no path is specified, then look for "tpm2-pcr-signature.json" automatically. Also, in
* this case include /.extra/ in the search path, but only in this case, and if we run in the
* initrd. We don't want to be too eager here, after all /.extra/ is untrusted territory. */
path = "tpm2-pcr-signature.json";
if (in_initrd())
if (strv_extend(&search, "/.extra") < 0)
return log_oom_debug();
}
r = search_and_fopen(path, "re", NULL, (const char**) search, &f, &discovered_path);
if (r < 0)
return log_debug_errno(r, "Failed to find TPM PCR signature file '%s': %m", path);
r = sd_json_parse_file(f, discovered_path, 0, ret, NULL, NULL);
if (r < 0)
return log_debug_errno(r, "Failed to parse TPM PCR signature JSON object '%s': %m", discovered_path);
return 0;
}
int tpm2_load_pcr_public_key(const char *path, void **ret_pubkey, size_t *ret_pubkey_size) {
_cleanup_strv_free_ char **search = NULL;
_cleanup_free_ char *discovered_path = NULL;
_cleanup_fclose_ FILE *f = NULL;
int r;
/* Tries to load a PCR public key file. Takes an absolute path, a simple file name or NULL. In the
* latter two cases searches in /etc/, /usr/lib/, /run/, as usual. */
search = strv_new(CONF_PATHS("systemd"));
if (!search)
return log_oom_debug();
if (!path) {
path = "tpm2-pcr-public-key.pem";
if (in_initrd())
if (strv_extend(&search, "/.extra") < 0)
return log_oom_debug();
}
r = search_and_fopen(path, "re", NULL, (const char**) search, &f, &discovered_path);
if (r < 0)
return log_debug_errno(r, "Failed to find TPM PCR public key file '%s': %m", path);
r = read_full_stream(f, (char**) ret_pubkey, ret_pubkey_size);
if (r < 0)
return log_debug_errno(r, "Failed to load TPM PCR public key PEM file '%s': %m", discovered_path);
return 0;
}
#define PBKDF2_HMAC_SHA256_ITERATIONS 10000
/*
* Implements PBKDF2 HMAC SHA256 for a derived keylen of 32
* bytes and for PBKDF2_HMAC_SHA256_ITERATIONS count.
* I found the wikipedia entry relevant and it contains links to
* relevant RFCs:
* - https://en.wikipedia.org/wiki/PBKDF2
* - https://www.rfc-editor.org/rfc/rfc2898#section-5.2
*/
int tpm2_util_pbkdf2_hmac_sha256(const void *pass,
size_t passlen,
const void *salt,
size_t saltlen,
uint8_t ret[static SHA256_DIGEST_SIZE]) {
_cleanup_(erase_and_freep) uint8_t *buffer = NULL;
uint8_t u[SHA256_DIGEST_SIZE];
/* To keep this simple, since derived KeyLen (dkLen in docs)
* Is the same as the hash output, we don't need multiple
* blocks. Part of the algorithm is to add the block count
* in, but this can be hardcoded to 1.
*/
static const uint8_t block_cnt[] = { 0, 0, 0, 1 };
assert(salt);
assert(saltlen > 0);
assert(saltlen <= (SIZE_MAX - sizeof(block_cnt)));
assert(passlen > 0);
/*
* Build a buffer of salt + block_cnt and hmac_sha256 it we
* do this as we don't have a context builder for HMAC_SHA256.
*/
buffer = malloc(saltlen + sizeof(block_cnt));
if (!buffer)
return -ENOMEM;
memcpy(buffer, salt, saltlen);
memcpy(&buffer[saltlen], block_cnt, sizeof(block_cnt));
hmac_sha256(pass, passlen, buffer, saltlen + sizeof(block_cnt), u);
/* dk needs to be an unmodified u as u gets modified in the loop */
memcpy(ret, u, SHA256_DIGEST_SIZE);
uint8_t *dk = ret;
for (size_t i = 1; i < PBKDF2_HMAC_SHA256_ITERATIONS; i++) {
hmac_sha256(pass, passlen, u, sizeof(u), u);
for (size_t j=0; j < sizeof(u); j++)
dk[j] ^= u[j];
}
return 0;
}
static const char* const tpm2_pcr_index_table[_TPM2_PCR_INDEX_MAX_DEFINED] = {
[TPM2_PCR_PLATFORM_CODE] = "platform-code",
[TPM2_PCR_PLATFORM_CONFIG] = "platform-config",
[TPM2_PCR_EXTERNAL_CODE] = "external-code",
[TPM2_PCR_EXTERNAL_CONFIG] = "external-config",
[TPM2_PCR_BOOT_LOADER_CODE] = "boot-loader-code",
[TPM2_PCR_BOOT_LOADER_CONFIG] = "boot-loader-config",
[TPM2_PCR_HOST_PLATFORM] = "host-platform",
[TPM2_PCR_SECURE_BOOT_POLICY] = "secure-boot-policy",
[TPM2_PCR_KERNEL_INITRD] = "kernel-initrd",
[TPM2_PCR_IMA] = "ima",
[TPM2_PCR_KERNEL_BOOT] = "kernel-boot",
[TPM2_PCR_KERNEL_CONFIG] = "kernel-config",
[TPM2_PCR_SYSEXTS] = "sysexts",
[TPM2_PCR_SHIM_POLICY] = "shim-policy",
[TPM2_PCR_SYSTEM_IDENTITY] = "system-identity",
[TPM2_PCR_DEBUG] = "debug",
[TPM2_PCR_APPLICATION_SUPPORT] = "application-support",
};
DEFINE_STRING_TABLE_LOOKUP_FROM_STRING_WITH_FALLBACK(tpm2_pcr_index, int, TPM2_PCRS_MAX - 1);
DEFINE_STRING_TABLE_LOOKUP_TO_STRING(tpm2_pcr_index, int);
bool tpm2_nvpcr_name_is_valid(const char *name) {
return string_is_safe(name, STRING_FILENAME) &&
tpm2_pcr_index_from_string(name) < 0; /* don't allow nvpcrs to be name like pcrs */
}
Reference in New Issue View Git Blame Copy Permalink