diff options
Diffstat (limited to 'roms/skiboot/libstb/tss2/ibmtpm20tss/utils/policymakerpcr.c')
| -rw-r--r-- | roms/skiboot/libstb/tss2/ibmtpm20tss/utils/policymakerpcr.c | 439 |
1 files changed, 439 insertions, 0 deletions
diff --git a/roms/skiboot/libstb/tss2/ibmtpm20tss/utils/policymakerpcr.c b/roms/skiboot/libstb/tss2/ibmtpm20tss/utils/policymakerpcr.c new file mode 100644 index 000000000..41f8faf69 --- /dev/null +++ b/roms/skiboot/libstb/tss2/ibmtpm20tss/utils/policymakerpcr.c @@ -0,0 +1,439 @@ +/********************************************************************************/ +/* */ +/* policymakerpcr */ +/* Written by Ken Goldman */ +/* IBM Thomas J. Watson Research Center */ +/* */ +/* (c) Copyright IBM Corporation 2015 - 2019. */ +/* */ +/* All rights reserved. */ +/* */ +/* Redistribution and use in source and binary forms, with or without */ +/* modification, are permitted provided that the following conditions are */ +/* met: */ +/* */ +/* Redistributions of source code must retain the above copyright notice, */ +/* this list of conditions and the following disclaimer. */ +/* */ +/* Redistributions in binary form must reproduce the above copyright */ +/* notice, this list of conditions and the following disclaimer in the */ +/* documentation and/or other materials provided with the distribution. */ +/* */ +/* Neither the names of the IBM Corporation nor the names of its */ +/* contributors may be used to endorse or promote products derived from */ +/* this software without specific prior written permission. */ +/* */ +/* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS */ +/* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT */ +/* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR */ +/* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT */ +/* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, */ +/* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT */ +/* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, */ +/* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY */ +/* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT */ +/* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE */ +/* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ +/********************************************************************************/ + +/* + policymakerpcr calculates a policyPCR term suitable for input to policymaker + + Inputs are: + + a hash algorithm + + a byte mask, totally big endian, e.g. 010000 is PCR 16 + + a file with lines in hexascii representing PCRs, e.g., the output of pcrread -ns + removed + + This assumes that the byte mask and PCR value file are consistent. + + Outputs are: + + if specified, a file with a hex ascii policyPCR line suitable for input to policymaker + + if specified, a print of the hash + + Example: + + policymakerpcr -halg sha1 -bm 010000 -if policies/policypcr16aaasha1.txt -v -pr -of policies/policypcr.txt + + Where policypcr16aaasha1.txt is represents the SHA-1 value of PCR 16 + + e.g., 1d47f68aced515f7797371b554e32d47981aa0a0 +*/ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <stdint.h> +#include <errno.h> + +#ifdef TPM_POSIX +#include <netinet/in.h> +#endif +#ifdef TPM_WINDOWS +#include <winsock2.h> +#endif + +#include <ibmtss/tss.h> +#include <ibmtss/tssutils.h> +#include <ibmtss/tsscryptoh.h> +#include <ibmtss/tsscrypto.h> +#include <ibmtss/tssmarshal.h> + +static void printUsage(void); +static void printPolicyPCR(FILE *out, + uint32_t sizeInBytes, + TPML_PCR_SELECTION *pcrs, + TPMT_HA *digest); +static int Format_FromHexascii(unsigned char *binary, + const char *string, + size_t length); +static int Format_ByteFromHexascii(unsigned char *byte, + const char *string); + +extern int tssUtilsVerbose; + +int main(int argc, char *argv[]) +{ + TPM_RC rc = 0; + int i; /* argc iterator */ + char *prc = NULL; /* pointer return code */ + const char *inFilename = NULL; + const char *outFilename = NULL; + FILE *inFile = NULL; + FILE *outFile = NULL; + /* initialized to suppress false gcc -O3 warning */ + uint32_t sizeInBytes = 0; /* hash algorithm mapped to size */ + uint32_t pcrmask = 0xffffffff; /* pcr register mask */ + TPML_PCR_SELECTION pcrs; + unsigned int pcrCount = 0; + TPMU_HA pcr[IMPLEMENTATION_PCR]; /* all the PCRs */ + int pr = FALSE; + TPMT_HA digest; + uint8_t pcrBytes[IMPLEMENTATION_PCR * sizeof(TPMU_HA)]; + uint16_t pcrLength; + + setvbuf(stdout, 0, _IONBF, 0); /* output may be going through pipe to log file */ + TSS_SetProperty(NULL, TPM_TRACE_LEVEL, "1"); + tssUtilsVerbose = FALSE; + + /* command line defaults */ + digest.hashAlg = TPM_ALG_SHA256; + + for (i=1 ; (i<argc) && (rc == 0) ; i++) { + if (strcmp(argv[i],"-halg") == 0) { + i++; + if (i < argc) { + if (strcmp(argv[i],"sha1") == 0) { + digest.hashAlg = TPM_ALG_SHA1; + } + else if (strcmp(argv[i],"sha256") == 0) { + digest.hashAlg = TPM_ALG_SHA256; + } + else if (strcmp(argv[i],"sha384") == 0) { + digest.hashAlg = TPM_ALG_SHA384; + } + else if (strcmp(argv[i],"sha512") == 0) { + digest.hashAlg = TPM_ALG_SHA512; + } + else { + printf("Bad parameter %s for -halg\n", argv[i]); + printUsage(); + } + } + else { + printf("Missing parameter for -hi\n"); + printUsage(); + } + } + else if (strcmp(argv[i],"-bm") == 0) { + i++; + if (i < argc) { + if (1 != sscanf(argv[i], "%x", &pcrmask)) { + printf("Invalid -bm argument '%s'\n", argv[i]); + printUsage(); + } + } + else { + printf("-bm option needs a value\n"); + printUsage(); + } + } + else if (strcmp(argv[i],"-of") == 0) { + i++; + if (i < argc) { + outFilename = argv[i]; + } + else { + printf("-of option needs a value\n"); + printUsage(); + } + } + else if (strcmp(argv[i],"-if") == 0) { + i++; + if (i < argc) { + inFilename = argv[i]; + } + else { + printf("-if option needs a value\n"); + printUsage(); + } + } + else if (strcmp(argv[i],"-pr") == 0) { + pr = TRUE; + } + else if (strcmp(argv[i],"-h") == 0) { + printUsage(); + } + else if (strcmp(argv[i],"-v") == 0) { + tssUtilsVerbose = TRUE; + TSS_SetProperty(NULL, TPM_TRACE_LEVEL, "2"); + } + else { + printf("\n%s is not a valid option\n", argv[i]); + printUsage(); + } + } + if (pcrmask == 0xffffffff) { + printf("Missing or illegal pcr byte mask parameter -bm\n"); + printUsage(); + } + if ((pcrmask != 0) && (inFilename == NULL)) { + printf("Missing file name parameter -if\n"); + printUsage(); + } + if ((pcrmask == 0) && (inFilename != NULL)) { + printf("Unnecessary file name parameter -if\n"); + printUsage(); + } + /* open the input file if needed */ + if ((rc == 0) && (pcrmask != 0)) { + inFile = fopen(inFilename, "r"); + if (inFile == NULL) { + printf("Error opening %s for %s, %s\n", inFilename, "r", strerror(errno)); + rc = EXIT_FAILURE; + } + } + if (rc == 0) { + sizeInBytes = TSS_GetDigestSize(digest.hashAlg); + } + /* Table 102 - Definition of TPML_PCR_SELECTION Structure */ + if (rc == 0) { + pcrs.count = 1; /* hard code one hash algorithm */ + /* Table 85 - Definition of TPMS_PCR_SELECTION Structure - pcrSelections */ + pcrs.pcrSelections[0].hash = digest.hashAlg; + pcrs.pcrSelections[0].sizeofSelect= 3; /* hard code 24 PCRs */ + /* TCG always marshals lower PCR first */ + pcrs.pcrSelections[0].pcrSelect[0] = (pcrmask >> 0) & 0xff; + pcrs.pcrSelections[0].pcrSelect[1] = (pcrmask >> 8) & 0xff; + pcrs.pcrSelections[0].pcrSelect[2] = (pcrmask >> 16) & 0xff; + } + /* read the input file to the PCR array, assumes the PCR select bm has the correct number of + bits */ + /* iterate through each line */ + for (pcrCount = 0 ; + (rc == 0) && (pcrCount < IMPLEMENTATION_PCR) && (inFile != NULL) ; + pcrCount++) { + + char lineString[256]; /* returned line in hex ascii */ + uint32_t lineLength; + + if (rc == 0) { + prc = fgets(lineString, sizeof(lineString), inFile); + } + /* no more lines, pcrCount is number of PCRs processed */ + if (rc == 0) { + if (prc == NULL) { + break; + } + } + if (rc == 0) { + lineLength = strlen(lineString); + if (lineLength == 0) { + break; + } + if (lineString[lineLength-1] == '\n') { + lineString[lineLength-1] = '0'; + lineLength--; + } + } + if (rc == 0) { + if (lineLength != (sizeInBytes *2)) { + printf("Line length %u is not twice digest size %u\n", lineLength, sizeInBytes); + rc = -1; + } + } + /* convert hex ascii to binary */ + if ((rc == 0) && (prc != NULL)) { + rc = Format_FromHexascii((uint8_t *)&pcr[pcrCount], + lineString, lineLength/2); + } + if (rc == 0) { + if (tssUtilsVerbose) printf("PCR %u\n", pcrCount); + if (tssUtilsVerbose) TSS_PrintAll("PCR", (uint8_t *)&pcr[pcrCount], sizeInBytes); + } + } + /* serialize PCRs */ + if (rc == 0) { + unsigned int pc; + uint8_t *buffer = pcrBytes; + uint32_t size = IMPLEMENTATION_PCR * sizeof(TPMU_HA); + pcrLength = 0; + for (pc = 0 ; (rc == 0) && (pc < pcrCount) ; pc++) { + rc = TSS_Array_Marshalu((uint8_t *)&pcr[pc], sizeInBytes, &pcrLength, &buffer, &size); + } + } + /* hash the marshaled PCR array */ + if (rc == 0) { + rc = TSS_Hash_Generate(&digest, + pcrLength, pcrBytes, + 0, NULL); + } + if (rc == 0) { + if (tssUtilsVerbose) TSS_PrintAll("PCR composite digest", (uint8_t *)&digest.digest, sizeInBytes); + } + if ((rc == 0) && pr) { + printPolicyPCR(stdout, + sizeInBytes, + &pcrs, + &digest); + } + if (outFilename != NULL) { + if (rc == 0) { + outFile = fopen(outFilename, "wb"); + if (outFile == NULL) { + printf("Error opening %s for %s, %s\n", outFilename , "W", strerror(errno)); + rc = EXIT_FAILURE; + } + } + if (rc == 0) { + printPolicyPCR(outFile, + sizeInBytes, + &pcrs, + &digest); + } + } + if (inFile != NULL) { + fclose(inFile); + } + if (outFile != NULL) { + fclose(outFile); + } + if (rc != 0) { + rc = EXIT_FAILURE; + } + return rc; +} + +static void printPolicyPCR(FILE *out, + uint32_t sizeInBytes, + TPML_PCR_SELECTION *pcrs, + TPMT_HA *digest) +{ + unsigned int i; + uint8_t *pcrDigest = (uint8_t *)&digest->digest; + + fprintf(out, "%02x", 0xff & (TPM_CC_PolicyPCR >> 24)); + fprintf(out, "%02x", 0xff & (TPM_CC_PolicyPCR >> 16)); + fprintf(out, "%02x", 0xff & (TPM_CC_PolicyPCR >> 8)); + fprintf(out, "%02x", 0xff & (TPM_CC_PolicyPCR >> 0)); + /* NOTE only handles count of 1, 1 hash algorithm */ + fprintf(out, "%08x", pcrs->count); + + fprintf(out, "%02x", 0xff & (pcrs->pcrSelections[0].hash >> 8)); + fprintf(out, "%02x", 0xff & (pcrs->pcrSelections[0].hash >> 0)); + + fprintf(out, "%02x", pcrs->pcrSelections[0].sizeofSelect); + + fprintf(out, "%02x", pcrs->pcrSelections[0].pcrSelect[0]); + fprintf(out, "%02x", pcrs->pcrSelections[0].pcrSelect[1]); + fprintf(out, "%02x", pcrs->pcrSelections[0].pcrSelect[2]); + + for (i = 0 ; i < sizeInBytes ; i++) { + fprintf(out, "%02x", pcrDigest[i]); + } + fprintf(out, "\n"); + return; +} + +/* Format_FromHexAscii() converts 'string' in hex ascii to 'binary' of 'length' + + It assumes that the string has enough bytes to accommodate the length. +*/ + +static int Format_FromHexascii(unsigned char *binary, + const char *string, + size_t length) +{ + int rc = 0; + size_t i; + + for (i = 0 ; (rc == 0) && (i < length) ; i++) { + rc = Format_ByteFromHexascii(binary + i, + string + (i * 2)); + + } + return rc; +} + +/* Format_ByteFromHexAscii() converts two bytes of hex ascii to one byte of binary + */ + +static int Format_ByteFromHexascii(unsigned char *byte, + const char *string) +{ + int rc = 0; + size_t i; + char c; + *byte = 0; + + for (i = 0 ; (rc == 0) && (i < 2) ; i++) { + (*byte) <<= 4; /* big endian, shift up the nibble */ + c = *(string + i); /* extract the next character from the string */ + + if ((c >= '0') && (c <= '9')) { + *byte += c - '0'; + } + else if ((c >= 'a') && (c <= 'f')) { + *byte += c + 10 - 'a'; + } + else if ((c >= 'A') && (c <= 'F')) { + *byte += c + 10 - 'A'; + } + else { + printf("Format_ByteFromHexascii: " + "Error: Line has non hex ascii character: %c\n", c); + rc = EXIT_FAILURE; + } + } + return rc; +} + + +static void printUsage(void) +{ + printf("\n"); + printf("policymakerpcr\n"); + printf("\n"); + printf("Creates a policyPCR term suitable for input to policymaker (hex ascii)\n"); + printf("\n"); + printf("Assumes that the byte mask and PCR values are consistent\n"); + printf("\n"); + printf("\t[-halg\thash algorithm (sha1 sha256 sha384 sha512) (default sha256)]\n"); + printf("\t-bm\tpcr byte mask in hex, big endian\n"); + printf("\n"); + printf("\te.g. 010000 selects PCR 16\n"); + printf("\te.g. ffffff selects all 24 PCRs\n"); + printf("\n"); + printf("\t-if input file - PCR values, hex ascii, one per line, %u max\n", IMPLEMENTATION_PCR); + printf("\trequired unless pcr mask is 0\n"); + printf("\n"); + printf("\t[-of\toutput file - policy hash in binary]\n"); + printf("\t[-pr\tstdout - policy hash in hex ascii]\n"); + printf("\n"); + exit(1); +} |