path: root/roms/skiboot/libstb/tss2/ibmtpm20tss/utils/imaextend.c

/********************************************************************************/
/*										*/
/*		      Extend an IMA measurement list into PCRs			*/
/*			     Written by Ken Goldman				*/
/*		       IBM Thomas J. Watson Research Center			*/
/*										*/
/* (c) Copyright IBM Corporation 2014 - 2020.					*/
/*										*/
/* All rights reserved.								*/
/* 										*/
/* Redistribution and use in source and binary forms, with or without		*/
/* modification, are permitted provided that the following conditions are	*/
/* met:										*/
/* 										*/
/* Redistributions of source code must retain the above copyright notice,	*/
/* this list of conditions and the following disclaimer.			*/
/* 										*/
/* Redistributions in binary form must reproduce the above copyright		*/
/* notice, this list of conditions and the following disclaimer in the		*/
/* documentation and/or other materials provided with the distribution.		*/
/* 										*/
/* Neither the names of the IBM Corporation nor the names of its		*/
/* contributors may be used to endorse or promote products derived from		*/
/* this software without specific prior written permission.			*/
/* 										*/
/* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS		*/
/* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT		*/
/* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR	*/
/* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT		*/
/* HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,	*/
/* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT		*/
/* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,	*/
/* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY	*/
/* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT		*/
/* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE	*/
/* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.		*/
/********************************************************************************/

/* imaextend is test/demo code.  It parses a TPM 1.2 IMA event log file and extends the measurements
   into TPM PCRs.  This simulates the actions that would be performed by the Linux kernel IMA in a
   hardware platform.

   To test incremental attestations, the caller can optionally specify a beginning event number and
   ending event number.

   To test a platform without a TPM or TPM device driver, but where IMA is creating an event log,
   the caller can optionally specify a sleep time.  The program will then incrementally extend after
   each sleep.
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <unistd.h>

#include <ibmtss/tss.h>
#include <ibmtss/tssresponsecode.h>
#include <ibmtss/tsscryptoh.h>
#include <ibmtss/tssutils.h>

#include "imalib.h"

/* local prototypes */

static TPM_RC copyDigest(PCR_Extend_In 	*in,
			 ImaEvent 	*imaEvent);
static TPM_RC pcrread(TSS_CONTEXT *tssContext,
		      TPMI_DH_PCR pcrHandle);
static void printUsage(void);

extern int tssUtilsVerbose;
int vverbose = FALSE;

int main(int argc, char * argv[])
{
    TPM_RC 		rc = 0;
    int 		i = 0;
    TSS_CONTEXT		*tssContext = NULL;
    PCR_Extend_In 	in;
    const char 		*infilename = NULL;
    FILE 		*infile = NULL;
    int 		littleEndian = FALSE;
    int			sim = FALSE;			/* extend into simulated PCRs */
    uint32_t 		bankNum = 0;			/* PCR hash bank, 0 is SHA-1, 1 is
							   SHA-256 */
    unsigned int 	pcrNum = 0;			/* PCR number iterator */
    TPMT_HA 		simPcrs[IMA_PCR_BANKS][IMPLEMENTATION_PCR];
    unsigned long	beginEvent = 0;			/* default beginning of log */
    unsigned long	endEvent = 0xffffffff;		/* default end of log */
    unsigned int	loopTime = 0;			/* default no loop */
    ImaEvent 		imaEvent;
    unsigned int 	lineNum;
    
    setvbuf(stdout, 0, _IONBF, 0);      /* output may be going through pipe to log file */
    TSS_SetProperty(NULL, TPM_TRACE_LEVEL, "1");
    tssUtilsVerbose = FALSE;
    
    for (i=1 ; i<argc ; i++) {
	if (strcmp(argv[i],"-if") == 0) {
	    i++;
	    if (i < argc) {
		infilename = argv[i];
	    }
	    else {
		printf("-if option needs a value\n");
		printUsage();
		exit(2);
	    }
	}
	else if (strcmp(argv[i],"-sim") == 0) {
	    sim = TRUE;
	}
	else if (strcmp(argv[i],"-le") == 0) {
	    littleEndian = TRUE; 
	}
	else if (strcmp(argv[i],"-b") == 0) {
	    i++;
	    if (i < argc) {
		sscanf(argv[i],"%lu", &beginEvent);
	    }
	    else {
		printf("Missing parameter for -b\n");
		printUsage();
	    }
	}
	else if (strcmp(argv[i],"-e") == 0) {
	    i++;
	    if (i < argc) {
		sscanf(argv[i],"%lu", &endEvent);
	    }
	    else {
		printf("Missing parameter for -e\n");
		printUsage();
	    }
	}
	else if (strcmp(argv[i],"-l") == 0) {
	    i++;
	    if (i < argc) {
		sscanf(argv[i],"%u", &loopTime);
	    }
	    else {
		printf("Missing parameter for -e\n");
		printUsage();
	    }
	}
	else if (!strcmp(argv[i], "-h")) {
	    printUsage();
	}
	else if (!strcmp(argv[i], "-v")) {
	    tssUtilsVerbose = TRUE;
	    vverbose = TRUE;
	    TSS_SetProperty(NULL, TPM_TRACE_LEVEL, "2");
	}
	else {
	    printf("\n%s is not a valid option\n", argv[i]);
	    printUsage();
	}
    }
    if (infilename == NULL) {
	printf("Missing -if argument\n");
	printUsage();
    }
    if (!sim) {
	/* Start a TSS context */
	if (rc == 0) {
	    rc = TSS_Create(&tssContext);
	}
	if (rc == 0) {
	    uint32_t algs;				/* hash algorithm iterator */
	    in.digests.count = 2;			/* extend SHA-1 and SHA-256 banks */
	    in.digests.digests[0].hashAlg = TPM_ALG_SHA1;
	    in.digests.digests[1].hashAlg = TPM_ALG_SHA256;
	    /* IMA zero extends into the SHA-256 bank */
	    for (algs = 0 ; algs < in.digests.count ; algs++) {
		memset((uint8_t *)&in.digests.digests[algs].digest, 0, sizeof(TPMU_HA));
	    }
	}
	if ((rc == 0) && tssUtilsVerbose) {
	    printf("Initial PCR 10 value\n");
	    rc = pcrread(tssContext, 10);
	}
    }
    else {	/* sim TRUE */
	/* simulated PCRs start at zero at boot */
	if (rc == 0) {
	    for (pcrNum = 0 ; pcrNum < IMPLEMENTATION_PCR ; pcrNum++) {
		/* initialize each algorithm ID */
		simPcrs[0][pcrNum].hashAlg = TPM_ALG_SHA1;
		simPcrs[1][pcrNum].hashAlg = TPM_ALG_SHA256;
		memset(&simPcrs[0][pcrNum].digest.tssmax, 0, SHA1_DIGEST_SIZE);
		memset(&simPcrs[1][pcrNum].digest.tssmax, 0, SHA256_DIGEST_SIZE);
	    }
	}
    }
    /*
      scan each measurement 'line' in the binary
    */
    do {
	/* read the IMA event log file */
	int endOfFile = FALSE;
	if (rc == 0) {
	    infile = fopen(infilename,"rb");
	    if (infile == NULL) {
		printf("Unable to open input file '%s'\n", infilename);
		rc = TSS_RC_FILE_OPEN;
	    }
	}
	for (lineNum = 0 ; (rc == 0) && !endOfFile ; lineNum++) {
	    /* read an IMA event line */
	    IMA_Event_Init(&imaEvent);
	    if (rc == 0) {
		rc = IMA_Event_ReadFile(&imaEvent, &endOfFile, infile,
					littleEndian);
	    }
	    /*
	      if the event line is in range
	    */
	    if ((rc == 0) && (lineNum >= beginEvent) && (lineNum <= endEvent) && !endOfFile) {
		/* debug tracing */
		if (rc == 0) {
		    ImaTemplateData imaTemplateData;
		    if (tssUtilsVerbose) printf("\n");
		    printf("imaextend: line %u\n", lineNum);
		    if (tssUtilsVerbose) {
			IMA_Event_Trace(&imaEvent, FALSE);
			/* unmarshal the template data */
			if (rc == 0) {
			    rc = IMA_TemplateData_ReadBuffer(&imaTemplateData,
							     &imaEvent,
							     littleEndian);
			}
			if (rc == 0) {
			    IMA_TemplateData_Trace(&imaTemplateData,
						   imaEvent.nameInt);
			}
			else {
			    printf("imaextend: Error parsing template data, event %u\n", lineNum);
			    rc = 0;		/* not a fatal error */
			}
		    }
		}
		if (!sim) {
		    if (rc == 0) {
			in.pcrHandle = imaEvent.pcrIndex;		/* normally PCR 10 */
		    }
		    /* copy the SHA-1 digest to be extended into the SHA-1 and SHA-256 banks */
		    if (rc == 0) {
			rc = copyDigest(&in, &imaEvent);
		    }	
		    if (rc == 0) {
			rc = TSS_Execute(tssContext,
					 NULL, 
					 (COMMAND_PARAMETERS *)&in,
					 NULL,
					 TPM_CC_PCR_Extend,
					 TPM_RS_PW, NULL, 0,
					 TPM_RH_NULL, NULL, 0);
		    }
		    if (rc == 0 && tssUtilsVerbose) {
			rc = pcrread(tssContext, imaEvent.pcrIndex);
		    }
		}
		else {		/* sim */
		    /* even though IMA_Event_ReadFile() range checks the PCR index, range check it
		       again here to silence the static analysis tool */
		    if (rc == 0) {
			if (imaEvent.pcrIndex >= IMPLEMENTATION_PCR) {
			    printf("imaextend: PCR index %u %08x out of range\n",
				   imaEvent.pcrIndex, imaEvent.pcrIndex);
			    rc = TSS_RC_BAD_PROPERTY_VALUE;
			}
		    }
		    if (rc == 0) {
			rc = IMA_Event_PcrExtend(simPcrs, &imaEvent);
		    }
		    if (rc == 0 && tssUtilsVerbose) {
			TSS_PrintAll("PCR digest SHA-1",
				     simPcrs[0][imaEvent.pcrIndex].digest.tssmax,
				     SHA1_DIGEST_SIZE);
			TSS_PrintAll("PCR digest SHA-256",
				     simPcrs[1][imaEvent.pcrIndex].digest.tssmax,
				     SHA256_DIGEST_SIZE);
			
			
		    }
		}
	    }	/* for each IMA event in range */
	    IMA_Event_Free(&imaEvent);
	}	/* for each IMA event line */
	if (tssUtilsVerbose && (loopTime != 0)) printf("set beginEvent to %u\n", lineNum-1);
	beginEvent = lineNum-1;		/* remove the last increment at EOF */
	if (infile != NULL) {
	    fclose(infile);
	}
#ifdef TPM_POSIX
	sleep(loopTime);
#endif
#ifdef TPM_WINDOWS
	Sleep(loopTime * 1000);
#endif
	
    } while ((rc == 0) && (loopTime != 0)); 		/* sleep loop */
    if (!sim) {
	TPM_RC rc1 = TSS_Delete(tssContext);
	if (rc == 0) {
	    rc = rc1;
	}
    }
    else {	/* sim */
	for (bankNum = 0 ; (rc == 0) && (bankNum < IMA_PCR_BANKS) ; bankNum++) {
	    TSS_TPM_ALG_ID_Print("algorithmId", simPcrs[bankNum][0].hashAlg, 0);
	    for (pcrNum = 0 ; pcrNum < IMPLEMENTATION_PCR ; pcrNum++) {
	        char 		pcrString[9];	/* PCR number */
		uint16_t 	digestSize;
		sprintf(pcrString, "PCR %02u:", pcrNum);
		/* TSS_PrintAllLogLevel() with a log level of LOGLEVEL_INFO to print the byte
		   array on one line with no length */
		digestSize = TSS_GetDigestSize(simPcrs[bankNum][pcrNum].hashAlg);
		TSS_PrintAllLogLevel(LOGLEVEL_INFO, pcrString, 1,
				     simPcrs[bankNum][pcrNum].digest.tssmax,
				     digestSize);
	    }
	}
    }
    if (rc == 0) {
	if (tssUtilsVerbose) printf("imaextend: success\n");
    }
    else {
	const char *msg;
	const char *submsg;
	const char *num;
	printf("imaextend: failed, rc %08x\n", rc);
	TSS_ResponseCode_toString(&msg, &submsg, &num, rc);
	printf("%s%s%s\n", msg, submsg, num);
	rc = EXIT_FAILURE;
    }
    return rc;
}

static TPM_RC copyDigest(PCR_Extend_In 	*in,
			 ImaEvent 	*imaEvent)
{
    TPM_RC 		rc = 0;
    unsigned char 	zeroDigest[SHA1_DIGEST_SIZE];
    int 		notAllZero;
    if (rc == 0) {
	memset(zeroDigest, 0, SHA1_DIGEST_SIZE);
	notAllZero = memcmp(imaEvent->digest, zeroDigest, SHA1_DIGEST_SIZE);
	/* the SHA-256 bank has already been 0 extended, so only the first 20 bytes need be
	   copied */
	if (notAllZero) {
	    memcpy((uint8_t *)&in->digests.digests[0].digest, imaEvent->digest, SHA1_DIGEST_SIZE);
	    memcpy((uint8_t *)&in->digests.digests[1].digest, imaEvent->digest, SHA1_DIGEST_SIZE);
	}
	/* IMA has a quirk where some measurements store a zero digest in the event log, but
	   extend ones into PCR 10 */
	else {
	    memset((uint8_t *)&in->digests.digests[0].digest, 0xff, SHA1_DIGEST_SIZE);
	    memset((uint8_t *)&in->digests.digests[1].digest, 0xff, SHA1_DIGEST_SIZE);
	}
    }
    return rc;
}	

static TPM_RC pcrread(TSS_CONTEXT *tssContext,
		      TPMI_DH_PCR pcrHandle)
{
    TPM_RC 		rc = 0;
    /* for debug, read back and trace the PCR value after the extend */
    PCR_Read_In 		pcrReadIn;
    PCR_Read_Out 		pcrReadOut;

    if (rc == 0) {
	pcrReadIn.pcrSelectionIn.count = 2;
	pcrReadIn.pcrSelectionIn.pcrSelections[0].hash = TPM_ALG_SHA1;
	pcrReadIn.pcrSelectionIn.pcrSelections[1].hash = TPM_ALG_SHA256;
	pcrReadIn.pcrSelectionIn.pcrSelections[0].sizeofSelect = 3;
	pcrReadIn.pcrSelectionIn.pcrSelections[1].sizeofSelect = 3;
	pcrReadIn.pcrSelectionIn.pcrSelections[0].pcrSelect[0] = 0;
	pcrReadIn.pcrSelectionIn.pcrSelections[0].pcrSelect[1] = 0;
	pcrReadIn.pcrSelectionIn.pcrSelections[0].pcrSelect[2] = 0;
	pcrReadIn.pcrSelectionIn.pcrSelections[1].pcrSelect[0] = 0;
	pcrReadIn.pcrSelectionIn.pcrSelections[1].pcrSelect[1] = 0;
	pcrReadIn.pcrSelectionIn.pcrSelections[1].pcrSelect[2] = 0;
	pcrReadIn.pcrSelectionIn.pcrSelections[0].pcrSelect[pcrHandle / 8] =
	    1 << (pcrHandle % 8);
	pcrReadIn.pcrSelectionIn.pcrSelections[1].pcrSelect[pcrHandle / 8] =
	    1 << (pcrHandle % 8);
    }
    if (rc == 0) {
	rc = TSS_Execute(tssContext,
			 (RESPONSE_PARAMETERS *)&pcrReadOut,
			 (COMMAND_PARAMETERS *)&pcrReadIn,
			 NULL,
			 TPM_CC_PCR_Read,
			 TPM_RH_NULL, NULL, 0);
    }
    if (rc == 0) {
	TSS_PrintAll("PCR digest SHA-1",
		     pcrReadOut.pcrValues.digests[0].t.buffer,
		     pcrReadOut.pcrValues.digests[0].t.size);
	TSS_PrintAll("PCR digest SHA-256",
		     pcrReadOut.pcrValues.digests[1].t.buffer,
		     pcrReadOut.pcrValues.digests[1].t.size);
    }
    return rc;
}

static void printUsage(void)
{
    printf("\n");
    printf("imaextend\n");
    printf("\n");
    printf("Runs TPM2_PCR_Extend to Extend a SHA-1 IMA measurement file (binary) into TPM PCRs\n");
    printf("The IMA measurement is directly extended into the SHA-1 bank, and a zero padded\n");
    printf("measurement is extended into the SHA-256 bank\n");
    printf("\n");
    printf("This handles the case where a zero measurement extends ones into the IMA PCR\n");
    printf("\n");
    printf("If -sim is specified, TPM PCRs are not extended.  Rather, imaextend extends into\n");
    printf("simluated PCRs and traces the result.\n");
    printf("\n");
    printf("\t-if\tIMA event log file name\n");
    printf("\t[-le\tinput file is little endian (default big endian)]\n");
    printf("\t[-sim\tcalculate simulated PCRs]\n");
    printf("\t[-b\tbeginning entry (default 0, beginning of log)]\n");
    printf("\t\tA beginning entry after the end of the log becomes a noop\n");
    printf("\t[-e\tending entry (default end of log)]\n");
    printf("\t\tE.g., -b 0 -e 0 sends one entry\n");
    printf("\t[-l\ttime - run in a continuous loop, with a sleep of 'time' seconds betwteen loops]\n");
    printf("\t\tThe intent is that this be run without specifying -b and -e\n");
    printf("\t\tAfer each pass, the next beginning entry is set to the last entry +1\n");
    printf("\n");
    exit(1);
}