pax_global_header00006660000000000000000000000064130071136140014506gustar00rootroot0000000000000052 comment=1e08ba698ab71e48504518b4b9f054ce1801375e tpm2.0-tools-1.1.0/000077500000000000000000000000001300711361400136635ustar00rootroot00000000000000tpm2.0-tools-1.1.0/.gitignore000066400000000000000000000015521300711361400156560ustar00rootroot00000000000000.deps/ .dirstamp *.log *.o *.trs aclocal.m4 autom4te.cache/ compile config.guess config.log config.status config.sub configure depcomp install-sh m4/ libtool ltmain.sh missing Makefile Makefile.in src/.dirstamp src/libcommon.a src/tpm2_activatecredential src/tpm2_hash src/tpm2_nvlist src/tpm2_nvread src/tpm2_rsaencrypt src/tpm2_nvrelease src/tpm2_create src/tpm2_getrandom src/tpm2_nvwrite src/tpm2_getpubak src/tpm2_akparse src/tpm2_rsadecrypt src/tpm2_sign src/tpm2_hmac src/tpm2_nvdefine src/tpm2_load src/tpm2_readpublic src/tpm2_unseal src/tpm2_encryptdecrypt src/tpm2_makecredential src/tpm2_certify src/tpm2_verifysignature src/tpm2_createprimary src/tpm2_quote src/tpm2_listpcrs src/tpm2_evictcontrol src/tpm2_getpubek src/tpm2_takeownership src/tpm2_loadexternal src/tpm2_getmanufec src/tpm2_rc_decode test-driver test/tpm2-rc-decode_unit test/tpm2-rc-entry_unit tpm2.0-tools-1.1.0/.travis.yml000066400000000000000000000020611300711361400157730ustar00rootroot00000000000000language: cpp compiler: - gcc # This is a lie: we don't need sudo but this is required to get an # Ubuntu image with a libc that isn't ancient, and with cmocka libs. sudo: required dist: trusty addons: apt: packages: - autoconf-archive - libcmocka0 - libcmocka-dev - openssl - libssl-dev - libcurl4-openssl-dev install: - wget http://downloads.sourceforge.net/project/ibmswtpm2/ibmtpm532.tar - mkdir ibmtpm532 && pushd ibmtpm532 && tar xzf ../ibmtpm532.tar && pushd ./src && make - ./tpm_server & - popd && popd - git clone https://github.com/01org/TPM2.0-TSS.git - pushd TPM2.0-TSS && ./bootstrap && CONFIG_SITE=./lib/default_config.site ./configure && make -j$(nproc) && sudo make install && popd - sudo ldconfig /usr/local/lib - resourcemgr -sim -tpmhost 127.0.0.1 & before_script: - ./bootstrap script: - mkdir ./build - pushd ./build - ../configure --enable-unit - make -j$(nproc) - make -j$(nproc) check - sudo make install - popd - pushd ./test - ./test_all.sh - popd tpm2.0-tools-1.1.0/AUTHORS000066400000000000000000000011151300711361400147310ustar00rootroot00000000000000The tpm2.0-tools project was created by Gang Wei at Intel Inc. A list of MUCH-APPRECIATED contributors follows. If you are not on this list but feel you should be, please contact the current maintainer(s). * atomsoftwarestudios * Benyu Xu * DamienMolina * Dandan Tu * Dewei Zhang * Erez Geva * Gang "Jimmy" Wei * Imran Desai * jethrogb * Philip Tricca tpm2.0-tools-1.1.0/Android.mk000066400000000000000000000057211300711361400156010ustar00rootroot00000000000000LOCAL_PATH := $(call my-dir) # This project TPM2_TPM_BASE=. # Download from https://github.com/01org/TPM2.0-TSS TPM2_TSS_BASE=tss define add_tss_inlude $(foreach d,$(1),$(LOCAL_PATH)/$(TPM2_TSS_BASE)/$(d)) endef TSS2_CFLAGS := -DSAPI_CLIENT # Here come the Version TPM_CFLAGS := -DVERSION=\"0.98\" $(TSS2_CFLAGS) TSS2_INCLUDE := $(call add_tss_inlude,include sysapi/include common) TSS2_TEST_INCLUDE := $(TSS2_INCLUDE) $(call add_tss_inlude,test/common/sample test/tpmclient resourcemgr) TPM_INCLUDE := $(TSS2_TEST_INCLUDE) $(call add_tss_inlude,include/tss2 include/tcti) include $(CLEAR_VARS) LOCAL_MODULE := libtss2 LOCAL_MODULE_TAGS := optional LOCAL_CFLAGS := $(TSS2_CFLAGS) LOCAL_C_INCLUDES := $(TSS2_INCLUDE) LOCAL_SRC_FILES := $(call all-c-files-under,$(TPM2_TSS_BASE)/sysapi $(TPM2_TSS_BASE)/tcti $(TPM2_TSS_BASE)/common) \ $(call all-cpp-files-under,$(TPM2_TSS_BASE)/tcti $(TPM2_TSS_BASE)/common) include $(BUILD_SHARED_LIBRARY) include $(CLEAR_VARS) LOCAL_MODULE := resourcemgr LOCAL_MODULE_TAGS := optional LOCAL_CFLAGS := $(TSS2_CFLAGS) LOCAL_C_INCLUDES := $(TSS2_INCLUDE) LOCAL_SRC_FILES := $(call all-c-files-under,$(TPM2_TSS_BASE)/resourcemgr) LOCAL_SHARED_LIBRARIES := libtss2 LOCAL_MODULE_PATH := $(TARGET_OUT_OPTIONAL_EXECUTABLES) include $(BUILD_EXECUTABLE) # The common testing functions call the testing application, so it must be static library! include $(CLEAR_VARS) LOCAL_MODULE := libtss2_test LOCAL_MODULE_TAGS := optional LOCAL_CFLAGS := $(TSS2_CFLAGS) LOCAL_C_INCLUDES := $(TSS2_TEST_INCLUDE) LOCAL_SRC_FILES := $(call all-c-files-under,$(TPM2_TSS_BASE)/test/common/sample) include $(BUILD_STATIC_LIBRARY) define add_tss_test_tgt include $$(CLEAR_VARS) LOCAL_MODULE := $(1) LOCAL_MODULE_TAGS := optional LOCAL_CFLAGS := $$(TSS2_CFLAGS) LOCAL_C_INCLUDES := $$(TSS2_TEST_INCLUDE) LOCAL_SRC_FILES := $$(TPM2_TSS_BASE)/test/$(1)/$(1).cpp LOCAL_SHARED_LIBRARIES := libtss2 LOCAL_STATIC_LIBRARIES := libtss2_test LOCAL_MODULE_PATH := $$(TARGET_OUT_OPTIONAL_EXECUTABLES) include $$(BUILD_EXECUTABLE) endef $(eval $(call add_tss_test_tgt,tpmtest)) $(eval $(call add_tss_test_tgt,tpmclient)) # The common source functions call the testing application, so it must be static library! include $(CLEAR_VARS) LOCAL_MODULE := libtpm_test LOCAL_MODULE_TAGS := optional LOCAL_CFLAGS := $(TPM_CFLAGS) LOCAL_C_INCLUDES := $(TPM_INCLUDE) LOCAL_SRC_FILES := $(TPM2_TPM_BASE)/sapi-tools/common.cpp include $(BUILD_STATIC_LIBRARY) define add_tpm_tgt include $$(CLEAR_VARS) LOCAL_MODULE := $(1) LOCAL_MODULE_TAGS := optional LOCAL_CFLAGS := $$(TPM_CFLAGS) LOCAL_C_INCLUDES := $$(TPM_INCLUDE) LOCAL_SRC_FILES := $$(TPM2_TPM_BASE)/sapi-tools/$(1).$(2) LOCAL_SHARED_LIBRARIES := libtss2 LOCAL_STATIC_LIBRARIES := libtpm_test libtss2_test LOCAL_MODULE_PATH := $$(TARGET_OUT_OPTIONAL_EXECUTABLES) include $$(BUILD_EXECUTABLE) endef $(foreach name,$(wildcard $(LOCAL_PATH)/$(TPM2_TPM_BASE)/sapi-tools/tpm2_*.cpp),$(eval $(call add_tpm_tgt,$(basename $(notdir $(name))),cpp))) tpm2.0-tools-1.1.0/CHANGELOG000066400000000000000000000036211300711361400150770ustar00rootroot00000000000000v1.1 - 2016-11-04 Added * travis ci support. * Allow for unit tests to be enabled selectively. * tpm2_rc_decode tool: Decode TPM_RC error codes. * Android Make file * tpm2_listpersistent: list all persistent objects * test scripts for tpm2-tools * tpm2_nvreadlock * tpm2_getmanufec: retrieve EC from tpm manufacturer server. * Copy 'common' and 'sample' code from the TPM2.0-TSS repo. Modified * tpm2_takeownership: update option -c to use lockout password to clear. * tpm2_listpcrs: add options -L and -s, rewrite to increase performance. * tpm2_quote: added -L option to support selection of multiple banks. * tpm2_quote: add -q option to get qualifying data. * configure: Use pkg-config to get info about libcurl and libcrypto. * configure: Use pkg-config to locate SAPI and TCTI headers / libraries. * tpm2_x: Add -X option to enable password input in Hex format. * tpm2_nvdefine: Change -X option to -I. * tpm2-nvwrite: fix for unable to write 1024B+ data. * tpm2_getmanufec: Fix base64 encoding. * tpm2_x: fixed a lot of TPM2B failures caused by wrong initialization. * tpm2_getmanufec: let configure handle libs. * tpm2_getmanufec: Convert from dos to unix format. * build: Check for TSS2 library @ configure time. * build: Detect required TSS2 and TCTI headers. * build: Use libtool to build the common library * build: Install all binaries into sbin. * build: Build common sources into library. * build: Move all source files to 'src'. * Makefile.am: Move all build rules into single Makefile.am. * everything: Use new TCTI headers and fixup API calls. * everything: Update source to cope with sapi header cleanup. * tpm2_activatecredential: Updated to support TCG compatible EK * tpm2_getpubak: Updated to use TCG compatible EK * tpm2_getpubek: fix ek creation to follow TCG EK profile spec. Removed * Windows related code * depenedency on the TPM2.0-TSS repo source code v1.0 - 2015-10-19 * 1.0 release * 29 tools included tpm2.0-tools-1.1.0/INSTALL000066400000000000000000000012731300711361400147170ustar00rootroot00000000000000To build and install the tpm2.0-tools software the following software is required: GNU Autoconf GNU Automake GNU Libtool pkg-config C compiler C++ compiler C Library Development Libraries and Header Files (for pthreads headers) TPM2.0 TSS socket TCTI library and header files TPM2.0 TSS SAPI library and header files OpenSSL library and header files Curl library and header files To obtain the tpm2.0-tools sources you must clone them as below: git clone https://github.com/01org/tpm2.0-tools To compile tpm2.0-tools execute the following commands from the root of the source directory: $ ./bootstrap $ ./configure $ make $ sudo make install All executables are generated under ./src/ directory. tpm2.0-tools-1.1.0/LICENSE000066400000000000000000000027341300711361400146760ustar00rootroot00000000000000Copyright (c) 2015, Intel Corporation Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of Intel Corporation nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. tpm2.0-tools-1.1.0/MAINTAINERS000066400000000000000000000001201300711361400153510ustar00rootroot00000000000000Gang "Jimmy" Wei Philip Tricca tpm2.0-tools-1.1.0/Makefile.am000066400000000000000000000127511300711361400157250ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2015, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; ACLOCAL_AMFLAGS = -I m4 INCLUDE_DIRS = -I$(srcdir)/src AM_CFLAGS = -DSAPI_CLIENT $(INCLUDE_DIRS) $(TPM20_TSS_CFLAGS) AM_CXXFLAGS = -DSAPI_CLIENT $(INCLUDE_DIRS) $(TPM20_TSS_CXXFLAGS) LDADD = src/libcommon.a $(TPM20_TSS_LIBS) $(TCTI_SOCK_LIBS) $(TCTI_DEV_LIBS) TESTS = $(check_PROGRAMS) noinst_LIBRARIES = src/libcommon.a sbin_PROGRAMS = src/tpm2_listpcrs \ src/tpm2_quote \ src/tpm2_takeownership \ src/tpm2_getpubek \ src/tpm2_getpubak \ src/tpm2_getmanufec \ src/tpm2_akparse \ src/tpm2_makecredential \ src/tpm2_activatecredential \ src/tpm2_hash \ src/tpm2_nvlist \ src/tpm2_nvread \ src/tpm2_nvreadlock \ src/tpm2_nvwrite \ src/tpm2_nvdefine \ src/tpm2_nvrelease \ src/tpm2_createprimary \ src/tpm2_create \ src/tpm2_hmac \ src/tpm2_certify \ src/tpm2_readpublic \ src/tpm2_getrandom \ src/tpm2_encryptdecrypt \ src/tpm2_evictcontrol \ src/tpm2_load \ src/tpm2_loadexternal \ src/tpm2_rsadecrypt \ src/tpm2_rsaencrypt \ src/tpm2_sign \ src/tpm2_unseal \ src/tpm2_verifysignature \ src/tpm2_listpersistent \ src/tpm2_rc_decode if UNIT check_PROGRAMS = \ test/tpm2-rc-decode_unit \ test/tpm2-rc-entry_unit endif COMMON_SRC = \ src/common.c \ src/debug.c \ src/syscontext.c \ src/CatSizedByteBuffer.c \ src/CopySizedBuffer.c \ src/DecryptEncrypt.c \ src/Entity.c \ src/kdfa.c \ src/LoadExternalHMACKey.c \ src/SessionHmac.c \ src/StartAuthSession.c \ src/TpmCalcPHash.c \ src/TpmHandleToName.c \ src/TpmHash.c \ src/TpmHmac.c src_libcommon_a_SOURCES = $(COMMON_SRC) src_tpm2_listpcrs_SOURCES = src/tpm2_listpcrs.cpp src_tpm2_quote_SOURCES = src/tpm2_quote.cpp src_tpm2_takeownership_SOURCES = src/tpm2_takeownership.cpp src_tpm2_getpubek_SOURCES = src/tpm2_getpubek.cpp src_tpm2_getpubak_SOURCES = src/tpm2_getpubak.cpp src_tpm2_getmanufec_SOURCES = src/tpm2_getmanufec.cpp src_tpm2_getmanufec_CFLAG = $(AM_CXXFLAGS) $(CURL_CFLAGS) src_tpm2_getmanufec_LDADD = $(LDADD) $(CURL_LIBS) src_tpm2_akparse_SOURCES = src/tpm2_akparse.cpp src_tpm2_makecredential_SOURCES = src/tpm2_makecredential.cpp src_tpm2_activatecredential_SOURCES = src/tpm2_activatecredential.cpp src_tpm2_hash_SOURCES = src/tpm2_hash.cpp src_tpm2_nvlist_SOURCES = src/tpm2_nvlist.cpp src_tpm2_nvread_SOURCES = src/tpm2_nvread.cpp src_tpm2_nvreadlock_SOURCES = src/tpm2_nvreadlock.cpp src_tpm2_nvwrite_SOURCES = src/tpm2_nvwrite.cpp src_tpm2_nvdefine_SOURCES = src/tpm2_nvdefine.cpp src_tpm2_nvrelease_SOURCES = src/tpm2_nvrelease.cpp src_tpm2_createprimary_SOURCES = src/tpm2_createprimary.cpp src_tpm2_create_SOURCES = src/tpm2_create.cpp src_tpm2_hmac_SOURCES = src/tpm2_hmac.cpp src_tpm2_certify_SOURCES = src/tpm2_certify.cpp src_tpm2_readpublic_SOURCES = src/tpm2_readpublic.cpp src_tpm2_getrandom_SOURCES = src/tpm2_getrandom.cpp src_tpm2_encryptdecrypt_SOURCES = src/tpm2_encryptdecrypt.cpp src_tpm2_evictcontrol_SOURCES = src/tpm2_evictcontrol.cpp src_tpm2_load_SOURCES = src/tpm2_load.cpp src_tpm2_loadexternal_SOURCES = src/tpm2_loadexternal.cpp src_tpm2_rsadecrypt_SOURCES = src/tpm2_rsadecrypt.cpp src_tpm2_rsaencrypt_SOURCES = src/tpm2_rsaencrypt.cpp src_tpm2_sign_SOURCES = src/tpm2_sign.cpp src_tpm2_unseal_SOURCES = src/tpm2_unseal.cpp src_tpm2_verifysignature_SOURCES = src/tpm2_verifysignature.cpp src_tpm2_listpersistent_SOURCES = src/tpm2_listpersistent.cpp src_tpm2_rc_decode_SOURCES = src/rc-decode.c src/tpm2_rc_decode.c if UNIT test_tpm2_rc_decode_unit_CFLAGS = $(AM_CXXFLAGS) $(CMOCKA_CFLAGS) test_tpm2_rc_decode_unit_LDADD = $(CMOCKA_LIBS) test_tpm2_rc_decode_unit_SOURCES = test/tpm2-rc-decode_unit.c test_tpm2_rc_entry_unit_CFLAGS = $(AM_CXXFLAGS) $(CMOCKA_CFLAGS) test_tpm2_rc_entry_unit_LDADD = $(CMOCKA_LIBS) test_tpm2_rc_entry_unit_SOURCES = src/rc-decode.c test/tpm2-rc-entry_unit.c endif tpm2.0-tools-1.1.0/README.md000066400000000000000000000025511300711361400151450ustar00rootroot00000000000000[![Build Status](https://travis-ci.org/01org/tpm2.0-tools.svg?branch=master)](https://travis-ci.org/01org/tpm2.0-tools) **This site contains the code for the TPM (Trusted Platform Module) 2.0 tools based on TPM2.0-TSS** Below is the name list of the implemented tools: ##Subset 1: NV tools tpm2_nvdefine tpm2_nvrelease tpm2_nvread tpm2_nvreadlock tpm2_nvwrite tpm2_nvlist ##Subset 2: Attestation tools tpm2_takeownership tpm2_getpubek tpm2_getmanufec tpm2_getpubak tpm2_akparse tpm2_makecredential tpm2_activatecredential tpm2_listpcrs tpm2_quote tpm2_listpersistent ##Subset 3: Key management tools tpm2_createprimary tpm2_create tpm2_evictcontrol tpm2_load tpm2_loadexternal ##Subset 4: Encryption tools tpm2_encryptdecrypt tpm2_rsaencrypt tpm2_rsadecrypt tpm2_unseal ##Subset 5: Signing tools tpm2_sign tpm2_verifysignature tpm2_certify ##Subset 6: utilities tpm2_getrandom tpm2_hash tpm2_hmac tpm2_readpublic ## Build and Installation instructions: Instructions for building and installing the tpm2.0-tools are provided in the [INSTALL](https://github.com/01org/tpm2.0-tools/blob/master/INSTALL) file. **For more details on this code and how to use it, the [manual](https://github.com/01org/tpm2.0-tools/blob/master/manual) file is a good place to start.** ## Resources TPM 2.0 specifications can be found at [Trusted Computing Group](http://www.trustedcomputinggroup.org/). tpm2.0-tools-1.1.0/bootstrap000077500000000000000000000003121300711361400156220ustar00rootroot00000000000000#! /bin/sh printf "Running libtoolize ...\n" libtoolize --install printf "Running aclocal ...\n" aclocal printf "Running autoconf ...\n" autoconf printf "Running automake ...\n" automake --add-missing tpm2.0-tools-1.1.0/configure.ac000066400000000000000000000014661300711361400161600ustar00rootroot00000000000000AC_INIT([tpm2.0-tools], [1.1.0]) AC_CONFIG_MACRO_DIR([m4]) AC_PROG_CC AC_PROG_CXX LT_INIT AM_INIT_AUTOMAKE([foreign subdir-objects]) AC_CONFIG_FILES([Makefile]) PKG_CHECK_MODULES([SAPI],[sapi]) PKG_CHECK_MODULES([TCTI_SOCK],[tcti-socket]) PKG_CHECK_MODULES([TCTI_DEV],[tcti-device]) PKG_CHECK_MODULES([CURL],[libcurl libcrypto]) AC_ARG_ENABLE([unit], [AS_HELP_STRING([--enable-unit], [build cmocka unit tests (default is no)])], [enable_unit=$enableval], [enable_unit=no]) AS_IF([test "x$enable_unit" != xno], [PKG_CHECK_MODULES([CMOCKA], [cmocka], [AC_DEFINE([HAVE_CMOCKA], [1])])]) AM_CONDITIONAL([UNIT], [test "x$enable_unit" != xno]) AC_OUTPUT tpm2.0-tools-1.1.0/manual000066400000000000000000001202761300711361400150730ustar00rootroot00000000000000tpm2.0-tools Manual =================== 1. Common steps before running any tools from tpm2.0-tools First of all, clone TPM2.0-TSS and follow the build process to install it. Then follow below steps for tpm2.0-tools. Build: $ ./bootstrap $ ./configure $ make Install: $ sudo make install Launch resourcemgr daemon: $ resourcemgr or $ resourcemgr -sim -tpmhost The resourcemgr can connect to either physical tpm or remote MS/IBM simulator, refer to the help of resourcemgr for details. 2. running tools All tool executables are built under ./src/. So once resourcemgr is up: $ cd ./src $ ./tpm2_xxx -x... Or if the tools are installed: $ tpm2_xxx -x... 3. tool usages Common options: -h/--help display this help and exit. -v/--version display version information and exit. -p/--port specifies the port number of resourcemgr, default: 2323, optional. -d/--dbg specifies level of debug messages output by resourcemgr, optional: 0 (high level test results) 1 (test app send/receive byte streams) 2 (resource manager send/receive byte streams) 3 (resource manager tables) Subset 1: NV tools ------------------ * tpm2_nvdefine Define NV index with given auth value, if passwd not given, assume NULL Usage: tpm2_nvdefine [-x/--index ] [-a/--authHandle ] [-s/--size ] [-t/--attribute ] [-P/--handlePasswd ] [-I/--indexPasswd ] [-X/--passwdInHex] where: -x/--index specifies the index of the NV area. -a/--authHandle specifies the handle used to authorize: 0x40000001 (TPM_RH_OWNER) 0x4000000C (TPM_RH_PLATFORM) -s/--size specifies the size of data area. -t/--attribute specifies the value of attribute in publicInfo struct (need calculate outside). -P/--handlePasswd specifies the password of authHandle. -I/--indexPasswd specifies the password of NV Index when created. -X/--passwdInHex passwords given by any options are hex format example: tpm2_nvdefine -x 0x1500016 -a 0x40000001 -s 32 -t 0x2000A tpm2_nvdefine -x 0x1500016 -a 0x40000001 -s 32 -t 0x2000A -I 1a1b1c -X * tpm2_nvrelease release NV index, if any passwd option is missing, assume NULL. Usage: tpm2_nvrelease [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ] [-X/--passwdInHex] where: -x/--index specifies the index of the NV area. -a/--authHandle specifies the handle used to authorize: 0x40000001 (TPM_RH_OWNER) 0x4000000C (TPM_RH_PLATFORM) -P/--handlePasswd specifies the password of authHandle. -X/--passwdInHex passwords given by any options are hex format example: tpm2_nvrelease -x 0x1500016 -a 0x40000001 -P passwd tpm2_nvrelease -x 0x1500016 -a 0x40000001 -P 1a1b1c -X * tpm2_nvread read content from NV index, if any passwd option is missing, assume NULL. Usage: tpm2_nvread [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ] [-s/--size ] [-o/--offset ] [-X/--passwdInHex] where: -x/--index specifies the index of the NV area. -a/--authHandle specifies the handle used to authorize: 0x40000001 (TPM_RH_OWNER) 0x4000000C (TPM_RH_PLATFORM) {NV_INDEX_FIRST:NV_INDEX_LAST} -P/--handlePasswd specifies the password of authHandle. -s/--size specifies the number of octets to read. -o/--offset specifies octet offset into the area This value shall be less than or equal to the size of the nvIndex data. -X/--passwdInHex passwords given by any options are hex format example: tpm2_nvread -x 0x1500016 -a 0x40000001 -P passwd -s 32 -o 0 tpm2_nvread -x 0x1500016 -a 0x40000001 -P 1a1b1c -s 32 -o 0 -X * tpm2_nvreadlock lock the NV index for further reads until the machine is restarted Usage: tpm2_nvreadlock [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ] [-X/--passwdInHex] where: -x/--index specifies the index of the NV area. -a/--authHandle specifies the handle used to authorize: 0x40000001 (TPM_RH_OWNER) 0x4000000C (TPM_RH_PLATFORM) {NV_INDEX_FIRST:NV_INDEX_LAST} -P/--handlePasswd specifies the password of authHandle. -X/--passwdInHex passwords given by any options are hex format example: tpm2_nvreadlock -x 0x1500016 -a 0x40000001 -P passwd tpm2_nvreadlock -x 0x1500016 -a 0x40000001 -P 1a1b1c -X * tpm2_nvwrite write content from a file to a specified index, if any passwd option is missing, assume NULL. Usage: tpm2_nvwrite [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ] [-f/--file ] [-X/--passwdInHex] where: -x/--index specifies the index of the NV area. -a/--authHandle specifies the handle used to authorize: 0x40000001 (TPM_RH_OWNER) 0x4000000C (TPM_RH_PLATFORM) {NV_INDEX_FIRST:NV_INDEX_LAST} -P/--handlePasswd specifies the password of authHandle. -f/--file specifies the nv data file. -X/--passwdInHex passwords given by any options are hex format example: tpm2_nvwrite -x 0x1500016 -a 0x40000001 -P passwd -f nv.data tpm2_nvwrite -x 0x1500016 -a 0x40000001 -P 1a1b1c -X -f nv.data * tpm2_nvlist display all defined NV indices. Usage: tpm2_nvlist example: tpm2_nvlist Subset 2: Attestation tools --------------------------- * tpm2_takeownership Inserting authorization values for the ownerAuth, endorsementAuth, and lockoutAuth, if any passwd option is missing, assume NULL. Usage: tpm2_takeownership [-e/--endorsePasswd ] [-o/--ownerPasswd ] [-l/--lockPasswd ] [-E/--oldEndorsePasswd ] [-O/--oldOwnerPasswd ] [-L/--oldLockPasswd ] [-X/--passwdInHex] where: -o/--ownerPasswd new Owner authorization value (string, optional, default:NULL). -e/--endorsePasswd new Endorsement authorization value (string, optional, default:NULL). -l/--lockPasswd new Lockout authorization value (string, optional, default:NULL). -O/--oldOwnerPasswd old Owner authorization (string, optional, default:NULL). -E/--oldEndorsePasswd old Endorsement authorization (string, optional, default:NULL). -L/--oldLockPasswd old Lockout authorization (string, optional, default:NULL). -X/--passwdInHex passwords given by any options are hex format -c/--clear [-L [-X]] clears the 3 authorizations values with lockout auth. example: Set ownerAuth, endorsementAuth and lockoutAuth to emptyAuth: tpm2_takeownership -c -L old Set ownerAuth, endorsementAuth and lockoutAuth to a newAuth: tpm2_takeownership -o new -e new -l new -O old -E old -L old tpm2_takeownership -o 2a2b2c -e 2a2b2c -l 2a2b2c -O 1a1b1c -E 1a1b1c -L 1a1b1c -X * tpm2_getpubek Generate TCG profile compliant endorsement key(endorsement hierarchy primary object), make it persistent with give ek handle, and return public EK, if any passwd option is missing, assume NULL, default type/alg is 0x1(RSA) Refer to: http://www.trustedcomputinggroup.org/files/static_page_files/7CAA5687-1A4B-B294-D04080D058E86C5F/Credential_Profile_EK_V2.0_R14_published.pdf Usage: tpm2_getpubek [-e/--endorsePasswd ] [-o/--ownerPasswd ] [-P/--ekPasswd ] [-H/--handle ] [-g/--alg ] [-f/--file ] [-X/--passwdInHex] where: -e/--endorsePasswd specifies current endorse password (string, optional, default:NULL). -o/--ownerPasswd specifies current owner password (string, optional, default:NULL). -P/--ekPasswd specifies the EK password when created (string, optional, default:NULL). -H/--handle specifies the handle used to make EK persistent (hex). -g/--alg specifies the algorithm type of EK (default:0x01/TPM_ALG_RSA). TPM_ALG_RSA 0x0001 TPM_ALG_KEYEDHASH 0x0008 TPM_ALG_ECC 0x0023 TPM_ALG_SYMCIPHER 0x0025 -f/--file specifies the file used to save the public portion of EK. -X/--passwdInHex passwords given by any options are hex format example: tpm2_getpubek -e abc123 -o abc123 -P passwd -H 0x81010001 -g 0x01 -f ek.pub tpm2_getpubek -e 1a1b1c -o 1a1b1c -P 123abc -X -H 0x81010001 -g 0x01 -f ek.pub * tpm2_getmanufec Retrieve the Endorsement Credential Certificate for the TPM endorsement key from the TPM manufacturer's endorsement certificate hosting server Usage: tpm2_getmanufec [-e/--endorsePasswd ] [-o/--ownerPasswd ] [-P/--ekPasswd ] [-H/--handle ] [-g/--alg ] [-f/--file ] [-S/--EKserverAddr ] [-E/--ECcertFile ] [-X/--passwdInHex] where: -e/--endorsePasswd specifies current endorse password (string, optional,default:NULL). -o/--ownerPasswd specifies current owner password (string, optional,default:NULL). -P/--ekPasswd specifies the EK password when created (string,optional,default:NULL). -H/--handle specifies the handle used to make EK persistent (hex). -g/--alg specifies the algorithm type of EK (default:0x01/TPM_ALG_RSA). -f/--file specifies the file used to save the public portion of EK. -N/--NonPersistent specifies to readout the EK public without making it persistent -O/--OfflineProv specifies that the file specifier from '-f' is an EK retrieved from offline platform that needs to be provisioned -E/--ECcertFile specifies the file used to save the Endorsement Credentials retrieved from the TPM manufacturer provisioning server -S/--EKserverAddr specifies to attempt retrieving the Endorsement Credentials from the specified TPM manufacturer provisioning server -U/--SSL_NO_VERIFY specifies to attempt connecting with the TPM manufacturer provisioning server with SSL_NO_VERIFY option -X/--passwdInHex passwords given by any options are hex format example: tpm2_getmanufec -e abc123 -o abc123 -P passwd -H 0x81010001-g 0x01 -O -N -U -E ECcert.bin -f ek.bin -S https://tpm.manufacturer.com/ekcertserver/ tpm2_getmanufec -e 1a1b1c -o 1a1b1c -P 123abc -X -H 0x81010001-g 0x01 -O -N -U -E ECcert.bin -f ek.bin -S https://tpm.manufacturer.com/ekcertserver/ * tpm2_getpubak Generate attestation key with given algorithm under endorsement hierarchy, make it persistent with given ak handle, and return pub AK and AK name, if any passwd option is missing, assume NULL, default type/alg is 0x1(RSA), default digestAlg is 0xb(SHA256), default signAlg is 0x14(RSASSA) for RSA, 0x18(ECDSA) for ECC Usage: tpm2_getpubak [-e/--endorsePasswd ] [-P/--akPasswd ] [-o/--ownerPasswd ] [-E/--ekHandle ] [-k/--akHandle ] [-g/--alg ] [-D/--digestAlg ] [-s/--signAlg ] [-f/--file ] [-n/--akName ] [-X/--passwdInHex] where: -e/--endorsePasswd specifies current endorsement password (string,optional,default:NULL). -P/--akPasswd specifies the AK password when created (string,optional,default:NULL). -o/--ownerPasswd specifies current owner password (string,optional,default:NULL). -E/--ekHandle specifies the handle of EK (hex). -k/--akHandle specifies the handle used to make AK persistent (hex). -g/--alg specifies the algorithm type of AK (default:0x01/TPM_ALG_RSA): TPM_ALG_RSA 0x0001 TPM_ALG_KEYEDHASH 0x0008 TPM_ALG_ECC 0x0023 -D/--digestAlg specifies the algorithm of digest. 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256 -s/--signAlg specifies the algorithm of sign. 0x0005 TPM_ALG_HMAC 0x0014 TPM_ALG_RSASSA 0x0016 TPM_ALG_RSAPSS 0x0018 TPM_ALG_ECDSA 0x001A TPM_ALG_ECDAA 0x001B TPM_ALG_SM2 0x001C TPM_ALG_ECSCHNORR -f/--file specifies the file used to save the public portion of AK. -n/--akName specifies the file used to save the ak name. -X/--passwdInHex passwords given by any options are hex format. example: tpm2_getpubak -e abc123 -P abc123 -o passwd -E 0x81010001 -k 0x81010002 -f ./ak.pub -n ./ak.name tpm2_getpubak -e 1a1b1c -P 123abc -o 1a1b1c -X -E 0x81010001 -k 0x81010002 -f ./ak.pub -n ./ak.name * tpm2_akparse parse the algorithm and key values in TPM2B_PUBLIC struct which input via file inputFile, and output the key into file akKeyFile. Usage: tpm2_akparse [-f inputFile][-k akKeyFile] where: -f Specifies the file used to be parsed. -k Specifies the file used to save ak key. example: tpm2_akparse -f ./ak.data -k ./ak.key * tpm2_makecredential Use the given tpm public key to protect the given secret which are used to encrypt the AK cert. Usage: -e, --encKey A tpm Public Key which was used to wrap the seed -s, --sec The secret which will be protected by the key derived from the random seed -n, --name The name of the key for which certificate is to be created -o, --outFile output file path, recording the two structures output by tpm2_makecredential function example: tpm2_makecredential -e -s -n -o * tpm2_activatecredential Verify that the given content is protected with given keyHandle for given handle, and then decrypt and return the secret, if any passwd option is missing, assume NULL. Currently only support using TCG profile compliant EK as the keyHandle. Usage: -H, --handle Handle of the object associated with the created certificate by CA -c, --context filename for handle context -k, --keyHandle Loaded key used to decrypt the the random seed -C, --keyContext filename for keyHandle context -P, --Password the handle's password, optional -e, --endorsePasswd the endorsement password, optional -f, --inFile Input file path, containing the two structures needed by tpm2_activatecredential function -o, --outFile Output file path, record the secret to decrypt the certificate -X, --passwdInHex passwords given by any options are hex format. example: tpm2_activatecredential -H 0x81010002 -k 0x81010001 -P abc123 -e abc123 -f -o tpm2_activatecredential -c ak.context -C ek.context -P abc123 -e abc123 -f -o tpm2_activatecredential -H 0x81010002 -k 0x81010001 -P 123abc -e 1a1b1c -X -f -o * tpm2_listpcrs display all PCR values in given algorithm with -g, display given PCR values in given algorithms with -L, or if no algorithm is given, output all algs. Output file just contains all returned PCR values in binary format and in 0~23 order and in the requested order if multiple algs were requested. Assume the caller know the pcr value length corresponding to the given bank/algorithm. Usage: -g, --algorithim The algorithm id, optional 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256 -o, --output The file to hold the PCR values in binary format, optional -L, --selList The list of pcr banks and selected PCRs' ids (0~23) for each bank -s, --algs Show the supported algs in the PCR banks example: display all PCR values: tpm2_listpcrs display the PCR values with specified bank: tpm2_listpcrs -g 0x04 display the PCR values with specified banks and store in a file: tpm2_listpcrs -L 0x04:16,17,18+0x0b:16,17,18 -o pcrs display the supported algs in the PCR banks: tpm2_listpcrs -s * tpm2_quote Provide quote and signature for given list of PCRs in given algorithm/banks. Usage: -k, --akHandle Handle of existing AK -c, --akContext filename for the existing AK's context -P, --akPassword AK handle's Password -l, --idList The list of selected PCRs' ids, 0~23 -g, --algorithm The algorithm id -L, --selList The list of pcr banks and selected PCRs' ids (0~23) for each bank -o, --outFile output file path, recording the two structures output by tpm2_quote function -X, --passwdInHex passwords given by any options are hex format. -q, --qualifyData Data given as a Hex string to qualify the quote, optional. Note: -L option & -g/-l options are mutually exclusive. -g/-l can be used to specify PCRs in one bank, and -L can be used to specify PCRs in any number of existing banks. example: tpm2_quote -k 0x81010002 -P abc123 -g 0x4 -l 16,17,18 -o outFile001 tpm2_quote -c ak.context -P abc123 -g 0x4 -l 16,17,18 -o outFile001 tpm2_quote -k 0x81010002 -g 0x4 -l 16,17,18 -o outFile001 tpm2_quote -c ak.context -g 0x4 -l 16,17,18 -o outFile001 tpm2_quote -k 0x81010002 -P 123abc -X -L 0x4:16,17,18+0xb:16,17,18 -o outFile001 -q 11aa22bb * tpm2_listpersistent display all defined persistent objects. Usage: tpm2_listpersistent example: tpm2_listpersistent Subset 3: Key management tools ------------------------------ * tpm2_createprimary create a Primary Object under one of the Primary Seeds or a Temporary Object under TPM_RH_NULL. Usage: -A, --auth the authorization used to authorize thecommands o TPM_RH_OWNER p TPM_RH_PLATFORM e TPM_RH_ENDORSEMENT n TPM_RH_NULL -P, --pwdp password for hierarchy, optional -K, --pwdk password for key, optional -g, --halg algorithm used for computing the Name of the object 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256 -G, --kalg algorithm associated with this object 0x0001 TPM_ALG_RSA 0x0008 TPM_ALG_KEYEDHASH 0x0023 TPM_ALG_ECC 0x0025 TPM_ALG_SYMCIPHER -C, --context The file to save the object context, optional -X, --passwdInHex passwords given by any options are hex format. example: tpm2_createprimary -A e -P abc123 -K def456 -g 0x000B -G 0x0008 tpm2_createprimary -A e -P abc123 -K def456 -g 0x000B -G 0x0008 -C ek.context tpm2_createprimary -A e -P 1a2b3c -K 456def -X -g 0x000B -G 0x0008 * tpm2_create create an object that can be loaded into a TPM using tpm2_load. The object will need to be loaded before it may be used. Usage: -H, --parent parent handle -c, --contextParent filename for parent context -P, --pwdp password for parent key, optional -K, --pwdk password for key, optional -g, --halg algorithm used for computing the Name of the object 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256 -G, --kalg algorithm associated with this object 0x0001 TPM_ALG_RSA 0x0008 TPM_ALG_KEYEDHASH 0x0023 TPM_ALG_ECC 0x0025 TPM_ALG_SYMCIPHER -A, --objectAttribute object attributes, optional -I, --inFile data file to be sealed, optional -L, --pol the input policy file, optional -o, --opu the output file which contains the public key, optional -O, --opr the output file which contains the private key, optional -X, --passwdInHex passwords given by any options are hex format. example: tpm2_create -H 0x81010001 -P abc123 -K def456 -g 0x000B -G 0x0008 -I data.File -o opu.File tpm2_create -c parent.context -P abc123 -K def456 -g 0x000B -G 0x0008 -I data.File -o opu.File tpm2_create -H 0x81010001 -P 123abc -K 456def -X -g 0x000B -G 0x0008 -I data.File -o opu.File * tpm2_evictcontrol allows a transient object to be made persistent or a persistent object to be evicted. Usage: -A, --auth the authorization used to authorize the commands o TPM_RH_OWNER p TPM_RH_PLATFORM -H, --handle the handle of a loaded object -c, --context filename for object context -S, --persistent the persistent handle for objectHandle -P, --pwda authrization password, optional -X, --passwdInHex passwords given by any options are hex format. example: tpm2_evictcontrol -A o -c object.context -S 0x81010002 -P abc123 tpm2_evictcontrol -A o -H 0x81010002 -S 0x81010002 -P abc123 tpm2_evictcontrol -A o -H 0x81010002 -S 0x81010002 -P 123abc -X * tpm2_load load objects into the TPM, both pub/priv portion are needed. Usage: -H, --parent parent handle -c, --contextParent filename for parent context -P, --pwdp parent key password, optional -u, --pubfile The public portion of the object -r, --privfile The sensitive portion of the object -n, --name Output file name, containing the name structure -C, --context The file to save the object context, optional -X, --passwdInHex passwords given by any options are hex format. example: tpm2_load -H 0x80000000 -P abc123 -u -r -n tpm2_load -c parent.context -P abc123 -u -r -n -C object.context tpm2_load -H 0x80000000 -P 123abc -X -u -r -n * tpm2_loadexternal load an object that is not a Protected Object into the TPM. The command allows loading of a public area or both a public and a sensitive area. Usage: -H, --hierarchy Hierarchy with which the object area is associated e TPM_RH_ENDORSEMENT o TPM_RH_OWNER p TPM_RH_PLATFORM n TPM_RH_NULL -u, --pubfile The public portion of the object -r, --privfile The sensitive portion of the object, optional -C, --context The file to save the object context, optional example: Load a public area generated by tpm2_create, tpm2_readpublic or manually tpm2_loadexternal -H -u -C object.context Load a key with sensitive area. Both the public & the senstive areas shall be generated externally. *DON'T* use the areas generated by tpm2_create. tpm2_loadexternal -H n -u -r -C object.context Subset 4: Encryption tools -------------------------- * tpm2_encryptdecrypt performs symmetric encryption or decryption. keyHandle shall reference a symmetric cipher object. Usage: -k, --keyHandle the symmetric key used for the operation (encryption/decryption) -c, --keyContext filename of the key context used for the operation -P, --pwdk the password of key, optional -D, --decrypt the operation type, default NO, optional YES the operation is decryption NO the operation is encryption -I, --inFile Input file path, containing the data to be operated -o, --outFile Output file path, record the operated data -X, --passwdInHex passwords given by any options are hex format. example: tpm2_encryptdecrypt -k 0x81010001 -P abc123 -D NO -I -o tpm2_encryptdecrypt -c key.context -P abc123 -D NO -I -o tpm2_encryptdecrypt -k 0x81010001 -P 123abca -X -D NO -I -o * tpm2_rsaencrypt performs RSA encryption using the indicated padding scheme according to IETF RFC 3447. The scheme of keyHandle should not be TPM_ALG_NULL. The key referenced by keyHandle is required to be an RSA key (TPM_RC_KEY) with the decrypt attribute SET (TPM_RC_ATTRIBUTES). Usage: -k, --keyHandle the public portion of RSA key to use for encryption -c, --keyContext filename of the key context used for the operation -I, --inFile Input file path, containing the data to be encrypted -o, --outFile Output file path, record the encrypted data example: tpm2_rsaencrypt -k 0x81010001 -I -o tpm2_rsaencrypt -c key.context -I -o * tpm2_rsadecrypt performs RSA decryption using the indicated padding scheme according to IETF RFC 3447 (PKCS#1). The scheme of keyHandle should not be TPM_ALG_NULL. The key referenced by keyHandle is required to be an RSA key (TPM_RC_KEY) with the decrypt attribute SET (TPM_RC_ATTRIBUTES). Usage: -k, --keyHandle the public portion of RSA key to use for decryption -c, --keyContext filename of the key context used for the operation -P, --pwdk the password of key, optional -I, --inFile Input file path, containing the data to be decrypted -o, --outFile Output file path, record the decrypted data -X, --passwdInHex passwords given by any options are hex format. example: tpm2_rsadecrypt -k 0x81010001 -I -o tpm2_rsadecrypt -k 0x81010001 -P 123abc -X -I -o * tpm2_unseal returns the data in a loaded Sealed Data Object. Usage: -H, --item item handle, handle of a loaded data object -c, --itemContext filename for item context -P, --pwdi item handle password, optional -o, --outfile Output file name, containing the unsealed data -X, --passwdInHex passwords given by any options are hex format. example: tpm2_unseal -H 0x81010001 -P abc123 -o tpm2_unseal -c item.context -P abc123 -o tpm2_unseal -H 0x81010001 -P 123abc -X -o Subset 5: Signing tools ----------------------- * tpm2_sign sign an externally provided hash with the specified symmetric or asymmetric signing key. If keyHandle references a restricted signing key, then validation shall be provided, indicating that the TPM performed the hash of the data and validation shall indicate that hashed data did not start with TPM_GENERATED_VALUE. The scheme of keyHandle should not be TPM_ALG_NULL. Usage: -k, --keyHandle Handle of key that will perform signing -c, --keyContext filename of the key context used for the operation -P, --pwdk the password of key, optional -g, --halg the hash algorithm used to digest the message 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256 -m, --msg the message file, containning the content to be digested -t, --ticket the ticket file, containning the validation structure, optional -s, --sig the signature file, record the signature structure -X, --passwdInHex passwords given by any options are hex format. example: tpm2_sign -k 0x81010001 -P abc123 -g 0x000B -m -s -t tpm2_sign -c key.context - abc123 -g 0x000B -m -s -t tpm2_sign -k 0x81010001 -P 123abc -X -g 0x000B -m -s -t * tpm2_verifysignature uses loaded keys to validate a signature on a message with the message digest passed to the TPM. If the signature check succeeds, then the TPM will produce a TPMT_TK_VERIFIED. Otherwise, the TPM shall return TPM_RC_SIGNATURE. If keyHandle references an asymmetric key, only the public portion of the key needs to be loaded. If keyHandle references a symmetric key, both the public and private portions need to be loaded. Usage: -k, --keyHandle handle of public key that will be used in the validation -c, --keyContext filename of the key context used for the operation -g, --halg the hash algorithm used to digest the message 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256 -m, --msg the input message file, containning the content to be digested -D, --digest the input hash file, containning the hash of the message. If this argument been chosed, the argument '-m(--msg)' and '-g(--halg)' is no need -s, --sig the input signature file, containning the signature to be tested -r, --raw set the input signature file to raw type, default TPMT_SIGNATURE, optional -t, --ticket the ticket file, record the validation structure example: tpm2_verifysignature -k 0x81010001 -g 0x000B -m -s -t tpm2_verifysignature -k 0x81010001 -D -s -t tpm2_verifysignature -c key.context -g 0x000B -m -s -t * tpm2_certify prove that an object with a specific Name is loaded in the TPM. By certifying that the object is loaded, the TPM warrants that a public area with a given Name is self-consistent and associated with a valid sensitive area. If a relying party has a public area that has the same Name as a Name certified with this command, then the values in that public area are correct. The object may be any object that is loaded with TPM2_Load() or TPM2_CreatePrimary(). An object that only has its public area loaded cannot be certified. Usage: -H, --objHandle handle of the object to be certified -C, --objContext filename of the object context to be certified -k, --keyHandle handle of the key used to sign the attestation structure -c, --keyContext filename of the key context used to sign the attestation structure -P, --pwdo the object handle's password, optional -K, --pwdk the keyHandle's password, optional -g, --halg the hash algorithm used to digest the message 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256 -a, --attestFile output file name, record the attestation structure -s, --sigFile output file name, record the signature structure -X, --passwdInHex passwords given by any options are hex format. example: tpm2_certify -H 0x81010002 -k 0x81010001 -P 0x0011 -K 0x00FF -g 0x00B -a -s tpm2_certify -C obj.context -c key.context -P 0x0011 -K 0x00FF -g 0x00B -a -s tpm2_certify -H 0x81010002 -k 0x81010001 -P 0011 -K 00FF -X -g 0x00B -a -s Subset 6: utilities ------------------- * tpm2_getrandom returns the next bytesRequested octets from the random number generator. Usage: tpm2_getrandom [-s/--size ] [-o/--of ] where: -s/--size specifies the size of the bytesRequested. -o/--of specifies the filename of output. example: tpm2_getrandom -s 20 -o random.out * tpm2_hash performs a hash operation on a data buffer and returns the results. If the results of the hash will be used in a signing operation that uses a restricted signing key, then the ticket returned by this command can indicate that the hash is safe to sign. Usage: -H, --hierarchy hierarchy to use for the ticket e TPM_RH_ENDORSEMENT o TPM_RH_OWNER p TPM_RH_PLATFORM n TPM_RH_NULL -g, --halg algorithm for the hash being computed 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256 -I, --infile file containning the data to be hashed -o, --outfile file record the hash result -t, --ticket file record the ticket example: tpm2_hash -H -g 0x004 -I -o -t * tpm2_hmac performs an HMAC on the supplied data using the indicated hash algorithm. The caller shall provide proper authorization for use of handle. Usage: -k, --keyHandle handle for the symmetric signing key providing the HMAC key -c, --keyContext filename of the key context used for the operation -P, --pwdk the keyHandle's password, optional -g, --halg algorithm for the hash being computed 0x0004 TPM_ALG_SHA1 0x000B TPM_ALG_SHA256 0x000C TPM_ALG_SHA384 0x000D TPM_ALG_SHA512 0x0012 TPM_ALG_SM3_256 -I, --infile file containning the data to be HMACed -o, --outfile file record the HMAC result -X, --passwdInHex passwords given by any options are hex format. example: tpm2_hmac -k 0x81010002 -P abc123 -g 0x004 -I -o tpm2_hmac -c key.context -P abc123 -g 0x004 -I -o tpm2_hmac -k 0x81010002 -P 123abc -X -g 0x004 -I -o * tpm2_readpublic Access to the public area of a loaded object. Usage: -H, --object The loaded object handle -c, --contextObject filename for object context -o, --opu The output file path, recording the public portion of the object example: tpm2_readpublic -H 0x81010002 --opu tpm2_readpublic -c obj.context --opu tpm2.0-tools-1.1.0/src/000077500000000000000000000000001300711361400144525ustar00rootroot00000000000000tpm2.0-tools-1.1.0/src/CatSizedByteBuffer.c000066400000000000000000000033701300711361400203050ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include void CatSizedByteBuffer( TPM2B *dest, TPM2B *src ) { int i; if( dest != 0 && src != 0 ) { for( i = 0; i < src->size; i++ ) dest->buffer[ dest->size + i] = src->buffer[i]; dest->size += src->size; } } tpm2.0-tools-1.1.0/src/CopySizedBuffer.c000066400000000000000000000037601300711361400176670ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include UINT16 CopySizedByteBuffer( TPM2B *dest, TPM2B *src ) { int i; UINT16 rval = 0; if( dest != 0 ) { if( src == 0 ) { dest->size = 0; rval = 0; } else { dest->size = src->size; for( i = 0; i < src->size; i++ ) dest->buffer[i] = src->buffer[i]; rval = ( sizeof( UINT16 ) + src->size ); } } else { rval = 0; } return rval; } tpm2.0-tools-1.1.0/src/DecryptEncrypt.c000066400000000000000000000254661300711361400176120ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "sample.h" #include TSS2_RC GetBlockSizeInBits( TPMI_ALG_SYM algorithm, UINT32 *blockSizeInBits ) { TSS2_RC rval = TSS2_RC_SUCCESS; if( algorithm == TPM_ALG_AES ) *blockSizeInBits = 128; else if( algorithm == TPM_ALG_SM3_256 ) *blockSizeInBits = 128; else rval = TSS2_APP_RC_BAD_ALGORITHM; return rval; } TSS2_RC GenerateSessionEncryptDecryptKey( SESSION *session, TPM2B_MAX_BUFFER *cfbKey, TPM2B_IV *ivIn, TPM2B_AUTH *authValue ) { TSS2_RC rval = TSS2_RC_SUCCESS; UINT32 blockSize; TPM2B_MAX_BUFFER key, sessionValue; rval = GetBlockSizeInBits( session->symmetric.algorithm, &blockSize ); CopySizedByteBuffer( &sessionValue.b, &session->sessionKey.b ); CatSizedByteBuffer( &sessionValue.b, &authValue->b ); if( rval == TSS2_RC_SUCCESS ) { key.t.size = sizeof( key ) - 2; rval = KDFa( session->authHash, &( sessionValue.b ), "CFB", &( session->nonceNewer.b ), &( session->nonceOlder.b ), session->symmetric.keyBits.sym + blockSize, &key ); if( rval == TSS2_RC_SUCCESS ) { if( key.t.size == ( session->symmetric.keyBits.sym + blockSize ) / 8 ) { if( ivIn != 0 && cfbKey != 0 ) { ivIn->t.size = blockSize / 8; cfbKey->t.size = (session->symmetric.keyBits.sym) / 8; if( ( ivIn->t.size <= sizeof( ivIn->t.buffer ) ) && ( ( cfbKey->t.size + ivIn->t.size ) <= MAX_DIGEST_BUFFER ) && ( cfbKey->t.size <= MAX_DIGEST_BUFFER ) ) { memcpy( (void *)&ivIn->t.buffer[0], (void *)&( key.t.buffer[ cfbKey->t.size ] ), ivIn->t.size ); memcpy( (void *)&cfbKey->t.buffer[0], (void *)&key.t.buffer[0], cfbKey->t.size ); } else { rval = APPLICATION_ERROR( TSS2_BASE_RC_INSUFFICIENT_BUFFER ); } } else { rval = APPLICATION_ERROR( TSS2_BASE_RC_INSUFFICIENT_BUFFER ); } } } } return rval; } UINT32 LoadSessionEncryptDecryptKey( TPMT_SYM_DEF *symmetric, TPM2B_MAX_BUFFER *key, TPM_HANDLE *keyHandle, TPM2B_NAME *keyName ) { TPM2B keyAuth; TPM2B_SENSITIVE inPrivate; TPM2B_PUBLIC inPublic; UINT32 rval; TSS2_SYS_CONTEXT *sysContext; keyAuth.size = 0; inPrivate.t.sensitiveArea.sensitiveType = TPM_ALG_SYMCIPHER; inPrivate.t.size = CopySizedByteBuffer( &(inPrivate.t.sensitiveArea.authValue.b), &keyAuth); inPrivate.t.sensitiveArea.seedValue.b.size = 0; inPrivate.t.size += CopySizedByteBuffer( &inPrivate.t.sensitiveArea.sensitive.bits.b, &key->b ); inPrivate.t.size += 2 * sizeof( UINT16 ); inPublic.t.publicArea.type = TPM_ALG_SYMCIPHER; inPublic.t.publicArea.nameAlg = TPM_ALG_NULL; *( UINT32 *)&( inPublic.t.publicArea.objectAttributes )= 0; inPublic.t.publicArea.objectAttributes.decrypt = 1; inPublic.t.publicArea.objectAttributes.sign = 1; inPublic.t.publicArea.objectAttributes.userWithAuth = 1; inPublic.t.publicArea.authPolicy.t.size = 0; inPublic.t.publicArea.parameters.symDetail.sym.algorithm = symmetric->algorithm; inPublic.t.publicArea.parameters.symDetail.sym.keyBits = symmetric->keyBits; inPublic.t.publicArea.parameters.symDetail.sym.mode = symmetric->mode; inPublic.t.publicArea.unique.sym.t.size = 0; sysContext = InitSysContext( 1000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) { return TSS2_APP_RC_INIT_SYS_CONTEXT_FAILED; } keyName->t.size = sizeof( *keyName ) - 2; rval = Tss2_Sys_LoadExternal( sysContext, 0, &inPrivate, &inPublic, TPM_RH_NULL, keyHandle, keyName, 0 ); TeardownSysContext( &sysContext ); return rval; } TSS2_RC EncryptCFB( SESSION *session, TPM2B_MAX_BUFFER *encryptedData, TPM2B_MAX_BUFFER *clearData, TPM2B_AUTH *authValue ) { TSS2_RC rval = TSS2_RC_SUCCESS; TPM2B_MAX_BUFFER encryptKey; TPM2B_IV ivIn, ivOut; TPM_HANDLE keyHandle; TPM2B_NAME keyName; TSS2_SYS_CONTEXT *sysContext; // Authorization structure for command. TPMS_AUTH_COMMAND sessionData; // Create and init authorization area for command: // only 1 authorization area. TPMS_AUTH_COMMAND *sessionDataArray[1] = { &sessionData }; // Authorization array for command (only has one auth structure). TSS2_SYS_CMD_AUTHS sessionsData = { 1, &sessionDataArray[0] }; sysContext = InitSysContext( 1000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) { TeardownSysContext( &sysContext ); return TSS2_APP_RC_TEARDOWN_SYS_CONTEXT_FAILED; } rval = GenerateSessionEncryptDecryptKey( session, &encryptKey, &ivIn, authValue ); if( rval == TSS2_RC_SUCCESS ) { rval = LoadSessionEncryptDecryptKey( &session->symmetric, &encryptKey, &keyHandle, &keyName ); if( rval == TSS2_RC_SUCCESS ) { // Encrypt the data. sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; sessionData.hmac.t.size = 0; encryptedData->t.size = sizeof( *encryptedData ) - 1; ivOut.t.size = sizeof( ivOut ) - 2; rval = Tss2_Sys_EncryptDecrypt( sysContext, keyHandle, &sessionsData, NO, TPM_ALG_CFB, &ivIn, clearData, encryptedData, &ivOut, 0 ); if( rval == TSS2_RC_SUCCESS ) { rval = Tss2_Sys_FlushContext( sysContext, keyHandle ); } } } TeardownSysContext( &sysContext ); return rval; } TSS2_RC DecryptCFB( SESSION *session, TPM2B_MAX_BUFFER *clearData, TPM2B_MAX_BUFFER *encryptedData, TPM2B_AUTH *authValue ) { TSS2_RC rval = TSS2_RC_SUCCESS; TPM2B_MAX_BUFFER encryptKey; TPM2B_IV ivIn, ivOut; TPM_HANDLE keyHandle; TPM2B_NAME keyName; TSS2_SYS_CONTEXT *sysContext; // Authorization structure for command. TPMS_AUTH_COMMAND sessionData; // Create and init authorization area for command: // only 1 authorization area. TPMS_AUTH_COMMAND *sessionDataArray[1] = { &sessionData }; // Authorization array for command (only has one auth structure). TSS2_SYS_CMD_AUTHS sessionsData = { 1, &sessionDataArray[0] }; sysContext = InitSysContext( 1000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) { TeardownSysContext( &sysContext ); return TSS2_APP_RC_TEARDOWN_SYS_CONTEXT_FAILED; } rval = GenerateSessionEncryptDecryptKey( session, &encryptKey, &ivIn, authValue ); if( rval == TSS2_RC_SUCCESS ) { rval = LoadSessionEncryptDecryptKey( &session->symmetric, &encryptKey, &keyHandle, &keyName ); if( rval == TSS2_RC_SUCCESS ) { // Decrypt the data. sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; sessionData.hmac.t.size = 0; rval = Tss2_Sys_EncryptDecrypt( sysContext, keyHandle, &sessionsData, YES, TPM_ALG_CFB, &ivIn, encryptedData, clearData, &ivOut, 0 ); if( rval == TSS2_RC_SUCCESS ) { rval = Tss2_Sys_FlushContext( sysContext, keyHandle ); } } } TeardownSysContext( &sysContext ); return rval; } TSS2_RC EncryptDecryptXOR( SESSION *session, TPM2B_MAX_BUFFER *outputData, TPM2B_MAX_BUFFER *inputData, TPM2B_AUTH *authValue ) { TSS2_RC rval = TSS2_RC_SUCCESS; TPM2B_MAX_BUFFER key, mask; int i; CopySizedByteBuffer( &key.b, &session->sessionKey.b ); CatSizedByteBuffer( &key.b, &authValue->b ); rval = KDFa( session->authHash, &key.b, "XOR", &session->nonceNewer.b, &session->nonceOlder.b, inputData->t.size * 8, &mask ); if( rval == TSS2_RC_SUCCESS ) { for( i = 0; i < inputData->t.size; i++ ) { outputData->t.buffer[i] = inputData->t.buffer[i] ^ mask.t.buffer[i]; } outputData->t.size = inputData->t.size; } return rval; } TSS2_RC EncryptCommandParam( SESSION *session, TPM2B_MAX_BUFFER *encryptedData, TPM2B_MAX_BUFFER *clearData, TPM2B_AUTH *authValue ) { TSS2_RC rval = TSS2_RC_SUCCESS; if( session->symmetric.algorithm == TPM_ALG_AES ) { // CFB mode encryption. rval = EncryptCFB( session, encryptedData, clearData, authValue ); } else { // XOR mode encryption. rval = EncryptDecryptXOR( session, encryptedData, clearData, authValue ); } return rval; } TSS2_RC DecryptResponseParam( SESSION *session, TPM2B_MAX_BUFFER *clearData, TPM2B_MAX_BUFFER *encryptedData, TPM2B_AUTH *authValue ) { TSS2_RC rval = TSS2_RC_SUCCESS; if( session->symmetric.algorithm == TPM_ALG_AES ) { // CFB mode decryption. rval = DecryptCFB( session, clearData, encryptedData, authValue ); } else { // XOR mode decryption. rval = EncryptDecryptXOR( session, clearData, encryptedData, authValue ); } return rval; } tpm2.0-tools-1.1.0/src/Entity.c000066400000000000000000000066421300711361400161020ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "sample.h" #ifdef __cplusplus extern "C" { #endif void InitEntities() { int i; for( i = 0; i < MAX_NUM_ENTITIES; i++ ) { entities[i].entityHandle = TPM_HT_NO_HANDLE; } } #ifdef __cplusplus } #endif TPM_RC AddEntity( TPM_HANDLE entityHandle, TPM2B_AUTH *auth ) { int i; TPM_RC rval = TPM_RC_FAILURE; for( i = 0; i < MAX_NUM_ENTITIES; i++ ) { if( entities[i].entityHandle == TPM_HT_NO_HANDLE ) { entities[i].entityHandle = entityHandle; CopySizedByteBuffer( &( entities[i].entityAuth.b ), &( auth->b ) ); if( ( entityHandle >> HR_SHIFT ) == TPM_HT_NV_INDEX ) { entities[i].nvNameChanged = 0; } rval = TPM_RC_SUCCESS; break; } } return rval; } TPM_RC DeleteEntity( TPM_HANDLE entityHandle ) { int i; TPM_RC rval = TPM_RC_FAILURE; for( i = 0; i < MAX_NUM_ENTITIES; i++ ) { if( entities[i].entityHandle == entityHandle ) { entities[i].entityHandle = TPM_HT_NO_HANDLE; rval = TPM_RC_SUCCESS; break; } } return rval; } TPM_RC GetEntityAuth( TPM_HANDLE entityHandle, TPM2B_AUTH *auth ) { int i; TPM_RC rval = TPM_RC_FAILURE; for( i = 0; i < MAX_NUM_ENTITIES; i++ ) { if( entities[i].entityHandle == entityHandle ) { CopySizedByteBuffer( &( auth->b ), &( entities[i].entityAuth.b ) ); rval = TPM_RC_SUCCESS; break; } } return rval; } TPM_RC GetEntity( TPM_HANDLE entityHandle, ENTITY **entity ) { int i; TPM_RC rval = TPM_RC_FAILURE; for( i = 0; i < MAX_NUM_ENTITIES; i++ ) { if( entities[i].entityHandle == entityHandle ) { *entity = &( entities[i] ); rval = TPM_RC_SUCCESS; } } return rval; } tpm2.0-tools-1.1.0/src/LoadExternalHMACKey.c000066400000000000000000000061451300711361400203100ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "sample.h" UINT32 LoadExternalHMACKey( TPMI_ALG_HASH hashAlg, TPM2B *key, TPM_HANDLE *keyHandle, TPM2B_NAME *keyName ) { TPM2B keyAuth; TPM2B_SENSITIVE inPrivate; TPM2B_PUBLIC inPublic; UINT32 rval; TSS2_SYS_CONTEXT *sysContext; keyAuth.size = 0; inPrivate.t.sensitiveArea.sensitiveType = TPM_ALG_KEYEDHASH; inPrivate.t.size = CopySizedByteBuffer( &(inPrivate.t.sensitiveArea.authValue.b), &keyAuth); inPrivate.t.sensitiveArea.seedValue.b.size = 0; inPrivate.t.size += CopySizedByteBuffer( &inPrivate.t.sensitiveArea.sensitive.bits.b, key); inPrivate.t.size += 2 * sizeof( UINT16 ); inPublic.t.publicArea.type = TPM_ALG_KEYEDHASH; inPublic.t.publicArea.nameAlg = TPM_ALG_NULL; *( UINT32 *)&( inPublic.t.publicArea.objectAttributes )= 0; inPublic.t.publicArea.objectAttributes.sign = 1; inPublic.t.publicArea.objectAttributes.userWithAuth = 1; inPublic.t.publicArea.authPolicy.t.size = 0; inPublic.t.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM_ALG_HMAC; inPublic.t.publicArea.parameters.keyedHashDetail.scheme.details.hmac.hashAlg = hashAlg; inPublic.t.publicArea.unique.keyedHash.t.size = 0; sysContext = InitSysContext( 1000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) { TeardownSysContext( &sysContext ); return TSS2_APP_ERROR_LEVEL + TPM_RC_FAILURE; } keyName->t.size = sizeof( TPM2B_NAME ) - 2; rval = Tss2_Sys_LoadExternal( sysContext, 0, &inPrivate, &inPublic, TPM_RH_NULL, keyHandle, keyName, 0 ); TeardownSysContext( &sysContext ); return rval; } tpm2.0-tools-1.1.0/src/SessionHmac.c000066400000000000000000000213071300711361400170350ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "sample.h" #include #include // // This function calculates the session HMAC and updates session state. // UINT32 TpmComputeSessionHmac( TSS2_SYS_CONTEXT *sysContext, TPMS_AUTH_COMMAND *pSessionDataIn, // Pointer to session input struct TPM_HANDLE entityHandle, // Used to determine if we're accessing a different // resource than the bound resoure. TPM_RC responseCode, // Response code for the command, 0xffff for "none" is // used to indicate that no response code is present // (used for calculating command HMACs vs response HMACs). TPM_HANDLE handle1, // First handle == 0xff000000 indicates no handle TPM_HANDLE handle2, // Second handle == 0xff000000 indicates no handle TPMA_SESSION sessionAttributes, // Current session attributes TPM2B_DIGEST *result, // Where the result hash is saved. TPM_RC sessionCmdRval ) { TPM2B_MAX_BUFFER hmacKey; TPM2B *bufferList[7]; TPM2B_DIGEST pHash; SESSION *pSession = 0; TPM2B_AUTH authValue; TPM2B sessionAttributesByteBuffer; UINT16 i; TPM_RC rval; UINT8 nvNameChanged = 0; ENTITY *nvEntity; UINT8 commandCode[4] = { 0, 0, 0, 0 }; UINT32 *cmdCodePtr; UINT32 cmdCode; hmacKey.b.size = 0; rval = GetSessionStruct( pSessionDataIn->sessionHandle, &pSession ); if( rval != TPM_RC_SUCCESS ) { return rval; } pHash.t.size = sizeof( TPM2B_DIGEST ) - 2; rval = ( *CalcPHash )( sysContext, handle1, handle2, pSession->authHash, responseCode, &pHash ); if( rval != TPM_RC_SUCCESS ) return rval; // Use entityHandle to get authValue, if any. if( ( pSession->bind == TPM_RH_NULL ) || ( ( pSession->bind != TPM_RH_NULL ) && ( pSession->bind == entityHandle ) ) ) { rval = GetEntityAuth( entityHandle, &authValue ); if( rval != TPM_RC_SUCCESS ) authValue.t.size = 0; } else { authValue.t.size = 0; } rval = Tss2_Sys_GetCommandCode( sysContext, &commandCode ); if( rval != TPM_RC_SUCCESS ) return rval; if( ( entityHandle >> HR_SHIFT ) == TPM_HT_NV_INDEX ) { // If NV index, get status wrt to name change. If name has changed, // we have to treat it as if its not the bound entity, even if it was // the bound entity. nvNameChanged = pSession->nvNameChanged; } rval = ConcatSizedByteBuffer( (TPM2B_MAX_BUFFER *)&hmacKey, &( pSession->sessionKey.b ) ); if( ( pSession->bind == TPM_RH_NULL ) || ( pSession->bind != entityHandle ) || nvNameChanged ) { rval = ConcatSizedByteBuffer( (TPM2B_MAX_BUFFER *)&hmacKey, &( authValue.b ) ); } #ifdef DEBUG OpenOutFile( &outFp ); TpmClientPrintf( 0, "\n\nhmacKey = " ); PrintSizedBuffer( &(hmacKey.b) ); CloseOutFile( &outFp ); #endif // Create buffer list i = 0; bufferList[i++] = &pHash.b; bufferList[i++] = &( pSession->nonceNewer.b ); bufferList[i++] = &( pSession->nonceOlder.b ); bufferList[i++] = &( pSession->nonceTpmDecrypt.b ); bufferList[i++] = &( pSession->nonceTpmEncrypt.b ); sessionAttributesByteBuffer.size = 1; sessionAttributesByteBuffer.buffer[0] = *(UINT8 *)&sessionAttributes; bufferList[i++] = &( sessionAttributesByteBuffer ); bufferList[i++] = 0; cmdCodePtr = (UINT32 *)&commandCode[0]; cmdCode = *cmdCodePtr; #ifdef DEBUG OpenOutFile( &outFp ); for( i = 0; bufferList[i] != 0; i++ ) { TpmClientPrintf( 0, "\n\nbufferlist[%d]:\n", i ); PrintSizedBuffer( bufferList[i] ); } CloseOutFile( &outFp ); #endif rval = (*HmacFunctionPtr)( pSession->authHash, &hmacKey.b, &( bufferList[0] ), result ); if( rval != TPM_RC_SUCCESS ) return rval; if( ( responseCode != TPM_RC_NO_RESPONSE ) && ( cmdCode == TPM_CC_NV_Write || cmdCode == TPM_CC_NV_Increment || cmdCode == TPM_CC_NV_SetBits ) ) { rval = GetEntity( entityHandle, &nvEntity ); if( rval != TPM_RC_SUCCESS ) { return rval; } else { // Only change session's nvNameChanged parameter when // the NV index's name changes due to a write. if( nvEntity->nvNameChanged == 0 ) { pSession->nvNameChanged = 1; nvEntity->nvNameChanged = 1; } } } return rval; } TPM_RC ComputeCommandHmacs( TSS2_SYS_CONTEXT *sysContext, TPM_HANDLE handle1, TPM_HANDLE handle2, TSS2_SYS_CMD_AUTHS *pSessionsDataIn, TPM_RC sessionCmdRval ) { uint8_t i; TPM_RC rval = TPM_RC_SUCCESS; TPM2B_AUTH *authPtr = 0; TPM_HANDLE entityHandle = TPM_HT_NO_HANDLE; // Note: from Part 1, table 6, Use of Authorization/Session Blocks, we // can have at most two HMAC sessions per command. for( i = 0; ( i < 2 ) && ( i < pSessionsDataIn->cmdAuthsCount ); i++ ) { authPtr = &( pSessionsDataIn->cmdAuths[i]->hmac ); if( i == 0 || i == 1 ) { entityHandle = handle1; } else { entityHandle = TPM_HT_NO_HANDLE; } if( authPtr != 0 ) { rval = ( *ComputeSessionHmacPtr )( sysContext, pSessionsDataIn->cmdAuths[i], entityHandle, TPM_RC_NO_RESPONSE, handle1, handle2, pSessionsDataIn->cmdAuths[i]->sessionAttributes, authPtr, sessionCmdRval ); if( rval != TPM_RC_SUCCESS ) break; } } return rval; } TPM_RC CheckResponseHMACs( TSS2_SYS_CONTEXT *sysContext, TPM_RC responseCode, TSS2_SYS_CMD_AUTHS *pSessionsDataIn, TPM_HANDLE handle1, TPM_HANDLE handle2, TSS2_SYS_RSP_AUTHS *pSessionsDataOut ) { TPM_HANDLE entityHandle = TPM_HT_NO_HANDLE; TPM2B_DIGEST auth; TPM_RC rval = TPM_RC_SUCCESS; uint8_t i; // Check response HMACs, if any. if( responseCode == TPM_RC_SUCCESS ) { for( i = 0; ( i < 2 ) && ( i < pSessionsDataIn->cmdAuthsCount ); i++ ) { if( i == 0 || i == 1 ) { entityHandle = handle1; } else { entityHandle = TPM_HT_NO_HANDLE; } if( ( pSessionsDataIn->cmdAuths[i]->sessionHandle >> HR_SHIFT ) == TPM_HT_HMAC_SESSION ) { rval = ( *ComputeSessionHmacPtr )( sysContext, pSessionsDataIn->cmdAuths[i], entityHandle, responseCode, handle1, handle2, pSessionsDataOut->rspAuths[i]->sessionAttributes, &auth, TPM_RC_SUCCESS ); if( rval != TPM_RC_SUCCESS ) return rval; rval = CompareSizedByteBuffer( &( auth.b ), &( pSessionsDataOut->rspAuths[i]->hmac.b ) ); if( rval != TPM_RC_SUCCESS ) return APPLICATION_HMAC_ERROR(i+1); } } } return rval; } tpm2.0-tools-1.1.0/src/StartAuthSession.c000066400000000000000000000231671300711361400201120ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "sample.h" #include #define SESSIONS_ARRAY_COUNT MAX_NUM_SESSIONS+1 typedef struct { SESSION session; void *nextEntry; } SESSION_LIST_ENTRY; SESSION_LIST_ENTRY *sessionsList = 0; INT16 sessionEntriesUsed = 0; TPM_RC AddSession( SESSION_LIST_ENTRY **sessionEntry ) { SESSION_LIST_ENTRY **newEntry; // TpmClientPrintf( 0, "In AddSession\n" ); // find end of list. for( newEntry = &sessionsList; *newEntry != 0; *newEntry = ( (SESSION_LIST_ENTRY *)*newEntry)->nextEntry ) ; // allocate space for session structure. *newEntry = malloc( sizeof( SESSION_LIST_ENTRY ) ); if( *newEntry != 0 ) { *sessionEntry = *newEntry; (*sessionEntry)->nextEntry = 0; sessionEntriesUsed++; return TPM_RC_SUCCESS; } else { return TSS2_APP_RC_SESSION_SLOT_NOT_FOUND; } } void DeleteSession( SESSION *session ) { SESSION_LIST_ENTRY *predSession; void *newNextEntry; // TpmClientPrintf( 0, "In DeleteSession\n" ); if( session == &sessionsList->session ) sessionsList = 0; else { // Find predecessor. for( predSession = sessionsList; predSession != 0 && &( ( ( SESSION_LIST_ENTRY *)predSession->nextEntry )->session ) != session; predSession = predSession->nextEntry ) ; if( predSession != 0 ) { sessionEntriesUsed--; newNextEntry = &( (SESSION_LIST_ENTRY *)predSession->nextEntry)->nextEntry; free( predSession->nextEntry ); predSession->nextEntry = newNextEntry; } } } TPM_RC GetSessionStruct( TPMI_SH_AUTH_SESSION sessionHandle, SESSION **session ) { TPM_RC rval = TSS2_APP_RC_GET_SESSION_STRUCT_FAILED; SESSION_LIST_ENTRY *sessionEntry; TpmClientPrintf( 0, "In GetSessionStruct\n" ); if( session != 0 ) { // // Get pointer to session structure using the sessionHandle // for( sessionEntry = sessionsList; sessionEntry != 0 && sessionEntry->session.sessionHandle != sessionHandle; sessionEntry = sessionEntry->nextEntry ) ; if( sessionEntry != 0 ) { *session = &sessionEntry->session; rval = TSS2_RC_SUCCESS; } } return rval; } TPM_RC GetSessionAlgId( TPMI_SH_AUTH_SESSION sessionHandle, TPMI_ALG_HASH *sessionAlgId ) { TPM_RC rval = TSS2_APP_RC_GET_SESSION_ALG_ID_FAILED; SESSION *session; TpmClientPrintf( 0, "In GetSessionAlgId\n" ); rval = GetSessionStruct( sessionHandle, &session ); if( rval == TSS2_RC_SUCCESS ) { *sessionAlgId = session->authHash; rval = TSS2_RC_SUCCESS; } return rval; } void RollNonces( SESSION *session, TPM2B_NONCE *newNonce ) { session->nonceOlder = session->nonceNewer; session->nonceNewer = *newNonce; } // // This is a wrapper function around the TPM2_StartAuthSession command. // It performs the command, calculates the session key, and updates a // SESSION structure. // TPM_RC StartAuthSession( SESSION *session ) { TPM_RC rval; TPM2B_ENCRYPTED_SECRET key; char label[] = "ATH"; TSS2_SYS_CONTEXT *tmpSysContext; UINT16 bytes; int i; key.t.size = 0; tmpSysContext = InitSysContext( 1000, resMgrTctiContext, &abiVersion ); if( tmpSysContext == 0 ) return TSS2_APP_RC_INIT_SYS_CONTEXT_FAILED; if( session->nonceOlder.t.size == 0 ) { session->nonceOlder.t.size = GetDigestSize( TPM_ALG_SHA1 ); for( i = 0; i < session->nonceOlder.t.size; i++ ) session->nonceOlder.t.buffer[i] = 0; } session->nonceNewer.t.size = session->nonceOlder.t.size; rval = Tss2_Sys_StartAuthSession( tmpSysContext, session->tpmKey, session->bind, 0, &( session->nonceOlder ), &( session->encryptedSalt ), session->sessionType, &( session->symmetric ), session->authHash, &( session->sessionHandle ), &( session->nonceNewer ), 0 ); if( rval == TPM_RC_SUCCESS ) { if( session->tpmKey == TPM_RH_NULL ) session->salt.t.size = 0; if( session->bind == TPM_RH_NULL ) session->authValueBind.t.size = 0; if( session->tpmKey == TPM_RH_NULL && session->bind == TPM_RH_NULL ) { session->sessionKey.b.size = 0; } else { // Generate the key used as input to the KDF. rval = ConcatSizedByteBuffer( (TPM2B_MAX_BUFFER *)&key, &( session->authValueBind.b ) ); if( rval != TPM_RC_SUCCESS ) { TeardownSysContext( &tmpSysContext ); return( rval ); } rval = ConcatSizedByteBuffer( (TPM2B_MAX_BUFFER *)&key, &( session->salt.b ) ); if( rval != TPM_RC_SUCCESS ) { TeardownSysContext( &tmpSysContext ); return( rval ); } bytes = GetDigestSize( session->authHash ); if( key.t.size == 0 ) { session->sessionKey.t.size = 0; } else { rval = KDFa( session->authHash, &(key.b), label, &( session->nonceNewer.b ), &( session->nonceOlder.b ), bytes * 8, (TPM2B_MAX_BUFFER *)&( session->sessionKey ) ); } if( rval != TPM_RC_SUCCESS ) { TeardownSysContext( &tmpSysContext ); return( TSS2_APP_RC_CREATE_SESSION_KEY_FAILED ); } } session->nonceTpmDecrypt.b.size = 0; session->nonceTpmEncrypt.b.size = 0; session->nvNameChanged = 0; } TeardownSysContext( &tmpSysContext ); return rval; } // // This version of StartAuthSession initializes the fields // of the session structure using the passed in // parameters, then calls StartAuthSession // with just a pointer to the session structure. // This allows all params to be set in one line of code when // the function is called; cleaner this way, for // some uses. // TPM_RC StartAuthSessionWithParams( SESSION **session, TPMI_DH_OBJECT tpmKey, TPM2B_MAX_BUFFER *salt, TPMI_DH_ENTITY bind, TPM2B_AUTH *bindAuth, TPM2B_NONCE *nonceCaller, TPM2B_ENCRYPTED_SECRET *encryptedSalt, TPM_SE sessionType, TPMT_SYM_DEF *symmetric, TPMI_ALG_HASH algId ) { TPM_RC rval; SESSION_LIST_ENTRY *sessionEntry; rval = AddSession( &sessionEntry ); if( rval == TSS2_RC_SUCCESS ) { *session = &sessionEntry->session; // Copy handles to session struct. (*session)->bind = bind; (*session)->tpmKey = tpmKey; // Copy nonceCaller to nonceOlder in session struct. // This will be used as nonceCaller when StartAuthSession // is called. CopySizedByteBuffer( &(*session)->nonceOlder.b, &nonceCaller->b ); // Copy encryptedSalt CopySizedByteBuffer( &(*session)->encryptedSalt.b, &encryptedSalt->b ); // Copy sessionType. (*session)->sessionType = sessionType; // Init symmetric. (*session)->symmetric.algorithm = symmetric->algorithm; (*session)->symmetric.keyBits.sym = symmetric->keyBits.sym; (*session)->symmetric.mode.sym = symmetric->mode.sym; (*session)->authHash = algId; // Copy bind' authValue. if( bindAuth == 0 ) { (*session)->authValueBind.b.size = 0; } else { CopySizedByteBuffer( &( (*session)->authValueBind.b ), &( bindAuth->b ) ); } // Calculate sessionKey if( (*session)->tpmKey == TPM_RH_NULL ) { (*session)->salt.t.size = 0; } else { CopySizedByteBuffer( &(*session)->salt.b, &salt->b ); } if( (*session)->bind == TPM_RH_NULL ) (*session)->authValueBind.t.size = 0; rval = StartAuthSession( *session ); } else { DeleteSession( *session ); } return( rval ); } TPM_RC EndAuthSession( SESSION *session ) { TPM_RC rval = TPM_RC_SUCCESS; DeleteSession( session ); return rval; } tpm2.0-tools-1.1.0/src/TpmCalcPHash.c000066400000000000000000000130221300711361400170630ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "changeEndian.h" #include "sample.h" #include #include // // This function is a helper function used to calculate cpHash and rpHash. // // NOTE: for calculating cpHash, set responseCode to TPM_RC_NO_RESPONSE; this // tells the function to leave it out of the calculation. // TPM_RC TpmCalcPHash( TSS2_SYS_CONTEXT *sysContext, TPM_HANDLE handle1, TPM_HANDLE handle2, TPMI_ALG_HASH authHash, TPM_RC responseCode, TPM2B_DIGEST *pHash ) { TPM_RC rval = TPM_RC_SUCCESS; UINT32 i; TPM2B_NAME name1; TPM2B_NAME name2; TPM2B_MAX_BUFFER hashInput; // Byte stream to be hashed to create pHash UINT8 *hashInputPtr; size_t parametersSize; const uint8_t *startParams; UINT8 cmdCode[4] = {0,0,0,0}; UINT8 *cmdCodePtr = &cmdCode[0]; name1.b.size = name2.b.size = 0; // Calculate pHash // // Only get names for commands if( responseCode == TPM_RC_NO_RESPONSE ) { // Get names for the handles rval = TpmHandleToName( handle1, &name1 ); if( rval != TPM_RC_SUCCESS ) return rval; } #ifdef DEBUG OpenOutFile( &outFp ); TpmClientPrintf( 0, "\n\nNAME1 = \n" ); PrintSizedBuffer( &(name1.b) ); CloseOutFile( &outFp ); #endif // Only get names for commands if( responseCode == TPM_RC_NO_RESPONSE ) { rval = Tss2_Sys_GetCpBuffer( sysContext, ¶metersSize, &startParams); if( rval != TPM_RC_SUCCESS ) return rval; rval = TpmHandleToName( handle2, &name2 ); if( rval != TPM_RC_SUCCESS ) return rval; } else { rval = Tss2_Sys_GetRpBuffer( sysContext, ¶metersSize, &startParams); if( rval != TPM_RC_SUCCESS ) return rval; } #ifdef DEBUG OpenOutFile( &outFp ); TpmClientPrintf( 0, "\n\nNAME2 = \n" ); PrintSizedBuffer( &(name2.b) ); CloseOutFile( &outFp ); #endif // Create pHash input byte stream: first add response code, if any. hashInput.b.size = 0; if( responseCode != TPM_RC_NO_RESPONSE ) { hashInputPtr = &( hashInput.t.buffer[hashInput.b.size] ); *(UINT32 *)hashInputPtr = CHANGE_ENDIAN_DWORD( responseCode ); hashInput.b.size += 4; hashInputPtr += 4; } // Create pHash input byte stream: now add command code. rval = Tss2_Sys_GetCommandCode( sysContext, &cmdCode ); if( rval != TPM_RC_SUCCESS ) return rval; hashInputPtr = &( hashInput.t.buffer[hashInput.b.size] ); *(UINT32 *)hashInputPtr = CHANGE_ENDIAN_DWORD( *(UINT32 *)cmdCodePtr ); hashInput.t.size += 4; // Create pHash input byte stream: now add in names for the handles. rval = ConcatSizedByteBuffer( &hashInput, &( name1.b ) ); if( rval != TPM_RC_SUCCESS ) return rval; rval = ConcatSizedByteBuffer( &hashInput, &( name2.b ) ); if( rval != TPM_RC_SUCCESS ) return rval; if( ( hashInput.t.size + parametersSize ) <= sizeof( hashInput.t.buffer ) ) { // Create pHash input byte stream: now add in parameters byte stream for( i = 0; i < parametersSize; i++ ) hashInput.t.buffer[hashInput.t.size + i ] = startParams[i]; hashInput.t.size += (UINT16)parametersSize; } else { return( APPLICATION_ERROR( TSS2_BASE_RC_INSUFFICIENT_BUFFER ) ); } #ifdef DEBUG OpenOutFile( &outFp ); TpmClientPrintf( 0, "\n\nPHASH input bytes= \n" ); PrintSizedBuffer( &(hashInput.b) ); CloseOutFile( &outFp ); #endif // Now hash the whole mess. if( hashInput.t.size > sizeof( hashInput.t.buffer ) ) { rval = APPLICATION_ERROR( TSS2_BASE_RC_INSUFFICIENT_BUFFER ); } else { rval = TpmHash( authHash, hashInput.t.size, &( hashInput.t.buffer[0] ), pHash ); if( rval != TPM_RC_SUCCESS ) return rval; #ifdef DEBUG OpenOutFile( &outFp ); TpmClientPrintf( 0, "\n\nPHASH = " ); PrintSizedBuffer( &(pHash->b) ); CloseOutFile( &outFp ); #endif } return rval; } tpm2.0-tools-1.1.0/src/TpmHandleToName.c000066400000000000000000000063371300711361400176070ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "changeEndian.h" #include "sample.h" // // UINT32 TpmHandleToName( TPM_HANDLE handle, TPM2B_NAME *name ) { TPM_RC rval; TPM2B_NAME qualifiedName; TPM2B_PUBLIC public; TPM2B_NV_PUBLIC nvPublic; TSS2_SYS_CONTEXT *sysContext; UINT8 *namePtr = &( name->t.name[0] ); // Initialize name to zero length in case of failure. qualifiedName.b.size = sizeof( TPM2B_NAME ) - 2; name->b.size = sizeof( TPM2B_NAME ) - 2; if( handle == ( TPM_HT_NO_HANDLE ) ) { name->b.size = 0; rval = TPM_RC_SUCCESS; } else { switch( handle >> HR_SHIFT ) { case TPM_HT_NV_INDEX: sysContext = InitSysContext( 1000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) return TSS2_APP_RC_INIT_SYS_CONTEXT_FAILED; nvPublic.t.size = 0; rval = Tss2_Sys_NV_ReadPublic( sysContext, handle, 0, &nvPublic, name, 0 ); TeardownSysContext( &sysContext ); break; case TPM_HT_TRANSIENT: case TPM_HT_PERSISTENT: sysContext = InitSysContext( 1000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) return TSS2_APP_RC_INIT_SYS_CONTEXT_FAILED; public.t.size = 0; rval = Tss2_Sys_ReadPublic( sysContext, handle, 0, &public, name, &qualifiedName, 0 ); TeardownSysContext( &sysContext ); break; default: rval = TPM_RC_SUCCESS; name->b.size = sizeof( TPM_HANDLE ); *(TPM_HANDLE *)namePtr = CHANGE_ENDIAN_DWORD( handle ); } } return rval; } tpm2.0-tools-1.1.0/src/TpmHash.c000066400000000000000000000076231300711361400161720ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "sample.h" // // This function does a hash on a string of data. // UINT32 TpmHash( TPMI_ALG_HASH hashAlg, UINT16 size, BYTE *data, TPM2B_DIGEST *result ) { TPM_RC rval; TPM2B_MAX_BUFFER dataSizedBuffer; UINT16 i; TSS2_SYS_CONTEXT *sysContext; dataSizedBuffer.t.size = size; for( i = 0; i < size; i++ ) dataSizedBuffer.t.buffer[i] = data[i]; sysContext = InitSysContext( 3000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) return TSS2_APP_RC_INIT_SYS_CONTEXT_FAILED; rval = Tss2_Sys_Hash ( sysContext, 0, &dataSizedBuffer, hashAlg, TPM_RH_NULL, result, 0, 0); TeardownSysContext( &sysContext ); return rval; } // // This function does a hash on an array of data strings. // UINT32 TpmHashSequence( TPMI_ALG_HASH hashAlg, UINT8 numBuffers, TPM2B_DIGEST *bufferList, TPM2B_DIGEST *result ) { UINT32 rval; TSS2_SYS_CONTEXT *sysContext; TPM2B_AUTH nullAuth; TPMI_DH_OBJECT sequenceHandle; int i; TPM2B emptyBuffer; TPMT_TK_HASHCHECK validation; TPMS_AUTH_COMMAND cmdAuth; TPMS_AUTH_COMMAND *cmdSessionArray[1] = { &cmdAuth }; TSS2_SYS_CMD_AUTHS cmdAuthArray = { 1, &cmdSessionArray[0] }; nullAuth.t.size = 0; emptyBuffer.size = 0; // Set result size to 0, in case any errors occur result->b.size = 0; // Init input sessions struct cmdAuth.sessionHandle = TPM_RS_PW; cmdAuth.nonce.t.size = 0; *( (UINT8 *)((void *)&cmdAuth.sessionAttributes ) ) = 0; cmdAuth.hmac.t.size = 0; sysContext = InitSysContext( 3000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) return TSS2_APP_RC_INIT_SYS_CONTEXT_FAILED; rval = Tss2_Sys_HashSequenceStart( sysContext, 0, &nullAuth, hashAlg, &sequenceHandle, 0 ); if( rval != TPM_RC_SUCCESS ) return( rval ); for( i = 0; i < numBuffers; i++ ) { rval = Tss2_Sys_SequenceUpdate ( sysContext, sequenceHandle, &cmdAuthArray, (TPM2B_MAX_BUFFER *)&bufferList[i], 0 ); if( rval != TPM_RC_SUCCESS ) return( rval ); } result->t.size = sizeof( *result ) - 2; rval = Tss2_Sys_SequenceComplete ( sysContext, sequenceHandle, &cmdAuthArray, ( TPM2B_MAX_BUFFER *)&emptyBuffer, TPM_RH_PLATFORM, result, &validation, 0 ); if( rval != TPM_RC_SUCCESS ) return( rval ); TeardownSysContext( &sysContext ); return rval; } tpm2.0-tools-1.1.0/src/TpmHmac.c000066400000000000000000000102001300711361400161400ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "sample.h" // // This function does an HMAC on a null-terminated list of input buffers. // UINT32 TpmHmac( TPMI_ALG_HASH hashAlg, TPM2B *key, TPM2B **bufferList, TPM2B_DIGEST *result ) { TPM2B_AUTH nullAuth; TPMI_DH_OBJECT sequenceHandle; int i; TPM2B emptyBuffer; TPMT_TK_HASHCHECK validation; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_COMMAND sessionData; TSS2_SYS_CMD_AUTHS sessionsData; TPM2B_AUTH hmac; TPM2B_NONCE nonce; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; UINT32 rval; TPM_HANDLE keyHandle; TPM2B_NAME keyName; TPM2B keyAuth; TSS2_SYS_CONTEXT *sysContext; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; // Set result size to 0, in case any errors occur result->b.size = 0; keyAuth.size = 0; nullAuth.t.size = 0; rval = LoadExternalHMACKey( hashAlg, key, &keyHandle, &keyName ); if( rval != TPM_RC_SUCCESS ) { return( rval ); } // Init input sessions struct sessionData.sessionHandle = TPM_RS_PW; nonce.t.size = 0; sessionData.nonce = nonce; CopySizedByteBuffer( &(hmac.b), &keyAuth ); sessionData.hmac = hmac; *( (UINT8 *)((void *)&( sessionData.sessionAttributes ) ) ) = 0; sessionsData.cmdAuthsCount = 1; sessionsData.cmdAuths = &sessionDataArray[0]; // Init sessions out struct sessionsDataOut.rspAuthsCount = 1; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; emptyBuffer.size = 0; sysContext = InitSysContext( 3000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) return TSS2_APP_ERROR_LEVEL + TPM_RC_FAILURE; rval = Tss2_Sys_HMAC_Start( sysContext, keyHandle, &sessionsData, &nullAuth, hashAlg, &sequenceHandle, 0 ); if( rval != TPM_RC_SUCCESS ) return( rval ); hmac.t.size = 0; sessionData.hmac = hmac; for( i = 0; bufferList[i] != 0; i++ ) { rval = Tss2_Sys_SequenceUpdate ( sysContext, sequenceHandle, &sessionsData, (TPM2B_MAX_BUFFER *)( bufferList[i] ), &sessionsDataOut ); if( rval != TPM_RC_SUCCESS ) return( rval ); } result->t.size = sizeof( TPM2B_DIGEST ) - 2; rval = Tss2_Sys_SequenceComplete ( sysContext, sequenceHandle, &sessionsData, ( TPM2B_MAX_BUFFER *)&emptyBuffer, TPM_RH_PLATFORM, result, &validation, &sessionsDataOut ); if( rval != TPM_RC_SUCCESS ) return( rval ); rval = Tss2_Sys_FlushContext( sysContext, keyHandle ); TeardownSysContext( &sysContext ); return rval; } tpm2.0-tools-1.1.0/src/changeEndian.c000066400000000000000000000045721300711361400171720ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include UINT64 ChangeEndianQword( UINT64 p ) { return( ((const UINT64)(((p)& 0xFF) << 56)) | \ ((const UINT64)(((p)& 0xFF00) << 40)) | \ ((const UINT64)(((p)& 0xFF0000) << 24)) | \ ((const UINT64)(((p)& 0xFF000000) << 8)) | \ ((const UINT64)(((p)& 0xFF00000000) >> 8)) | \ ((const UINT64)(((p)& 0xFF0000000000) >> 24)) | \ ((const UINT64)(((p)& 0xFF000000000000) >> 40)) | \ ((const UINT64)(((p)& 0xFF00000000000000) >> 56)) ); } UINT32 ChangeEndianDword( UINT32 p ) { return( ((const UINT32)(((p)& 0xFF) << 24)) | \ ((const UINT32)(((p)& 0xFF00) << 8)) | \ ((const UINT32)(((p)& 0xFF0000) >> 8)) | \ ((const UINT32)(((p)& 0xFF000000) >> 24))); } UINT16 ChangeEndianWord( UINT16 p ) { return( ((const UINT16)(((p)& 0xFF) << 8)) | ((const UINT16)(((p)& 0xFF00) >> 8))); } tpm2.0-tools-1.1.0/src/changeEndian.h000066400000000000000000000045151300711361400171740ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #ifndef ENDIANCONV_H #define ENDIANCONV_H #ifndef TSS2_API_VERSION_1_1_1_1 #error Version mismatch among TSS2 header files ! #endif /* TSS2_API_VERSION_1_1_1_1 */ #ifdef __cplusplus extern "C" { #endif // // Comment out following line for big endian CPUs. // #define LITTLE_ENDIAN_CPU #ifdef LITTLE_ENDIAN_CPU UINT64 ChangeEndianQword( UINT64 p ); UINT32 ChangeEndianDword( UINT32 p ); UINT16 ChangeEndianWord( UINT16 p ); // CPU is little endian, so bytes need to be swapped. #define CHANGE_ENDIAN_WORD(p) ( ChangeEndianWord (p) ) #define CHANGE_ENDIAN_DWORD(p) ( ChangeEndianDword(p) ) #define CHANGE_ENDIAN_QWORD(p) ( ChangeEndianQword(p) ) #else // If CPU is big-endian, no need to do endianness swapping. #define CHANGE_ENDIAN_WORD(p) p #define CHANGE_ENDIAN_DWORD(p) p #define CHANGE_ENDIAN_QWORD(p) p #endif #ifdef __cplusplus } #endif #endif tpm2.0-tools-1.1.0/src/common.c000066400000000000000000000416401300711361400161130ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include "sample.h" #include #include "syscontext.h" #include "debug.h" #include "common.h" #define errorStringSize 200 char errorString[errorStringSize]; TSS2_TCTI_CONTEXT *resMgrTctiContext = 0; TSS2_ABI_VERSION abiVersion = { TSSWG_INTEROP, TSS_SAPI_FIRST_FAMILY, TSS_SAPI_FIRST_LEVEL, TSS_SAPI_FIRST_VERSION }; UINT32 ( *ComputeSessionHmacPtr )( TSS2_SYS_CONTEXT *sysContext, TPMS_AUTH_COMMAND *cmdAuth, // Pointer to session input struct TPM_HANDLE entityHandle, // Used to determine if we're accessing a different // resource than the bound resoure. TPM_RC responseCode, // Response code for the command, 0xffff for "none" is // used to indicate that no response code is present // (used for calculating command HMACs vs response HMACs). TPM_HANDLE handle1, // First handle == 0xff000000 indicates no handle TPM_HANDLE handle2, // Second handle == 0xff000000 indicates no handle TPMA_SESSION sessionAttributes, // Current session attributes TPM2B_DIGEST *result, // Where the result hash is saved. TPM_RC sessionCmdRval ) = TpmComputeSessionHmac; TPM_RC ( *GetSessionAlgIdPtr )( TPMI_SH_AUTH_SESSION authHandle, TPMI_ALG_HASH *sessionAlgId ) = GetSessionAlgId; TPM_RC ( *CalcPHash )( TSS2_SYS_CONTEXT *sysContext,TPM_HANDLE handle1, TPM_HANDLE handle2, TPMI_ALG_HASH authHash, TPM_RC responseCode, TPM2B_DIGEST *pHash ) = TpmCalcPHash; UINT32 (*HmacFunctionPtr)( TPM_ALG_ID hashAlg, TPM2B *key,TPM2B **bufferList, TPM2B_DIGEST *result ) = TpmHmac; UINT32 (*HashFunctionPtr)( TPMI_ALG_HASH hashAlg, UINT16 size, BYTE *data, TPM2B_DIGEST *result ) = TpmHash; UINT32 (*HandleToNameFunctionPtr)( TPM_HANDLE handle, TPM2B_NAME *name ) = TpmHandleToName; FILE *outFp; UINT8 simulator = 1; TSS2_SYS_CONTEXT *sysContext; #if 1 int TpmClientPrintf( UINT8 type, const char *format, ...) { return 0; } #else int TpmClientPrintf( UINT8 type, const char *format, ...) { va_list args; int rval = 0; OpenOutFile( &outFp ); if( outFp ) { if( type == RM_PREFIX ) { PrintRMDebugPrefix(); } va_start( args, format ); rval = vfprintf( outFp, format, args ); va_end (args); CloseOutFile( &outFp ); } else { printf( "TpmClientPrintf failed\n" ); } return rval; } #endif int CompareTPM2B( TPM2B *buffer1, TPM2B *buffer2 ) { int i; if( buffer1->size != buffer2->size ) return -1; for( i = 0; i < buffer1->size; i++ ) { if( buffer1->buffer[0] != buffer2->buffer[0] ) return -2; } return 0; } void PrintSizedBuffer( TPM2B *sizedBuffer ) { int i; for( i = 0; i < sizedBuffer->size; i++ ) { printf( "%2.2x ", sizedBuffer->buffer[i] ); if( ( (i+1) % 16 ) == 0 ) { printf( "\n" ); } } printf( "\n" ); } #define LEVEL_STRING_SIZE 50 void ErrorHandler( UINT32 rval ) { UINT32 errorLevel = rval & TSS2_ERROR_LEVEL_MASK; char levelString[LEVEL_STRING_SIZE + 1]; switch( errorLevel ) { case TSS2_TPM_ERROR_LEVEL: strncpy( levelString, "TPM", LEVEL_STRING_SIZE ); break; case TSS2_APP_ERROR_LEVEL: strncpy( levelString, "Application", LEVEL_STRING_SIZE ); break; case TSS2_SYS_ERROR_LEVEL: strncpy( levelString, "System API", LEVEL_STRING_SIZE ); break; case TSS2_SYS_PART2_ERROR_LEVEL: strncpy( levelString, "System API TPM encoded", LEVEL_STRING_SIZE ); break; case TSS2_TCTI_ERROR_LEVEL: strncpy( levelString, "TCTI", LEVEL_STRING_SIZE ); break; case TSS2_RESMGRTPM_ERROR_LEVEL: strncpy( levelString, "Resource Mgr TPM encoded", LEVEL_STRING_SIZE ); break; case TSS2_RESMGR_ERROR_LEVEL: strncpy( levelString, "Resource Mgr", LEVEL_STRING_SIZE ); break; case TSS2_DRIVER_ERROR_LEVEL: strncpy( levelString, "Driver", LEVEL_STRING_SIZE ); break; default: strncpy( levelString, "Unknown Level", LEVEL_STRING_SIZE ); break; } snprintf( errorString, errorStringSize, "%s Error: 0x%x\n", levelString, rval ); } char resMgrInterfaceName[] = "Resource Manager"; TSS2_RC InitTctiResMgrContext( TCTI_SOCKET_CONF *rmInterfaceConfig, TSS2_TCTI_CONTEXT **tctiContext, char *name ) { size_t size; TSS2_RC rval; rval = InitSocketTcti(NULL, &size, rmInterfaceConfig, 0 ); if( rval != TSS2_RC_SUCCESS ) return rval; *tctiContext = (TSS2_TCTI_CONTEXT *)malloc(size); if( *tctiContext ) { rval = InitSocketTcti(*tctiContext, &size, rmInterfaceConfig, 0 ); } else { rval = TSS2_TCTI_RC_BAD_CONTEXT; } return rval; } void TeardownTctiResMgrContext( TSS2_TCTI_CONTEXT *tctiContext ) { tss2_tcti_finalize (tctiContext); free (tctiContext); } void Cleanup() { fflush( stdout ); PlatformCommand( resMgrTctiContext, MS_SIM_POWER_OFF ); TeardownTctiResMgrContext( resMgrTctiContext ); exit(1); } void InitSysContextFailure() { printf( "InitSysContext failed, exiting...\n" ); Cleanup(); } TCTI_SOCKET_CONF rmInterfaceConfig = { DEFAULT_HOSTNAME, DEFAULT_RESMGR_TPM_PORT }; int prepareTest(const char *hostName, const int port, int debugLevel) { TSS2_RC rval; rmInterfaceConfig.hostname = hostName; rmInterfaceConfig.port = port; rval = InitTctiResMgrContext( &rmInterfaceConfig, &resMgrTctiContext, &resMgrInterfaceName[0] ); if( rval != TSS2_RC_SUCCESS ) { printf( "Resource Mgr, %s, failed initialization: 0x%x. Exiting...\n", "resMgr", rval ); Cleanup(); } sysContext = InitSysContext( 0, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) { InitSysContextFailure(); } // always send simulator platform command to RM, // will be igorened if RM not on simulator PlatformCommand( resMgrTctiContext ,MS_SIM_POWER_ON ); PlatformCommand( resMgrTctiContext, MS_SIM_NV_ON ); return 0; } void finishTest() { TeardownTctiResMgrContext( resMgrTctiContext ); TeardownSysContext( &sysContext ); } int getSizeUint16Hex(const char *arg, UINT16 *num) { char tmpArg[1024] = {0}; char *errPtr; long tmpSize = 0; if (arg == NULL || num == NULL) return -1; safeStrNCpy(tmpArg, arg, sizeof(tmpArg)); tmpSize = strtol(tmpArg,&errPtr,16); if(strlen(errPtr) != 0) return -2; if( tmpSize > 0xffff || tmpSize < 0) return -3; *num = tmpSize; return 0; } int getSizeUint16(const char *arg, UINT16 *num) { char tmpArg[1024] = {0}; char *errPtr; long tmpSize = 0; if (arg == NULL || num == NULL) return -1; safeStrNCpy(tmpArg, arg, sizeof(tmpArg)); tmpSize = strtol(tmpArg,&errPtr,10); if(strlen(errPtr) != 0) return -2; if( tmpSize > 0xffff || tmpSize < 0) return -3; *num = tmpSize; return 0; } int getSizeUint32Hex(const char *arg, UINT32 *num) { char tmpArg[1024] = {0}; char *errPtr; long long tmpSize = 0; if (arg == NULL || num == NULL) return -1; safeStrNCpy(tmpArg, arg, sizeof(tmpArg)); tmpSize = strtoll(tmpArg,&errPtr,16); if(strlen(errPtr) != 0) return -2; if(tmpSize > 0xffffffff || tmpSize < 0) return -3; *num = tmpSize; return 0; } int getSizeUint32(const char *arg, UINT32 *num) { char tmpArg[1024] = {0}; char *errPtr; long tmpSize = 0; if (arg == NULL || num == NULL) return -1; safeStrNCpy(tmpArg, arg, sizeof(tmpArg)); tmpSize = strtol(tmpArg,&errPtr,10); if(strlen(errPtr) != 0) return -2; if(tmpSize > 0xffffffff || tmpSize < 0) return -3; *num = tmpSize; return 0; } int str2ByteStructure(const char *inStr, UINT16 *byteLength, BYTE *byteBuffer) { if(inStr == NULL || byteLength == NULL || byteBuffer == NULL) return -1; if(*byteLength <= strlen(inStr)) return -2; *byteLength = strlen(inStr); memcpy(byteBuffer, inStr, *byteLength); byteBuffer[*byteLength] = '\0'; return 0; } int hex2ByteStructure(const char *inStr, UINT16 *byteLength, BYTE *byteBuffer) { int strLength;//if the inStr likes "1a2b...", no prefix "0x" int i = 0; if(inStr == NULL || byteLength == NULL || byteBuffer == NULL) return -1; strLength = strlen(inStr); if(strLength%2) return -2; for(i = 0; i < strLength; i++) { if(!isxdigit(inStr[i])) return -3; } if(*byteLength < strLength/2) return -4; *byteLength = strLength/2; for(i = 0; i < *byteLength; i++) { char tmpStr[3] = {0}; tmpStr[0] = inStr[i*2]; tmpStr[1] = inStr[i*2+1]; byteBuffer[i] = strtol(tmpStr, NULL, 16); } return 0; } int loadDataFromFile(const char *fileName, UINT8 *buf, UINT16 *size) { UINT16 count = 1, left; FILE *f; if ( size == NULL || buf == NULL || fileName == NULL ) return -1; f = fopen(fileName, "rb+"); if( f == NULL ) { printf("File(%s) open error.\n", fileName); return -2; } left = *size; *size = 0; while( left > 0 && count > 0 ) { count = fread(buf, 1, left, f); *size += count; left -= count; buf += count; } if( *size == 0 ) { printf("File read error\n"); fclose(f); return -3; } fclose(f); return 0; } int saveDataToFile(const char *fileName, UINT8 *buf, UINT16 size) { FILE *f; UINT16 count = 1; if( fileName == NULL || buf == NULL || size == 0 ) return -1; f = fopen(fileName, "wb+"); if( f == NULL ) { printf("File(%s) open error.\n", fileName); return -2; } while( size > 0 && count > 0 ) { count = fwrite(buf, 1, size, f); size -= count; buf += count; } if( size > 0 ) { printf("File write error\n"); fclose(f); return -3; } fclose(f); return 0; } static TPMS_CONTEXT context; int saveTpmContextToFile(TSS2_SYS_CONTEXT *sysContext, TPM_HANDLE handle, const char *fileName) { TPM_RC rval; rval = Tss2_Sys_ContextSave( sysContext, handle, &context); if( rval == TPM_RC_SUCCESS && saveDataToFile(fileName, (UINT8 *)&context, sizeof(TPMS_CONTEXT)) ) rval = TPM_RC_FAILURE; if( rval != TPM_RC_SUCCESS ) { printf("\n......ContextSave:Save handle 0x%x context failed. TPM Error:0x%x......\n", handle, rval); return -1; } return 0; } int loadTpmContextFromFile(TSS2_SYS_CONTEXT *sysContext, TPM_HANDLE *handle, const char *fileName) { TPM_RC rval = TPM_RC_SUCCESS; UINT16 size = sizeof(TPMS_CONTEXT); if( loadDataFromFile(fileName, (UINT8 *)&context, &size) ) rval = TPM_RC_FAILURE; if( rval == TPM_RC_SUCCESS ) rval = Tss2_Sys_ContextLoad(sysContext, &context, handle); if( rval != TPM_RC_SUCCESS ) { printf("\n......ContextLoad Error. TPM Error:0x%x......\n", rval); return -1; } return 0; } // // This function does a hash on an array of data strings. // static TPM_RC TpmHashSequenceEx( TPMI_ALG_HASH hashAlg, UINT32 numBuffers, TPM2B_MAX_BUFFER *bufferList, TPM2B_DIGEST *result ) { TPM_RC rval; TSS2_SYS_CONTEXT *sysContext; TPM2B_AUTH nullAuth; TPMI_DH_OBJECT sequenceHandle; int i; TPM2B emptyBuffer; TPMT_TK_HASHCHECK validation; TPMS_AUTH_COMMAND cmdAuth; TPMS_AUTH_COMMAND *cmdSessionArray[1] = { &cmdAuth }; TSS2_SYS_CMD_AUTHS cmdAuthArray = { 1, &cmdSessionArray[0] }; nullAuth.t.size = 0; emptyBuffer.size = 0; // Set result size to 0, in case any errors occur result->b.size = 0; // Init input sessions struct cmdAuth.sessionHandle = TPM_RS_PW; cmdAuth.nonce.t.size = 0; *( (UINT8 *)((void *)&cmdAuth.sessionAttributes ) ) = 0; cmdAuth.hmac.t.size = 0; sysContext = InitSysContext( 3000, resMgrTctiContext, &abiVersion ); if( sysContext == 0 ) return TSS2_APP_RC_INIT_SYS_CONTEXT_FAILED; rval = Tss2_Sys_HashSequenceStart( sysContext, 0, &nullAuth, hashAlg, &sequenceHandle, 0 ); if( rval != TPM_RC_SUCCESS ) return( rval ); for( i = 0; i < numBuffers; i++ ) { rval = Tss2_Sys_SequenceUpdate ( sysContext, sequenceHandle, &cmdAuthArray, &bufferList[i], 0 ); if( rval != TPM_RC_SUCCESS ) return( rval ); } rval = Tss2_Sys_SequenceComplete ( sysContext, sequenceHandle, &cmdAuthArray, ( TPM2B_MAX_BUFFER *)&emptyBuffer, TPM_RH_PLATFORM, result, &validation, 0 ); if( rval != TPM_RC_SUCCESS ) return( rval ); TeardownSysContext( &sysContext ); return rval; } int computeDataHash(BYTE *buffer, UINT16 length, TPMI_ALG_HASH halg, TPM2B_DIGEST *result) { UINT8 numBuffers = 0; UINT32 i; if(length <= MAX_DIGEST_BUFFER) { if( TpmHash(halg, length, buffer, result) == TPM_RC_SUCCESS) return 0; else return -1; } numBuffers = (length - 1) / MAX_DIGEST_BUFFER + 1; TPM2B_MAX_BUFFER *bufferList = (TPM2B_MAX_BUFFER *)calloc(numBuffers, sizeof(TPM2B_MAX_BUFFER)); if(bufferList == NULL) return -2; for(i = 0; i < numBuffers - 1; i++) { bufferList[i].t.size = MAX_DIGEST_BUFFER; memcpy(bufferList[i].t.buffer, buffer + i * MAX_DIGEST_BUFFER, MAX_DIGEST_BUFFER); } bufferList[i].t.size = length - i * MAX_DIGEST_BUFFER; memcpy(bufferList[i].t.buffer, buffer + i * MAX_DIGEST_BUFFER, bufferList[i].t.size); TPM_RC rval = TpmHashSequenceEx(halg, numBuffers, bufferList, result); free(bufferList); return rval == TPM_RC_SUCCESS ? 0 : -3; } int checkOutFile(const char *path) { FILE *fp = fopen(path,"rb"); if(NULL != fp) { fclose(fp); printf("OutFile: %s Already Exist, Please Rename OR Delete It!\n",path); return -1; } return 0; } int getFileSize(const char *path, long *fileSize) { FILE *fp = fopen(path,"rb"); if(NULL == fp) { printf("File: %s Not Found OR Access Error !\n",path); return -1; } fseek(fp, 0, SEEK_SET); fseek(fp, 0, SEEK_END); *fileSize = ftell(fp); fclose(fp); return 0; } int getPcrId(const char *arg, UINT32 *pcrId) { UINT32 n = 0; if(arg == NULL || pcrId == NULL) return -1; if(getSizeUint32(arg, &n)) return -2; if(n > 23) return -3; *pcrId = n; return 0; } int getPort(const char *arg, int *port) { UINT16 n = 0; if(arg == NULL || port == NULL) return -1; if(getSizeUint16(arg, &n)) return -2; if(n < 1 || n > 65534) return -3; *port = n; return 0; } int getDebugLevel(const char *arg, int *dl) { UINT16 n = 0; if(arg == NULL || dl == NULL) return -1; if(getSizeUint16(arg, &n)) return -2; if(n > 3) return -3; *dl = n; return 0; } tpm2.0-tools-1.1.0/src/common.h000066400000000000000000000074201300711361400161160ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #ifndef COMMON_H #define COMMON_H #ifdef __cplusplus extern "C" { #endif extern TSS2_SYS_CONTEXT *sysContext; void copyData( UINT8 *to, UINT8 *from, UINT32 length ); int TpmClientPrintf( UINT8 type, const char *format, ...); int CompareTPM2B( TPM2B *buffer1, TPM2B *buffer2 ); void PrintSizedBufferOpen( TPM2B *sizedBuffer ); void PrintSizedBuffer( TPM2B *sizedBuffer ); void ErrorHandler( UINT32 rval ); int prepareTest(const char *hostName, const int port, int debugLevel); void finishTest(); int getSizeUint16(const char *arg, UINT16 *num); int getSizeUint16Hex(const char *arg, UINT16 *num); int getSizeUint32(const char *arg, UINT32 *num); int getSizeUint32Hex(const char *arg, UINT32 *num); int getPcrId(const char *arg, UINT32 *num); int str2ByteStructure(const char *inStr, UINT16 *byteLenth, BYTE *byteBuffer); int hex2ByteStructure(const char *inStr, UINT16 *byteLenth, BYTE *byteBuffer); int saveDataToFile(const char *fileName, UINT8 *buf, UINT16 size); int loadDataFromFile(const char *fileName, UINT8 *buf, UINT16 *size); int saveTpmContextToFile(TSS2_SYS_CONTEXT *sysContext, TPM_HANDLE handle, const char *fileName); int loadTpmContextFromFile(TSS2_SYS_CONTEXT *sysContext, TPM_HANDLE *handle, const char *fileName); int computeDataHash(BYTE *buffer, UINT16 length, TPMI_ALG_HASH halg, TPM2B_DIGEST *result); int checkOutFile(const char *path); int getFileSize(const char *path, long *fileSize); int getPort(const char *arg, int *port); int getDebugLevel(const char *arg, int *dl); inline void showArgError(const char *arg, const char *name) { printf("Argument error: %s\n",arg); printf("Please type \"%s -h\" get the usage!\n", name); } inline void showArgMismatch(const char *name) { printf("Argument mismatched!\n"); printf("Please type \"%s -h\" get the usage!\n", name); } inline void showVersion(const char *name) { printf("%s, version %s\n", name, VERSION); } inline char *safeStrNCpy(char *dest, const char *src, size_t n) { if(strlen(src) > 0) { strncpy(dest, src, n - 1); dest[n - 1] = '\0'; } return dest; } #ifdef __cplusplus } #endif #endif // COMMON_H tpm2.0-tools-1.1.0/src/debug.c000066400000000000000000000072331300711361400157110ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include // Needed for _wtoi #include #include #include "debug.h" UINT8 rmDebugPrefix = 0; void DebugPrintBuffer( UINT8 *buffer, UINT32 length ) { UINT32 i; for( i = 0; i < length; i++ ) { if( ( i % 16 ) == 0 ) { (*printfFunction)(NO_PREFIX, "\n"); PrintRMDebugPrefix(); } (*printfFunction)(NO_PREFIX, "%2.2x ", buffer[i] ); } (*printfFunction)(NO_PREFIX, "\n\n" ); fflush( stdout ); } void DebugPrintBufferOpen( UINT8 *buffer, UINT32 length ) { UINT32 i; OpenOutFile( &outFp ); if( outFp != 0 ) { for( i = 0; i < length; i++ ) { if( ( i % 16 ) == 0 ) { (*printfFunction)(NO_PREFIX, "\n"); PrintRMDebugPrefix(); } (*printfFunction)(NO_PREFIX, "%2.2x ", buffer[i] ); } (*printfFunction)(NO_PREFIX, "\n\n" ); fflush( stdout ); } CloseOutFile( &outFp ); } #ifdef SHARED_OUT_FILE static int openCnt = 0; void OpenOutFile( FILE **outFp ) { if( *outFp == 0 ) { if( 0 == strcmp( outFileName, "" ) ) { *outFp = stdout; } else { if( openCnt == 0 ) { do { *outFp = fopen( &outFileName[0], "a+" ); } while( *outFp == 0 ); } openCnt++; } } else { if( ( *outFp != stdout ) && ( openCnt < 0xff ) ) openCnt++; } } void CloseOutFile( FILE **outFp ) { if( 0 != strcmp( outFileName, "" ) ) { if( *outFp != 0 ) { if( openCnt == 1 && *outFp != stdout ) { fclose( *outFp ); *outFp = 0; } if( openCnt > 0 ) openCnt--; } } } #else void OpenOutFile( FILE **outFilePtr ) { *outFilePtr = stdout; } void CloseOutFile( FILE **outFilePtr ) { } #endif void PrintRMDebugPrefix() { if( rmDebugPrefix ) (*printfFunction)(NO_PREFIX, "|| " ); } tpm2.0-tools-1.1.0/src/debug.h000066400000000000000000000041531300711361400157140ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #ifndef DEBUG_H #define DEBUG_H #ifdef __cplusplus extern "C" { #endif enum debugLevel { DBG_NO_COMMAND = 0, DBG_COMMAND = 1, DBG_COMMAND_RM = 2, DBG_COMMAND_RM_TABLES = 3 }; void PrintRMDebugPrefix(); void DebugPrintBuffer( UINT8 *command_buffer, UINT32 cnt1 ); void DebugPrintBufferOpen( UINT8 *buffer, UINT32 length ); void OpenOutFile( FILE **outFp ); void CloseOutFile( FILE **outFp ); extern FILE *outFp; extern UINT8 rmDebugPrefix; #ifdef DEBUG #define DEBUG_PRINT_BUFFER( buffer, length ) DebugPrintBufferOpen( buffer, length ) #else #define DEBUG_PRINT_BUFFER( buffer, length ) #endif #ifdef __cplusplus } #endif #endif tpm2.0-tools-1.1.0/src/kdfa.c000066400000000000000000000104031300711361400155210ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include "sample.h" #include #include #include "changeEndian.h" // // TPM_RC KDFa( TPMI_ALG_HASH hashAlg, TPM2B *key, char *label, TPM2B *contextU, TPM2B *contextV, UINT16 bits, TPM2B_MAX_BUFFER *resultKey ) { TPM2B_DIGEST tmpResult; TPM2B_DIGEST tpm2bLabel, tpm2bBits, tpm2b_i_2; UINT8 *tpm2bBitsPtr = &tpm2bBits.t.buffer[0]; UINT8 *tpm2b_i_2Ptr = &tpm2b_i_2.t.buffer[0]; TPM2B_DIGEST *bufferList[8]; UINT32 bitsSwizzled, i_Swizzled; TPM_RC rval; int i, j; UINT16 bytes = bits / 8; #ifdef DEBUG OpenOutFile( &outFp ); TpmClientPrintf( 0, "KDFA, hashAlg = %4.4x\n", hashAlg ); TpmClientPrintf( 0, "\n\nKDFA, key = \n" ); PrintSizedBuffer( key ); CloseOutFile( &outFp ); #endif resultKey->t .size = 0; tpm2b_i_2.t.size = 4; tpm2bBits.t.size = 4; bitsSwizzled = CHANGE_ENDIAN_DWORD( bits ); *(UINT32 *)tpm2bBitsPtr = bitsSwizzled; for(i = 0; label[i] != 0 ;i++ ); tpm2bLabel.t.size = i+1; for( i = 0; i < tpm2bLabel.t.size; i++ ) { tpm2bLabel.t.buffer[i] = label[i]; } #ifdef DEBUG OpenOutFile( &outFp ); TpmClientPrintf( 0, "\n\nKDFA, tpm2bLabel = \n" ); PrintSizedBuffer( (TPM2B *)&tpm2bLabel ); TpmClientPrintf( 0, "\n\nKDFA, contextU = \n" ); PrintSizedBuffer( contextU ); TpmClientPrintf( 0, "\n\nKDFA, contextV = \n" ); PrintSizedBuffer( contextV ); CloseOutFile( &outFp ); #endif resultKey->t.size = 0; i = 1; while( resultKey->t.size < bytes ) { // Inner loop i_Swizzled = CHANGE_ENDIAN_DWORD( i ); *(UINT32 *)tpm2b_i_2Ptr = i_Swizzled; j = 0; bufferList[j++] = (TPM2B_DIGEST *)&(tpm2b_i_2.b); bufferList[j++] = (TPM2B_DIGEST *)&(tpm2bLabel.b); bufferList[j++] = (TPM2B_DIGEST *)contextU; bufferList[j++] = (TPM2B_DIGEST *)contextV; bufferList[j++] = (TPM2B_DIGEST *)&(tpm2bBits.b); bufferList[j++] = (TPM2B_DIGEST *)0; #ifdef DEBUG OpenOutFile( &outFp ); for( j = 0; bufferList[j] != 0; j++ ) { TpmClientPrintf( 0, "\n\nbufferlist[%d]:\n", j ); PrintSizedBuffer( &( bufferList[j]->b ) ); } CloseOutFile( &outFp ); #endif rval = (*HmacFunctionPtr )( hashAlg, key, (TPM2B **)&( bufferList[0] ), &tmpResult ); if( rval != TPM_RC_SUCCESS ) { return( rval ); } ConcatSizedByteBuffer( resultKey, &(tmpResult.b) ); } // Truncate the result to the desired size. resultKey->t.size = bytes; #ifdef DEBUG OpenOutFile( &outFp ); TpmClientPrintf( 0, "\n\nKDFA, resultKey = \n" ); PrintSizedBuffer( &( resultKey->b ) ); CloseOutFile( &outFp ); #endif return TPM_RC_SUCCESS; } tpm2.0-tools-1.1.0/src/rc-decode.c000066400000000000000000000756551300711361400164650ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2016, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include "rc-decode.h" /* Array of RC_VER1 error codes from TPM 2.0, Part 2, Table 17 * The error code is in the lower 7 bits [06:00] but the identifiers are * defined as RC_VER1 + 0xXXX. When looking up values you must include bit * 8 in the comparison or mask out bit 8. */ struct tpm2_rc_entry tpm2_ver1_entry [] = { { /* 0x000 */ .id = TPM_RC_INITIALIZE, .name = "TPM_RC_INITIALIZE", .description = "TPM not initialized", }, { /* 0x001 */ .id = TPM_RC_FAILURE, .name = "TPM_RC_FAILURE", .description = "commands not being accepted because of a TPM failure", }, { /* 0x003 */ .id = TPM_RC_SEQUENCE, .name = "TPM_RC_SEQUENCE", .description = "improper use of a sequence handle", }, { /* 0x00B */ .id = TPM_RC_PRIVATE, .name = "TPM_RC_PRIVATE", .description = NULL, }, { /* 0x019 */ .id = TPM_RC_HMAC, .name = "TPM_RC_HMAC", .description = NULL, }, { /* 0x020 */ .id = TPM_RC_DISABLED, .name = "TPM_RC_DISABLED", .description = NULL, }, { /* 0x021 */ .id = TPM_RC_EXCLUSIVE, .name = "TPM_RC_EXCLUSIVE", .description = "command failed because audit sequence required exclusivity", }, { /* 0x024 */ .id = TPM_RC_AUTH_TYPE, .name = "TPM_RC_AUTH_TYPE", .description = "authorization handle is not correct for command", }, { /* 0x025 */ .id = TPM_RC_AUTH_MISSING, .name = "TPM_RC_AUTH_MISSING", .description = "command requires an authorization session for handle and it is not present.", }, { /* 0x026 */ .id = TPM_RC_POLICY, .name = "TPM_RC_POLICY", .description = "policy Failure In Math Operation or an invalid authPolicy value", }, { /* 0x027 */ .id = TPM_RC_PCR, .name = "TPM_RC_PCR", .description = "PCR check fail", }, { /* 0x028 */ .id = TPM_RC_PCR_CHANGED, .name = "TPM_RC_PCR_CHANGED", .description = "PCR have changed since checked.", }, { /* 0x02D */ .id = TPM_RC_UPGRADE, .name = "TPM_RC_UPGRADE", .description = "for all commands other than TPM2_FieldUpgradeData(), this code indicates that the TPM is in field upgrade mode; for TPM2_FieldUpgradeData(), this code indicates that the TPM is not in field upgrade mode", }, { /* 0x02E */ .id = TPM_RC_TOO_MANY_CONTEXTS, .name = "TPM_RC_TOO_MANY_CONTEXTS", .description = "context ID counter is at maximum.", }, { /* 0x02F */ .id = TPM_RC_AUTH_UNAVAILABLE, .name = "TPM_RC_AUTH_UNAVAILABLE", .description = "authValue or authPolicy is not available for selected entity.", }, { /* 0x030 */ .id = TPM_RC_REBOOT, .name = "TPM_RC_REBOOT", .description = "a _TPM_Init and Startup(CLEAR) is required before the TPM can resume operation.", }, { /* 0x0x031 */ .id = TPM_RC_UNBALANCED, .name = "TPM_RC_UNBALANCED", .description = "the protection algorithms (hash and symmetric) are not reasonably balanced. The digest size of the hash must be larger than the key size of the symmetric algorithm.", }, { /* 0x042 */ .id = TPM_RC_COMMAND_SIZE, .name = "TPM_RC_COMMAND_SIZE", .description = "command commandSize value is inconsistent with contents of the command buffer; either the size is not the same as the octets loaded by the hardware interface layer or the value is not large enough to hold a command header", }, { /* 0x043 */ .id = TPM_RC_COMMAND_CODE, .name = "TPM_RC_COMMAND_CODE", .description = "command code not supported", }, { /* 0x044 */ .id = TPM_RC_AUTHSIZE, .name = "TPM_RC_AUTHSIZE", .description = "the value of authorizationSize is out of range or the number of octets in the Authorization Area is greater than required", }, { /* 0x045 */ .id = TPM_RC_AUTH_CONTEXT, .name = "TPM_RC_AUTH_CONTEXT", .description = "use of an authorization session with a context command or another command that cannot have an authorization session.", }, { /* 0x046 */ .id = TPM_RC_NV_RANGE, .name = "TPM_RC_NV_RANGE", .description = "NV offset+size is out of range.", }, { /* 0x047 */ .id = TPM_RC_NV_SIZE, .name = "TPM_RC_NV_SIZE", .description = "Requested allocation size is larger than allowed.", }, { /* 0x048 */ .id = TPM_RC_NV_LOCKED, .name = "TPM_RC_NV_LOCKED", .description = "NV access locked.", }, { /* 0x049 */ .id = TPM_RC_NV_AUTHORIZATION, .name = "TPM_RC_NV_AUTHORIZATION", .description = "NV access authorization fails in command actions (this failure does not affect lockout.action)", }, { /* 0x04A */ .id = TPM_RC_NV_UNINITIALIZED, .name = "TPM_RC_NV_UNINITIALIZED", .description = "an NV Index is used before being initialized or the state saved by TPM2_Shutdown(STATE) could not be restored", }, { /* 0x04B */ .id = TPM_RC_NV_SPACE, .name = "TPM_RC_NV_SPACE", .description = "insufficient space for NV allocation", }, { /* 0x04C */ .id = TPM_RC_NV_DEFINED, .name = "TPM_RC_NV_DEFINED", .description = "NV Index or persistend object already defined", }, { /* 0x050 */ .id = TPM_RC_BAD_CONTEXT, .name = "TPM_RC_BAD_CONTEXT", .description = "context in TPM2_ContextLoad() is not valid", }, { /* 0x051 */ .id = TPM_RC_CPHASH, .name = "TPM_RC_CPHASH", .description = "cpHash value already set or not correct for use", }, { /* 0x052 */ .id = TPM_RC_PARENT, .name = "TPM_RC_PARENT", .description = "handle for parent is not a valid parent", }, { /* 0x053 */ .id = TPM_RC_NEEDS_TEST, .name = "TPM_RC_NEEDS_TEST", .description = "some function needs testing.", }, { /* 0x054 */ .id = TPM_RC_NO_RESULT, .name = "TPM_RC_NO_RESULT", .description = "returned when an internal function cannot process a request due to an unspecified problem. This code is usually related to invalid parameters that are not properly filtered by the input unmarshaling code.", }, { /* 0x055 */ .id = TPM_RC_SENSITIVE, .name = "TPM_RC_SENSITIVE", .description = "the sensitive area did not unmarshal correctly after decryption – this code is used in lieu of the other unmarshaling errors so that an attacker cannot determine where the unmarshaling error occurred", }, { /* 0x07F */ .id = RC_MAX_FM0, .name = "RC_MAX_FM0", .description = "largest version 1 code that is not a warning", } }; /* Array of RC_FMT1 error codes from TPM 2.0, Part 2, Table 17 * The error code is in the lower 6 bits [05:00] but the identifiers are * defined as RC_FMT1 + 0xXXX. When looking up values you must include bit * 7 in the comparison or mask it out. */ struct tpm2_rc_entry tpm2_fmt1_entry [] = { { /* 0x001 */ .id = TPM_RC_ASYMMETRIC, .name = "TPM_RC_ASYMMETRIC", .description = "asymmetric algorithm not supported or not correct", }, { /* 0x002 */ .id = TPM_RC_ATTRIBUTES, .name = "TPM_RC_ATTRIBUTES", .description = "inconsistent attributes", }, { /* 0x003 */ .id = TPM_RC_HASH, .name = "TPM_RC_HASH", .description = "hash algorithm not supported or not appropriate", }, { /* 0x004 */ .id = TPM_RC_VALUE, .name = "TPM_RC_VALUE", .description = "value is out of range or is not correct for the context", }, { /* 0x005 */ .id = TPM_RC_HIERARCHY, .name = "TPM_RC_HIERARCHY", .description = "hierarchy is not enabled or is not correct for the use", }, { /* 0x007 */ .id = TPM_RC_KEY_SIZE, .name = "TPM_RC_KEY_SIZE", .description = "key size is not supported", }, { /* 0x008 */ .id = TPM_RC_MGF, .name = "TPM_RC_MGF", .description = "mask generation function not supported", }, { /* 0x009 */ .id = TPM_RC_MODE, .name = "TPM_RC_MODE", .description = "mode of operation not supported", }, { /* 0x00A */ .id = TPM_RC_TYPE, .name = "TPM_RC_TYPE", .description = "the type of the value is not appropriate for the use", }, { /* 0x00B */ .id = TPM_RC_HANDLE, .name = "TPM_RC_HANDLE", .description = "the handle is not correct for the use", }, { /* 0x00C */ .id = TPM_RC_KDF, .name = "TPM_RC_KDF", .description = "unsupported key derivation function or function not appropriate for use", }, { /* 0x00D */ .id = TPM_RC_RANGE, .name = "TPM_RC_RANGE", .description = "value was out of allowed range.", }, { /* 0x00E */ .id = TPM_RC_AUTH_FAIL, .name = "TPM_RC_AUTH_FAIL", .description = "the authorization HMAC check failed and DA counter incremented", }, { /* 0x00F */ .id = TPM_RC_NONCE, .name = "TPM_RC_NONCE", .description = "invalid nonce size", }, { /* 0x010 */ .id = TPM_RC_PP, .name = "TPM_RC_PP", .description = "authorization requires assertion of PP", }, { /* 0x012 */ .id = TPM_RC_SCHEME, .name = "TPM_RC_SCHEME", .description = "unsupported or incompatible scheme", }, { /* 0x015 */ .id = TPM_RC_SIZE, .name = "TPM_RC_SIZE", .description = "structure is the wrong size", }, { /* 0x016 */ .id = TPM_RC_SYMMETRIC, .name = "TPM_RC_SYMMETRIC", .description = "unsupported symmetric algorithm or key size, or not appropriate for instance", }, { /* 0x017 */ .id = TPM_RC_TAG, .name = "TPM_RC_TAG", .description = "incorrect structure tag", }, { /* 0x018 */ .id = TPM_RC_SELECTOR, .name = "TPM_RC_SELECTOR", .description = "union selector is incorrect", }, { /* 0x01A */ .id = TPM_RC_INSUFFICIENT, .name = "TPM_RC_INSUFFICIENT", .description = "the TPM was unable to unmarshal a value because there were not enough octets in the input buffer", }, { /* 0x01B */ .id = TPM_RC_SIGNATURE, .name = "TPM_RC_SIGNATURE", .description = "the signature is not valid", }, { /* 0x01C */ .id = TPM_RC_KEY, .name = "TPM_RC_KEY", .description = "key fields are not compatible with the selected use", }, { /* 0x0x01D */ .id = TPM_RC_POLICY_FAIL, .name = "TPM_RC_POLICY_FAIL", .description = "a policy check failed", }, { /* 0x01F */ .id = TPM_RC_INTEGRITY, .name = "TPM_RC_INTEGRITY", .description = "integrity check failed", }, { /* 0x020 */ .id = TPM_RC_TICKET, .name = "TPM_RC_TICKET", .description = "invalid ticket", }, { /* 0x021 */ .id = TPM_RC_RESERVED_BITS, .name = "TPM_RC_RESERVED_BITS", .description = "reserved bits not set to zero as required", }, { /* 0x022 */ .id = TPM_RC_BAD_AUTH, .name = "TPM_RC_BAD_AUTH", .description = "authorization failure without DA implications", }, { /* 0x023 */ .id = TPM_RC_EXPIRED, .name = "TPM_RC_EXPIRED", .description = "the policy has expired", }, { /* 0x024 */ .id = TPM_RC_POLICY_CC, .name = "TPM_RC_POLICY_CC", .description = "the commandCode in the policy is not the commandCode of the command or the command code in a policy command references a command that is not implemented", }, { /* 0x025 */ .id = TPM_RC_BINDING, .name = "TPM_RC_BINDING", .description = "public and sensitive portions of an object are not cryptographically bound", }, { /* 0x026 */ .id = TPM_RC_CURVE, .name = "TPM_RC_CURVE", .description = "curve not supported", }, { /* 0x027 */ .id = TPM_RC_ECC_POINT, .name = "TPM_RC_ECC_POINT", .description = "point is not on the required curve.", } }; /* Array of RC_WARN error codes from TPM 2.0, Part 2, Table 17. These are * implicitly RC_VER1 codes, but not errors, warnings. Index in this array * corresponds to the error code in the lower 6 bits [05:00]. Again, the * identifiers in the ID field have a constant added to the error code. This * time it's RC_WARN (0x900). */ struct tpm2_rc_entry tpm2_warn_entry [] = { { /* 0x001 */ .id = TPM_RC_CONTEXT_GAP, .name = "TPM_RC_CONTEXT_GAP", .description = "gap for context ID is too large", }, { /* 0x002 */ .id = TPM_RC_OBJECT_MEMORY, .name = "TPM_RC_OBJECT_MEMORY", .description = "out of memory for object contexts", }, { /* 0x003 */ .id = TPM_RC_SESSION_MEMORY, .name = "TPM_RC_SESSION_MEMORY", .description = "out of memory for session contexts", }, { /* 0x004 */ .id = TPM_RC_MEMORY, .name = "TPM_RC_MEMORY", .description = "out of shared object/session memory or need space for internal operations", }, { /* 0x005 */ .id = TPM_RC_SESSION_HANDLES, .name = "TPM_RC_SESSION_HANDLES", .description = "out of session handles – a session must be flushed before a new session may be created", }, { /* 0x006 */ .id = TPM_RC_OBJECT_HANDLES, .name = "TPM_RC_OBJECT_HANDLES", .description = "out of object handles – the handle space for objects is depleted and a reboot is required NOTE: This cannot occur on the reference implementation. NOTE: There is no reason why an implementation would implement a design that would deplete handle space. Platform specifications are encouraged to forbid it.", }, { /* 0x007 */ .id = TPM_RC_LOCALITY, .name = "TPM_RC_LOCALITY", .description = "bad locality", }, { /* 0x008 */ .id = TPM_RC_YIELDED, .name = "TPM_RC_YIELDED", .description = "the TPM has suspended operation on the command; forward progress was made and the command may be retried. See TPM 2.0 Part 1, “Multi-tasking.” NOTE: This cannot occur on the reference implementation.", }, { /* 0x009 */ .id = TPM_RC_CANCELED, .name = "TPM_RC_CANCELED", .description = "the command was canceled", }, { /* 0x00A */ .id = TPM_RC_TESTING, .name = "TPM_RC_TESTING", .description = "TPM is performing self-tests", }, { /* 0x010 */ .id = TPM_RC_REFERENCE_H0, .name = "TPM_RC_REFERENCE_H0", .description = "the 1st handle in the handle area references a transient object or session that is not loaded", }, { /* 0x011 */ .id = TPM_RC_REFERENCE_H1, .name = "TPM_RC_REFERENCE_H1", .description = "the 2nd handle in the handle area references a transient object or session that is not loaded", }, { /* 0x012 */ .id = TPM_RC_REFERENCE_H2, .name = "TPM_RC_REFERENCE_H2", .description = "the 3rd handle in the handle area references a transient object or session that is not loaded", }, { /* 0x013 */ .id = TPM_RC_REFERENCE_H3, .name = "TPM_RC_REFERENCE_H3", .description = "the 4th handle in the handle area references a transient object or session that is not loaded", }, { /* 0x014 */ .id = TPM_RC_REFERENCE_H4, .name = "TPM_RC_REFERENCE_H4", .description = "the 5th handle in the handle area references a transient object or session that is not loaded", }, { /* 0x015 */ .id = TPM_RC_REFERENCE_H5, .name = "TPM_RC_REFERENCE_H5", .description = "the 6th handle in the handle area references a transient object or session that is not loaded", }, { /* 0x016 */ .id = TPM_RC_REFERENCE_H6, .name = "TPM_RC_REFERENCE_H6", .description = "the 7th handle in the handle area references a transient object or session that is not loaded", }, { /* 0x018 */ .id = TPM_RC_REFERENCE_S0, .name = "TPM_RC_REFERENCE_S0", .description = "the 1st authorization session handle references a session that is not loaded", }, { /* 0x019 */ .id = TPM_RC_REFERENCE_S1, .name = "TPM_RC_REFERENCE_S1", .description = "the 2nd authorization session handle references a session that is not loaded", }, { /* 0x01A */ .id = TPM_RC_REFERENCE_S2, .name = "TPM_RC_REFERENCE_S2", .description = "the 3rd authorization session handle references a session that is not loaded", }, { /* 0x01B */ .id = TPM_RC_REFERENCE_S3, .name = "TPM_RC_REFERENCE_S3", .description = "the 4th authorization session handle references a session that is not loaded", }, { /* 0x01C */ .id = TPM_RC_REFERENCE_S4, .name = "TPM_RC_REFERENCE_S4", .description = "the 5th session handle references a session that is not loaded", }, { /* 0x01D */ .id = TPM_RC_REFERENCE_S5, .name = "TPM_RC_REFERENCE_S5", .description = "the 6th session handle references a session that is not loaded", }, { /* 0x01E */ .id = TPM_RC_REFERENCE_S6, .name = "TPM_RC_REFERENCE_S6", .description = "the 7th authorization session handle references a session that is not loaded", }, { /* 0x020 */ .id = TPM_RC_NV_RATE, .name = "TPM_RC_NV_RATE", .description = "the TPM is rate-limiting accesses to prevent wearout of NV", }, { /* 0x021 */ .id = TPM_RC_LOCKOUT, .name = "TPM_RC_LOCKOUT", .description = "authorizations for objects subject to DA protection are not allowed at this time because the TPM is in DA lockout mode", }, { /* 0x022 */ .id = TPM_RC_RETRY, .name = "TPM_RC_RETRY", .description = "the TPM was not able to start the command", }, { /* 0x023 */ .id = TPM_RC_NV_UNAVAILABLE, .name = "TPM_RC_NV_UNAVAILABLE", .description = "the command may require writing of NV and NV is not current accessible", }, { /* 0x7F */ .id = TPM_RC_NOT_USED, .name = "TPM_RC_NOT_USED", .description = "this value is reserved and shall not be returned by the TPM", } }; /* Array of position error codes from TPM 2.0 Part 2, Table 17. These are * implicitly associated with RC_FMT1 codes. */ tpm2_rc_entry_t tpm2_position_entry [] = { { /* 0x100 */ .id = TPM_RC_1, .name = "TPM_RC_1", .description = NULL, }, { /* 0x200 */ .id = TPM_RC_2, .name = "TPM_RC_2", .description = NULL, }, { /* 0x300 */ .id = TPM_RC_3, .name = "TPM_RC_3", .description = NULL, }, { /* 0x400 */ .id = TPM_RC_4, .name = "TPM_RC_4", .description = NULL, }, { /* 0x500 */ .id = TPM_RC_5, .name = "TPM_RC_5", .description = NULL, }, { /* 0x600 */ .id = TPM_RC_6, .name = "TPM_RC_6", .description = NULL, }, { /* 0x700 */ .id = TPM_RC_7, .name = "TPM_RC_7", .description = NULL, }, { /* 0x800 */ .id = TPM_RC_8, .name = "TPM_RC_8", .description = NULL, }, { /* 0x900 */ .id = TPM_RC_9, .name = "TPM_RC_9", .description = NULL, }, { /* 0xA00 */ .id = TPM_RC_A, .name = "TPM_RC_A", .description = NULL, }, { /* 0xB00 */ .id = TPM_RC_B, .name = "TPM_RC_B", .description = NULL, }, { /* 0xC00 */ .id = TPM_RC_C, .name = "TPM_RC_C", .description = NULL, }, { /* 0xD00 */ .id = TPM_RC_D, .name = "TPM_RC_D", .description = NULL, }, { /* 0xE00 */ .id = TPM_RC_E, .name = "TPM_RC_E", .description = NULL, }, { /* 0xF00 */ .id = TPM_RC_F, .name = "TPM_RC_F", .description = NULL, } }; /* Array of tpm2_rc_entrys for layers defined in the TSS spec. */ struct tpm2_rc_entry tpm2_tss_layer_entry [] = { { /* 0x0 * The spec calls this TSS2_TPM_RC_LEVEL and it's defined as bits * [15:12] not [23:16] like the error layer / levels. */ .id = TSS2_TPM_ERROR_LEVEL, .name = "TSS2_TPM_ERROR_LEVEL", .description = "Error produced by the TPM", }, { /* 10 << 16 = 0xA0000 */ .id = TSS2_TCTI_ERROR_LEVEL, .name = "TSS2_TCTI_ERROR_LEVEL", .description = "Error from the TCTI" }, { /* 8 << 16 = 0x80000 */ .id = TSS2_SYS_ERROR_LEVEL, .name = "TSS2_SYS_ERROR_LEVEL", .description = "Error from the SAPI", }, { /* 9 << 16 = 0x90000 */ .id = TSS2_SYS_PART2_ERROR_LEVEL, .name = "TSS2_SYS_PART2_RC_LEVEL", .description = "Error from the SAPI duplicating TPM error check" } }; /* Array of TSS2 error codes from TSS System API section 6.1.2. * Index in this array corresponds to the error code in the lower 12 bits * 11:00]. Undefined error codes will have NULL data in the array. */ struct tpm2_rc_entry tpm2_tss_base_rc_entry [] = { { /* 0x01 */ .id = TSS2_BASE_RC_GENERAL_FAILURE, .name = "TSS2_BASE_RC_GENERAL_FAILURE", .description = "Catch all for all errors not otherwise specifed", }, { /* 0x02 */ .id = TSS2_BASE_RC_NOT_IMPLEMENTED, .name = "TSS2_BASE_RC_NOT_IMPLEMENTED", .description = "If called functionality isn't implemented", }, { /* 0x03 */ .id = TSS2_BASE_RC_BAD_CONTEXT, .name = "TSS2_BASE_RC_BAD_CONTEXT", .description = "A context structure is bad", }, { /* 0x04 */ .id = TSS2_BASE_RC_ABI_MISMATCH, .name = "TSS2_BASE_RC_ABI_MISMATCH", .description = "Passed in ABI version doesn't match called module's ABI version", }, { /* 0x05 */ .id = TSS2_BASE_RC_BAD_REFERENCE, .name = "TSS2_BASE_RC_BAD_REFERENCE", .description = "A pointer is NULL that isn't allowed to be NULL.", }, { /* 0x06 */ .id = TSS2_BASE_RC_INSUFFICIENT_BUFFER, .name = "TSS2_BASE_RC_INSUFFICIENT_BUFFER", .description = "A buffer isn't large enough", }, { /* 0x07 */ .id = TSS2_BASE_RC_BAD_SEQUENCE, .name = "TSS2_BASE_RC_BAD_SEQUENCE", .description = "Function called in the wrong order", }, { /* 0x08 */ .id = TSS2_BASE_RC_NO_CONNECTION, .name = "TSS2_BASE_RC_NO_CONNECTION", .description = "Fails to connect to next lower layer", }, { /* 0x09 */ .id = TSS2_BASE_RC_TRY_AGAIN, .name = "TSS2_BASE_RC_TRY_AGAIN", .description = "Operation timed out; function must be called again to be completed", }, { /* 0x0A */ .id = TSS2_BASE_RC_IO_ERROR, .name = "TSS2_BASE_RC_IO_ERROR", .description = "IO failure", }, { /* 0x0B */ .id = TSS2_BASE_RC_BAD_VALUE, .name = "TSS2_BASE_RC_BAD_VALUE", .description = "A parameter has a bad value", }, { /* 0x0C */ .id = TSS2_BASE_RC_NOT_PERMITTED, .name = "TSS2_BASE_RC_NOT_PERMITTED", .description = "Operation not permitted.", }, { /* 0x0D */ .id = TSS2_BASE_RC_INVALID_SESSIONS, .name = "TSS2_BASE_RC_INVALID_SESSIONS", .description = "Session structures were sent, but command doesn't use them or doesn't use the specifed number of them", }, { /* 0x0E */ .id = TSS2_BASE_RC_NO_DECRYPT_PARAM, .name = "TSS2_BASE_RC_NO_DECRYPT_PARAM", .description = "If function called that uses decrypt parameter, but command doesn't support decrypt parameter.", }, { /* 0x0F */ .id = TSS2_BASE_RC_NO_ENCRYPT_PARAM, .name = "TSS2_BASE_RC_NO_ENCRYPT_PARAM", .description = "If function called that uses encrypt parameter, but command doesn't support decrypt parameter.", }, { /* 0x10 */ .id = TSS2_BASE_RC_BAD_SIZE, .name = "TSS2_BASE_RC_BAD_SIZE", .description = "If size of a paremeter is incorrect", }, { /* 0x11 */ .id = TSS2_BASE_RC_MALFORMED_RESPONSE, .name = "TSS2_BASE_RC_MALFORMED_RESPONSE", .description = "Response is malformed", }, { /* 0x12 */ .id = TSS2_BASE_RC_INSUFFICIENT_CONTEXT, .name = "TSS2_BASE_RC_INSUFFICIENT_CONTEXT", .description = "Context not large enough", }, { /* 0x13 */ .id = TSS2_BASE_RC_INSUFFICIENT_RESPONSE, .name = "TSS2_BASE_RC_INSUFFICIENT_RESPONSE", .description = "Response is not long enough", }, { /* 0x14 */ .id = TSS2_BASE_RC_INCOMPATIBLE_TCTI, .name = "TSS2_BASE_RC_INCOMPATIBLE_TCTI", .description = "Unknown or unusable TCTI version", }, { /* 0x15 */ .id = TSS2_BASE_RC_NOT_SUPPORTED, .name = "TSS2_BASE_RC_NOT_SUPPORTED", .description = "Functionality not supported.", }, { /* 0x16 */ .id = TSS2_BASE_RC_BAD_TCTI_STRUCTURE, .name = "TSS2_BASE_RC_BAD_TCTI_STRUCTURE", .description = "TCTI context is bad.", } }; /* char* tpm2_strrc (TPM_RC rc, char *out_str, size_t out_str_size) { if (is_tpm2_rc_format_zero (rc)) return tpm2_fmt0_entry [rc].description; else if (is_tpm2_rc_format_one (rc)) return tpm2_fmt1_entry [rc].description; else return NULL; } */ /* Functions to lookup / retrieve entries from the arrays of tpm2_rc_entry_t's * None of these functions check the format of the TPM_RC before doing the * lookup. They just mask out the irrelevant bits and do the lookup doing the * remainder. "irrelevant bits" is determined by the 'select_func' parameter. * This is a function to mask out "irrelevant bits". The same function is * applied to both the source RC and the RCs in the 'id' field of the array. */ #define STR_ENTRY_ARRAY_LENGTH(name) (sizeof (name) / sizeof (struct tpm2_rc_entry)) #define STR_ENTRY_ARRAY_LOOKUP(rc, array, select_func) \ int i; \ for (i = 0; i < STR_ENTRY_ARRAY_LENGTH (array); ++i) \ if (select_func (rc) == select_func (array[i].id)) \ return &array[i]; \ return NULL; tpm2_rc_entry_t* tpm2_get_tss_base_rc_entry (TPM_RC rc) { STR_ENTRY_ARRAY_LOOKUP (rc, tpm2_tss_base_rc_entry, tpm2_rc_get_tss_err_code); } tpm2_rc_entry_t* tpm2_get_parameter_entry (TPM_RC rc) { STR_ENTRY_ARRAY_LOOKUP (rc, tpm2_position_entry, tpm2_rc_get_parameter_number); } tpm2_rc_entry_t* tpm2_get_handle_entry (TPM_RC rc) { STR_ENTRY_ARRAY_LOOKUP (rc, tpm2_position_entry, tpm2_rc_get_handle_number); } tpm2_rc_entry_t* tpm2_get_session_entry (TPM_RC rc) { STR_ENTRY_ARRAY_LOOKUP (rc, tpm2_position_entry, tpm2_rc_get_session_number); } tpm2_rc_entry_t* tpm2_get_layer_entry (TPM_RC rc) { STR_ENTRY_ARRAY_LOOKUP (rc, tpm2_tss_layer_entry, tpm2_rc_get_layer); } tpm2_rc_entry_t* tpm2_get_fmt0_entry (TPM_RC rc) { STR_ENTRY_ARRAY_LOOKUP (rc, tpm2_ver1_entry, tpm2_rc_get_code_7bit); } tpm2_rc_entry_t* tpm2_get_fmt1_entry (TPM_RC rc) { STR_ENTRY_ARRAY_LOOKUP (rc, tpm2_fmt1_entry, tpm2_rc_get_code_6bit); } tpm2_rc_entry_t* tpm2_get_warn_entry (TPM_RC rc) { STR_ENTRY_ARRAY_LOOKUP (rc, tpm2_warn_entry, tpm2_rc_get_code_6bit); } tpm2.0-tools-1.1.0/src/rc-decode.h000066400000000000000000000217371300711361400164620ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2016, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #ifndef RC_DECODE_H #define RC_DECODE_H #include #include /* struct / type used to map TPM_RC error code parts to string representations of * their identifier and description. */ typedef struct tpm2_rc_entry { uint32_t id; char *name; char *description; } tpm2_rc_entry_t; /* To understand the TPM_RC you need to read a 2 different parts of the * spec: * Section 39.4 of TPM 2.0 Part 1: Architecture * Section 6.6 of TPM 2.0 Part 2: Structures * * The notion of RC levels only exists for the TSS. See the TSS system API * specification section 6.1.2 for details. */ /* Macros to determine whether or not a specific bit in position 'pos' from * variable 'var' is set. */ #define IS_BIT_SET(var, pos) ((1 << (pos)) & (var)) #define IS_BIT_CLEAR(var, pos) !IS_BIT_SET(var, pos) /* useful masks not defined in the spec */ /* bits [06:00] */ #define TPM_RC_7BIT_ERROR_MASK 0x7f /* bits [05:00] */ #define TPM_RC_6BIT_ERROR_MASK 0x3f /* bits [11:08] */ #define TPM_RC_PARAMETER_MASK 0xf00 /* bits [10:08] */ #define TPM_RC_HANDLE_MASK 0x700 #define TPM_RC_SESSION_MASK 0x700 /* "Format Zero" response codes have bit 7 clear. * Format zero RCs could be in a number of formats: * - A TPM 1.2 RC * - A vendor defined error code * - A 6 bit warning code * - A 6 bit error code */ static inline bool tpm2_rc_is_format_zero (TPM_RC response_code) { if (IS_BIT_CLEAR (response_code, 7)) return true; else return false; } /* "Format One" response codes have bit 7 set. * These RCs have two components: * - A 5 bit error code in bits [05:00] * - A 4 bit parameter identifier in [11:08] or a 3 bit handle / session * identifier in bits [10:08] */ static inline int tpm2_rc_is_format_one (TPM_RC response_code) { if (IS_BIT_SET (response_code, 7)) return true; else return false; } /* Determine whether or not a response code (TPM_RC) is in the 1.2 format or * the 2.0 format. */ static inline bool tpm2_rc_is_tpm2 (TPM_RC response_code) { /* if bit 7 & 8 are both 0, TPM_RC is 1.2 format */ if (IS_BIT_CLEAR (response_code, 7) && IS_BIT_CLEAR (response_code, 8)) return false; else return true; } static inline bool tpm2_rc_is_tpm12 (TPM_RC response_code) { if (!tpm2_rc_is_tpm2 (response_code)) return true; else return false; } /* Determine whether or not a response code (TPM_RC) is a vendor defined code. * Vendor defined TPM2 response codes have bit 8 and 10 set, and bit 7 clear. */ static inline bool tpm2_rc_is_vendor_defined (TPM_RC response_code) { if (IS_BIT_CLEAR (response_code, 7) && IS_BIT_SET (response_code, 8) && IS_BIT_SET (response_code, 10)) { return true; } else { return false; } } /* Determine whether or not bits [06:00] contain a warning code. * Warning codes have bit 8 and 11 set, and bits 7 and 10 clear. */ static inline bool tpm2_rc_is_warning_code (TPM_RC response_code) { if (IS_BIT_CLEAR (response_code, 7) && IS_BIT_SET (response_code, 8) && IS_BIT_CLEAR (response_code, 10) && IS_BIT_SET (response_code, 11)) { return true; } else { return false; } } /* Determine whether or not bits [06:00] contain an error code. * Error codes have bit 8 set, and bits 7, 10 and 11 clear. */ static inline bool tpm2_rc_is_error_code (TPM_RC response_code) { if (IS_BIT_CLEAR (response_code, 7) && IS_BIT_SET (response_code, 8) && IS_BIT_CLEAR (response_code, 10) && IS_BIT_CLEAR (response_code, 11)) { return 1; } else { return 0; } } /* Determine whether or not bits [05:00] contain and error code with a * parameter number in bits [11:08]. * Bit 6 and 7 are set. */ static inline bool tpm2_rc_is_error_code_with_parameter (TPM_RC response_code) { if (IS_BIT_SET (response_code, 6) && IS_BIT_SET (response_code, 7)) return true; else return false; } /* Determine whether or not bits [05:00] contain an error code with a * handle number in bits [10:08] * Bit 7 set, bits 6 and 11 clear. */ static inline bool tpm2_rc_is_error_code_with_handle (TPM_RC response_code) { if (IS_BIT_CLEAR (response_code, 6) && IS_BIT_SET (response_code, 7) && IS_BIT_CLEAR (response_code, 11)) { return true; } else { return false; } } /* Determine whether or not bits [05:00] contain an error code with a * session number in bits [10:08] * Bit 6 clear, bits 7 and 11 set. */ static inline bool tpm2_rc_is_error_code_with_session (TPM_RC response_code) { if (IS_BIT_CLEAR (response_code, 6) && IS_BIT_SET (response_code, 7) && IS_BIT_SET (response_code, 11)) { return true; } else { return false; } } /* Isolate bits [06:00] of the TPM_RC. * The 7bit warning or error code is only valid if the RC is a "format zero" * RC. */ static inline UINT32 tpm2_rc_get_code_7bit (TPM_RC response_code) { return TPM_RC_7BIT_ERROR_MASK & response_code; } /* Isolate bits [05:00] of the TPM_RC. * The 6bit error code is only valid if the RC is a "format one" RC. */ static inline UINT32 tpm2_rc_get_code_6bit (TPM_RC response_code) { return TPM_RC_6BIT_ERROR_MASK & response_code; } /* Isolate bits [11:08] of the TPM_RC. * The 4 it parameter code is only valid if the RC is a "format one" RC * with bit 6 set. Test for this with the * tpm2_rc_is_error_code_with_parameters function. */ static inline UINT32 tpm2_rc_get_parameter_number (TPM_RC response_code) { return TPM_RC_PARAMETER_MASK & response_code; } /* Isolate bits [10:08] of the TPM_RC. * The 3 bit handle / session code is only valid if the RC is a "format one" * RC with bits 6 clear. */ static inline UINT32 tpm2_rc_get_handle_number (TPM_RC response_code) { return TPM_RC_HANDLE_MASK & response_code; } static inline UINT32 tpm2_rc_get_session_number (TPM_RC response_code) { return TPM_RC_SESSION_MASK & response_code; } /* Isolate the error level component of the TPM_RC in bits [23:16] */ static inline UINT32 tpm2_rc_get_layer (TPM_RC response_code) { return TSS2_ERROR_LEVEL_MASK & response_code; } /* This function returns true if the error code indicates that it came from a * TSS component. False otherwise (which indicates it came from the TPM). */ static inline bool tpm2_rc_is_from_tss (TPM_RC response_code) { if (tpm2_rc_get_layer (response_code)) return true; else return false; } /* Isolate the error code from a TSS layer. It's not entirely clear to me * from the spec what the right mask is here. Bits [23:16] are for the layer * indicator but it says nothing else about which bits mean what. It makes * sense to assume that the lower 2 bytes hold the error code but the top * byte (AFAIK) is unaccounted for. * So I'm masking [31:24] as well as the ayer indicator. */ static inline UINT32 tpm2_rc_get_tss_err_code (TPM_RC response_code) { return 0X0000ffff & response_code; } /* Functions to retrieve tpm2_rc_entry with strings for RC decoding. */ tpm2_rc_entry_t* tpm2_get_tss_base_rc_entry (TPM_RC rc); tpm2_rc_entry_t* tpm2_get_parameter_entry (TPM_RC rc); tpm2_rc_entry_t* tpm2_get_handle_entry (TPM_RC rc); tpm2_rc_entry_t* tpm2_get_session_entry (TPM_RC rc); tpm2_rc_entry_t* tpm2_get_layer_entry (TPM_RC rc); tpm2_rc_entry_t* tpm2_get_fmt0_entry (TPM_RC rc); tpm2_rc_entry_t* tpm2_get_fmt1_entry (TPM_RC rc); tpm2_rc_entry_t* tpm2_get_warn_entry (TPM_RC rc); #endif /* RC_DECODE_H */ tpm2.0-tools-1.1.0/src/sample.h000066400000000000000000000336261300711361400161160ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #ifndef SAMPLE_H #define SAMPLE_H #ifdef __cplusplus extern "C" { #endif #include #include #include #include "syscontext.h" extern FILE *outFp; extern TSS2_TCTI_CONTEXT *resMgrTctiContext; extern TSS2_ABI_VERSION abiVersion; enum TSS2_APP_RC_CODE { APP_RC_PASSED, APP_RC_GET_NAME_FAILED, APP_RC_CREATE_SESSION_KEY_FAILED, APP_RC_SESSION_SLOT_NOT_FOUND, APP_RC_BAD_ALGORITHM, APP_RC_SYS_CONTEXT_CREATE_FAILED, APP_RC_GET_SESSION_STRUCT_FAILED, APP_RC_GET_SESSION_ALG_ID_FAILED, APP_RC_INIT_SYS_CONTEXT_FAILED, APP_RC_TEARDOWN_SYS_CONTEXT_FAILED, APP_RC_BAD_LOCALITY }; // Add this to application-specific error codes so they overlap // with TSS ones which may be re-used for app level errors. #define APP_RC_OFFSET 0x100 // These are app specific error codes, so they have // APP_RC_OFFSET added. #define TSS2_APP_RC_PASSED (APP_RC_PASSED + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_GET_NAME_FAILED (APP_RC_GET_NAME_FAILED + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_CREATE_SESSION_KEY_FAILED (APP_RC_CREATE_SESSION_KEY_FAILED + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_SESSION_SLOT_NOT_FOUND (APP_RC_SESSION_SLOT_NOT_FOUND + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_BAD_ALGORITHM (APP_RC_BAD_ALGORITHM + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_SYS_CONTEXT_CREATE_FAILED (APP_RC_SYS_CONTEXT_CREATE_FAILED + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_GET_SESSION_STRUCT_FAILED (APP_RC_GET_SESSION_STRUCT_FAILED + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_GET_SESSION_ALG_ID_FAILED (APP_RC_GET_SESSION_ALG_ID_FAILED + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_INIT_SYS_CONTEXT_FAILED (APP_RC_INIT_SYS_CONTEXT_FAILED + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_TEARDOWN_SYS_CONTEXT_FAILED (APP_RC_TEARDOWN_SYS_CONTEXT_FAILED + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) #define TSS2_APP_RC_BAD_LOCALITY (APP_RC_BAD_LOCALITY + APP_RC_OFFSET + TSS2_APP_ERROR_LEVEL) // These error codes are application level versions of // TSS error codes so they don't have APP_RC_OFFSET added. #define TSS2_APP_RC_BAD_REFERENCE (TSS2_BASE_RC_BAD_REFERENCE + TSS2_APP_ERROR_LEVEL) #define TPM_HT_NO_HANDLE 0xfc000000 #define TPM_RC_NO_RESPONSE 0xffffffff #define MAX_NUM_SESSIONS MAX_ACTIVE_SESSIONS #define MAX_NUM_ENTITIES 100 #define APPLICATION_ERROR( errCode ) \ ( TSS2_APP_ERROR_LEVEL + errCode ) #define APPLICATION_HMAC_ERROR(i) \ ( TSS2_APP_ERROR_LEVEL + TPM_RC_S + TPM_RC_AUTH_FAIL + ( (i ) << 8 ) ) typedef struct { // Inputs to StartAuthSession; these need to be saved // so that HMACs can be calculated. TPMI_DH_OBJECT tpmKey; TPMI_DH_ENTITY bind; TPM2B_ENCRYPTED_SECRET encryptedSalt; TPM2B_MAX_BUFFER salt; TPM_SE sessionType; TPMT_SYM_DEF symmetric; TPMI_ALG_HASH authHash; // Outputs from StartAuthSession; these also need // to be saved for calculating HMACs and // other session related functions. TPMI_SH_AUTH_SESSION sessionHandle; TPM2B_NONCE nonceTPM; // Internal state for the session TPM2B_DIGEST sessionKey; TPM2B_DIGEST authValueBind; // authValue of bind object TPM2B_NONCE nonceNewer; TPM2B_NONCE nonceOlder; TPM2B_NONCE nonceTpmDecrypt; TPM2B_NONCE nonceTpmEncrypt; TPM2B_NAME name; // Name of the object the session handle // points to. Used for computing HMAC for // any HMAC sessions present. // void *hmacPtr; // Pointer to HMAC field in the marshalled // data stream for the session. // This allows the function to calculate // and fill in the HMAC after marshalling // of all the inputs. // // This is only used if the session is an // HMAC session. // UINT8 nvNameChanged; // Used for some special case code // dealing with the NV written state. } SESSION; // // Structure used to maintain entity data. Right now it just // consists of handles/authValue pairs. // typedef struct{ TPM_HANDLE entityHandle; TPM2B_AUTH entityAuth; UINT8 nvNameChanged; } ENTITY; void InitEntities(); TPM_RC AddEntity( TPM_HANDLE entityHandle, TPM2B_AUTH *auth ); TPM_RC DeleteEntity( TPM_HANDLE entityHandle ); TPM_RC GetEntityAuth( TPM_HANDLE entityHandle, TPM2B_AUTH *auth ); TPM_RC GetEntity( TPM_HANDLE entityHandle, ENTITY **entity ); TPM_RC GetSessionStruct( TPMI_SH_AUTH_SESSION authHandle, SESSION **pSession ); TPM_RC GetSessionAlgId( TPMI_SH_AUTH_SESSION authHandle, TPMI_ALG_HASH *sessionAlgId ); TPM_RC EndAuthSession( SESSION *session ); TPM_RC ComputeCommandHmacs( TSS2_SYS_CONTEXT *sysContext, TPM_HANDLE handle1, TPM_HANDLE handle2, TSS2_SYS_CMD_AUTHS *pSessionsData, TPM_RC sessionCmdRval ); extern INT16 sessionEntriesUsed; extern void InitSessionsTable(); extern UINT32 ( *ComputeSessionHmacPtr )( TSS2_SYS_CONTEXT *sysContext, TPMS_AUTH_COMMAND *cmdAuth, // Pointer to session input struct TPM_HANDLE entityHandle, // Used to determine if we're accessing a different // resource than the bound resoure. TPM_RC responseCode, // Response code for the command, 0xffff for "none" is // used to indicate that no response code is present // (used for calculating command HMACs vs response HMACs). TPM_HANDLE handle1, // First handle == 0xff000000 indicates no handle TPM_HANDLE handle2, // Second handle == 0xff000000 indicates no handle TPMA_SESSION sessionAttributes, // Current session attributes TPM2B_DIGEST *result, // Where the result hash is saved. TPM_RC sessionCmdRval ); extern TPM_RC CheckResponseHMACs( TSS2_SYS_CONTEXT *sysContext, TPM_RC responseCode, TSS2_SYS_CMD_AUTHS *pSessionsDataIn, TPM_HANDLE handle1, TPM_HANDLE handle2, TSS2_SYS_RSP_AUTHS *pSessionsDataOut ); TPM_RC StartAuthSessionWithParams( SESSION **session, TPMI_DH_OBJECT tpmKey, TPM2B_MAX_BUFFER *salt, TPMI_DH_ENTITY bind, TPM2B_AUTH *bindAuth, TPM2B_NONCE *nonceCaller, TPM2B_ENCRYPTED_SECRET *encryptedSalt, TPM_SE sessionType, TPMT_SYM_DEF *symmetric, TPMI_ALG_HASH algId ); // // Used by upper layer code to save and update entity data // (authValue, specifically) at creation and use time. // // NOTE: this really needs to be turned into a linked list // with add, find, and remove entries, instead of a fixed // length array. // ENTITY entities[MAX_NUM_ENTITIES+1]; // // This function calculates the session HMAC // UINT32 TpmComputeSessionHmac( TSS2_SYS_CONTEXT *sysContext, TPMS_AUTH_COMMAND *pSessionDataIn, // Pointer to session input struct TPM_HANDLE entityHandle, // Used to determine if we're accessing a different // resource than the bound resoure. TPM_RC responseCode, // Response code for the command, 0xffff for "none" is // used to indicate that no response code is present // (used for calculating command HMACs vs response HMACs). TPM_HANDLE handle1, // First handle == 0xff000000 indicates no handle TPM_HANDLE handle2, // Second handle == 0xff000000 indicates no handle TPMA_SESSION sessionAttributes, // Current session attributes TPM2B_DIGEST *result, // Where the result hash is saved. TPM_RC sessionCmdRval ); TPM_RC TpmCalcPHash( TSS2_SYS_CONTEXT *sysContext, TPM_HANDLE handle1, TPM_HANDLE handle2, TPMI_ALG_HASH authHash, TPM_RC responseCode, TPM2B_DIGEST *pHash ); // // Function pointers for HMAC and Hashing. // Typically, in a real integration of the TSS 2.0 system API, these // will point to wrapper funtions which will call into system level // crypto libraries. // // In the sample code, these routines use TPM functions // to perform HMAC and hashing. This serves two purposes: // 1. Provides out of box sample code // 2. Enhances test coverage for the TPM HMAC and hash system APIs. // // // Pointer to generic HMAC function. // // Inputs: // // hashAlg: parameter indicates the hash algorithm to use. // key: is the key input to the HMAC // bufferList: list of pointers to sized byte buffers, NULL terminated. // // Outputs: // // result: the resulting HMAC. Length will be zero, if errors occurred. // return value: if no errors occur, TPM_RC_SUCCESS. Otherwise an error code // that indicates what error occurred. This error code will be // determined by the HMAC routine that gets called. In the case // of the errors returned will be TPM 2.0 error codes. // extern UINT32 (*HmacFunctionPtr)( TPMI_ALG_HASH hashAlg, TPM2B *key,TPM2B **bufferList, TPM2B_DIGEST *result ); // // Pointer to generic hash wrapper function. // // Inputs: // // hashAlg: parameter indicates the hash algorithm to use. This parameter is used to // determine which hashing function to call. // size: number of bytes to hash // data: pointer to start of bytes to hash // // Outputs: // // result: the resulting hash. Length will be zero, if errors occurred. // return value: if no errors occur, TPM_RC_SUCCESS. Otherwise an error code // that indicates what error occurred. This error code will be // determined by the hash routine that gets called. In the case // of the errors returned will be TPM 2.0 error codes. // extern UINT32 (*HashFunctionPtr)( TPMI_ALG_HASH hashAlg, UINT16 size, BYTE *data, TPM2B_DIGEST *result ); // // Pointer to function that gets the name of a resource given the handle // for the resource. // // Inputs: // // handle: The handle for the resource. // // Outputs: // // name: The name of the resource. Length will be zero if errors // occurred. // return value: If not errors occur, TPM_RC_SUCCESS. Otherwise an error code // that indicates what error occurred. This error code will be // determined by the routine that gets called. In the case // of the errors returned will be TPM 2.0 error codes. // extern UINT32 (*HandleToNameFunctionPtr)( TPM_HANDLE handle, TPM2B_NAME *name ); extern TPM_RC ( *CalcPHash )( TSS2_SYS_CONTEXT *sysContext,TPM_HANDLE handle1, TPM_HANDLE handle2, TPMI_ALG_HASH authHash, TPM_RC responseCode, TPM2B_DIGEST *pHash ); void PrintSizedBuffer( TPM2B *sizedBuffer ); void InitNullSession( TPMS_AUTH_COMMAND *nullSessionData ); TPM_RC LoadExternalHMACKey( TPMI_ALG_HASH hashAlg, TPM2B *key, TPM_HANDLE *keyHandle, TPM2B_NAME *keyName ); UINT16 CopySizedByteBuffer( TPM2B *dest, TPM2B *src ); TSS2_RC EncryptCommandParam( SESSION *session, TPM2B_MAX_BUFFER *encryptedData, TPM2B_MAX_BUFFER *clearData, TPM2B_AUTH *authValue ); TSS2_RC DecryptResponseParam( SESSION *session, TPM2B_MAX_BUFFER *clearData, TPM2B_MAX_BUFFER *encryptedData, TPM2B_AUTH *authValue ); TPM_RC KDFa( TPMI_ALG_HASH hashAlg, TPM2B *key, char *label, TPM2B *contextU, TPM2B *contextV, UINT16 bits, TPM2B_MAX_BUFFER *resultKey ); UINT32 TpmHashSequence( TPMI_ALG_HASH hashAlg, UINT8 numBuffers, TPM2B_DIGEST *bufferList, TPM2B_DIGEST *result ); void CatSizedByteBuffer( TPM2B *dest, TPM2B *src ); void RollNonces( SESSION *session, TPM2B_NONCE *newNonce ); TSS2_RC SetLocality( TSS2_SYS_CONTEXT *sysContext, UINT8 locality ); TPM_RC TpmHmac( TPMI_ALG_HASH hashAlg, TPM2B *key,TPM2B **bufferList, TPM2B_DIGEST *result ); UINT32 TpmHash( TPMI_ALG_HASH hashAlg, UINT16 size, BYTE *data, TPM2B_DIGEST *result ); UINT32 TpmHandleToName( TPM_HANDLE handle, TPM2B_NAME *name ); int TpmClientPrintf( UINT8 type, const char *format, ...); void OpenOutFile( FILE **outFp ); void CloseOutFile( FILE **outFp ); #ifdef __cplusplus } #endif #endif tpm2.0-tools-1.1.0/src/syscontext.c000066400000000000000000000052041300711361400170420ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include // Allocates space for and initializes system // context structure. // Returns: // ptr to system context, if successful // NULL pointer, if not successful. TSS2_SYS_CONTEXT *InitSysContext( UINT16 maxCommandSize, TSS2_TCTI_CONTEXT *tctiContext, TSS2_ABI_VERSION *abiVersion ) { UINT32 contextSize; TSS2_RC rval; TSS2_SYS_CONTEXT *sysContext; // Get the size needed for system context structure. contextSize = Tss2_Sys_GetContextSize( maxCommandSize ); // Allocate the space for the system context structure. sysContext = malloc( contextSize ); if( sysContext != 0 ) { // Initialized the system context structure. rval = Tss2_Sys_Initialize( sysContext, contextSize, tctiContext, abiVersion ); if( rval == TSS2_RC_SUCCESS ) return sysContext; else return 0; } else { return 0; } } void TeardownSysContext( TSS2_SYS_CONTEXT **sysContext ) { if( *sysContext != 0 ) { Tss2_Sys_Finalize(*sysContext); free(*sysContext); *sysContext = 0; } } tpm2.0-tools-1.1.0/src/syscontext.h000066400000000000000000000034401300711361400170470ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #ifndef SYS_CONTEXT_H #define SYS_CONTEXT_H #include #include #include TSS2_SYS_CONTEXT *InitSysContext( UINT16 maxCommandSize, TSS2_TCTI_CONTEXT *tctiContext, TSS2_ABI_VERSION *abiVersion ); void TeardownSysContext( TSS2_SYS_CONTEXT **sysContext ); #endif tpm2.0-tools-1.1.0/src/tpm2_activatecredential.cpp000066400000000000000000000325501300711361400217600ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" #include "sample.h" int debugLevel = 0; char outFilePath[PATH_MAX] = {0}; TPMI_DH_OBJECT activateHandle; TPMI_DH_OBJECT keyHandle; TPM2B_ID_OBJECT credentialBlob; TPM2B_ENCRYPTED_SECRET secret; TPMS_AUTH_COMMAND cmdAuth; TPMS_AUTH_COMMAND cmdAuth2; TPMS_AUTH_COMMAND cmdAuth3; bool hexPasswd = false; int readCrtSecFromFile(const char *path,TPM2B_ID_OBJECT *credentialBlob, TPM2B_ENCRYPTED_SECRET *secret) { FILE *fp = fopen(path,"rb"); if(NULL == fp) { printf("File: %s Not Found OR Access Error !\n",path); return -1; } if(fread(credentialBlob,sizeof(TPM2B_ID_OBJECT),1,fp) != 1) { fclose(fp); printf("Read credentialBlob from file %s Error!\n",path); return -2; } if(fread(secret,sizeof(TPM2B_ENCRYPTED_SECRET),1,fp)!= 1) { fclose(fp); printf("Read secret form file %s error !\n",path); return -3; } fclose(fp); return 0; } int activateCredential() { UINT32 rval; TPM2B_DIGEST certInfoData = { { sizeof(certInfoData)-2, } }; printf("\nACTIVATE CREDENTIAL TESTS:\n"); cmdAuth.sessionHandle = TPM_RS_PW; cmdAuth2.sessionHandle = TPM_RS_PW; *((UINT8 *)((void *)&cmdAuth.sessionAttributes)) = 0; *((UINT8 *)((void *)&cmdAuth2.sessionAttributes)) = 0; *((UINT8 *)((void *)&cmdAuth3.sessionAttributes)) = 0; TPMS_AUTH_COMMAND *cmdSessionArray[2] = { &cmdAuth, &cmdAuth3 }; TSS2_SYS_CMD_AUTHS cmdAuthArray = { 2, &cmdSessionArray[0] }; TPMS_AUTH_COMMAND *cmdSessionArray1[1] = { &cmdAuth2 }; TSS2_SYS_CMD_AUTHS cmdAuthArray1 = { 1, &cmdSessionArray1[0] }; SESSION *session; TPM2B_ENCRYPTED_SECRET encryptedSalt = { { 0, } }; TPM2B_NONCE nonceCaller = { { 0, } }; TPMT_SYM_DEF symmetric; symmetric.algorithm = TPM_ALG_NULL; if (cmdAuth.hmac.t.size > 0 && hexPasswd) { cmdAuth.hmac.t.size = sizeof(cmdAuth.hmac) - 2; if (hex2ByteStructure((char *)cmdAuth.hmac.t.buffer, &cmdAuth.hmac.t.size, cmdAuth.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for handlePasswd.\n"); return -1; } } if (cmdAuth2.hmac.t.size > 0 && hexPasswd) { cmdAuth2.hmac.t.size = sizeof(cmdAuth2.hmac) - 2; if (hex2ByteStructure((char *)cmdAuth2.hmac.t.buffer, &cmdAuth2.hmac.t.size, cmdAuth2.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for endorsePasswd.\n"); return -1; } } rval = StartAuthSessionWithParams( &session, TPM_RH_NULL, 0, TPM_RH_NULL, 0, &nonceCaller, &encryptedSalt, TPM_SE_POLICY, &symmetric, TPM_ALG_SHA256 ); if( rval != TPM_RC_SUCCESS ) { printf("\n......StartAuthSessionWithParams Error. TPM Error:0x%x......\n", rval); return -1; } printf("\nStartAuthSessionWithParams succ.......\n"); rval = Tss2_Sys_PolicySecret(sysContext, TPM_RH_ENDORSEMENT, session->sessionHandle, &cmdAuthArray1, 0, 0, 0, 0, 0, 0, 0); if( rval != TPM_RC_SUCCESS ) { printf("\n......Tss2_Sys_PolicySecret Error. TPM Error:0x%x......\n", rval); return -2; } printf("\nTss2_Sys_PolicySecret succ.......\n"); cmdAuth3.sessionHandle = session->sessionHandle; cmdAuth3.sessionAttributes.continueSession = 1; cmdAuth3.hmac.t.size = 0; rval = Tss2_Sys_ActivateCredential(sysContext, activateHandle, keyHandle, &cmdAuthArray, &credentialBlob, &secret, &certInfoData, 0); if(rval != TPM_RC_SUCCESS) { printf("\n......ActivateCredential failed. TPM Error:0x%x......\n", rval); return -3; } printf("\nActivate Credential succ.\n"); // Need to flush the session here. rval = Tss2_Sys_FlushContext( sysContext, session->sessionHandle ); if( rval != TPM_RC_SUCCESS ) { printf("\n......TPM2_Sys_FlushContext Error. TPM Error:0x%x......\n", rval); return -4; } // And remove the session from sessions table. rval = EndAuthSession( session ); if( rval != TPM_RC_SUCCESS ) { printf("\n......EndAuthSession Error. TPM Error:0x%x......\n", rval); return -5; } printf("\nCertInfoData :\n"); for (int k = 0; k Handle of the object associated with the created certificate by CA\n" "-c, --context filename for handle context\n" "-k, --keyHandle Loaded key used to decrypt the the random seed\n" "-C, --keyContext filename for keyHandle context\n" "-P, --Password the handle's password, optional\n" "-e, --endorsePasswd the endorsement password, optional\n" "-f, --inFile Input file path, containing the two structures needed by tpm2_activatecredential function\n" "-o, --outFile Output file path, record the secret to decrypt the certificate\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -H 0x81010002 -k 0x81010001 -P passwd -e new -f -o \n" "%s -H 0x81010002 -k 0x81010001 -P 123abc -e 1a1a1c -X -f -o \n" , name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; //DEFAULT_TPM_PORT; char *contextFilePath = NULL; char *keyContextFilePath = NULL; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvH:c:k:C:P:e:f:o:Xp:d:"; struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"handle",1,NULL,'H'}, {"context",1,NULL,'c'}, {"keyHandle",1,NULL,'k'}, {"keyContext",1,NULL,'C'}, {"Password",1,NULL,'P'}, {"endorsePasswd",1,NULL,'e'}, {"inFile",1,NULL,'f'}, {"outFile",1,NULL,'o'}, {"passwdInHex",0,NULL,'X'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {0,0,0,0}, }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, H_flag = 0, c_flag = 0, k_flag = 0, C_flag = 0, e_flag = 0, P_flag = 0, f_flag = 0, o_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } cmdAuth.hmac.t.size = 0; cmdAuth2.hmac.t.size = 0; while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'H': if(getSizeUint32Hex(optarg,&activateHandle) != 0) { returnVal = -1; break; } H_flag = 1; break; case 'c': contextFilePath = optarg; if(contextFilePath == NULL || contextFilePath[0] == '\0') { returnVal = -2; break; } printf("contextFile = %s\n", contextFilePath); c_flag = 1; break; case 'k': if(getSizeUint32Hex(optarg,&keyHandle) != 0) { returnVal = -3; break; } k_flag = 1; break; case 'C': keyContextFilePath = optarg; if(keyContextFilePath == NULL || keyContextFilePath[0] == '\0') { returnVal = -4; break; } printf("keyContextFile = %s\n", keyContextFilePath); C_flag = 1; break; case 'P': cmdAuth.hmac.t.size = sizeof(cmdAuth.hmac.t) - 2; if(str2ByteStructure(optarg,&cmdAuth.hmac.t.size,cmdAuth.hmac.t.buffer) != 0) { returnVal = -5; break; } P_flag = 1; break; case 'e': cmdAuth2.hmac.t.size = sizeof(cmdAuth2.hmac.t) - 2; if(str2ByteStructure(optarg,&cmdAuth2.hmac.t.size,cmdAuth2.hmac.t.buffer) != 0) { returnVal = -6; break; } e_flag = 1; break; case 'f': if(readCrtSecFromFile(optarg,&credentialBlob,&secret) != 0) { returnVal = -7; break; } f_flag = 1; break; case 'o': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); #if 0 if(checkOutFile(outFilePath) != 0) { returnVal = -1; break; } #endif o_flag = 1; break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -8; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -9; } break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -10; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -11; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + H_flag + c_flag + k_flag + C_flag + f_flag + o_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -12; } } else if((flagCnt == 4) && (H_flag == 1 || c_flag == 1) && (k_flag == 1 || C_flag == 1) && (f_flag == 1) && (o_flag == 1)) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &activateHandle, contextFilePath); if(C_flag && returnVal == 0) returnVal = loadTpmContextFromFile(sysContext, &keyHandle, keyContextFilePath); if(returnVal == 0) returnVal = activateCredential(); finishTest(); if(returnVal) return -13; } else { showArgMismatch(argv[0]); return -14; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_akparse.cpp000066400000000000000000000166751300711361400175650ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" char akDataFile[PATH_MAX]; char akKeyFile[PATH_MAX]; void SaveWithBigEndian(FILE *file, const UINT16 &data) { BYTE tmp = (const BYTE)((data & 0xFF00) >> 8); fwrite(&tmp, sizeof(BYTE), 1, file); tmp = (const BYTE)(data & 0x00FF); fwrite(&tmp, sizeof(BYTE), 1, file); } // CPU is little endian, so bytes need to be swapped in order to use bt java. template int SaveKeyToFile(const char keyfile[], UINT16 algType, const T &t) { FILE *f; UINT32 count; if( (f = fopen(keyfile, "wb+")) == NULL ) { printf("file(%s) open error.\n", keyfile); return -1; } printf("file(%s) open success.\n ", keyfile); SaveWithBigEndian(f, algType); SaveWithBigEndian(f, t.size); // fwrite(&algType, sizeof(UINT16), 1, f);// or we can use ChangeEndianWord() to swap the byte. // fwrite(&t.size, sizeof(UINT16), 1, f); if( ( count = fwrite(&t.buffer[0], sizeof(BYTE), t.size, f) ) != t.size ) { printf("write key file error\n"); fclose(f); return -2; } fclose(f); f = NULL; printf("write data count: %d, %s: \n", count, keyfile); PrintSizedBuffer((TPM2B *)&t); return 0; } int SaveEccKeyToFile(const char keyfile[], UINT16 algType, const TPMS_ECC_POINT &ecc) { FILE *f; UINT16 count, size; if( (f = fopen(keyfile, "wb+")) == NULL ) { printf("file(%s) open error.\n", keyfile); return -1; } printf("file(%s) open success.\n ", keyfile); // fwrite(&algType, sizeof(UINT16), 1, f); SaveWithBigEndian(f, algType); size = ecc.x.t.size; // fwrite(&size, sizeof(UINT16), 1, f); SaveWithBigEndian(f, size); if( ( count = fwrite(&ecc.x.t.buffer[0], sizeof(BYTE), size, f) ) != size ) { printf("write X coordinate to file error\n"); fclose(f); return -2; } printf("write X coordinate count: %d, X coordinate: \n", count); PrintSizedBuffer((TPM2B *)&ecc.x); size = ecc.y.t.size; // fwrite(&size, sizeof(UINT16), 1, f); SaveWithBigEndian(f, size); if( ( count = fwrite(&ecc.y.t.buffer[0], sizeof(BYTE), size, f) ) != size ) { printf("write Y coordinate to file error\n"); fclose(f); return -3; } printf("write Y coordinate count: %d, Y coordinate: \n", count); PrintSizedBuffer((TPM2B *)&ecc.y); fclose(f); f = NULL; return 0; } int parseAKPublicArea() { TPM2B_PUBLIC outPublic; UINT16 size = sizeof(outPublic); if( loadDataFromFile(akDataFile, (UINT8 *)&outPublic, &size) ) { return -1; } if( TPM_ALG_RSA == outPublic.t.publicArea.type ) { if(SaveKeyToFile(akKeyFile, TPM_ALG_RSA, outPublic.t.publicArea.unique.rsa.t)) return -2; } else if( TPM_ALG_ECC == outPublic.t.publicArea.type ) { if(SaveEccKeyToFile(akKeyFile, TPM_ALG_ECC, outPublic.t.publicArea.unique.ecc)) return -3; } else if( TPM_ALG_KEYEDHASH == outPublic.t.publicArea.type ) { if(SaveKeyToFile(akKeyFile, TPM_ALG_KEYEDHASH, outPublic.t.publicArea.unique.keyedHash.t)) return -4; } else if( TPM_ALG_SYMCIPHER == outPublic.t.publicArea.type ) { if(SaveKeyToFile(akKeyFile, TPM_ALG_SYMCIPHER, outPublic.t.publicArea.unique.sym.t)) return -5; } else { printf("\nThe algorithm type(0x%4.4x) is not supported\n", outPublic.t.publicArea.type); return -6; } return 0; } void showHelp(const char *name) { showVersion(name); printf("\nUsed to parse the algorithm and key values in TPM2B_PUBLIC struct\n" "Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-f inputFile][-k akKeyFile]\n" " -h\tDisplay command tool usage info.\n" " -v\tDisplay command tool version info.\n" " -f\tSpecifies the file used to be parsed.\n" " -k\tSpecifies the file used to save ak key.\n" "\nFor Example:\n" " %s -f ./ak.data -k ./ak.key\n" , name, name, name, name); } int main(int argc, char *argv[]) { int opt; int rval = 0; struct option sOpts[] = { { "file" , required_argument, NULL, 'f' }, { "keyFile" , required_argument, NULL, 'k' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { NULL , no_argument, NULL, 0 }, }; if(argc <= 1) { showHelp(argv[0]); return -1; } if( argc > (int)(2*sizeof(sOpts)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -2; } while ( ( opt = getopt_long( argc, argv, "f:k:hv", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'f': if( optarg == NULL ) { printf("\nPlease input the file that used to be parsed.\n"); return -3; } safeStrNCpy( &akDataFile[0], optarg, sizeof(akDataFile) ); break; case 'k': if( optarg == NULL ) { printf("\nPlease input the file that used to save ak key.\n"); return -4; } safeStrNCpy( &akKeyFile[0], optarg, sizeof(akKeyFile) ); break; default: showHelp(argv[0]); return -5; } } rval = parseAKPublicArea(); return rval ? -6 : 0; } tpm2.0-tools-1.1.0/src/tpm2_certify.cpp000066400000000000000000000336031300711361400175720ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; TPMS_AUTH_COMMAND cmdAuth, cmdAuth2; bool hexPasswd = false; int getKeyType(TPMI_DH_OBJECT objectHandle, TPMI_ALG_PUBLIC *type) { TPM_RC rval; TPMS_AUTH_RESPONSE sessionDataOut; TPMS_AUTH_RESPONSE *sessionDataOutArray[1] = {&sessionDataOut}; TSS2_SYS_RSP_AUTHS sessionsDataOut = {1, &sessionDataOutArray[0]}; TPM2B_PUBLIC outPublic = { { 0, } }; TPM2B_NAME name = { { sizeof(TPM2B_NAME)-2, } }; TPM2B_NAME qualifiedName = { { sizeof(TPM2B_NAME)-2, } }; rval = Tss2_Sys_ReadPublic(sysContext, objectHandle, 0, &outPublic, &name, &qualifiedName, &sessionsDataOut); if(rval == TPM_RC_SUCCESS) { *type = outPublic.t.publicArea.type; return 0; } return -1; } int setScheme(TPMI_DH_OBJECT keyHandle, TPMI_ALG_HASH halg, TPMT_SIG_SCHEME *inScheme) { TPM_ALG_ID type; if(getKeyType(keyHandle, &type)) return -1; printf("\nkeyType: 0x%04x\n", type); switch(type) { case TPM_ALG_RSA: inScheme->scheme = TPM_ALG_RSASSA; inScheme->details.rsassa.hashAlg = halg; break; case TPM_ALG_KEYEDHASH: inScheme->scheme = TPM_ALG_HMAC; inScheme->details.hmac.hashAlg = halg; break; case TPM_ALG_ECC: inScheme->scheme = TPM_ALG_ECDSA; inScheme->details.ecdsa.hashAlg = halg; break; case TPM_ALG_SYMCIPHER: default: return -2; } return 0; } int certify( TPMI_DH_OBJECT objectHandle, TPMI_DH_OBJECT keyHandle, TPMI_ALG_HASH halg, const char *attestFilePath, const char *sigFilePath) { TPM_RC rval; TPM2B_DATA qualifyingData; UINT8 qualDataString[] = { 0x00, 0xff, 0x55,0xaa }; TPMT_SIG_SCHEME inScheme; TPM2B_ATTEST certifyInfo = { { sizeof(TPM2B_ATTEST)-2, } }; TPMT_SIGNATURE signature; TPMS_AUTH_COMMAND *cmdSessionArray[2] = { &cmdAuth, &cmdAuth2 }; TSS2_SYS_CMD_AUTHS cmdAuthArray = { 2, &cmdSessionArray[0] }; TPMS_AUTH_RESPONSE sessionDataOut1, sessionDataOut2; TPMS_AUTH_RESPONSE *sessionDataOutArray[2] = {&sessionDataOut1, &sessionDataOut2}; TSS2_SYS_RSP_AUTHS sessionsDataOut = {2, &sessionDataOutArray[0]}; printf("\nCERTIFY TESTS:\n"); cmdAuth.sessionHandle = TPM_RS_PW; cmdAuth2.sessionHandle = TPM_RS_PW; *((UINT8 *)((void *)&cmdAuth.sessionAttributes)) = 0; *((UINT8 *)((void *)&cmdAuth2.sessionAttributes)) = 0; if (cmdAuth.hmac.t.size > 0 && hexPasswd) { cmdAuth.hmac.t.size = sizeof(cmdAuth.hmac) - 2; if (hex2ByteStructure((char *)cmdAuth.hmac.t.buffer, &cmdAuth.hmac.t.size, cmdAuth.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for object Passwd.\n"); return -1; } } if (cmdAuth2.hmac.t.size > 0 && hexPasswd) { cmdAuth2.hmac.t.size = sizeof(cmdAuth2.hmac) - 2; if (hex2ByteStructure((char *)cmdAuth2.hmac.t.buffer, &cmdAuth2.hmac.t.size, cmdAuth2.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for key Passwd.\n"); return -1; } } qualifyingData.t.size = sizeof( qualDataString ); memcpy( &( qualifyingData.t.buffer[0] ), qualDataString, sizeof( qualDataString ) ); if ( setScheme(keyHandle, halg, &inScheme) ) { printf("No suitable signing scheme!\n"); return -1; } rval = Tss2_Sys_Certify( sysContext, objectHandle, keyHandle, &cmdAuthArray, &qualifyingData, &inScheme, &certifyInfo, &signature, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("TPM2_Certify failed. Error Code: 0x%x\n",rval); return -2; } printf("\nCertify succ.\n"); if(saveDataToFile(attestFilePath, (UINT8 *)certifyInfo.t.attestationData, certifyInfo.t.size)) return -3; printf("attestFile %s completed!\n",attestFilePath); if(saveDataToFile(sigFilePath, (UINT8 *)&signature, sizeof(signature))) return -4; printf("sigFile %s completed!\n",sigFilePath); return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-H, --objHandle handle of the object to be certified\n" "-C, --objContext filename of the object context to be certified\n" "-k, --keyHandle handle of the key used to sign the attestation structure\n" "-c, --keyContext filename of the key context used to sign the attestation structure\n" "-P, --pwdo the object handle's password, optional\n" "-K, --pwdk the keyHandle's password, optional\n" "-g, --halg the hash algorithm used to digest the message\n" "\t0x0004 TPM_ALG_SHA1\n" "\t0x000B TPM_ALG_SHA256\n" "\t0x000C TPM_ALG_SHA384\n" "\t0x000D TPM_ALG_SHA512\n" "\t0x0012 TPM_ALG_SM3_256\n" "-a, --attestFile output file name, record the attestation structure\n" "-s, --sigFile output file name, record the signature structure\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -H 0x81010002 -k 0x81010001 -P 0x0011 -K 0x00FF -g 0x00B -a -s \n" "%s -H 0x81010002 -k 0x81010001 -g 0x00B -a -s \n\n"// -i \n\n",DEFAULT_TPM_PORT); "%s -H 0x81010002 -k 0x81010001 -P 0011 -K 00FF -X -g 0x00B -a -s \n" , name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT;//DEFAULT_TPM_PORT; char attestFilePath[PATH_MAX] = {0}; char sigFilePath[PATH_MAX] = {0}; TPMI_DH_OBJECT objectHandle; TPMI_DH_OBJECT keyHandle; TPMI_ALG_HASH halg; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvH:k:P:K:g:a:s:p:d:C:c:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"objectHandle",1,NULL,'H'}, {"keyHandle",1,NULL,'k'}, {"pwdo",1,NULL,'P'}, {"pwdk",1,NULL,'K'}, {"halg",1,NULL,'g'}, {"attestFile",1,NULL,'a'}, {"sigFile",1,NULL,'s'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"objContext",1,NULL,'C'}, {"keyContext",1,NULL,'c'}, {"passwdInHex",0,NULL,'X'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, H_flag = 0, k_flag = 0, P_flag = 0, K_flag = 0, g_flag = 0, a_flag = 0, c_flag = 0, C_flag = 0, s_flag = 0; char *contextFile = NULL; char *contextKeyFile = NULL; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'H': if(getSizeUint32Hex(optarg,&objectHandle) != 0) { returnVal = -1; break; } H_flag = 1; break; case 'k': if(getSizeUint32Hex(optarg,&keyHandle) != 0) { returnVal = -2; break; } k_flag = 1; break; case 'P': cmdAuth.hmac.t.size = sizeof(cmdAuth.hmac.t) - 2; if(str2ByteStructure(optarg,&cmdAuth.hmac.t.size,cmdAuth.hmac.t.buffer) != 0) { returnVal = -3; break; } P_flag = 1; break; case 'K': cmdAuth2.hmac.t.size = sizeof(cmdAuth2.hmac.t) - 2; if(str2ByteStructure(optarg,&cmdAuth2.hmac.t.size,cmdAuth2.hmac.t.buffer) != 0) { returnVal = -4; break; } K_flag = 1; break; case 'g': if(getSizeUint16Hex(optarg,&halg) != 0) { showArgError(optarg, argv[0]); returnVal = -5; break; } printf("halg = 0x%4.4x\n", halg); g_flag = 1; break; case 'a': safeStrNCpy(attestFilePath, optarg, sizeof(attestFilePath)); if(checkOutFile(attestFilePath) != 0) { returnVal = -6; break; } a_flag = 1; break; case 's': safeStrNCpy(sigFilePath, optarg, sizeof(sigFilePath)); if(checkOutFile(sigFilePath) != 0) { returnVal = -7; break; } s_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -8; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -9; } break; case 'c': contextKeyFile = optarg; if(contextKeyFile == NULL || contextKeyFile[0] == '\0') { returnVal = -10; break; } printf("contextKeyFile = %s\n", contextKeyFile); c_flag = 1; break; case 'C': contextFile = optarg; if(contextFile == NULL || contextFile[0] == '\0') { returnVal = -11; break; } printf("contextFile = %s\n", contextFile); C_flag = 1; break; case 'X': hexPasswd = true; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -12; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -13; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + H_flag + k_flag + g_flag + a_flag + s_flag + c_flag + C_flag; if(P_flag == 0) cmdAuth.hmac.t.size = 0; if(K_flag == 0) cmdAuth2.hmac.t.size = 0; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -14; } } else if((flagCnt == 5) && (H_flag == 1 || C_flag) && (k_flag == 1 || c_flag) && (g_flag == 1) && (a_flag == 1) && (s_flag == 1)) { prepareTest(hostName, port, debugLevel); if(C_flag) returnVal = loadTpmContextFromFile(sysContext, &objectHandle, contextFile); if(returnVal == 0 && c_flag) returnVal = loadTpmContextFromFile(sysContext, &keyHandle, contextKeyFile); if(returnVal == 0) returnVal = certify(objectHandle, keyHandle, halg, attestFilePath, sigFilePath); finishTest(); if(returnVal) return -15; } else { showArgMismatch(argv[0]); return -16; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_create.cpp000066400000000000000000000434721300711361400173750ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; int debugLevel = 0; int setAlg(TPMI_ALG_PUBLIC type,TPMI_ALG_HASH nameAlg,TPM2B_PUBLIC *inPublic, int I_flag) { switch(nameAlg) { case TPM_ALG_SHA1: case TPM_ALG_SHA256: case TPM_ALG_SHA384: case TPM_ALG_SHA512: case TPM_ALG_SM3_256: case TPM_ALG_NULL: inPublic->t.publicArea.nameAlg = nameAlg; break; default: printf("nameAlg algrithm: 0x%0x not support !\n", nameAlg); return -1; } // First clear attributes bit field. *(UINT32 *)&(inPublic->t.publicArea.objectAttributes) = 0; inPublic->t.publicArea.objectAttributes.restricted = 0; inPublic->t.publicArea.objectAttributes.userWithAuth = 1; inPublic->t.publicArea.objectAttributes.decrypt = 1; inPublic->t.publicArea.objectAttributes.sign = 1; inPublic->t.publicArea.objectAttributes.fixedTPM = 1; inPublic->t.publicArea.objectAttributes.fixedParent = 1; inPublic->t.publicArea.objectAttributes.sensitiveDataOrigin = 1; inPublic->t.publicArea.type = type; switch(type) { case TPM_ALG_RSA: inPublic->t.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM_ALG_NULL; inPublic->t.publicArea.parameters.rsaDetail.scheme.scheme = TPM_ALG_NULL; inPublic->t.publicArea.parameters.rsaDetail.keyBits = 2048; inPublic->t.publicArea.parameters.rsaDetail.exponent = 0; inPublic->t.publicArea.unique.rsa.t.size = 0; break; case TPM_ALG_KEYEDHASH: inPublic->t.publicArea.unique.keyedHash.t.size = 0; inPublic->t.publicArea.objectAttributes.decrypt = 0; if (I_flag) { // sealing inPublic->t.publicArea.objectAttributes.sign = 0; inPublic->t.publicArea.objectAttributes.sensitiveDataOrigin = 0; inPublic->t.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM_ALG_NULL; } else { // hmac inPublic->t.publicArea.objectAttributes.sign = 1; inPublic->t.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM_ALG_HMAC; inPublic->t.publicArea.parameters.keyedHashDetail.scheme.details.hmac.hashAlg = nameAlg; //for tpm2_hmac multi alg } break; case TPM_ALG_ECC: inPublic->t.publicArea.parameters.eccDetail.symmetric.algorithm = TPM_ALG_NULL; inPublic->t.publicArea.parameters.eccDetail.scheme.scheme = TPM_ALG_NULL; inPublic->t.publicArea.parameters.eccDetail.curveID = TPM_ECC_NIST_P256; inPublic->t.publicArea.parameters.eccDetail.kdf.scheme = TPM_ALG_NULL; inPublic->t.publicArea.unique.ecc.x.t.size = 0; inPublic->t.publicArea.unique.ecc.y.t.size = 0; break; case TPM_ALG_SYMCIPHER: inPublic->t.publicArea.parameters.symDetail.sym.algorithm = TPM_ALG_AES; inPublic->t.publicArea.parameters.symDetail.sym.keyBits.sym = 128; inPublic->t.publicArea.parameters.symDetail.sym.mode.sym = TPM_ALG_CFB; inPublic->t.publicArea.unique.sym.t.size = 0; break; default: printf("type algrithm: 0x%0x not support !\n",type); return -2; } return 0; } int create(TPMI_DH_OBJECT parentHandle, TPM2B_PUBLIC *inPublic, TPM2B_SENSITIVE_CREATE *inSensitive, TPMI_ALG_PUBLIC type, TPMI_ALG_HASH nameAlg, const char *opuFilePath, const char *oprFilePath, int o_flag, int O_flag, int I_flag, int A_flag, UINT32 objectAttributes) { TPM_RC rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_DATA outsideInfo = { { 0, } }; TPML_PCR_SELECTION creationPCR; TPM2B_PUBLIC outPublic = { { 0, } }; TPM2B_PRIVATE outPrivate = { { sizeof(TPM2B_PRIVATE)-2, } }; TPM2B_CREATION_DATA creationData = { { 0, } }; TPM2B_DIGEST creationHash = { { sizeof(TPM2B_DIGEST)-2, } }; TPMT_TK_CREATION creationTicket = { 0, }; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionsData.cmdAuthsCount = 1; sessionsData.cmdAuths[0] = &sessionData; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for parent Passwd.\n"); return -1; } } if (inSensitive->t.sensitive.userAuth.t.size > 0 && hexPasswd) { inSensitive->t.sensitive.userAuth.t.size = sizeof(inSensitive->t.sensitive.userAuth) - 2; if (hex2ByteStructure((char *)inSensitive->t.sensitive.userAuth.t.buffer, &inSensitive->t.sensitive.userAuth.t.size, inSensitive->t.sensitive.userAuth.t.buffer) != 0) { printf( "Failed to convert Hex format password for object Passwd.\n"); return -1; } } inSensitive->t.size = inSensitive->t.sensitive.userAuth.b.size + 2; if(setAlg(type, nameAlg, inPublic, I_flag)) return -1; if(A_flag == 1) inPublic->t.publicArea.objectAttributes.val = objectAttributes; printf("ObjectAttribute: 0x%08X\n",inPublic->t.publicArea.objectAttributes.val); creationPCR.count = 0; rval = Tss2_Sys_Create(sysContext, parentHandle, &sessionsData, inSensitive, inPublic, &outsideInfo, &creationPCR, &outPrivate,&outPublic,&creationData, &creationHash, &creationTicket, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\nCreate Object Failed ! ErrorCode: 0x%0x\n\n",rval); return -2; } printf("\nCreate Object Succeed !\n"); if(o_flag == 1) { if(saveDataToFile(opuFilePath, (UINT8 *)&outPublic, sizeof(outPublic))) return -3; } if(O_flag == 1) { if(saveDataToFile(oprFilePath, (UINT8 *)&outPrivate, sizeof(outPrivate))) return -4; } return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-H, --parent parent handle\n" "-c, --contextParent filename for parent context\n" "-P, --pwdp password for parent key, optional\n" "-K, --pwdk password for key, optional\n" "-g, --halg algorithm used for computing the Name of the object\n" "\t0x0004 TPM_ALG_SHA1\n" "\t0x000B TPM_ALG_SHA256\n" "\t0x000C TPM_ALG_SHA384\n" "\t0x000D TPM_ALG_SHA512\n" "\t0x0012 TPM_ALG_SM3_256\n" "-G, --kalg algorithm associated with this object\n" "\t0x0001 TPM_ALG_RSA\n" "\t0x0008 TPM_ALG_KEYEDHASH\n" "\t0x0023 TPM_ALG_ECC\n" "\t0x0025 TPM_ALG_SYMCIPHER\n" "-A, --objectAttribute object attributes, optional\n" "-I, --inFile data file to be sealed, optional\n" "-L, --pol the input policy file, optional\n" "-o, --opu the output file which contains the public key, optional\n" "-O, --opr the output file which contains the private key, optional\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -H 0x80000000 -P abc123 -K def456 -g 0x000B -G 0x0008 -I data.File -o opu.File\n" "%s -H 0x80000000 -g 0x000B -G 0x0008 -I data.File -o opu.File -O opr.File\n\n"// -i \n\n",DEFAULT_TPM_PORT); "%s -H 0x80000000 -P 123abc -K 456def -X -g 0x000B -G 0x0008 -I data.File -o opu.File\n" ,name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPM2B_SENSITIVE_CREATE inSensitive; inSensitive.t.sensitive.data.t.size = 0; TPM2B_PUBLIC inPublic; TPMI_ALG_PUBLIC type; TPMI_ALG_HASH nameAlg; TPMI_DH_OBJECT parentHandle; UINT32 objectAttributes = 0; char opuFilePath[PATH_MAX] = {0}; char oprFilePath[PATH_MAX] = {0}; char *contextParentFilePath = NULL; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvH:P:K:g:G:A:I:L:o:O:p:d:c:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"parent",1,NULL,'H'}, {"pwdp",1,NULL,'P'}, {"pwdk",1,NULL,'K'}, {"halg",1,NULL,'g'}, {"kalg",1,NULL,'G'}, {"objectAttributes",1,NULL,'A'}, {"inFile",1,NULL,'I'}, {"policyFile",1,NULL,'L'}, {"opu",1,NULL,'o'}, {"opr",1,NULL,'O'}, {"contextParent",1,NULL,'c'}, {"passwdInHex",0,NULL,'X'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, H_flag = 0, P_flag = 0, K_flag = 0, g_flag = 0, G_flag = 0, A_flag = 0, I_flag = 0, L_flag = 0, o_flag = 0, c_flag = 0, O_flag = 0/*, f_flag = 0*/; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'H': if(getSizeUint32Hex(optarg,&parentHandle) != 0) { showArgError(optarg, argv[0]); returnVal = -1; break; } H_flag = 1; break; case 'P': sessionData.hmac.t.size = sizeof(sessionData.hmac.t) - 2; if(str2ByteStructure(optarg,&sessionData.hmac.t.size,sessionData.hmac.t.buffer) != 0) { returnVal = -2; break; } P_flag = 1; break; case 'K': inSensitive.t.sensitive.userAuth.t.size = sizeof(inSensitive.t.sensitive.userAuth.t) - 2; if(str2ByteStructure(optarg,&inSensitive.t.sensitive.userAuth.t.size, inSensitive.t.sensitive.userAuth.t.buffer) != 0) { returnVal = -3; break; } K_flag = 1; break; case 'g': if(getSizeUint16Hex(optarg,&nameAlg) != 0) { showArgError(optarg, argv[0]); returnVal = -4; break; } printf("nameAlg = 0x%4.4x\n", nameAlg); g_flag = 1; break; case 'G': if(getSizeUint16Hex(optarg,&type) != 0) { showArgError(optarg, argv[0]); returnVal = -5; break; } printf("type = 0x%4.4x\n", type); G_flag = 1; break; case 'A': if(getSizeUint32Hex(optarg,&objectAttributes) != 0) { showArgError(optarg, argv[0]); returnVal = -6; break; } A_flag = 1;//H_flag = 1; break; case 'I': inSensitive.t.sensitive.data.t.size = sizeof(inSensitive.t.sensitive.data) - 2; if(loadDataFromFile(optarg, inSensitive.t.sensitive.data.t.buffer, &inSensitive.t.sensitive.data.t.size) != 0) { returnVal = -7; break; } I_flag = 1; printf("inSensitive.t.sensitive.data.t.size = %d\n",inSensitive.t.sensitive.data.t.size); break; case 'L': inPublic.t.publicArea.authPolicy.t.size = sizeof(inPublic.t.publicArea.authPolicy) - 2; if(loadDataFromFile(optarg, inPublic.t.publicArea.authPolicy.t.buffer, &inPublic.t.publicArea.authPolicy.t.size) != 0) { returnVal = -8; break; } L_flag = 1; break; case 'o': safeStrNCpy(opuFilePath, optarg, sizeof(opuFilePath)); if(checkOutFile(opuFilePath) != 0) { returnVal = -9; break; } o_flag = 1; break; case 'O': safeStrNCpy(oprFilePath, optarg, sizeof(oprFilePath)); if(checkOutFile(oprFilePath) != 0) { returnVal = -10; break; } O_flag = 1; break; case 'c': contextParentFilePath = optarg; if(contextParentFilePath == NULL || contextParentFilePath[0] == '\0') { returnVal = -11; break; } printf("contextParentFile = %s\n", contextParentFilePath); c_flag = 1; break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -12; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -13; } break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -14; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -15; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; if(P_flag == 0) sessionData.hmac.t.size = 0; if(I_flag == 0) inSensitive.t.sensitive.data.t.size = 0; if(K_flag == 0) inSensitive.t.sensitive.userAuth.t.size = 0; if(L_flag == 0) inPublic.t.publicArea.authPolicy.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; flagCnt = h_flag + v_flag + H_flag + g_flag + G_flag + c_flag ; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -16; } } else if(flagCnt == 3 && (H_flag == 1 || c_flag == 1) && g_flag == 1 && G_flag == 1) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &parentHandle, contextParentFilePath); if(returnVal == 0) returnVal = create(parentHandle, &inPublic, &inSensitive, type, nameAlg, opuFilePath, oprFilePath, o_flag, O_flag, I_flag, A_flag, objectAttributes); finishTest(); if(returnVal) return -17; } else { showArgMismatch(argv[0]); return -18; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_createprimary.cpp000066400000000000000000000356761300711361400210100ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; TPM_HANDLE handle2048rsa; int setAlg(TPMI_ALG_PUBLIC type,TPMI_ALG_HASH nameAlg,TPM2B_PUBLIC *inPublic) { switch(nameAlg) { case TPM_ALG_SHA1: case TPM_ALG_SHA256: case TPM_ALG_SHA384: case TPM_ALG_SHA512: case TPM_ALG_SM3_256: case TPM_ALG_NULL: inPublic->t.publicArea.nameAlg = nameAlg; break; default: printf("nameAlg algrithm: 0x%0x not support !\n", nameAlg); return -1; } // First clear attributes bit field. *(UINT32 *)&(inPublic->t.publicArea.objectAttributes) = 0; inPublic->t.publicArea.objectAttributes.restricted = 1; inPublic->t.publicArea.objectAttributes.userWithAuth = 1; inPublic->t.publicArea.objectAttributes.decrypt = 1; inPublic->t.publicArea.objectAttributes.fixedTPM = 1; inPublic->t.publicArea.objectAttributes.fixedParent = 1; inPublic->t.publicArea.objectAttributes.sensitiveDataOrigin = 1; inPublic->t.publicArea.authPolicy.t.size = 0; inPublic->t.publicArea.type = type; switch(type) { case TPM_ALG_RSA: inPublic->t.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM_ALG_AES; inPublic->t.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 128; inPublic->t.publicArea.parameters.rsaDetail.symmetric.mode.aes = TPM_ALG_CFB; inPublic->t.publicArea.parameters.rsaDetail.scheme.scheme = TPM_ALG_NULL; inPublic->t.publicArea.parameters.rsaDetail.keyBits = 2048; inPublic->t.publicArea.parameters.rsaDetail.exponent = 0; inPublic->t.publicArea.unique.rsa.t.size = 0; break; case TPM_ALG_KEYEDHASH: inPublic->t.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM_ALG_XOR; inPublic->t.publicArea.parameters.keyedHashDetail.scheme.details.exclusiveOr.hashAlg = TPM_ALG_SHA256; inPublic->t.publicArea.parameters.keyedHashDetail.scheme.details.exclusiveOr.kdf = TPM_ALG_KDF1_SP800_108; inPublic->t.publicArea.unique.keyedHash.t.size = 0; break; case TPM_ALG_ECC: inPublic->t.publicArea.parameters.eccDetail.symmetric.algorithm = TPM_ALG_AES; inPublic->t.publicArea.parameters.eccDetail.symmetric.keyBits.aes = 128; inPublic->t.publicArea.parameters.eccDetail.symmetric.mode.sym = TPM_ALG_CFB; inPublic->t.publicArea.parameters.eccDetail.scheme.scheme = TPM_ALG_NULL; inPublic->t.publicArea.parameters.eccDetail.curveID = TPM_ECC_NIST_P256; inPublic->t.publicArea.parameters.eccDetail.kdf.scheme = TPM_ALG_NULL; inPublic->t.publicArea.unique.ecc.x.t.size = 0; inPublic->t.publicArea.unique.ecc.y.t.size = 0; break; case TPM_ALG_SYMCIPHER: inPublic->t.publicArea.parameters.symDetail.sym.algorithm = TPM_ALG_AES; inPublic->t.publicArea.parameters.symDetail.sym.keyBits.sym = 128; inPublic->t.publicArea.parameters.symDetail.sym.mode.sym = TPM_ALG_CFB; inPublic->t.publicArea.unique.sym.t.size = 0; break; default: printf("type algrithm: 0x%0x not support !\n",type); return -2; } return 0; } int createPrimary(TPMI_RH_HIERARCHY hierarchy, TPM2B_PUBLIC *inPublic, TPM2B_SENSITIVE_CREATE *inSensitive, TPMI_ALG_PUBLIC type, TPMI_ALG_HASH nameAlg, int P_flag, int K_flag) { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_DATA outsideInfo = { { 0, } }; TPML_PCR_SELECTION creationPCR; TPM2B_NAME name = { { sizeof(TPM2B_NAME)-2, } }; TPM2B_PUBLIC outPublic = { { 0, } }; TPM2B_CREATION_DATA creationData = { { 0, } }; TPM2B_DIGEST creationHash = { { sizeof(TPM2B_DIGEST)-2, } }; TPMT_TK_CREATION creationTicket = { 0, }; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsData.cmdAuthsCount = 1; sessionsDataOut.rspAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; if(P_flag == 0) sessionData.hmac.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for hierarchy Passwd.\n"); return -1; } } if(K_flag == 0) inSensitive->t.sensitive.userAuth.t.size = 0; if (inSensitive->t.sensitive.userAuth.t.size > 0 && hexPasswd) { inSensitive->t.sensitive.userAuth.t.size = sizeof(inSensitive->t.sensitive.userAuth) - 2; if (hex2ByteStructure((char *)inSensitive->t.sensitive.userAuth.t.buffer, &inSensitive->t.sensitive.userAuth.t.size, inSensitive->t.sensitive.userAuth.t.buffer) != 0) { printf( "Failed to convert Hex format password for primary Passwd.\n"); return -1; } } inSensitive->t.sensitive.data.t.size = 0; inSensitive->t.size = inSensitive->t.sensitive.userAuth.b.size + 2; if(setAlg(type, nameAlg, inPublic)) return -1; creationPCR.count = 0; rval = Tss2_Sys_CreatePrimary(sysContext, hierarchy, &sessionsData, inSensitive, inPublic, &outsideInfo, &creationPCR, &handle2048rsa, &outPublic, &creationData, &creationHash, &creationTicket, &name, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\nCreatePrimary Failed ! ErrorCode: 0x%0x\n\n",rval); return -2; } printf("\nCreatePrimary Succeed ! Handle: 0x%8.8x\n\n",handle2048rsa); return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-A, --auth the authorization used to authorize thecommands\n" "\to TPM_RH_OWNER\n" "\tp TPM_RH_PLATFORM\n" "\te TPM_RH_ENDORSEMENT\n" "\tn TPM_RH_NULL\n" "-P, --pwdp password for hierarchy, optional\n" "-K, --pwdk password for key, optional\n" "-g, --halg algorithm used for computing the Name of the object\n" "\t0x0004 TPM_ALG_SHA1\n" "\t0x000B TPM_ALG_SHA256\n" "\t0x000C TPM_ALG_SHA384\n" "\t0x000D TPM_ALG_SHA512\n" "\t0x0012 TPM_ALG_SM3_256\n" "-G, --kalg algorithm associated with this object\n" "\t0x0001 TPM_ALG_RSA\n" "\t0x0008 TPM_ALG_KEYEDHASH\n" "\t0x0023 TPM_ALG_ECC\n" "\t0x0025 TPM_ALG_SYMCIPHER\n" "-C, --context The file to save the object context, optional\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -A e -P abc123 -K def456 -g 0x000B -G 0x0008 \n" "%s -A p -g 0x000B -G 0x0008\n\n"//-i \n\n" "%s -A e -P 1a1b1c -K 456def -X -g 0x000B -G 0x0008 \n" , name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPM2B_SENSITIVE_CREATE inSensitive; TPM2B_PUBLIC inPublic; TPMI_ALG_PUBLIC type; TPMI_ALG_HASH nameAlg; TPMI_RH_HIERARCHY hierarchy = TPM_RH_NULL; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvA:P:K:g:G:p:d:C:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"auth",1,NULL,'A'}, {"pwdp",1,NULL,'P'}, {"pwdk",1,NULL,'K'}, {"halg",1,NULL,'g'}, {"kalg",1,NULL,'G'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"context",1,NULL,'C'}, {"passwdInHex",0,NULL,'X'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, A_flag = 0, P_flag = 0, K_flag = 0, g_flag = 0, G_flag = 0, C_flag = 0; char *contextFile = NULL; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'A': if(strcmp(optarg,"o") == 0 || strcmp(optarg,"O") == 0) hierarchy = TPM_RH_OWNER; else if(strcmp(optarg,"p") == 0 || strcmp(optarg,"P") == 0) hierarchy = TPM_RH_PLATFORM; else if(strcmp(optarg,"e") == 0 || strcmp(optarg,"E") == 0) hierarchy = TPM_RH_ENDORSEMENT; else if(strcmp(optarg,"n") == 0 || strcmp(optarg,"N") == 0) hierarchy = TPM_RH_NULL; else { returnVal = -1; break; } A_flag = 1; break; case 'P': sessionData.hmac.t.size = sizeof(sessionData.hmac.t) - 2; if(str2ByteStructure(optarg,&sessionData.hmac.t.size,sessionData.hmac.t.buffer) != 0) { returnVal = -2; break; } P_flag = 1; break; case 'K': inSensitive.t.sensitive.userAuth.t.size = sizeof(inSensitive.t.sensitive.userAuth.t) - 2; if(str2ByteStructure(optarg,&inSensitive.t.sensitive.userAuth.t.size, inSensitive.t.sensitive.userAuth.t.buffer) != 0) { returnVal = -3; break; } K_flag = 1; break; case 'g': if(getSizeUint16Hex(optarg,&nameAlg) != 0) { showArgError(optarg, argv[0]); returnVal = -4; break; } printf("nameAlg = 0x%4.4x\n", nameAlg); g_flag = 1; break; case 'G': if(getSizeUint16Hex(optarg,&type) != 0) { showArgError(optarg, argv[0]); returnVal = -5; break; } printf("type = 0x%4.4x\n", type); G_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -6; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -7; } break; case 'C': contextFile = optarg; if(contextFile == NULL || contextFile[0] == '\0') { returnVal = -8; break; } printf("contextFile = %s\n", contextFile); C_flag = 1; break; case 'X': hexPasswd = true; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -9; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -10; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + A_flag + g_flag + G_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -11; } } else if(flagCnt == 3 && A_flag == 1 && g_flag == 1 && G_flag == 1) { prepareTest(hostName, port, debugLevel); returnVal = createPrimary(hierarchy, &inPublic, &inSensitive, type, nameAlg, P_flag, K_flag); if (returnVal == 0 && C_flag) returnVal = saveTpmContextToFile(sysContext, handle2048rsa, contextFile); finishTest(); if(returnVal) return -12; } else { showArgMismatch(argv[0]); return -13; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_encryptdecrypt.cpp000066400000000000000000000245641300711361400212120ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; int encryptDecrypt(TPMI_DH_OBJECT keyHandle, TPMI_YES_NO decryptVal, TPM2B_MAX_BUFFER *inData, const char *outFilePath) { UINT32 rval; // Inputs TPMI_ALG_SYM_MODE mode; TPM2B_IV ivIn; // Outputs TPM2B_MAX_BUFFER outData = { { sizeof(TPM2B_MAX_BUFFER)-2, } }; TPM2B_IV ivOut = { { sizeof(TPM2B_IV)-2, } }; TSS2_SYS_CMD_AUTHS sessionsData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; sessionDataArray[0] = &sessionData; sessionsData.cmdAuths = &sessionDataArray[0]; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for key Passwd.\n"); return -1; } } sessionsData.cmdAuthsCount = 1; sessionsData.cmdAuths[0] = &sessionData; mode = TPM_ALG_NULL; ivIn.t.size = MAX_SYM_BLOCK_SIZE; memset(ivIn.t.buffer, 0, MAX_SYM_BLOCK_SIZE); if(decryptVal == NO) printf("\nENCRYPTDECRYPT: ENCRYPT\n"); if(decryptVal == YES) printf("\nENCRYPTDECRYPT: DECRYPT\n"); rval = Tss2_Sys_EncryptDecrypt(sysContext, keyHandle, &sessionsData, decryptVal, mode, &ivIn, inData, &outData, &ivOut, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("EncryptDecrypt failed, error code: 0x%x\n", rval); return -1; } printf("\nEncryptDecrypt succ.\n"); if(saveDataToFile(outFilePath, (UINT8 *)outData.t.buffer, outData.t.size)) return -2; printf("OutFile %s completed!\n", outFilePath); return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-k, --keyHandle the symmetric key used for the operation(encryption/decryption)\n" "-c, --keyContext filename of the key context used for the operation\n" "-P, --pwdk the password of key, optional\n" "-D, --decrypt the operation type, default NO, optional\n" "\tYES the operation is decryption\n" "\tNO the operation is encryption\n" "-I, --inFile Input file path, containing the data to be operated\n" "-o, --outFile Output file path, record the operated data\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -k 0x81010001 -P abc123 -D NO -I -o \n" "%s -k 0x81010001 -I -o \n\n"// -i \n\n",DEFAULT_TPM_PORT); "%s -k 0x81010001 -P 123abc -X -D NO -I -o \n" ,name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; //DEFAULT_TPM_PORT; TPMI_DH_OBJECT keyHandle; TPMI_YES_NO decryptVal = NO; TPM2B_MAX_BUFFER inData; char outFilePath[PATH_MAX] = {0}; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvk:P:D:I:o:p:d:c:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"keyHandle",1,NULL,'k'}, {"pwdk",1,NULL,'P'}, {"decrypt",1,NULL,'D'}, {"inFile",1,NULL,'I'}, {"outFile",1,NULL,'o'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"keyContext",1,NULL,'c'}, {"passwdInHex",0,NULL,'X'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, k_flag = 0, P_flag = 0, I_flag = 0, c_flag = 0, o_flag = 0; char *contextKeyFile = NULL; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'k': if(getSizeUint32Hex(optarg,&keyHandle) != 0) { returnVal = -1; break; } k_flag = 1; break; case 'P': sessionData.hmac.t.size = sizeof(sessionData.hmac.t) - 2; if(str2ByteStructure(optarg,&sessionData.hmac.t.size,sessionData.hmac.t.buffer) != 0) { returnVal = -2; break; } P_flag = 1; break; case 'D': if(strcmp("YES", optarg) == 0) decryptVal = YES; else if(strcmp("NO", optarg) == 0) decryptVal = NO; else { returnVal = -3; showArgError(optarg, argv[0]); break; } break; case 'I': inData.t.size = sizeof(inData) - 2; if(loadDataFromFile(optarg, inData.t.buffer, &inData.t.size) != 0) { returnVal = -4; break; } I_flag = 1; break; case 'o': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -5; break; } o_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -6; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -7; } break; case 'c': contextKeyFile = optarg; if(contextKeyFile == NULL || contextKeyFile[0] == '\0') { returnVal = -8; break; } printf("contextKeyFile = %s\n", contextKeyFile); c_flag = 1; break; case 'X': hexPasswd = true; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -9; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -10; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; if(P_flag == 0) sessionData.hmac.t.size = 0; flagCnt = h_flag + v_flag + k_flag + I_flag + o_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -11; } } else if((flagCnt == 3) && (k_flag == 1 || c_flag == 1) && (I_flag == 1) && (o_flag == 1)) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &keyHandle, contextKeyFile); if (returnVal == 0) returnVal = encryptDecrypt(keyHandle, decryptVal, &inData, outFilePath); finishTest(); if(returnVal) return -12; } else { showArgMismatch(argv[0]); return -13; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_evictcontrol.cpp000066400000000000000000000232601300711361400206360ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; int evictControl(TPMI_RH_PROVISION auth, TPMI_DH_OBJECT objectHandle,TPMI_DH_OBJECT persistentHandle, int P_flag) { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; if(P_flag == 0) sessionData.hmac.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for authorization Passwd.\n"); return -1; } } rval = Tss2_Sys_EvictControl(sysContext, auth, objectHandle, &sessionsData, persistentHandle,&sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\nEvictControl Failed, error code: 0x%0x\n\n",rval); return -1; } printf("\nEvictControl succ.\n"); return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-A, --auth the authorization used to authorize the commands\n" "\to TPM_RH_OWNER\n" "\tp TPM_RH_PLATFORM\n" "-H, --handle the handle of a loaded object\n" "-c, --context filename for object context\n" "-S, --persistent the persistent handle for objectHandle\n" "-P, --pwda authrization password, optional\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -A o -H 0x80000000 -S 0x81010002 -P abc123 \n" "%s -A p -H 0x80000000 -S 0x81010002\n\n"// -i \n\n",DEFAULT_TPM_PORT); "%s -A o -H 0x80000000 -S 0x81010002 -P 123abc -X\n" ,name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; //DEFAULT_TPM_PORT; TPMI_RH_PROVISION auth = TPM_RH_NULL; TPMI_DH_OBJECT objectHandle; TPMI_DH_OBJECT persistentHandle; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvA:H:S:P:p:d:c:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"auth",1,NULL,'A'}, {"handle",1,NULL,'H'}, {"persistent",1,NULL,'S'}, {"pwda",1,NULL,'P'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"context",1,NULL,'c'}, {"passwdInHex",0,NULL,'X'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, A_flag = 0, H_flag = 0, S_flag = 0, c_flag = 0, P_flag = 0; char *contextFile = NULL; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'A': if(strcmp(optarg,"o") == 0 || strcmp(optarg,"O") == 0) auth = TPM_RH_OWNER; else if(strcmp(optarg,"p") == 0 || strcmp(optarg,"P") == 0) auth = TPM_RH_PLATFORM; else { printf("ERROR: auth '%s' not supported!\n", optarg); returnVal = -1; break; } A_flag = 1; break; case 'H': if(getSizeUint32Hex(optarg, &objectHandle) != 0) { returnVal = -2; break; } printf("\nobjectHandle: 0x%x\n\n",objectHandle); H_flag = 1; break; case 'S': if(getSizeUint32Hex(optarg, &persistentHandle) != 0) { returnVal = -3; break; } printf("\npersistentHandle: 0x%x\n\n",persistentHandle); S_flag = 1; break; case 'P': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the authenticating password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); returnVal = -4; break; } if( strlen(optarg) > 0 ) { sessionData.hmac.t.size = strlen(optarg); safeStrNCpy( (char *)&sessionData.hmac.t.buffer[0], optarg, sizeof(sessionData.hmac.t.buffer) ); } P_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -5; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -6; } break; case 'c': contextFile = optarg; if(contextFile == NULL || contextFile[0] == '\0') { returnVal = -7; break; } printf("contextFile = %s\n", contextFile); c_flag = 1; break; case 'X': hexPasswd = true; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -8; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -9; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + A_flag + H_flag + S_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -10; } } else if(flagCnt == 3 && A_flag == 1 && (H_flag == 1 || c_flag) && S_flag == 1) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &objectHandle, contextFile); if (returnVal == 0) returnVal = evictControl(auth, objectHandle, persistentHandle, P_flag); finishTest(); if(returnVal) return -11; } else { showArgMismatch(argv[0]); return -12; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_getmanufec.cpp000066400000000000000000000570001300711361400202400ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; char outputFile[PATH_MAX]; char ownerPasswd[sizeof(TPMU_HA)]; char endorsePasswd[sizeof(TPMU_HA)]; char ekPasswd[sizeof(TPMU_HA)]; bool hexPasswd = false; TPM_HANDLE persistentHandle; UINT32 algorithmType = TPM_ALG_RSA; char ECcertFile[PATH_MAX]; char *EKserverAddr = NULL; unsigned int nonPersistentRead = 0; unsigned int SSL_NO_VERIFY = 0; unsigned int OfflineProv = 0; BYTE authPolicy[] = {0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xB3, 0xF8, 0x1A, 0x90, 0xCC, 0x8D, 0x46, 0xA5, 0xD7, 0x24, 0xFD, 0x52, 0xD7, 0x6E, 0x06, 0x52, 0x0B, 0x64, 0xF2, 0xA1, 0xDA, 0x1B, 0x33, 0x14, 0x69, 0xAA}; int setKeyAlgorithm(UINT16 algorithm, TPM2B_SENSITIVE_CREATE &inSensitive, TPM2B_PUBLIC &inPublic) { inPublic.t.publicArea.nameAlg = TPM_ALG_SHA256; // First clear attributes bit field. *(UINT32 *)&(inPublic.t.publicArea.objectAttributes) = 0; inPublic.t.publicArea.objectAttributes.restricted = 1; inPublic.t.publicArea.objectAttributes.userWithAuth = 0; inPublic.t.publicArea.objectAttributes.adminWithPolicy = 1; inPublic.t.publicArea.objectAttributes.sign = 0; inPublic.t.publicArea.objectAttributes.decrypt = 1; inPublic.t.publicArea.objectAttributes.fixedTPM = 1; inPublic.t.publicArea.objectAttributes.fixedParent = 1; inPublic.t.publicArea.objectAttributes.sensitiveDataOrigin = 1; inPublic.t.publicArea.authPolicy.t.size = 32; memcpy(inPublic.t.publicArea.authPolicy.t.buffer, authPolicy, 32); inPublic.t.publicArea.type = algorithm; switch (algorithm) { case TPM_ALG_RSA: inPublic.t.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM_ALG_AES; inPublic.t.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 128; inPublic.t.publicArea.parameters.rsaDetail.symmetric.mode.aes = TPM_ALG_CFB; inPublic.t.publicArea.parameters.rsaDetail.scheme.scheme = TPM_ALG_NULL; inPublic.t.publicArea.parameters.rsaDetail.keyBits = 2048; inPublic.t.publicArea.parameters.rsaDetail.exponent = 0x0; inPublic.t.publicArea.unique.rsa.t.size = 256; break; case TPM_ALG_KEYEDHASH: inPublic.t.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM_ALG_XOR; inPublic.t.publicArea.parameters.keyedHashDetail.scheme.details.exclusiveOr.hashAlg = TPM_ALG_SHA256; inPublic.t.publicArea.parameters.keyedHashDetail.scheme.details.exclusiveOr.kdf = TPM_ALG_KDF1_SP800_108; inPublic.t.publicArea.unique.keyedHash.t.size = 0; break; case TPM_ALG_ECC: inPublic.t.publicArea.parameters.eccDetail.symmetric.algorithm = TPM_ALG_AES; inPublic.t.publicArea.parameters.eccDetail.symmetric.keyBits.aes = 128; inPublic.t.publicArea.parameters.eccDetail.symmetric.mode.sym = TPM_ALG_CFB; inPublic.t.publicArea.parameters.eccDetail.scheme.scheme = TPM_ALG_NULL; inPublic.t.publicArea.parameters.eccDetail.curveID = TPM_ECC_NIST_P256; inPublic.t.publicArea.parameters.eccDetail.kdf.scheme = TPM_ALG_NULL; inPublic.t.publicArea.unique.ecc.x.t.size = 32; inPublic.t.publicArea.unique.ecc.y.t.size = 32; break; case TPM_ALG_SYMCIPHER: inPublic.t.publicArea.parameters.symDetail.sym.algorithm = TPM_ALG_AES; inPublic.t.publicArea.parameters.symDetail.sym.keyBits.aes = 128; inPublic.t.publicArea.parameters.symDetail.sym.mode.sym = TPM_ALG_CFB; inPublic.t.publicArea.unique.sym.t.size = 0; break; default: printf("\n......The algorithm type input(%4.4x) is not supported!......\n", algorithm); return -1; } return 0; } int createEKHandle() { UINT32 rval; TPMS_AUTH_COMMAND sessionData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_SENSITIVE_CREATE inSensitive = { { sizeof(TPM2B_SENSITIVE_CREATE) - 2, } }; TPM2B_PUBLIC inPublic = { { sizeof(TPM2B_PUBLIC) - 2, } }; TPM2B_DATA outsideInfo = { { 0, } }; TPML_PCR_SELECTION creationPCR; TPM2B_NAME name = { { sizeof(TPM2B_NAME) - 2, } }; TPM2B_PUBLIC outPublic = { { 0, } }; TPM2B_CREATION_DATA creationData = { { 0, } }; TPM2B_DIGEST creationHash = { { sizeof(TPM2B_DIGEST) - 2, } }; TPMT_TK_CREATION creationTicket = { 0, }; TPM_HANDLE handle2048ek; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; // use enAuth in Tss2_Sys_CreatePrimary if (strlen(endorsePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(endorsePasswd); memcpy( &sessionData.hmac.t.buffer[0], endorsePasswd, sessionData.hmac.t.size ); } else if (strlen(endorsePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(endorsePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for endorsePasswd.\n"); return -1; } } if (strlen(ekPasswd) > 0 && !hexPasswd) { inSensitive.t.sensitive.userAuth.t.size = strlen(ekPasswd); memcpy( &inSensitive.t.sensitive.userAuth.t.buffer[0], ekPasswd, inSensitive.t.sensitive.userAuth.t.size ); } else if (strlen(ekPasswd) > 0 && hexPasswd) { inSensitive.t.sensitive.userAuth.t.size = sizeof(inSensitive.t.sensitive.userAuth) - 2; if (hex2ByteStructure(ekPasswd, &inSensitive.t.sensitive.userAuth.t.size, inSensitive.t.sensitive.userAuth.t.buffer) != 0) { printf( "Failed to convert Hex format password for ekPasswd.\n"); return -1; } } inSensitive.t.sensitive.data.t.size = 0; inSensitive.t.size = inSensitive.t.sensitive.userAuth.b.size + 2; if ( setKeyAlgorithm(algorithmType, inSensitive, inPublic) ) return -1; creationPCR.count = 0; /*To Create EK*/ rval = Tss2_Sys_CreatePrimary(sysContext, TPM_RH_ENDORSEMENT, &sessionsData, &inSensitive, &inPublic, &outsideInfo, &creationPCR, &handle2048ek, &outPublic, &creationData, &creationHash, &creationTicket, &name, &sessionsDataOut); if ( rval != TPM_RC_SUCCESS ) { printf("\n......TPM2_CreatePrimary Error. TPM Error:0x%x......\n", rval); return -2; } printf("\nEK create succ.. Handle: 0x%8.8x\n", handle2048ek); if (!nonPersistentRead) { // To make EK persistent, use own auth sessionData.hmac.t.size = 0; if (strlen(ownerPasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(ownerPasswd); memcpy( &sessionData.hmac.t.buffer[0], ownerPasswd, sessionData.hmac.t.size ); } else if (strlen(ownerPasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(ownerPasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for ownerPasswd.\n"); return -1; } } rval = Tss2_Sys_EvictControl(sysContext, TPM_RH_OWNER, handle2048ek, &sessionsData, persistentHandle, &sessionsDataOut); if ( rval != TPM_RC_SUCCESS ) { printf("\n......EvictControl:Make EK persistent Error. TPM Error:0x%x......\n", rval); return -3; } printf("EvictControl EK persistent succ.\n"); } rval = Tss2_Sys_FlushContext(sysContext, handle2048ek); if ( rval != TPM_RC_SUCCESS ) { printf("\n......Flush transient EK failed. TPM Error:0x%x......\n", rval); return -4; } printf("Flush transient EK succ.\n"); // save ek public if ( saveDataToFile(outputFile, (UINT8 *)&outPublic, sizeof(outPublic)) ) { printf("\n......Failed to save EK pub key into file(%s)......\n", outputFile); return -5; } return 0; } unsigned char *HashEKPublicKey(void) { printf("Calculating the SHA256 hash of the Endorsement Public Key\n"); FILE *fp; unsigned char EKpubKey[259]; unsigned char *hash = (unsigned char*)malloc(SHA256_DIGEST_LENGTH); fp = fopen(outputFile, "rb"); if (fp == NULL) printf("File Open Error\n"); else { fseek(fp, 0x66, 0); fread(EKpubKey, 1, 256, fp); } fclose(fp); EKpubKey[256] = 0x01; EKpubKey[257] = 0x00; EKpubKey[258] = 0x01; //Exponent SHA256_CTX sha256; SHA256_Init(&sha256); SHA256_Update(&sha256, EKpubKey, sizeof(EKpubKey)); SHA256_Final(hash, &sha256); for (int i = 0; i < SHA256_DIGEST_LENGTH; i++) printf("%02X", hash[i]); printf("\n"); return hash; } char *Base64Encode(const unsigned char* buffer) { printf("Calculating the Base64Encode of the hash of the Endorsement Public Key:\n"); BIO *bio, *b64; BUF_MEM *bufferPtr; b64 = BIO_new(BIO_f_base64()); bio = BIO_new(BIO_s_mem()); bio = BIO_push(b64, bio); BIO_set_flags(bio, BIO_FLAGS_BASE64_NO_NL); BIO_write(bio, buffer, SHA256_DIGEST_LENGTH); BIO_flush(bio); BIO_get_mem_ptr(bio, &bufferPtr); BIO_set_close(bio, BIO_NOCLOSE); BIO_free_all(bio); char *b64text = (*bufferPtr).data; for (int i = 0; i < strlen(b64text); i++) { if (b64text[i] == '+') b64text[i] = '-'; if (b64text[i] == '/') b64text[i] = '_'; } CURL *curl = curl_easy_init(); if (curl) { char *output = curl_easy_escape(curl, b64text, strlen(b64text)); if (output) { strncpy(b64text, output, strlen(output)); curl_free(output); } } curl_easy_cleanup(curl); curl_global_cleanup(); printf("%s\n", b64text); return b64text; } int RetrieveEndorsementCredentials(char *b64h) { printf("Retrieving Endorsement Credential Certificate from the TPM Manufacturer EK Provisioning Server\n"); char *weblink = (char*)malloc(1 + strlen(b64h) + strlen(EKserverAddr)); memset(weblink, 0, (1 + strlen(b64h) + strlen(EKserverAddr))); strcat(weblink, EKserverAddr); strcat(weblink, b64h); printf("%s\n", weblink); CURL *curl; CURLcode res; FILE * respfile; respfile = fopen(ECcertFile, "wb"); curl_global_init(CURL_GLOBAL_DEFAULT); curl = curl_easy_init(); if (curl) { if (SSL_NO_VERIFY) { curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0); //should not be used - Used only on platforms with older CA certificates. } //curl_easy_setopt(curl, CURLOPT_PINNEDPUBLICKEY, "/home/root/TEMP/intelekserver.pubkey.der"); curl_easy_setopt(curl, CURLOPT_URL, weblink); curl_easy_setopt(curl, CURLOPT_VERBOSE, respfile); curl_easy_setopt(curl, CURLOPT_WRITEDATA, respfile); res = curl_easy_perform(curl); if (res != CURLE_OK) { fprintf(stderr, "\ncurl_easy_perform() failed: %s\n", curl_easy_strerror(res)); } curl_easy_cleanup(curl); } curl_global_cleanup(); printf("\n"); free(weblink); return 0; } int TPMinitialProvisioning(void) { if (EKserverAddr == NULL) { printf("TPM Manufacturer Endorsement Credential Server Address cannot be NULL\n"); return -99; } RetrieveEndorsementCredentials(Base64Encode(HashEKPublicKey())); return 0; } void showHelp(const char *name) { showVersion(name); printf("Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-e/--endorsePasswd ] [-o/--ownerPasswd ] [-P/--ekPasswd ]\n" " [-H/--handle ] [-g/--alg ] [-f/--file ]\n" " [-S/--EKserverAddr ] [-E/--ECcertFile ]\n" " [-X/--passwdInHex]\n" " [-i/--ip ] [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -e/--endorsePasswd specifies current endorse password (string,optional,default:NULL).\n" " -o/--ownerPasswd specifies current owner password (string,optional,default:NULL).\n" " -P/--ekPasswd specifies the EK password when created (string,optional,default:NULL).\n" " -H/--handle specifies the handle used to make EK persistent (hex).\n" " -g/--alg specifies the algorithm type of EK (default:0x01/TPM_ALG_RSA).\n" " -f/--file specifies the file used to save the public portion of EK.\n" " -X/--passwdInHex passwords given by any options are hex format.\n" " -p/--port specifies the port number (optional,default:%d).\n" " -N/--NonPersistent specifies to readout the EK public without making it persistent\n" " -O/--OfflineProv specifies that the file specifier from '-f' is an EK retrieved from offline platform that needs to be provisioned\n" " -E/--ECcertFile specifies the file used to save the Endorsement Credentials retrieved from the TPM manufacturer provisioning server\n" " -S/--EKserverAddr specifies to attempt retrieving the Endorsement Credentials from the specified TPM manufacturer provisioning server\n" " -U/--SSL_NO_VERIFY specifies to attempt connecting with the TPM manufacturer provisioning server with SSL_NO_VERIFY option\n" " -d/--dbg specifies level of debug messages(optional,default:0):\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " %s -e abc123 -o abc123 -P passwd -H 0x81010001-g 0x01 -O -N -U -E ECcert.bin -f ek.bin -S https://tpm.manufacturer.com/ekcertserver/ \n" " %s -e 1a1b1c -o 1a1b1c -P 123abc -X -H 0x81010001-g 0x01 -O -N -U -E ECcert.bin -f ek.bin -S https://tpm.manufacturer.com/ekcertserver/ \n" , name, name, name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char *argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int opt; int returnVal = 1; int ProvisioningreturnVal = 0; struct option sOpts[] = { { "endorsePasswd", required_argument, NULL, 'e' }, { "ownerPasswd" , required_argument, NULL, 'o' }, { "handle" , required_argument, NULL, 'H' }, { "ekPasswd" , required_argument, NULL, 'P' }, { "alg" , required_argument, NULL, 'g' }, { "file" , required_argument, NULL, 'f' }, { "passwdInHex" , no_argument, NULL, 'X' }, { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { "NonPersistent", no_argument, NULL, 'N' }, { "OfflineProv" , no_argument, NULL, 'O' }, { "ECcertFile" , required_argument, NULL, 'E' }, { "EKserverAddr" , required_argument, NULL, 'S' }, { "SSL_NO_VERIFY", no_argument, NULL, 'U' }, { NULL , no_argument, NULL, 0 }, }; if (argc == 1) { showHelp(argv[0]); return 0; } if ( argc > (int)(2 * sizeof(sOpts) / sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while ( ( opt = getopt_long( argc, argv, "e:o:H:P:g:f:Xp:d:S:E:OUNhv", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'H': if ( getSizeUint32Hex(optarg, &persistentHandle) ) { printf("\nPlease input the handle used to make EK persistent(hex) in correct format.\n"); return -2; } break; case 'e': if ( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the endorsement password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA) - 1); return -3; } safeStrNCpy(endorsePasswd, optarg, sizeof(endorsePasswd)); break; case 'o': if ( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the owner password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA) - 1); return -4; } safeStrNCpy(ownerPasswd, optarg, sizeof(ownerPasswd)); break; case 'P': if ( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the EK password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA) - 1); return -5; } safeStrNCpy(ekPasswd, optarg, sizeof(ekPasswd)); break; case 'g': if ( getSizeUint32Hex(optarg, &algorithmType) ) { printf("\nPlease input the algorithm type in correct format.\n"); return -6; } break; case 'f': if ( optarg == NULL ) { printf("\nPlease input the file used to save the pub ek.\n"); return -7; } safeStrNCpy(outputFile, optarg, sizeof(outputFile)); break; case 'X': hexPasswd = true; break; case 'p': if ( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -8; } break; case 'd': if ( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -9; } break; case 'E': if ( optarg == NULL ) { printf("\nPlease input the file used to save the EC Certificate retrieved from server\n"); return -99; } safeStrNCpy(ECcertFile, optarg, sizeof(ECcertFile)); break; case 'N': nonPersistentRead = 1; printf("Tss2_Sys_CreatePrimary called with Endorsement Handle without making it persistent\n"); break; case 'O': OfflineProv = 1; printf("Setting up for offline provisioning - reading the retrieved EK specified by the file \n"); break; case 'U': SSL_NO_VERIFY = 1; printf("CAUTION: TLS communication with the said TPM manufacturer server setup with SSL_NO_VERIFY!\n"); break; case 'S': if (optarg == NULL ) { printf("TPM Manufacturer Endorsement Credential Server Address cannot be NULL\n"); return -99; } EKserverAddr = (char *)malloc(strlen(optarg)); strncpy(EKserverAddr, optarg, strlen(optarg)); printf("TPM Manufacturer EK provisioning address -- %s\n", EKserverAddr); break; default: showHelp(argv[0]); return -10; } } prepareTest(hostName, port, debugLevel); if (!OfflineProv) returnVal = createEKHandle(); ProvisioningreturnVal = TPMinitialProvisioning(); finishTest(); if ( returnVal && ProvisioningreturnVal) return -11; return 0; } tpm2.0-tools-1.1.0/src/tpm2_getpubak.cpp000066400000000000000000000602561300711361400177330ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" #include "sample.h" int debugLevel = 0; TPM_HANDLE persistentEKHandle; TPM_HANDLE persistentAKHandle; char endorsePasswd[sizeof(TPMU_HA)]; char akPasswd[sizeof(TPMU_HA)]; char ownerPasswd[sizeof(TPMU_HA)]; bool hexPasswd = false; char outputFile[PATH_MAX]; char aknameFile[PATH_MAX]; UINT32 algorithmType = TPM_ALG_RSA; UINT32 digestAlg = TPM_ALG_SHA256; UINT32 signAlg = TPM_ALG_NULL; int setRSASigningAlg(TPM2B_PUBLIC &inPublic) { if (signAlg == TPM_ALG_NULL) signAlg = TPM_ALG_RSASSA; inPublic.t.publicArea.parameters.rsaDetail.scheme.scheme = signAlg; switch(signAlg) { case TPM_ALG_RSASSA: case TPM_ALG_RSAPSS: inPublic.t.publicArea.parameters.rsaDetail.scheme.details.anySig.hashAlg = digestAlg; break; default: printf("\n......The RSA signing algorithm type input(%4.4x) is not supported!......\n", signAlg); return -1; } return 0; } int setECCSigningAlg(TPM2B_PUBLIC &inPublic) { if (signAlg == TPM_ALG_NULL) signAlg = TPM_ALG_ECDSA; inPublic.t.publicArea.parameters.eccDetail.scheme.scheme = signAlg; switch(signAlg) { case TPM_ALG_ECDSA: case TPM_ALG_SM2: case TPM_ALG_ECSCHNORR: case TPM_ALG_ECDAA: inPublic.t.publicArea.parameters.eccDetail.scheme.details.anySig.hashAlg = digestAlg; case TPM_ALG_NULL: break; default: printf("\n......The ECC signing algorithm type input(%4.4x) is not supported!......\n", signAlg); return -1; } return 0; } int setKeyedhashSigningAlg(TPM2B_PUBLIC &inPublic) { if (signAlg == TPM_ALG_NULL) signAlg = TPM_ALG_HMAC; inPublic.t.publicArea.parameters.keyedHashDetail.scheme.scheme = signAlg; switch(signAlg) { case TPM_ALG_HMAC: inPublic.t.publicArea.parameters.keyedHashDetail.scheme.details.hmac.hashAlg = digestAlg; case TPM_ALG_NULL: break; default: printf("\n......The Keyedhash signing algorithm type input(%4.4x) is not supported!......\n", signAlg); return -1; } return 0; } int setKeyAlgorithm(UINT16 algorithm, TPM2B_SENSITIVE_CREATE &inSensitive, TPM2B_PUBLIC &inPublic) { inPublic.t.publicArea.nameAlg = TPM_ALG_SHA256; // First clear attributes bit field. *(UINT32 *)&(inPublic.t.publicArea.objectAttributes) = 0; inPublic.t.publicArea.objectAttributes.restricted = 1; inPublic.t.publicArea.objectAttributes.userWithAuth = 1; inPublic.t.publicArea.objectAttributes.sign = 1; inPublic.t.publicArea.objectAttributes.decrypt = 0; inPublic.t.publicArea.objectAttributes.fixedTPM = 1; inPublic.t.publicArea.objectAttributes.fixedParent = 1; inPublic.t.publicArea.objectAttributes.sensitiveDataOrigin = 1; inPublic.t.publicArea.authPolicy.t.size = 0; inPublic.t.publicArea.type = algorithm; switch(algorithm) { case TPM_ALG_RSA: inPublic.t.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM_ALG_NULL; inPublic.t.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 0; inPublic.t.publicArea.parameters.rsaDetail.symmetric.mode.aes = TPM_ALG_NULL; inPublic.t.publicArea.parameters.rsaDetail.keyBits = 2048; inPublic.t.publicArea.parameters.rsaDetail.exponent = 0; inPublic.t.publicArea.unique.rsa.t.size = 0; if(setRSASigningAlg(inPublic)) return -1; break; case TPM_ALG_ECC: inPublic.t.publicArea.parameters.eccDetail.symmetric.algorithm = TPM_ALG_NULL; inPublic.t.publicArea.parameters.eccDetail.symmetric.mode.sym = TPM_ALG_NULL; inPublic.t.publicArea.parameters.eccDetail.symmetric.keyBits.sym = 0; inPublic.t.publicArea.parameters.eccDetail.curveID = TPM_ECC_NIST_P256; inPublic.t.publicArea.parameters.eccDetail.kdf.scheme = TPM_ALG_NULL; inPublic.t.publicArea.unique.ecc.x.t.size = 0; inPublic.t.publicArea.unique.ecc.y.t.size = 0; if(setECCSigningAlg(inPublic)) return -2; break; case TPM_ALG_KEYEDHASH: inPublic.t.publicArea.unique.keyedHash.t.size = 0; if(setKeyedhashSigningAlg(inPublic)) return -3; break; case TPM_ALG_SYMCIPHER: default: printf("\n......The algorithm type input(%4.4x) is not supported!......\n", algorithm); return -4; } return 0; } int createAK() { UINT32 rval = TPM_RC_SUCCESS; TPMS_AUTH_COMMAND sessionData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_SENSITIVE_CREATE inSensitive = { { sizeof(TPM2B_SENSITIVE_CREATE)-2, } }; TPM2B_PUBLIC inPublic = { { sizeof(TPM2B_PUBLIC)-2, } }; TPM2B_DATA outsideInfo = { { 0, } }; TPML_PCR_SELECTION creationPCR; TPM2B_NAME name = { { sizeof(TPM2B_NAME)-2, } }; TPM2B_PRIVATE outPrivate = { { sizeof( TPM2B_PRIVATE ) - 2, } }; TPM2B_PUBLIC outPublic = { { 0, } }; TPM2B_CREATION_DATA creationData = { { 0, } }; TPM2B_DIGEST creationHash = { { sizeof(TPM2B_DIGEST)-2, } }; TPMT_TK_CREATION creationTicket = { 0, }; TPM_HANDLE handle2048rsa = persistentEKHandle; TPM_HANDLE loadedSha1KeyHandle; SESSION *session; TPM2B_ENCRYPTED_SECRET encryptedSalt = { { 0, } }; TPM2B_NONCE nonceCaller = { { 0, } }; TPMT_SYM_DEF symmetric; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; sessionsData.cmdAuthsCount = 1; sessionsDataOut.rspAuthsCount = 1; // set the object Auth value inSensitive.t.sensitive.userAuth.t.size = 0; if (strlen(akPasswd) > 0 && !hexPasswd) { inSensitive.t.sensitive.userAuth.t.size = strlen( akPasswd ); memcpy( &( inSensitive.t.sensitive.userAuth.t.buffer[0] ), &( akPasswd[0] ), inSensitive.t.sensitive.userAuth.t.size ); } else if (strlen(akPasswd) > 0 && hexPasswd) { inSensitive.t.sensitive.userAuth.t.size = sizeof(inSensitive.t.sensitive.userAuth) - 2; if (hex2ByteStructure(akPasswd, &inSensitive.t.sensitive.userAuth.t.size, inSensitive.t.sensitive.userAuth.t.buffer) != 0) { printf( "Failed to convert Hex format password for akPasswd.\n"); return -1; } } inSensitive.t.sensitive.data.t.size = 0; inSensitive.t.size = inSensitive.t.sensitive.userAuth.b.size + 2; creationPCR.count = 0; if( setKeyAlgorithm(algorithmType, inSensitive, inPublic) ) return -1; sessionData.hmac.t.size = 0; if (strlen(endorsePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(endorsePasswd); memcpy( &sessionData.hmac.t.buffer[0], endorsePasswd, sessionData.hmac.t.size ); } else if (strlen(endorsePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(endorsePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for endorsePasswd.\n"); return -1; } } symmetric.algorithm = TPM_ALG_NULL; rval = StartAuthSessionWithParams( &session, TPM_RH_NULL, 0, TPM_RH_NULL, 0, &nonceCaller, &encryptedSalt, TPM_SE_POLICY, &symmetric, TPM_ALG_SHA256 ); if( rval != TPM_RC_SUCCESS ) { printf("\n......StartAuthSessionWithParams Error. TPM Error:0x%x......\n", rval); return -2; } printf("\nStartAuthSessionWithParams succ.......\n"); rval = Tss2_Sys_PolicySecret(sysContext, TPM_RH_ENDORSEMENT, session->sessionHandle, &sessionsData, 0, 0, 0, 0, 0, 0, 0); if( rval != TPM_RC_SUCCESS ) { printf("\n......Tss2_Sys_PolicySecret Error. TPM Error:0x%x......\n", rval); return -3; } printf("\nTss2_Sys_PolicySecret succ.......\n"); sessionData.sessionHandle = session->sessionHandle; sessionData.sessionAttributes.continueSession = 1; sessionData.hmac.t.size = 0; rval = Tss2_Sys_Create( sysContext, handle2048rsa, &sessionsData, &inSensitive, &inPublic, &outsideInfo, &creationPCR, &outPrivate, &outPublic, &creationData, &creationHash, &creationTicket, &sessionsDataOut ); if( rval != TPM_RC_SUCCESS ) { printf("\n......TPM2_Create Error. TPM Error:0x%x......\n", rval); return -4; } printf("\nTPM2_Create succ.......\n"); // Need to flush the session here. rval = Tss2_Sys_FlushContext( sysContext, session->sessionHandle ); if( rval != TPM_RC_SUCCESS ) { printf("\n......TPM2_Sys_FlushContext Error. TPM Error:0x%x......\n", rval); return -5; } // And remove the session from sessions table. rval = EndAuthSession( session ); if( rval != TPM_RC_SUCCESS ) { printf("\n......EndAuthSession Error. TPM Error:0x%x......\n", rval); return -6; } sessionData.sessionHandle = TPM_RS_PW; sessionData.sessionAttributes.continueSession = 0; sessionData.hmac.t.size = 0; if (strlen(endorsePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(endorsePasswd); memcpy( &sessionData.hmac.t.buffer[0], endorsePasswd, sessionData.hmac.t.size ); } else if (strlen(endorsePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(endorsePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for endorsePasswd.\n"); return -1; } } rval = StartAuthSessionWithParams( &session, TPM_RH_NULL, 0, TPM_RH_NULL, 0, &nonceCaller, &encryptedSalt, TPM_SE_POLICY, &symmetric, TPM_ALG_SHA256 ); if( rval != TPM_RC_SUCCESS ) { printf("\n......StartAuthSessionWithParams Error. TPM Error:0x%x......\n", rval); return -7; } printf("\nStartAuthSessionWithParams succ.......\n"); rval = Tss2_Sys_PolicySecret(sysContext, TPM_RH_ENDORSEMENT, session->sessionHandle, &sessionsData, 0, 0, 0, 0, 0, 0, 0); if( rval != TPM_RC_SUCCESS ) { printf("\n......Tss2_Sys_PolicySecret Error. TPM Error:0x%x......\n", rval); return -8; } printf("\nTss2_Sys_PolicySecret succ.......\n"); sessionData.sessionHandle = session->sessionHandle; sessionData.sessionAttributes.continueSession = 1; sessionData.hmac.t.size = 0; rval = Tss2_Sys_Load ( sysContext, handle2048rsa, &sessionsData, &outPrivate, &outPublic, &loadedSha1KeyHandle, &name, &sessionsDataOut); if( rval != TPM_RC_SUCCESS ) { printf("\n......TPM2_Load Error. TPM Error:0x%x......\n", rval); return -9; } printf( "\nName of loaded key: \n" ); PrintSizedBuffer( (TPM2B *)&name ); printf("\n"); printf( "\nLoaded key handle: %8.8x\n", loadedSha1KeyHandle ); // write name to ak.name file if( saveDataToFile(aknameFile, &name.t.name[0], name.t.size) ) { printf("\n......Failed to save AK name into file(%s)......\n", aknameFile); return -10; } // Need to flush the session here. rval = Tss2_Sys_FlushContext( sysContext, session->sessionHandle ); if( rval != TPM_RC_SUCCESS ) { printf("\n......TPM2_Sys_FlushContext Error. TPM Error:0x%x......\n", rval); return -11; } // And remove the session from sessions table. rval = EndAuthSession( session ); if( rval != TPM_RC_SUCCESS ) { printf("\n......EndAuthSession Error. TPM Error:0x%x......\n", rval); return -12; } sessionData.sessionHandle = TPM_RS_PW; sessionData.sessionAttributes.continueSession = 0; sessionData.hmac.t.size = 0; // use the owner auth here. if (strlen(ownerPasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(ownerPasswd); memcpy( &sessionData.hmac.t.buffer[0], ownerPasswd, sessionData.hmac.t.size ); } else if (strlen(ownerPasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(ownerPasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for ownerPasswd.\n"); return -1; } } rval = Tss2_Sys_EvictControl(sysContext, TPM_RH_OWNER, loadedSha1KeyHandle, &sessionsData, persistentAKHandle, &sessionsDataOut); if( rval != TPM_RC_SUCCESS ) { printf("\n......TPM2_EvictControl Error. TPM Error:0x%x......\n", rval); return -13; } printf("\nEvictControl: Make AK persistent succ.\n"); rval = Tss2_Sys_FlushContext(sysContext, loadedSha1KeyHandle); if( rval != TPM_RC_SUCCESS ) { printf("\n......Flush transient AK error. TPM Error:0x%x......\n", rval); return -14; } printf("\nFlush transient AK succ.\n"); // save ak public if( saveDataToFile(outputFile, (UINT8 *)&outPublic, sizeof(outPublic)) ) { printf("\n......Failed to save AK pub key into file(%s)......\n", outputFile); return -15; } return 0; } void showHelp(const char *name) { showVersion(name); printf("Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-e/--endorsePasswd ] [-P/--akPasswd ] [-o/--ownerPasswd ]\n" " [-E/--ekHandle ] [-k/--akHandle ] [-g/--alg ] [-D/--digestAlg ]\n" " [-s/--signAlg ] [-f/--file ] [-n/--akName ]\n" " or: %s [-e/--endorsePasswd ] [-P/--akPasswd ] [-o/--ownerPasswd ]\n" " [-E/--ekHandle ] [-k/--akHandle ] [-g/--alg ] [-D/--digestAlg ]\n" " [-s/--signAlg ] [-f/--file ] [-n/--akName ]\n" " [-X/--passwdInHex]\n" " [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -e/--endorsePasswd specifies current endorsement password (string,optional,default:NULL).\n" " -P/--akPasswd specifies the AK password when created (string,optional,default:NULL).\n" " -o/--ownerPasswd specifies current owner password (string,optional,default:NULL).\n" " -E/--ekHandle specifies the handle of EK (hex).\n" " -k/--akHandle specifies the handle used to make AK persistent (hex).\n" " -g/--alg specifies the algorithm type of AK (default:0x01/TPM_ALG_RSA):\n" " TPM_ALG_RSA 0x0001\n" " TPM_ALG_KEYEDHASH 0x0008\n" " TPM_ALG_ECC 0x0023\n" " -D/--digestAlg specifies the algorithm of digest.\n" "\t0x0004 TPM_ALG_SHA1\n" "\t0x000B TPM_ALG_SHA256\n" "\t0x000C TPM_ALG_SHA384\n" "\t0x000D TPM_ALG_SHA512\n" "\t0x0012 TPM_ALG_SM3_256\n" " -s/--signAlg specifies the algorithm of sign.\n" "\t0x0005 TPM_ALG_HMAC\n" "\t0x0014 TPM_ALG_RSASSA\n" "\t0x0016 TPM_ALG_RSAPSS\n" "\t0x0018 TPM_ALG_ECDSA\n" "\t0x001A TPM_ALG_ECDAA\n" "\t0x001B TPM_ALG_SM2\n" "\t0x001C TPM_ALG_ECSCHNORR\n" " -f/--file specifies the file used to save the public portion of AK.\n" " -n/--akName specifies the file used to save the ak name.\n" " -X/--passwdInHex passwords given by any options are hex format.\n" " -p/--port specifies the port number (default:%d).\n" " -d/--dbg specifies level of debug messages:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " %s -e abc123 -P abc123 -o passwd -E 0x81010001 -k 0x81010002 -f ./ak.pub -n ./ak.name\n" " %s -e 1a2b3c -P 123abc -o 1a1b1c -X -E 0x81010001 -k 0x81010002 -f ./ak.pub -n ./ak.name\n" , name, name, name, name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char *argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int opt; int returnVal = 0; struct option sOpts[] = { { "ownerPasswd", required_argument, NULL, 'o' }, { "endorsePasswd", required_argument, NULL, 'e' }, { "ekHandle" , required_argument, NULL, 'E' }, { "akHandle" , required_argument, NULL, 'k' }, { "alg" , required_argument, NULL, 'g' }, { "digestAlg" , required_argument, NULL, 'D' }, { "signAlg" , required_argument, NULL, 's' }, { "akPasswd" , required_argument, NULL, 'P' }, { "file" , required_argument, NULL, 'f' }, { "akName" , required_argument, NULL, 'n' }, { "passwdInHex", no_argument, NULL, 'X' }, { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { NULL , no_argument, NULL, 0 }, }; if(argc == 1) { showHelp(argv[0]); return 0; } if( argc > (int)(2*sizeof(sOpts)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while ( ( opt = getopt_long( argc, argv, "o:E:e:k:g:D:s:P:f:n:Xp:d:hv", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'E': if( getSizeUint32Hex(optarg, &persistentEKHandle) ) { printf("\nPlease input the persistent EK handle(hex) in correct format.\n"); return -2; } break; case 'k': if( getSizeUint32Hex(optarg, &persistentAKHandle) ) { printf("\nPlease input the persistent handle used to make AK persistent(hex) in correct format.\n"); return -3; } break; case 'g': if( getSizeUint32Hex(optarg, &algorithmType) ) { printf("\nPlease input the algorithm type in correct format.\n"); return -4; } break; case 'D': if( getSizeUint32Hex(optarg, &digestAlg) ) { printf("\nPlease input the digest algorithm in correct format.\n"); return -5; } break; case 's': if( getSizeUint32Hex(optarg, &signAlg) ) { printf("\nPlease input the signing algorithm in correct format.\n"); return -6; } break; case 'o': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the owner password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -7; } safeStrNCpy(ownerPasswd, optarg, sizeof(ownerPasswd)); break; case 'e': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the endorsement password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -8; } safeStrNCpy(endorsePasswd, optarg, sizeof(endorsePasswd)); break; case 'P': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the AK password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -9; } safeStrNCpy(akPasswd, optarg, sizeof(akPasswd)); break; case 'f': if( optarg == NULL ) { printf("\nPlease input the file used to save the pub ek.\n"); return -10; } safeStrNCpy(outputFile, optarg, sizeof(outputFile)); break; case 'n': if( optarg == NULL ) { printf("\nPlease input the file used to save ak name.\n"); return -11; } safeStrNCpy(aknameFile, optarg, sizeof(aknameFile)); break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -12; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -13; } break; default: showHelp(argv[0]); return -14; } } prepareTest(hostName, port, debugLevel); returnVal = createAK(); finishTest(); if(returnVal) return -15; return 0; } tpm2.0-tools-1.1.0/src/tpm2_getpubek.cpp000066400000000000000000000405041300711361400177310ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; char outputFile[PATH_MAX]; char ownerPasswd[sizeof(TPMU_HA)]; char endorsePasswd[sizeof(TPMU_HA)]; char ekPasswd[sizeof(TPMU_HA)]; bool hexPasswd = false; TPM_HANDLE persistentHandle; UINT32 algorithmType = TPM_ALG_RSA; BYTE authPolicy[] = {0x83, 0x71, 0x97, 0x67, 0x44, 0x84, 0xB3, 0xF8, 0x1A, 0x90, 0xCC, 0x8D, 0x46, 0xA5, 0xD7, 0x24, 0xFD, 0x52, 0xD7, 0x6E, 0x06, 0x52, 0x0B, 0x64, 0xF2, 0xA1, 0xDA, 0x1B, 0x33, 0x14, 0x69, 0xAA}; int setKeyAlgorithm(UINT16 algorithm, TPM2B_SENSITIVE_CREATE &inSensitive, TPM2B_PUBLIC &inPublic) { inPublic.t.publicArea.nameAlg = TPM_ALG_SHA256; // First clear attributes bit field. *(UINT32 *)&(inPublic.t.publicArea.objectAttributes) = 0; inPublic.t.publicArea.objectAttributes.restricted = 1; inPublic.t.publicArea.objectAttributes.userWithAuth = 0; inPublic.t.publicArea.objectAttributes.adminWithPolicy = 1; inPublic.t.publicArea.objectAttributes.sign = 0; inPublic.t.publicArea.objectAttributes.decrypt = 1; inPublic.t.publicArea.objectAttributes.fixedTPM = 1; inPublic.t.publicArea.objectAttributes.fixedParent = 1; inPublic.t.publicArea.objectAttributes.sensitiveDataOrigin = 1; inPublic.t.publicArea.authPolicy.t.size = 32; memcpy(inPublic.t.publicArea.authPolicy.t.buffer, authPolicy, 32); inPublic.t.publicArea.type = algorithm; switch(algorithm) { case TPM_ALG_RSA: inPublic.t.publicArea.parameters.rsaDetail.symmetric.algorithm = TPM_ALG_AES; inPublic.t.publicArea.parameters.rsaDetail.symmetric.keyBits.aes = 128; inPublic.t.publicArea.parameters.rsaDetail.symmetric.mode.aes = TPM_ALG_CFB; inPublic.t.publicArea.parameters.rsaDetail.scheme.scheme = TPM_ALG_NULL; inPublic.t.publicArea.parameters.rsaDetail.keyBits = 2048; inPublic.t.publicArea.parameters.rsaDetail.exponent = 0; inPublic.t.publicArea.unique.rsa.t.size = 256; break; case TPM_ALG_KEYEDHASH: inPublic.t.publicArea.parameters.keyedHashDetail.scheme.scheme = TPM_ALG_XOR; inPublic.t.publicArea.parameters.keyedHashDetail.scheme.details.exclusiveOr.hashAlg = TPM_ALG_SHA256; inPublic.t.publicArea.parameters.keyedHashDetail.scheme.details.exclusiveOr.kdf = TPM_ALG_KDF1_SP800_108; inPublic.t.publicArea.unique.keyedHash.t.size = 0; break; case TPM_ALG_ECC: inPublic.t.publicArea.parameters.eccDetail.symmetric.algorithm = TPM_ALG_AES; inPublic.t.publicArea.parameters.eccDetail.symmetric.keyBits.aes = 128; inPublic.t.publicArea.parameters.eccDetail.symmetric.mode.sym = TPM_ALG_CFB; inPublic.t.publicArea.parameters.eccDetail.scheme.scheme = TPM_ALG_NULL; inPublic.t.publicArea.parameters.eccDetail.curveID = TPM_ECC_NIST_P256; inPublic.t.publicArea.parameters.eccDetail.kdf.scheme = TPM_ALG_NULL; inPublic.t.publicArea.unique.ecc.x.t.size = 32; inPublic.t.publicArea.unique.ecc.y.t.size = 32; break; case TPM_ALG_SYMCIPHER: inPublic.t.publicArea.parameters.symDetail.sym.algorithm = TPM_ALG_AES; inPublic.t.publicArea.parameters.symDetail.sym.keyBits.aes = 128; inPublic.t.publicArea.parameters.symDetail.sym.mode.sym = TPM_ALG_CFB; inPublic.t.publicArea.unique.sym.t.size = 0; break; default: printf("\n......The algorithm type input(%4.4x) is not supported!......\n", algorithm); return -1; } return 0; } int createEKHandle() { UINT32 rval; TPMS_AUTH_COMMAND sessionData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_SENSITIVE_CREATE inSensitive = { { sizeof(TPM2B_SENSITIVE_CREATE)-2, } }; TPM2B_PUBLIC inPublic = { { sizeof(TPM2B_PUBLIC)-2, } }; TPM2B_DATA outsideInfo = { { 0, } }; TPML_PCR_SELECTION creationPCR; TPM2B_NAME name = { { sizeof(TPM2B_NAME)-2, } }; TPM2B_PUBLIC outPublic = { { 0, } }; TPM2B_CREATION_DATA creationData = { { 0, } }; TPM2B_DIGEST creationHash = { { sizeof(TPM2B_DIGEST)-2, } }; TPMT_TK_CREATION creationTicket = { 0, }; TPM_HANDLE handle2048ek; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; // use enAuth in Tss2_Sys_CreatePrimary if (strlen(endorsePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(endorsePasswd); memcpy( &sessionData.hmac.t.buffer[0], endorsePasswd, sessionData.hmac.t.size ); } else if (strlen(endorsePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(endorsePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for endorsePasswd.\n"); return -1; } } if (strlen(ekPasswd) > 0 && !hexPasswd) { inSensitive.t.sensitive.userAuth.t.size = strlen(ekPasswd); memcpy( &inSensitive.t.sensitive.userAuth.t.buffer[0], ekPasswd, inSensitive.t.sensitive.userAuth.t.size ); } else if (strlen(ekPasswd) > 0 && hexPasswd) { inSensitive.t.sensitive.userAuth.t.size = sizeof(inSensitive.t.sensitive.userAuth) - 2; if (hex2ByteStructure(ekPasswd, &inSensitive.t.sensitive.userAuth.t.size, inSensitive.t.sensitive.userAuth.t.buffer) != 0) { printf( "Failed to convert Hex format password for ekPasswd.\n"); return -1; } } inSensitive.t.sensitive.data.t.size = 0; inSensitive.t.size = inSensitive.t.sensitive.userAuth.b.size + 2; if( setKeyAlgorithm(algorithmType, inSensitive, inPublic) ) return -1; creationPCR.count = 0; /*To Create EK*/ rval = Tss2_Sys_CreatePrimary(sysContext, TPM_RH_ENDORSEMENT, &sessionsData, &inSensitive, &inPublic, &outsideInfo, &creationPCR, &handle2048ek, &outPublic, &creationData, &creationHash, &creationTicket, &name, &sessionsDataOut); if( rval != TPM_RC_SUCCESS ) { printf("\n......TPM2_CreatePrimary Error. TPM Error:0x%x......\n", rval); return -2; } printf("\nEK create succ.. Handle: 0x%8.8x\n", handle2048ek); // To make EK persistent, use own auth sessionData.hmac.t.size = 0; if (strlen(ownerPasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(ownerPasswd); memcpy( &sessionData.hmac.t.buffer[0], ownerPasswd, sessionData.hmac.t.size ); } else if (strlen(ownerPasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(ownerPasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for ownerPasswd.\n"); return -1; } } rval = Tss2_Sys_EvictControl(sysContext, TPM_RH_OWNER, handle2048ek, &sessionsData, persistentHandle, &sessionsDataOut); if( rval != TPM_RC_SUCCESS ) { printf("\n......EvictControl:Make EK persistent Error. TPM Error:0x%x......\n", rval); return -3; } printf("EvictControl EK persistent succ.\n"); rval = Tss2_Sys_FlushContext(sysContext, handle2048ek); if( rval != TPM_RC_SUCCESS ) { printf("\n......Flush transient EK failed. TPM Error:0x%x......\n", rval); return -4; } printf("Flush transient EK succ.\n"); // save ek public if( saveDataToFile(outputFile, (UINT8 *)&outPublic, sizeof(outPublic)) ) { printf("\n......Failed to save EK pub key into file(%s)......\n", outputFile); return -5; } return 0; } void showHelp(const char *name) { showVersion(name); printf("Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-e/--endorsePasswd ] [-o/--ownerPasswd ] [-P/--ekPasswd ]\n" " [-H/--handle ] [-g/--alg ] [-f/--file ]\n" " or: %s [-e/--endorsePasswd ] [-o/--ownerPasswd ] [-P/--ekPasswd ]\n" " [-H/--handle ] [-g/--alg ] [-f/--file ]\n" " [-X/--passwdInHex]\n" " [-i/--ip ] [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -e/--endorsePasswd specifies current endorse password (string,optional,default:NULL).\n" " -o/--ownerPasswd specifies current owner password (string,optional,default:NULL).\n" " -P/--ekPasswd specifies the EK password when created (string,optional,default:NULL).\n" " -H/--handle specifies the handle used to make EK persistent (hex).\n" " -g/--alg specifies the algorithm type of EK (default:0x01/TPM_ALG_RSA).\n" " -f/--file specifies the file used to save the public portion of EK.\n" " -X/--passwdInHex passwords given by any options are hex format.\n" " -p/--port specifies the port number (optional,default:%d).\n" " -d/--dbg specifies level of debug messages(optional,default:0):\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " %s -e abc123 -o abc123 -P passwd -H 0x81010001 -g 0x01 -f ek.pub\n" " %s -e 1a1b1c -o 1a1b1c -P 123abc -X -H 0x81010001 -g 0x01 -f ek.pub\n" , name, name, name, name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char *argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int opt; int returnVal = 0; struct option sOpts[] = { { "endorsePasswd", required_argument, NULL, 'e' }, { "ownerPasswd" , required_argument, NULL, 'o' }, { "handle" , required_argument, NULL, 'H' }, { "ekPasswd" , required_argument, NULL, 'P' }, { "alg" , required_argument, NULL, 'g' }, { "file" , required_argument, NULL, 'f' }, { "passwdInHex" , no_argument, NULL, 'X' }, { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { NULL , no_argument, NULL, 0 }, }; if(argc == 1) { showHelp(argv[0]); return 0; } if( argc > (int)(2*sizeof(sOpts)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while ( ( opt = getopt_long( argc, argv, "e:o:H:P:g:f:Xp:d:hv", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'H': if( getSizeUint32Hex(optarg, &persistentHandle) ) { printf("\nPlease input the handle used to make EK persistent(hex) in correct format.\n"); return -2; } break; case 'e': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the endorsement password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -3; } safeStrNCpy(endorsePasswd, optarg, sizeof(endorsePasswd)); break; case 'o': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the owner password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -4; } safeStrNCpy(ownerPasswd, optarg, sizeof(ownerPasswd)); break; case 'P': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the EK password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -5; } safeStrNCpy(ekPasswd, optarg, sizeof(ekPasswd)); break; case 'g': if( getSizeUint32Hex(optarg, &algorithmType) ) { printf("\nPlease input the algorithm type in correct format.\n"); return -6; } break; case 'f': if( optarg == NULL ) { printf("\nPlease input the file used to save the pub ek.\n"); return -7; } safeStrNCpy(outputFile, optarg, sizeof(outputFile)); break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -8; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -9; } break; default: showHelp(argv[0]); return -10; } } prepareTest(hostName, port, debugLevel); returnVal = createEKHandle(); finishTest(); if( returnVal ) return -11; return 0; } tpm2.0-tools-1.1.0/src/tpm2_getrandom.cpp000066400000000000000000000156461300711361400201140ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include // Needed for _wtoi #include #include #include #include #include #include #include "common.h" int debugLevel = 0; void showHelp(const char *name) { printf("\n%s [options]\n" "Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-s/--size ] [-o/--of ] \n" " or: %s [-s/--size ] [-o/--of ]\n" " [-i/--ip ] [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -s/--size specifies the size of the bytesRequested.\n" " -o/--of specifies the filename of output:\n" " -p/--port specifies the port number (default:%d).\n" " -d/--dbg specifies level of debug messages:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " %s -s 20 -o random.out \n" , name, name, name, name, name, DEFAULT_RESMGR_TPM_PORT, name); } int getRandom(const char *outFileName, UINT16 bytesRequested) { TPM_RC rval; TPM2B_DIGEST randomBytes = { { sizeof(TPM2B_DIGEST)-2, } }; rval = Tss2_Sys_GetRandom(sysContext, NULL, bytesRequested, &randomBytes, NULL); if (rval != TSS2_RC_SUCCESS) { printf("\n......TPM2_GetRandom Error. TPM Error:0x%x......\n", rval); return -1; } printf("\nGetRandom succ...\n"); printf("byte size: %d\n",randomBytes.t.size); for(UINT16 i = 0; i < randomBytes.t.size; i++) printf(" 0x%2.2X",randomBytes.t.buffer[i]); printf("\n"); if(saveDataToFile(outFileName, (UINT8 *)randomBytes.t.buffer, randomBytes.t.size)) return -2; return 0; } int main(int argc, char* argv[]) { UINT16 size=20; char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int returnVal = 0; char outFileName[PATH_MAX] = {0}; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); const char *optstring = "s:o:p:d:hv"; int opt = -1; static struct option long_Opts[] = { { "size",1,NULL,'s' }, { "of",1, NULL,'o' }, { "port",1,NULL,'p' }, { "dbg", 1,NULL,'d' }, { "help",0,NULL,'h' }, { "version",0,NULL,'v' }, { 0,0,0,0 }, }; int flagCnt = 0, s_flag=0, o_flag=0, h_flag=0, v_flag=0; if( argc > (int)(2*sizeof(long_Opts)/sizeof(struct option)) || argc == 1) { showArgMismatch(argv[0]); return -1; } while((opt = getopt_long(argc,argv,optstring,long_Opts,NULL)) != -1 && returnVal == 0) { switch (opt) { case 'h': h_flag = 1; // showHelp(); break; case '?': returnVal = -2; break; case 'v': // showVersion(); v_flag = 1; break; case 's': if(getSizeUint16(optarg, &size)) { printf(" s must go with the size number.\n"); returnVal = -3; break; } s_flag = 1; break; case 'o': if (optarg==NULL) { printf("\n Please don't forget to specified the output file! \n"); returnVal = -4; break; } safeStrNCpy(outFileName, optarg, sizeof(outFileName)); o_flag=1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -5; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -6; } break; default: showArgMismatch(argv[0]); exit(-7); } }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + o_flag + s_flag; if (flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -8; } } else if(flagCnt == 2 && h_flag != 1 && v_flag !=1) { prepareTest(hostName, port, debugLevel); returnVal = getRandom(outFileName, size); finishTest(); if(returnVal) return -9; } else { showArgMismatch(argv[0]); return -10; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_hash.cpp000066400000000000000000000227651300711361400170570ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; int getHierarchyValue(const char *argValue, TPMI_RH_HIERARCHY *hierarchyValue) { if(strlen(argValue) != 1) { printf("Wrong Hierarchy Value: %s\n",argValue); return -1; } switch(argValue[0]) { case 'e': *hierarchyValue = TPM_RH_ENDORSEMENT; break; case 'o': *hierarchyValue = TPM_RH_OWNER; break; case 'p': *hierarchyValue = TPM_RH_PLATFORM; break; case 'n': *hierarchyValue = TPM_RH_NULL; break; default: printf("Wrong Hierarchy Value: %s\n",argValue); return -2; } return 0; } int hash(TPMI_RH_HIERARCHY hierarchyValue, TPM2B_MAX_BUFFER *data, TPMI_ALG_HASH halg, const char *outHashFilePath, const char *outTicketFilePath) { UINT32 rval; TPM2B_DIGEST outHash = { { sizeof(TPM2B_DIGEST)-2, } }; TPMT_TK_HASHCHECK validation; rval = Tss2_Sys_Hash(sysContext, 0, data, halg, hierarchyValue, &outHash, &validation, 0); if(rval != TPM_RC_SUCCESS) { printf("\n......TPM2_Hash Error. TPM Error:0x%x......\n", rval); return -1; } printf("\ntpm2_hash succ.\n\n"); printf("\nhash value(hex type): "); for(UINT16 i = 0; i < outHash.t.size; i++) printf("%02x ", outHash.t.buffer[i]); printf("\n"); printf("\nvalidation value(hex type): "); for(INT16 j = 0; j < validation.digest.t.size; j++) printf("%02x ", validation.digest.t.buffer[j]); printf("\n"); if(saveDataToFile(outHashFilePath, (UINT8 *)&outHash, sizeof(outHash))) return -2; if(saveDataToFile(outTicketFilePath, (UINT8 *)&validation, sizeof(validation))) return -3; return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-H, --hierarchy hierarchy to use for the ticket\n" "\te TPM_RH_ENDORSEMENT\n" "\to TPM_RH_OWNER\n" "\tp TPM_RH_PLATFORM\n" "\tn TPM_RH_NULL\n" "-g, --halg algorithm for the hash being computed\n" "\t0x0004 TPM_ALG_SHA1\n" "\t0x000B TPM_ALG_SHA256\n" "\t0x000C TPM_ALG_SHA384\n" "\t0x000D TPM_ALG_SHA512\n" "\t0x0012 TPM_ALG_SM3_256\n" "-I, --infile file containning the data to be hashed\n" "-o, --outfile file record the hash result\n" "-t, --ticket file record the ticket\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -H -g 0x004 -I -o -t \n" , name, DEFAULT_RESMGR_TPM_PORT, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPMI_RH_HIERARCHY hierarchyValue; TPM2B_MAX_BUFFER data; TPMI_ALG_HASH halg; char outHashFilePath[PATH_MAX] = {0}; char outTicketFilePath[PATH_MAX] = {0}; long fileSize = 0; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvH:g:I:o:t:p:d:"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"Hierachy",1,NULL,'H'}, {"halg",1,NULL,'g'}, {"infile",1,NULL,'I'}, {"outfile",1,NULL,'o'}, {"ticket",1,NULL,'t'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, H_flag = 0, g_flag = 0, I_flag = 0, o_flag = 0, t_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'H': if(getHierarchyValue(optarg,&hierarchyValue) != 0) { returnVal = -1; break; } printf("\nhierarchyValue: 0x%x\n\n",hierarchyValue); H_flag = 1; break; case 'g': if(getSizeUint16Hex(optarg,&halg) != 0) { showArgError(optarg, argv[0]); returnVal = -2; break; } printf("halg = 0x%4.4x\n", halg); g_flag = 1; break; case 'I': if( getFileSize(optarg, &fileSize) != 0) { returnVal = -3; break; } if(fileSize > MAX_DIGEST_BUFFER) { printf("Input data too long: %ld, should be less than %d bytes\n", fileSize, MAX_DIGEST_BUFFER); returnVal = -4; break; } data.t.size = fileSize; if(loadDataFromFile(optarg, data.t.buffer, &data.t.size) != 0) { returnVal = -5; break; } I_flag = 1; break; case 'o': safeStrNCpy(outHashFilePath, optarg, sizeof(outHashFilePath)); if(checkOutFile(outHashFilePath) != 0) { returnVal = -6; break; } o_flag = 1; break; case 't': safeStrNCpy(outTicketFilePath, optarg, sizeof(outTicketFilePath)); if(checkOutFile(outTicketFilePath) != 0) { returnVal = -7; break; } t_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -8; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -9; } break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -10; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -11; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + H_flag + g_flag + I_flag + o_flag + t_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -12; } } else if(flagCnt == 5 && h_flag != 1 && v_flag != 1) { prepareTest(hostName, port, debugLevel); returnVal = hash(hierarchyValue, &data, halg, outHashFilePath, outTicketFilePath); finishTest(); if(returnVal) return -13; } else { showArgMismatch(argv[0]); return -14; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_hmac.cpp000066400000000000000000000250311300711361400170310ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; int debugLevel = 0; int hmac(TPMI_DH_OBJECT keyHandle, TPM2B_MAX_BUFFER *data, TPMI_ALG_HASH halg, const char *outHmacFilePath) { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_DIGEST outHMAC = { { sizeof(TPM2B_DIGEST)-2, } }; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for key Passwd.\n"); return -1; } } rval = Tss2_Sys_HMAC(sysContext, keyHandle, &sessionsData, data, halg, &outHMAC, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\n......TPM2_HMAC Error. TPM Error:0x%x......\n", rval); return -1; } printf("\ntpm2_hmac succ.\n\n"); printf("\nhmac value(hex type): "); for(UINT16 i = 0; i < outHMAC.t.size; i++) printf("%02x ", outHMAC.t.buffer[i]); printf("\n"); if( saveDataToFile(outHmacFilePath, (UINT8 *)&outHMAC, sizeof(outHMAC)) ) return -2; return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-k, --keyHandle handle for the symmetric signing key providing the HMAC key\n" "-c, --keyContext filename of the key context used for the operation\n" "-P, --pwdk the keyHandle's password, optional\n" "-g, --halg algorithm for the hash being computed\n" "\t0x0004 TPM_ALG_SHA1\n" "\t0x000B TPM_ALG_SHA256\n" "\t0x000C TPM_ALG_SHA384\n" "\t0x000D TPM_ALG_SHA512\n" "\t0x0012 TPM_ALG_SM3_256\n" "-I, --infile file containning the data to be HMACed\n" "-o, --outfile file record the HMAC result\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -k 0x80000001 -P abc123 -g 0x004 -I -o \n" "%s -k 0x80000001 -g 0x004 -I -o \n\n"// -i \n\n",DEFAULT_TPM_PORT); "%s -k 0x80000001 -P 123abc -X -g 0x004 -I -o \n" , name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPMI_DH_OBJECT keyHandle; TPM2B_MAX_BUFFER data; TPMI_ALG_HASH halg; char outHmacFilePath[PATH_MAX] = {0}; char *contextKeyFile = NULL; long fileSize = 0; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvk:P:g:I:o:p:d:c:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"keyHandle",1,NULL,'k'}, {"pwdk",1,NULL,'P'}, {"halg",1,NULL,'g'}, {"infile",1,NULL,'I'}, {"outfile",1,NULL,'o'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"keyContext",1,NULL,'c'}, {"passwdInHex",0,NULL,'X'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, k_flag = 0, P_flag = 0, g_flag = 0, I_flag = 0, c_flag = 0, o_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'k': if(getSizeUint32Hex(optarg,&keyHandle) != 0) { returnVal = -1; break; } k_flag = 1; break; case 'P': sessionData.hmac.t.size = sizeof(sessionData.hmac.t) - 2; if(str2ByteStructure(optarg,&sessionData.hmac.t.size,sessionData.hmac.t.buffer) != 0) { returnVal = -2; break; } P_flag = 1; break; case 'g': if(getSizeUint16Hex(optarg,&halg) != 0) { showArgError(optarg, argv[0]); returnVal = -3; break; } printf("halg = 0x%4.4x\n", halg); g_flag = 1; break; case 'I': // long fileSize = 0; if( getFileSize(optarg, &fileSize) != 0) { returnVal = -4; break; } if(fileSize > MAX_DIGEST_BUFFER) { printf("Input data too long: %ld, should be less than %d bytes\n", fileSize, MAX_DIGEST_BUFFER); returnVal = -5; break; } data.t.size = sizeof(data) - 2; if(loadDataFromFile(optarg, (UINT8 *)data.t.buffer, &data.t.size) != 0) { returnVal = -6; break; } I_flag = 1; break; case 'o': safeStrNCpy(outHmacFilePath, optarg, sizeof(outHmacFilePath)); if(checkOutFile(outHmacFilePath) != 0) { returnVal = -7; break; } o_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -8; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -9; } break; case 'c': contextKeyFile = optarg; if(contextKeyFile == NULL || contextKeyFile[0] == '\0') { returnVal = -10; break; } printf("contextKeyFile = %s\n", contextKeyFile); c_flag = 1; break; case 'X': hexPasswd = true; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -11; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -12; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; if(P_flag != 1) sessionData.hmac.t.size = 0; flagCnt = h_flag + v_flag + k_flag + g_flag + I_flag + o_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -13; } } else if((flagCnt == 4) && (k_flag == 1 || c_flag == 1) && (I_flag == 1) && (o_flag == 1) && g_flag == 1) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &keyHandle, contextKeyFile); if(returnVal == 0) returnVal = hmac(keyHandle, &data, halg, outHmacFilePath); finishTest(); if(returnVal) return -14; } else { showArgMismatch(argv[0]); return -15; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_listpcrs.cpp000066400000000000000000000407401300711361400177700ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" #define SET_PCR_SELECT_BIT( pcrSelection, pcr ) \ (pcrSelection).pcrSelect[( (pcr)/8 )] |= ( 1 << ( (pcr) % 8) ); #define CLEAR_PCR_SELECT_BITS( pcrSelection ) \ (pcrSelection).pcrSelect[0] = 0; \ (pcrSelection).pcrSelect[1] = 0; \ (pcrSelection).pcrSelect[2] = 0; #define SET_PCR_SELECT_SIZE( pcrSelection, size ) \ (pcrSelection).sizeofSelect = size; #define TEST_PCR_SELECT_BIT( pcrSelection, pcr ) \ ((pcrSelection).pcrSelect[( (pcr)/8 )] & ( 1 << ( (pcr) % 8) )) int debugLevel = 0; FILE *fp = NULL; char outFilePath[PATH_MAX]; const struct { TPMI_ALG_HASH alg; const char *desc; } g_algs [] = { {TPM_ALG_SHA1, "TPM_ALG_SHA1"}, {TPM_ALG_SHA256, "TPM_ALG_SHA256"}, {TPM_ALG_SHA384, "TPM_ALG_SHA384"}, {TPM_ALG_SHA512, "TPM_ALG_SHA512"}, {TPM_ALG_SM3_256, "TPM_ALG_SM3_256"}, {TPM_ALG_NULL, "TPM_ALG_UNKOWN"} }; static struct { int count; TPMI_ALG_HASH alg[8]; } g_banks = {3, {TPM_ALG_SHA1, TPM_ALG_SHA256, TPM_ALG_SHA384,}}; TPML_PCR_SELECTION g_pcrSelections; static struct { int count; TPML_DIGEST pcrValues[24]; } g_pcrs = {0,}; int findAlgorithm(TPMI_ALG_HASH algId) { int i; for(i = 0; g_algs[i].alg != TPM_ALG_NULL; i++) if( g_algs[i].alg == algId ) break; return i; } void updatePcrSelections(TPML_PCR_SELECTION *s1, TPML_PCR_SELECTION *s2) { for(int i2 = 0; i2 < s2->count; i2++) { for(int i1 = 0; i1 < s1->count; i1++) { if(s2->pcrSelections[i2].hash != s1->pcrSelections[i1].hash) continue; for(int j = 0; j < s1->pcrSelections[i1].sizeofSelect; j++) s1->pcrSelections[i1].pcrSelect[j] &= ~s2->pcrSelections[i2].pcrSelect[j]; } } } bool emptyPcrSections(TPML_PCR_SELECTION *s) { for(int i = 0; i < s->count; i++) for(int j = 0; j < s->pcrSelections[i].sizeofSelect; j++) if(s->pcrSelections[i].pcrSelect[j]) return false; return true; } int readPcrValues() { TPML_PCR_SELECTION pcrSelectionIn; TPML_PCR_SELECTION pcrSelectionOut; UINT32 pcrUpdateCounter; UINT32 rval; //1. prepare pcrSelectionIn with g_pcrSelections memcpy(&pcrSelectionIn, &g_pcrSelections, sizeof(pcrSelectionIn)); //2. call pcr_read g_pcrs.count = 0; do { rval = Tss2_Sys_PCR_Read( sysContext, 0, &pcrSelectionIn, &pcrUpdateCounter, &pcrSelectionOut, &g_pcrs.pcrValues[g_pcrs.count], 0 ); if(rval != TPM_RC_SUCCESS ) { printf("read pcr failed. tpm error 0x%0x\n\n", rval); return -1; } //3. unmask pcrSelectionOut bits from pcrSelectionIn updatePcrSelections(&pcrSelectionIn, &pcrSelectionOut); //4. goto step 2 if pcrSelctionIn still has bits set } while(++g_pcrs.count < 24 && !emptyPcrSections(&pcrSelectionIn)); if(g_pcrs.count >= 24 && !emptyPcrSections(&pcrSelectionIn)) { printf("too much pcrs to get! try to split into multiple calls...\n\n"); return -1; } return 0; } int preparePcrSelections_g(TPMI_ALG_HASH algId) { UINT32 pcrId = 0; g_pcrSelections.count = 1; g_pcrSelections.pcrSelections[0].hash = algId; SET_PCR_SELECT_SIZE(g_pcrSelections.pcrSelections[0], 3); CLEAR_PCR_SELECT_BITS(g_pcrSelections.pcrSelections[0]); for(pcrId = 0; pcrId < 24; pcrId++) { SET_PCR_SELECT_BIT(g_pcrSelections.pcrSelections[0], pcrId ); } } void preparePcrSelections() { UINT32 pcrId = 0; g_pcrSelections.count = 0; for( int i = 0; i < g_banks.count; i++ ) { g_pcrSelections.pcrSelections[i].hash = g_banks.alg[i]; SET_PCR_SELECT_SIZE(g_pcrSelections.pcrSelections[i], 3); CLEAR_PCR_SELECT_BITS(g_pcrSelections.pcrSelections[i]); for(pcrId = 0; pcrId < 24; pcrId++) { SET_PCR_SELECT_BIT(g_pcrSelections.pcrSelections[i], pcrId ); } g_pcrSelections.count++; } } // show all PCR banks according to g_pcrSelection & g_pcrs. int showPcrValues() { int vi = 0, di = 0; for( int i = 0; i < g_pcrSelections.count; i++) { int alg_i = findAlgorithm(g_pcrSelections.pcrSelections[i].hash); printf("\nBank/Algorithm: %s(0x%04x)\n", g_algs[alg_i].desc, g_pcrSelections.pcrSelections[i].hash); for(UINT32 pcrId = 0; pcrId < 24; pcrId++) { if(!TEST_PCR_SELECT_BIT(g_pcrSelections.pcrSelections[i], pcrId)) continue; if(vi >= g_pcrs.count || di >= g_pcrs.pcrValues[vi].count) { printf("Something wrong, trying to print but nothing more\n"); return -1; } printf("PCR_%02d:", pcrId); for(int k = 0; k < g_pcrs.pcrValues[vi].digests[di].t.size; k++) printf(" %02x", g_pcrs.pcrValues[vi].digests[di].t.buffer[k]); printf("\n"); if(fp != NULL && fwrite(g_pcrs.pcrValues[vi].digests[di].t.buffer, g_pcrs.pcrValues[vi].digests[di].t.size, 1, fp) != 1) { printf("write to file %s failed!\n", outFilePath); return -1; } if(++di < g_pcrs.pcrValues[vi].count) continue; //printf("returned values[%d] are printed!\n", vi); di = 0; if(++vi < g_pcrs.count) continue; //printf("all returned values are printed!\n"); } } return 0; } int showAllPcrValues() { preparePcrSelections(); if(readPcrValues()) return -1; if(showPcrValues()) return -1; return 0; } int showSelectedPcrValues() { if(readPcrValues()) return -1; if(showPcrValues()) return -1; return 0; } int showAlgPcrValues(TPMI_ALG_HASH algId) { preparePcrSelections_g(algId); if(readPcrValues()) return -1; if(showPcrValues()) return -1; return 0; } int getBanks() { TPMI_YES_NO moreData; TPMS_CAPABILITY_DATA capabilityData; UINT32 rval; rval = Tss2_Sys_GetCapability( sysContext, 0, TPM_CAP_PCRS, 0, 1, &moreData, &capabilityData, 0 ); if(rval != TPM_RC_SUCCESS) { printf("\n......GetCapability: Get PCR allocation status Error. TPM Error:0x%x......\n", rval); return -1; } for( int i=0; i < capabilityData.data.assignedPCR.count; i++ ) { g_banks.alg[i] = capabilityData.data.assignedPCR.pcrSelections[i].hash; } g_banks.count = capabilityData.data.assignedPCR.count; return 0; } void showBanks() { printf("Supported Bank/Algorithm:"); for(int i = 0; i < g_banks.count; i++) { int j = findAlgorithm(g_banks.alg[i]); printf(" %s(0x%04x)", g_algs[j].desc, g_banks.alg[i]); } printf("\n"); } void showHelp(const char *name) { printf("\n%s [options]\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info;\n" "-g, --algorithim The algorithm id, optional\n" "-o, --output The file to hold the PCR values in binary format, optional\n" "-p, --port The Port number, default is %d, optional\n" "-L, --selList \n" " The list of pcr banks and selected PCRs' ids\n" " (0~23) for each bank\n" "-s, --algs Show the supported algs in the PCR banks\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n\tExample:\n" "display usage:\n" " %s -h\n" "display version:\n" " %s -v\n" "display all PCR values:\n" " %s\n" "display the PCR values with specified bank:\n" " %s -g 0x04\n" "display the PCR values with specified banks and store in a file:\n" " %s -L 0x04:16,17,18+0x0b:16,17,18 -o pcrs\n" "display the supported algs in the PCR banks:\n" " %s -s\n" , name, DEFAULT_RESMGR_TPM_PORT, name, name, name, name, name, name ); } const char *findChar(const char *str, int len, char c) { if(str == NULL || len <= 0) return NULL; for(int i = 0; i < len; i++) { if(str[i] == c) return &str[i]; } return NULL; } int parsePCRList(const char *str, int len, TPMS_PCR_SELECTION *pcrSel) { char buf[3]; const char *strCurrent; int lenCurrent; UINT32 pcr; if(str == NULL || len == 0) return -1; pcrSel->sizeofSelect = 3; pcrSel->pcrSelect[0] = 0; pcrSel->pcrSelect[1] = 0; pcrSel->pcrSelect[2] = 0; do { strCurrent = str; str = findChar(strCurrent, len, ','); if(str) { lenCurrent = str - strCurrent; str++; len -= lenCurrent + 1; } else { lenCurrent = len; len = 0; } if(lenCurrent > sizeof(buf) - 1) return -1; safeStrNCpy(buf, strCurrent, lenCurrent + 1); if(getPcrId(buf, &pcr)!= 0) return -1; pcrSel->pcrSelect[pcr/8] |= (1 << (pcr % 8)); } while(str); return 0; } int parsePCRSelection(const char *str, int len, TPMS_PCR_SELECTION *pcrSel) { const char *strLeft; char buf[7]; if(str == NULL || len == 0) return -1; strLeft = findChar(str, len, ':'); if(strLeft == NULL) return -1; if(strLeft - str > sizeof(buf) - 1) return -1; safeStrNCpy(buf, str, strLeft - str + 1); if(getSizeUint16Hex(buf, &pcrSel->hash) != 0) return -1; strLeft++; if(strLeft - str >= len) return -1; if(parsePCRList(strLeft, str + len - strLeft, pcrSel)) return -1; return 0; } int parsePCRSelections(const char *arg, TPML_PCR_SELECTION *pcrSels) { const char *strLeft = arg; const char *strCurrent = arg; int lenCurrent = 0; if(arg == NULL || pcrSels == NULL) return -1; pcrSels->count = 0; do { strCurrent = strLeft; strLeft = findChar(strCurrent, strlen(strCurrent), '+'); if(strLeft) { lenCurrent = strLeft - strCurrent; strLeft++; } else lenCurrent = strlen(strCurrent); if(parsePCRSelection(strCurrent, lenCurrent, &pcrSels->pcrSelections[pcrSels->count])) return -1; pcrSels->count++; } while(strLeft); if(pcrSels->count == 0) return -1; return 0; } int main(int argc, char *argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvg:p:d:o:L:s"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"algorithm",1,NULL,'g'}, {"output",1,NULL,'o'}, {"algs",0,NULL,'s'}, {"selList",1,NULL,'L'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {0,0,0,0} }; TPMI_ALG_HASH algorithmId; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, o_flag = 0, L_flag = 0, s_flag = 0, g_flag = 0; while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'g': if(getSizeUint16Hex(optarg,&algorithmId) != 0) { showArgError(optarg, argv[0]); returnVal = -1; break; } g_flag = 1; break; case 'o': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -2; break; } o_flag = 1; break; case 'L': if(parsePCRSelections(optarg, &g_pcrSelections) != 0) { showArgError(optarg, argv[0]); returnVal = -10; break; } L_flag = 1; break; case 's': s_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -3; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -4; } break; // case 0: // break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -5; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -6; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + g_flag + L_flag + s_flag; if(flagCnt > 1) { showArgMismatch(argv[0]); return -7; } if(h_flag) { showHelp(argv[0]); return 0; } else if(v_flag == 1) { showVersion(argv[0]); return 0; } if(o_flag) { fp = fopen(outFilePath,"w+"); if(NULL == fp) { printf("OutFile: %s Can Not Be Created !\n",outFilePath); return -8; } } prepareTest(hostName, port, debugLevel); returnVal = getBanks(); if(returnVal == 0) { if(s_flag) showBanks(); else if(g_flag) returnVal = showAlgPcrValues(algorithmId); else if(L_flag) returnVal = showSelectedPcrValues(); else returnVal = showAllPcrValues(); } finishTest(); if(fp) fclose(fp); if(returnVal) return -9; return 0; } tpm2.0-tools-1.1.0/src/tpm2_listpersistent.cpp000066400000000000000000000144201300711361400212150ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2016, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "changeEndian.h" #include "common.h" int debugLevel = 0; int readPublic(TPMI_DH_OBJECT objectHandle) { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_PUBLIC outPublic = { { 0, } }; TPM2B_NAME name = { { sizeof(TPM2B_NAME)-2, } }; TPM2B_NAME qualifiedName = { { sizeof(TPM2B_NAME)-2, } }; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsDataOut.rspAuthsCount = 1; rval = Tss2_Sys_ReadPublic(sysContext, objectHandle, 0, &outPublic, &name, &qualifiedName, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\nTPM2_ReadPublic error: rval = 0x%0x\n\n",rval); return -1; } printf(" {\n"); printf("\tType: 0x%x\n ", outPublic.t.publicArea.type); printf("\tHash algorithm(nameAlg): 0x%x\n ", outPublic.t.publicArea.nameAlg); printf("\tAttributes: 0x%x\n", outPublic.t.publicArea.objectAttributes.val); printf(" }\n"); return 0; } int listPersistent() { TPMI_YES_NO moreData; TPMS_CAPABILITY_DATA capabilityData; UINT32 rval; rval = Tss2_Sys_GetCapability( sysContext, 0, TPM_CAP_HANDLES, CHANGE_ENDIAN_DWORD(TPM_HT_PERSISTENT), TPM_PT_HR_PERSISTENT, &moreData, &capabilityData, 0 ); if(rval != TPM_RC_SUCCESS) { printf("\n......GetCapability: Get persistent object list Error." " TPM Error:0x%x......\n", rval); return -1; } printf( "%d persistent objects defined.\n", capabilityData.data.handles.count); for( UINT32 i=0; i < capabilityData.data.handles.count; i++ ) { printf("\n %d. Persistent handle: 0x%x\n", i, capabilityData.data.handles.handle[i]); if(readPublic(capabilityData.data.handles.handle[i])) return -2; } printf("\n"); return 0; } void showHelp(const char *name) { printf("Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s\n" " or: %s [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -p/--port specifies the port number, default %d, optional\n" " -d/--dbg specifies level of debug messages, optional:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" , name, name, name, name, DEFAULT_RESMGR_TPM_PORT); } int main(int argc, char *argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int opt = -1; int returnVal = 0; struct option sOptions[] = { { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { 0 , 0, 0, 0 }, }; if( argc > (int)(2*sizeof(sOptions)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while( ( opt = getopt_long(argc, argv, "p:d:hv", sOptions, NULL) ) != -1 ) { switch(opt) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -2; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -3; } break; default: break; } }; prepareTest(hostName, port, debugLevel); returnVal = listPersistent(); finishTest(); if(returnVal) return -4; return 0; } tpm2.0-tools-1.1.0/src/tpm2_load.cpp000066400000000000000000000252301300711361400170410ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" TPM_HANDLE handle2048rsa; TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; int debugLevel = 0; int load(TPMI_DH_OBJECT parentHandle, TPM2B_PUBLIC *inPublic, TPM2B_PRIVATE *inPrivate, const char *outFileName, int P_flag) { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_NAME nameExt = { { sizeof(TPM2B_NAME)-2, } }; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; if(P_flag == 0) sessionData.hmac.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for parent Passwd.\n"); return -1; } } rval = Tss2_Sys_Load(sysContext, parentHandle, &sessionsData, inPrivate , inPublic, &handle2048rsa, &nameExt, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\nLoad Object Failed ! ErrorCode: 0x%0x\n\n",rval); return -1; } printf("\nLoad succ.\nLoadedHandle: 0x%08x\n\n",handle2048rsa); if(saveDataToFile(outFileName, (UINT8 *)&nameExt, sizeof(nameExt))) return -2; return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-H, --parent parent handle\n" "-c, --contextParent filename for parent context\n" "-P, --pwdp parent key password, optional\n" "-u, --pubfile The public portion of the object\n" "-r, --privfile The sensitive portion of the object\n" "-n, --name Output file name, containing the name structure\n" "-C, --context The file to save the object context, optional" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -H 0x80000000 -P abc123 -u -r -n \n" "%s -H 0x80000000 -u -r -n \n\n"// -i \n\n",DEFAULT_TPM_PORT); "%s -H 0x80000000 -P 123abc -X -u -r -n \n" ,name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT;//DEFAULT_TPM_PORT; TPMI_DH_OBJECT parentHandle; TPM2B_PUBLIC inPublic; TPM2B_PRIVATE inPrivate; UINT16 size; char outFilePath[PATH_MAX] = {0}; char *contextFile = NULL; char *contextParentFilePath = NULL; memset(&inPublic,0,sizeof(TPM2B_PUBLIC)); memset(&inPrivate,0,sizeof(TPM2B_SENSITIVE)); setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvH:P:u:r:n:p:d:C:c:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"parent",1,NULL,'H'}, {"pwdp",1,NULL,'P'}, {"pubfile",1,NULL,'u'}, {"privfile",1,NULL,'r'}, {"name",1,NULL,'n'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"context",1,NULL,'C'}, {"contextParent",1,NULL,'c'}, {"passwdInHex",0,NULL,'X'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, H_flag = 0, P_flag = 0, u_flag = 0, r_flag = 0, c_flag = 0, C_flag = 0, n_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'H': if(getSizeUint32Hex(optarg, &parentHandle) != 0) { returnVal = -1; break; } printf("\nparentHandle: 0x%x\n\n",parentHandle); H_flag = 1; break; case 'P': sessionData.hmac.t.size = sizeof(sessionData.hmac.t) - 2; if(str2ByteStructure(optarg,&sessionData.hmac.t.size,sessionData.hmac.t.buffer) != 0) { returnVal = -2; break; } P_flag = 1; break; case 'u': size = sizeof(inPublic); if(loadDataFromFile(optarg, (UINT8 *)&inPublic, &size) != 0) { returnVal = -3; break; } u_flag = 1; break; case 'r': size = sizeof(inPrivate); if(loadDataFromFile(optarg, (UINT8 *)&inPrivate, &size) != 0) { returnVal = -4; break; } r_flag = 1; break; case 'n': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -5; break; } n_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -6; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -7; } break; case 'c': contextParentFilePath = optarg; if(contextParentFilePath == NULL || contextParentFilePath[0] == '\0') { returnVal = -8; break; } printf("contextParentFile = %s\n", contextParentFilePath); c_flag = 1; break; case 'C': contextFile = optarg; if(contextFile == NULL || contextFile[0] == '\0') { returnVal = -9; break; } printf("contextFile = %s\n", contextFile); C_flag = 1; break; case 'X': hexPasswd = true; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -10; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -11; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + H_flag + u_flag +r_flag + n_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -12; } } else if(flagCnt == 4 && (H_flag == 1 || c_flag == 1) && u_flag == 1 && r_flag == 1 && n_flag == 1) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &parentHandle, contextParentFilePath); if (returnVal == 0) returnVal = load(parentHandle, &inPublic, &inPrivate,outFilePath, P_flag); if (returnVal == 0 && C_flag) returnVal = saveTpmContextToFile(sysContext, handle2048rsa, contextFile); finishTest(); if(returnVal) return -13; } else { showArgMismatch(argv[0]); return -14; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_loadexternal.cpp000066400000000000000000000212511300711361400206030ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" TPM_HANDLE handle2048rsa; int debugLevel = 0; int getHierarchyValue(const char *argValue, TPMI_RH_HIERARCHY *hierarchyValue) { if(strlen(argValue) != 1) { printf("Wrong Hierarchy Value: %s\n",argValue); return -1; } switch(argValue[0]) { case 'e': *hierarchyValue = TPM_RH_ENDORSEMENT; break; case 'o': *hierarchyValue = TPM_RH_OWNER; break; case 'p': *hierarchyValue = TPM_RH_PLATFORM; break; case 'n': *hierarchyValue = TPM_RH_NULL; break; default: printf("Wrong Hierarchy Value: %s\n",argValue); return -2; } return 0; } int loadExternal(TPMI_RH_HIERARCHY hierarchyValue, TPM2B_PUBLIC *inPublic, TPM2B_SENSITIVE *inPrivate, int r_flag) { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_NAME nameExt = { { sizeof(TPM2B_NAME)-2, } }; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsDataOut.rspAuthsCount = 1; if(r_flag == 0) rval = Tss2_Sys_LoadExternal(sysContext, 0, NULL, inPublic, hierarchyValue, &handle2048rsa, &nameExt, &sessionsDataOut); else rval = Tss2_Sys_LoadExternal(sysContext, 0, inPrivate , inPublic, hierarchyValue, &handle2048rsa, &nameExt, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\nLoadExternal Failed ! ErrorCode: 0x%0x\n\n", rval); return -1; } printf("\nLoadExternal succ.\nLoadedHandle: 0x%08x\n\n", handle2048rsa); return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-H, --hierarchy Hierarchy with which the object area is associated\n" "\te TPM_RH_ENDORSEMENT\n" "\to TPM_RH_OWNER\n" "\tp TPM_RH_PLATFORM\n" "\tn TPM_RH_NULL\n" "-u, --pubfile The public portion of the object\n" "-r, --privfile The sensitive portion of the object, optional\n" "-C, --context The file to save the object context, optional\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -H -u -r \n" "%s -H -u \n\n"// -i \n\n",DEFAULT_TPM_PORT); ,name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPMI_RH_HIERARCHY hierarchyValue; TPM2B_PUBLIC inPublic; TPM2B_SENSITIVE inPrivate; UINT16 size; memset(&inPublic,0,sizeof(TPM2B_PUBLIC)); memset(&inPrivate,0,sizeof(TPM2B_SENSITIVE)); setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvH:u:r:p:d:C:"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"Hierachy",1,NULL,'H'}, {"pubfile",1,NULL,'u'}, {"privfile",1,NULL,'r'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"context",1,NULL,'C'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, H_flag = 0, u_flag = 0, C_flag = 0, r_flag = 0; char *contextFile = NULL; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'H': if(getHierarchyValue(optarg,&hierarchyValue) != 0) { returnVal = -1; break; } printf("\nhierarchyValue: 0x%x\n\n",hierarchyValue); H_flag = 1; break; case 'u': size = sizeof(inPublic); if(loadDataFromFile(optarg, (UINT8 *)&inPublic, &size) != 0) { returnVal = -2; break; } u_flag = 1; break; case 'r': size = sizeof(inPrivate); if(loadDataFromFile(optarg, (UINT8 *)&inPrivate, &size) != 0) { returnVal = -3; break; } r_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -4; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -5; } break; case 'C': contextFile = optarg; if(contextFile == NULL || contextFile[0] == '\0') { returnVal = -6; break; } printf("contextFile = %s\n", contextFile); C_flag = 1; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -7; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -8; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + H_flag + u_flag ; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -9; } } else if(flagCnt == 2 && H_flag == 1 && u_flag == 1) { prepareTest(hostName, port, debugLevel); returnVal = loadExternal(hierarchyValue, &inPublic, &inPrivate, r_flag); if(returnVal == 0 && C_flag) returnVal = saveTpmContextToFile(sysContext, handle2048rsa, contextFile); finishTest(); if(returnVal) return -10; } else { showArgMismatch(argv[0]); return -11; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_makecredential.cpp000066400000000000000000000217171300711361400211000ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; TPM_HANDLE handle2048rsa; //declaretion for read and write file TPM2B_NAME objectName; char outFilePath[PATH_MAX] = {0}; TPM2B_PUBLIC inPublic; TPM2B_DIGEST inCredential; int writeCrtSecToFile(const char *path,TPM2B_ID_OBJECT *credentialBlob, TPM2B_ENCRYPTED_SECRET *secret) { FILE *fp = fopen(path,"w+"); if(NULL == fp) { printf("OutFile: %s Can Not Be Created !\n",path); return -1; } else { if(fwrite(credentialBlob,sizeof(TPM2B_ID_OBJECT),1,fp) != 1) { fclose(fp); printf("OutFile: %s Write Data In Error!\n",path); return -2; } if(fwrite(secret, sizeof(TPM2B_ENCRYPTED_SECRET), 1, fp) != 1) { fclose(fp); printf("OutFile: %s Write Data In Error!\n",path); return -3; } } fclose(fp); return 0; } int makeCredential() { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_NAME nameExt = { { sizeof(TPM2B_NAME)-2, } }; TPM2B_ID_OBJECT credentialBlob = { { sizeof(TPM2B_ID_OBJECT)-2, }, }; TPM2B_ENCRYPTED_SECRET secret = { { sizeof(TPM2B_ENCRYPTED_SECRET)-2, }, }; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsDataOut.rspAuthsCount = 1; rval = Tss2_Sys_LoadExternal(sysContext, 0, NULL , &inPublic,TPM_RH_NULL,&handle2048rsa, &nameExt, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\n......LoadExternal failed. TPM Error:0x%x......\n", rval); return -1; } printf("LoadExternal succ.\n"); rval = Tss2_Sys_MakeCredential(sysContext, handle2048rsa, 0, &inCredential, &objectName,&credentialBlob, &secret, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\n......MakeCredential failed. TPM Error:0x%x......\n", rval); return -2; } printf("MakeCredential succ.\n"); rval = Tss2_Sys_FlushContext(sysContext, handle2048rsa); if( rval != TPM_RC_SUCCESS ) { printf("\n......Flush loaded key failed. TPM Error:0x%x......\n", rval); return -3; } printf("Flush loaded key succ.\n"); if(writeCrtSecToFile(outFilePath,&credentialBlob,&secret)) return -4; printf("OutFile: %s completed!\n\n",outFilePath); return 0; } void showHelp(const char *name) { printf("%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-e, --encKey A tpm Public Key which was used to wrap the seed\n" "-s, --sec The secret which will be protected by the key derived from the random seed\n" "-n, --name The name of the key for which certificate is to be created\n" "-o, --outFile output file path, recording the two structures output by tpm2_makecredential function\n" // "-i, --ip The IP address of simulator, optional\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel<0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -e -s -n -o \n" , name, DEFAULT_RESMGR_TPM_PORT, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; UINT16 size; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hve:s:n:o:p:d:"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"encKey",1,NULL,'e'}, {"sec",1,NULL,'s'}, {"name",1,NULL,'n'}, {"outFile",1,NULL,'o'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, e_flag = 0, s_flag = 0, n_flag = 0, o_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'e': size = sizeof(inPublic); if(loadDataFromFile(optarg, (UINT8 *)&inPublic, &size) != 0) { returnVal = -1; break; } e_flag = 1; break; case 's': inCredential.t.size = sizeof(inCredential) - 2; if(loadDataFromFile(optarg, inCredential.t.buffer, &inCredential.t.size) != 0) { returnVal = -2; break; } s_flag = 1; break; case 'n': objectName.t.size = sizeof(objectName) - 2; if(hex2ByteStructure(optarg,&objectName.t.size,objectName.t.name) != 0) { returnVal = -3; break; } n_flag = 1; break; case 'o': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -4; break; } o_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -5; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -6; } break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -7; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -8; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + e_flag + s_flag + n_flag + o_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -9; } } else if(flagCnt == 4 && h_flag != 1 && v_flag != 1) { prepareTest(hostName, port, debugLevel); returnVal = makeCredential(); finishTest(); if(returnVal) return -10; } else { showArgMismatch(argv[0]); return -11; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_nvdefine.cpp000066400000000000000000000250711300711361400177230ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; UINT32 nvIndex = 0; UINT32 authHandle = TPM_RH_PLATFORM; UINT32 size = 0; UINT32 nvAttribute = 0; char handlePasswd[sizeof(TPMU_HA)]; char indexPasswd[sizeof(TPMU_HA)]; bool hexPasswd = false; int nvSpaceDefine() { UINT32 rval; TPM2B_AUTH nvAuth; TPM2B_NV_PUBLIC publicInfo; TPMS_AUTH_COMMAND sessionData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1] = { &sessionData }; TPMS_AUTH_RESPONSE *sessionDataOutArray[1] = { &sessionDataOut }; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; if (strlen(handlePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(handlePasswd); memcpy( &sessionData.hmac.t.buffer[0], handlePasswd, sessionData.hmac.t.size ); } else if (strlen(handlePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(handlePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for handlePasswd.\n"); return -1; } } publicInfo.t.size = sizeof( TPMI_RH_NV_INDEX ) + sizeof( TPMI_ALG_HASH ) + sizeof( TPMA_NV ) + sizeof( UINT16) + sizeof( UINT16 ); publicInfo.t.nvPublic.nvIndex = nvIndex; publicInfo.t.nvPublic.nameAlg = TPM_ALG_SHA256; // Now set the attributes. publicInfo.t.nvPublic.attributes.val = nvAttribute; publicInfo.t.nvPublic.authPolicy.t.size = 0; publicInfo.t.nvPublic.dataSize = size; nvAuth.t.size = 0; if (strlen(indexPasswd) > 0 && !hexPasswd) { nvAuth.t.size = strlen(indexPasswd); memcpy( &nvAuth.t.buffer[0], indexPasswd, nvAuth.t.size ); } else if (strlen(indexPasswd) > 0 && hexPasswd) { nvAuth.t.size = sizeof(nvAuth) - 2; if (hex2ByteStructure(indexPasswd,&nvAuth.t.size,nvAuth.t.buffer) != 0) { printf( "Failed to convert Hex format password for indexPasswd.\n"); return -1; } } rval = Tss2_Sys_NV_DefineSpace( sysContext, authHandle, &sessionsData, &nvAuth, &publicInfo, &sessionsDataOut ); if(rval != TPM_RC_SUCCESS) { printf( "\nFailed to define NV area at index 0x%x (%d).Error:0x%x\n", nvIndex, nvIndex, rval ); return -1; } printf( "Success to define NV area at index 0x%x (%d).\n", nvIndex, nvIndex); return 0; } void showHelp(const char *name) { printf("Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-x/--index ] [-a/--authHandle ] [-s/--size ] [-t/--attribute ]\n" " [-P/--handlePasswd ] [-I/--indexPasswd ]\n" " or: %s [-x/--index ] [-a/--authHandle ] [-s/--size ] [-t/--attribute ]\n" " [-P/--handlePasswd ] [-I/--indexPasswd ]\n" " [-X/--passwdInHex]\n" " [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -x/--index specifies the index of the NV area.\n" " -a/--authHandle specifies the handle used to authorize:\n" " 0x40000001 (TPM_RH_OWNER)\n" " 0x4000000C (TPM_RH_PLATFORM)\n" " -s/--size specifies the size of data area.\n" " -t/--attribute specifies the value of attribute in publicInfo struct (need calculate outside).\n" " -P/--handlePasswd specifies the password of authHandle.\n" " -I/--indexPasswd specifies the password of NV Index when created.\n" " -X/--passwdInHex passwords given by any options are hex format.\n" " -p/--port specifies the port number, default:%d, optional\n" " -d/--dbg specifies level of debug messages, optional:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " %s -x 0x1500016 -a 0x40000001 -s 32 -t 0x2000A\n" " %s -x 0x1500016 -a 0x40000001 -s 32 -t 0x2000A -I 1a1b1c -X\n" , name, name, name, name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char* argv[]) { int opt; char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int returnVal = 0; struct option sOpts[] = { { "index" , required_argument, NULL, 'x' }, { "authHandle" , required_argument, NULL, 'a' }, { "size" , required_argument, NULL, 's' }, { "attribute" , required_argument, NULL, 't' }, { "handlePasswd", required_argument, NULL, 'P' }, { "indexPasswd" , required_argument, NULL, 'I' }, { "passwdInHex" , no_argument, NULL, 'X' }, { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { NULL , no_argument, NULL, 0 }, }; if( argc == 1) { showHelp(argv[0]); return 0; } if( argc > (int)(2*sizeof(sOpts)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while ( ( opt = getopt_long( argc, argv, "x:a:s:t:P:I:Xp:d:hv", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return -2; case 'v': showVersion(argv[0]); return -3; case 'x': if( getSizeUint32Hex(optarg, &nvIndex) != 0 ) return -4; break; case 'a': if( getSizeUint32Hex(optarg, &authHandle) != 0 ) return -5; break; case 's': if( getSizeUint32(optarg, &size) != 0 ) return -6; break; case 't': if( getSizeUint32Hex(optarg, &nvAttribute) != 0 ) return -7; break; case 'P': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the handle password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -8; } safeStrNCpy(handlePasswd, optarg, sizeof(handlePasswd)); break; case 'I': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the index password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -9; } safeStrNCpy(indexPasswd, optarg, sizeof(indexPasswd)); break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -10; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -11; } break; } } if( nvIndex == 0 ) { printf("\nYou must provide an index (!= 0) for the NV area.\n"); return -12; } if( authHandle == 0 ) { printf("\nYou must provide an right auth handle for this operation.\n"); showHelp(argv[0]); return -13; } prepareTest(hostName, port, debugLevel); returnVal = nvSpaceDefine(); finishTest(); if(returnVal) return -14; return 0; } tpm2.0-tools-1.1.0/src/tpm2_nvlist.cpp000066400000000000000000000135111300711361400174400ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "changeEndian.h" #include "common.h" int debugLevel = 0; int NVReadPublic(TPMI_RH_NV_INDEX nvIndex) { UINT32 rval; TPM2B_NAME nvName = { { sizeof(TPM2B_NAME)-2, } }; TPM2B_NV_PUBLIC nvPublic = { { 0, } }; rval = Tss2_Sys_NV_ReadPublic( sysContext, nvIndex, 0, &nvPublic, &nvName, 0 ); if(rval != TPM_RC_SUCCESS) { printf("\nNVReadPublic Failed ! ErrorCode: 0x%0x\n\n", rval); return -1; } printf(" {\n"); printf("\tHash algorithm(nameAlg):%d\n ", nvPublic.t.nvPublic.nameAlg); printf("\tThe Index attributes(attributes):0x%x\n ", nvPublic.t.nvPublic.attributes.val); printf("\tThe size of the data area(dataSize):%d\n ", nvPublic.t.nvPublic.dataSize); printf(" }\n"); return 0; } int nvList() { TPMI_YES_NO moreData; TPMS_CAPABILITY_DATA capabilityData; UINT32 rval; rval = Tss2_Sys_GetCapability( sysContext, 0, TPM_CAP_HANDLES, CHANGE_ENDIAN_DWORD(TPM_HT_NV_INDEX), TPM_PT_NV_INDEX_MAX, &moreData, &capabilityData, 0 ); if(rval != TPM_RC_SUCCESS) { printf("\n......GetCapability:Get NV Index list Error. TPM Error:0x%x......\n", rval); return -1; } printf( "%d NV indexes defined.\n", capabilityData.data.handles.count); for( UINT32 i=0; i < capabilityData.data.handles.count; i++ ) { printf("\n %d. NV Index: 0x%x\n", i, capabilityData.data.handles.handle[i]); if(NVReadPublic(capabilityData.data.handles.handle[i])) return -2; } printf("\n"); return 0; } void showHelp(const char *name) { printf("Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s\n" " or: %s [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -p/--port specifies the port number, default %d, optional\n" " -d/--dbg specifies level of debug messages, optional:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" , name, name, name, name, DEFAULT_RESMGR_TPM_PORT); } int main(int argc, char *argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int opt = -1; int returnVal = 0; struct option sOptions[] = { { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { 0 , 0, 0, 0 }, }; if( argc > (int)(2*sizeof(sOptions)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while( ( opt = getopt_long(argc, argv, "p:d:hv", sOptions, NULL) ) != -1 ) { switch(opt) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -2; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -3; } break; default: break; } }; prepareTest(hostName, port, debugLevel); returnVal = nvList(); finishTest(); if(returnVal) return -4; return 0; } tpm2.0-tools-1.1.0/src/tpm2_nvread.cpp000066400000000000000000000230101300711361400173730ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; UINT32 nvIndex = 0; UINT32 authHandle = TPM_RH_PLATFORM; UINT32 sizeToRead = 0; UINT32 offset = 0; char handlePasswd[sizeof(TPMU_HA)]; bool hexPasswd = false; int nvRead(TPMI_RH_NV_AUTH authHandle, TPMI_RH_NV_INDEX nvIndex, UINT16 size, UINT16 offset) { UINT32 rval; TPMS_AUTH_COMMAND sessionData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPM2B_MAX_NV_BUFFER nvData = { { sizeof(TPM2B_MAX_NV_BUFFER)-2, } }; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; if (strlen(handlePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(handlePasswd); memcpy( &sessionData.hmac.t.buffer[0], handlePasswd, sessionData.hmac.t.size ); } else if (strlen(handlePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(handlePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for handlePasswd.\n"); return -1; } } rval = Tss2_Sys_NV_Read( sysContext, authHandle, nvIndex, &sessionsData, size, offset, &nvData, &sessionsDataOut ); if(rval != TPM_RC_SUCCESS) { printf("\nFailed to read NVRAM area at index 0x%x (%d).Error:0x%x\n", nvIndex, nvIndex, rval ); return -1; } printf("\nThe size of data:%d\n", nvData.t.size); for (int i=0; i] [-a/--authHandle ] [-P/--handlePasswd ] [-s/--size ] [-o/--offset ]\n" " or: %s [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ] [-s/--size ] [-o/--offset ]\n" " [-X/--passwdInHex]\n" " [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -x/--index specifies the index of the NV area.\n" " -a/--authHandle specifies the handle used to authorize:\n" " 0x40000001 (TPM_RH_OWNER)\n" " 0x4000000C (TPM_RH_PLATFORM)\n" " {NV_INDEX_FIRST:NV_INDEX_LAST}\n" " -P/--handlePasswd specifies the password of authHandle.\n" " -s/--size specifies the number of octets to read.\n" " -o/--offset specifies octet offset into the area\n" " This value shall be less than or equal to the size of the nvIndex data.\n" " -X/--passwdInHex passwords given by any options are hex format.\n" " -p/--port specifies the port number, default:%d, optional\n" " -d/--dbg specifies level of debug messages, optional:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " %s -x 0x1500016 -a 0x40000001 -P passwd -s 32 -o 0\n" " %s -x 0x1500016 -a 0x40000001 -P 1a1b1c -s 32 -o 0 -X\n" , name, name, name, name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char* argv[]) { int opt; char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int returnVal = 0; struct option sOpts[] = { { "index" , required_argument, NULL, 'x' }, { "authHandle" , required_argument, NULL, 'a' }, { "size" , required_argument, NULL, 's' }, { "offset" , required_argument, NULL, 'o' }, { "handlePasswd", required_argument, NULL, 'P' }, { "passwdInHex" , no_argument, NULL, 'X' }, { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { NULL , no_argument, NULL, 0 }, }; if( argc == 1) { showHelp(argv[0]); return 0; } if( argc > (int)(2*sizeof(sOpts)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while ( ( opt = getopt_long( argc, argv, "x:a:s:o:P:Xp:d:hv", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'x': if( getSizeUint32Hex(optarg, &nvIndex) != 0 ) { return -2; } break; case 'a': if( getSizeUint32Hex(optarg, &authHandle) != 0 ) { return -3; } break; case 'P': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the handle password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -4; } safeStrNCpy( handlePasswd, optarg, sizeof(handlePasswd) ); break; case 's': if( getSizeUint32(optarg, &sizeToRead) != 0 ) { return -5; } break; case 'o': if( getSizeUint32(optarg, &offset) != 0 ) { return -6; } break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -7; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -8; } break; default: showArgMismatch(argv[0]); return -9; } } if( nvIndex == 0 ) { printf("You must provide an index (!= 0) for the NVRAM area.\n"); return -10; } if( authHandle == 0 ) { printf("You must provide an right auth handle for this operation.\n"); return -11; } prepareTest(hostName, port, debugLevel); returnVal = nvRead(authHandle, nvIndex, sizeToRead, offset); finishTest(); if(returnVal) return -12; return 0; } tpm2.0-tools-1.1.0/src/tpm2_nvreadlock.cpp000066400000000000000000000206611300711361400202550ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // Copyright (c) 2016, Atom Software Studios // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; UINT32 nvIndex = 0; UINT32 authHandle = TPM_RH_PLATFORM; UINT32 sizeToRead = 0; UINT32 offset = 0; char handlePasswd[sizeof(TPMU_HA)]; bool hexPasswd = false; int nvReadLock(TPMI_RH_NV_AUTH authHandle, TPMI_RH_NV_INDEX nvIndex) { UINT32 rval; TPMS_AUTH_COMMAND sessionData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPM2B_MAX_NV_BUFFER nvData = { { sizeof(TPM2B_MAX_NV_BUFFER)-2, } }; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; if (strlen(handlePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(handlePasswd); memcpy( &sessionData.hmac.t.buffer[0], handlePasswd, sessionData.hmac.t.size ); } else if (strlen(handlePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(handlePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for handlePasswd.\n"); return -1; } } rval = Tss2_Sys_NV_ReadLock( sysContext, authHandle, nvIndex, &sessionsData, &sessionsDataOut ); if(rval != TPM_RC_SUCCESS) { printf("\nFailed to lock NVRAM area at index 0x%x (%d).Error:0x%x\n", nvIndex, nvIndex, rval ); return -1; } return 0; } void showHelp(const char *name) { printf("Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ]\n" " [-X/--passwdInHex]\n" " [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -x/--index specifies the index of the NV area.\n" " -a/--authHandle specifies the handle used to authorize:\n" " 0x40000001 (TPM_RH_OWNER)\n" " 0x4000000C (TPM_RH_PLATFORM)\n" " {NV_INDEX_FIRST:NV_INDEX_LAST}\n" " -P/--handlePasswd specifies the password of authHandle.\n" " -X/--passwdInHex the passwords given by -P/-I are hex format.\n" " -p/--port specifies the port number, default:%d, optional\n" " -d/--dbg specifies level of debug messages, optional:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " %s -x 0x1500016 -a 0x40000001 -P passwd\n" " %s -x 0x1500016 -a 0x40000001 -P 1a1b1c -X\n" , name, name, name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char* argv[]) { int opt; char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int returnVal = 0; struct option sOpts[] = { { "index" , required_argument, NULL, 'x' }, { "authHandle" , required_argument, NULL, 'a' }, { "handlePasswd", required_argument, NULL, 'P' }, { "passwdInHex" , no_argument, NULL, 'X' }, { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { NULL , no_argument, NULL, 0 }, }; if( argc == 1) { showHelp(argv[0]); return 0; } if( argc > (int)(2*sizeof(sOpts)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while ( ( opt = getopt_long( argc, argv, "x:a:P:Xp:d:hv", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'x': if( getSizeUint32Hex(optarg, &nvIndex) != 0 ) { return -2; } break; case 'a': if( getSizeUint32Hex(optarg, &authHandle) != 0 ) { return -3; } break; case 'P': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the handle password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -4; } safeStrNCpy( handlePasswd, optarg, sizeof(handlePasswd) ); break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -7; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -8; } break; default: showArgMismatch(argv[0]); return -9; } } if( nvIndex == 0 ) { printf("You must provide an index (!= 0) for the NVRAM area.\n"); return -10; } if( authHandle == 0 ) { printf("You must provide an right auth handle for this operation.\n"); return -11; } prepareTest(hostName, port, debugLevel); returnVal = nvReadLock(authHandle, nvIndex); finishTest(); if(returnVal) return -12; return 0; } tpm2.0-tools-1.1.0/src/tpm2_nvrelease.cpp000066400000000000000000000200331300711361400201020ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; UINT32 nvIndex; UINT32 authHandle; char handlePasswd[sizeof(TPMU_HA)]; bool hexPasswd = false; int nvSpaceRelease() { UINT32 rval; TPMS_AUTH_COMMAND sessionData; TSS2_SYS_CMD_AUTHS sessionsData; TPMS_AUTH_COMMAND *sessionDataArray[1]; sessionDataArray[0] = &sessionData; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; if (strlen(handlePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(handlePasswd); memcpy( &sessionData.hmac.t.buffer[0], handlePasswd, sessionData.hmac.t.size ); } else if (strlen(handlePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(handlePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for handlePasswd.\n"); return -1; } } rval = Tss2_Sys_NV_UndefineSpace( sysContext, authHandle, nvIndex, &sessionsData, 0 ); if(rval != TPM_RC_SUCCESS) { printf( "Failed to release NV area at index 0x%x (%d).Error:0x%x\n", nvIndex, nvIndex, rval ); return -1; } printf( "Success to release NV area at index 0x%x (%d).\n", nvIndex, nvIndex); return 0; } void showHelp(const char *name) { printf("Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ]\n" " or: %s [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ]\n" " [-X/--passwdInHex]\n" " [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -x/--index specifies the index of the NV area.\n" " -a/--authHandle specifies the handle used to authorize:\n" " 0x40000001 (TPM_RH_OWNER)\n" " 0x4000000C (TPM_RH_PLATFORM)\n" " -P/--handlePasswd specifies the password of authHandle.\n" " -X/--passwdInHex passwords given by any options are hex format.\n" " -p/--port specifies the port number, default:%d, optional\n" " -d/--dbg specifies level of debug messages, optional:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " %s -x 0x1500016 -a 0x40000001 -P passwd\n" " %s -x 0x1500016 -a 0x40000001 -P 1a1b1c -X" , name, name, name, name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char* argv[]) { int opt; char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int returnVal = 0; struct option sOpts[] = { { "index" , required_argument, NULL, 'x' }, { "authHandle" , required_argument, NULL, 'a' }, { "handlePasswd", required_argument, NULL, 'P' }, { "passwdInHex" , no_argument, NULL, 'X' }, { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { NULL , no_argument, NULL, 0 }, }; if( argc == 1 ) { showHelp(argv[0]); return 0; } if( argc > (int)(2*sizeof(sOpts)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while ( ( opt = getopt_long( argc, argv, "x:a:P:Xp:d:hv", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'x': if( getSizeUint32Hex(optarg, &nvIndex) != 0 ) { return -2; } break; case 'a': if( getSizeUint32Hex(optarg, &authHandle) != 0 ) { return -3; } break; case 'P': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the handle password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -4; } safeStrNCpy(handlePasswd, optarg, sizeof(handlePasswd)); break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -5; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -6; } break; default: showArgMismatch(argv[0]); return -7; } } if( nvIndex == 0 ) { printf("\nYou must provide an index (!= 0) for the NVRAM area.\n"); return -8; } if( authHandle == 0 ) { printf("\nYou must provide an right auth handle for this operation.\n"); return -9; } prepareTest(hostName, port, debugLevel); returnVal = nvSpaceRelease(); finishTest(); if(returnVal) return -10; return 0; } tpm2.0-tools-1.1.0/src/tpm2_nvwrite.cpp000066400000000000000000000233371300711361400176260ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; UINT32 nvIndex = 0; UINT32 authHandle = TPM_RH_PLATFORM; UINT16 dataSize = 0; unsigned char nvBuffer[MAX_NV_INDEX_SIZE]; char fileName[PATH_MAX]; char handlePasswd[sizeof(TPMU_HA)]; bool hexPasswd = false; int nvWrite() { UINT32 rval; TPMS_AUTH_COMMAND sessionData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; UINT16 i, offset = 0; TPM2B_MAX_NV_BUFFER nvWriteData; TPMS_AUTH_COMMAND *sessionDataArray[1] = { &sessionData }; TPMS_AUTH_RESPONSE *sessionDataOutArray[1] = { &sessionDataOut }; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; if (strlen(handlePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(handlePasswd); memcpy( &sessionData.hmac.t.buffer[0], handlePasswd, sessionData.hmac.t.size ); } else if (strlen(handlePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(handlePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for handlePasswd.\n"); return -1; } } while (dataSize > 0) { nvWriteData.t.size = dataSize > MAX_NV_BUFFER_SIZE ? MAX_NV_BUFFER_SIZE : dataSize; printf("\nThe data(size=%d) to be written:\n", nvWriteData.t.size); for( i = 0; i<(int)nvWriteData.t.size; i++ ) { nvWriteData.t.buffer[i] = nvBuffer[offset+i]; printf("%02x ", nvBuffer[offset+i]); } printf("\n\n"); rval = Tss2_Sys_NV_Write( sysContext, authHandle, nvIndex, &sessionsData, &nvWriteData, offset, &sessionsDataOut ); if(rval != TSS2_RC_SUCCESS) { printf( "Failed to write NV area at index 0x%x (%d) offset 0x%x. Error:0x%x\n", nvIndex, nvIndex, offset, rval ); return -1; } printf( "Success to write NV area at index 0x%x (%d) offset 0x%x.\n", nvIndex, nvIndex, offset ); dataSize -= nvWriteData.t.size; offset += nvWriteData.t.size; } return 0; } void showHelp(const char *name) { printf("Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ] [-f/--file ]\n" " or: %s [-x/--index ] [-a/--authHandle ] [-P/--handlePasswd ] [-f/--file ]\n" " [-X/--passwdInHex]\n" " [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -x/--index specifies the index of the NV area.\n" " -a/--authHandle specifies the handle used to authorize:\n" " 0x40000001 (TPM_RH_OWNER)\n" " 0x4000000C (TPM_RH_PLATFORM)\n" " {NV_INDEX_FIRST:NV_INDEX_LAST}\n" " -P/--handlePasswd specifies the password of authHandle.\n" " -f/--file specifies the nv data file.\n" " -X/--passwdInHex passwords given by any options are hex format.\n" " -p/--port specifies the port number, default:%d, optional\n" " -d/--dbg specifies level of debug messages, optional:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " %s -x 0x1500016 -a 0x40000001 -P passwd -f nv.data\n" " %s -x 0x1500016 -a 0x40000001 -P 1a1b1c -X -f nv.data\n" , name, name, name, name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char* argv[]) { int opt; char type[100] = "local"; char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int returnVal = 0; struct option sOpts[] = { { "index" , required_argument, NULL, 'x' }, { "authHandle" , required_argument, NULL, 'a' }, { "file" , required_argument, NULL, 'f' }, { "handlePasswd", required_argument, NULL, 'P' }, { "passwdInHex" , no_argument, NULL, 'X' }, { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { NULL , no_argument, NULL, 0 }, }; if(argc == 1) { showHelp(argv[0]); return 0; } if( argc > (int)(2*sizeof(sOpts)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while ( ( opt = getopt_long( argc, argv, "x:a:f:P:Xp:d:hv", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'x': if( getSizeUint32Hex(optarg, &nvIndex) != 0 ) { return -2; } break; case 'a': if( getSizeUint32Hex(optarg, &authHandle) != 0 ) { return -3; } break; case 'P': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input the handle password(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -4; } safeStrNCpy(&handlePasswd[0], optarg, sizeof(handlePasswd)); break; case 'f': if( optarg == NULL ) { printf("\nPlease input the nv data file.\n"); return -5; } safeStrNCpy(&fileName[0], optarg, sizeof(fileName)); break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -6; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -7; } break; default: showArgMismatch(argv[0]); return -8; } } if( nvIndex == 0 ) { printf("You must provide an index (!= 0) for the NVRAM area.\n"); return -9; } if( authHandle == 0 ) { printf("You must provide an right auth handle for this operation.\n"); return -10; } dataSize = MAX_NV_INDEX_SIZE; if(loadDataFromFile(fileName, nvBuffer, &dataSize)) { printf("Failed to read data from %s\n", fileName); return -11; } prepareTest(hostName, port, debugLevel); returnVal = nvWrite(); finishTest(); if(returnVal) return -12; return 0; } tpm2.0-tools-1.1.0/src/tpm2_quote.cpp000066400000000000000000000516741300711361400172720ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; typedef struct { int size; UINT32 id[24]; } PCR_LIST; TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; char outFilePath[PATH_MAX]; TPM2B_DATA qualifyingData = {{0,}}; TPML_PCR_SELECTION pcrSelections; void PrintBuffer( UINT8 *buffer, UINT32 size ) { UINT32 i; for( i = 0; i < size; i++ ) { printf( "%2.2x", buffer[i] ); } printf( "\n" ); } #if 0 void PrintTPM2B_ATTEST( TPM2B_ATTEST *attest ) { TPMS_ATTEST *s_att = (TPMS_ATTEST *)&attest->t.attestationData[0]; printf( "ATTEST_2B:\n" ); printf( "\tsize = 0x%4.4x\n", attest->t.size ); //already little endian printf( "\tattestationData(TPMS_ATTEST):\n" ); printf( "\t\tmagic = 0x%8.8x\n", ntohl(s_att->magic) );//big endian printf( "\t\ttype = 0x%4.4x\n", ntohs(s_att->type) ); printf( "\t\tqualifiedSigner(NAME_2B):\n" ); printf( "\t\t\tsize = 0x%4.4x\n", ntohs(s_att->qualifiedSigner.t.size) ); printf( "\t\t\tname = " ); PrintBuffer( s_att->qualifiedSigner.b.buffer, ntohs(s_att->qualifiedSigner.b.size) ); s_att = (TPMS_ATTEST *)(((BYTE *)s_att) - sizeof(s_att->qualifiedSigner.t) + ntohs(s_att->qualifiedSigner.t.size) + 2); printf( "\t\textraData(DATA_2B):\n" ); printf( "\t\t\tsize = 0x%4.4x\n", ntohs(s_att->extraData.t.size) ); printf( "\t\t\tbuffer = " ); PrintBuffer( s_att->extraData.b.buffer, ntohs(s_att->extraData.b.size) ); s_att = (TPMS_ATTEST *)(((BYTE *)s_att) - sizeof(s_att->extraData.t) + ntohs(s_att->extraData.t.size) + 2); printf( "\t\tclockInfo(TPMS_CLOCK_INFO):\n" ); printf( "\t\t\tclock = 0x%16.16lx\n", s_att->clockInfo.clock ); printf( "\t\t\tresetCount = 0x%8.8x\n", ntohl(s_att->clockInfo.resetCount) ); printf( "\t\t\trestartCount = 0x%8.8x\n", ntohl(s_att->clockInfo.restartCount) ); printf( "\t\t\tsafe = 0x%2.2x\n", s_att->clockInfo.safe ); s_att = (TPMS_ATTEST *)(((BYTE *)s_att) - 7); printf( "\t\tfirmwareVersion = 0x%16.16lx\n", s_att->firmwareVersion ); printf( "\t\tattested(TPMS_QUOTE_INFO):\n" ); printf( "\t\t\tpcrSelect(TPML_PCR_SELECTION):\n" ); printf( "\t\t\t\tcount = 0x%8.8x\n", ntohl(s_att->attested.quote.pcrSelect.count) ); for ( UINT32 i = 0; i < ntohl(s_att->attested.quote.pcrSelect.count); i++ ) { TPMS_PCR_SELECTION *s = &s_att->attested.quote.pcrSelect.pcrSelections[i]; printf( "\t\t\t\tpcrSelections[%d](TPMS_PCR_SELECTION):\n", i ); printf( "\t\t\t\t\thash = 0x%4.4x\n", ntohs(s->hash) ); printf( "\t\t\t\t\tsizeofSelect = 0x%2.2x\n", s->sizeofSelect ); printf( "\t\t\t\t\tpcrSelect = " ); PrintBuffer( s->pcrSelect, s->sizeofSelect ); } s_att = (TPMS_ATTEST *)(((BYTE *)s_att) - sizeof(s_att->attested.quote.pcrSelect) + ntohl(s_att->attested.quote.pcrSelect.count) * sizeof(TPMS_PCR_SELECTION) + 4 ); printf( "\t\t\tpcrDigest(DIGEST_2B):\n" ); printf( "\t\t\t\tsize = 0x%4.4x\n", ntohs(s_att->attested.quote.pcrDigest.t.size) ); printf( "\t\t\t\tbuffer = " ); PrintBuffer( s_att->attested.quote.pcrDigest.b.buffer, ntohs(s_att->attested.quote.pcrDigest.b.size) ); } void PrintTPMT_SIGNATURE( TPMT_SIGNATURE *sig ) { printf( "TPMT_SIGNATURE:\n" ); printf( "\tsigAlg = 0x%4.4x\n", sig->sigAlg ); printf( "\tsignature(TPMU_SIGNATURE):\n" ); switch ( sig->sigAlg ) { case TPM_ALG_RSASSA: case TPM_ALG_RSAPSS: printf( "\t\tTPMS_SIGNATURE_RSA:\n" ); printf( "\t\t\thash = 0x%4.4x\n", sig->signature.rsassa.hash ); printf( "\t\t\tsig(PUBLIC_KEY_RSA_2B):\n" ); printf( "\t\t\t\tsize = 0x%4.4x\n", sig->signature.rsassa.sig.t.size ); printf( "\t\t\t\tbuffer = " ); PrintSizedBuffer( &sig->signature.rsassa.sig.b ); break; case TPM_ALG_ECDSA: case TPM_ALG_ECDAA: case TPM_ALG_SM2: case TPM_ALG_ECSCHNORR: printf( "\t\tTPMS_SIGNATURE_ECC:\n" ); printf( "\t\t\thash = 0x%4.4x\n", sig->signature.ecdsa.hash); printf( "\t\t\tsignatureR(TPM2B_ECC_PARAMETER):\n" ); printf( "\t\t\t\tsize = 0x%4.4x\n", sig->signature.ecdsa.signatureR.t.size ); printf( "\t\t\t\tbuffer = " ); PrintSizedBuffer( &sig->signature.ecdsa.signatureR.b ); printf( "\t\t\tsignatureS(TPM2B_ECC_PARAMETER):\n" ); printf( "\t\t\t\tsize = 0x%4.4x\n", sig->signature.ecdsa.signatureS.t.size ); printf( "\t\t\t\tbuffer = " ); PrintSizedBuffer( &sig->signature.ecdsa.signatureS.b ); break; case TPM_ALG_HMAC: printf( "\t\tTPMS_HA:\n" ); printf( "\t\t\thashAlg = 0x%4.4x\n", sig->signature.hmac.hashAlg); printf( "\t\t\tdigest = " ); UINT16 size = 0; switch ( sig->signature.hmac.hashAlg ) { case TPM_ALG_SHA1: size = SHA1_DIGEST_SIZE; break; case TPM_ALG_SHA256: size = SHA256_DIGEST_SIZE; break; case TPM_ALG_SHA384: size = SHA384_DIGEST_SIZE; break; case TPM_ALG_SHA512: size = SHA512_DIGEST_SIZE; break; case TPM_ALG_SM3_256: size = SM3_256_DIGEST_SIZE; break; } PrintBuffer( (BYTE *)&sig->signature.hmac.digest, size ); break; } } #endif UINT16 calcSizeofTPM2B_ATTEST( TPM2B_ATTEST *attest ) { return 2 + attest->b.size; } UINT16 calcSizeofTPMT_SIGNATURE( TPMT_SIGNATURE *sig ) { UINT16 size = 2; switch ( sig->sigAlg ) { case TPM_ALG_RSASSA: case TPM_ALG_RSAPSS: size += 2 + 2 + sig->signature.rsassa.sig.t.size; break; case TPM_ALG_ECDSA: case TPM_ALG_ECDAA: case TPM_ALG_SM2: case TPM_ALG_ECSCHNORR: size += 2 + 2*sizeof(TPM2B_ECC_PARAMETER); break; case TPM_ALG_HMAC: size += 2; switch ( sig->signature.hmac.hashAlg ) { case TPM_ALG_SHA1: size += SHA1_DIGEST_SIZE; break; case TPM_ALG_SHA256: size += SHA256_DIGEST_SIZE; break; case TPM_ALG_SHA384: size += SHA384_DIGEST_SIZE; break; case TPM_ALG_SHA512: size += SHA512_DIGEST_SIZE; break; case TPM_ALG_SM3_256: size += SM3_256_DIGEST_SIZE; break; default: size = 0; break; } break; default: size = 0; break; } return size > sizeof(*sig) ? sizeof(*sig) : size; } int quote(TPM_HANDLE akHandle, TPML_PCR_SELECTION *pcrSelection) { UINT32 rval; TPMT_SIG_SCHEME inScheme; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPM2B_ATTEST quoted = { { sizeof(TPM2B_ATTEST)-2, } }; TPMT_SIGNATURE signature; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for AK Passwd.\n"); return -1; } } inScheme.scheme = TPM_ALG_NULL; memset( (void *)&signature, 0, sizeof(signature) ); rval = Tss2_Sys_Quote(sysContext, akHandle, &sessionsData, &qualifyingData, &inScheme, pcrSelection, "ed, &signature, &sessionsDataOut ); if(rval != TPM_RC_SUCCESS) { printf("\nQuote Failed ! ErrorCode: 0x%0x\n\n", rval); return -1; } printf( "\nquoted:\n " ); PrintSizedBuffer( (TPM2B *)"ed ); //PrintTPM2B_ATTEST("ed); printf( "\nsignature:\n " ); PrintBuffer( (UINT8 *)&signature, sizeof(signature) ); //PrintTPMT_SIGNATURE(&signature); FILE *fp = fopen(outFilePath,"w+"); if(NULL == fp) { printf("OutFile: %s Can Not Be Created !\n",outFilePath); return -2; } if(fwrite("ed, calcSizeofTPM2B_ATTEST("ed), 1 ,fp) != 1) { fclose(fp); printf("OutFile: %s Write quoted Data In Error!\n",outFilePath); return -3; } if(fwrite(&signature, calcSizeofTPMT_SIGNATURE(&signature), 1, fp) != 1) { fclose(fp); printf("OutFile: %s Write signature Data In Error!\n",outFilePath); return -4; } fclose(fp); return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info;\n" "-k, --akHandle Handle of existing AK\n" "-c, --akContext filename for the existing AK's context\n" "-P, --akPassword AK handle's Password\n" "-l, --idList The list of selected PCRs' ids, 0~23\n" "-g, --algorithm The algorithm id\n" "-L, --selList The list of pcr banks and selected PCRs' ids(0~23) for each bank\n" "-o, --outFile output file path, recording the two structures output by tpm2_quote function\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-q, --qualifyData Data given as a Hex string to qualify the quote, optional.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Note: -L option & -g/-l options are mutually exclusive. -g/-l can be used to specify PCRs in one bank, and -L can be used to specify PCRs in any number of existing banks.\n" "\n" "Example:\n" "display usage: %s -h\n" "display version: %s -v\n" "quote the selected PCR values:\n" "\t %s -k 0x80000001 -P abc123 -g 0x4 -l 16,17,18 -o outFile001\n" "\t %s -c ak.context -P abc123 -g 0x4 -l 16,17,18 -o outFile001\n" "\t %s -k 0x80000001 -g 0x4 -l 16,17,18 -o outFile001 \n" "\t %s -c ak.context -g 0x4 -l 16,17,18 -o outFile001 \n" "\t %s -k 0x80000001 -P 123abc -X -L 0x4:16,17,18+0xb:16,17,18 -o outFile001 -q 11aa22bb\n" , name, DEFAULT_RESMGR_TPM_PORT, name, name, name, name, name, name, name); } const char *findChar(const char *str, int len, char c) { if(str == NULL || len <= 0) return NULL; for(int i = 0; i < len; i++) { if(str[i] == c) return &str[i]; } return NULL; } int parsePCRList(const char *str, int len, TPMS_PCR_SELECTION *pcrSel) { char buf[3]; const char *strCurrent; int lenCurrent; UINT32 pcr; if(str == NULL || len == 0) return -1; pcrSel->sizeofSelect = 3; pcrSel->pcrSelect[0] = 0; pcrSel->pcrSelect[1] = 0; pcrSel->pcrSelect[2] = 0; do { strCurrent = str; str = findChar(strCurrent, len, ','); if(str) { lenCurrent = str - strCurrent; str++; len -= lenCurrent + 1; } else { lenCurrent = len; len = 0; } if(lenCurrent > sizeof(buf) - 1) return -1; safeStrNCpy(buf, strCurrent, lenCurrent + 1); if(getPcrId(buf, &pcr)!= 0) return -1; pcrSel->pcrSelect[pcr/8] |= (1 << (pcr % 8)); } while(str); return 0; } int parsePCRSelection(const char *str, int len, TPMS_PCR_SELECTION *pcrSel) { const char *strLeft; char buf[7]; if(str == NULL || len == 0) return -1; strLeft = findChar(str, len, ':'); if(strLeft == NULL) return -1; if(strLeft - str > sizeof(buf) - 1) return -1; safeStrNCpy(buf, str, strLeft - str + 1); if(getSizeUint16Hex(buf, &pcrSel->hash) != 0) return -1; strLeft++; if(strLeft - str >= len) return -1; if(parsePCRList(strLeft, str + len - strLeft, pcrSel)) return -1; return 0; } int parsePCRSelections(const char *arg, TPML_PCR_SELECTION *pcrSels) { const char *strLeft = arg; const char *strCurrent = arg; int lenCurrent = 0; if(arg == NULL || pcrSels == NULL) return -1; pcrSels->count = 0; do { strCurrent = strLeft; strLeft = findChar(strCurrent, strlen(strCurrent), '+'); if(strLeft) { lenCurrent = strLeft - strCurrent; strLeft++; } else lenCurrent = strlen(strCurrent); if(parsePCRSelection(strCurrent, lenCurrent, &pcrSels->pcrSelections[pcrSels->count])) return -1; pcrSels->count++; } while(strLeft); if(pcrSels->count == 0) return -1; return 0; } int main(int argc, char *argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvk:c:P:l:g:L:o:Xq:p:d:"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"akHandle",1,NULL,'k'}, {"akContext",1,NULL,'c'}, {"akPassword",1,NULL,'P'}, //add ak auth {"idList",1,NULL,'l'}, {"algorithm",1,NULL,'g'}, {"selList",1,NULL,'L'}, {"outFile",1,NULL,'o'}, {"passwdInHex",0,NULL,'X'}, {"qualifyData",1,NULL,'q'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {0,0,0,0} }; char *contextFilePath = NULL; TPM_HANDLE akHandle; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, k_flag = 0, c_flag = 0, P_flag = 0, l_flag = 0, g_flag = 0, L_flag = 0, o_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'k': if(getSizeUint32Hex(optarg,&akHandle) != 0) { showArgError(optarg, argv[0]); returnVal = -1; break; } k_flag = 1; break; case 'c': contextFilePath = optarg; if(contextFilePath == NULL || contextFilePath[0] == '\0') { showArgError(optarg, argv[0]); returnVal = -2; break; } printf("contextFile = %s\n", contextFilePath); c_flag = 1; break; case 'P': sessionData.hmac.t.size = sizeof(sessionData.hmac.t) - 2; if(str2ByteStructure(optarg,&sessionData.hmac.t.size,sessionData.hmac.t.buffer) != 0) { showArgError(optarg, argv[0]); returnVal = -3; break; } P_flag = 1; break; case 'l': if(parsePCRList(optarg, strlen(optarg), &pcrSelections.pcrSelections[0]) != 0) { showArgError(optarg, argv[0]); returnVal = -4; break; } l_flag = 1; break; case 'g': if(getSizeUint16Hex(optarg,&pcrSelections.pcrSelections[0].hash) != 0) { showArgError(optarg, argv[0]); returnVal = -5; break; } pcrSelections.count = 1; g_flag = 1; break; case 'L': if(parsePCRSelections(optarg, &pcrSelections) != 0) { showArgError(optarg, argv[0]); returnVal = -15; break; } L_flag = 1; break; case 'o': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { showArgError(optarg, argv[0]); returnVal = -6; break; } o_flag = 1; break; case 'X': hexPasswd = true; break; case 'q': qualifyingData.t.size = sizeof(qualifyingData) - 2; if(hex2ByteStructure(optarg,&qualifyingData.t.size,qualifyingData.t.buffer) != 0) { showArgError(optarg, argv[0]); returnVal = -14; break; } break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -7; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -8; } break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -9; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -10; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + k_flag + c_flag + l_flag + g_flag + L_flag + o_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -11; } } else if(((flagCnt == 3 && L_flag) || (flagCnt == 4 && (g_flag && l_flag))) && (k_flag || c_flag) && o_flag) { if(P_flag == 0) sessionData.hmac.t.size = 0; prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &akHandle, contextFilePath); if(returnVal == TPM_RC_SUCCESS) returnVal = quote(akHandle, &pcrSelections); finishTest(); if(returnVal) return -12; } else { showArgMismatch(argv[0]); return -13; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_rc_decode.c000066400000000000000000000215351300711361400174750ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2016, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include "common.h" #include "rc-decode.h" #define TPM_RC_MAX 0xffffffff void showHelp (const char *name) { printf ("%s [--version|--help] TPM_RC\n" "-h, --help\t\tDisplay help message\n" "-v, --version\t\tDisplay version info\n" "\nExample:\n" "Decode hex TPM return code: %s 0xffffffff\n", name, name); } TPM_RC str_to_tpm_rc (const char *rc_str) { uintmax_t rc_read = 0; char *end_ptr = NULL; rc_read = strtoumax (rc_str, &end_ptr, 0); if (rc_read > TPM_RC_MAX) { fprintf (stderr, "invalid TPM_RC\n"); exit (1); } /* apply the TPM_RC_MAX mask to the possibly larger uintmax_t */ return rc_read & TPM_RC_MAX; } int process_cmdline (int argc, char *argv[]) { int opt = -1; const char *optstring = "hv"; static struct option long_options[] = { { "help", 0 , NULL, 'h' }, { "version", 0, NULL, 'v' }, { 0 } }; while ((opt = getopt_long (argc, argv, optstring, long_options, NULL)) != -1) { switch (opt) { case 'h': showHelp (argv[0]); exit (0); case 'v': showVersion (argv[0]); exit (0); case '?': exit (1); } } return optind; } /* Dump the hex, identifier and description for the format zero / VER1 error * provided in TPM_RC parameter. */ int print_tpm_rc_format_zero (TPM_RC rc) { TPM_RC rc_tmp; tpm2_rc_entry_t *entry; rc_tmp = tpm2_rc_get_code_7bit (rc); if (tpm2_rc_is_vendor_defined (rc)) { fprintf (stderr, "vendor defined TPM_RCs are not supported\n"); return -1; } else if (tpm2_rc_is_warning_code (rc)) { entry = tpm2_get_warn_entry (rc_tmp); if (entry) printf ("format 0 warning code\n hex: 0x%02x\n name: %s\n " "description: %s\n", rc_tmp, entry->name, entry->description); else printf ("failed to decode TPM_RC warning: 0x%x\n", rc_tmp); } else if (tpm2_rc_is_error_code (rc)) { entry = tpm2_get_fmt0_entry (rc_tmp); if (entry) printf ("format 0 error code\n hex: 0x%02x\n name: %s\n " "description: %s\n", rc_tmp, entry->name, entry->description); else printf ("failed to decode TPM_RC error: 0x%02x\n", rc_tmp); } else if (tpm2_rc_is_tpm12 (rc_tmp)) { fprintf (stderr, "version 1.2 TPM_RCs are not supproted\n"); return -1; } else { fprintf (stderr, "Unknown TPM_RC format\n"); return -1; } /* decode warning / error code */ return 0; } /* Dump the hex, identifier and description for the format one / FMT1 error * as well as the parameter, handle or session data. */ int print_tpm_rc_format_one (TPM_RC rc) { TPM_RC rc_tmp; tpm2_rc_entry_t *entry; int ret; printf ("format 1 error code\n"); rc_tmp = tpm2_rc_get_code_6bit (rc); printf (" hex: 0x%02x\n", rc_tmp); /* decode error message */ entry = tpm2_get_fmt1_entry (rc_tmp); if (!entry) { printf ("Unknown TPM_RC\n"); return -1; } printf (" identifier: %s\n description: %s\n", entry->name, entry->description); /* decode parameter / handle / session number */ if (tpm2_rc_is_error_code_with_parameter (rc)) { rc_tmp = tpm2_rc_get_parameter_number (rc); entry = tpm2_get_parameter_entry (rc_tmp); if (!entry) { printf ("Unknown TPM_RC parameter number: 0x%03x\n", rc_tmp); return -1; } printf ("parameter\n hex: 0x%03x\n identifier: %s\n " "description: %s\n", rc_tmp, entry->name, entry->description); } else if (tpm2_rc_is_error_code_with_handle (rc)) { rc_tmp = tpm2_rc_get_handle_number (rc); entry = tpm2_get_handle_entry (rc_tmp); if (!entry) { printf ("Unkonwn TPM_RC handle number: 0x%03x\n", rc_tmp); return -1; } printf ("handle\n hex:0x%03x\n identifier: %s\n " "description: %s\n", rc_tmp, entry->name, entry->description); } else if (tpm2_rc_is_error_code_with_session (rc)) { rc_tmp = tpm2_rc_get_session_number (rc); entry = tpm2_get_session_entry (rc_tmp); if (!entry) { printf ("Unknown TPM_RC session number: 0x%03x\n", rc_tmp); return -1; } printf ("session\n hex: 0x%03x\n identifier: %s\n " "description: %s\n", rc_tmp, entry->name, entry->description); } return 0; } /* Dump the hex, identifier and description for the TSS defined layer * indicator in the provided TPM_RC. */ int print_tpm_rc_tss_layer (TPM_RC rc) { TPM_RC rc_tmp; tpm2_rc_entry_t *entry; int ret; rc_tmp = tpm2_rc_get_layer (rc); /* Currently no entry for 0x0 layer, assume it's directly from the TPM? */ printf ("error layer\n hex: 0x%x\n", rc_tmp); entry = tpm2_get_layer_entry (rc_tmp); if (entry) { printf (" identifier: %s\n description: %s\n", entry->name, entry->description); ret = 0; } else { printf ("failed to decode TPM_RC layer: 0x%x\n", rc_tmp); ret = -1; } return ret; } /* Dump the hex, identifier string and description for the TSS defined * base error code in the provided TPM_RC. */ int print_tpm_rc_tss_error_code (TPM_RC rc) { TPM_RC rc_tmp; tpm2_rc_entry_t *entry; int ret; entry = tpm2_get_tss_base_rc_entry (rc); if (entry) { printf ("base error code\n identifier: %s\n description: %s\n", entry->name, entry->description); ret = 0; } else { rc_tmp = tpm2_rc_get_tss_err_code (rc); printf ("failed to decode TPM_RC error code: 0x%x\n", rc_tmp); ret = -1; } return ret; } /* Top level function to dump human readable data about TPM_RCs as defined * in the TPM2 Part 2: Structures, Table 17.. */ int print_tpm_rc_tpm_error_code (TPM_RC rc) { if (tpm2_rc_is_format_zero (rc)) print_tpm_rc_format_zero (rc); else if (tpm2_rc_is_format_one (rc)) print_tpm_rc_format_one (rc); else { fprintf (stderr, "Unknown TPM_RC format\n"); return -1; } } /* Top level function to dump human readable data about TPM_RCs. */ int print_tpm_rc (TPM_RC rc) { int ret; TPM_RC rc_tmp; /* determin which layer in the stack produced the error */ rc_tmp = tpm2_rc_get_layer (rc); ret = print_tpm_rc_tss_layer (rc); switch (rc_tmp) { case TSS2_SYS_ERROR_LEVEL: case TSS2_TCTI_ERROR_LEVEL: ret = print_tpm_rc_tss_error_code (rc); break; case TSS2_SYS_PART2_ERROR_LEVEL: case TSS2_TPM_ERROR_LEVEL: ret = print_tpm_rc_tpm_error_code (rc); break; default: break; } return ret; } int main (int argc, char *argv[]) { TPM_RC rc = 0; int pos_ind = -1, ret = -1; pos_ind = process_cmdline (argc, argv); if (pos_ind + 1 != argc) { printf ("No error code provided, try --help\n"); exit (1); } rc = str_to_tpm_rc (argv[pos_ind]); ret = print_tpm_rc (rc); exit (ret); } tpm2.0-tools-1.1.0/src/tpm2_readpublic.cpp000066400000000000000000000170011300711361400202310ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; int readPublic(TPMI_DH_OBJECT objectHandle, const char *outFilePath) { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_PUBLIC outPublic = { { 0, } }; TPM2B_NAME name = { { sizeof(TPM2B_NAME)-2, } }; TPM2B_NAME qualifiedName = { { sizeof(TPM2B_NAME)-2, } }; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsDataOut.rspAuthsCount = 1; rval = Tss2_Sys_ReadPublic(sysContext, objectHandle, 0, &outPublic, &name, &qualifiedName, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("\nTPM2_ReadPublic error: rval = 0x%0x\n\n",rval); return -1; } printf("\nTPM2_ReadPublic OutPut: \n"); printf("name: \n"); for(UINT16 i = 0; i < name.t.size; i++) printf("%02x ",name.t.name[i]); printf("\n"); printf("qualifiedName: \n"); for(UINT16 j = 0; j < qualifiedName.t.size; j++) printf("%02x ",qualifiedName.t.name[j]); printf("\n"); if(saveDataToFile(outFilePath, (UINT8 *)&outPublic, sizeof(outPublic))) return -2; return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-H, --object The loaded object handle \n" "-c, --contextObject filename for object context\n" "-o, --opu The output file path,\n" " recording the readout public portion of the object\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -H 0x80000000 --opu \n" , name, DEFAULT_RESMGR_TPM_PORT, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPMI_DH_OBJECT objectHandle; char outFilePath[PATH_MAX] = {0}; char *contextFile = NULL; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvH:o:p:d:c:"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"object",1,NULL,'H'}, {"opu",1,NULL,'o'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"contextObject",1,NULL,'c'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, H_flag = 0, c_flag = 0, o_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'H': if(getSizeUint32Hex(optarg,&objectHandle) != 0) { returnVal = -1; break; } printf("\nobject handle: 0x%x\n\n",objectHandle); H_flag = 1; break; case 'o': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -2; break; } o_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -3; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -4; } break; case 'c': contextFile = optarg; if(contextFile == NULL || contextFile[0] == '\0') { returnVal = -5; break; } printf("contextFile = %s\n", contextFile); c_flag = 1; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -6; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -7; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + H_flag + o_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -8; } } else if(flagCnt == 2 && (H_flag == 1 || c_flag) && o_flag == 1) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &objectHandle, contextFile); if(returnVal == 0) returnVal = readPublic(objectHandle, outFilePath); finishTest(); if(returnVal) return -9; } else { showArgMismatch(argv[0]); return -10; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_rsadecrypt.cpp000066400000000000000000000225601300711361400203050ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; int rsaDecrypt(TPMI_DH_OBJECT keyHandle, TPM2B_PUBLIC_KEY_RSA *cipherText, const char *outFilePath) { UINT32 rval; TPMT_RSA_DECRYPT inScheme; TPM2B_DATA label; TPM2B_PUBLIC_KEY_RSA message = { { sizeof(TPM2B_PUBLIC_KEY_RSA)-2, } }; TSS2_SYS_CMD_AUTHS sessionsData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; sessionDataArray[0] = &sessionData; sessionsData.cmdAuths = &sessionDataArray[0]; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for key Passwd.\n"); return -1; } } inScheme.scheme = TPM_ALG_RSAES; label.t.size = 0; rval = Tss2_Sys_RSA_Decrypt(sysContext, keyHandle, &sessionsData, cipherText, &inScheme, &label, &message, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("rsaDecrypt failed, error code: 0x%x\n", rval); return -1; } printf("\nRSA Decrypt succ.\n"); if(saveDataToFile(outFilePath, message.t.buffer, message.t.size)) { printf("OutFile %s failed!\n", outFilePath); return -1; } printf("OutFile %s completed!\n", outFilePath); return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-k, --keyHandle the public portion of RSA key to use for decryption \n" "-c, --keyContext filename of the key context used for the operation\n" "-P, --pwdk the password of key, optional\n" "-I, --inFile Input file path, containing the data to be decrypted\n" "-o, --outFile Output file path, record the decrypted data\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -k 0x81010001 -I -o \n" "%s -k 0x81010001 -P 123abc -X -I -o \n" ,name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPMI_DH_OBJECT keyHandle; TPM2B_PUBLIC_KEY_RSA cipherText; char outFilePath[PATH_MAX] = {0}; char *contextKeyFile = NULL; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvk:P:I:o:p:d:c:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"keyHandle",1,NULL,'k'}, {"pwdk",1,NULL,'P'}, {"inFile",1,NULL,'I'}, {"outFile",1,NULL,'o'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"keyContext",1,NULL,'c'}, {"passwdInHex",0,NULL,'X'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, k_flag = 0, P_flag = 0, I_flag = 0, c_flag = 0, o_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'k': if(getSizeUint32Hex(optarg,&keyHandle) != 0) { returnVal = -1; break; } k_flag = 1; break; case 'P': sessionData.hmac.t.size = sizeof(sessionData.hmac.t) - 2; if(str2ByteStructure(optarg,&sessionData.hmac.t.size,sessionData.hmac.t.buffer) != 0) { returnVal = -2; break; } P_flag = 1; break; case 'I': cipherText.t.size = sizeof(cipherText) - 2; if(loadDataFromFile(optarg, cipherText.t.buffer, &cipherText.t.size) != 0) { returnVal = -3; break; } I_flag = 1; break; case 'o': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -4; break; } o_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -5; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -6; } break; case 'c': contextKeyFile = optarg; if(contextKeyFile == NULL || contextKeyFile[0] == '\0') { returnVal = -7; break; } printf("contextKeyFile = %s\n", contextKeyFile); c_flag = 1; break; case 'X': hexPasswd = true; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -8; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -9; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; if(P_flag == 0) sessionData.hmac.t.size = 0; flagCnt = h_flag + v_flag + k_flag + I_flag + o_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -10; } } else if((flagCnt == 3) && (k_flag == 1 || c_flag == 1) && (I_flag == 1) && (o_flag == 1)) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &keyHandle, contextKeyFile); if(returnVal == 0) returnVal = rsaDecrypt(keyHandle, &cipherText, outFilePath); finishTest(); if(returnVal) return -11; } else { showArgMismatch(argv[0]); return -12; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_rsaencrypt.cpp000066400000000000000000000174701300711361400203230ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; int rsaEncrypt(TPMI_DH_OBJECT keyHandle, TPM2B_PUBLIC_KEY_RSA *message, const char *outFilePath) { UINT32 rval; // Inputs TPMT_RSA_DECRYPT inScheme; TPM2B_DATA label; // Outputs TPM2B_PUBLIC_KEY_RSA outData = { { sizeof(TPM2B_PUBLIC_KEY_RSA)-2, } }; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsDataOut.rspAuthsCount = 1; inScheme.scheme = TPM_ALG_RSAES; label.t.size = 0; rval = Tss2_Sys_RSA_Encrypt(sysContext, keyHandle, NULL, message, &inScheme, &label, &outData, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("rsaencrypt failed, error code: 0x%x\n", rval); return -1; } printf("\nRSA Encrypt succ.\n"); if(saveDataToFile(outFilePath, outData.t.buffer, outData.t.size)) { printf("OutFile %s failed!\n", outFilePath); return -2; } printf("OutFile %s completed!\n",outFilePath); return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-k, --keyHandle the public portion of RSA key to use for encryption \n" "-c, --keyContext filename of the key context used for the operation\n" "-I, --inFile Input file path, containing the data to be encrypted\n" "-o, --outFile Output file path, record the encrypted data\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -k 0x81010001 -I -o \n" , name, DEFAULT_RESMGR_TPM_PORT, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPMI_DH_OBJECT keyHandle; TPM2B_PUBLIC_KEY_RSA message; char outFilePath[PATH_MAX] = {0}; char *contextKeyFile = NULL; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvk:I:o:p:d:c:"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"keyHandle",1,NULL,'k'}, {"inFile",1,NULL,'I'}, {"outFile",1,NULL,'o'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"keyContext",1,NULL,'c'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, k_flag = 0, I_flag = 0, c_flag = 0, o_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'k': if(getSizeUint32Hex(optarg,&keyHandle) != 0) { returnVal = -1; break; } k_flag = 1; break; case 'I': message.t.size = sizeof(message) - 2; if(loadDataFromFile(optarg, message.t.buffer, &message.t.size) != 0) { returnVal = -2; break; } I_flag = 1; break; case 'o': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -3; break; } o_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -4; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -5; } break; case 'c': contextKeyFile = optarg; if(contextKeyFile == NULL || contextKeyFile[0] == '\0') { returnVal = -6; break; } printf("contextKeyFile = %s\n", contextKeyFile); c_flag = 1; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -7; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -8; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + k_flag + I_flag + o_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -9; } } else if((flagCnt == 3) && (k_flag == 1 || c_flag == 1) && (I_flag == 1) && (o_flag == 1)) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &keyHandle, contextKeyFile); if (returnVal == 0) returnVal = rsaEncrypt(keyHandle, &message, outFilePath); finishTest(); if(returnVal) return -10; } else { showArgMismatch(argv[0]); return -11; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_sign.cpp000066400000000000000000000326521300711361400170700ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; int getKeyType(TPMI_DH_OBJECT objectHandle, TPMI_ALG_PUBLIC *type) { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TPMS_AUTH_RESPONSE *sessionDataOutArray[1] = {&sessionDataOut}; TSS2_SYS_RSP_AUTHS sessionsDataOut = {1, &sessionDataOutArray[0]}; TPM2B_PUBLIC outPublic = { { 0, } }; TPM2B_NAME name = { { sizeof(TPM2B_NAME)-2, } }; TPM2B_NAME qualifiedName = { { sizeof(TPM2B_NAME)-2, } }; rval = Tss2_Sys_ReadPublic(sysContext, objectHandle, 0, &outPublic, &name, &qualifiedName, &sessionsDataOut); if(rval == TPM_RC_SUCCESS) { *type = outPublic.t.publicArea.type; return 0; } return -1; } int setScheme(TPMI_DH_OBJECT keyHandle, TPMI_ALG_HASH halg, TPMT_SIG_SCHEME *inScheme) { TPM_ALG_ID type; if(getKeyType(keyHandle, &type)) return -1; printf("\nkeyType: 0x%04x\n", type); switch(type) { case TPM_ALG_RSA: inScheme->scheme = TPM_ALG_RSASSA; inScheme->details.rsassa.hashAlg = halg; break; case TPM_ALG_KEYEDHASH: inScheme->scheme = TPM_ALG_HMAC; inScheme->details.hmac.hashAlg = halg; break; case TPM_ALG_ECC: inScheme->scheme = TPM_ALG_ECDSA; inScheme->details.ecdsa.hashAlg = halg; break; case TPM_ALG_SYMCIPHER: default: return -2; } return 0; } int sign(TPMI_DH_OBJECT keyHandle, TPMI_ALG_HASH halg, BYTE *msg, UINT16 length, TPMT_TK_HASHCHECK *validation, const char *outFilePath) { UINT32 rval; TPM2B_DIGEST digest = { {sizeof(TPM2B_DIGEST)-2, } }; TPMT_SIG_SCHEME inScheme; TPMT_SIGNATURE signature; TSS2_SYS_CMD_AUTHS sessionsData; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; sessionDataArray[0] = &sessionData; sessionsData.cmdAuths = &sessionDataArray[0]; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for key Passwd.\n"); return -1; } } if(computeDataHash(msg, length, halg, &digest)) { printf("Compute message hash failed !\n"); return -1; } printf("\ndigest(hex type):\n "); for(UINT16 i = 0; i < digest.t.size; i++) printf("%02x ", digest.t.buffer[i]); printf("\n"); if(setScheme(keyHandle, halg, &inScheme)) { printf("No suitable signing scheme!\n"); return -2; } rval = Tss2_Sys_Sign(sysContext, keyHandle, &sessionsData, &digest, &inScheme, validation, &signature, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("tpm2_sign failed, error code: 0x%x\n", rval); return -3; } printf("\ntpm2_sign succ.\n"); if(saveDataToFile(outFilePath, (UINT8 *)&signature, sizeof(signature))) { printf("failed to save signature into %s\n", outFilePath); return -4; } return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-k, --keyHandle Handle of key that will perform signing\n" "-c, --keyContext filename of the key context used for the operation\n" "-P, --pwdk the password of key, optional\n" "-g, --halg the hash algorithm used to digest the message \n" "\t0x0004 TPM_ALG_SHA1\n" "\t0x000B TPM_ALG_SHA256\n" "\t0x000C TPM_ALG_SHA384\n" "\t0x000D TPM_ALG_SHA512\n" "\t0x0012 TPM_ALG_SM3_256\n" "-m, --msg the message file, containning the content to be digested\n" "-t, --ticket the ticket file, containning the validation structure, optional\n" "-s, --sig the signature file, record the signature structure\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -k 0x81010001 -P abc123 -g 0x000B -m -s -t \n" "%s -k 0x81010001 -g 0x00B -m -s \n\n"// -i \n\n",DEFAULT_TPM_PORT); "%s -k 0x81010001 -P 123abc -X -g 0x000B -m -s -t \n" ,name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPMI_DH_OBJECT keyHandle; BYTE *msg = NULL; UINT16 length = 0; UINT16 size = 0; long fileSize = 0; TPMT_TK_HASHCHECK validation; TPMI_ALG_HASH halg; char outFilePath[PATH_MAX] = {0}; char inMsgFileName[PATH_MAX] = {0}; char *contextKeyFile = NULL; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvk:P:g:m:t:s:p:d:c:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"keyHandle",1,NULL,'k'}, {"pwdk",1,NULL,'P'}, {"halg",1,NULL,'g'}, {"msg",1,NULL,'m'}, {"sig",1,NULL,'s'}, {"ticket",1,NULL,'t'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"keyContext",1,NULL,'c'}, {"passwdInHex",0,NULL,'X'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, k_flag = 0, P_flag = 0, g_flag = 0, m_flag = 0, t_flag = 0, c_flag = 0, s_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'k': if(getSizeUint32Hex(optarg,&keyHandle) != 0) { returnVal = -1; break; } k_flag = 1; break; case 'P': sessionData.hmac.t.size = sizeof(sessionData.hmac.t) - 2; if(str2ByteStructure(optarg,&sessionData.hmac.t.size,sessionData.hmac.t.buffer) != 0) { returnVal = -2; break; } P_flag = 1; break; case 'g': if(getSizeUint16Hex(optarg,&halg) != 0) { showArgError(optarg, argv[0]); returnVal = -3; break; } printf("halg = 0x%4.4x\n", halg); g_flag = 1; break; case 'm': safeStrNCpy(inMsgFileName, optarg, sizeof(inMsgFileName)); m_flag = 1; break; case 't': size = sizeof(validation); if(loadDataFromFile(optarg, (UINT8 *)&validation, &size) != 0) { returnVal = -4; break; } t_flag = 1; break; case 's': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -5; break; } s_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -6; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -7; } break; case 'c': contextKeyFile = optarg; if(contextKeyFile == NULL || contextKeyFile[0] == '\0') { returnVal = -8; break; } printf("contextKeyFile = %s\n", contextKeyFile); c_flag = 1; break; case 'X': hexPasswd = true; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -9; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -10; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) goto end; if(m_flag) { if(getFileSize(inMsgFileName, &fileSize)) { returnVal = -11; goto end; } if(fileSize == 0) { printf("the message file is empty !\n"); returnVal = -12; goto end; } if(fileSize > 0xffff) { printf("the message file was too long !\n"); returnVal = -13; goto end; } msg = (BYTE*)malloc(fileSize); if(msg == NULL) { returnVal = -14; goto end; } memset(msg, 0, fileSize); length = fileSize; if(loadDataFromFile(inMsgFileName, msg, &length) != 0) { returnVal = -15; goto end; } #if 0 printf("\nmsg length: %d\n",length); printf("msg content: "); for(int i = 0; i < length; i++) { printf("%02x ", msg[i]); } printf("\n"); return -1; #endif } if(P_flag == 0) sessionData.hmac.t.size = 0; if(t_flag == 0) { validation.tag = TPM_ST_HASHCHECK; validation.hierarchy = TPM_RH_NULL; validation.digest.t.size = 0; } flagCnt = h_flag + v_flag + k_flag + g_flag + m_flag + s_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); returnVal = -16; } } else if((flagCnt == 4) && (k_flag == 1 || c_flag == 1) && (g_flag == 1) && (m_flag == 1) && (s_flag == 1)) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &keyHandle, contextKeyFile); if(returnVal == 0) returnVal = sign(keyHandle, halg, msg, length, &validation, outFilePath); finishTest(); if(returnVal) returnVal = -17; } else { showArgMismatch(argv[0]); returnVal = -18; } end: if(msg) free(msg); return returnVal; } tpm2.0-tools-1.1.0/src/tpm2_takeownership.cpp000066400000000000000000000375611300711361400210170ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; char oldOwnerPasswd[sizeof(TPMU_HA)]; char oldEndorsePasswd[sizeof(TPMU_HA)]; char oldLockoutPasswd[sizeof(TPMU_HA)]; char newOwnerPasswd[sizeof(TPMU_HA)]; char newEndorsePasswd[sizeof(TPMU_HA)]; char newLockoutPasswd[sizeof(TPMU_HA)]; bool hexPasswd = false; int clearHierarchyAuth() { UINT32 rval; TPMS_AUTH_COMMAND sessionData; TSS2_SYS_CMD_AUTHS sessionsData; TPMS_AUTH_COMMAND *sessionDataArray[1]; sessionDataArray[0] = &sessionData; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; if (strlen(oldLockoutPasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(oldLockoutPasswd); memcpy( &sessionData.hmac.t.buffer[0], oldLockoutPasswd, sessionData.hmac.t.size ); } else if (strlen(oldLockoutPasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(oldLockoutPasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for oldLockoutPasswd.\n"); return -1; } } rval = Tss2_Sys_Clear ( sysContext, TPM_RH_LOCKOUT, &sessionsData, 0 ); if(rval != TPM_RC_SUCCESS) { printf("\nClear Failed ! ErrorCode: 0x%0x\n\n", rval); return -2; } return 0; } int changeHierarchyAuth() { UINT32 rval; TPM2B_AUTH newAuth; TPMS_AUTH_COMMAND sessionData; TSS2_SYS_CMD_AUTHS sessionsData; TPMS_AUTH_COMMAND *sessionDataArray[1]; sessionDataArray[0] = &sessionData; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; sessionData.hmac.t.size = 0; *( (UINT8 *)((void *)&sessionData.sessionAttributes ) ) = 0; // Change Owner Auth newAuth.t.size = 0; if (strlen(newOwnerPasswd) > 0 && !hexPasswd) { newAuth.t.size = strlen(newOwnerPasswd); memcpy( &newAuth.t.buffer[0], newOwnerPasswd, newAuth.t.size ); } else if (strlen(newOwnerPasswd) > 0 && hexPasswd) { newAuth.t.size = sizeof(newAuth) - 2; if (hex2ByteStructure(newOwnerPasswd, &newAuth.t.size, newAuth.t.buffer) != 0) { printf( "Failed to convert Hex format password for newOwnerPasswd.\n"); return -1; } } sessionData.hmac.t.size = 0; if (strlen(oldOwnerPasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(oldOwnerPasswd); memcpy( &sessionData.hmac.t.buffer[0], oldOwnerPasswd, sessionData.hmac.t.size ); } else if (strlen(oldOwnerPasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(oldOwnerPasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for oldOwnerPasswd.\n"); return -1; } } rval = Tss2_Sys_HierarchyChangeAuth( sysContext, TPM_RH_OWNER, &sessionsData, &newAuth, 0 ); if( rval != TPM_RC_SUCCESS ) { printf("\n......Change Hierarchy Owner Auth Error. TPM Error:0x%x......\n", rval); return -1; } printf("\n......Change Hierarchy Owner Auth Succ......\n"); // Change Endorsement Auth newAuth.t.size = 0; if (strlen(newEndorsePasswd) > 0 && !hexPasswd) { newAuth.t.size = strlen(newEndorsePasswd); memcpy( &newAuth.t.buffer[0], newEndorsePasswd, newAuth.t.size ); } else if (strlen(newEndorsePasswd) > 0 && hexPasswd) { newAuth.t.size = sizeof(newAuth) - 2; if (hex2ByteStructure(newEndorsePasswd, &newAuth.t.size, newAuth.t.buffer) != 0) { printf( "Failed to convert Hex format password for newEndorsePasswd.\n"); return -1; } } sessionData.hmac.t.size = 0; if (strlen(oldEndorsePasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(oldEndorsePasswd); memcpy( &sessionData.hmac.t.buffer[0], oldEndorsePasswd, sessionData.hmac.t.size ); } else if (strlen(oldEndorsePasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(oldEndorsePasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for oldEndorsePasswd.\n"); return -1; } } rval = Tss2_Sys_HierarchyChangeAuth( sysContext, TPM_RH_ENDORSEMENT, &sessionsData, &newAuth, 0 ); if( rval != TPM_RC_SUCCESS ) { printf("\n......Change Hierarchy Endorsement Auth Error. TPM Error:0x%x......\n", rval); return -2; } printf("\n......Change Hierarchy Endorsement Auth Succ......\n"); // Change Lockout Auth newAuth.t.size = strlen( newLockoutPasswd ); memcpy( &newAuth.t.buffer[0], newLockoutPasswd, newAuth.t.size ); sessionData.hmac.t.size = strlen( oldLockoutPasswd ); memcpy( &sessionData.hmac.t.buffer[0], oldLockoutPasswd, sessionData.hmac.t.size ); newAuth.t.size = 0; if (strlen(newLockoutPasswd) > 0 && !hexPasswd) { newAuth.t.size = strlen(newLockoutPasswd); memcpy( &newAuth.t.buffer[0], newLockoutPasswd, newAuth.t.size ); } else if (strlen(newLockoutPasswd) > 0 && hexPasswd) { newAuth.t.size = sizeof(newAuth) - 2; if (hex2ByteStructure(newLockoutPasswd, &newAuth.t.size, newAuth.t.buffer) != 0) { printf( "Failed to convert Hex format password for newLockoutPasswd.\n"); return -1; } } sessionData.hmac.t.size = 0; if (strlen(oldLockoutPasswd) > 0 && !hexPasswd) { sessionData.hmac.t.size = strlen(oldLockoutPasswd); memcpy( &sessionData.hmac.t.buffer[0], oldLockoutPasswd, sessionData.hmac.t.size ); } else if (strlen(oldLockoutPasswd) > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure(oldLockoutPasswd, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for oldLockoutPasswd.\n"); return -1; } } rval = Tss2_Sys_HierarchyChangeAuth( sysContext, TPM_RH_LOCKOUT, &sessionsData, &newAuth, 0 ); if( rval != TPM_RC_SUCCESS ) { printf("\n......Change Hierarchy Lockout Auth Error. TPM Error:0x%x......\n", rval); return -3; } printf("\n......Change Hierarchy Lockout Auth Succ......\n"); return 0; } void showHelp(const char *name) { printf("\n%s: inserting authorization values for the owner, endorsement, and lockout.\n" "Usage: %s [-h/--help]\n" " or: %s [-v/--version]\n" " or: %s [-e/--endorsePasswd ] [-o/--ownerPasswd ] [-l/--lockPasswd ]\n" " [-E/--oldEndorsePasswd ] [-O/--oldOwnerPasswd ] [-L/--oldLockPasswd ]\n" " or: %s [-e/--endorsePasswd ] [-o/--ownerPasswd ] [-l/--lockPasswd ]\n" " [-E/--oldEndorsePasswd ] [-O/--oldOwnerPasswd ] [-L/--oldLockPasswd ]\n" " [-X/--passwdInHex]\n" " [-p/--port ] [-d/--dbg ]\n" "\nwhere:\n\n" " -h/--help display this help and exit.\n" " -v/--version display version information and exit.\n" " -o/--ownerPasswd new Owner authorization value.\n" " -e/--endorsePasswd new Endorsement authorization value.\n" " -l/--lockPasswd new Lockout authorization value.\n" " -O/--oldOwnerPasswd old Owner authorization (string,optional,default:NULL).\n" " -E/--oldEndorsePasswd old Endorsement authorization (string,optional,default:NULL).\n" " -L/--oldLockPasswd old Lockout authorization (string,optional,default:NULL).\n" " -X/--passwdInHex passwords given by any options are hex format.\n" " -p/--port specifies the port number. default %d.\n" " -c/--clear [-L [-X]] clears the 3 authorizations values with lockout auth.\n" " -d/--dbg specifies level of debug messages:\n" " 0 (high level test results)\n" " 1 (test app send/receive byte streams)\n" " 2 (resource manager send/receive byte streams)\n" " 3 (resource manager tables)\n" "\nexample:\n" " Set ownerAuth, endorsementAuth and lockoutAuth to emptyAuth: %s -c -L old\n" " Set ownerAuth, endorsementAuth and lockoutAuth to a newAuth:\n" " %s -o new -e new -l new -O old -E old -L old\n" " %s -o 2a2b2c -e 2a2b2c -l 2a2b2c -O 1a1b1c -E 1a1b1c -L 1a1b1c -X\n" , name, name, name, name, name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char *argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; int opt; int clearAuth = 0; bool argsError = false; int returnVal = 0; struct option sOpts[] = { { "ownerPasswd" , required_argument, NULL, 'o' }, { "endorsePasswd" , required_argument, NULL, 'e' }, { "lockPasswd" , required_argument, NULL, 'l' }, { "oldOwnerPasswd" , required_argument, NULL, 'O' }, { "oldEndorsePasswd", required_argument, NULL, 'E' }, { "oldLockPasswd" , required_argument, NULL, 'L' }, { "passwdInHex" , no_argument, NULL, 'X' }, { "port" , required_argument, NULL, 'p' }, { "dbg" , required_argument, NULL, 'd' }, { "help" , no_argument, NULL, 'h' }, { "version" , no_argument, NULL, 'v' }, { "clear" , no_argument, NULL, 'c' }, { NULL , no_argument, NULL, 0 }, }; if(argc == 1) { showHelp(argv[0]); return 0; } if( argc > (int)(2*sizeof(sOpts)/sizeof(struct option)) ) { showArgMismatch(argv[0]); return -1; } while ( ( opt = getopt_long( argc, argv, "o:e:l:O:E:L:Xp:d:hvc", sOpts, NULL ) ) != -1 ) { switch ( opt ) { case 'h': case '?': showHelp(argv[0]); return 0; case 'v': showVersion(argv[0]); return 0; case 'c': clearAuth = 1; break; case 'o': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { argsError = true; break; } safeStrNCpy(newOwnerPasswd, optarg, sizeof(newOwnerPasswd)); break; case 'e': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { argsError = true; break; } safeStrNCpy(newEndorsePasswd, optarg, sizeof(newEndorsePasswd)); break; case 'l': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { argsError = true; break; } safeStrNCpy(newLockoutPasswd, optarg, sizeof(newLockoutPasswd)); break; case 'O': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input current Owner authorization value(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -2; } safeStrNCpy(oldOwnerPasswd, optarg, sizeof(oldOwnerPasswd)); break; case 'E': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input current Endorsement authorization value(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -3; } safeStrNCpy(oldEndorsePasswd, optarg, sizeof(oldEndorsePasswd)); break; case 'L': if( optarg == NULL || (strlen(optarg) >= sizeof(TPMU_HA)) ) { printf("\nPlease input current Lockout authorization value(optional,no more than %d characters).\n", (int)sizeof(TPMU_HA)-1); return -4; } safeStrNCpy(oldLockoutPasswd, optarg, sizeof(oldLockoutPasswd)); break; case 'X': hexPasswd = true; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); return -5; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); return -6; } break; default: showHelp(argv[0]); return -7; } } if( argsError == true ) { showArgMismatch(argv[0]); return -8; } prepareTest(hostName, port, debugLevel) != 0; if( clearAuth ) returnVal = clearHierarchyAuth(); else returnVal = changeHierarchyAuth(); finishTest(); if(returnVal) return -9; return 0; } tpm2.0-tools-1.1.0/src/tpm2_unseal.cpp000066400000000000000000000217271300711361400174200ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include //#include "sample.h" #include #include "common.h" int debugLevel = 0; TPMS_AUTH_COMMAND sessionData; bool hexPasswd = false; UINT32 unseal(TPMI_DH_OBJECT itemHandle, const char *outFileName, int P_flag) { UINT32 rval; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_CMD_AUTHS sessionsData; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_COMMAND *sessionDataArray[1]; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; TPM2B_SENSITIVE_DATA outData = {{sizeof(TPM2B_SENSITIVE_DATA)-2, }}; sessionDataArray[0] = &sessionData; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsData.cmdAuths = &sessionDataArray[0]; sessionsDataOut.rspAuthsCount = 1; sessionsData.cmdAuthsCount = 1; sessionData.sessionHandle = TPM_RS_PW; sessionData.nonce.t.size = 0; *((UINT8 *)((void *)&sessionData.sessionAttributes)) = 0; if(P_flag == 0) sessionData.hmac.t.size = 0; if (sessionData.hmac.t.size > 0 && hexPasswd) { sessionData.hmac.t.size = sizeof(sessionData.hmac) - 2; if (hex2ByteStructure((char *)sessionData.hmac.t.buffer, &sessionData.hmac.t.size, sessionData.hmac.t.buffer) != 0) { printf( "Failed to convert Hex format password for item Passwd.\n"); return -1; } } rval = Tss2_Sys_Unseal(sysContext, itemHandle, &sessionsData, &outData, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("Unseal failed. Error Code: 0x%x\n", rval); return -1; } printf("\nUnseal succ.\nUnsealed data: "); for(UINT16 i = 0; i < outData.t.size; i++) printf(" 0x%02x", outData.t.buffer[i]); printf("\n"); if(saveDataToFile(outFileName, (UINT8 *)&outData, sizeof(outData))) { printf("Failed to save unsealed data into %s\n", outFileName); return -2; } return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-H, --item item handle, handle of a loaded data object\n" "-c, --itemContext filename for item context\n" "-P, --pwdi item handle password, optional\n" "-o, --outfile Output file name, containing the unsealed data\n" "-X, --passwdInHex passwords given by any options are hex format.\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -H 0x80000000 -P abc123 -o \n" "%s -H 0x80000000 -o \n\n"// -i \n\n",DEFAULT_TPM_PORT); "%s -H 0x80000000 -P 123abc -X -o \n" ,name, DEFAULT_RESMGR_TPM_PORT, name, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPMI_DH_OBJECT itemHandle; char outFilePath[PATH_MAX] = {0}; char *contextItemFile = NULL; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvH:P:o:p:d:c:X"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"item",1,NULL,'H'}, {"pwdi",1,NULL,'P'}, {"outfile",1,NULL,'o'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"itemContext",1,NULL,'c'}, {"passwdInHex",0,NULL,'X'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, H_flag = 0, P_flag = 0, c_flag = 0, o_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'H': if(getSizeUint32Hex(optarg, &itemHandle) != 0) { returnVal = -1; break; } printf("\nitemHandle: 0x%x\n\n",itemHandle); H_flag = 1; break; case 'P': sessionData.hmac.t.size = sizeof(sessionData.hmac.t) - 2; if(str2ByteStructure(optarg,&sessionData.hmac.t.size,sessionData.hmac.t.buffer) != 0) { returnVal = -2; break; } P_flag = 1; break; case 'o': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -3; break; } o_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -4; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -5; } break; case 'c': contextItemFile = optarg; if(contextItemFile == NULL || contextItemFile[0] == '\0') { returnVal = -6; break; } printf("contextItemFile = %s\n", contextItemFile); c_flag = 1; break; case 'X': hexPasswd = true; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -7; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -8; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) return returnVal; flagCnt = h_flag + v_flag + H_flag + o_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); return -9; } } else if(flagCnt == 2 && (H_flag == 1 || c_flag ==1) && o_flag == 1) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &itemHandle, contextItemFile); if (returnVal == 0) returnVal = unseal(itemHandle, outFilePath, P_flag); finishTest(); if(returnVal) return -10; } else { showArgMismatch(argv[0]); return -11; } return 0; } tpm2.0-tools-1.1.0/src/tpm2_verifysignature.cpp000066400000000000000000000303671300711361400213570ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2015, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // 3. Neither the name of Intel Corporation nor the names of its contributors // may be used to endorse or promote products derived from this software without // specific prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include #include #include #include "common.h" int debugLevel = 0; BYTE *msg = NULL; UINT16 msgLen = 0; TPM2B_DIGEST msgHash = { { sizeof(TPM2B_DIGEST)-2, } }; int verifySignature(TPMI_DH_OBJECT keyHandle, int D_flag, TPMI_ALG_HASH halg, TPMT_SIGNATURE *signature, const char *outFilePath) { UINT32 rval; TPMT_TK_VERIFIED validation; TPMS_AUTH_RESPONSE sessionDataOut; TSS2_SYS_RSP_AUTHS sessionsDataOut; TPMS_AUTH_RESPONSE *sessionDataOutArray[1]; sessionDataOutArray[0] = &sessionDataOut; sessionsDataOut.rspAuths = &sessionDataOutArray[0]; sessionsDataOut.rspAuthsCount = 1; printf("\nTPM2_VerifySignature TESTS:\n"); if(D_flag == 0) { if(computeDataHash(msg, msgLen, halg, &msgHash)) { printf("Compute message hash failed !\n"); return -1; } printf("\nVerifySignature: computing message hash succeeded!\n"); } printf("\nmsgHash(hex type):\n "); for(UINT16 i = 0; i < msgHash.t.size; i++) printf("%02x ", msgHash.t.buffer[i]); printf("\n"); rval = Tss2_Sys_VerifySignature(sysContext, keyHandle, NULL, &msgHash, signature, &validation, &sessionsDataOut); if(rval != TPM_RC_SUCCESS) { printf("tpm2_verifysignature failed, error code: 0x%x\n", rval); return -2; } printf("\ntpm2_verifysignature succ.\n\n"); if(saveDataToFile(outFilePath, (UINT8 *)&validation, sizeof(validation))) { printf("failed to save validation into %s\n", outFilePath); return -3; } return 0; } void showHelp(const char *name) { printf("\n%s [options]\n" "\n" "-h, --help Display command tool usage info;\n" "-v, --version Display command tool version info\n" "-k, --keyHandle handle of public key that will be used in the validation\n" "-c, --keyContext filename of the key context used for the operation\n" "-g, --halg the hash algorithm used to digest the message \n" "\t0x0004 TPM_ALG_SHA1\n" "\t0x000B TPM_ALG_SHA256\n" "\t0x000C TPM_ALG_SHA384\n" "\t0x000D TPM_ALG_SHA512\n" "\t0x0012 TPM_ALG_SM3_256\n" "-m, --msg the input message file, containning the content to be digested\n" "-D, --digest the input hash file, containning the hash of the message\n" "\tif this argument been chosed, the argument '-m(--msg)' and '-g(--halg)' is no need\n" "-s, --sig the input signature file, containning the signature to be tested\n" "-r, --raw set the input signature file to raw type, default TPMT_SIGNATURE, optional\n" "-t, --ticket the ticket file, record the validation structure\n" "-p, --port The Port number, default is %d, optional\n" "-d, --debugLevel <0|1|2|3> The level of debug message, default is 0, optional\n" "\t0 (high level test results)\n" "\t1 (test app send/receive byte streams)\n" "\t2 (resource manager send/receive byte streams)\n" "\t3 (resource manager tables)\n" "\n" "Example:\n" "%s -k 0x81010001 -g 0x000B -m -s -t \n" "%s -k 0x81010001 -D -s -t \n" ,name, DEFAULT_RESMGR_TPM_PORT, name, name); } int main(int argc, char* argv[]) { char hostName[200] = DEFAULT_HOSTNAME; int port = DEFAULT_RESMGR_TPM_PORT; TPMI_DH_OBJECT keyHandle; long fileSize = 0; UINT16 size; TPMI_ALG_HASH halg = TPM_ALG_SHA256; TPMT_SIGNATURE signature; char inSigFilePath[PATH_MAX] = {0}; char outFilePath[PATH_MAX] = {0}; char inMsgFilePath[PATH_MAX] = {0}; char *contextKeyFile = NULL; setbuf(stdout, NULL); setvbuf (stdout, NULL, _IONBF, BUFSIZ); int opt = -1; const char *optstring = "hvk:g:m:D:rs:t:p:d:c:"; static struct option long_options[] = { {"help",0,NULL,'h'}, {"version",0,NULL,'v'}, {"keyHandle",1,NULL,'k'}, {"digest",1,NULL,'D'}, {"halg",1,NULL,'g'}, {"msg",1,NULL,'m'}, {"raw",0,NULL,'r'}, {"sig",1,NULL,'s'}, {"ticket",1,NULL,'t'}, {"port",1,NULL,'p'}, {"debugLevel",1,NULL,'d'}, {"keyContext",1,NULL,'c'}, {0,0,0,0} }; int returnVal = 0; int flagCnt = 0; int h_flag = 0, v_flag = 0, k_flag = 0, g_flag = 0, m_flag = 0, D_flag = 0, r_flag = 0, s_flag = 0, c_flag = 0, t_flag = 0; if(argc == 1) { showHelp(argv[0]); return 0; } while((opt = getopt_long(argc,argv,optstring,long_options,NULL)) != -1) { switch(opt) { case 'h': h_flag = 1; break; case 'v': v_flag = 1; break; case 'k': if(getSizeUint32Hex(optarg,&keyHandle) != 0) { returnVal = -1; break; } k_flag = 1; break; case 'g': if(getSizeUint16Hex(optarg,&halg) != 0) { showArgError(optarg, argv[0]); returnVal = -2; break; } printf("halg = 0x%4.4x\n", halg); g_flag = 1; break; case 'm': safeStrNCpy(inMsgFilePath, optarg, sizeof(inMsgFilePath)); m_flag = 1; break; case 'D': size = sizeof(msgHash); if(loadDataFromFile(optarg, (UINT8 *)&msgHash, &size) != 0) { returnVal = -3; break; } D_flag = 1; break; case 'r': r_flag = 1; break; case 's': safeStrNCpy(inSigFilePath, optarg, sizeof(inSigFilePath)); s_flag = 1; break; case 't': safeStrNCpy(outFilePath, optarg, sizeof(outFilePath)); if(checkOutFile(outFilePath) != 0) { returnVal = -4; break; } t_flag = 1; break; case 'p': if( getPort(optarg, &port) ) { printf("Incorrect port number.\n"); returnVal = -5; } break; case 'd': if( getDebugLevel(optarg, &debugLevel) ) { printf("Incorrect debug level.\n"); returnVal = -6; } break; case 'c': contextKeyFile = optarg; if(contextKeyFile == NULL || contextKeyFile[0] == '\0') { returnVal = -7; break; } printf("contextKeyFile = %s\n", contextKeyFile); c_flag = 1; break; case ':': // printf("Argument %c needs a value!\n",optopt); returnVal = -8; break; case '?': // printf("Unknown Argument: %c\n",optopt); returnVal = -9; break; //default: // break; } if(returnVal) break; }; if(returnVal != 0) goto end; if(m_flag) { if(getFileSize(inMsgFilePath, &fileSize) != 0) { returnVal = -10; goto end; } if(fileSize == 0) { printf("the message file is empty !\n"); returnVal = -11; goto end; } if(fileSize > 0xffff) { printf("the message file was too long !\n"); returnVal = -12; goto end; } #if 0 printf("\nmsg length: %d\n",length); printf("msg content: "); for(int i = 0; i < length; i++) { printf("%02x ", msg[i]); } printf("\n"); return -1; #endif msg = (BYTE*)malloc(fileSize); if(msg == NULL) { returnVal = -13; goto end; } memset(msg, 0, fileSize); msgLen = fileSize; if(loadDataFromFile(inMsgFilePath, msg, &msgLen) != 0) { returnVal = -14; goto end; } } if(D_flag == 1 && (m_flag == 1 || g_flag == 1)) { showArgMismatch(argv[0]); returnVal = -15; goto end; } if(D_flag == 1) { printf("\nVerifySignature: using the input hash file!\n"); } if(s_flag ==1) //construct the signature { if(r_flag == 0) { UINT16 size = sizeof(signature); if(loadDataFromFile(inSigFilePath, (UINT8 *)&signature, &size)) { returnVal = -16; goto end; } printf("VerifySignature: using the input signature file as sig structure!\n"); } else { signature.sigAlg = TPM_ALG_RSASSA; signature.signature.rsassa.hash = halg; signature.signature.rsassa.sig.t.size = sizeof(signature.signature.rsassa.sig) - 2; if(loadDataFromFile(inSigFilePath, signature.signature.rsassa.sig.t.buffer, &signature.signature.rsassa.sig.t.size)) { returnVal = -17; goto end; } printf("VerifySignature: using the input signature file as raw data!\n"); } } flagCnt = h_flag + v_flag + k_flag + g_flag + m_flag + D_flag + s_flag + t_flag + c_flag; if(flagCnt == 1) { if(h_flag == 1) showHelp(argv[0]); else if(v_flag == 1) showVersion(argv[0]); else { showArgMismatch(argv[0]); returnVal = -18; } } else if(((flagCnt==4 && D_flag==1) || (flagCnt==5 && D_flag==0)) && (h_flag==0 && v_flag==0) && ((k_flag==1 || c_flag == 1) && s_flag==1 && t_flag==1) ) { prepareTest(hostName, port, debugLevel); if(c_flag) returnVal = loadTpmContextFromFile(sysContext, &keyHandle, contextKeyFile); if(returnVal == 0) returnVal = verifySignature(keyHandle, D_flag, halg, &signature, outFilePath); finishTest(); if(returnVal) returnVal = -19; } else { showArgMismatch(argv[0]); returnVal = -20; } end: if(msg) free(msg); return returnVal; } tpm2.0-tools-1.1.0/test/000077500000000000000000000000001300711361400146425ustar00rootroot00000000000000tpm2.0-tools-1.1.0/test/README.md000066400000000000000000000015371300711361400161270ustar00rootroot00000000000000**these are some scripts for the testing of TPM (Trusted Platform Module) 2.0 tools ** Below are script instructions: ##1: integration testing test_smoking.sh is a quick & brief testing for all tpm-tools. test_all.sh runs all separated .sh. ##2: separated testing There are some separated .sh for each of tpm2-tool. Name convention is test_tpm2_xxx.sh. ##3: algorithm testing Named as test_algs_tpm2_XXX.sh, test all algorithms involved in the parameters of tpm2-tools. A part of test_tpm2_XXX_all.sh also contain algorithm testing. ##4: others test_tpm2_XXX_func.sh for adding some test cases in furture. ##Condition and Operation instructions: 1.TPM is initialized 2.install tpm2-tools 3.must start resourcemgr before run all test scripts 4.clean up all log files 5.run xxx.sh for automatic test 6.results record in XXX_pass.log or XXX_fail.log tpm2.0-tools-1.1.0/test/test_algs.sh000077500000000000000000000065131300711361400171730ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; ###this script use for test the implementation of all algorithms involved createprimary &create/load #!/bin/sh halg_p= kalg_p= halg_c= kalg_c= rm *.log context* op* name.load* for halg_p in 0x0004 0x000B 0x000C 0x000D 0x0012 # for halg_p in 0x0004 0x000B 0x000C do for kalg_p in 0x0001 0x0008 0x0023 0x0025 do tpm2_createprimary -A e -g $halg_p -G $kalg_p -C context.p_"$halg_p"_"$kalg_p" if [ $? != 0 ];then echo "createprimary for context.p_"$halg_p"_"$kalg_p" fail, please check the environment or parameters!" fi ############create & load key context############ for halg_c in 0x0004 0x000B 0x000C 0x000D 0x0012 do for kalg_c in 0x0001 0x0008 0x0023 0x0025 do tpm2_create -g $halg_c -G $kalg_c -o opu_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -O opr_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -c context.p_"$halg_p"_"$kalg_p" if [ $? != 0 ];then echo "create used context.p_"$halg_p"_"$kalg_p" with algs:"$halg_c""$kalg_c" fail, please check the environment or parameters!" echo "create used context.p_"$halg_p"_"$kalg_p" with algs:"$halg_c""$kalg_c" fail" >>create_error.log else tpm2_load -c context.p_"$halg_p"_"$kalg_p" -u opu_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -r opr_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -n name.load_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -C context_load_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" if [ $? != 0 ];then echo "load for context.p_"$halg_p"_"$kalg_p" fail, please check the environment or parameters!" echo "load context.p_"$halg_p"_"$kalg_p" for create context_load_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" fail" >>load_error.log fi fi done done done done tpm2.0-tools-1.1.0/test/test_algs_tpm2_encryptdecrypt.sh000077500000000000000000000057521300711361400233000ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh ##before this script, you should make sure all kinds of context already loaded context_p= halg= new_path=`dirname $0` PATH="$PATH":"$new_path" ctx_count=`ls |grep -c context_load` if [ $ctx_count -le 1 ];then echo "we should execute test_algs.sh first!" wait 5 test_algs.sh fi rm test_algs_encryptdecrypt_*.log if [ ! -e "secret.data" ] then echo "12345678" > secret.data fi #for halg_p in 0x0004 0x000B 0x000C 0x000D 0x0012 for context_p in `ls context_load*` do tpm2_encryptdecrypt -c $context_p -D NO -I secret.data -o endecrypt_"$context_p".f if [ $? != 0 ];then echo "encryptdecrypt for endecrypt_"$context_p".f fail, please check the environment or parameters!" echo "encryptdecrypt for endecrypt_"$context_p".f fail" >>test_encryptdecrypt_error.log else echo "encryptdecrypt for endecrypt_"$context_p".f pass" >>test_encryptdecrypt_pass.log tpm2_encryptdecrypt -c $context_p -D YES -I endecrypt_"$context_p".f -o decrypt_"$context_p".f if [ $? != 0 ];then echo "encryptdecrypt for decrypt_"$context_p".f fail, please check the environment or parameters!" echo "encryptdecrypt for decrypt_"$context_p".f fail" >>test_encryptdecrypt_error.log else echo "encryptdecrypt for decrypt_"$context_p".f pass" >>test_encryptdecrypt_pass.log fi fi done tpm2.0-tools-1.1.0/test/test_algs_tpm2_getpubak.sh000077500000000000000000000055701300711361400220210ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash handle_ek=0x81010005 ##ek_e=1 ek_alg=0x0001 handle_ak=0x81010006 ak_alg= digestAlg= signAlg= fail() { echo "$1 test fail, please check the environment or parameters!" echo ""$1" fail" >>test_getpubak_error.log } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } rm test_getpub*.log rm ak.pub* tpm2_getpubek -H "$handle_ek" -g $ek_alg -f ek.pub_"$ek_alg" if [ $? != 0 ];then fail getpubek exit 1 fi ## ./tpm2_getpubak -e "$handle_ek" -k $handle_ak -g $ak_alg -D $digestAlg -s $signAlg -f ak.pub_"$kalg_p"_"$halg"_"$digestAlg"_"$signAlg" -n ak.name_"$kalg_p"_"$halg"_"$digestAlg"_"$signAlg" for ak_alg in 0x0001 0x0008 0x0023 do for digestAlg in 0x0004 0x000B 0x000C 0x000D 0x0012 do for signAlg in 0x0005 0x0014 0x0016 0x0018 0x001A 0x001B 0x001C do tpm2_getpubak -E "$handle_ek" -k $handle_ak -g $ak_alg -D $digestAlg -s $signAlg -f ak.pub_"$ak_alg"_"$digestAlg"_"$signAlg" -n ak.name_"$ak_alg"_"$digestAlg"_"$signAlg" if [ $? != 0 ];then fail "Ak_alg_"$ak_alg"_"$digestAlg"_"$signAlg"" else Pass "Ak_alg_"$ak_alg"_"$digestAlg"_"$signAlg"" fi handle_ak=$(($handle_ak+0x1)) val=`echo 'obase=16; '$handle_ak''|bc` handle_ak=0x"$val" done done done tpm2.0-tools-1.1.0/test/test_algs_tpm2_getpubek.sh000077500000000000000000000043621300711361400220230ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash #handle_ek=0x81010003 ek_e=1 handle_k= kalg_p= halg= digestAlg= signAlg= fail() { echo "getpubek for ek.pub_"$1" fail, please check the environment or parameters!" echo "getpubek for ek.pub_"$1" fail" >>test_getpubek_error.log } Pass() { echo "getpubek for ek.pub_"$1" pass" >>test_getpubak_pass.log } rm test_getpub*.log rm ek.pub* for kalg_p in 0x0001 0x0008 0x0023 0x0025 do ##echo $ek_e tpm2_getpubek -H 0x8101000"$ek_e" -g $kalg_p -f ek.pub_"$kalg_p" if [ $? != 0 ];then fail "$kalg_p" else Pass "$kalg_p" fi ek_e=$(($ek_e+2)) done tpm2.0-tools-1.1.0/test/test_algs_tpm2_hmac.sh000077500000000000000000000050511300711361400211210ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh context_p= halg= ctx_count= new_path=`dirname $0` PATH="$PATH":"$new_path" ctx_count=`ls |grep -c context_load` if [ $ctx_count -le 1 ];then echo "we should execute test_algs.sh first!" wait 5 test_algs.sh fi rm -f test_hmac_*.log if [ ! -e "secret.data" ] then echo "12345678" > secret.data fi #for halg_p in 0x0004 0x000B 0x000C 0x000D 0x0012 for context_p in `ls context_load*` do for halg in 0x0004 0x000B 0x000C do ## echo "halg_p: "$halg_p" kalg_p: "$kalg_p"" >>test.log tpm2_hmac -c $context_p -g $halg -I secret.data -o hmac_out_"$context_p"_"$halg_h" if [ $? != 0 ];then echo "hmac for hmac_out_"$context_p"_"$halg" fail, please check the environment or parameters!" echo "hmac for hmac_out_"$context_p"_"$halg" fail" >>test_hmac_error.log else echo "hmac for hmac_out_"$context_p"_"$halg" pass" >>test_hmac_pass.log fi done done tpm2.0-tools-1.1.0/test/test_algs_tpm2_quote.sh000077500000000000000000000047111300711361400213500ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh ##before this script, you should make sure all kinds of context already loaded context_p= halg= new_path=`dirname $0` PATH="$PATH":"$new_path" ctx_count=`ls |grep -c context_load` if [ $ctx_count -le 1 ];then echo "we should execute test_algs.sh first!" wait 5 test_algs.sh fi rm test_quote_*.log for context_p in `ls context_load*` do for halg in 0x0004 0x000B 0x000C 0x000D 0x0012 do tpm2_quote -c $context_p -g $halg -l 16,17,18 -o quote_out_"$context_p"_"$halg_h"_"$halg" if [ $? != 0 ];then echo "quote for quote_"$context_p"_"$halg" fail, please check the environment or parameters!" echo " quote for quote_"$context_p"_"$halg" fail" >>test_quote_error.log else echo "quote for quote_"$context_p"_"$halg" pass" >>test_quote_pass.log fi done done tpm2.0-tools-1.1.0/test/test_algs_tpm2_readpublic.sh000077500000000000000000000044401300711361400223240ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash context_p= halg= new_path=`dirname $0` PATH="$PATH":"$new_path" ctx_count=`ls |grep -c context_load` if [ $ctx_count -le 1 ];then echo "we should execute test_algs.sh first!" wait 5 test_algs.sh fi rm test_readpublic_*.log for context_p in `ls context_load*` do tpm2_readpublic -c $context_p -o rd-opu_"$context_p" if [ $? != 0 ];then echo "readpublic for "$context_p" fail, please check the environment or parameters!" echo "readpublic for "$context_p" fail" >>test_readpublic_error.log else echo "readpublic for "$context_p" pass" >>test_readpublic__pass.log fi done tpm2.0-tools-1.1.0/test/test_algs_tpm2_sign.sh000077500000000000000000000051061300711361400211520ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh ##before this script, you should make sure all kinds of context already loaded context_p= halg= new_path=`dirname $0` PATH="$PATH":"$new_path" ctx_count=`ls |grep -c context_load` if [ $ctx_count -le 1 ];then echo "we should execute test_algs.sh first!" wait 5 test_algs.sh fi rm test_algs_sign_*.log sign_* if [ ! -e "secret.data" ] then echo "12345678" > secret.data fi #for halg_p in 0x0004 0x000B 0x000C 0x000D 0x0012 for context_p in `ls context_load*` do for halg in 0x0004 0x000B 0x000C do tpm2_sign -c $context_p -g $halg -m secret.data -s sign_"$context_p"_"$halg_h"_"$halg" if [ $? != 0 ];then echo "sign for sign_"$context_p"_"$halg" fail, please check the environment or parameters!" echo " sign for sign_"$context_p"_"$halg" fail" >>test_algs_sign_error.log else echo "sign for sign_"$context_p"_"$halg" pass" >>test_algs_sign_pass.log fi done done tpm2.0-tools-1.1.0/test/test_algs_tpm2_unseal.sh000077500000000000000000000074711300711361400215100ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh context_p= halg_p= kalg_p= halg_c= kalg_c= rm *.log context* op* name.load* if [ ! -e "secret.data" ] then echo "12345678" > secret.data fi for halg_p in 0x0004 0x000B 0x000C 0x000D 0x0012 do for kalg_p in 0x0001 0x0008 0x0023 0x0025 do tpm2_createprimary -A p -g $halg_p -G $kalg_p -C context.p_"$halg_p"_"$kalg_p" if [ $? != 0 ];then echo "createprimary for context.p_"$halg_p"_"$kalg_p" fail, please check the environment or parameters!" continue fi ############create & load key context############ for halg_c in 0x0004 0x000B 0x000C 0x000D 0x0012 do for kalg_c in 0x0001 0x0008 0x0023 0x0025 do tpm2_create -g $halg_c -G $kalg_c -o opu_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -O opr_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -I secret.data -c context.p_"$halg_p"_"$kalg_p" if [ $? != 0 ];then echo "create used context.p_"$halg_p"_"$kalg_p" with algs:"$halg_c""$kalg_c" fail, please check the environment or parameters!" echo "create used context.p_"$halg_p"_"$kalg_p" with algs:"$halg_c""$kalg_c" fail" >>create_error.log else tpm2_load -c context.p_"$halg_p"_"$kalg_p" -u opu_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -r opr_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -n name.load_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" -C context_load_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" if [ $? != 0 ];then echo "load for context.p_"$halg_p"_"$kalg_p" fail, please check the environment or parameters!" echo "load context.p_"$halg_p"_"$kalg_p" for create context_load_"$halg_p""$kalg_p"_"$halg_c""$kalg_c" fail" >>load_error.log fi fi done done done done #ctx_count=`ls |grep -c context_load` #if [ $ctx_count -le 1 ];then # echo "we should execute test_algs.sh first!" # wait 5 # ./test_algs.sh #fi rm test_unseal_*.log usl_* for context_p in `ls context_load*` do tpm2_unseal -c $context_p -o usl_"$context_p".out if [ $? != 0 ];then echo "unseal fail, please check the environment or parameters!" echo "unseal for_"$context_p" fail" >>test_unseal_error.log else echo "unseal for_"$context_p" pass" >>test_unseal_pass.log fi done tpm2.0-tools-1.1.0/test/test_algs_tpm2_verifysignature.sh000077500000000000000000000063351300711361400234450ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh ##before this script, you should make sure all kinds of context already loaded context_p= halg= new_path=`dirname $0` PATH="$PATH":"$new_path" ctx_count=`ls |grep -c context_load` if [ $ctx_count -le 1 ];then echo "we should execute test_algs.sh first!" wait 5 test_algs.sh fi rm test_algs_*.log sign_* verifysig_* tickt_verify* if [ ! -e "secret.data" ] then echo "12345678" > secret.data fi #for halg_p in 0x0004 0x000B 0x000C 0x000D 0x0012 for context_p in `ls context_load*` do for halg in 0x0004 0x000B 0x000C do tpm2_sign -c $context_p -g $halg -m secret.data -s sign_"$context_p"_"$halg" if [ $? != 0 ];then echo "sign for sign_"$context_p"_"$halg" fail, please check the environment or parameters!" echo " sign for sign_"$context_p"_"$halg" fail" >>test_algs_sign_error.log else echo "sign for sign_"$context_p"_"$halg" pass" >>test_algs_sign_pass.log for halg_ver in 0x0004 0x000B 0x000C 0x000D 0x0012 do tpm2_verifysignature -c $context_p -g $halg_ver -m secret.data -s sign_"$context_p"_"$halg" -t tickt_verify_sign_"$context_p"_"$halg"_"$halg_ver".out if [ $? != 0 ];then echo "verifysignature for sign_"$context_p"_"$halg"_"$halg_ver" fail, please check the environment or parameters!" echo " verifysignature for sign_"$context_p"_"$halg"_"$halg_ver" fail" >>test_algs_verifysignature_error.log else echo " verifysignature for sign_"$context_p"_"$halg"_"$halg_ver" pass" >>test_algs_verifysignature_pass.log fi done fi done done tpm2.0-tools-1.1.0/test/test_all.sh000077500000000000000000000054651300711361400170220ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; ####before this script, please make sure all test scripts copy here, TPM is initialized. #!/bin/bash new_path=`dirname $0` PATH="$PATH":"$new_path" rm test_all_pass.log test_all_fail.log func() { $1 if [ $? = 0 ];then clear echo -e "\033[32m $1 pass \033[0m" sleep 1 echo "$1 pass" >>test_all_pass.log else echo -e "\033[31m $1 Fail \033[0m" echo "$1 fail" >>test_all_fail.log sleep 1 fi } func test_tpm2_takeownership_all.sh func test_tpm2_nv.sh func test_tpm2_listpcrs.sh func test_tpm2_getrandom.sh ##func test_tpm2_createprimary_all.sh ##func test_tpm2_create_all.sh func test_tpm2_load.sh func test_tpm2_loadexternal.sh func test_tpm2_evictcontrol.sh func test_tpm2_hash.sh func test_tpm2_hmac.sh func test_tpm2_quote.sh func test_tpm2_unseal.sh func test_tpm2_akparse.sh func test_tpm2_certify.sh func test_tpm2_evictcontrol.sh func test_tpm2_getpubek.sh func test_tpm2_getpubak.sh func test_tpm2_makecredential.sh func test_tpm2_activecredential.sh func test_tpm2_readpublic.sh func test_tpm2_rsaencrypt.sh func test_tpm2_rsadecrypt.sh func test_tpm2_encryptdecrypt.sh func test_tpm2_sign.sh func test_tpm2_verifysignature.sh tpm2.0-tools-1.1.0/test/test_smoking.sh000077500000000000000000000201331300711361400177060ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh new_path=`dirname $0` PATH="$PATH":"$new_path" ekHandle=0x81010007 akHandle=0x81010008 fail() { echo "$1 test fail, please check the environment or parameters!" exit 1 } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } rm *.out tpm2_takeownership -c if [ $? != 0 ];then fail takeownership fi test_tpm2_nv.sh tpm2_getpubek -H $ekHandle -g 0x01 -f ek.pub1.out if [ $? != 0 ];then fail getpubek fi tpm2_getpubak -E $ekHandle -k $akHandle -f ak.pub1.out -n ak.name_1.out |tee output_ak if [ $? != 0 ] || [ ! -e ak.name_1.out ];then fail getpubak fi grep -A 3 "Name of loaded key:" output_ak|tr "\n" " " >grep.txt Loadkeyname=`sed -e 's/ //g' grep.txt | awk -F':' '{print $2}'` echo 123456 | xxd -r -ps > secret.data tpm2_makecredential -e ek.pub1.out -s secret.data -n $Loadkeyname -o makecredential.out if [ $? != 0 ];then fail makecredential fi tpm2_activatecredential -H $akHandle -k $ekHandle -f makecredential.out -o act_credential.out if [ $? != 0 ];then fail activatecredential fi tpm2_akparse -f ak.pub1.out -k akparse.out if [ $? != 0 ];then fail akparse fi ##### getrandom & hash tpm2_getrandom -s 20 -o random.out if [ $? != 0 ];then fail getrandom fi tpm2_hash -H n -g 0x004 -I random.out -o hash.out -t hash_tk.out if [ $? != 0 ];then fail hash fi ############context ############## ###unseal tpm2_createprimary -A p -g 0x0004 -G 0x001 -C context.p1.out if [ $? != 0 ];then fail createprimary fi tpm2_create -c context.p1.out -g 0x000B -G 0x0008 -o opu1.out -O opr1.out -I secret.data if [ $? != 0 ];then fail create fi tpm2_load -c context.p1.out -u opu1.out -r opr1.out -n name.load.1.out -C context_load_out1.out if [ $? != 0 ];then fail load fi tpm2_unseal -c context_load_out1.out -o usl.data.out if [ $? != 0 ];then fail unseal fi #####quote tpm2_createprimary -A p -g 0x000B -G 0x001 -C context.p2.out if [ $? != 0 ];then fail createprimary fi tpm2_create -c context.p2.out -g 0x000B -G 0x0008 -o opu2.out -O opr2.out if [ $? != 0 ];then fail create fi tpm2_load -c context.p2.out -u opu2.out -r opr2.out -n name.load_2.out -C context_load_out2.out if [ $? != 0 ];then fail load fi tpm2_quote -c context_load_out2.out -g 0x4 -l 16,17,18 -o quote_outFile.out if [ $? != 0 ];then fail quote fi ######Hmac tpm2_createprimary -A e -g 0x000B -G 0x0001 -C context.p3.out if [ $? != 0 ];then fail createprimary fi tpm2_create -c context.p3.out -g 0x000B -G 0x0008 -o opu3.out -O opr3.out if [ $? != 0 ];then fail create fi tpm2_load -c context.p3.out -u opu3.out -r opr3.out -n name.load.3.out -C context_load_out3.out if [ $? != 0 ];then fail load fi tpm2_hmac -c context_load_out3.out -g 0x00B -I secret.data -o hmac.out if [ $? != 0 ];then fail hmac fi ######readpublic tpm2_createprimary -A e -g 0x000B -G 0x0001 -C context.p4.out if [ $? != 0 ];then fail createprimary fi tpm2_create -c context.p4.out -g 0x000B -G 0x0008 -o opu4.out -O opr4.out if [ $? != 0 ];then fail create fi tpm2_load -c context.p4.out -u opu4.out -r opr4.out -n name.load.4.out -C context_load_out4.out if [ $? != 0 ];then fail load fi tpm2_readpublic -c context_load_out4.out -o rd-opu.out if [ $? != 0 ];then fail readpublic fi ######evictcontrol tpm2_createprimary -A e -g 0x000B -G 0x0001 -C context.p5.out if [ $? != 0 ];then fail createprimary fi tpm2_create -g 0x000B -G 0x0008 -o opu5.out -O opr5.out -c context.p5.out if [ $? != 0 ];then fail create fi tpm2_load -c context.p5.out -u opu5.out -r opr5.out -n name.load5.out -C context_load_out5.out if [ $? != 0 ];then fail load fi tpm2_evictcontrol -A o -c context_load_out5.out -S 0x81010003 if [ $? != 0 ];then fail evictontronl else tpm2_evictcontrol -A o -H 0x81010003 -S 0x81010003 if [ $? != 0 ];then fail evictcontrol_release_Handle fi fi #####rsaencrypt & rsadecrypt tpm2_createprimary -A e -g 0x000B -G 0x0001 -C context.p6.out if [ $? != 0 ];then fail createprimary fi tpm2_create -g 0x000B -G 0x0001 -o opu6.out -O opr6.out -c context.p6.out if [ $? != 0 ];then fail create fi tpm2_loadexternal -H n -u opu6.out -C context_loadexternal_out6.out if [ $? != 0 ];then fail loadexternal fi tpm2_rsaencrypt -c context_loadexternal_out6.out -I secret.data -o rsa_en.out if [ $? != 0 ];then fail rsa_encrypt fi tpm2_load -c context.p6.out -u opu6.out -r opr6.out -n name.load6.out -C context_load_out6.out if [ $? != 0 ];then fail load fi tpm2_rsadecrypt -c context_load_out6.out -I rsa_en.out -o rsa_de.out if [ $? != 0 ];then fail rsa_decrypt fi #####sign tpm2_createprimary -A e -g 0x000B -G 0x0001 -C context.p7.out if [ $? != 0 ];then fail createprimary fi tpm2_create -g 0x000B -G 0x0008 -o opu7.out -O opr7.out -c context.p7.out if [ $? != 0 ];then fail create fi tpm2_load -c context.p7.out -u opu7.out -r opr7.out -n name.load7.out -C context_load_out7.out if [ $? != 0 ];then fail load fi tpm2_sign -c context_load_out7.out -g 0x00B -m secret.data -s sign.f.out if [ $? != 0 ];then fail sign fi tpm2_verifysignature -c context_load_out7.out -g 0x000B -m secret.data -s sign.f.out -t tickt_verify_sign.out if [ $? != 0 ];then fail verifysignature fi ######encryptdecrypt tpm2_createprimary -A e -g 0x000B -G 0x0001 -C context.p8.out if [ $? != 0 ];then fail createprimary fi tpm2_create -g 0x000B -G 0x0025 -o opu8.out -O opr8.out -c context.p8.out if [ $? != 0 ];then fail create fi tpm2_load -c context.p8.out -u opu8.out -r opr8.out -n name.load8.out -C context_load_out8.out if [ $? != 0 ];then fail load fi tpm2_encryptdecrypt -c context_load_out8.out -D NO -I secret.data -o endecrypt.out if [ $? != 0 ];then fail encrypt fi tpm2_encryptdecrypt -c context_load_out8.out -D YES -I endecrypt.out -o endecrypt_de.out if [ $? != 0 ];then fail decrypt fi ######certify tpm2_createprimary -A e -g 0x000B -G 0x0001 -C context.p9.out if [ $? != 0 ];then fail createprimary fi tpm2_create -g 0x000B -G 0x0001 -o opu9.out -O opr9.out -c context.p9.out if [ $? != 0 ];then fail create fi tpm2_load -c context.p9.out -u opu9.out -r opr9.out -n name.load9.out -C context_load_out9.out -d 3 if [ $? != 0 ];then fail load fi tpm2_certify -C context.p9.out -c context_load_out9.out -g 0x000B -a attest.out -s certify_signature.out if [ $? != 0 ];then fail certify fi tpm2_listpcrs if [ $? != 0 ];then fail listpcrs fi tpm2.0-tools-1.1.0/test/test_tpm2_activecredential.sh000077500000000000000000000060121300711361400225070ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash handle_ek=0x81010009 handle_ak=0x8101000a ek_alg=0x001 ak_alg=0x0001 digestAlg=0x000B signAlg=0x0014 file_input_data=secret.data output_ek_pub=ek_pub.out output_ak_pub=ak_pub.out output_ak_pub_name=ak_name_pub.out output_mkcredential=mkcredential.out output_actcredential=actcredential.out fail() { echo "$1 test fail, please check the environment or parameters!" exit 1 } rm $output_ek_pub $output_ak_pub $output_ak_pub_name $output_mkcredential $output_actcredential -rf if [ ! -e "$file_input_data" ] then echo "12345678" > $file_input_data fi tpm2_getpubek -H $handle_ek -g $ek_alg -f $output_ek_pub if [ $? != 0 ] || [ ! -e $output_ek_pub ];then fail getpubek fi tpm2_getpubak -E $handle_ek -k $handle_ak -g $ak_alg -D $digestAlg -s $signAlg -f $output_ak_pub -n $output_ak_pub_name |tee output_ak if [ $? != 0 ] || [ ! -e output_ak ];then fail getpubak fi grep -A 3 "Name of loaded key:" output_ak|tr "\n" " " >grep.txt Loadkeyname=`sed -e 's/ //g' grep.txt | awk -F':' '{print $2}'` tpm2_makecredential -e $output_ek_pub -s $file_input_data -n $Loadkeyname -o $output_mkcredential if [ $? != 0 ];then fail makecredential fi tpm2_activatecredential -H $handle_ak -k $handle_ek -f $output_mkcredential -o $output_actcredential if [ $? != 0 ];then fail activatecredential fi echo "activcredential successfully!" tpm2.0-tools-1.1.0/test/test_tpm2_akparse.sh000077500000000000000000000040651300711361400206350ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash new_path=`dirname $0` PATH="$PATH":"$new_path" file_input_data=ak_pub.out output_akparse=akparse.out rm $output_ekparse -rf if [ ! -e "$file_input_data" ] then test_tpm2_getpubak.sh fi tpm2_akparse -f $file_input_data -k $output_akparse if [ $? != 0 ];then echo "akparse fail, please check the environment or parameters!" exit 1 fi echo "akparse successfully!" tpm2.0-tools-1.1.0/test/test_tpm2_certify.sh000077500000000000000000000060021300711361400206450ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash file_primary_key_ctx=context.p_B1 file_certify_key_pub=opuB1_B8 file_certify_key_priv=oprB1_B8 file_certify_key_ctx=context_load_out_B1_B8 file_certify_key_name=name.load.B1_B8 file_output_attest=attest.out file_output_signature=certify_signature.out alg_hash=0x000B alg_primary_key=0x0001 alg_certify_key=0x0001 rm $file_primary_key_ctx $file_certify_key_pub $file_certify_key_priv $file_certify_key_ctx $file_certify_key_name $file_output_attest $file_output_signature -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_hash -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then echo "createprimary fail, please check the environment or parameters!" exit 1 fi tpm2_create -g $alg_hash -G $alg_certify_key -o $file_certify_key_pub -O $file_certify_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then echo "create fail, please check the environment or parameters!" exit 1 fi tpm2_load -c $file_primary_key_ctx -u $file_certify_key_pub -r $file_certify_key_priv -n $file_certify_key_name -C $file_certify_key_ctx if [ $? != 0 ];then echo "load fail, please check the environment or parameters!" exit 1 fi tpm2_certify -C $file_primary_key_ctx -c $file_certify_key_ctx -g $alg_hash -a $file_output_attest -s $file_output_signature if [ $? != 0 ];then echo "certify fail, please check the environment or parameters!" exit 1 fi tpm2.0-tools-1.1.0/test/test_tpm2_create_all.sh000077500000000000000000000046701300711361400213040ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh new_path=`dirname $0` PATH="$PATH":"$new_path" pCtx= gAlg= GAlg= rm create.error.log ctx_count=`ls |grep -c context_load` if [ $ctx_count -le 1 ];then echo "we should execute test_tpm2_createprimary_all.sh first!" wait 5 test_tpm2_createprimary_all.sh fi for pCtx in `ls ctx.cpri*` do for gAlg in 0x04 0x0B 0x0C 0x0D 0x12 do for GAlg in 0x01 0x08 0x23 0x25 do tpm2_create -c $pCtx -g $gAlg -G $GAlg -o opu."$pCtx".g"$gAlg".G"$GAlg" -O opr."$pCtx".g"$gAlg".G"$GAlg" if [ $? != 0 ];then echo "tpm2_create error: pCtx=$pCtx gAlg=$gAlg GAlg=$GAlg" echo "tpm2_create error: pCtx=$pCtx gAlg=$gAlg GAlg=$GAlg" >> create.error.log fi done done done tpm2.0-tools-1.1.0/test/test_tpm2_createprimary_all.sh000077500000000000000000000044441300711361400227070ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh Atype= gAlg= GAlg= rm createprimary.error.log rf for gAlg in 0x04 0x0B 0x0C 0x0D 0x12 do for GAlg in 0x01 0x08 0x23 0x25 do for Atype in o e p n do tpm2_createprimary -A $Atype -g $gAlg -G $GAlg -C ctx.cpri."$Atype".g"$gAlg".G"$GAlg" if [ $? != 0 ];then echo "tpm2_createprimary error: Atype=$Atype gAlg=$gAlg GAlg=$GAlg" echo "tpm2_createprimary error: Atype=$Atype gAlg=$gAlg GAlg=$GAlg" >> createprimary.error.log fi done done done tpm2.0-tools-1.1.0/test/test_tpm2_encryptdecrypt.sh000077500000000000000000000070561300711361400222710ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash alg_primary_obj=0x0004 alg_primary_key=0x0001 alg_create_obj=0x000B alg_create_key=0x0025 file_input_data=secret.data file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key" file_en_decrypt_key_pub=opu_"$alg_create_obj"_"$alg_create_key" file_en_decrypt_key_priv=opr_"$alg_create_obj"_"$alg_create_key" file_en_decrypt_key_name=name.load_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_en_decrypt_key_ctx=ctx_load_out_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_encrypt_output_data=encrypt_"$file_en_decrypt_key_ctx" file_decrypt_output_data=decrypt_"$file_en_decrypt_key_ctx" fail() { echo "$1 test fail, please check the environment or parameters!" exit 1 } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } rm $file_primary_key_ctx $file_en_decrypt_key_pub $file_en_decrypt_key_priv $file_en_decrypt_key_name $file_en_decrypt_key_ctx $file_encrypt_output_data $file_decrypt_output_data -rf if [ ! -e "$file_input_data" ] then echo "12345678" > $file_input_data fi tpm2_takeownership -c tpm2_createprimary -A e -g $alg_primary_obj -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then fail createprimary fi tpm2_create -g $alg_create_obj -G $alg_create_key -o $file_en_decrypt_key_pub -O $file_en_decrypt_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then fail create fi tpm2_load -c $file_primary_key_ctx -u $file_en_decrypt_key_pub -r $file_en_decrypt_key_priv -n $file_en_decrypt_key_name -C $file_en_decrypt_key_ctx if [ $? != 0 ];then fail load fi tpm2_encryptdecrypt -c $file_en_decrypt_key_ctx -D NO -I secret.data -o $file_encrypt_output_data if [ $? != 0 ];then fail decrypt fi tpm2_encryptdecrypt -c $file_en_decrypt_key_ctx -D YES -I $file_encrypt_output_data -o $file_decrypt_output_data if [ $? != 0 ];then fail decrypt fi echo "encryptdecrypt test OK!" tpm2.0-tools-1.1.0/test/test_tpm2_evictcontrol.sh000077500000000000000000000061001300711361400217120ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash file_primary_key_ctx=context.p_B1 file_evict_key_pub=opuB1_B8 file_evict_key_priv=oprB1_B8 file_evict_key_ctx=context_load_out_B1_B8 file_evict_key_name=name.load.B1_B8 persistentHandle=0x81010003 alg_hash=0x000B alg_primary_key=0x0001 alg_evict_key=0x0008 rm $file_primary_key_ctx $file_evict_key_pub $file_evict_key_priv $file_evict_key_ctx $file_evict_key_name $file_output_data -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_hash -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then echo "createprimary fail, please check the environment or parameters!" exit 1 fi tpm2_create -g $alg_hash -G $alg_evict_key -o $file_evict_key_pub -O $file_evict_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then echo "create fail, please check the environment or parameters!" exit 1 fi tpm2_load -c $file_primary_key_ctx -u $file_evict_key_pub -r $file_evict_key_priv -n $file_evict_key_name -C $file_evict_key_ctx if [ $? != 0 ];then echo "load fail, please check the environment or parameters!" exit 1 fi tpm2_evictcontrol -A o -c $file_evict_key_ctx -S $persistentHandle if [ $? != 0 ];then echo "evictontronl persistentHandle fail, please check the environment or parameters!" exit 1 else tpm2_evictcontrol -A o -H $persistentHandle -S $persistentHandle if [ $? != 0 ];then echo "evictcontrol release Handle fail, please check the environment or parameters!" exit 1 fi fi tpm2.0-tools-1.1.0/test/test_tpm2_getpubak.sh000077500000000000000000000045731300711361400210150ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash handle_ek=0x8101000b handle_ak=0x8101000c ek_alg=0x001 ak_alg=0x0001 digestAlg=0x000B signAlg=0x0014 output_ek_pub=ek_pub.out output_ak_pub=ak_pub.out output_ak_pub_name=ak_name_pub.out rm $output_ek_pub $output_ak_pub $output_ak_pub_name -rf tpm2_getpubek -H $handle_ek -g $ek_alg -f $output_ek_pub if [ $? != 0 ] || [ ! -e $output_ek_pub ];then echo "getpubek fail, please check the environment or parameters!" exit 1 fi tpm2_getpubak -E $handle_ek -k $handle_ak -g $ak_alg -D $digestAlg -s $signAlg -f $output_ak_pub -n $output_ak_pub_name if [ $? != 0 ] || [ ! -e $output_ak_pub ];then echo "getpubak fail, please check the environment or parameters!" exit 1 fi echo "getpubak successfully!" tpm2.0-tools-1.1.0/test/test_tpm2_getpubek.sh000077500000000000000000000037311300711361400210140ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash handle_ek=0x81010005 ek_alg=0x001 output_ek_pub=ek_pub.out rm $output_ek_pub tpm2_getpubek -H $handle_ek -g $ek_alg -f $output_ek_pub if [ $? != 0 ] || [ ! -e $output_ek_pub ];then echo "getpubek fail, please check the environment or parameters!" exit 1 fi echo "getpubek successfully!" tpm2.0-tools-1.1.0/test/test_tpm2_getrandom.sh000077500000000000000000000036101300711361400211620ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh size=32 rm -f random.out tpm2_getrandom -s 32 -o random.out if [ $? != 0 ];then echo "getrandom test fail, please check the environment or parameters!" exit 1 else echo "getrandom succeed" fi tpm2.0-tools-1.1.0/test/test_tpm2_getrandom_func.sh000077500000000000000000000044701300711361400222020ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh #this script for tpm2_getrandom verification LOG_FILE=random_pass_count.log if [ -e "$LOG_FILE" ];then rm -f "$LOG_FILE" fi i= #for((i=1;i<=10;i++)); do for i in `seq 100`; do tpm2_getrandom -s 32 -o random_"$i".out if [ $? != 0 ];then echo " create random_"$i".out fail, please check the environment or parameters!" exit 2 else echo "create random_"$i".out Pass" >>$LOG_FILE fi done for a in `seq 99` ;do b=$(($a+1)) while [ $b -le 100 ]; do diff "random_"$a".out" "random_"$b".out" >/dev/null if [ $? -eq 0 ];then echo "random test fial" exit 1 fi b=$(($b+1)) done done echo "random test Pass" tpm2.0-tools-1.1.0/test/test_tpm2_hash.sh000077500000000000000000000042611300711361400201300ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh #this script is for hash case testing halg=0x000B Hierarchy=e rm -f hash_out_"$Hierarchy"_"$halg" hash_tk_"$Hierarchy"_"$halg" if [ ! -f hash.in ];then echo "T0naX0u123abc" >hash.in fi tpm2_hash -H $Hierarchy -g $halg -I hash.in -o hash_out_"$Hierarchy"_"$halg" -t hash_tk_"$Hierarchy"_"$halg" if [ $? != 0 ];then echo "hash forHierarchy:"$Hierarchy"halg:"$halg" fail, please check the environment or parameters!" exit 1 else echo "hash for Hierarchy:"$Hierarchy"halg:"$halg" succed" fi tpm2.0-tools-1.1.0/test/test_tpm2_hash_all.sh000077500000000000000000000043341300711361400207610ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/sh #this script is for hash case testing halg= Hierarchy= rm test_hash.log if [ ! -f hash.in ];then echo "T0naX0u123abc" >hash.in fi for Hierarchy in e o p n do for halg in 0x0004 0x000B 0x000C 0x000D 0x0012 do tpm2_hash -H $Hierarchy -g $halg -I hash.in -o hash_out_"$Hierarchy"_"$halg" -t hash_tk_"$Hierarchy"_"$halg" if [ $? != 0 ];then echo "hash for hash_out_"$Hierarchy"_"$halg" fail, please check the environment or parameters!" else echo "hash for hash_out_"$Hierarchy"_"$halg" pass" >>test_hash_pass.log fi done done tpm2.0-tools-1.1.0/test/test_tpm2_hmac.sh000077500000000000000000000071031300711361400201130ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash alg_primary_obj=0x000B alg_primary_key=0x0001 alg_create_obj=0x000B alg_create_key=0x0008 halg=0x000B handle_hmac_key=0x81010013 file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key" file_hmac_key_pub=opu_"$alg_create_obj"_"$alg_create_key" file_hmac_key_priv=opr_"$alg_create_obj"_"$alg_create_key" file_hmac_key_name=name.load_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_hmac_key_ctx=ctx_load_out_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_hmac_output=hmac_"$file_hmac_key_ctx" file_input_data=secret.data fail() { echo "$1 test fail, please check the environment or parameters!" exit 1 } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } rm $file_primary_key_ctx $file_hmac_key_pub $file_hmac_key_priv $file_hmac_key_name $file_hmac_key_ctx $file_hmac_output -rf if [ ! -e "$file_input_data" ] then echo "12345678" > $file_input_data fi tpm2_takeownership -c tpm2_createprimary -A e -g $alg_primary_obj -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then fail createprimary fi tpm2_create -g $alg_create_obj -G $alg_create_key -o $file_hmac_key_pub -O $file_hmac_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then fail create fi tpm2_load -c $file_primary_key_ctx -u $file_hmac_key_pub -r $file_hmac_key_priv -n $file_hmac_key_name -C $file_hmac_key_ctx if [ $? != 0 ];then fail load fi tpm2_hmac -c $file_hmac_key_ctx -g $halg -I $file_input_data -o $file_hmac_output if [ $? != 0 ];then fail hmac fi ####handle test rm -f $file_hmac_output tpm2_evictcontrol -A o -c $file_hmac_key_ctx -S $handle_hmac_key |tee evict.log c1="$?" grep "persistentHandle: "$handle_hmac_key"" evict.log c2="$?" if [ $c1 != 0 ] || [ $c2 != 0 ];then fail evict fi tpm2_hmac -k $handle_hmac_key -g $halg -I $file_input_data -o $file_hmac_output if [ $? != 0 ];then fail hmac fi tpm2.0-tools-1.1.0/test/test_tpm2_listpcrs.sh000077500000000000000000000040531300711361400210470ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash tpm2_listpcrs if [ $? != 0 ];then echo "listpcrs fail!" exit 1 fi tpm2_listpcrs -g 0x04 if [ $? != 0 ];then echo "listpcrs fail!" exit 1 fi rm -rf pcrs tpm2_listpcrs -L 0x04:17,18,19+0x0b:0,17,18,19 -o pcrs if [ $? != 0 ];then echo "listpcrs fail!" exit 1 fi tpm2_listpcrs -s if [ $? != 0 ];then echo "listpcrs fail!" exit 1 fi echo "listpcrs OK!" tpm2.0-tools-1.1.0/test/test_tpm2_load.sh000077500000000000000000000071571300711361400201330ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash alg_primary_obj=0x000B alg_primary_key=0x0001 alg_create_obj=0x000B alg_create_key=0x0008 alg_load=0x0004 file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key" file_load_key_pub=opu_"$alg_create_obj"_"$alg_create_key" file_load_key_priv=opr_"$alg_create_obj"_"$alg_create_key" file_load_key_name=name.load_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_load_key_ctx=ctx_load_out_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_load_output=load_"$file_load_key_ctx" Handle_parent=0x81010018 Handle_ek_load=0x81010017 fail() { echo "$1 test fail, please check the environment or parameters!" # echo ""$1" fail" >>test_encryptdecrypt_error.log exit 1 } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } rm $file_primary_key_ctx $file_load_key_pub $file_load_key_priv $file_load_key_name $file_load_key_ctx $file_load_output -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_primary_obj -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then fail createprimary fi tpm2_create -g $alg_create_obj -G $alg_create_key -o $file_load_key_pub -O $file_load_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then fail create fi tpm2_load -c $file_primary_key_ctx -u $file_load_key_pub -r $file_load_key_priv -n $file_load_key_name -C $file_load_key_ctx if [ $? != 0 ];then fail load fi #####handle test rm $file_load_key_pub $file_load_key_priv $file_load_key_name $file_load_key_ctx $file_load_output -rf tpm2_evictcontrol -A o -c $file_primary_key_ctx -S $Handle_parent if [ $? != 0 ];then fail evict fi tpm2_create -H $Handle_parent -g $alg_create_obj -G $alg_create_key -o $file_load_key_pub -O $file_load_key_priv if [ $? != 0 ];then fail create fi tpm2_load -H $Handle_parent -u $file_load_key_pub -r $file_load_key_priv -n $file_load_key_name -C $file_load_key_ctx if [ $? != 0 ];then fail load fi echo "load test OK!" tpm2.0-tools-1.1.0/test/test_tpm2_loadexternal.sh000077500000000000000000000075131300711361400216720ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash alg_primary_obj=0x000B alg_primary_key=0x0001 alg_create_obj=0x000B alg_create_key=0x0008 file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key" file_loadexternal_key_pub=opu_"$alg_create_obj"_"$alg_create_key" file_loadexternal_key_priv=opr_"$alg_create_obj"_"$alg_create_key" file_loadexternal_key_name=name.loadexternal_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_loadexternal_key_ctx=ctx_loadexternal_out_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_loadexternal_output=loadexternal_"$file_loadexternal_key_ctx" Handle_parent=0x81010019 fail() { echo "$1 test fail, please check the environment or parameters!" # echo ""$1" fail" >>test_encryptdecrypt_error.log exit 1 } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } rm $file_primary_key_ctx $file_loadexternal_key_pub $file_loadexternal_key_priv $file_loadexternal_key_name $file_loadexternal_key_ctx $file_loadexternal_output -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_primary_obj -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then fail createprimary fi tpm2_create -g $alg_create_obj -G $alg_create_key -o $file_loadexternal_key_pub -O $file_loadexternal_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then fail create fi ##tpm2_loadexternalexternal -H n -u $file_loadexternal_key_pub -r $file_loadexternal_key_priv -n $file_loadexternal_key_name -C $file_loadexternal_key_ctx tpm2_loadexternal -H n -u $file_loadexternal_key_pub -C $file_loadexternal_key_ctx if [ $? != 0 ];then fail loadexternal fi #####handle test rm $file_loadexternal_key_pub $file_loadexternal_key_priv $file_loadexternal_key_name $file_loadexternal_key_ctx $file_loadexternal_output -rf tpm2_evictcontrol -A o -c $file_primary_key_ctx -S $Handle_parent if [ $? != 0 ];then fail evict fi tpm2_create -H $Handle_parent -g $alg_create_obj -G $alg_create_key -o $file_loadexternal_key_pub -O $file_loadexternal_key_priv if [ $? != 0 ];then fail create fi tpm2_loadexternal -H n -u $file_loadexternal_key_pub if [ $? != 0 ];then fail loadexternal fi echo "loadexternal test OK!" tpm2.0-tools-1.1.0/test/test_tpm2_makecredential.sh000077500000000000000000000056141300711361400221600ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash handle_ek=0x81010007 handle_ak=0x81010008 ek_alg=0x001 ak_alg=0x0001 digestAlg=0x000B signAlg=0x0014 file_input_data=secret.data output_ek_pub=ek_pub.out output_ak_pub=ak_pub.out output_ak_pub_name=ak_name_pub.out output_mkcredential=mkcredential.out rm $output_ek_pub $output_ak_pub $output_ak_pub_name $output_mkcredential -rf if [ ! -e "$file_input_data" ] then echo "12345678" > $file_input_data fi tpm2_getpubek -H $handle_ek -g $ek_alg -f $output_ek_pub if [ $? != 0 ] || [ ! -e $output_ek_pub ];then echo "getpubek fail, please check the environment or parameters!" exit 1 fi tpm2_getpubak -E $handle_ek -k $handle_ak -g $ak_alg -D $digestAlg -s $signAlg -f $output_ak_pub -n $output_ak_pub_name |tee output_ak if [ $? != 0 ] || [ ! -e output_ak ];then echo "getpubak fail, please check the environment or parameters!" exit 1 fi grep -A 3 "Name of loaded key:" output_ak|tr "\n" " " >grep.txt Loadkeyname=`sed -e 's/ //g' grep.txt | awk -F':' '{print $2}'` tpm2_makecredential -e $output_ek_pub -s $file_input_data -n $Loadkeyname -o $output_mkcredential if [ $? != 0 ];then echo "makecredential fail, please check the environment or parameters!" exit 1 fi echo "makecredential successfully!" tpm2.0-tools-1.1.0/test/test_tpm2_nv.sh000077500000000000000000000053721300711361400176340ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash nv_test_index=0x1500018 nv_auth_handle=0x40000001 tpm2_takeownership -c if [ $? != 0 ];then echo "clean ownership Fail!" exit 1 fi tpm2_nvlist|grep -i $nv_test_index if [ $? = 0 ];then tpm2_nvrelease -x $nv_test_index -a $nv_auth_handle if [ $? != 0 ];then echo "please release the nv index $nv_test_index first!" exit 1 fi fi tpm2_nvdefine -x $nv_test_index -a $nv_auth_handle -s 32 -t 0x2000A if [ $? != 0 ];then echo "nvdefine fail,Please check your environment!" exit 1 fi if [ ! -f nv.test_w ];then echo "please123abc" >nv.test_w fi tpm2_nvwrite -x $nv_test_index -a $nv_auth_handle -f nv.test_w if [ $? != 0 ];then echo "nvwrite fail!" exit 1 fi tpm2_nvread -x $nv_test_index -a $nv_auth_handle -s 32 -o 0 if [ $? != 0 ];then echo "nvread fail!" exit 1 fi tpm2_nvlist|grep -i $nv_test_index if [ $? != 0 ];then echo "nvlist fail or double check the define index!" exit 1 fi tpm2_nvrelease -x $nv_test_index -a $nv_auth_handle if [ $? != 0 ];then echo "nvrelease fail or double check the define index!" exit 1 else echo "release the nv index OK!" fi tpm2.0-tools-1.1.0/test/test_tpm2_quote.sh000077500000000000000000000111361300711361400203410ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash alg_primary_obj=0x000B alg_primary_key=0x0001 alg_create_obj=0x000B alg_create_key=0x0008 alg_quote=0x0004 alg_quote1=0x000b file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key" file_quote_key_pub=opu_"$alg_create_obj"_"$alg_create_key" file_quote_key_priv=opr_"$alg_create_obj"_"$alg_create_key" file_quote_key_name=name.load_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_quote_key_ctx=ctx_load_out_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_quote_output=quote_"$file_quote_key_ctx" Handle_ak_quote=0x81010016 Handle_ek_quote=0x81010017 nonce=12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde12345abcde fail() { echo "$1 test fail, please check the environment or parameters!" # echo ""$1" fail" >>test_encryptdecrypt_error.log exit 1 } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } rm $file_primary_key_ctx $file_quote_key_pub $file_quote_key_priv $file_quote_key_name $file_quote_key_ctx $file_quote_output -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_primary_obj -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then fail createprimary exit 1 fi tpm2_create -g $alg_create_obj -G $alg_create_key -o $file_quote_key_pub -O $file_quote_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then fail create exit 1 fi tpm2_load -c $file_primary_key_ctx -u $file_quote_key_pub -r $file_quote_key_priv -n $file_quote_key_name -C $file_quote_key_ctx if [ $? != 0 ];then fail load fi tpm2_quote -c $file_quote_key_ctx -g $alg_quote -l 16,17,18 -o $file_quote_output -q $nonce if [ $? != 0 ];then fail quote fi rm $file_quote_output -rf tpm2_quote -c $file_quote_key_ctx -L $alg_quote:16,17,18+$alg_quote1:16,17,18 -o $file_quote_output -q $nonce if [ $? != 0 ];then fail quote fi #####handle testing tpm2_evictcontrol -A o -c $file_quote_key_ctx -S $Handle_ak_quote if [ $? != 0 ];then fail evict fi rm quote_handle_output_"$Handle_ak_quote" -rf tpm2_quote -k $Handle_ak_quote -g $alg_quote -l 16,17,18 -o quote_handle_output_"$Handle_ak_quote" -q $nonce if [ $? != 0 ];then fail quote_handle fi rm quote_handle_output_"$Handle_ak_quote" -rf tpm2_quote -k $Handle_ak_quote -L $alg_quote:16,17,18+$alg_quote1:16,17,18 -o quote_handle_output_"$Handle_ak_quote" -q $nonce if [ $? != 0 ];then fail quote_handle fi #####AK Handle_ak_quote=$(($Handle_ak_quote+0x2)) val=`echo 'obase=16;'$Handle_ak_quote''|bc` Handle_ak_quote=0x"$val" tpm2_getpubek -H $Handle_ek_quote -g 0x01 -f ek.pub2 if [ $? != 0 ];then fail getpubek fi tpm2_getpubak -E $Handle_ek_quote -k $Handle_ak_quote -f ak.pub2 -n ak.name_2 if [ $? != 0 ];then fail getpubak fi rm quote_handle_output_"$Handle_ak_quote" -rf tpm2_quote -k $Handle_ak_quote -g $alg_quote -l 16,17,18 -o quote_handle_output_"$Handle_ak_quote" -q $nonce if [ $? != 0 ];then fail quote_handle_ak fi echo "quote test OK!" tpm2.0-tools-1.1.0/test/test_tpm2_readpublic.sh000077500000000000000000000066321300711361400213230ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash alg_primary_obj=0x000B alg_primary_key=0x0001 alg_create_obj=0x000B alg_create_key=0x0008 file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key" file_readpub_key_pub=opu_"$alg_create_obj"_"$alg_create_key" file_readpub_key_priv=opr_"$alg_create_obj"_"$alg_create_key" file_readpub_key_name=name.load_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_readpub_key_ctx=ctx_load_out_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_readpub_output=readpub_"$file_readpub_key_ctx" Handle_readpub=0x81010014 fail() { echo "$1 test fail, please check the environment or parameters!" exit 1 } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } rm $file_primary_key_ctx $file_readpub_key_pub $file_readpub_key_priv $file_readpub_key_name $file_readpub_key_ctx $file_readpub_output -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_primary_obj -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then fail createprimary fi tpm2_create -g $alg_create_obj -G $alg_create_key -o $file_readpub_key_pub -O $file_readpub_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then fail create fi tpm2_load -c $file_primary_key_ctx -u $file_readpub_key_pub -r $file_readpub_key_priv -n $file_readpub_key_name -C $file_readpub_key_ctx if [ $? != 0 ];then fail load fi tpm2_readpublic -c $file_readpub_key_ctx -o $file_readpub_output if [ $? != 0 ];then fail decrypt fi #####handle testing tpm2_evictcontrol -A o -c $file_readpub_key_ctx -S $Handle_readpub if [ $? != 0 ];then fail evict fi rm $file_readpub_output -rf tpm2_readpublic -H $Handle_readpub -o $file_readpub_output if [ $? != 0 ];then fail readpublic_handle fi echo "readpublic test OK!" tpm2.0-tools-1.1.0/test/test_tpm2_rsadecrypt.sh000077500000000000000000000071141300711361400213650ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash file_primary_key_ctx=context.p_B1 file_rsaencrypt_key_pub=opuB1_B8 file_rsaencrypt_key_priv=oprB1_B8 file_rsaencrypt_key_ctx=context_loadext_out_B1_B8 file_rsadecrypt_key_ctx=context_load_out_B1_B8 file_rsaencrypt_key_name=name.load.B1_B8 file_rsa_en_output_data=rsa_en.out file_rsa_de_output_data=rsa_de.out file_input_data=secret.data alg_hash=0x000B alg_primary_key=0x0001 alg_rsaencrypt_key=0x0001 if [ ! -e "$file_input_data" ] then echo "12345678" > $file_input_data fi rm $file_primary_key_ctx $file_rsaencrypt_key_pub $file_rsaencrypt_key_priv $file_rsaencrypt_key_ctx $file_rsaencrypt_key_name $file_output_data $file_rsa_en_output_data $file_rsa_de_output_data -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_hash -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then echo "createprimary fail, please check the environment or parameters!" exit 1 fi tpm2_create -g $alg_hash -G $alg_rsaencrypt_key -o $file_rsaencrypt_key_pub -O $file_rsaencrypt_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then echo "create fail, please check the environment or parameters!" exit 1 fi tpm2_loadexternal -H n -u $file_rsaencrypt_key_pub -C $file_rsaencrypt_key_ctx if [ $? != 0 ];then echo "loadexternal fail, please check the environment or parameters!" exit 1 fi tpm2_rsaencrypt -c $file_rsaencrypt_key_ctx -I $file_input_data -o $file_rsa_en_output_data if [ $? != 0 ];then echo "rsa encrypt fail, please check the environment or parameters!" exit 1 fi tpm2_load -c $file_primary_key_ctx -u $file_rsaencrypt_key_pub -r $file_rsaencrypt_key_priv -n $file_rsaencrypt_key_name -C $file_rsadecrypt_key_ctx if [ $? != 0 ];then echo "load fail, please check the environment or parameters!" exit 1 fi tpm2_rsadecrypt -c $file_rsadecrypt_key_ctx -I $file_rsa_en_output_data -o $file_rsa_de_output_data if [ $? != 0 ];then echo "rsa decrypt fail, please check the environment or parameters!" exit 1 fi tpm2.0-tools-1.1.0/test/test_tpm2_rsaencrypt.sh000077500000000000000000000061621300711361400214010ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash file_primary_key_ctx=context.p_B1 file_rsaencrypt_key_pub=opuB1_B8 file_rsaencrypt_key_priv=oprB1_B8 file_rsaencrypt_key_ctx=context_load_out_B1_B8 file_rsaencrypt_key_name=name.load.B1_B8 file_rsa_en_output_data=rsa_en.out file_input_data=secret.data alg_hash=0x000B alg_primary_key=0x0001 alg_rsaencrypt_key=0x0001 if [ ! -e "$file_input_data" ] then echo "12345678" > $file_input_data fi rm $file_primary_key_ctx $file_rsaencrypt_key_pub $file_rsaencrypt_key_priv $file_rsaencrypt_key_ctx $file_rsaencrypt_key_name $file_output_data $file_rsa_en_output_data -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_hash -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then echo "createprimary fail, please check the environment or parameters!" exit 1 fi tpm2_create -g $alg_hash -G $alg_rsaencrypt_key -o $file_rsaencrypt_key_pub -O $file_rsaencrypt_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then echo "create fail, please check the environment or parameters!" exit 1 fi tpm2_loadexternal -H n -u $file_rsaencrypt_key_pub -C $file_rsaencrypt_key_ctx if [ $? != 0 ];then echo "loadexternal fail, please check the environment or parameters!" exit 1 fi #./tpm2_rsaencrypt -c context_loadexternal_out6.out -I secret.data -o rsa_en.out tpm2_rsaencrypt -c $file_rsaencrypt_key_ctx -I $file_input_data -o $file_rsa_en_output_data if [ $? != 0 ];then echo "rsa encrypt fail, please check the environment or parameters!" exit 1 fi tpm2.0-tools-1.1.0/test/test_tpm2_sign.sh000077500000000000000000000065431300711361400201520ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash file_primary_key_ctx=context.p_B1 file_signing_key_pub=opuB1_B8 file_signing_key_priv=oprB1_B8 file_signing_key_ctx=context_load_out_B1_B8 file_signing_key_name=name.load.B1_B8 file_input_data=secret.data file_output_data=sig.4 handle_signing_key=0x81010005 alg_hash=0x000B alg_primary_key=0x0001 alg_signing_key=0x0008 fail() { echo "$1 test fail, please check the environment or parameters!" exit 1 } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } if [ ! -e "$file_input_data" ] then echo "12345678" > $file_input_data fi rm $file_primary_key_ctx $file_signing_key_pub $file_signing_key_priv $file_signing_key_ctx $file_signing_key_name $file_output_data -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_hash -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then fail createprimary fi tpm2_create -g $alg_hash -G $alg_signing_key -o $file_signing_key_pub -O $file_signing_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then fail create fi tpm2_load -c $file_primary_key_ctx -u $file_signing_key_pub -r $file_signing_key_priv -n $file_signing_key_name -C $file_signing_key_ctx if [ $? != 0 ];then fail load fi tpm2_sign -c $file_signing_key_ctx -g $alg_hash -m $file_input_data -s $file_output_data if [ ! -e "$file_output_data" ];then fail sign else rm $file_output_data -rf fi tpm2_evictcontrol -A o -c $file_signing_key_ctx -S $handle_signing_key |tee evict.log c1="$?" grep "persistentHandle: "$handle_signing_key"" evict.log c2="$?" if [ $c1 != 0 ] || [ $c2 != 0 ];then fail evictcontrol fi tpm2_sign -k $handle_signing_key -g $alg_hash -m $file_input_data -s $file_output_data if [ $? != 0 ];then fail sign fi tpm2.0-tools-1.1.0/test/test_tpm2_takeownership_all.sh000077500000000000000000000046171300711361400227250ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash ownerPasswd=abc123 endorsePasswd=abc123 lockPasswd=abc123 new_ownerPasswd=newpswd new_endorsePasswd=newpswd new_lockPasswd=newpswd tpm2_takeownership -c if [ $? != 0 ];then echo "clean ownership Fail!" exit 1 fi tpm2_takeownership -o $ownerPasswd -e $endorsePasswd -l $lockPasswd if [ $? != 0 ];then echo "take ownership Fail, check your envirnoment!" exit 1 fi tpm2_takeownership -O $ownerPasswd -E $endorsePasswd -L $lockPasswd -o $new_ownerPasswd -e $new_endorsePasswd -l $new_lockPasswd if [ $? != 0 ];then echo "re-take ownership Fail, check your envirnoment!" exit 1 fi tpm2_takeownership -c -L $new_lockPasswd if [ $? != 0 ];then echo "clean ownership fail with lock password!" exit 1 fi tpm2.0-tools-1.1.0/test/test_tpm2_unseal.sh000077500000000000000000000073511300711361400204770ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash alg_primary_obj=0x0004 alg_primary_key=0x0001 alg_create_obj=0x000B alg_create_key=0x0008 file_input_data=secret.data file_primary_key_ctx=context.p_"$alg_primary_obj"_"$alg_primary_key" file_unseal_key_pub=opu_"$alg_create_obj"_"$alg_create_key" file_unseal_key_priv=opr_"$alg_create_obj"_"$alg_create_key" file_unseal_key_ctx=ctx_load_out_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_unseal_key_name=name.load_"$alg_primary_obj"_"$alg_primary_key"-"$alg_create_obj"_"$alg_create_key" file_unseal_output_data=usl_"$file_unseal_key_ctx" rm $file_primary_key_ctx $file_unseal_key_pub $file_unseal_key_priv $file_unseal_key_ctx $file_unseal_key_name $file_unseal_output_data -rf if [ ! -e "$file_input_data" ] then echo "12345678" > $file_input_data fi tpm2_takeownership -c tpm2_createprimary -A p -g $alg_primary_obj -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then echo "createprimary fail, please check the environment or parameters!" exit 1 fi #./tpm2_create -g 0x000B -G 0x0008 -o opu9.out -O opr9.out -c context.p9.out -I secret.data tpm2_create -g $alg_create_obj -G $alg_create_key -o $file_unseal_key_pub -O $file_unseal_key_priv -I $file_input_data -c $file_primary_key_ctx if [ $? != 0 ];then echo "create fail, please check the environment or parameters!" exit 1 fi #./tpm2_load -c context.p9.out -u opu9.out -r opr9.out -n name.load9.out -C context_load_out9.out tpm2_load -c $file_primary_key_ctx -u $file_unseal_key_pub -r $file_unseal_key_priv -n $file_unseal_key_name -C $file_unseal_key_ctx if [ $? != 0 ];then echo "load fail, please check the environment or parameters!" exit 1 fi #tpm2_unseal -c context_load_out1.out -o usl.data.out tpm2_unseal -c $file_unseal_key_ctx $ -o $file_unseal_output_data if [ $? != 0 ];then echo "unseal fail, please check the environment or parameters!" exit 1 fi ###handle test blocked ##tpm2_evictcontrol -A p -c $file_unseal_key_ctx -S 0x81010015 --Fail to evict ##tpm2_evictcontrol -A o -c context_load_out4 -S 0x81010015 (0x285) ##tpm2_unseal -H 0x81010015 -o usl_handle tpm2.0-tools-1.1.0/test/test_tpm2_verifysignature.sh000077500000000000000000000105521300711361400224330ustar00rootroot00000000000000#;**********************************************************************; # # Copyright (c) 2016, Intel Corporation # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # # 1. Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # # 2. Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # # 3. Neither the name of Intel Corporation nor the names of its contributors # may be used to endorse or promote products derived from this software without # specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF # THE POSSIBILITY OF SUCH DAMAGE. #;**********************************************************************; #!/bin/bash file_primary_key_ctx=context.p_B1 file_signing_key_pub=opuB1_B8 file_signing_key_priv=oprB1_B8 file_signing_key_ctx=context_load_out_B1_B8 file_signing_key_name=name.load.B1_B8 file_input_data=secret.data file_output_data=sig.4 file_verify_tk_data=tickt_verify_sig.4 file_input_data_hash=secret_hash.data file_input_data_hash_tk=secret_hash_tk.data handle_signing_key=0x81010005 alg_hash=0x000B alg_primary_key=0x0001 alg_signing_key=0x0001 fail() { echo "$1 test fail, please check the environment or parameters!" exit 1 } Pass() { echo ""$1" pass" >>test_getpubak_pass.log } if [ ! -e "$file_input_data" ] then echo "12345678" > $file_input_data fi rm $file_primary_key_ctx $file_signing_key_pub $file_signing_key_priv $file_signing_key_ctx $file_signing_key_name $file_output_data $file_verify_tk_data $file_input_data_hash $file_input_data_hash_tk -rf tpm2_takeownership -c tpm2_createprimary -A e -g $alg_hash -G $alg_primary_key -C $file_primary_key_ctx if [ $? != 0 ];then fail createprimary fi tpm2_create -g $alg_hash -G $alg_signing_key -o $file_signing_key_pub -O $file_signing_key_priv -c $file_primary_key_ctx if [ $? != 0 ];then fail create fi tpm2_load -c $file_primary_key_ctx -u $file_signing_key_pub -r $file_signing_key_priv -n $file_signing_key_name -C $file_signing_key_ctx if [ $? != 0 ];then fail load fi tpm2_sign -c $file_signing_key_ctx -g $alg_hash -m $file_input_data -s $file_output_data if [ ! -e "$file_output_data" ];then echo "no outputfile,sign test Fail!" exit 1 fi #tpm2_verifysignature -c context_load_out_6 -g 0x000B -m secret.data -s sign.f1 -t tickt_verify_sign.out tpm2_verifysignature -c $file_signing_key_ctx -g $alg_hash -m $file_input_data -s $file_output_data -t $file_verify_tk_data if [ $? != 0 ];then fail verifysignature fi #./tpm2_hash -H n -g 0x00B -I secret.data -o hash.f.01 -t hash.tk.f.01 tpm2_hash -H n -g $alg_hash -I $file_input_data -o $file_input_data_hash -t $file_input_data_hash_tk if [ ! -e "$file_input_data_hash" ];then echo "hash $file_input_data Fail!" exit 1 fi rm $file_verify_tk_data -rf tpm2_verifysignature -c $file_signing_key_ctx -D $file_input_data_hash -s $file_output_data -t $file_verify_tk_data if [ $? != 0 ];then fail verifysignature fi rm $file_verify_tk_data $file_signing_key_ctx -rf tpm2_loadexternal -H n -u $file_signing_key_pub -C $file_signing_key_ctx if [ ! -e "$file_signing_key_ctx" ];then fail Loadexternal fi ###need debug 0x2cb error first ## tpm2_verifysignature -c $file_signing_key_ctx -g $alg_hash -m $file_input_data -s $file_output_data -t $file_verify_tk_data if [ $? != 0 ];then fail verifysignature fi tpm2.0-tools-1.1.0/test/tpm2-rc-decode_unit.c000066400000000000000000000430401300711361400205530ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2016, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include "rc-decode.h" #define TPM_RC_ALL_1 0xffffffff /* Check our ability to determine RC format. The spec is massively (IMHO) * confusing on this point. See section 6.6.3 from part 2 for some clarity. * specifically the NOTE immediately before table 17 */ static void tpm2_rc_is_format_zero_true (void **state) { TPM_RC rc = 0xffffff7f; assert_true (tpm2_rc_is_format_zero (rc)); } static void tpm2_rc_is_format_zero_false (void **state) { TPM_RC rc = TPM_RC_ALL_1; assert_false (tpm2_rc_is_format_zero (rc)); } static void tpm2_rc_is_format_one_true (void **state) { TPM_RC rc = TPM_RC_ALL_1; assert_true (tpm2_rc_is_format_one (rc)); } static void tpm2_rc_is_format_one_false (void **state) { TPM_RC rc = 0xffffff7f; assert_false (tpm2_rc_is_format_one (rc)); } /* Bits 7 and 8 in the TPM_RC are set to 0 for TPM1.2 return codes. * Here we test to be sure the is_tpm2_rc function identifies this RC as such. * All other bits in the RC are set to 1 since the comparison is done using a * logical AND operation. */ static void tpm2_rc_is_tpm12_true (void **state) { /* bits 7 & 8 clear */ TPM_RC rc = 0xfffffe7f; assert_true (tpm2_rc_is_tpm12 (rc)); } static void tpm2_rc_is_tpm12_false (void **state) { TPM_RC rc = 0xfffffe7f; assert_false (tpm2_rc_is_tpm2 (rc)); } /* If either of bits 7 or 8 are set the response code is a TPM2 response. * The next 3 tests go through the 3 possible permutations (01, 10 & 11) * for these two bits. */ static void tpm2_rc_is_tpm2_01 (void **state) { /* bit 7 set, bit 8 clear */ TPM_RC rc = 0xfffffeff; assert_true (tpm2_rc_is_tpm2 (rc)); } static void tpm2_rc_is_tpm2_10 (void **state) { /* bit 7 clear, bit 8 set */ TPM_RC rc = 0xffffff7f; assert_true (tpm2_rc_is_tpm2 (rc)); } static void tpm2_rc_is_tpm2_11 (void **state) { /* bit 7 and 8 set */ TPM_RC rc = TPM_RC_ALL_1; assert_true (tpm2_rc_is_tpm2 (rc)); } /* Vendor defined response codes have bit 8 and 10 set and bit 7 cleared. */ static void tpm2_rc_is_vendor_defined_code_all_but_7 (void **state) { /* bit 7 clear, bit 8 and 10 set */ TPM_RC rc = 0xffffff7f; assert_true (tpm2_rc_is_vendor_defined (rc)); } /* Negative case for bit 7 */ static void tpm2_rc_is_vendor_defined_code_7_set (void **state) { /* bit 7, 8 and 10 set */ TPM_RC rc = TPM_RC_ALL_1; assert_false (tpm2_rc_is_vendor_defined (rc)); } /* Negative case for bit 8 */ static void tpm2_rc_is_vendor_defined_code_8_unset (void **state) { /* bit 7 and 8 clear, bit 10 set */ TPM_RC rc = 0xfffffe7f; assert_false (tpm2_rc_is_vendor_defined (rc)); } /* Negative case for bit 10 */ static void tpm2_rc_is_vendor_defined_code_10_unset (void **state) { /* bit 7 and 10 clear, bit 8 set */ TPM_RC rc = 0xfffffb7f; assert_false (tpm2_rc_is_vendor_defined (rc)); } /* Case to show that an unrelated bit has no effect. */ static void tpm2_rc_is_vendor_defined_code_no_9 (void **state) { /* bit 7 and 9 clear, bit 8 and 10 set */ TPM_RC rc = 0xfffffd7f; assert_true (tpm2_rc_is_vendor_defined (rc)); } /* Warning codes have bit 8 and 11 set, and bits 7 and 10 clear. */ static void tpm2_rc_is_warning_code_success (void **state) { /* bit 7 and 10 clear, bit 8 and 11 set */ TPM_RC rc = 0xfffff97f; assert_true (tpm2_rc_is_warning_code (rc)); } /* Negitive case for bit 8 */ static void tpm2_rc_is_warning_code_8_unset (void **state) { /* bit 7, 8 and 10 clear, bit 11 set */ TPM_RC rc = 0xfffffa7f; assert_false (tpm2_rc_is_warning_code (rc)); } /* Negative case for bit 7 */ static void tpm2_rc_is_warning_code_7_set (void **state) { /* bit 7, 8 and 11 set, bit 10 clear */ TPM_RC rc = 0xfffff9ff; assert_false (tpm2_rc_is_warning_code (rc)); } /* Negative case for bit 10 */ static void tpm2_rc_is_warning_code_10_set (void **state) { /* bit 8, 10 and 11 set, bit 7 clear */ TPM_RC rc = 0xfffff7f; assert_false (tpm2_rc_is_warning_code (rc)); } /* Negative case for bit 11 */ static void tpm2_rc_is_warning_code_11_unset (void **state) { /* bit 8 set, bits 7, 10 and 11 clear */ TPM_RC rc = 0xfffff37f; assert_false (tpm2_rc_is_warning_code (rc)); } /* Error code in bit [6:0] if bit 8 set, and bit 7, 10 and 11 clear. */ static void tpm2_rc_is_error_code_success (void **state) { TPM_RC rc = 0xfffff37f; assert_true (tpm2_rc_is_error_code (rc)); } /* Negative case for bit 8 */ static void tpm2_rc_is_error_code_8_unset (void **state) { /* bit 7, 8, 10 and 11 clear */ TPM_RC rc = 0xfffff27f; assert_false (tpm2_rc_is_error_code (rc)); } /* Negative case for bit 7 */ static void tpm2_rc_is_error_code_7_set (void **state) { /* bit 7 and 8 set, bit 10 and 11 clear*/ TPM_RC rc = 0xfffff3ff; assert_false (tpm2_rc_is_error_code (rc)); } /* Negative case for bit 10 */ static void tpm2_rc_is_error_code_10_set (void **state) { /* bit 8 and 10 set, bit 7 and 11 clear */ TPM_RC rc = 0xfffff77f; assert_false (tpm2_rc_is_error_code (rc)); } /* Negative case for bit 11 */ static void tpm2_rc_is_error_code_11_set (void **state) { /* bit 8 and 11 set, bit 7 and 10 clear*/ TPM_RC rc = 0xfffffb7f; assert_false (tpm2_rc_is_error_code (rc)); } /* Error code in bits [5:0] with parameter number in bits [11:8] when * bits 6 and 7 are set. */ static void tpm2_rc_is_error_code_with_parameter_success (void **state) { TPM_RC rc = TPM_RC_ALL_1; assert_true (tpm2_rc_is_error_code_with_parameter (rc)); } /* Negative case for bit 6 */ static void tpm2_rc_is_error_code_with_parameter_6_unset (void **state) { /* bit 6 clear, bit 7 set */ TPM_RC rc = 0xffffffbf; assert_false (tpm2_rc_is_error_code_with_parameter (rc)); } /* Negative case for bit 7 */ static void tpm2_rc_is_error_code_with_parameter_7_unset (void **state) { /* bit 6 set, bit 7 clear */ TPM_RC rc = 0xffffff7f; assert_false (tpm2_rc_is_error_code_with_parameter (rc)); } /* Error code in bits [5:0] with handle number in bits [10:8] when * bit 7 is set and bits 6 and 11 are clear. */ static void tpm2_rc_is_error_code_with_handle_success (void **state) { TPM_RC rc = 0xfffff7bf; assert_true (tpm2_rc_is_error_code_with_handle (rc)); } /* Negative case for bit 6 */ static void tpm2_rc_is_error_code_with_handle_6_set (void **state) { /* bit 6 and 7 set, bit 11 clear*/ TPM_RC rc = 0xfffff7ff; assert_false (tpm2_rc_is_error_code_with_handle (rc)); } /* Negative case for bit 7 */ static void tpm2_rc_is_error_code_with_handle_7_unset (void **state) { /* bit 6, 7 and 11 clear */ TPM_RC rc = 0xfffff73f; assert_false (tpm2_rc_is_error_code_with_handle (rc)); } /* Negative case for bit 11 */ static void tpm2_rc_is_error_code_with_handle_11_set (void **state) { /* bit 6 clear, bit 7 and 11 clear */ TPM_RC rc = 0xffffffbf; assert_false (tpm2_rc_is_error_code_with_handle (rc)); } /* Error code in bits [05:00] with session number in bits [10:08] when * bit 6 is clear and bits 7 and 11 set. */ static void tpm2_rc_is_error_code_with_session_success (void **state) { /* bit 6 clear, bits 7 & 11 set */ TPM_RC rc = 0xffffffbf; assert_true (tpm2_rc_is_error_code_with_session (rc)); } /* Negative case for bit 6 */ static void tpm2_rc_is_error_code_with_session_6_set (void **state) { /* bits 6, 7 & 11 set */ TPM_RC rc = TPM_RC_ALL_1; assert_false (tpm2_rc_is_error_code_with_session (rc)); } /* Negative case for bit 7 */ static void tpm2_rc_is_error_code_with_session_7_unset (void **state) { /* bits 6 & 7 clear, bit 11 set */ TPM_RC rc = 0xffffff3f; assert_false (tpm2_rc_is_error_code_with_session (rc)); } /* Negative case for bit 11 */ static void tpm2_rc_is_error_code_with_session_11_unset (void **state) { /* bits 6 & 11 clear, bit 7 set */ TPM_RC rc = 0xfffff7bf; assert_false (tpm2_rc_is_error_code_with_session (rc)); } /* Isolate bits [06:00] of the TPM_RC. * The first of these tests ensures that when all bits are set that we only * get back an int with the bits [06:00] set. */ static void tpm2_rc_get_code_7bit_all (void **state) { TPM_RC rc = TPM_RC_ALL_1; assert_int_equal (tpm2_rc_get_code_6bit (rc), 0x0000003f); } static void tpm2_rc_get_code_7bit_general_failure (void **state) { TPM_RC rc = ~TPM_RC_6BIT_ERROR_MASK | TSS2_BASE_RC_GENERAL_FAILURE; assert_int_equal (tpm2_rc_get_code_6bit (rc), TSS2_BASE_RC_GENERAL_FAILURE); } /* Isolate bits [05:00] of the TPM_RC. * This test ensures that the tpm2_rc_get_code_6bit returns only bits [05:00] * unmodified. */ static void tpm2_rc_get_code_6bit_all (void **state) { TPM_RC rc = TPM_RC_ALL_1; assert_int_equal (tpm2_rc_get_code_6bit (rc), 0x0000003f); } static void tpm2_rc_get_code_6bit_general_failure (void **state) { TPM_RC rc = ~TPM_RC_6BIT_ERROR_MASK | TSS2_BASE_RC_GENERAL_FAILURE; assert_int_equal (tpm2_rc_get_code_6bit (rc), TSS2_BASE_RC_GENERAL_FAILURE); } /* Isolate bits [11:08] from the TPM_RC. */ static void tpm2_rc_get_parameter_number_f (void **state) { TPM_RC rc = ~TPM_RC_PARAMETER_MASK | TPM_RC_F; assert_int_equal (tpm2_rc_get_parameter_number (rc), TPM_RC_F); } static void tpm2_rc_get_parameter_number_9 (void **state) { TPM_RC rc = ~TPM_RC_PARAMETER_MASK | TPM_RC_9; assert_int_equal (tpm2_rc_get_parameter_number (rc), TPM_RC_9); } /* Isolate bits [10:08] from the TPM_RC. */ static void tpm2_rc_get_handle_number_1 (void **state) { TPM_RC rc = ~TPM_RC_HANDLE_MASK | TPM_RC_1; assert_int_equal (tpm2_rc_get_handle_number (rc), TPM_RC_1); } /* The largest handle number possible */ static void tpm2_rc_get_handle_number_7 (void **state) { TPM_RC rc = ~TPM_RC_HANDLE_MASK | TPM_RC_7; assert_int_equal (tpm2_rc_get_handle_number (rc), TPM_RC_7); } /* A negative case to test for handle numbers beyond what's possible */ static void tpm2_rc_get_handle_number_f (void **state) { TPM_RC rc = ~TPM_RC_HANDLE_MASK | TPM_RC_F; assert_int_not_equal (tpm2_rc_get_handle_number (rc), TPM_RC_F); } /* Isolate bits [10:08] from the TPM_RC. This is redundant but it tests * the functions that expose functionality which are themselves redundant. */ static void tpm2_rc_get_session_number_1 (void **state) { TPM_RC rc = ~TPM_RC_SESSION_MASK | TPM_RC_1; assert_int_equal (tpm2_rc_get_session_number (rc), TPM_RC_1); } static void tpm2_rc_get_session_number_7 (void **state) { TPM_RC rc = ~TPM_RC_SESSION_MASK | TPM_RC_7; assert_int_equal (tpm2_rc_get_session_number (rc), TPM_RC_7); } static void tpm2_rc_get_session_number_f (void **state) { TPM_RC rc = ~TPM_RC_SESSION_MASK | TPM_RC_F; assert_int_not_equal (tpm2_rc_get_session_number (rc), TPM_RC_F); } /* Isolate the various error layers. To test this we set every bit in the RC * and then selectively disable bits using a logical AND to make the error * level meaningful. We then compare the result of the tpm2_rc_get_level * function to the level that we set to be sure that all other bits were * cleared. */ static void tpm2_rc_get_layer_tpm (void **state) { TPM_RC rc = ~TSS2_ERROR_LEVEL_MASK | TSS2_TPM_ERROR_LEVEL; assert_int_equal (tpm2_rc_get_layer (rc), TSS2_TPM_ERROR_LEVEL); } static void tpm2_rc_get_layer_sys (void **state) { TPM_RC rc = ~TSS2_ERROR_LEVEL_MASK | TSS2_SYS_ERROR_LEVEL; assert_int_equal (tpm2_rc_get_layer (rc), TSS2_SYS_ERROR_LEVEL); } static void tpm2_rc_get_layer_tcti (void **state) { TPM_RC rc = ~TSS2_ERROR_LEVEL_MASK | TSS2_TCTI_ERROR_LEVEL; assert_int_equal (tpm2_rc_get_layer (rc), TSS2_TCTI_ERROR_LEVEL); } /* Check our ability to determine the source of the */ static void tpm2_rc_is_from_tss_sys (void **state) { TPM_RC rc = ~TSS2_ERROR_LEVEL_MASK | TSS2_SYS_ERROR_LEVEL; assert_true (tpm2_rc_is_from_tss (rc)); } static void tpm2_rc_is_from_tss_tpm (void **state) { TPM_RC rc = ~TSS2_ERROR_LEVEL_MASK | TSS2_TPM_ERROR_LEVEL; assert_false (tpm2_rc_is_from_tss (rc)); } static void tpm2_rc_is_from_tss_tcti (void **state) { TPM_RC rc = ~TSS2_ERROR_LEVEL_MASK | TSS2_TCTI_ERROR_LEVEL; assert_true (tpm2_rc_is_from_tss (rc)); } /* Isolate the base error code from a TSS error. */ static void tpm2_rc_get_tss_err_code_general_from_tcti (void **state) { TPM_RC rc = TSS2_TCTI_RC_GENERAL_FAILURE; assert_int_equal (TSS2_BASE_RC_GENERAL_FAILURE, tpm2_rc_get_tss_err_code (rc)); } static void tpm2_rc_get_tss_err_code_try_again_from_tcti (void **state) { TPM_RC rc = TSS2_TCTI_RC_TRY_AGAIN; assert_int_equal (TSS2_BASE_RC_TRY_AGAIN, tpm2_rc_get_tss_err_code (rc)); } static void tpm2_rc_get_tss_err_code_abi_mismatch_from_sys (void **state) { TPM_RC rc = TSS2_SYS_RC_ABI_MISMATCH; assert_int_equal (TSS2_BASE_RC_ABI_MISMATCH, tpm2_rc_get_tss_err_code (rc)); } static void tpm2_rc_get_tss_err_code_bad_size_from_sys (void **state) { TPM_RC rc = TSS2_SYS_RC_BAD_SIZE; assert_int_equal (TSS2_BASE_RC_BAD_SIZE, tpm2_rc_get_tss_err_code (rc)); } int main (int argc, char* argv[]) { const UnitTest tests[] = { unit_test (tpm2_rc_is_format_zero_true), unit_test (tpm2_rc_is_format_zero_false), unit_test (tpm2_rc_is_format_one_true), unit_test (tpm2_rc_is_format_one_false), unit_test (tpm2_rc_is_tpm12_true), unit_test (tpm2_rc_is_tpm12_false), unit_test (tpm2_rc_is_tpm2_01), unit_test (tpm2_rc_is_tpm2_10), unit_test (tpm2_rc_is_tpm2_11), unit_test (tpm2_rc_is_vendor_defined_code_all_but_7), unit_test (tpm2_rc_is_vendor_defined_code_7_set), unit_test (tpm2_rc_is_vendor_defined_code_8_unset), unit_test (tpm2_rc_is_vendor_defined_code_10_unset), unit_test (tpm2_rc_is_vendor_defined_code_no_9), unit_test (tpm2_rc_is_warning_code_success), unit_test (tpm2_rc_is_warning_code_8_unset), unit_test (tpm2_rc_is_warning_code_7_set), unit_test (tpm2_rc_is_warning_code_10_set), unit_test (tpm2_rc_is_warning_code_11_unset), unit_test (tpm2_rc_is_error_code_success), unit_test (tpm2_rc_is_error_code_8_unset), unit_test (tpm2_rc_is_error_code_7_set), unit_test (tpm2_rc_is_error_code_10_set), unit_test (tpm2_rc_is_error_code_11_set), unit_test (tpm2_rc_is_error_code_with_parameter_success), unit_test (tpm2_rc_is_error_code_with_parameter_6_unset), unit_test (tpm2_rc_is_error_code_with_parameter_7_unset), unit_test (tpm2_rc_is_error_code_with_handle_success), unit_test (tpm2_rc_is_error_code_with_handle_6_set), unit_test (tpm2_rc_is_error_code_with_handle_7_unset), unit_test (tpm2_rc_is_error_code_with_handle_11_set), unit_test (tpm2_rc_is_error_code_with_session_success), unit_test (tpm2_rc_is_error_code_with_session_6_set), unit_test (tpm2_rc_is_error_code_with_session_7_unset), unit_test (tpm2_rc_is_error_code_with_session_11_unset), unit_test (tpm2_rc_get_code_7bit_all), unit_test (tpm2_rc_get_code_7bit_general_failure), unit_test (tpm2_rc_get_code_6bit_all), unit_test (tpm2_rc_get_code_6bit_general_failure), unit_test (tpm2_rc_get_parameter_number_f), unit_test (tpm2_rc_get_parameter_number_9), unit_test (tpm2_rc_get_handle_number_1), unit_test (tpm2_rc_get_handle_number_7), unit_test (tpm2_rc_get_handle_number_f), unit_test (tpm2_rc_get_session_number_1), unit_test (tpm2_rc_get_session_number_7), unit_test (tpm2_rc_get_session_number_f), unit_test (tpm2_rc_get_layer_tpm), unit_test (tpm2_rc_get_layer_sys), unit_test (tpm2_rc_get_layer_tcti), unit_test (tpm2_rc_is_from_tss_tpm), unit_test (tpm2_rc_is_from_tss_sys), unit_test (tpm2_rc_is_from_tss_tcti), unit_test (tpm2_rc_get_tss_err_code_general_from_tcti), unit_test (tpm2_rc_get_tss_err_code_try_again_from_tcti), unit_test (tpm2_rc_get_tss_err_code_abi_mismatch_from_sys), unit_test (tpm2_rc_get_tss_err_code_bad_size_from_sys), }; return run_tests (tests); } tpm2.0-tools-1.1.0/test/tpm2-rc-entry_unit.c000066400000000000000000000237071300711361400205010ustar00rootroot00000000000000//**********************************************************************; // Copyright (c) 2016, Intel Corporation // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions are met: // // 1. Redistributions of source code must retain the above copyright notice, // this list of conditions and the following disclaimer. // // 2. Redistributions in binary form must reproduce the above copyright notice, // this list of conditions and the following disclaimer in the documentation // and/or other materials provided with the distribution. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE // ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS // INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN // CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) // ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF // THE POSSIBILITY OF SUCH DAMAGE. //**********************************************************************; #include #include #include #include #include #include #include "rc-decode.h" /* Lookup an error code using the provided function. Assert that the returned * id matches the one that we looked up. * tpm_rc: TPM_RC we're looking up * lookup_func: function to lookup the TPM_RC */ #define LOOKUP_SUCCESS(tpm_rc, lookup_func) \ LOOKUP_EXPECTED_SUCCESS (tpm_rc, tpm_rc, lookup_func); /* Same as LOOKUP_SUCCESS but expect a failure. */ #define LOOKUP_FAILURE(tpm_rc, lookup_func) \ TPM_RC rc = (tpm_rc); \ tpm2_rc_entry_t *entry = NULL; \ entry = (lookup_func)(rc); \ assert_null (entry); /* Lookup TPM_RC and compare to expected value. Assert success condition. * tpm_rc: TPM_RC we're looking up * layer: expected layer * lookup_func: function to lookup the layer from the provided TPM_RC */ #define LOOKUP_EXPECTED_SUCCESS(rc_in, rc_expect, lookup_func) \ TPM_RC rc = (rc_in); \ tpm2_rc_entry_t *entry = NULL; \ entry = (lookup_func)(rc); \ assert_non_null (entry); \ assert_int_equal ((rc_expect), entry->id); /* Check for match in tpm2_tss_base_rc_entry table. */ static void tpm2_rc_entry_tss_base_rc_general (void **state) { LOOKUP_SUCCESS (TSS2_BASE_RC_GENERAL_FAILURE, tpm2_get_tss_base_rc_entry); } static void tpm2_rc_entry_tss_base_rc_insufficient_buffer (void **state) { LOOKUP_SUCCESS (TSS2_BASE_RC_INSUFFICIENT_BUFFER, tpm2_get_tss_base_rc_entry); } /* Check for non-existant error codes in the tpm2_tss_base_rc_entry table */ static void tpm2_rc_entry_tss_base_rc_bad_min (void **state) { LOOKUP_FAILURE (0x0, tpm2_get_tss_base_rc_entry); } static void tpm2_rc_entry_tss_base_rc_bad_max (void **state) { LOOKUP_FAILURE (0xffff, tpm2_get_tss_base_rc_entry); } /* Check for match in tpm2_tss_base_rc_entry with TCTI layer indicator set */ static void tpm2_rc_entry_tss_tcti_rc_general (void **state) { LOOKUP_EXPECTED_SUCCESS (TSS2_TCTI_RC_INSUFFICIENT_BUFFER, TSS2_BASE_RC_INSUFFICIENT_BUFFER, tpm2_get_tss_base_rc_entry); } /* Check for match in tpm2_tss_base_rc_entry with SAPI (aka SYS) layer set */ static void tpm2_rc_entry_tss_sapi_rc_bad_value (void **state) { LOOKUP_EXPECTED_SUCCESS (TSS2_SYS_RC_BAD_VALUE, TSS2_BASE_RC_BAD_VALUE, tpm2_get_tss_base_rc_entry); } /* Check for match in tpm2_position_entry for the first parameter indicator. * NOTE: The parameter indicator is ignored. In reality this should be checked * first. */ static void tpm2_rc_entry_parameter_1 (void **state) { LOOKUP_EXPECTED_SUCCESS (TPM_RC_P + TPM_RC_1, TPM_RC_1, tpm2_get_parameter_entry); } static void tpm2_rc_entry_parameter_a (void **state) { LOOKUP_EXPECTED_SUCCESS (TPM_RC_P + TPM_RC_A, TPM_RC_A, tpm2_get_parameter_entry); } /* same for tpm2_handle_entry */ static void tpm2_rc_entry_handle_3 (void **state) { LOOKUP_EXPECTED_SUCCESS (TPM_RC_H + TPM_RC_3, TPM_RC_3, tpm2_get_handle_entry); } static void tpm2_rc_entry_handle_7 (void **state) { LOOKUP_EXPECTED_SUCCESS (TPM_RC_H + TPM_RC_7, TPM_RC_7, tpm2_get_handle_entry); } /* same for tpm2_session_entry */ static void tpm2_rc_entry_session_2 (void **state) { LOOKUP_EXPECTED_SUCCESS (TPM_RC_H + TPM_RC_2, TPM_RC_2, tpm2_get_session_entry); } static void tpm2_rc_entry_session_5 (void **state) { LOOKUP_EXPECTED_SUCCESS (TPM_RC_H + TPM_RC_5, TPM_RC_5, tpm2_get_session_entry); } /* Check for match in tpm2_tss_layer_entry for the TCTI layer. */ static void tpm2_rc_entry_layer_tcti_from_general_failure (void **state) { LOOKUP_EXPECTED_SUCCESS (TSS2_TCTI_RC_GENERAL_FAILURE, TSS2_TCTI_ERROR_LEVEL, tpm2_get_layer_entry); } static void tpm2_rc_entry_layer_tcti_from_not_permitted (void **state) { LOOKUP_EXPECTED_SUCCESS (TSS2_TCTI_RC_NOT_PERMITTED, TSS2_TCTI_ERROR_LEVEL, tpm2_get_layer_entry); } /* Check for match in tpm2_tss_layer_entry for the SAPI (aka SYS) layer */ static void tpm2_rc_entry_layer_sapi_from_no_encrypt_param (void **state) { LOOKUP_EXPECTED_SUCCESS (TSS2_SYS_RC_NO_ENCRYPT_PARAM, TSS2_SYS_ERROR_LEVEL, tpm2_get_layer_entry); } static void tpm2_rc_entry_layer_sapi_from_bad_tcti_structure (void **state) { LOOKUP_EXPECTED_SUCCESS (TSS2_SYS_RC_BAD_TCTI_STRUCTURE, TSS2_SYS_ERROR_LEVEL, tpm2_get_layer_entry); } /* Part2 error messages generated by SAPI as part of offloading the error * checking. */ static void tpm2_rc_entry_layer_part2_from_all (void **state) { LOOKUP_EXPECTED_SUCCESS (TSS2_SYS_PART2_ERROR_LEVEL | ~(0xff << TSS2_RC_LEVEL_SHIFT), TSS2_SYS_PART2_ERROR_LEVEL, tpm2_get_layer_entry); } /* Lookup layer to identify errors from the TPM */ static void tpm2_rc_entry_layer_tpm (void **state) { LOOKUP_EXPECTED_SUCCESS (TSS2_TPM_ERROR_LEVEL | ~(0xff << TSS2_RC_LEVEL_SHIFT), TSS2_TPM_ERROR_LEVEL, tpm2_get_layer_entry); } /* Lookup non-existant error level */ static void tpm2_rc_entry_layer_bad (void **state) { LOOKUP_FAILURE (~(0x1 << TSS2_RC_LEVEL_SHIFT), tpm2_get_layer_entry); } /* Lookup structures holding data about format0 / VER1 error codes. */ static void tpm2_rc_entry_fmt0_failure (void **state) { LOOKUP_SUCCESS (TPM_RC_FAILURE, tpm2_get_fmt0_entry); } static void tpm2_rc_entry_fmt0_pcr_changed (void **state) { LOOKUP_SUCCESS (TPM_RC_PCR_CHANGED, tpm2_get_fmt0_entry); } /* Check for no match on invalid fmt0 / ver1 error code */ static void tpm2_rc_entry_fmt0_bad (void **state) { LOOKUP_FAILURE (0x023, tpm2_get_fmt0_entry); } /* Lookup structures holding data about format1 / FMT1 error codes. */ static void tpm2_rc_entry_fmt1_hierarchy (void **state) { LOOKUP_SUCCESS (TPM_RC_HIERARCHY, tpm2_get_fmt1_entry); } static void tpm2_rc_entry_fmt1_expired (void **state) { LOOKUP_SUCCESS (TPM_RC_EXPIRED, tpm2_get_fmt1_entry); } static void tpm2_rc_entry_fmt1_bad (void **state) { LOOKUP_FAILURE (0x30, tpm2_get_fmt1_entry); } /* Lookup structures holding data about fmt1 warning error codes. */ static void tpm2_rc_entry_warn_memory (void **state) { LOOKUP_SUCCESS (TPM_RC_MEMORY, tpm2_get_warn_entry); } static void tpm2_rc_entry_warn_reference_s5 (void **state) { LOOKUP_SUCCESS (TPM_RC_REFERENCE_S5, tpm2_get_warn_entry); } static void tpm2_rc_entry_warn_bad (void **state) { LOOKUP_FAILURE (0x17, tpm2_get_warn_entry); } int main (int argc, char *argv[]) { const UnitTest tests[] = { unit_test (tpm2_rc_entry_tss_base_rc_general), unit_test (tpm2_rc_entry_tss_base_rc_insufficient_buffer), unit_test (tpm2_rc_entry_tss_base_rc_bad_min), unit_test (tpm2_rc_entry_tss_base_rc_bad_max), unit_test (tpm2_rc_entry_tss_tcti_rc_general), unit_test (tpm2_rc_entry_tss_sapi_rc_bad_value), unit_test (tpm2_rc_entry_parameter_1), unit_test (tpm2_rc_entry_parameter_a), unit_test (tpm2_rc_entry_handle_3), unit_test (tpm2_rc_entry_handle_7), unit_test (tpm2_rc_entry_session_2), unit_test (tpm2_rc_entry_session_5), unit_test (tpm2_rc_entry_layer_tcti_from_general_failure), unit_test (tpm2_rc_entry_layer_tcti_from_not_permitted), unit_test (tpm2_rc_entry_layer_sapi_from_no_encrypt_param), unit_test (tpm2_rc_entry_layer_sapi_from_bad_tcti_structure), unit_test (tpm2_rc_entry_layer_part2_from_all), unit_test (tpm2_rc_entry_layer_tpm), unit_test (tpm2_rc_entry_layer_bad), unit_test (tpm2_rc_entry_fmt0_failure), unit_test (tpm2_rc_entry_fmt0_pcr_changed), unit_test (tpm2_rc_entry_fmt0_bad), unit_test (tpm2_rc_entry_fmt1_hierarchy), unit_test (tpm2_rc_entry_fmt1_expired), unit_test (tpm2_rc_entry_fmt1_bad), unit_test (tpm2_rc_entry_warn_memory), unit_test (tpm2_rc_entry_warn_reference_s5), unit_test (tpm2_rc_entry_warn_bad), }; return run_tests (tests); }