~ubuntu-branches/ubuntu/hardy/trousers/hardy-proposed

Viewing changes to src/tspi/tspi_delegate.c

Committer: Bazaar Package Importer
Author(s): Daniel Baumann
Date: 2008-01-23 22:03:00 UTC
mfrom: (1.1.1 upstream)
Revision ID: james.westby@ubuntu.com-20080123220300-fhtqja3c0oq0gp6z

Tags: 0.3.1-4

http://bugs.debian.org/457400

http://bugs.debian.org/459682

* Added patch from Aaron M. Ucko <ucko@debian.org> to allow trousers to
  build successfully on amd64, and presumably also other 64-bit
  architectures (Closes: #457400).
* Including udev rule for /dev/tpm from William Lima
  <wlima.amadeus@gmail.com> as suggested by David Smith <dds@google.com>
  (Closes: #459682).
* Added lintian overrides.

files added:
debian/TODO

debian/config

debian/config/45-trousers.rules

debian/libtspi-dev.docs

debian/lintian

debian/lintian/libtspi1

debian/lintian/trousers

debian/patches/01-tss-user.dpatch

debian/patches/02-manapge.dpatch

debian/patches/03-readme.dpatch

debian/patches/04-64bit-cleanliness.dpatch

debian/trousers.examples

man/man3/Tspi_Context_GetRegisteredKeysByUUID2.3

man/man3/Tspi_DAA_IssueCredential.3

man/man3/Tspi_DAA_IssueInit.3

man/man3/Tspi_DAA_IssueSetup.3

man/man3/Tspi_DAA_IssuerKeyVerification.3

man/man3/Tspi_DAA_VerifyInit.3

man/man3/Tspi_DAA_VerifySignature.3

man/man3/Tspi_DecodeBER_TssBlob.3

man/man3/Tspi_EncodeDER_TssBlob.3

man/man3/Tspi_TPM_DAA_JoinCreateDaaPubKey.3

man/man3/Tspi_TPM_DAA_JoinInit.3

man/man3/Tspi_TPM_DAA_JoinStoreCredential.3

man/man3/Tspi_TPM_DAA_Sign.3

man/man3/Tspi_TPM_GetAuditDigest.3

man/man3/Tspi_TPM_OwnerGetSRKPubKey.3

man/man3/Tspi_TPM_Quote2.3

src/include/authsess.h

src/include/obj_context.h

src/include/obj_daa.h

src/include/obj_delfamily.h

src/include/obj_encdata.h

src/include/obj_hash.h

src/include/obj_migdata.h

src/include/obj_nv.h

src/include/obj_pcrs.h

src/include/obj_policy.h

src/include/obj_rsakey.h

src/include/obj_tpm.h

src/include/rpc_tcstp.h

src/include/rpc_tcstp_tcs.h

src/include/rpc_tcstp_tsp.h

src/include/tcs_aik.h

src/include/tcs_context.h

src/include/tcs_key_ps.h

src/include/threads.h

src/include/tsp_audit.h

src/include/tsp_delegate.h

src/include/tsp_seal.h

src/include/tss/TSP.idl

src/include/tss/compat11b.h

src/include/tss/tcs.h

src/include/tss/tcs_defines.h

src/include/tss/tpm.h

src/include/tss/tpm_error.h

src/include/tss/tpm_ordinal.h

src/tcs/crypto

src/tcs/crypto/openssl

src/tcs/crypto/openssl/crypto.c

src/tcs/rpc

src/tcs/rpc/tcstp

src/tcs/rpc/tcstp/rpc.c

src/tcs/rpc/tcstp/rpc_admin.c

src/tcs/rpc/tcstp/rpc_aik.c

src/tcs/rpc/tcstp/rpc_audit.c

src/tcs/rpc/tcstp/rpc_auth.c

src/tcs/rpc/tcstp/rpc_bind.c

src/tcs/rpc/tcstp/rpc_caps.c

src/tcs/rpc/tcstp/rpc_caps_tpm.c

src/tcs/rpc/tcstp/rpc_certify.c

src/tcs/rpc/tcstp/rpc_changeauth.c

src/tcs/rpc/tcstp/rpc_cmk.c

src/tcs/rpc/tcstp/rpc_context.c

src/tcs/rpc/tcstp/rpc_counter.c

src/tcs/rpc/tcstp/rpc_daa.c

src/tcs/rpc/tcstp/rpc_delegate.c

src/tcs/rpc/tcstp/rpc_dir.c

src/tcs/rpc/tcstp/rpc_ek.c

src/tcs/rpc/tcstp/rpc_evlog.c

src/tcs/rpc/tcstp/rpc_key.c

src/tcs/rpc/tcstp/rpc_maint.c

src/tcs/rpc/tcstp/rpc_migration.c

src/tcs/rpc/tcstp/rpc_nv.c

src/tcs/rpc/tcstp/rpc_oper.c

src/tcs/rpc/tcstp/rpc_own.c

src/tcs/rpc/tcstp/rpc_pcr_extend.c

src/tcs/rpc/tcstp/rpc_ps.c

src/tcs/rpc/tcstp/rpc_quote.c

src/tcs/rpc/tcstp/rpc_quote2.c

src/tcs/rpc/tcstp/rpc_random.c

src/tcs/rpc/tcstp/rpc_seal.c

src/tcs/rpc/tcstp/rpc_selftest.c

src/tcs/rpc/tcstp/rpc_sign.c

src/tcs/rpc/tcstp/rpc_tick.c

src/tcs/rpc/tcstp/rpc_transport.c

src/tcs/tcs_aik.c

src/tcs/tcs_auth_mgr.c

src/tcs/tcs_caps.c

src/tcs/tcs_context.c

src/tcs/tcs_context_key.c

src/tcs/tcs_counter.c

src/tcs/tcs_evlog.c

src/tcs/tcs_evlog_biosem.c

src/tcs/tcs_evlog_imaem.c

src/tcs/tcs_key.c

src/tcs/tcs_key_mem_cache.c

src/tcs/tcs_key_ps.c

src/tcs/tcs_migration.c

src/tcs/tcs_pbg.c

src/tcs/tcs_ps.c

src/tcs/tcs_quote.c

src/tcs/tcs_quote2.c

src/tcs/tcs_req_mgr.c

src/tcs/tcs_seal.c

src/tcs/tcsi_admin.c

src/tcs/tcsi_aik.c

src/tcs/tcsi_audit.c

src/tcs/tcsi_auth.c

src/tcs/tcsi_bind.c

src/tcs/tcsi_caps.c

src/tcs/tcsi_caps_tpm.c

src/tcs/tcsi_certify.c

src/tcs/tcsi_changeauth.c

src/tcs/tcsi_cmk.c

src/tcs/tcsi_context.c

src/tcs/tcsi_counter.c

src/tcs/tcsi_daa.c

src/tcs/tcsi_delegate.c

src/tcs/tcsi_dir.c

src/tcs/tcsi_ek.c

src/tcs/tcsi_evlog.c

src/tcs/tcsi_key.c

src/tcs/tcsi_maint.c

src/tcs/tcsi_migration.c

src/tcs/tcsi_nv.c

src/tcs/tcsi_oper.c

src/tcs/tcsi_own.c

src/tcs/tcsi_pcr.c

src/tcs/tcsi_ps.c

src/tcs/tcsi_quote.c

src/tcs/tcsi_quote2.c

src/tcs/tcsi_random.c

src/tcs/tcsi_seal.c

src/tcs/tcsi_selftest.c

src/tcs/tcsi_sign.c

src/tcs/tcsi_tick.c

src/tcs/tcsi_transport.c

src/trspi/crypto/openssl/hash.c

src/trspi/crypto/openssl/rsa.c

src/trspi/crypto/openssl/symmetric.c

src/tspi/obj_daa.c

src/tspi/obj_delfamily.c

src/tspi/obj_migdata.c

src/tspi/obj_nv.c

src/tspi/rpc

src/tspi/rpc/hosttable.c

src/tspi/rpc/tcs_api.c

src/tspi/rpc/tcstp

src/tspi/rpc/tcstp/rpc.c

src/tspi/rpc/tcstp/rpc_admin.c

src/tspi/rpc/tcstp/rpc_aik.c

src/tspi/rpc/tcstp/rpc_audit.c

src/tspi/rpc/tcstp/rpc_auth.c

src/tspi/rpc/tcstp/rpc_bind.c

src/tspi/rpc/tcstp/rpc_caps.c

src/tspi/rpc/tcstp/rpc_caps_tpm.c

src/tspi/rpc/tcstp/rpc_certify.c

src/tspi/rpc/tcstp/rpc_changeauth.c

src/tspi/rpc/tcstp/rpc_cmk.c

src/tspi/rpc/tcstp/rpc_context.c

src/tspi/rpc/tcstp/rpc_counter.c

src/tspi/rpc/tcstp/rpc_daa.c

src/tspi/rpc/tcstp/rpc_delegate.c

src/tspi/rpc/tcstp/rpc_dir.c

src/tspi/rpc/tcstp/rpc_ek.c

src/tspi/rpc/tcstp/rpc_evlog.c

src/tspi/rpc/tcstp/rpc_key.c

src/tspi/rpc/tcstp/rpc_maint.c

src/tspi/rpc/tcstp/rpc_migration.c

src/tspi/rpc/tcstp/rpc_nv.c

src/tspi/rpc/tcstp/rpc_oper.c

src/tspi/rpc/tcstp/rpc_own.c

src/tspi/rpc/tcstp/rpc_pcr_extend.c

src/tspi/rpc/tcstp/rpc_ps.c

src/tspi/rpc/tcstp/rpc_quote.c

src/tspi/rpc/tcstp/rpc_quote2.c

src/tspi/rpc/tcstp/rpc_random.c

src/tspi/rpc/tcstp/rpc_seal.c

src/tspi/rpc/tcstp/rpc_selftest.c

src/tspi/rpc/tcstp/rpc_sign.c

src/tspi/rpc/tcstp/rpc_tick.c

src/tspi/rpc/tcstp/rpc_transport.c

src/tspi/tsp_admin.c

src/tspi/tsp_aik.c

src/tspi/tsp_asym.c

src/tspi/tsp_audit.c

src/tspi/tsp_auth.c

src/tspi/tsp_bind.c

src/tspi/tsp_caps.c

src/tspi/tsp_caps_tpm.c

src/tspi/tsp_certify.c

src/tspi/tsp_changeauth.c

src/tspi/tsp_context_mem.c

src/tspi/tsp_counter.c

src/tspi/tsp_daa.c

src/tspi/tsp_delegate.c

src/tspi/tsp_dir.c

src/tspi/tsp_ek.c

src/tspi/tsp_get_flags.c

src/tspi/tsp_key.c

src/tspi/tsp_maint.c

src/tspi/tsp_migration.c

src/tspi/tsp_nv.c

src/tspi/tsp_oper.c

src/tspi/tsp_own.c

src/tspi/tsp_pcr.c

src/tspi/tsp_pcr_extend.c

src/tspi/tsp_policy.c

src/tspi/tsp_ps.c

src/tspi/tsp_quote.c

src/tspi/tsp_quote2.c

src/tspi/tsp_random.c

src/tspi/tsp_seal.c

src/tspi/tsp_selftest.c

src/tspi/tsp_sign.c

src/tspi/tsp_tick.c

src/tspi/tsp_transport.c

src/tspi/tspi_admin.c

src/tspi/tspi_aik.c

src/tspi/tspi_asn1.c

src/tspi/tspi_audit.c

src/tspi/tspi_bind.c

src/tspi/tspi_caps.c

src/tspi/tspi_caps_tpm.c

src/tspi/tspi_certify.c

src/tspi/tspi_changeauth.c

src/tspi/tspi_cmk.c

src/tspi/tspi_context.c

src/tspi/tspi_counter.c

src/tspi/tspi_daa.c

src/tspi/tspi_delegate.c

src/tspi/tspi_dir.c

src/tspi/tspi_ek.c

src/tspi/tspi_getset.c

src/tspi/tspi_hash.c

src/tspi/tspi_key.c

src/tspi/tspi_maint.c

src/tspi/tspi_migration.c

src/tspi/tspi_nv.c

src/tspi/tspi_oper.c

src/tspi/tspi_own.c

src/tspi/tspi_pcr_comp.c

src/tspi/tspi_pcr_comp12.c

src/tspi/tspi_pcr_events.c

src/tspi/tspi_pcr_extend.c

src/tspi/tspi_policy.c

src/tspi/tspi_ps.c

src/tspi/tspi_quote.c

src/tspi/tspi_quote2.c

src/tspi/tspi_random.c

src/tspi/tspi_seal.c

src/tspi/tspi_selftest.c

src/tspi/tspi_sign.c

src/tspi/tspi_tick.c

src/tspi/tspi_transport.c

files removed:
autom4te.cache

autom4te.cache/output.0

autom4te.cache/output.1

autom4te.cache/requests

autom4te.cache/traces.0

autom4te.cache/traces.1

debian/45-trousers.rules

debian/patches/01_makefiles.diff

debian/patches/01_makefiles.dpatch

debian/patches/02_defaultgroup__tcsd.dpatch

debian/trousers.README.Debian

debian/trousers.default

debian/trousers.dirs

debian/watch

src/include/spi_internal_types.h

src/include/tcs_internal_types.h

src/include/trpctp.h

src/tcs/auth_mgr.c

src/tcs/biosem.c

src/tcs/cache.c

src/tcs/cxt.c

src/tcs/imaem.c

src/tcs/req_mgr.c

src/tcs/tcscm.c

src/tcs/tcsem.c

src/tcs/tcskcm.c

src/tcs/tcspbg.c

src/tcsd/tcsd_wrap.c

src/tcsd_api

src/tcsd_api/calltcsapi.c

src/tcsd_api/clntside.c

src/tcsd_api/hosttable.c

src/tcsd_api/tcstp.c

src/trspi/crypto/openssl/crypto.c

src/tspi/keyreg.c

src/tspi/memmgr.c

src/tspi/secrets.c

src/tspi/spi_context.c

src/tspi/spi_data.c

src/tspi/spi_getset.c

src/tspi/spi_hash.c

src/tspi/spi_key.c

src/tspi/spi_pcr.c

src/tspi/spi_policy.c

src/tspi/spi_tpm.c

files modified:
AUTHORS

ChangeLog

Makefile.in

README

config.guess

config.sub

configure

configure.in

debian/changelog

debian/control

debian/copyright

debian/libtspi-dev.install

debian/libtspi1.install

debian/patches/00list

debian/rules

debian/trousers.docs

debian/trousers.init

debian/trousers.install

debian/trousers.postinst

debian/trousers.postrm

dist/Makefile.in

dist/tcsd.conf.in

man/Makefile.in

man/man3/Makefile.am

man/man3/Makefile.in

man/man3/Tspi_Context_LoadKeyByUUID.3

man/man3/Tspi_TPM_GetPubEndorsementKey.3

man/man5/Makefile.in

man/man5/tcsd.conf.5.in

man/man8/Makefile.in

src/Makefile.in

src/include/Makefile.am

src/include/Makefile.in

src/include/auth_mgr.h

src/include/capabilities.h

src/include/hosttable.h

src/include/memmgr.h

src/include/obj.h

src/include/req_mgr.h

src/include/spi_utils.h

src/include/tcs_tsp.h

src/include/tcs_utils.h

src/include/tcsd.h

src/include/tcsd_ops.h

src/include/tcsd_wrap.h

src/include/tcsem.h

src/include/tcslog.h

src/include/tcsps.h

src/include/trousers/trousers.h

src/include/trousers/tss.h

src/include/trousers_types.h

src/include/tspps.h

src/include/tss/platform.h

src/include/tss/tcpa_defines.h

src/include/tss/tcpa_error.h

src/include/tss/tcpa_struct.h

src/include/tss/tcpa_typedef.h

src/include/tss/tcs_error.h

src/include/tss/tcs_structs.h

src/include/tss/tcs_typedef.h

src/include/tss/tddl_error.h

src/include/tss/tddlapi_error.h

src/include/tss/tddli.h

src/include/tss/tspi.h

src/include/tss/tss_defines.h

src/include/tss/tss_error.h

src/include/tss/tss_error_basics.h

src/include/tss/tss_structs.h

src/include/tss/tss_typedef.h

src/tcs/Makefile.am

src/tcs/Makefile.in

src/tcs/ps/ps_utils.c

src/tcs/ps/tcsps.c

src/tcs/tcs_utils.c

src/tcsd/Makefile.am

src/tcsd/Makefile.in

src/tcsd/platform.c

src/tcsd/svrside.c

src/tcsd/tcsd_conf.c

src/tcsd/tcsd_threads.c

src/tddl/Makefile.am

src/tddl/Makefile.in

src/trspi/Makefile.am

src/trspi/Makefile.in

src/trspi/trousers.c

src/tspi/Makefile.am

src/tspi/Makefile.in

src/tspi/obj.c

src/tspi/obj_context.c

src/tspi/obj_encdata.c

src/tspi/obj_hash.c

src/tspi/obj_pcrs.c

src/tspi/obj_policy.c

src/tspi/obj_rsakey.c

src/tspi/obj_tpm.c

src/tspi/ps/tspps.c

src/tspi/spi_utils.c

tools/Makefile.in

tools/ps_inspect.c

Show diffs side-by-side

added added

removed removed

src/tspi/tspi_delegate.c

* Licensed Materials - Property of IBM

* trousers - An open source TCG Software Stack

* (C) Copyright International Business Machines Corp. 2007

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

#include <inttypes.h>

#include "trousers/tss.h"

#include "trousers/trousers.h"

#include "trousers_types.h"

#include "spi_utils.h"

#include "obj.h"

#include "tsp_delegate.h"

#include "tsplog.h"

TSS_RESULT

Tspi_TPM_Delegate_AddFamily(TSS_HTPM hTpm, /* in, must not be NULL */

BYTE bLabel, /* in */

TSS_HDELFAMILY* phFamily) /* out */

{

TPM_FAMILY_ID familyID = 0;

UINT32 outDataSize;

BYTE *outData = NULL;

UINT64 offset;

TSS_RESULT result;

if (phFamily == NULL)

return TSPERR(TSS_E_BAD_PARAMETER);

*phFamily = NULL_HDELFAMILY;

if ((result = do_delegate_manage(hTpm, familyID, TPM_FAMILY_CREATE, sizeof(bLabel), &bLabel,

&outDataSize, &outData)))

return result;

offset = 0;

Trspi_UnloadBlob_UINT32(&offset, &familyID, outData);

/* Create or update the delfamily object */

if ((result = update_delfamily_object(hTpm, familyID)))

goto done;

obj_delfamily_find_by_familyid(hTpm, familyID, phFamily);

if (*phFamily == NULL_HDELFAMILY)

result = TSPERR(TSS_E_INTERNAL_ERROR);

done:

free(outData);

return result;

}

TSS_RESULT

Tspi_TPM_Delegate_GetFamily(TSS_HTPM hTpm, /* in, must not NULL */

UINT32 ulFamilyID, /* in */

TSS_HDELFAMILY* phFamily) /* out */

{

TSS_RESULT result;

if (phFamily == NULL)

return TSPERR(TSS_E_BAD_PARAMETER);

*phFamily = NULL_HDELFAMILY;

/* Update the delfamily object */

if ((result = update_delfamily_object(hTpm, ulFamilyID)))

return result;

obj_delfamily_find_by_familyid(hTpm, ulFamilyID, phFamily);

if (*phFamily == NULL_HDELFAMILY)

result = TSPERR(TSS_E_BAD_PARAMETER);

return result;

}

TSS_RESULT

Tspi_TPM_Delegate_InvalidateFamily(TSS_HTPM hTpm, /* in, must not be NULL */

TSS_HDELFAMILY hFamily) /* in */

{

TPM_FAMILY_ID familyID;

UINT32 outDataSize;

BYTE *outData = NULL;

TSS_RESULT result;

if ((result = obj_delfamily_get_familyid(hFamily, &familyID)))

return result;

if ((result = do_delegate_manage(hTpm, familyID, TPM_FAMILY_INVALIDATE, 0, NULL,

&outDataSize, &outData)))

return result;

100

/* Delete the delfamily object */

101

result = obj_delfamily_remove(hFamily, hTpm);

102

103

free(outData);

104

105

return result;

106

}

107

108

TSS_RESULT

109

Tspi_TPM_Delegate_CreateDelegation(TSS_HOBJECT hObject, /* in */

110

BYTE bLabel, /* in */

111

UINT32 ulFlags, /* in */

112

TSS_HPCRS hPcrs, /* in */

113

TSS_HDELFAMILY hFamily, /* in */

114

TSS_HPOLICY hDelegation) /* in, out */

115

{

116

TSS_RESULT result;

117

118

if (obj_is_tpm(hObject)) {

119

if ((result = create_owner_delegation(hObject, bLabel, ulFlags, hPcrs, hFamily,

120

hDelegation)))

121

return result;

122

} else if (obj_is_rsakey(hObject)) {

123

if ((result = create_key_delegation(hObject, bLabel, ulFlags, hPcrs, hFamily,

124

hDelegation)))

125

return result;

126

} else

127

return TSPERR(TSS_E_INVALID_HANDLE);

128

129

return TSS_SUCCESS;

130

}

131

132

TSS_RESULT

133

Tspi_TPM_Delegate_CacheOwnerDelegation(TSS_HTPM hTpm, /* in */

134

TSS_HPOLICY hDelegation, /* in */

135

UINT32 ulIndex, /* in */

136

UINT32 ulFlags) /* in */

137

{

138

TSS_HCONTEXT hContext;

139

TSS_HPOLICY hPolicy;

140

UINT32 blobSize;

141

BYTE *blob = NULL;

142

UINT32 secretMode = TSS_SECRET_MODE_NONE;

143

Trspi_HashCtx hashCtx;

144

TCPA_DIGEST digest;

145

TPM_AUTH ownerAuth, *pAuth;

146

TSS_RESULT result;

147

148

if ((result = obj_tpm_get_tsp_context(hTpm, &hContext)))

149

return result;

150

151

if ((result = obj_tpm_get_policy(hTpm, TSS_POLICY_USAGE, &hPolicy)))

152

return result;

153

154

if ((result = obj_policy_get_delegation_blob(hDelegation, TSS_DELEGATIONTYPE_OWNER,

155

&blobSize, &blob)))

156

return result;

157

158

if (ulFlags & ~TSS_DELEGATE_CACHEOWNERDELEGATION_OVERWRITEEXISTING) {

159

result = TSPERR(TSS_E_BAD_PARAMETER);

160

goto done;

161

}

162

163

if ((ulFlags & TSS_DELEGATE_CACHEOWNERDELEGATION_OVERWRITEEXISTING) == 0) {

164

TPM_DELEGATE_PUBLIC public;

165

166

/* Verify there is nothing occupying the specified row */

167

result = get_delegate_index(hContext, ulIndex, &public);

168

if (result == TSS_SUCCESS) {

169

free(public.pcrInfo.pcrSelection.pcrSelect);

170

result = TSPERR(TSS_E_DELFAMILY_ROWEXISTS);

171

goto done;

172

}

173

}

174

175

if (hPolicy != NULL_HPOLICY) {

176

if ((result = obj_policy_get_mode(hPolicy, &secretMode)))

177

goto done;

178

}

179

180

if (secretMode != TSS_SECRET_MODE_NONE) {

181

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

182

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_Delegate_LoadOwnerDelegation);

183

result |= Trspi_Hash_UINT32(&hashCtx, ulIndex);

184

result |= Trspi_Hash_UINT32(&hashCtx, blobSize);

185

result |= Trspi_HashUpdate(&hashCtx, blobSize, blob);

186

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

187

goto done;

188

189

pAuth = &ownerAuth;

190

if ((result = secret_PerformAuth_OIAP(hTpm, TPM_ORD_Delegate_LoadOwnerDelegation,

191

hPolicy, FALSE, &digest, pAuth)))

192

goto done;

193

} else

194

pAuth = NULL;

195

196

if ((result = TCS_API(hContext)->Delegate_LoadOwnerDelegation(hContext, ulIndex, blobSize,

197

blob, pAuth)))

198

goto done;

199

200

if (pAuth) {

201

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

202

result |= Trspi_Hash_UINT32(&hashCtx, result);

203

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_Delegate_LoadOwnerDelegation);

204

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

205

goto done;

206

207

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, pAuth)))

208

goto done;

209

}

210

211

result = obj_policy_set_delegation_index(hDelegation, ulIndex);

212

213

done:

214

free_tspi(hContext, blob);

215

216

return result;

217

}

218

219

TSS_RESULT

220

Tspi_TPM_Delegate_UpdateVerificationCount(TSS_HTPM hTpm, /* in */

221

TSS_HPOLICY hDelegation) /* in, out */

222

{

223

TSS_HCONTEXT hContext;

224

TSS_HPOLICY hPolicy;

225

UINT32 secretMode = TSS_SECRET_MODE_NONE;

226

Trspi_HashCtx hashCtx;

227

TCPA_DIGEST digest;

228

TPM_AUTH ownerAuth, *pAuth;

229

TSS_BOOL indexSet;

230

UINT32 inputSize;

231

BYTE *input = NULL;

232

UINT32 outputSize;

233

BYTE *output = NULL;

234

UINT64 offset;

235

TSS_RESULT result;

236

237

if ((result = obj_tpm_get_tsp_context(hTpm, &hContext)))

238

return result;

239

240

if ((result = obj_tpm_get_policy(hTpm, TSS_POLICY_USAGE, &hPolicy)))

241

return result;

242

243

if (hPolicy != NULL_HPOLICY) {

244

if ((result = obj_policy_get_mode(hPolicy, &secretMode)))

245

goto done;

246

}

247

248

if ((result = obj_policy_is_delegation_index_set(hDelegation, &indexSet)))

249

return result;

250

if (indexSet) {

251

UINT32 index;

252

253

if ((result = obj_policy_get_delegation_index(hDelegation, &index)))

254

return result;

255

inputSize = sizeof(UINT32);

256

input = calloc_tspi(hContext, inputSize);

257

if (!input) {

258

LogError("malloc of %zd bytes failed.", sizeof(UINT32));

259

return TSPERR(TSS_E_OUTOFMEMORY);

260

}

261

offset = 0;

262

Trspi_LoadBlob_UINT32(&offset, index, input);

263

} else {

264

if ((result = obj_policy_get_delegation_blob(hDelegation, 0,

265

&inputSize, &input)))

266

return result;

267

}

268

269

if (secretMode != TSS_SECRET_MODE_NONE) {

270

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

271

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_Delegate_UpdateVerification);

272

result |= Trspi_Hash_UINT32(&hashCtx, inputSize);

273

result |= Trspi_HashUpdate(&hashCtx, inputSize, input);

274

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

275

goto done;

276

277

pAuth = &ownerAuth;

278

if ((result = secret_PerformAuth_OIAP(hTpm, TPM_ORD_Delegate_UpdateVerification,

279

hPolicy, FALSE, &digest, pAuth)))

280

goto done;

281

} else

282

pAuth = NULL;

283

284

if ((result = TCS_API(hContext)->Delegate_UpdateVerificationCount(hContext, inputSize,

285

input, pAuth, &outputSize,

286

&output)))

287

goto done;

288

289

if (pAuth) {

290

result = Trspi_HashInit(&hashCtx, TSS_HASH_SHA1);

291

result |= Trspi_Hash_UINT32(&hashCtx, result);

292

result |= Trspi_Hash_UINT32(&hashCtx, TPM_ORD_Delegate_UpdateVerification);

293

result |= Trspi_Hash_UINT32(&hashCtx, outputSize);

294

result |= Trspi_HashUpdate(&hashCtx, outputSize, output);

295

if ((result |= Trspi_HashFinal(&hashCtx, digest.digest)))

296

goto done;

297

298

if ((result = obj_policy_validate_auth_oiap(hPolicy, &digest, pAuth)))

299

goto done;

300

}

301

302

result = obj_policy_set_delegation_blob(hDelegation, 0, outputSize, output);

303

304

done:

305

free_tspi(hContext, input);

306

free(output);

307

308

return result;

309

}

310

311

TSS_RESULT

312

Tspi_TPM_Delegate_VerifyDelegation(TSS_HPOLICY hDelegation) /* in, out */

313

{

314

TSS_HCONTEXT hContext;

315

UINT32 delegateSize;

316

BYTE *delegate = NULL;

317

TSS_RESULT result;

318

319

if ((result = obj_policy_get_tsp_context(hDelegation, &hContext)))

320

return result;

321

322

if ((result = obj_policy_get_delegation_blob(hDelegation, 0, &delegateSize, &delegate)))

323

return result;

324

325

result = TCS_API(hContext)->Delegate_VerifyDelegation(hContext, delegateSize, delegate);

326

327

free_tspi(hContext, delegate);

328

329

return result;

330

}

331

332

TSS_RESULT

333

Tspi_TPM_Delegate_ReadTables(TSS_HCONTEXT hContext, /* in */

334

UINT32* pulFamilyTableSize, /* out */

335

TSS_FAMILY_TABLE_ENTRY** ppFamilyTable, /* out */

336

UINT32* pulDelegateTableSize, /* out */

337

TSS_DELEGATION_TABLE_ENTRY** ppDelegateTable) /* out */

338

{

339

UINT32 tpmFamilyTableSize, tpmDelegateTableSize;

340

BYTE *tpmFamilyTable = NULL, *tpmDelegateTable = NULL;

341

TPM_FAMILY_TABLE_ENTRY tpmFamilyEntry;

342

TSS_FAMILY_TABLE_ENTRY tssFamilyEntry, *tssFamilyTable = NULL;

343

UINT32 tssFamilyTableSize = 0;

344

TPM_DELEGATE_PUBLIC tpmDelegatePublic;

345

TSS_DELEGATION_TABLE_ENTRY tssDelegateEntry, *tssDelegateTable = NULL;

346

UINT32 tssDelegateTableSize = 0;

347

UINT32 tableIndex;

348

UINT64 tpmOffset;

349

UINT64 tssOffset;

350

TSS_RESULT result;

351

352

if (!pulFamilyTableSize || !ppFamilyTable || !pulDelegateTableSize || !ppDelegateTable)

353

return TSPERR(TSS_E_BAD_PARAMETER);

354

355

if (!obj_is_context(hContext))

356

return TSPERR(TSS_E_INVALID_HANDLE);

357

358

if ((result = TCS_API(hContext)->Delegate_ReadTable(hContext, &tpmFamilyTableSize,

359

&tpmFamilyTable, &tpmDelegateTableSize,

360

&tpmDelegateTable)))

361

return result;

362

363

if (tpmFamilyTableSize > 0) {

364

/* Create the TSS_FAMILY_TABLE_ENTRY array */

365

for (tpmOffset = 0, tssOffset = 0; tpmOffset < tpmFamilyTableSize;) {

366

Trspi_UnloadBlob_TPM_FAMILY_TABLE_ENTRY(&tpmOffset, tpmFamilyTable,

367

&tpmFamilyEntry);

368

369

/* No pointers in the family table entries, so no

370

assignments required before doing LoadBlob */

371

Trspi_LoadBlob_TSS_FAMILY_TABLE_ENTRY(&tssOffset, NULL, &tssFamilyEntry);

372

}

373

374

if ((tssFamilyTable = calloc_tspi(hContext, tssOffset)) == NULL) {

375

LogError("malloc of %" PRIu64 " bytes failed.", tssOffset);

376

result = TSPERR(TSS_E_OUTOFMEMORY);

377

goto done;

378

}

379

for (tpmOffset = 0, tssOffset = 0; tpmOffset < tpmFamilyTableSize; tssFamilyTableSize++) {

380

Trspi_UnloadBlob_TPM_FAMILY_TABLE_ENTRY(&tpmOffset, tpmFamilyTable,

381

&tpmFamilyEntry);

382

383

tssFamilyEntry.familyID = tpmFamilyEntry.familyID;

384

tssFamilyEntry.label = tpmFamilyEntry.label.label;

385

tssFamilyEntry.verificationCount = tpmFamilyEntry.verificationCount;

386

tssFamilyEntry.enabled =

387

(tpmFamilyEntry.flags & TPM_FAMFLAG_ENABLE) ? TRUE : FALSE;

388

tssFamilyEntry.locked =

389

(tpmFamilyEntry.flags & TPM_FAMFLAG_DELEGATE_ADMIN_LOCK) ? TRUE : FALSE;

390

Trspi_LoadBlob_TSS_FAMILY_TABLE_ENTRY(&tssOffset, (BYTE *)tssFamilyTable,

391

&tssFamilyEntry);

392

}

393

}

394

395

if (tpmDelegateTableSize > 0) {

396

/* Create the TSS_DELEGATION_TABLE_ENTRY array */

397

for (tpmOffset = 0, tssOffset = 0; tpmOffset < tpmDelegateTableSize;) {

398

Trspi_UnloadBlob_UINT32(&tpmOffset, &tableIndex, tpmDelegateTable);

399

if ((result = Trspi_UnloadBlob_TPM_DELEGATE_PUBLIC(&tpmOffset, tpmDelegateTable,

400

&tpmDelegatePublic))) {

401

free_tspi(hContext, tssFamilyTable);

402

goto done;

403

}

404

405

/* Some pointers in the delegate table entries, so

406

do some assignments before doing LoadBlob */

407

tssDelegateEntry.pcrInfo.sizeOfSelect =

408

tpmDelegatePublic.pcrInfo.pcrSelection.sizeOfSelect;

409

tssDelegateEntry.pcrInfo.selection =

410

tpmDelegatePublic.pcrInfo.pcrSelection.pcrSelect;

411

tssDelegateEntry.pcrInfo.sizeOfDigestAtRelease =

412

sizeof(tpmDelegatePublic.pcrInfo.digestAtRelease.digest);

413

tssDelegateEntry.pcrInfo.digestAtRelease =

414

tpmDelegatePublic.pcrInfo.digestAtRelease.digest;

415

Trspi_LoadBlob_TSS_DELEGATION_TABLE_ENTRY(&tssOffset, NULL,

416

&tssDelegateEntry);

417

418

free(tpmDelegatePublic.pcrInfo.pcrSelection.pcrSelect);

419

}

420

421

if ((tssDelegateTable = calloc_tspi(hContext, tssOffset)) == NULL) {

422

LogError("malloc of %" PRIu64 " bytes failed.", tssOffset);

423

free_tspi(hContext, tssFamilyTable);

424

result = TSPERR(TSS_E_OUTOFMEMORY);

425

goto done;

426

}

427

for (tpmOffset = 0, tssOffset = 0; tpmOffset < tpmDelegateTableSize; tssDelegateTableSize++) {

428

Trspi_UnloadBlob_UINT32(&tpmOffset, &tableIndex, tpmDelegateTable);

429

if ((result = Trspi_UnloadBlob_TPM_DELEGATE_PUBLIC(&tpmOffset,

430

tpmDelegateTable, &tpmDelegatePublic))) {

431

free_tspi(hContext, tssFamilyTable);

432

free_tspi(hContext, tssDelegateTable);

433

goto done;

434

}

435

436

tssDelegateEntry.tableIndex = tableIndex;

437

tssDelegateEntry.label = tpmDelegatePublic.label.label;

438

tssDelegateEntry.pcrInfo.sizeOfSelect =

439

tpmDelegatePublic.pcrInfo.pcrSelection.sizeOfSelect;

440

tssDelegateEntry.pcrInfo.selection =

441

tpmDelegatePublic.pcrInfo.pcrSelection.pcrSelect;

442

tssDelegateEntry.pcrInfo.localityAtRelease =

443

tpmDelegatePublic.pcrInfo.localityAtRelease;

444

tssDelegateEntry.pcrInfo.sizeOfDigestAtRelease =

445

sizeof(tpmDelegatePublic.pcrInfo.digestAtRelease.digest);

446

tssDelegateEntry.pcrInfo.digestAtRelease =

447

tpmDelegatePublic.pcrInfo.digestAtRelease.digest;

448

tssDelegateEntry.per1 = tpmDelegatePublic.permissions.per1;

449

tssDelegateEntry.per2 = tpmDelegatePublic.permissions.per2;

450

tssDelegateEntry.familyID = tpmDelegatePublic.familyID;

451

tssDelegateEntry.verificationCount = tpmDelegatePublic.verificationCount;

452

Trspi_LoadBlob_TSS_DELEGATION_TABLE_ENTRY(&tssOffset,

453

(BYTE *)tssDelegateTable, &tssDelegateEntry);

454

455

free(tpmDelegatePublic.pcrInfo.pcrSelection.pcrSelect);

456

}

457

}

458

459

*ppFamilyTable = tssFamilyTable;

460

*pulFamilyTableSize = tssFamilyTableSize;

461

*ppDelegateTable = tssDelegateTable;

462

*pulDelegateTableSize = tssDelegateTableSize;

463

464

done:

465

free(tpmFamilyTable);

466

free(tpmDelegateTable);

467

468

return result;

469

}

470

Older »