Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-10 09:31:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: Allow to runtime-disable RSAPSS signing scheme

Browse Source 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2023-06-26 08:07:22 -04:00 committed by Stefan Berger
parent 01d5759990
commit 26ad3f2167
2 changed files with 37 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/tpm2/RuntimeAlgorithm.c
View File

@ -132,7 +132,7 @@ static const struct {
[TPM_ALG_SM4] = SYMMETRIC(ALG_SM4, "sm4", s_KeySizesSM4, true, 0), // not supported
[TPM_ALG_RSASSA] = SIGNING(ALG_RSASSA, "rsassa", false, 1),
[TPM_ALG_RSAES] = ENCRYPTING(ALG_RSAES, "rsaes", false, 1),
[TPM_ALG_RSAPSS] = SIGNING(ALG_RSAPSS, "rsapss", false, 1),
[TPM_ALG_RSAPSS] = SIGNING(ALG_RSAPSS, "rsapss", true, 1),
[TPM_ALG_OAEP] = ENCRYPTING(ALG_OAEP, "oaep", false, 1), // never disable: CryptSecretEncrypt/Decrypt needs it
[TPM_ALG_ECDSA] = SIGNING(ALG_ECDSA, "ecdsa", false, 1),
[TPM_ALG_ECDH] = OTHER(ALG_ECDH, "ecdh", false, 1),

39
src/tpm2/Unmarshal.c
View File

@ -1451,6 +1451,10 @@ TPMI_ALG_SIG_SCHEME_Unmarshal(TPMI_ALG_SIG_SCHEME *target, BYTE **buffer, INT32
#if ALG_ECSCHNORR
case TPM_ALG_ECSCHNORR:
#endif
if (!RuntimeAlgorithmCheckEnabled(&g_RuntimeProfile.RuntimeAlgorithm, // libtpms added begin
*target)) {
rc = TPM_RC_SCHEME;
} // libtpms added end
break;
case TPM_ALG_NULL:
if (allowNull) {
@ -1458,9 +1462,11 @@ TPMI_ALG_SIG_SCHEME_Unmarshal(TPMI_ALG_SIG_SCHEME *target, BYTE **buffer, INT32
}
default:
rc = TPM_RC_SCHEME;
*target = orig_target; // libtpms added
}
}
if (rc != TPM_RC_SUCCESS) { // libtpms added begin
*target = orig_target;
} // libtpms added end
return rc;
}
@ -3247,6 +3253,10 @@ TPMU_SIG_SCHEME_Unmarshal(TPMU_SIG_SCHEME *target, BYTE **buffer, INT32 *size, U
{
TPM_RC rc = TPM_RC_SUCCESS;
if (!RuntimeAlgorithmCheckEnabled(&g_RuntimeProfile.RuntimeAlgorithm, selector)) { // libtpms added begin
return TPM_RC_SELECTOR;
} // libtpms added end
switch (selector) {
#if ALG_RSASSA
case TPM_ALG_RSASSA:
@ -3511,6 +3521,9 @@ TPMI_ALG_ASYM_SCHEME_Unmarshal(TPMI_ALG_ASYM_SCHEME *target, BYTE **buffer, INT3
#if ALG_OAEP
case TPM_ALG_OAEP:
#endif
if (!RuntimeAlgorithmCheckEnabled(&g_RuntimeProfile.RuntimeAlgorithm, *target)) { // libtpms added begin
rc = TPM_RC_VALUE;
} // libtpms added end
break;
case TPM_ALG_NULL:
if (allowNull) {
@ -3518,9 +3531,11 @@ TPMI_ALG_ASYM_SCHEME_Unmarshal(TPMI_ALG_ASYM_SCHEME *target, BYTE **buffer, INT3
}
default:
rc = TPM_RC_VALUE;
*target = orig_target; // libtpms added
}
}
if (rc != TPM_RC_SUCCESS) { // libtpms added begin
*target = orig_target;
} // libtpms added end
return rc;
}
#endif
@ -3532,6 +3547,12 @@ TPMU_ASYM_SCHEME_Unmarshal(TPMU_ASYM_SCHEME *target, BYTE **buffer, INT32 *size,
{
TPM_RC rc = TPM_RC_SUCCESS;
if (rc == TPM_RC_SUCCESS) { // libtpms added begin
if (!RuntimeAlgorithmCheckEnabled(&g_RuntimeProfile.RuntimeAlgorithm, selector)) {
return TPM_RC_SELECTOR;
}
} // libtpms added end
switch (selector) {
#if ALG_ECDH
case TPM_ALG_ECDH:
@ -3616,6 +3637,10 @@ TPMI_ALG_RSA_SCHEME_Unmarshal(TPMI_ALG_RSA_SCHEME *target, BYTE **buffer, INT32
#if ALG_OAEP
case TPM_ALG_OAEP:
#endif
if (!RuntimeAlgorithmCheckEnabled(&g_RuntimeProfile.RuntimeAlgorithm, // libtpms added begin
*target)) {
rc = TPM_RC_VALUE;
} // libtpms added end
break;
case TPM_ALG_NULL:
if (allowNull) {
@ -3623,9 +3648,11 @@ TPMI_ALG_RSA_SCHEME_Unmarshal(TPMI_ALG_RSA_SCHEME *target, BYTE **buffer, INT32
}
default:
rc = TPM_RC_VALUE;
*target = orig_target; // libtpms added
}
}
if (rc != TPM_RC_SUCCESS) { // libtpms added begin
*target = orig_target;
} // libtpms added end
return rc;
}
@ -4007,6 +4034,12 @@ TPMU_SIGNATURE_Unmarshal(TPMU_SIGNATURE *target, BYTE **buffer, INT32 *size, UIN
{
TPM_RC rc = TPM_RC_SUCCESS;
if (rc == TPM_RC_SUCCESS) { // libtpms added begin
if (!RuntimeAlgorithmCheckEnabled(&g_RuntimeProfile.RuntimeAlgorithm, selector)) {
return TPM_RC_SELECTOR;
}
} // libtpms added end
switch (selector) {
#if ALG_RSASSA
case TPM_ALG_RSASSA: