Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-08 07:55:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tpm2: Enable TPM2_PolicyParameters in default-v1 profile

Browse Source 
Enable TPM2_PolicyParameters in default-v1 profile and bump up the
StateFormatLevel to '5'.

Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2024-07-17 17:29:02 -04:00 committed by Stefan Berger
parent 7d31d5ae8b
commit 8e27756625
5 changed files with 53 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
man/man3/TPMLIB_SetProfile.pod
View File

@ -152,6 +152,11 @@ the null profile (libtpms v0.9).
=back
=item 5: (since v0.10)
This I<StateFormatLevel> enabled the TPM 2 commands PolicyCapability (0x19b)
and PolicyParameters (0x19c).
=back
A user may specify the I<StateFormatLevel> when using the I<custom> profile.

4
src/tpm2/RuntimeCommands.c
View File

@ -186,8 +186,8 @@ static const struct {
COMMAND(ACT_SetTimeout, true, 0), // not supported
COMMAND(ECC_Encrypt, true, 3),
COMMAND(ECC_Decrypt, true, 3),
COMMAND(PolicyCapability, true, 0), // not supported
COMMAND(PolicyParameters, true, 0), // not supported
COMMAND(PolicyCapability, true, 5),
COMMAND(PolicyParameters, true, 5),
COMMAND(NV_DefineSpace2, true, 0), // not supported
COMMAND(NV_ReadPublic2, true, 0), // not supported
COMMAND(SetCapability, true, 0), // not supported

9
src/tpm2/RuntimeProfile.c
View File

@ -52,7 +52,7 @@ struct RuntimeProfile g_RuntimeProfile;
const char defaultCommandsProfile[] =
"0x11f-0x122,0x124-0x12e,0x130-0x140,0x142-0x159,0x15b-0x15e,"
"0x160-0x165,0x167-0x174,0x176-0x178,0x17a-0x193,0x197,0x199-0x19a";
"0x160-0x165,0x167-0x174,0x176-0x178,0x17a-0x193,0x197,0x199-0x19c";
const char defaultAlgorithmsProfile[] =
"rsa,rsa-min-size=1024,tdes,tdes-min-size=128,sha1,hmac,"
@ -73,7 +73,7 @@ static const struct RuntimeProfileDesc {
* This basically locks the name of the profile to the stateFormatLevel.
*/
unsigned int stateFormatLevel;
#define STATE_FORMAT_LEVEL_CURRENT 4
#define STATE_FORMAT_LEVEL_CURRENT 5
#define STATE_FORMAT_LEVEL_UNKNOWN 0 /* JSON didn't provide StateFormatLevel; this is only
allowed for the 'default' profile or when user
passed JSON via SetProfile() */
@ -86,6 +86,7 @@ static const struct RuntimeProfileDesc {
* 4 : Camellia-192 & AES-192 enabled
* Session attribute isNameHashDefined was added and existing functions TPM2_PolicyNameHash
* and CheckPolicyAuthSession are using it.
* 5 : Enabled TPM2_PolicyCapability (0x19b) & TPM2_PolicyParameters (0x19c)
*/
const char *description;
#define DESCRIPTION_MAX_SIZE 250
@ -773,8 +774,8 @@ RuntimeProfileGetSeedCompatLevel(void)
case 1: /* profile runs on v0.9 */
return SEED_COMPAT_LEVEL_RSA_PRIME_ADJUST_FIX;
case 2 ... 4: /* profile runs on v0.10 */ {
MUST_BE(STATE_FORMAT_LEVEL_CURRENT == 4); // force update when this changes
case 2 ... 5: /* profile runs on v0.10 */ {
MUST_BE(STATE_FORMAT_LEVEL_CURRENT == 5); // force update when this changes
return SEED_COMPAT_LEVEL_LAST;
}

4
src/tpm2/TpmProfile_CommandList.h
View File

@ -174,7 +174,7 @@
#define CC_PolicyAuthValue CC_YES
#define CC_PolicyAuthorize CC_YES
#define CC_PolicyAuthorizeNV CC_YES
#define CC_PolicyCapability CC_NO /* libtpms: NO */
#define CC_PolicyCapability CC_YES /* libtpms: YES; since v0.10, StateFormatLevel 5 */
#define CC_PolicyCommandCode CC_YES
#define CC_PolicyCounterTimer CC_YES
#define CC_PolicyCpHash CC_YES
@ -187,7 +187,7 @@
#define CC_PolicyOR CC_YES
#define CC_PolicyPCR CC_YES
#define CC_PolicyPassword CC_YES
#define CC_PolicyParameters CC_NO /* libtpms: NO */
#define CC_PolicyParameters CC_YES /* libtpms: YES; since v0.10, StateFormatLevel 5 */
#define CC_PolicyPhysicalPresence CC_YES
#define CC_PolicyRestart CC_YES
#define CC_PolicySecret CC_YES

41
tests/tpm2_setprofile.c
View File

@ -59,10 +59,10 @@ static const struct {
.exp_profile =
"{\"ActiveProfile\":{"
"\"Name\":\"default-v1\","
"\"StateFormatLevel\":4,"
"\"StateFormatLevel\":5,"
"\"Commands\":\"0x11f-0x122,0x124-0x12e,0x130-0x140,0x142-0x159,"
"0x15b-0x15e,0x160-0x165,0x167-0x174,0x176-0x178,"
"0x17a-0x193,0x197,0x199-0x19a\","
"0x17a-0x193,0x197,0x199-0x19c\","
"\"Algorithms\":\"rsa,rsa-min-size=1024,tdes,tdes-min-size=128,"
"sha1,hmac,aes,aes-min-size=128,mgf1,keyedhash,"
"xor,sha256,sha384,sha512,null,rsassa,rsaes,rsapss,"
@ -248,6 +248,43 @@ static const struct {
"cmac,ctr,ofb,cbc,cfb,ecb\","
"\"Description\":\"test\""
"}}",
}, {
// commands 0x19b-0x19c require StateFormatLevel 5
.profile = "{"
"\"Name\":\"custom\","
"\"StateFormatLevel\":4,"
"\"Commands\":\"0x11f-0x122,0x124-0x12e,0x130-0x140,0x142-0x159,"
"0x15b-0x15e,0x160-0x165,0x167-0x174,0x176-0x178,"
"0x17a-0x193,0x197,0x199-0x19b\","
"\"Description\":\"test\""
"}",
.exp_fail = true,
}, {
.profile = "{"
"\"Name\":\"custom\","
"\"StateFormatLevel\":0,"
"\"Commands\":\"0x11f-0x122,0x124-0x12e,0x130-0x140,0x142-0x159,"
"0x15b-0x15e,0x160-0x165,0x167-0x174,0x176-0x178,"
"0x17a-0x193,0x197,0x19b-0x19c\","
"\"Description\":\"test\""
"}",
.exp_fail = false,
.exp_profile =
"{\"ActiveProfile\":{"
"\"Name\":\"custom\","
"\"StateFormatLevel\":5,"
"\"Commands\":\"0x11f-0x122,0x124-0x12e,0x130-0x140,0x142-0x159,"
"0x15b-0x15e,0x160-0x165,0x167-0x174,0x176-0x178,"
"0x17a-0x193,0x197,0x19b-0x19c\","
"\"Algorithms\":\"rsa,rsa-min-size=1024,tdes,tdes-min-size=128,"
"sha1,hmac,aes,aes-min-size=128,mgf1,keyedhash,"
"xor,sha256,sha384,sha512,null,rsassa,rsaes,rsapss,"
"oaep,ecdsa,ecdh,ecdaa,sm2,ecschnorr,ecmqv,"
"kdf1-sp800-56a,kdf2,kdf1-sp800-108,ecc,ecc-min-size=192,"
"ecc-nist,ecc-bn,symcipher,camellia,camellia-min-size=128,"
"cmac,ctr,ofb,cbc,cfb,ecb\","
"\"Description\":\"test\""
"}}",
}, {
// keep last
}