Proxmox-Port/libtpms
1
0
Fork 0
mirror of https://github.com/stefanberger/libtpms synced 2026-08-10 12:01:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Sync: Put pAssert after every SessionGet

Browse Source 
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
This commit is contained in:
Stefan Berger 2025-07-23 15:12:29 -04:00
parent 14ceaaff58
commit c153741b44
8 changed files with 62 additions and 78 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/tpm2/AttestationCommands.c
View File

@ -203,9 +203,10 @@ TPM2_GetSessionAuditDigest(
GetSessionAuditDigest_Out *out // OUT: output parameter list
)
{
SESSION *session = SessionGet(in->sessionHandle);
TPMS_ATTEST auditInfo;
OBJECT *signObject = HandleToObject(in->signHandle);
SESSION* session = SessionGet(in->sessionHandle);
pAssert_RC(session);
TPMS_ATTEST auditInfo;
OBJECT* signObject = HandleToObject(in->signHandle);
// Input Validation
if(!IsSigningObject(signObject))
return TPM_RCS_KEY + RC_GetSessionAuditDigest_signHandle;

16
src/tpm2/ContextCommands.c
View File

@ -151,8 +151,8 @@ TPM2_ContextSave(ContextSave_In* in, // IN: input parameter list
out->context.contextBlob.t.size =
integritySize + fingerprintSize + objectSize;
// Make sure things fit
pAssert(out->context.contextBlob.t.size
<= sizeof(out->context.contextBlob.t.buffer));
pAssert_RC(out->context.contextBlob.t.size
<= sizeof(out->context.contextBlob.t.buffer));
// Copy the whole internal OBJECT structure to context blob
MemoryCopy(outObject, objbuf, objectSize); // libtpms changed
// Increment object context ID
@ -195,15 +195,15 @@ TPM2_ContextSave(ContextSave_In* in, // IN: input parameter list
integritySize + fingerprintSize + sizeof(*session);
// Make sure things fit
pAssert(out->context.contextBlob.t.size
< sizeof(out->context.contextBlob.t.buffer));
pAssert_RC(out->context.contextBlob.t.size
< sizeof(out->context.contextBlob.t.buffer));
// Copy the whole internal SESSION structure to context blob.
// Save space for fingerprint at the beginning of the buffer
// This is done before anything else so that the actual context
// can be reclaimed after this call
pAssert(sizeof(*session) <= sizeof(out->context.contextBlob.t.buffer)
- integritySize - fingerprintSize);
pAssert_RC(sizeof(*session) <= sizeof(out->context.contextBlob.t.buffer)
- integritySize - fingerprintSize);
MemoryCopy(
out->context.contextBlob.t.buffer + integritySize + fingerprintSize,
session,
@ -233,8 +233,8 @@ TPM2_ContextSave(ContextSave_In* in, // IN: input parameter list
// Save fingerprint at the beginning of encrypted area of context blob.
// Reserve the integrity space
pAssert(sizeof(out->context.sequence)
<= sizeof(out->context.contextBlob.t.buffer) - integritySize);
pAssert_RC(sizeof(out->context.sequence)
<= sizeof(out->context.contextBlob.t.buffer) - integritySize);
MemoryCopy(out->context.contextBlob.t.buffer + integritySize,
&out->context.sequence,
sizeof(out->context.sequence));

22
src/tpm2/EACommands.c
View File

@ -92,6 +92,7 @@ TPM2_PolicySigned(PolicySigned_In* in, // IN: input parameter list
// Input Validation
// Set up local pointers
session = SessionGet(in->policySession); // the session structure
pAssert_RC(session);
// Only do input validation if this is not a trial policy session
if(session->attributes.isTrialPolicy == CLEAR)
@ -254,6 +255,7 @@ TPM2_PolicySecret(PolicySecret_In* in, // IN: input parameter list
// Input Validation
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
//Only do input validation if this is not a trial policy session
if(session->attributes.isTrialPolicy == CLEAR)
@ -360,6 +362,7 @@ TPM2_PolicyTicket(PolicyTicket_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// NOTE: A trial policy session is not allowed to use this command.
// A ticket is used in place of a previously given authorization. Since
@ -458,6 +461,7 @@ TPM2_PolicyOR(PolicyOR_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// Compare and Update Internal Session policy if match
for(i = 0; i < in->pHashList.count; i++)
@ -613,6 +617,7 @@ TPM2_PolicyPhysicalPresence(PolicyPhysicalPresence_In* in // IN: input paramete
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// Update policy hash
// policyDigestnew = hash(policyDigestold || TPM_CC_PolicyPhysicalPresence)
@ -662,6 +667,7 @@ TPM2_PolicyLocality(PolicyLocality_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// Get new locality setting in canonical form
marshalBuffer[0] = 0; // Code analysis says that this is not initialized
@ -776,6 +782,7 @@ TPM2_PolicyNV(PolicyNV_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
//If this is a trial policy, skip all validations and the operation
if(session->attributes.isTrialPolicy == CLEAR)
@ -889,6 +896,7 @@ TPM2_PolicyCounterTimer(PolicyCounterTimer_In* in // IN: input parameter list
return TPM_RCS_RANGE;
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
//If this is a trial policy, skip the check to see if the condition is met.
if(session->attributes.isTrialPolicy == CLEAR)
@ -970,6 +978,7 @@ TPM2_PolicyCommandCode(PolicyCommandCode_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
if(session->commandCode != 0 && session->commandCode != in->code)
return TPM_RCS_VALUE + RC_PolicyCommandCode_code;
@ -1028,6 +1037,7 @@ TPM2_PolicyCpHash(PolicyCpHash_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// A valid cpHash must have the same size as session hash digest
// NOTE: the size of the digest can't be zero because TPM_ALG_NULL
@ -1094,6 +1104,7 @@ TPM2_PolicyNameHash(PolicyNameHash_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// A valid nameHash must have the same size as session hash digest
// Since the authHashAlg for a session cannot be TPM_ALG_NULL, the digest size
@ -1159,6 +1170,7 @@ TPM2_PolicyDuplicationSelect(
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// nameHash in session context must be empty
if(session->u1.nameHash.t.size != 0)
@ -1248,6 +1260,7 @@ TPM2_PolicyAuthorize(PolicyAuthorize_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
if(in->keySign.t.size < 2)
{
@ -1337,6 +1350,7 @@ TPM2_PolicyAuthValue(PolicyAuthValue_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// Update policy hash
// policyDigestnew = hash(policyDigestold || TPM_CC_PolicyAuthValue)
@ -1384,6 +1398,7 @@ TPM2_PolicyPassword(PolicyPassword_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// Update policy hash
// policyDigestnew = hash(policyDigestold || TPM_CC_PolicyAuthValue)
@ -1422,6 +1437,8 @@ TPM2_PolicyGetDigest(
// Command Output
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
out->policyDigest = session->u2.policyDigest;
return TPM_RC_SUCCESS;
}
@ -1448,6 +1465,7 @@ TPM2_PolicyNvWritten(PolicyNvWritten_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// If already set is this a duplicate (the same setting)? If it
// is a conflicting setting, it is an error
@ -1511,6 +1529,7 @@ TPM2_PolicyTemplate(PolicyTemplate_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// error if the templateHash in session context is not empty and is not the
// same as the input or is not a template
@ -1586,6 +1605,7 @@ TPM2_PolicyAuthorizeNV(PolicyAuthorizeNV_In* in)
// Input Validation
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// Skip checks if this is a trial policy
if(!session->attributes.isTrialPolicy)
@ -1702,6 +1722,7 @@ TPM2_PolicyCapability(PolicyCapability_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
if(session->attributes.isTrialPolicy == CLEAR)
{
@ -1939,6 +1960,7 @@ TPM2_PolicyParameters(PolicyParameters_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// A valid pHash must have the same size as session hash digest
// Since the authHashAlg for a session cannot be TPM_ALG_NULL, the digest size

62
src/tpm2/Entity.c
View File

@ -1,62 +1,4 @@
/********************************************************************************/
/* */
/* Accessing properties for handles of various types */
/* Written by Ken Goldman */
/* IBM Thomas J. Watson Research Center */
/* */
/* Licenses and Notices */
/* */
/* 1. Copyright Licenses: */
/* */
/* - Trusted Computing Group (TCG) grants to the user of the source code in */
/* this specification (the "Source Code") a worldwide, irrevocable, */
/* nonexclusive, royalty free, copyright license to reproduce, create */
/* derivative works, distribute, display and perform the Source Code and */
/* derivative works thereof, and to grant others the rights granted herein. */
/* */
/* - The TCG grants to the user of the other parts of the specification */
/* (other than the Source Code) the rights to reproduce, distribute, */
/* display, and perform the specification solely for the purpose of */
/* developing products based on such documents. */
/* */
/* 2. Source Code Distribution Conditions: */
/* */
/* - Redistributions of Source Code must retain the above copyright licenses, */
/* this list of conditions and the following disclaimers. */
/* */
/* - Redistributions in binary form must reproduce the above copyright */
/* licenses, this list of conditions and the following disclaimers in the */
/* documentation and/or other materials provided with the distribution. */
/* */
/* 3. Disclaimers: */
/* */
/* - THE COPYRIGHT LICENSES SET FORTH ABOVE DO NOT REPRESENT ANY FORM OF */
/* LICENSE OR WAIVER, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, WITH */
/* RESPECT TO PATENT RIGHTS HELD BY TCG MEMBERS (OR OTHER THIRD PARTIES) */
/* THAT MAY BE NECESSARY TO IMPLEMENT THIS SPECIFICATION OR OTHERWISE. */
/* Contact TCG Administration (admin@trustedcomputinggroup.org) for */
/* information on specification licensing rights available through TCG */
/* membership agreements. */
/* */
/* - THIS SPECIFICATION IS PROVIDED "AS IS" WITH NO EXPRESS OR IMPLIED */
/* WARRANTIES WHATSOEVER, INCLUDING ANY WARRANTY OF MERCHANTABILITY OR */
/* FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, OR */
/* NONINFRINGEMENT OF INTELLECTUAL PROPERTY RIGHTS, OR ANY WARRANTY */
/* OTHERWISE ARISING OUT OF ANY PROPOSAL, SPECIFICATION OR SAMPLE. */
/* */
/* - Without limitation, TCG and its members and licensors disclaim all */
/* liability, including liability for infringement of any proprietary */
/* rights, relating to use of information in this specification and to the */
/* implementation of this specification, and TCG disclaims all liability for */
/* cost of procurement of substitute goods or services, lost profits, loss */
/* of use, loss of data or any incidental, consequential, direct, indirect, */
/* or special damages, whether under contract, tort, warranty or otherwise, */
/* arising in any way out of use or reliance upon this specification or any */
/* information herein. */
/* */
/* (c) Copyright IBM Corp. and others, 2016 - 2024 */
/* */
/********************************************************************************/
// SPDX-License-Identifier: BSD-2-Clause
//** Description
// The functions in this file are used for accessing properties for handles of
@ -149,6 +91,7 @@ EntityGetLoadStatus(COMMAND* command // IN/OUT: command parsing structure
{
SESSION* session;
session = SessionGet(handle);
pAssert_RC(session != NULL);
// Check if the session is a HMAC session
if(session->attributes.isPolicy == SET)
result = TPM_RC_HANDLE;
@ -164,6 +107,7 @@ EntityGetLoadStatus(COMMAND* command // IN/OUT: command parsing structure
{
SESSION* session;
session = SessionGet(handle);
pAssert_RC(session != NULL);
// Check if the session is a policy session
if(session->attributes.isPolicy == CLEAR)
result = TPM_RC_HANDLE;

1
src/tpm2/PolicyTransportSPDM.c
View File

@ -27,6 +27,7 @@ TPM2_PolicyTransportSPDM(PolicyTransportSPDM_In* in // IN: input parameter list
// Get pointer to the session structure
session = SessionGet(in->policySession);
pAssert_RC(session);
// Check that TPM2_PolicyTransportSPDM has not previously been executed
if(session->attributes.checkSecureChannel == SET)

8
src/tpm2/Session.c
View File

@ -306,18 +306,18 @@ SESSION* SessionGet(TPM_HANDLE handle // IN: session handle
size_t slotIndex;
CONTEXT_SLOT sessionIndex;
pAssert(HandleGetType(handle) == TPM_HT_POLICY_SESSION
|| HandleGetType(handle) == TPM_HT_HMAC_SESSION);
pAssert_NULL(HandleGetType(handle) == TPM_HT_POLICY_SESSION
|| HandleGetType(handle) == TPM_HT_HMAC_SESSION);
slotIndex = handle & HR_HANDLE_MASK;
pAssert(slotIndex < MAX_ACTIVE_SESSIONS);
pAssert_NULL(slotIndex < MAX_ACTIVE_SESSIONS);
// get the contents of the session array. Because session is loaded, we
// should always get a valid sessionIndex
sessionIndex = gr.contextArray[slotIndex] - 1;
pAssert(sessionIndex < MAX_LOADED_SESSIONS);
pAssert_NULL(sessionIndex < MAX_LOADED_SESSIONS);
return &s_sessions[sessionIndex].session;
}

6
src/tpm2/SessionCommands.c
View File

@ -168,8 +168,12 @@ TPM2_PolicyRestart(
PolicyRestart_In *in // IN: input parameter list
)
{
SESSION* session = SessionGet(in->sessionHandle);
pAssert_RC(session != NULL);
// Initialize policy session data
SessionResetPolicyData(SessionGet(in->sessionHandle));
SessionResetPolicyData(session);
return TPM_RC_SUCCESS;
}
#endif // CC_PolicyRestart

18
src/tpm2/SessionProcess.c
View File

@ -93,6 +93,7 @@ static TPM_RC IncrementLockout(UINT32 sessionIndex)
else
{
session = SessionGet(sessionHandle);
pAssert_RC(session);
// If the session is bound to lockout, then use that as the relevant
// handle. This means that an authorization failure with a bound session
// bound to lockoutAuth will take precedence over any other
@ -107,7 +108,7 @@ static TPM_RC IncrementLockout(UINT32 sessionIndex)
}
if(handle == TPM_RH_LOCKOUT)
{
pAssert(gp.lockOutAuthEnabled == TRUE);
pAssert_RC(gp.lockOutAuthEnabled == TRUE);
// lockout is no longer enabled
gp.lockOutAuthEnabled = FALSE;
@ -864,6 +865,7 @@ static TPM2B_DIGEST* ComputeCommandHMAC(
// Will add the nonce for the decrypt session.
SESSION* decryptSession =
SessionGet(s_sessionHandles[s_decryptSessionIndex]);
pAssert_RC(decryptSession != NULL);
nonceDecrypt = &decryptSession->nonceTPM;
}
// Now repeat for the encrypt session.
@ -880,6 +882,7 @@ static TPM2B_DIGEST* ComputeCommandHMAC(
// Continue with the HMAC processing.
session = SessionGet(s_sessionHandles[sessionIndex]);
pAssert_RC(session != NULL);
// Generate HMAC key.
MemoryCopy2B(&key.b, &session->sessionKey.b, sizeof(key.t.buffer));
@ -1003,6 +1006,7 @@ static TPM_RC CheckPolicyAuthSession(
//
// Initialize pointer to the authorization session.
session = SessionGet(s_sessionHandles[sessionIndex]);
pAssert_RC(session != NULL);
// If the command is TPM2_PolicySecret(), make sure that
// either password or authValue is required
@ -1233,6 +1237,7 @@ static TPM_RC RetrieveSessionData(
return TPM_RC_REFERENCE_S0 + sessionIndex;
sessionType = HandleGetType(s_sessionHandles[sessionIndex]);
session = SessionGet(s_sessionHandles[sessionIndex]);
pAssert_RC(session != NULL);
// Check if the session is an HMAC/policy session.
if((session->attributes.isPolicy == SET && sessionType == TPM_HT_HMAC_SESSION)
@ -1416,6 +1421,7 @@ static TPM_RC CheckAuthSession(
if(sessionHandle != TPM_RS_PW)
{
session = SessionGet(sessionHandle);
pAssert_RC(session != NULL);
// Set includeAuth to indicate if DA checking will be required and if the
// authValue will be included in any HMAC.
@ -1580,7 +1586,7 @@ ParseSessionBuffer(COMMAND* command // IN: the structure that contains
return result;
// There is no command in the TPM spec that has more handles than
// MAX_SESSION_NUM.
pAssert(command->handleNum <= MAX_SESSION_NUM);
pAssert_RC(command->handleNum <= MAX_SESSION_NUM);
// Associate the session with an authorization handle.
for(i = 0; i < command->handleNum; i++)
@ -1620,6 +1626,7 @@ ParseSessionBuffer(COMMAND* command // IN: the structure that contains
else
{
session = SessionGet(s_sessionHandles[sessionIndex]);
pAssert_RC(session != NULL);
// A trial session can not appear in session area, because it cannot
// be used for authorization, audit or encrypt/decrypt.
@ -1658,7 +1665,7 @@ ParseSessionBuffer(COMMAND* command // IN: the structure that contains
return TPM_RCS_ATTRIBUTES + errorIndex;
// no authValue included in any of the HMAC computations
pAssert(session != NULL);
pAssert_RC(session != NULL);
session->attributes.includeAuth = CLEAR;
// check HMAC for encrypt/decrypt/audit only sessions
@ -1895,6 +1902,7 @@ static void UpdateAuditSessionStatus(
if(s_sessionHandles[i] == TPM_RS_PW)
continue;
session = SessionGet(s_sessionHandles[i]);
pAssert_VOID_OK(session != NULL);
// If a session is used for audit
if(IS_ATTRIBUTE(s_attributes[i], TPMA_SESSION, audit))
@ -2066,6 +2074,8 @@ static TPM2B_NONCE* BuildSingleResponseAuth(
{
// Fill in policy/HMAC based session response.
SESSION* session = SessionGet(s_sessionHandles[sessionIndex]);
pAssert_NULL(session != NULL);
//
// If the session is a policy session with isPasswordNeeded SET, the
// authorization field is empty.
@ -2094,6 +2104,7 @@ static void UpdateAllNonceTPM(COMMAND* command // IN: controlling structure
if(s_sessionHandles[i] != TPM_RS_PW)
{
session = SessionGet(s_sessionHandles[i]);
pAssert_VOID_OK(session != NULL);
// Update nonceTPM in both internal session and response.
CryptRandomGenerate(session->nonceTPM.t.size, session->nonceTPM.t.buffer);
}
@ -2203,6 +2214,7 @@ BuildResponseSession(COMMAND* command // IN: structure that has relevant comman
// Compute the response HMAC and get a pointer to the nonce used.
// This function will also update the values if needed. Note, the
nonceTPM = BuildSingleResponseAuth(command, i, &responseAuth);
pAssert_RC(nonceTPM != NULL);
}
command->authSize +=
TPM2B_NONCE_Marshal(nonceTPM, &command->responseBuffer, NULL);