TPM_RESULT TPM_EstablishTransport(TPM_KEY_HANDLE encHandle,
TPM_TRANSPORT_PUBLIC *transPublic,
UINT32 secretSize, BYTE *secret,
TPM_AUTH *auth1,
TPM_TRANSHANDLE *transHandle,
TPM_MODIFIER_INDICATOR *locality,
TPM_CURRENT_TICKS *currentTicks,
TPM_NONCE *transNonceEven)
{
TPM_RESULT res;
TPM_KEY_DATA *key;
TPM_TRANSPORT_AUTH trans_auth;
TPM_SESSION_DATA *session;
info("TPM_EstablishTransport()");
/* setup authorization data */
if (encHandle == TPM_KH_TRANSPORT) {
if (auth1->authHandle != TPM_INVALID_HANDLE) return TPM_BADTAG;
if (transPublic->transAttributes & TPM_TRANSPORT_ENCRYPT) return TPM_BAD_SCHEME;
if (secretSize != 20) return TPM_BAD_PARAM_SIZE;
memcpy(trans_auth.authData, secret, 20);
} else {
/* get key and verify its usage */
key = tpm_get_key(encHandle);
if (key == NULL) return TPM_INVALID_KEYHANDLE;
if (key->keyUsage != TPM_KEY_STORAGE && key->keyUsage != TPM_KEY_LEGACY)
return TPM_INVALID_KEYUSAGE;
/* verify authorization */
if (key->authDataUsage != TPM_AUTH_NEVER) {
res = tpm_verify_auth(auth1, key->usageAuth, encHandle);
if (res != TPM_SUCCESS) return res;
if (decrypt_transport_auth(key, secret, secretSize, &trans_auth))
return TPM_DECRYPT_ERROR;
}
}
/* check whether the transport has to be encrypted */
if (transPublic->transAttributes & TPM_TRANSPORT_ENCRYPT) {
if (tpmData.permanent.flags.FIPS
&& transPublic->algID == TPM_ALG_MGF1) return TPM_INAPPROPRIATE_ENC;
/* until now, only MGF1 is supported */
if (transPublic->algID != TPM_ALG_MGF1) return TPM_BAD_KEY_PROPERTY;
}
/* initialize transport session */
tpm_get_random_bytes(transNonceEven->nonce, sizeof(transNonceEven->nonce));
*transHandle = tpm_get_free_session(TPM_ST_TRANSPORT);
session = tpm_get_transport(*transHandle);
if (session == NULL) return TPM_RESOURCES;
session->transInternal.transHandle = *transHandle;
memset(&session->transInternal.transDigest, 0, sizeof(TPM_DIGEST));
memcpy(&session->transInternal.transPublic, transPublic,
sizeof_TPM_TRANSPORT_PUBLIC((*transPublic)));
memcpy(&session->transInternal.transNonceEven, transNonceEven, sizeof(TPM_NONCE));
memcpy(&session->nonceEven, transNonceEven, sizeof(TPM_NONCE));
memcpy(&session->transInternal.authData, trans_auth.authData, sizeof(TPM_AUTHDATA));
*locality = tpmData.stany.flags.localityModifier;
memcpy(currentTicks, &tpmData.stany.data.currentTicks, sizeof(TPM_CURRENT_TICKS));
/* perform transport logging */
if (transPublic->transAttributes & TPM_TRANSPORT_LOG) {
tpm_sha1_ctx_t sha1;
BYTE *ptr, buf[4 + 4 + 4 + sizeof_TPM_CURRENT_TICKS(x) + 20];
UINT32 len;
/* log input */
memset(buf, 0, sizeof(buf));
transport_log_in(auth1->digest, buf, &session->transInternal.transDigest);
/* compute digest of output parameters and log output */
ptr = buf; len = sizeof(buf);
tpm_marshal_UINT32(&ptr, &len, TPM_SUCCESS);
tpm_marshal_TPM_COMMAND_CODE(&ptr, &len, TPM_ORD_EstablishTransport);
tpm_marshal_TPM_MODIFIER_INDICATOR(&ptr, &len, *locality);
tpm_marshal_TPM_CURRENT_TICKS(&ptr, &len, currentTicks);
tpm_marshal_TPM_NONCE(&ptr, &len, transNonceEven);
tpm_sha1_init(&sha1);
tpm_sha1_update(&sha1, buf, sizeof(buf));
tpm_sha1_final(&sha1, buf);
transport_log_out(buf, &session->transInternal.transDigest);
}
/* check whether this is a exclusive transport session */
if (transPublic->transAttributes & TPM_TRANSPORT_EXCLUSIVE) {
tpmData.stany.flags.transportExclusive = TRUE;
tpmData.stany.data.transExclusive = *transHandle;
}
auth1->continueAuthSession = FALSE;
return TPM_SUCCESS;
}
TPM_RESULT TPM_LoadContext(TPM_HANDLE entityHandle, BOOL keepHandle,
UINT32 contextSize, TPM_CONTEXT_BLOB *contextBlob,
TPM_HANDLE *handle)
{
TPM_CONTEXT_SENSITIVE context;
BYTE *context_buf;
TPM_SESSION_DATA *session;
TPM_DAA_SESSION_DATA *sessionDAA;
TPM_KEY_DATA *key;
TPM_DIGEST digest;
int i = 0;
info("TPM_LoadContext()");
if (decrypt_context(contextBlob->additionalData, contextBlob->additionalSize,
contextBlob->sensitiveData, contextBlob->sensitiveSize,
&context, &context_buf)) return TPM_DECRYPT_ERROR;
/* validate structure */
if (compute_context_digest(contextBlob, &digest)
|| memcmp(&digest, &contextBlob->integrityDigest, sizeof(TPM_DIGEST))) {
tpm_free(context_buf);
return TPM_BADCONTEXT;
}
if (contextBlob->resourceType == TPM_RT_KEY) {
/* check contextNonce */
if (context.internalData.key.parentPCRStatus
|| (context.internalData.key.keyFlags & TPM_KEY_FLAG_VOLATILE)) {
if (memcmp(&context.contextNonce, &tpmData.stclear.data.contextNonceKey,
sizeof(TPM_NONCE)) != 0) {
tpm_free(context_buf);
return TPM_BADCONTEXT;
}
}
/* check handle */
key = tpm_get_key_slot(entityHandle);
if (key == NULL || !key->payload) {
if (keepHandle) {
tpm_free(context_buf);
return TPM_BAD_HANDLE;
}
*handle = tpm_get_free_key();
if (*handle == TPM_INVALID_HANDLE) {
tpm_free(context_buf);
return TPM_RESOURCES;
}
key = &tpmData.permanent.data.keys[HANDLE_TO_INDEX(*handle)];
} else {
*handle = entityHandle;
}
/* reload resource */
memcpy(key, &context.internalData.key, sizeof(TPM_KEY_DATA));
tpm_rsa_copy_key(&key->key, &context.internalData.key.key);
} else if (contextBlob->resourceType == TPM_RT_DAA_TPM) {
/* check contextNonce */
if (memcmp(&context.contextNonce, &tpmData.stany.data.contextNonceSession,
sizeof(TPM_NONCE)) != 0) {
tpm_free(context_buf);
return TPM_BADCONTEXT;
}
/* check context list */
for (i = 0; i < TPM_MAX_SESSION_LIST; i++)
if (tpmData.stany.data.contextList[i] == contextBlob->contextCount) break;
if (i >= TPM_MAX_SESSION_LIST) {
tpm_free(context_buf);
return TPM_BADCONTEXT;
}
tpmData.stany.data.contextList[i] = 0;
/* check handle */
info("entityHandle = %08x, keepHandle = %d", entityHandle, keepHandle);
sessionDAA = tpm_get_daa_slot(entityHandle);
if (sessionDAA == NULL) {
if (keepHandle) {
tpm_free(context_buf);
return TPM_BAD_HANDLE;
}
*handle = tpm_get_free_daa_session();
if (*handle == TPM_INVALID_HANDLE) {
tpm_free(context_buf);
return TPM_RESOURCES;
}
sessionDAA = &tpmData.stany.data.sessionsDAA[HANDLE_TO_INDEX(*handle)];
} else if (sessionDAA->type != TPM_ST_INVALID) {
if (keepHandle) {
tpm_free(context_buf);
return TPM_BAD_HANDLE;
}
*handle = tpm_get_free_daa_session();
if (*handle == TPM_INVALID_HANDLE) {
tpm_free(context_buf);
return TPM_RESOURCES;
}
sessionDAA = &tpmData.stany.data.sessionsDAA[HANDLE_TO_INDEX(*handle)];
} else {
if (HANDLE_TO_RT(entityHandle) != TPM_RT_DAA_TPM) {
if (keepHandle) {
tpm_free(context_buf);
return TPM_BAD_HANDLE;
}
*handle = tpm_get_free_daa_session();
if (*handle == TPM_INVALID_HANDLE) {
tpm_free(context_buf);
return TPM_RESOURCES;
}
sessionDAA = &tpmData.stany.data.sessionsDAA[HANDLE_TO_INDEX(*handle)];
} else
*handle = entityHandle;
}
/* reload resource */
tpmData.stany.data.currentDAA = *handle;
info("stany.data.currentDAA := %.8x", *handle);
memset(sessionDAA, 0, sizeof(TPM_DAA_SESSION_DATA));
memcpy(sessionDAA, &context.internalData.sessionDAA, context.internalSize);
} else {
/* check contextNonce */
if (memcmp(&context.contextNonce, &tpmData.stany.data.contextNonceSession,
sizeof(TPM_NONCE)) != 0) {
tpm_free(context_buf);
return TPM_BADCONTEXT;
}
if (context.internalData.session.type == TPM_ST_OSAP
&& tpm_get_key(context.internalData.session.handle) == NULL) {
tpm_free(context_buf);
return TPM_RESOURCEMISSING;
}
/* check context list */
for (i = 0; i < TPM_MAX_SESSION_LIST; i++)
if (tpmData.stany.data.contextList[i] == contextBlob->contextCount) break;
if (i >= TPM_MAX_SESSION_LIST) {
tpm_free(context_buf);
return TPM_BADCONTEXT;
}
tpmData.stany.data.contextList[i] = 0;
/* check handle */
session = tpm_get_session_slot(entityHandle);
if (session == NULL || session->type != TPM_ST_INVALID) {
if (keepHandle) {
tpm_free(context_buf);
return TPM_BAD_HANDLE;
}
*handle = tpm_get_free_session(context.internalData.session.type);
if (*handle == TPM_INVALID_HANDLE) {
tpm_free(context_buf);
return TPM_RESOURCES;
}
session = &tpmData.stany.data.sessions[HANDLE_TO_INDEX(*handle)];
} else {
*handle = entityHandle;
}
/* reload resource */
memcpy(session, &context.internalData.session, sizeof(TPM_SESSION_DATA));
}
tpm_free(context_buf);
return TPM_SUCCESS;
}
