1 # SPDX-License-Identifier: (GPL-2.0 OR BSD-3-C 1 # SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause) 2 2 3 import hashlib 3 import hashlib 4 import os 4 import os 5 import socket 5 import socket 6 import struct 6 import struct 7 import sys 7 import sys 8 import unittest 8 import unittest 9 import fcntl 9 import fcntl 10 import select 10 import select 11 11 12 TPM2_ST_NO_SESSIONS = 0x8001 12 TPM2_ST_NO_SESSIONS = 0x8001 13 TPM2_ST_SESSIONS = 0x8002 13 TPM2_ST_SESSIONS = 0x8002 14 14 15 TPM2_CC_FIRST = 0x01FF 15 TPM2_CC_FIRST = 0x01FF 16 16 17 TPM2_CC_CREATE_PRIMARY = 0x0131 17 TPM2_CC_CREATE_PRIMARY = 0x0131 18 TPM2_CC_DICTIONARY_ATTACK_LOCK_RESET = 0x0139 18 TPM2_CC_DICTIONARY_ATTACK_LOCK_RESET = 0x0139 19 TPM2_CC_CREATE = 0x0153 19 TPM2_CC_CREATE = 0x0153 20 TPM2_CC_LOAD = 0x0157 20 TPM2_CC_LOAD = 0x0157 21 TPM2_CC_UNSEAL = 0x015E 21 TPM2_CC_UNSEAL = 0x015E 22 TPM2_CC_FLUSH_CONTEXT = 0x0165 22 TPM2_CC_FLUSH_CONTEXT = 0x0165 23 TPM2_CC_START_AUTH_SESSION = 0x0176 23 TPM2_CC_START_AUTH_SESSION = 0x0176 24 TPM2_CC_GET_CAPABILITY = 0x017A 24 TPM2_CC_GET_CAPABILITY = 0x017A 25 TPM2_CC_GET_RANDOM = 0x017B 25 TPM2_CC_GET_RANDOM = 0x017B 26 TPM2_CC_PCR_READ = 0x017E 26 TPM2_CC_PCR_READ = 0x017E 27 TPM2_CC_POLICY_PCR = 0x017F 27 TPM2_CC_POLICY_PCR = 0x017F 28 TPM2_CC_PCR_EXTEND = 0x0182 28 TPM2_CC_PCR_EXTEND = 0x0182 29 TPM2_CC_POLICY_PASSWORD = 0x018C 29 TPM2_CC_POLICY_PASSWORD = 0x018C 30 TPM2_CC_POLICY_GET_DIGEST = 0x0189 30 TPM2_CC_POLICY_GET_DIGEST = 0x0189 31 31 32 TPM2_SE_POLICY = 0x01 32 TPM2_SE_POLICY = 0x01 33 TPM2_SE_TRIAL = 0x03 33 TPM2_SE_TRIAL = 0x03 34 34 35 TPM2_ALG_RSA = 0x0001 35 TPM2_ALG_RSA = 0x0001 36 TPM2_ALG_SHA1 = 0x0004 36 TPM2_ALG_SHA1 = 0x0004 37 TPM2_ALG_AES = 0x0006 37 TPM2_ALG_AES = 0x0006 38 TPM2_ALG_KEYEDHASH = 0x0008 38 TPM2_ALG_KEYEDHASH = 0x0008 39 TPM2_ALG_SHA256 = 0x000B 39 TPM2_ALG_SHA256 = 0x000B 40 TPM2_ALG_NULL = 0x0010 40 TPM2_ALG_NULL = 0x0010 41 TPM2_ALG_CBC = 0x0042 41 TPM2_ALG_CBC = 0x0042 42 TPM2_ALG_CFB = 0x0043 42 TPM2_ALG_CFB = 0x0043 43 43 44 TPM2_RH_OWNER = 0x40000001 44 TPM2_RH_OWNER = 0x40000001 45 TPM2_RH_NULL = 0x40000007 45 TPM2_RH_NULL = 0x40000007 46 TPM2_RH_LOCKOUT = 0x4000000A 46 TPM2_RH_LOCKOUT = 0x4000000A 47 TPM2_RS_PW = 0x40000009 47 TPM2_RS_PW = 0x40000009 48 48 49 TPM2_RC_SIZE = 0x01D5 49 TPM2_RC_SIZE = 0x01D5 50 TPM2_RC_AUTH_FAIL = 0x098E 50 TPM2_RC_AUTH_FAIL = 0x098E 51 TPM2_RC_POLICY_FAIL = 0x099D 51 TPM2_RC_POLICY_FAIL = 0x099D 52 TPM2_RC_COMMAND_CODE = 0x0143 52 TPM2_RC_COMMAND_CODE = 0x0143 53 53 54 TSS2_RC_LAYER_SHIFT = 16 54 TSS2_RC_LAYER_SHIFT = 16 55 TSS2_RESMGR_TPM_RC_LAYER = (11 << TSS2_RC_LAYE 55 TSS2_RESMGR_TPM_RC_LAYER = (11 << TSS2_RC_LAYER_SHIFT) 56 56 57 TPM2_CAP_HANDLES = 0x00000001 57 TPM2_CAP_HANDLES = 0x00000001 58 TPM2_CAP_COMMANDS = 0x00000002 58 TPM2_CAP_COMMANDS = 0x00000002 59 TPM2_CAP_PCRS = 0x00000005 59 TPM2_CAP_PCRS = 0x00000005 60 TPM2_CAP_TPM_PROPERTIES = 0x00000006 60 TPM2_CAP_TPM_PROPERTIES = 0x00000006 61 61 62 TPM2_PT_FIXED = 0x100 62 TPM2_PT_FIXED = 0x100 63 TPM2_PT_TOTAL_COMMANDS = TPM2_PT_FIXED + 41 63 TPM2_PT_TOTAL_COMMANDS = TPM2_PT_FIXED + 41 64 64 65 HR_SHIFT = 24 65 HR_SHIFT = 24 66 HR_LOADED_SESSION = 0x02000000 66 HR_LOADED_SESSION = 0x02000000 67 HR_TRANSIENT = 0x80000000 67 HR_TRANSIENT = 0x80000000 68 68 69 SHA1_DIGEST_SIZE = 20 69 SHA1_DIGEST_SIZE = 20 70 SHA256_DIGEST_SIZE = 32 70 SHA256_DIGEST_SIZE = 32 71 71 72 TPM2_VER0_ERRORS = { 72 TPM2_VER0_ERRORS = { 73 0x000: "TPM_RC_SUCCESS", 73 0x000: "TPM_RC_SUCCESS", 74 0x030: "TPM_RC_BAD_TAG", 74 0x030: "TPM_RC_BAD_TAG", 75 } 75 } 76 76 77 TPM2_VER1_ERRORS = { 77 TPM2_VER1_ERRORS = { 78 0x000: "TPM_RC_FAILURE", 78 0x000: "TPM_RC_FAILURE", 79 0x001: "TPM_RC_FAILURE", 79 0x001: "TPM_RC_FAILURE", 80 0x003: "TPM_RC_SEQUENCE", 80 0x003: "TPM_RC_SEQUENCE", 81 0x00B: "TPM_RC_PRIVATE", 81 0x00B: "TPM_RC_PRIVATE", 82 0x019: "TPM_RC_HMAC", 82 0x019: "TPM_RC_HMAC", 83 0x020: "TPM_RC_DISABLED", 83 0x020: "TPM_RC_DISABLED", 84 0x021: "TPM_RC_EXCLUSIVE", 84 0x021: "TPM_RC_EXCLUSIVE", 85 0x024: "TPM_RC_AUTH_TYPE", 85 0x024: "TPM_RC_AUTH_TYPE", 86 0x025: "TPM_RC_AUTH_MISSING", 86 0x025: "TPM_RC_AUTH_MISSING", 87 0x026: "TPM_RC_POLICY", 87 0x026: "TPM_RC_POLICY", 88 0x027: "TPM_RC_PCR", 88 0x027: "TPM_RC_PCR", 89 0x028: "TPM_RC_PCR_CHANGED", 89 0x028: "TPM_RC_PCR_CHANGED", 90 0x02D: "TPM_RC_UPGRADE", 90 0x02D: "TPM_RC_UPGRADE", 91 0x02E: "TPM_RC_TOO_MANY_CONTEXTS", 91 0x02E: "TPM_RC_TOO_MANY_CONTEXTS", 92 0x02F: "TPM_RC_AUTH_UNAVAILABLE", 92 0x02F: "TPM_RC_AUTH_UNAVAILABLE", 93 0x030: "TPM_RC_REBOOT", 93 0x030: "TPM_RC_REBOOT", 94 0x031: "TPM_RC_UNBALANCED", 94 0x031: "TPM_RC_UNBALANCED", 95 0x042: "TPM_RC_COMMAND_SIZE", 95 0x042: "TPM_RC_COMMAND_SIZE", 96 0x043: "TPM_RC_COMMAND_CODE", 96 0x043: "TPM_RC_COMMAND_CODE", 97 0x044: "TPM_RC_AUTHSIZE", 97 0x044: "TPM_RC_AUTHSIZE", 98 0x045: "TPM_RC_AUTH_CONTEXT", 98 0x045: "TPM_RC_AUTH_CONTEXT", 99 0x046: "TPM_RC_NV_RANGE", 99 0x046: "TPM_RC_NV_RANGE", 100 0x047: "TPM_RC_NV_SIZE", 100 0x047: "TPM_RC_NV_SIZE", 101 0x048: "TPM_RC_NV_LOCKED", 101 0x048: "TPM_RC_NV_LOCKED", 102 0x049: "TPM_RC_NV_AUTHORIZATION", 102 0x049: "TPM_RC_NV_AUTHORIZATION", 103 0x04A: "TPM_RC_NV_UNINITIALIZED", 103 0x04A: "TPM_RC_NV_UNINITIALIZED", 104 0x04B: "TPM_RC_NV_SPACE", 104 0x04B: "TPM_RC_NV_SPACE", 105 0x04C: "TPM_RC_NV_DEFINED", 105 0x04C: "TPM_RC_NV_DEFINED", 106 0x050: "TPM_RC_BAD_CONTEXT", 106 0x050: "TPM_RC_BAD_CONTEXT", 107 0x051: "TPM_RC_CPHASH", 107 0x051: "TPM_RC_CPHASH", 108 0x052: "TPM_RC_PARENT", 108 0x052: "TPM_RC_PARENT", 109 0x053: "TPM_RC_NEEDS_TEST", 109 0x053: "TPM_RC_NEEDS_TEST", 110 0x054: "TPM_RC_NO_RESULT", 110 0x054: "TPM_RC_NO_RESULT", 111 0x055: "TPM_RC_SENSITIVE", 111 0x055: "TPM_RC_SENSITIVE", 112 0x07F: "RC_MAX_FM0", 112 0x07F: "RC_MAX_FM0", 113 } 113 } 114 114 115 TPM2_FMT1_ERRORS = { 115 TPM2_FMT1_ERRORS = { 116 0x001: "TPM_RC_ASYMMETRIC", 116 0x001: "TPM_RC_ASYMMETRIC", 117 0x002: "TPM_RC_ATTRIBUTES", 117 0x002: "TPM_RC_ATTRIBUTES", 118 0x003: "TPM_RC_HASH", 118 0x003: "TPM_RC_HASH", 119 0x004: "TPM_RC_VALUE", 119 0x004: "TPM_RC_VALUE", 120 0x005: "TPM_RC_HIERARCHY", 120 0x005: "TPM_RC_HIERARCHY", 121 0x007: "TPM_RC_KEY_SIZE", 121 0x007: "TPM_RC_KEY_SIZE", 122 0x008: "TPM_RC_MGF", 122 0x008: "TPM_RC_MGF", 123 0x009: "TPM_RC_MODE", 123 0x009: "TPM_RC_MODE", 124 0x00A: "TPM_RC_TYPE", 124 0x00A: "TPM_RC_TYPE", 125 0x00B: "TPM_RC_HANDLE", 125 0x00B: "TPM_RC_HANDLE", 126 0x00C: "TPM_RC_KDF", 126 0x00C: "TPM_RC_KDF", 127 0x00D: "TPM_RC_RANGE", 127 0x00D: "TPM_RC_RANGE", 128 0x00E: "TPM_RC_AUTH_FAIL", 128 0x00E: "TPM_RC_AUTH_FAIL", 129 0x00F: "TPM_RC_NONCE", 129 0x00F: "TPM_RC_NONCE", 130 0x010: "TPM_RC_PP", 130 0x010: "TPM_RC_PP", 131 0x012: "TPM_RC_SCHEME", 131 0x012: "TPM_RC_SCHEME", 132 0x015: "TPM_RC_SIZE", 132 0x015: "TPM_RC_SIZE", 133 0x016: "TPM_RC_SYMMETRIC", 133 0x016: "TPM_RC_SYMMETRIC", 134 0x017: "TPM_RC_TAG", 134 0x017: "TPM_RC_TAG", 135 0x018: "TPM_RC_SELECTOR", 135 0x018: "TPM_RC_SELECTOR", 136 0x01A: "TPM_RC_INSUFFICIENT", 136 0x01A: "TPM_RC_INSUFFICIENT", 137 0x01B: "TPM_RC_SIGNATURE", 137 0x01B: "TPM_RC_SIGNATURE", 138 0x01C: "TPM_RC_KEY", 138 0x01C: "TPM_RC_KEY", 139 0x01D: "TPM_RC_POLICY_FAIL", 139 0x01D: "TPM_RC_POLICY_FAIL", 140 0x01F: "TPM_RC_INTEGRITY", 140 0x01F: "TPM_RC_INTEGRITY", 141 0x020: "TPM_RC_TICKET", 141 0x020: "TPM_RC_TICKET", 142 0x021: "TPM_RC_RESERVED_BITS", 142 0x021: "TPM_RC_RESERVED_BITS", 143 0x022: "TPM_RC_BAD_AUTH", 143 0x022: "TPM_RC_BAD_AUTH", 144 0x023: "TPM_RC_EXPIRED", 144 0x023: "TPM_RC_EXPIRED", 145 0x024: "TPM_RC_POLICY_CC", 145 0x024: "TPM_RC_POLICY_CC", 146 0x025: "TPM_RC_BINDING", 146 0x025: "TPM_RC_BINDING", 147 0x026: "TPM_RC_CURVE", 147 0x026: "TPM_RC_CURVE", 148 0x027: "TPM_RC_ECC_POINT", 148 0x027: "TPM_RC_ECC_POINT", 149 } 149 } 150 150 151 TPM2_WARN_ERRORS = { 151 TPM2_WARN_ERRORS = { 152 0x001: "TPM_RC_CONTEXT_GAP", 152 0x001: "TPM_RC_CONTEXT_GAP", 153 0x002: "TPM_RC_OBJECT_MEMORY", 153 0x002: "TPM_RC_OBJECT_MEMORY", 154 0x003: "TPM_RC_SESSION_MEMORY", 154 0x003: "TPM_RC_SESSION_MEMORY", 155 0x004: "TPM_RC_MEMORY", 155 0x004: "TPM_RC_MEMORY", 156 0x005: "TPM_RC_SESSION_HANDLES", 156 0x005: "TPM_RC_SESSION_HANDLES", 157 0x006: "TPM_RC_OBJECT_HANDLES", 157 0x006: "TPM_RC_OBJECT_HANDLES", 158 0x007: "TPM_RC_LOCALITY", 158 0x007: "TPM_RC_LOCALITY", 159 0x008: "TPM_RC_YIELDED", 159 0x008: "TPM_RC_YIELDED", 160 0x009: "TPM_RC_CANCELED", 160 0x009: "TPM_RC_CANCELED", 161 0x00A: "TPM_RC_TESTING", 161 0x00A: "TPM_RC_TESTING", 162 0x010: "TPM_RC_REFERENCE_H0", 162 0x010: "TPM_RC_REFERENCE_H0", 163 0x011: "TPM_RC_REFERENCE_H1", 163 0x011: "TPM_RC_REFERENCE_H1", 164 0x012: "TPM_RC_REFERENCE_H2", 164 0x012: "TPM_RC_REFERENCE_H2", 165 0x013: "TPM_RC_REFERENCE_H3", 165 0x013: "TPM_RC_REFERENCE_H3", 166 0x014: "TPM_RC_REFERENCE_H4", 166 0x014: "TPM_RC_REFERENCE_H4", 167 0x015: "TPM_RC_REFERENCE_H5", 167 0x015: "TPM_RC_REFERENCE_H5", 168 0x016: "TPM_RC_REFERENCE_H6", 168 0x016: "TPM_RC_REFERENCE_H6", 169 0x018: "TPM_RC_REFERENCE_S0", 169 0x018: "TPM_RC_REFERENCE_S0", 170 0x019: "TPM_RC_REFERENCE_S1", 170 0x019: "TPM_RC_REFERENCE_S1", 171 0x01A: "TPM_RC_REFERENCE_S2", 171 0x01A: "TPM_RC_REFERENCE_S2", 172 0x01B: "TPM_RC_REFERENCE_S3", 172 0x01B: "TPM_RC_REFERENCE_S3", 173 0x01C: "TPM_RC_REFERENCE_S4", 173 0x01C: "TPM_RC_REFERENCE_S4", 174 0x01D: "TPM_RC_REFERENCE_S5", 174 0x01D: "TPM_RC_REFERENCE_S5", 175 0x01E: "TPM_RC_REFERENCE_S6", 175 0x01E: "TPM_RC_REFERENCE_S6", 176 0x020: "TPM_RC_NV_RATE", 176 0x020: "TPM_RC_NV_RATE", 177 0x021: "TPM_RC_LOCKOUT", 177 0x021: "TPM_RC_LOCKOUT", 178 0x022: "TPM_RC_RETRY", 178 0x022: "TPM_RC_RETRY", 179 0x023: "TPM_RC_NV_UNAVAILABLE", 179 0x023: "TPM_RC_NV_UNAVAILABLE", 180 0x7F: "TPM_RC_NOT_USED", 180 0x7F: "TPM_RC_NOT_USED", 181 } 181 } 182 182 183 RC_VER1 = 0x100 183 RC_VER1 = 0x100 184 RC_FMT1 = 0x080 184 RC_FMT1 = 0x080 185 RC_WARN = 0x900 185 RC_WARN = 0x900 186 186 187 ALG_DIGEST_SIZE_MAP = { 187 ALG_DIGEST_SIZE_MAP = { 188 TPM2_ALG_SHA1: SHA1_DIGEST_SIZE, 188 TPM2_ALG_SHA1: SHA1_DIGEST_SIZE, 189 TPM2_ALG_SHA256: SHA256_DIGEST_SIZE, 189 TPM2_ALG_SHA256: SHA256_DIGEST_SIZE, 190 } 190 } 191 191 192 ALG_HASH_FUNCTION_MAP = { 192 ALG_HASH_FUNCTION_MAP = { 193 TPM2_ALG_SHA1: hashlib.sha1, 193 TPM2_ALG_SHA1: hashlib.sha1, 194 TPM2_ALG_SHA256: hashlib.sha256 194 TPM2_ALG_SHA256: hashlib.sha256 195 } 195 } 196 196 197 NAME_ALG_MAP = { 197 NAME_ALG_MAP = { 198 "sha1": TPM2_ALG_SHA1, 198 "sha1": TPM2_ALG_SHA1, 199 "sha256": TPM2_ALG_SHA256, 199 "sha256": TPM2_ALG_SHA256, 200 } 200 } 201 201 202 202 203 class UnknownAlgorithmIdError(Exception): 203 class UnknownAlgorithmIdError(Exception): 204 def __init__(self, alg): 204 def __init__(self, alg): 205 self.alg = alg 205 self.alg = alg 206 206 207 def __str__(self): 207 def __str__(self): 208 return '0x%0x' % (alg) 208 return '0x%0x' % (alg) 209 209 210 210 211 class UnknownAlgorithmNameError(Exception): 211 class UnknownAlgorithmNameError(Exception): 212 def __init__(self, name): 212 def __init__(self, name): 213 self.name = name 213 self.name = name 214 214 215 def __str__(self): 215 def __str__(self): 216 return name 216 return name 217 217 218 218 219 class UnknownPCRBankError(Exception): 219 class UnknownPCRBankError(Exception): 220 def __init__(self, alg): 220 def __init__(self, alg): 221 self.alg = alg 221 self.alg = alg 222 222 223 def __str__(self): 223 def __str__(self): 224 return '0x%0x' % (alg) 224 return '0x%0x' % (alg) 225 225 226 226 227 class ProtocolError(Exception): 227 class ProtocolError(Exception): 228 def __init__(self, cc, rc): 228 def __init__(self, cc, rc): 229 self.cc = cc 229 self.cc = cc 230 self.rc = rc 230 self.rc = rc 231 231 232 if (rc & RC_FMT1) == RC_FMT1: 232 if (rc & RC_FMT1) == RC_FMT1: 233 self.name = TPM2_FMT1_ERRORS.get(r 233 self.name = TPM2_FMT1_ERRORS.get(rc & 0x3f, "TPM_RC_UNKNOWN") 234 elif (rc & RC_WARN) == RC_WARN: 234 elif (rc & RC_WARN) == RC_WARN: 235 self.name = TPM2_WARN_ERRORS.get(r 235 self.name = TPM2_WARN_ERRORS.get(rc & 0x7f, "TPM_RC_UNKNOWN") 236 elif (rc & RC_VER1) == RC_VER1: 236 elif (rc & RC_VER1) == RC_VER1: 237 self.name = TPM2_VER1_ERRORS.get(r 237 self.name = TPM2_VER1_ERRORS.get(rc & 0x7f, "TPM_RC_UNKNOWN") 238 else: 238 else: 239 self.name = TPM2_VER0_ERRORS.get(r 239 self.name = TPM2_VER0_ERRORS.get(rc & 0x7f, "TPM_RC_UNKNOWN") 240 240 241 def __str__(self): 241 def __str__(self): 242 if self.cc: 242 if self.cc: 243 return '%s: cc=0x%08x, rc=0x%08x' 243 return '%s: cc=0x%08x, rc=0x%08x' % (self.name, self.cc, self.rc) 244 else: 244 else: 245 return '%s: rc=0x%08x' % (self.nam 245 return '%s: rc=0x%08x' % (self.name, self.rc) 246 246 247 247 248 class AuthCommand(object): 248 class AuthCommand(object): 249 """TPMS_AUTH_COMMAND""" 249 """TPMS_AUTH_COMMAND""" 250 250 251 def __init__(self, session_handle=TPM2_RS_ 251 def __init__(self, session_handle=TPM2_RS_PW, nonce=bytes(), 252 session_attributes=0, hmac=by 252 session_attributes=0, hmac=bytes()): 253 self.session_handle = session_handle 253 self.session_handle = session_handle 254 self.nonce = nonce 254 self.nonce = nonce 255 self.session_attributes = session_attr 255 self.session_attributes = session_attributes 256 self.hmac = hmac 256 self.hmac = hmac 257 257 258 def __bytes__(self): 258 def __bytes__(self): 259 fmt = '>I H%us B H%us' % (len(self.non 259 fmt = '>I H%us B H%us' % (len(self.nonce), len(self.hmac)) 260 return struct.pack(fmt, self.session_h 260 return struct.pack(fmt, self.session_handle, len(self.nonce), 261 self.nonce, self.se 261 self.nonce, self.session_attributes, len(self.hmac), 262 self.hmac) 262 self.hmac) 263 263 264 def __len__(self): 264 def __len__(self): 265 fmt = '>I H%us B H%us' % (len(self.non 265 fmt = '>I H%us B H%us' % (len(self.nonce), len(self.hmac)) 266 return struct.calcsize(fmt) 266 return struct.calcsize(fmt) 267 267 268 268 269 class SensitiveCreate(object): 269 class SensitiveCreate(object): 270 """TPMS_SENSITIVE_CREATE""" 270 """TPMS_SENSITIVE_CREATE""" 271 271 272 def __init__(self, user_auth=bytes(), data 272 def __init__(self, user_auth=bytes(), data=bytes()): 273 self.user_auth = user_auth 273 self.user_auth = user_auth 274 self.data = data 274 self.data = data 275 275 276 def __bytes__(self): 276 def __bytes__(self): 277 fmt = '>H%us H%us' % (len(self.user_au 277 fmt = '>H%us H%us' % (len(self.user_auth), len(self.data)) 278 return struct.pack(fmt, len(self.user_ 278 return struct.pack(fmt, len(self.user_auth), self.user_auth, 279 len(self.data), sel 279 len(self.data), self.data) 280 280 281 def __len__(self): 281 def __len__(self): 282 fmt = '>H%us H%us' % (len(self.user_au 282 fmt = '>H%us H%us' % (len(self.user_auth), len(self.data)) 283 return struct.calcsize(fmt) 283 return struct.calcsize(fmt) 284 284 285 285 286 class Public(object): 286 class Public(object): 287 """TPMT_PUBLIC""" 287 """TPMT_PUBLIC""" 288 288 289 FIXED_TPM = (1 << 1) 289 FIXED_TPM = (1 << 1) 290 FIXED_PARENT = (1 << 4) 290 FIXED_PARENT = (1 << 4) 291 SENSITIVE_DATA_ORIGIN = (1 << 5) 291 SENSITIVE_DATA_ORIGIN = (1 << 5) 292 USER_WITH_AUTH = (1 << 6) 292 USER_WITH_AUTH = (1 << 6) 293 RESTRICTED = (1 << 16) 293 RESTRICTED = (1 << 16) 294 DECRYPT = (1 << 17) 294 DECRYPT = (1 << 17) 295 295 296 def __fmt(self): 296 def __fmt(self): 297 return '>HHIH%us%usH%us' % \ 297 return '>HHIH%us%usH%us' % \ 298 (len(self.auth_policy), len(self.p 298 (len(self.auth_policy), len(self.parameters), len(self.unique)) 299 299 300 def __init__(self, object_type, name_alg, 300 def __init__(self, object_type, name_alg, object_attributes, 301 auth_policy=bytes(), paramete 301 auth_policy=bytes(), parameters=bytes(), 302 unique=bytes()): 302 unique=bytes()): 303 self.object_type = object_type 303 self.object_type = object_type 304 self.name_alg = name_alg 304 self.name_alg = name_alg 305 self.object_attributes = object_attrib 305 self.object_attributes = object_attributes 306 self.auth_policy = auth_policy 306 self.auth_policy = auth_policy 307 self.parameters = parameters 307 self.parameters = parameters 308 self.unique = unique 308 self.unique = unique 309 309 310 def __bytes__(self): 310 def __bytes__(self): 311 return struct.pack(self.__fmt(), 311 return struct.pack(self.__fmt(), 312 self.object_type, 312 self.object_type, 313 self.name_alg, 313 self.name_alg, 314 self.object_attribu 314 self.object_attributes, 315 len(self.auth_polic 315 len(self.auth_policy), 316 self.auth_policy, 316 self.auth_policy, 317 self.parameters, 317 self.parameters, 318 len(self.unique), 318 len(self.unique), 319 self.unique) 319 self.unique) 320 320 321 def __len__(self): 321 def __len__(self): 322 return struct.calcsize(self.__fmt()) 322 return struct.calcsize(self.__fmt()) 323 323 324 324 325 def get_digest_size(alg): 325 def get_digest_size(alg): 326 ds = ALG_DIGEST_SIZE_MAP.get(alg) 326 ds = ALG_DIGEST_SIZE_MAP.get(alg) 327 if not ds: 327 if not ds: 328 raise UnknownAlgorithmIdError(alg) 328 raise UnknownAlgorithmIdError(alg) 329 return ds 329 return ds 330 330 331 331 332 def get_hash_function(alg): 332 def get_hash_function(alg): 333 f = ALG_HASH_FUNCTION_MAP.get(alg) 333 f = ALG_HASH_FUNCTION_MAP.get(alg) 334 if not f: 334 if not f: 335 raise UnknownAlgorithmIdError(alg) 335 raise UnknownAlgorithmIdError(alg) 336 return f 336 return f 337 337 338 338 339 def get_algorithm(name): 339 def get_algorithm(name): 340 alg = NAME_ALG_MAP.get(name) 340 alg = NAME_ALG_MAP.get(name) 341 if not alg: 341 if not alg: 342 raise UnknownAlgorithmNameError(name) 342 raise UnknownAlgorithmNameError(name) 343 return alg 343 return alg 344 344 345 345 346 def hex_dump(d): 346 def hex_dump(d): 347 d = [format(x, '02x') for x in d] !! 347 d = [format(ord(x), '02x') for x in d] 348 d = [d[i: i + 16] for i in range(0, len(d) 348 d = [d[i: i + 16] for i in range(0, len(d), 16)] 349 d = [' '.join(x) for x in d] 349 d = [' '.join(x) for x in d] 350 d = os.linesep.join(d) 350 d = os.linesep.join(d) 351 351 352 return d 352 return d 353 353 354 class Client: 354 class Client: 355 FLAG_DEBUG = 0x01 355 FLAG_DEBUG = 0x01 356 FLAG_SPACE = 0x02 356 FLAG_SPACE = 0x02 357 FLAG_NONBLOCK = 0x04 357 FLAG_NONBLOCK = 0x04 358 TPM_IOC_NEW_SPACE = 0xa200 358 TPM_IOC_NEW_SPACE = 0xa200 359 359 360 def __init__(self, flags = 0): 360 def __init__(self, flags = 0): 361 self.flags = flags 361 self.flags = flags 362 362 363 if (self.flags & Client.FLAG_SPACE) == 363 if (self.flags & Client.FLAG_SPACE) == 0: 364 self.tpm = open('/dev/tpm0', 'r+b' 364 self.tpm = open('/dev/tpm0', 'r+b', buffering=0) 365 else: 365 else: 366 self.tpm = open('/dev/tpmrm0', 'r+ 366 self.tpm = open('/dev/tpmrm0', 'r+b', buffering=0) 367 367 368 if (self.flags & Client.FLAG_NONBLOCK) 368 if (self.flags & Client.FLAG_NONBLOCK): 369 flags = fcntl.fcntl(self.tpm, fcnt 369 flags = fcntl.fcntl(self.tpm, fcntl.F_GETFL) 370 flags |= os.O_NONBLOCK 370 flags |= os.O_NONBLOCK 371 fcntl.fcntl(self.tpm, fcntl.F_SETF 371 fcntl.fcntl(self.tpm, fcntl.F_SETFL, flags) 372 self.tpm_poll = select.poll() 372 self.tpm_poll = select.poll() 373 << 374 def __del__(self): << 375 if self.tpm: << 376 self.tpm.close() << 377 373 378 def close(self): 374 def close(self): 379 self.tpm.close() 375 self.tpm.close() 380 376 381 def send_cmd(self, cmd): 377 def send_cmd(self, cmd): 382 self.tpm.write(cmd) 378 self.tpm.write(cmd) 383 379 384 if (self.flags & Client.FLAG_NONBLOCK) 380 if (self.flags & Client.FLAG_NONBLOCK): 385 self.tpm_poll.register(self.tpm, s 381 self.tpm_poll.register(self.tpm, select.POLLIN) 386 self.tpm_poll.poll(10000) 382 self.tpm_poll.poll(10000) 387 383 388 rsp = self.tpm.read() 384 rsp = self.tpm.read() 389 385 390 if (self.flags & Client.FLAG_NONBLOCK) 386 if (self.flags & Client.FLAG_NONBLOCK): 391 self.tpm_poll.unregister(self.tpm) 387 self.tpm_poll.unregister(self.tpm) 392 388 393 if (self.flags & Client.FLAG_DEBUG) != 389 if (self.flags & Client.FLAG_DEBUG) != 0: 394 sys.stderr.write('cmd' + os.linese 390 sys.stderr.write('cmd' + os.linesep) 395 sys.stderr.write(hex_dump(cmd) + o 391 sys.stderr.write(hex_dump(cmd) + os.linesep) 396 sys.stderr.write('rsp' + os.linese 392 sys.stderr.write('rsp' + os.linesep) 397 sys.stderr.write(hex_dump(rsp) + o 393 sys.stderr.write(hex_dump(rsp) + os.linesep) 398 394 399 rc = struct.unpack('>I', rsp[6:10])[0] 395 rc = struct.unpack('>I', rsp[6:10])[0] 400 if rc != 0: 396 if rc != 0: 401 cc = struct.unpack('>I', cmd[6:10] 397 cc = struct.unpack('>I', cmd[6:10])[0] 402 raise ProtocolError(cc, rc) 398 raise ProtocolError(cc, rc) 403 399 404 return rsp 400 return rsp 405 401 406 def read_pcr(self, i, bank_alg = TPM2_ALG_ 402 def read_pcr(self, i, bank_alg = TPM2_ALG_SHA1): 407 pcrsel_len = max((i >> 3) + 1, 3) 403 pcrsel_len = max((i >> 3) + 1, 3) 408 pcrsel = [0] * pcrsel_len 404 pcrsel = [0] * pcrsel_len 409 pcrsel[i >> 3] = 1 << (i & 7) 405 pcrsel[i >> 3] = 1 << (i & 7) 410 pcrsel = ''.join(map(chr, pcrsel)).enc 406 pcrsel = ''.join(map(chr, pcrsel)).encode() 411 407 412 fmt = '>HII IHB%us' % (pcrsel_len) 408 fmt = '>HII IHB%us' % (pcrsel_len) 413 cmd = struct.pack(fmt, 409 cmd = struct.pack(fmt, 414 TPM2_ST_NO_SESSIONS, 410 TPM2_ST_NO_SESSIONS, 415 struct.calcsize(fmt) 411 struct.calcsize(fmt), 416 TPM2_CC_PCR_READ, 412 TPM2_CC_PCR_READ, 417 1, 413 1, 418 bank_alg, 414 bank_alg, 419 pcrsel_len, pcrsel) 415 pcrsel_len, pcrsel) 420 416 421 rsp = self.send_cmd(cmd) 417 rsp = self.send_cmd(cmd) 422 418 423 pcr_update_cnt, pcr_select_cnt = struc 419 pcr_update_cnt, pcr_select_cnt = struct.unpack('>II', rsp[10:18]) 424 assert pcr_select_cnt == 1 420 assert pcr_select_cnt == 1 425 rsp = rsp[18:] 421 rsp = rsp[18:] 426 422 427 alg2, pcrsel_len2 = struct.unpack('>HB 423 alg2, pcrsel_len2 = struct.unpack('>HB', rsp[:3]) 428 assert bank_alg == alg2 and pcrsel_len 424 assert bank_alg == alg2 and pcrsel_len == pcrsel_len2 429 rsp = rsp[3 + pcrsel_len:] 425 rsp = rsp[3 + pcrsel_len:] 430 426 431 digest_cnt = struct.unpack('>I', rsp[: 427 digest_cnt = struct.unpack('>I', rsp[:4])[0] 432 if digest_cnt == 0: 428 if digest_cnt == 0: 433 return None 429 return None 434 rsp = rsp[6:] 430 rsp = rsp[6:] 435 431 436 return rsp 432 return rsp 437 433 438 def extend_pcr(self, i, dig, bank_alg = TP 434 def extend_pcr(self, i, dig, bank_alg = TPM2_ALG_SHA1): 439 ds = get_digest_size(bank_alg) 435 ds = get_digest_size(bank_alg) 440 assert(ds == len(dig)) 436 assert(ds == len(dig)) 441 437 442 auth_cmd = AuthCommand() 438 auth_cmd = AuthCommand() 443 439 444 fmt = '>HII I I%us IH%us' % (len(auth_ 440 fmt = '>HII I I%us IH%us' % (len(auth_cmd), ds) 445 cmd = struct.pack( 441 cmd = struct.pack( 446 fmt, 442 fmt, 447 TPM2_ST_SESSIONS, 443 TPM2_ST_SESSIONS, 448 struct.calcsize(fmt), 444 struct.calcsize(fmt), 449 TPM2_CC_PCR_EXTEND, 445 TPM2_CC_PCR_EXTEND, 450 i, 446 i, 451 len(auth_cmd), 447 len(auth_cmd), 452 bytes(auth_cmd), 448 bytes(auth_cmd), 453 1, bank_alg, dig) 449 1, bank_alg, dig) 454 450 455 self.send_cmd(cmd) 451 self.send_cmd(cmd) 456 452 457 def start_auth_session(self, session_type, 453 def start_auth_session(self, session_type, name_alg = TPM2_ALG_SHA1): 458 fmt = '>HII IIH16sHBHH' 454 fmt = '>HII IIH16sHBHH' 459 cmd = struct.pack(fmt, 455 cmd = struct.pack(fmt, 460 TPM2_ST_NO_SESSIONS, 456 TPM2_ST_NO_SESSIONS, 461 struct.calcsize(fmt) 457 struct.calcsize(fmt), 462 TPM2_CC_START_AUTH_S 458 TPM2_CC_START_AUTH_SESSION, 463 TPM2_RH_NULL, 459 TPM2_RH_NULL, 464 TPM2_RH_NULL, 460 TPM2_RH_NULL, 465 16, 461 16, 466 ('\0' * 16).encode() 462 ('\0' * 16).encode(), 467 0, 463 0, 468 session_type, 464 session_type, 469 TPM2_ALG_NULL, 465 TPM2_ALG_NULL, 470 name_alg) 466 name_alg) 471 467 472 return struct.unpack('>I', self.send_c 468 return struct.unpack('>I', self.send_cmd(cmd)[10:14])[0] 473 469 474 def __calc_pcr_digest(self, pcrs, bank_alg 470 def __calc_pcr_digest(self, pcrs, bank_alg = TPM2_ALG_SHA1, 475 digest_alg = TPM2_AL 471 digest_alg = TPM2_ALG_SHA1): 476 x = [] 472 x = [] 477 f = get_hash_function(digest_alg) 473 f = get_hash_function(digest_alg) 478 474 479 for i in pcrs: 475 for i in pcrs: 480 pcr = self.read_pcr(i, bank_alg) 476 pcr = self.read_pcr(i, bank_alg) 481 if pcr is None: 477 if pcr is None: 482 return None 478 return None 483 x += pcr 479 x += pcr 484 480 485 return f(bytearray(x)).digest() 481 return f(bytearray(x)).digest() 486 482 487 def policy_pcr(self, handle, pcrs, bank_al 483 def policy_pcr(self, handle, pcrs, bank_alg = TPM2_ALG_SHA1, 488 name_alg = TPM2_ALG_SHA1): 484 name_alg = TPM2_ALG_SHA1): 489 ds = get_digest_size(name_alg) 485 ds = get_digest_size(name_alg) 490 dig = self.__calc_pcr_digest(pcrs, ban 486 dig = self.__calc_pcr_digest(pcrs, bank_alg, name_alg) 491 if not dig: 487 if not dig: 492 raise UnknownPCRBankError(bank_alg 488 raise UnknownPCRBankError(bank_alg) 493 489 494 pcrsel_len = max((max(pcrs) >> 3) + 1, 490 pcrsel_len = max((max(pcrs) >> 3) + 1, 3) 495 pcrsel = [0] * pcrsel_len 491 pcrsel = [0] * pcrsel_len 496 for i in pcrs: 492 for i in pcrs: 497 pcrsel[i >> 3] |= 1 << (i & 7) 493 pcrsel[i >> 3] |= 1 << (i & 7) 498 pcrsel = ''.join(map(chr, pcrsel)).enc 494 pcrsel = ''.join(map(chr, pcrsel)).encode() 499 495 500 fmt = '>HII IH%usIHB3s' % ds 496 fmt = '>HII IH%usIHB3s' % ds 501 cmd = struct.pack(fmt, 497 cmd = struct.pack(fmt, 502 TPM2_ST_NO_SESSIONS, 498 TPM2_ST_NO_SESSIONS, 503 struct.calcsize(fmt) 499 struct.calcsize(fmt), 504 TPM2_CC_POLICY_PCR, 500 TPM2_CC_POLICY_PCR, 505 handle, 501 handle, 506 len(dig), 502 len(dig), 507 bytes(dig), 503 bytes(dig), 508 1, 504 1, 509 bank_alg, 505 bank_alg, 510 pcrsel_len, pcrsel) 506 pcrsel_len, pcrsel) 511 507 512 self.send_cmd(cmd) 508 self.send_cmd(cmd) 513 509 514 def policy_password(self, handle): 510 def policy_password(self, handle): 515 fmt = '>HII I' 511 fmt = '>HII I' 516 cmd = struct.pack(fmt, 512 cmd = struct.pack(fmt, 517 TPM2_ST_NO_SESSIONS, 513 TPM2_ST_NO_SESSIONS, 518 struct.calcsize(fmt) 514 struct.calcsize(fmt), 519 TPM2_CC_POLICY_PASSW 515 TPM2_CC_POLICY_PASSWORD, 520 handle) 516 handle) 521 517 522 self.send_cmd(cmd) 518 self.send_cmd(cmd) 523 519 524 def get_policy_digest(self, handle): 520 def get_policy_digest(self, handle): 525 fmt = '>HII I' 521 fmt = '>HII I' 526 cmd = struct.pack(fmt, 522 cmd = struct.pack(fmt, 527 TPM2_ST_NO_SESSIONS, 523 TPM2_ST_NO_SESSIONS, 528 struct.calcsize(fmt) 524 struct.calcsize(fmt), 529 TPM2_CC_POLICY_GET_D 525 TPM2_CC_POLICY_GET_DIGEST, 530 handle) 526 handle) 531 527 532 return self.send_cmd(cmd)[12:] 528 return self.send_cmd(cmd)[12:] 533 529 534 def flush_context(self, handle): 530 def flush_context(self, handle): 535 fmt = '>HIII' 531 fmt = '>HIII' 536 cmd = struct.pack(fmt, 532 cmd = struct.pack(fmt, 537 TPM2_ST_NO_SESSIONS, 533 TPM2_ST_NO_SESSIONS, 538 struct.calcsize(fmt) 534 struct.calcsize(fmt), 539 TPM2_CC_FLUSH_CONTEX 535 TPM2_CC_FLUSH_CONTEXT, 540 handle) 536 handle) 541 537 542 self.send_cmd(cmd) 538 self.send_cmd(cmd) 543 539 544 def create_root_key(self, auth_value = byt 540 def create_root_key(self, auth_value = bytes()): 545 attributes = \ 541 attributes = \ 546 Public.FIXED_TPM | \ 542 Public.FIXED_TPM | \ 547 Public.FIXED_PARENT | \ 543 Public.FIXED_PARENT | \ 548 Public.SENSITIVE_DATA_ORIGIN | \ 544 Public.SENSITIVE_DATA_ORIGIN | \ 549 Public.USER_WITH_AUTH | \ 545 Public.USER_WITH_AUTH | \ 550 Public.RESTRICTED | \ 546 Public.RESTRICTED | \ 551 Public.DECRYPT 547 Public.DECRYPT 552 548 553 auth_cmd = AuthCommand() 549 auth_cmd = AuthCommand() 554 sensitive = SensitiveCreate(user_auth= 550 sensitive = SensitiveCreate(user_auth=auth_value) 555 551 556 public_parms = struct.pack( 552 public_parms = struct.pack( 557 '>HHHHHI', 553 '>HHHHHI', 558 TPM2_ALG_AES, 554 TPM2_ALG_AES, 559 128, 555 128, 560 TPM2_ALG_CFB, 556 TPM2_ALG_CFB, 561 TPM2_ALG_NULL, 557 TPM2_ALG_NULL, 562 2048, 558 2048, 563 0) 559 0) 564 560 565 public = Public( 561 public = Public( 566 object_type=TPM2_ALG_RSA, 562 object_type=TPM2_ALG_RSA, 567 name_alg=TPM2_ALG_SHA1, 563 name_alg=TPM2_ALG_SHA1, 568 object_attributes=attributes, 564 object_attributes=attributes, 569 parameters=public_parms) 565 parameters=public_parms) 570 566 571 fmt = '>HIII I%us H%us H%us HI' % \ 567 fmt = '>HIII I%us H%us H%us HI' % \ 572 (len(auth_cmd), len(sensitive), le 568 (len(auth_cmd), len(sensitive), len(public)) 573 cmd = struct.pack( 569 cmd = struct.pack( 574 fmt, 570 fmt, 575 TPM2_ST_SESSIONS, 571 TPM2_ST_SESSIONS, 576 struct.calcsize(fmt), 572 struct.calcsize(fmt), 577 TPM2_CC_CREATE_PRIMARY, 573 TPM2_CC_CREATE_PRIMARY, 578 TPM2_RH_OWNER, 574 TPM2_RH_OWNER, 579 len(auth_cmd), 575 len(auth_cmd), 580 bytes(auth_cmd), 576 bytes(auth_cmd), 581 len(sensitive), 577 len(sensitive), 582 bytes(sensitive), 578 bytes(sensitive), 583 len(public), 579 len(public), 584 bytes(public), 580 bytes(public), 585 0, 0) 581 0, 0) 586 582 587 return struct.unpack('>I', self.send_c 583 return struct.unpack('>I', self.send_cmd(cmd)[10:14])[0] 588 584 589 def seal(self, parent_key, data, auth_valu 585 def seal(self, parent_key, data, auth_value, policy_dig, 590 name_alg = TPM2_ALG_SHA1): 586 name_alg = TPM2_ALG_SHA1): 591 ds = get_digest_size(name_alg) 587 ds = get_digest_size(name_alg) 592 assert(not policy_dig or ds == len(pol 588 assert(not policy_dig or ds == len(policy_dig)) 593 589 594 attributes = 0 590 attributes = 0 595 if not policy_dig: 591 if not policy_dig: 596 attributes |= Public.USER_WITH_AUT 592 attributes |= Public.USER_WITH_AUTH 597 policy_dig = bytes() 593 policy_dig = bytes() 598 594 599 auth_cmd = AuthCommand() 595 auth_cmd = AuthCommand() 600 sensitive = SensitiveCreate(user_auth= 596 sensitive = SensitiveCreate(user_auth=auth_value, data=data) 601 597 602 public = Public( 598 public = Public( 603 object_type=TPM2_ALG_KEYEDHASH, 599 object_type=TPM2_ALG_KEYEDHASH, 604 name_alg=name_alg, 600 name_alg=name_alg, 605 object_attributes=attributes, 601 object_attributes=attributes, 606 auth_policy=policy_dig, 602 auth_policy=policy_dig, 607 parameters=struct.pack('>H', TPM2_ 603 parameters=struct.pack('>H', TPM2_ALG_NULL)) 608 604 609 fmt = '>HIII I%us H%us H%us HI' % \ 605 fmt = '>HIII I%us H%us H%us HI' % \ 610 (len(auth_cmd), len(sensitive), le 606 (len(auth_cmd), len(sensitive), len(public)) 611 cmd = struct.pack( 607 cmd = struct.pack( 612 fmt, 608 fmt, 613 TPM2_ST_SESSIONS, 609 TPM2_ST_SESSIONS, 614 struct.calcsize(fmt), 610 struct.calcsize(fmt), 615 TPM2_CC_CREATE, 611 TPM2_CC_CREATE, 616 parent_key, 612 parent_key, 617 len(auth_cmd), 613 len(auth_cmd), 618 bytes(auth_cmd), 614 bytes(auth_cmd), 619 len(sensitive), 615 len(sensitive), 620 bytes(sensitive), 616 bytes(sensitive), 621 len(public), 617 len(public), 622 bytes(public), 618 bytes(public), 623 0, 0) 619 0, 0) 624 620 625 rsp = self.send_cmd(cmd) 621 rsp = self.send_cmd(cmd) 626 622 627 return rsp[14:] 623 return rsp[14:] 628 624 629 def unseal(self, parent_key, blob, auth_va 625 def unseal(self, parent_key, blob, auth_value, policy_handle): 630 private_len = struct.unpack('>H', blob 626 private_len = struct.unpack('>H', blob[0:2])[0] 631 public_start = private_len + 2 627 public_start = private_len + 2 632 public_len = struct.unpack('>H', blob[ 628 public_len = struct.unpack('>H', blob[public_start:public_start + 2])[0] 633 blob = blob[:private_len + public_len 629 blob = blob[:private_len + public_len + 4] 634 630 635 auth_cmd = AuthCommand() 631 auth_cmd = AuthCommand() 636 632 637 fmt = '>HII I I%us %us' % (len(auth_cm 633 fmt = '>HII I I%us %us' % (len(auth_cmd), len(blob)) 638 cmd = struct.pack( 634 cmd = struct.pack( 639 fmt, 635 fmt, 640 TPM2_ST_SESSIONS, 636 TPM2_ST_SESSIONS, 641 struct.calcsize(fmt), 637 struct.calcsize(fmt), 642 TPM2_CC_LOAD, 638 TPM2_CC_LOAD, 643 parent_key, 639 parent_key, 644 len(auth_cmd), 640 len(auth_cmd), 645 bytes(auth_cmd), 641 bytes(auth_cmd), 646 blob) 642 blob) 647 643 648 data_handle = struct.unpack('>I', self 644 data_handle = struct.unpack('>I', self.send_cmd(cmd)[10:14])[0] 649 645 650 if policy_handle: 646 if policy_handle: 651 auth_cmd = AuthCommand(session_han 647 auth_cmd = AuthCommand(session_handle=policy_handle, hmac=auth_value) 652 else: 648 else: 653 auth_cmd = AuthCommand(hmac=auth_v 649 auth_cmd = AuthCommand(hmac=auth_value) 654 650 655 fmt = '>HII I I%us' % (len(auth_cmd)) 651 fmt = '>HII I I%us' % (len(auth_cmd)) 656 cmd = struct.pack( 652 cmd = struct.pack( 657 fmt, 653 fmt, 658 TPM2_ST_SESSIONS, 654 TPM2_ST_SESSIONS, 659 struct.calcsize(fmt), 655 struct.calcsize(fmt), 660 TPM2_CC_UNSEAL, 656 TPM2_CC_UNSEAL, 661 data_handle, 657 data_handle, 662 len(auth_cmd), 658 len(auth_cmd), 663 bytes(auth_cmd)) 659 bytes(auth_cmd)) 664 660 665 try: 661 try: 666 rsp = self.send_cmd(cmd) 662 rsp = self.send_cmd(cmd) 667 finally: 663 finally: 668 self.flush_context(data_handle) 664 self.flush_context(data_handle) 669 665 670 data_len = struct.unpack('>I', rsp[10: 666 data_len = struct.unpack('>I', rsp[10:14])[0] - 2 671 667 672 return rsp[16:16 + data_len] 668 return rsp[16:16 + data_len] 673 669 674 def reset_da_lock(self): 670 def reset_da_lock(self): 675 auth_cmd = AuthCommand() 671 auth_cmd = AuthCommand() 676 672 677 fmt = '>HII I I%us' % (len(auth_cmd)) 673 fmt = '>HII I I%us' % (len(auth_cmd)) 678 cmd = struct.pack( 674 cmd = struct.pack( 679 fmt, 675 fmt, 680 TPM2_ST_SESSIONS, 676 TPM2_ST_SESSIONS, 681 struct.calcsize(fmt), 677 struct.calcsize(fmt), 682 TPM2_CC_DICTIONARY_ATTACK_LOCK_RES 678 TPM2_CC_DICTIONARY_ATTACK_LOCK_RESET, 683 TPM2_RH_LOCKOUT, 679 TPM2_RH_LOCKOUT, 684 len(auth_cmd), 680 len(auth_cmd), 685 bytes(auth_cmd)) 681 bytes(auth_cmd)) 686 682 687 self.send_cmd(cmd) 683 self.send_cmd(cmd) 688 684 689 def __get_cap_cnt(self, cap, pt, cnt): 685 def __get_cap_cnt(self, cap, pt, cnt): 690 handles = [] 686 handles = [] 691 fmt = '>HII III' 687 fmt = '>HII III' 692 688 693 cmd = struct.pack(fmt, 689 cmd = struct.pack(fmt, 694 TPM2_ST_NO_SESSIONS, 690 TPM2_ST_NO_SESSIONS, 695 struct.calcsize(fmt) 691 struct.calcsize(fmt), 696 TPM2_CC_GET_CAPABILI 692 TPM2_CC_GET_CAPABILITY, 697 cap, pt, cnt) 693 cap, pt, cnt) 698 694 699 rsp = self.send_cmd(cmd)[10:] 695 rsp = self.send_cmd(cmd)[10:] 700 more_data, cap, cnt = struct.unpack('> 696 more_data, cap, cnt = struct.unpack('>BII', rsp[:9]) 701 rsp = rsp[9:] 697 rsp = rsp[9:] 702 698 703 for i in range(0, cnt): 699 for i in range(0, cnt): 704 handle = struct.unpack('>I', rsp[: 700 handle = struct.unpack('>I', rsp[:4])[0] 705 handles.append(handle) 701 handles.append(handle) 706 rsp = rsp[4:] 702 rsp = rsp[4:] 707 703 708 return handles, more_data 704 return handles, more_data 709 705 710 def get_cap(self, cap, pt): 706 def get_cap(self, cap, pt): 711 handles = [] 707 handles = [] 712 708 713 more_data = True 709 more_data = True 714 while more_data: 710 while more_data: 715 next_handles, more_data = self.__g 711 next_handles, more_data = self.__get_cap_cnt(cap, pt, 1) 716 handles += next_handles 712 handles += next_handles 717 pt += 1 713 pt += 1 718 714 719 return handles 715 return handles 720 716 721 def get_cap_pcrs(self): 717 def get_cap_pcrs(self): 722 pcr_banks = {} 718 pcr_banks = {} 723 719 724 fmt = '>HII III' 720 fmt = '>HII III' 725 721 726 cmd = struct.pack(fmt, 722 cmd = struct.pack(fmt, 727 TPM2_ST_NO_SESSIONS, 723 TPM2_ST_NO_SESSIONS, 728 struct.calcsize(fmt) 724 struct.calcsize(fmt), 729 TPM2_CC_GET_CAPABILI 725 TPM2_CC_GET_CAPABILITY, 730 TPM2_CAP_PCRS, 0, 1) 726 TPM2_CAP_PCRS, 0, 1) 731 rsp = self.send_cmd(cmd)[10:] 727 rsp = self.send_cmd(cmd)[10:] 732 _, _, cnt = struct.unpack('>BII', rsp[ 728 _, _, cnt = struct.unpack('>BII', rsp[:9]) 733 rsp = rsp[9:] 729 rsp = rsp[9:] 734 730 735 # items are TPMS_PCR_SELECTION's 731 # items are TPMS_PCR_SELECTION's 736 for i in range(0, cnt): 732 for i in range(0, cnt): 737 hash, sizeOfSelect = struct.unpa 733 hash, sizeOfSelect = struct.unpack('>HB', rsp[:3]) 738 rsp = rsp[3:] 734 rsp = rsp[3:] 739 735 740 pcrSelect = 0 736 pcrSelect = 0 741 if sizeOfSelect > 0: 737 if sizeOfSelect > 0: 742 pcrSelect, = struct.unpack(' 738 pcrSelect, = struct.unpack('%ds' % sizeOfSelect, 743 r 739 rsp[:sizeOfSelect]) 744 rsp = rsp[sizeOfSelect:] 740 rsp = rsp[sizeOfSelect:] 745 pcrSelect = int.from_bytes(p 741 pcrSelect = int.from_bytes(pcrSelect, byteorder='big') 746 742 747 pcr_banks[hash] = pcrSelect 743 pcr_banks[hash] = pcrSelect 748 744 749 return pcr_banks 745 return pcr_banks
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.