1 # SPDX-License-Identifier: (GPL-2.0 OR BSD-3-C 1 # SPDX-License-Identifier: (GPL-2.0 OR BSD-3-Clause)
2 2
3 import hashlib 3 import hashlib
4 import os 4 import os
5 import socket 5 import socket
6 import struct 6 import struct
7 import sys 7 import sys
8 import unittest 8 import unittest
9 import fcntl 9 import fcntl
10 import select 10 import select
11 11
12 TPM2_ST_NO_SESSIONS = 0x8001 12 TPM2_ST_NO_SESSIONS = 0x8001
13 TPM2_ST_SESSIONS = 0x8002 13 TPM2_ST_SESSIONS = 0x8002
14 14
15 TPM2_CC_FIRST = 0x01FF 15 TPM2_CC_FIRST = 0x01FF
16 16
17 TPM2_CC_CREATE_PRIMARY = 0x0131 17 TPM2_CC_CREATE_PRIMARY = 0x0131
18 TPM2_CC_DICTIONARY_ATTACK_LOCK_RESET = 0x0139 18 TPM2_CC_DICTIONARY_ATTACK_LOCK_RESET = 0x0139
19 TPM2_CC_CREATE = 0x0153 19 TPM2_CC_CREATE = 0x0153
20 TPM2_CC_LOAD = 0x0157 20 TPM2_CC_LOAD = 0x0157
21 TPM2_CC_UNSEAL = 0x015E 21 TPM2_CC_UNSEAL = 0x015E
22 TPM2_CC_FLUSH_CONTEXT = 0x0165 22 TPM2_CC_FLUSH_CONTEXT = 0x0165
23 TPM2_CC_START_AUTH_SESSION = 0x0176 23 TPM2_CC_START_AUTH_SESSION = 0x0176
24 TPM2_CC_GET_CAPABILITY = 0x017A 24 TPM2_CC_GET_CAPABILITY = 0x017A
25 TPM2_CC_GET_RANDOM = 0x017B 25 TPM2_CC_GET_RANDOM = 0x017B
26 TPM2_CC_PCR_READ = 0x017E 26 TPM2_CC_PCR_READ = 0x017E
27 TPM2_CC_POLICY_PCR = 0x017F 27 TPM2_CC_POLICY_PCR = 0x017F
28 TPM2_CC_PCR_EXTEND = 0x0182 28 TPM2_CC_PCR_EXTEND = 0x0182
29 TPM2_CC_POLICY_PASSWORD = 0x018C 29 TPM2_CC_POLICY_PASSWORD = 0x018C
30 TPM2_CC_POLICY_GET_DIGEST = 0x0189 30 TPM2_CC_POLICY_GET_DIGEST = 0x0189
31 31
32 TPM2_SE_POLICY = 0x01 32 TPM2_SE_POLICY = 0x01
33 TPM2_SE_TRIAL = 0x03 33 TPM2_SE_TRIAL = 0x03
34 34
35 TPM2_ALG_RSA = 0x0001 35 TPM2_ALG_RSA = 0x0001
36 TPM2_ALG_SHA1 = 0x0004 36 TPM2_ALG_SHA1 = 0x0004
37 TPM2_ALG_AES = 0x0006 37 TPM2_ALG_AES = 0x0006
38 TPM2_ALG_KEYEDHASH = 0x0008 38 TPM2_ALG_KEYEDHASH = 0x0008
39 TPM2_ALG_SHA256 = 0x000B 39 TPM2_ALG_SHA256 = 0x000B
40 TPM2_ALG_NULL = 0x0010 40 TPM2_ALG_NULL = 0x0010
41 TPM2_ALG_CBC = 0x0042 41 TPM2_ALG_CBC = 0x0042
42 TPM2_ALG_CFB = 0x0043 42 TPM2_ALG_CFB = 0x0043
43 43
44 TPM2_RH_OWNER = 0x40000001 44 TPM2_RH_OWNER = 0x40000001
45 TPM2_RH_NULL = 0x40000007 45 TPM2_RH_NULL = 0x40000007
46 TPM2_RH_LOCKOUT = 0x4000000A 46 TPM2_RH_LOCKOUT = 0x4000000A
47 TPM2_RS_PW = 0x40000009 47 TPM2_RS_PW = 0x40000009
48 48
49 TPM2_RC_SIZE = 0x01D5 49 TPM2_RC_SIZE = 0x01D5
50 TPM2_RC_AUTH_FAIL = 0x098E 50 TPM2_RC_AUTH_FAIL = 0x098E
51 TPM2_RC_POLICY_FAIL = 0x099D 51 TPM2_RC_POLICY_FAIL = 0x099D
52 TPM2_RC_COMMAND_CODE = 0x0143 52 TPM2_RC_COMMAND_CODE = 0x0143
53 53
54 TSS2_RC_LAYER_SHIFT = 16 54 TSS2_RC_LAYER_SHIFT = 16
55 TSS2_RESMGR_TPM_RC_LAYER = (11 << TSS2_RC_LAYE 55 TSS2_RESMGR_TPM_RC_LAYER = (11 << TSS2_RC_LAYER_SHIFT)
56 56
57 TPM2_CAP_HANDLES = 0x00000001 57 TPM2_CAP_HANDLES = 0x00000001
58 TPM2_CAP_COMMANDS = 0x00000002 58 TPM2_CAP_COMMANDS = 0x00000002
59 TPM2_CAP_PCRS = 0x00000005 <<
60 TPM2_CAP_TPM_PROPERTIES = 0x00000006 59 TPM2_CAP_TPM_PROPERTIES = 0x00000006
61 60
62 TPM2_PT_FIXED = 0x100 61 TPM2_PT_FIXED = 0x100
63 TPM2_PT_TOTAL_COMMANDS = TPM2_PT_FIXED + 41 62 TPM2_PT_TOTAL_COMMANDS = TPM2_PT_FIXED + 41
64 63
65 HR_SHIFT = 24 64 HR_SHIFT = 24
66 HR_LOADED_SESSION = 0x02000000 65 HR_LOADED_SESSION = 0x02000000
67 HR_TRANSIENT = 0x80000000 66 HR_TRANSIENT = 0x80000000
68 67
69 SHA1_DIGEST_SIZE = 20 68 SHA1_DIGEST_SIZE = 20
70 SHA256_DIGEST_SIZE = 32 69 SHA256_DIGEST_SIZE = 32
71 70
72 TPM2_VER0_ERRORS = { 71 TPM2_VER0_ERRORS = {
73 0x000: "TPM_RC_SUCCESS", 72 0x000: "TPM_RC_SUCCESS",
74 0x030: "TPM_RC_BAD_TAG", 73 0x030: "TPM_RC_BAD_TAG",
75 } 74 }
76 75
77 TPM2_VER1_ERRORS = { 76 TPM2_VER1_ERRORS = {
78 0x000: "TPM_RC_FAILURE", 77 0x000: "TPM_RC_FAILURE",
79 0x001: "TPM_RC_FAILURE", 78 0x001: "TPM_RC_FAILURE",
80 0x003: "TPM_RC_SEQUENCE", 79 0x003: "TPM_RC_SEQUENCE",
81 0x00B: "TPM_RC_PRIVATE", 80 0x00B: "TPM_RC_PRIVATE",
82 0x019: "TPM_RC_HMAC", 81 0x019: "TPM_RC_HMAC",
83 0x020: "TPM_RC_DISABLED", 82 0x020: "TPM_RC_DISABLED",
84 0x021: "TPM_RC_EXCLUSIVE", 83 0x021: "TPM_RC_EXCLUSIVE",
85 0x024: "TPM_RC_AUTH_TYPE", 84 0x024: "TPM_RC_AUTH_TYPE",
86 0x025: "TPM_RC_AUTH_MISSING", 85 0x025: "TPM_RC_AUTH_MISSING",
87 0x026: "TPM_RC_POLICY", 86 0x026: "TPM_RC_POLICY",
88 0x027: "TPM_RC_PCR", 87 0x027: "TPM_RC_PCR",
89 0x028: "TPM_RC_PCR_CHANGED", 88 0x028: "TPM_RC_PCR_CHANGED",
90 0x02D: "TPM_RC_UPGRADE", 89 0x02D: "TPM_RC_UPGRADE",
91 0x02E: "TPM_RC_TOO_MANY_CONTEXTS", 90 0x02E: "TPM_RC_TOO_MANY_CONTEXTS",
92 0x02F: "TPM_RC_AUTH_UNAVAILABLE", 91 0x02F: "TPM_RC_AUTH_UNAVAILABLE",
93 0x030: "TPM_RC_REBOOT", 92 0x030: "TPM_RC_REBOOT",
94 0x031: "TPM_RC_UNBALANCED", 93 0x031: "TPM_RC_UNBALANCED",
95 0x042: "TPM_RC_COMMAND_SIZE", 94 0x042: "TPM_RC_COMMAND_SIZE",
96 0x043: "TPM_RC_COMMAND_CODE", 95 0x043: "TPM_RC_COMMAND_CODE",
97 0x044: "TPM_RC_AUTHSIZE", 96 0x044: "TPM_RC_AUTHSIZE",
98 0x045: "TPM_RC_AUTH_CONTEXT", 97 0x045: "TPM_RC_AUTH_CONTEXT",
99 0x046: "TPM_RC_NV_RANGE", 98 0x046: "TPM_RC_NV_RANGE",
100 0x047: "TPM_RC_NV_SIZE", 99 0x047: "TPM_RC_NV_SIZE",
101 0x048: "TPM_RC_NV_LOCKED", 100 0x048: "TPM_RC_NV_LOCKED",
102 0x049: "TPM_RC_NV_AUTHORIZATION", 101 0x049: "TPM_RC_NV_AUTHORIZATION",
103 0x04A: "TPM_RC_NV_UNINITIALIZED", 102 0x04A: "TPM_RC_NV_UNINITIALIZED",
104 0x04B: "TPM_RC_NV_SPACE", 103 0x04B: "TPM_RC_NV_SPACE",
105 0x04C: "TPM_RC_NV_DEFINED", 104 0x04C: "TPM_RC_NV_DEFINED",
106 0x050: "TPM_RC_BAD_CONTEXT", 105 0x050: "TPM_RC_BAD_CONTEXT",
107 0x051: "TPM_RC_CPHASH", 106 0x051: "TPM_RC_CPHASH",
108 0x052: "TPM_RC_PARENT", 107 0x052: "TPM_RC_PARENT",
109 0x053: "TPM_RC_NEEDS_TEST", 108 0x053: "TPM_RC_NEEDS_TEST",
110 0x054: "TPM_RC_NO_RESULT", 109 0x054: "TPM_RC_NO_RESULT",
111 0x055: "TPM_RC_SENSITIVE", 110 0x055: "TPM_RC_SENSITIVE",
112 0x07F: "RC_MAX_FM0", 111 0x07F: "RC_MAX_FM0",
113 } 112 }
114 113
115 TPM2_FMT1_ERRORS = { 114 TPM2_FMT1_ERRORS = {
116 0x001: "TPM_RC_ASYMMETRIC", 115 0x001: "TPM_RC_ASYMMETRIC",
117 0x002: "TPM_RC_ATTRIBUTES", 116 0x002: "TPM_RC_ATTRIBUTES",
118 0x003: "TPM_RC_HASH", 117 0x003: "TPM_RC_HASH",
119 0x004: "TPM_RC_VALUE", 118 0x004: "TPM_RC_VALUE",
120 0x005: "TPM_RC_HIERARCHY", 119 0x005: "TPM_RC_HIERARCHY",
121 0x007: "TPM_RC_KEY_SIZE", 120 0x007: "TPM_RC_KEY_SIZE",
122 0x008: "TPM_RC_MGF", 121 0x008: "TPM_RC_MGF",
123 0x009: "TPM_RC_MODE", 122 0x009: "TPM_RC_MODE",
124 0x00A: "TPM_RC_TYPE", 123 0x00A: "TPM_RC_TYPE",
125 0x00B: "TPM_RC_HANDLE", 124 0x00B: "TPM_RC_HANDLE",
126 0x00C: "TPM_RC_KDF", 125 0x00C: "TPM_RC_KDF",
127 0x00D: "TPM_RC_RANGE", 126 0x00D: "TPM_RC_RANGE",
128 0x00E: "TPM_RC_AUTH_FAIL", 127 0x00E: "TPM_RC_AUTH_FAIL",
129 0x00F: "TPM_RC_NONCE", 128 0x00F: "TPM_RC_NONCE",
130 0x010: "TPM_RC_PP", 129 0x010: "TPM_RC_PP",
131 0x012: "TPM_RC_SCHEME", 130 0x012: "TPM_RC_SCHEME",
132 0x015: "TPM_RC_SIZE", 131 0x015: "TPM_RC_SIZE",
133 0x016: "TPM_RC_SYMMETRIC", 132 0x016: "TPM_RC_SYMMETRIC",
134 0x017: "TPM_RC_TAG", 133 0x017: "TPM_RC_TAG",
135 0x018: "TPM_RC_SELECTOR", 134 0x018: "TPM_RC_SELECTOR",
136 0x01A: "TPM_RC_INSUFFICIENT", 135 0x01A: "TPM_RC_INSUFFICIENT",
137 0x01B: "TPM_RC_SIGNATURE", 136 0x01B: "TPM_RC_SIGNATURE",
138 0x01C: "TPM_RC_KEY", 137 0x01C: "TPM_RC_KEY",
139 0x01D: "TPM_RC_POLICY_FAIL", 138 0x01D: "TPM_RC_POLICY_FAIL",
140 0x01F: "TPM_RC_INTEGRITY", 139 0x01F: "TPM_RC_INTEGRITY",
141 0x020: "TPM_RC_TICKET", 140 0x020: "TPM_RC_TICKET",
142 0x021: "TPM_RC_RESERVED_BITS", 141 0x021: "TPM_RC_RESERVED_BITS",
143 0x022: "TPM_RC_BAD_AUTH", 142 0x022: "TPM_RC_BAD_AUTH",
144 0x023: "TPM_RC_EXPIRED", 143 0x023: "TPM_RC_EXPIRED",
145 0x024: "TPM_RC_POLICY_CC", 144 0x024: "TPM_RC_POLICY_CC",
146 0x025: "TPM_RC_BINDING", 145 0x025: "TPM_RC_BINDING",
147 0x026: "TPM_RC_CURVE", 146 0x026: "TPM_RC_CURVE",
148 0x027: "TPM_RC_ECC_POINT", 147 0x027: "TPM_RC_ECC_POINT",
149 } 148 }
150 149
151 TPM2_WARN_ERRORS = { 150 TPM2_WARN_ERRORS = {
152 0x001: "TPM_RC_CONTEXT_GAP", 151 0x001: "TPM_RC_CONTEXT_GAP",
153 0x002: "TPM_RC_OBJECT_MEMORY", 152 0x002: "TPM_RC_OBJECT_MEMORY",
154 0x003: "TPM_RC_SESSION_MEMORY", 153 0x003: "TPM_RC_SESSION_MEMORY",
155 0x004: "TPM_RC_MEMORY", 154 0x004: "TPM_RC_MEMORY",
156 0x005: "TPM_RC_SESSION_HANDLES", 155 0x005: "TPM_RC_SESSION_HANDLES",
157 0x006: "TPM_RC_OBJECT_HANDLES", 156 0x006: "TPM_RC_OBJECT_HANDLES",
158 0x007: "TPM_RC_LOCALITY", 157 0x007: "TPM_RC_LOCALITY",
159 0x008: "TPM_RC_YIELDED", 158 0x008: "TPM_RC_YIELDED",
160 0x009: "TPM_RC_CANCELED", 159 0x009: "TPM_RC_CANCELED",
161 0x00A: "TPM_RC_TESTING", 160 0x00A: "TPM_RC_TESTING",
162 0x010: "TPM_RC_REFERENCE_H0", 161 0x010: "TPM_RC_REFERENCE_H0",
163 0x011: "TPM_RC_REFERENCE_H1", 162 0x011: "TPM_RC_REFERENCE_H1",
164 0x012: "TPM_RC_REFERENCE_H2", 163 0x012: "TPM_RC_REFERENCE_H2",
165 0x013: "TPM_RC_REFERENCE_H3", 164 0x013: "TPM_RC_REFERENCE_H3",
166 0x014: "TPM_RC_REFERENCE_H4", 165 0x014: "TPM_RC_REFERENCE_H4",
167 0x015: "TPM_RC_REFERENCE_H5", 166 0x015: "TPM_RC_REFERENCE_H5",
168 0x016: "TPM_RC_REFERENCE_H6", 167 0x016: "TPM_RC_REFERENCE_H6",
169 0x018: "TPM_RC_REFERENCE_S0", 168 0x018: "TPM_RC_REFERENCE_S0",
170 0x019: "TPM_RC_REFERENCE_S1", 169 0x019: "TPM_RC_REFERENCE_S1",
171 0x01A: "TPM_RC_REFERENCE_S2", 170 0x01A: "TPM_RC_REFERENCE_S2",
172 0x01B: "TPM_RC_REFERENCE_S3", 171 0x01B: "TPM_RC_REFERENCE_S3",
173 0x01C: "TPM_RC_REFERENCE_S4", 172 0x01C: "TPM_RC_REFERENCE_S4",
174 0x01D: "TPM_RC_REFERENCE_S5", 173 0x01D: "TPM_RC_REFERENCE_S5",
175 0x01E: "TPM_RC_REFERENCE_S6", 174 0x01E: "TPM_RC_REFERENCE_S6",
176 0x020: "TPM_RC_NV_RATE", 175 0x020: "TPM_RC_NV_RATE",
177 0x021: "TPM_RC_LOCKOUT", 176 0x021: "TPM_RC_LOCKOUT",
178 0x022: "TPM_RC_RETRY", 177 0x022: "TPM_RC_RETRY",
179 0x023: "TPM_RC_NV_UNAVAILABLE", 178 0x023: "TPM_RC_NV_UNAVAILABLE",
180 0x7F: "TPM_RC_NOT_USED", 179 0x7F: "TPM_RC_NOT_USED",
181 } 180 }
182 181
183 RC_VER1 = 0x100 182 RC_VER1 = 0x100
184 RC_FMT1 = 0x080 183 RC_FMT1 = 0x080
185 RC_WARN = 0x900 184 RC_WARN = 0x900
186 185
187 ALG_DIGEST_SIZE_MAP = { 186 ALG_DIGEST_SIZE_MAP = {
188 TPM2_ALG_SHA1: SHA1_DIGEST_SIZE, 187 TPM2_ALG_SHA1: SHA1_DIGEST_SIZE,
189 TPM2_ALG_SHA256: SHA256_DIGEST_SIZE, 188 TPM2_ALG_SHA256: SHA256_DIGEST_SIZE,
190 } 189 }
191 190
192 ALG_HASH_FUNCTION_MAP = { 191 ALG_HASH_FUNCTION_MAP = {
193 TPM2_ALG_SHA1: hashlib.sha1, 192 TPM2_ALG_SHA1: hashlib.sha1,
194 TPM2_ALG_SHA256: hashlib.sha256 193 TPM2_ALG_SHA256: hashlib.sha256
195 } 194 }
196 195
197 NAME_ALG_MAP = { 196 NAME_ALG_MAP = {
198 "sha1": TPM2_ALG_SHA1, 197 "sha1": TPM2_ALG_SHA1,
199 "sha256": TPM2_ALG_SHA256, 198 "sha256": TPM2_ALG_SHA256,
200 } 199 }
201 200
202 201
203 class UnknownAlgorithmIdError(Exception): 202 class UnknownAlgorithmIdError(Exception):
204 def __init__(self, alg): 203 def __init__(self, alg):
205 self.alg = alg 204 self.alg = alg
206 205
207 def __str__(self): 206 def __str__(self):
208 return '0x%0x' % (alg) 207 return '0x%0x' % (alg)
209 208
210 209
211 class UnknownAlgorithmNameError(Exception): 210 class UnknownAlgorithmNameError(Exception):
212 def __init__(self, name): 211 def __init__(self, name):
213 self.name = name 212 self.name = name
214 213
215 def __str__(self): 214 def __str__(self):
216 return name 215 return name
217 216
218 217
219 class UnknownPCRBankError(Exception): 218 class UnknownPCRBankError(Exception):
220 def __init__(self, alg): 219 def __init__(self, alg):
221 self.alg = alg 220 self.alg = alg
222 221
223 def __str__(self): 222 def __str__(self):
224 return '0x%0x' % (alg) 223 return '0x%0x' % (alg)
225 224
226 225
227 class ProtocolError(Exception): 226 class ProtocolError(Exception):
228 def __init__(self, cc, rc): 227 def __init__(self, cc, rc):
229 self.cc = cc 228 self.cc = cc
230 self.rc = rc 229 self.rc = rc
231 230
232 if (rc & RC_FMT1) == RC_FMT1: 231 if (rc & RC_FMT1) == RC_FMT1:
233 self.name = TPM2_FMT1_ERRORS.get(r 232 self.name = TPM2_FMT1_ERRORS.get(rc & 0x3f, "TPM_RC_UNKNOWN")
234 elif (rc & RC_WARN) == RC_WARN: 233 elif (rc & RC_WARN) == RC_WARN:
235 self.name = TPM2_WARN_ERRORS.get(r 234 self.name = TPM2_WARN_ERRORS.get(rc & 0x7f, "TPM_RC_UNKNOWN")
236 elif (rc & RC_VER1) == RC_VER1: 235 elif (rc & RC_VER1) == RC_VER1:
237 self.name = TPM2_VER1_ERRORS.get(r 236 self.name = TPM2_VER1_ERRORS.get(rc & 0x7f, "TPM_RC_UNKNOWN")
238 else: 237 else:
239 self.name = TPM2_VER0_ERRORS.get(r 238 self.name = TPM2_VER0_ERRORS.get(rc & 0x7f, "TPM_RC_UNKNOWN")
240 239
241 def __str__(self): 240 def __str__(self):
242 if self.cc: 241 if self.cc:
243 return '%s: cc=0x%08x, rc=0x%08x' 242 return '%s: cc=0x%08x, rc=0x%08x' % (self.name, self.cc, self.rc)
244 else: 243 else:
245 return '%s: rc=0x%08x' % (self.nam 244 return '%s: rc=0x%08x' % (self.name, self.rc)
246 245
247 246
248 class AuthCommand(object): 247 class AuthCommand(object):
249 """TPMS_AUTH_COMMAND""" 248 """TPMS_AUTH_COMMAND"""
250 249
251 def __init__(self, session_handle=TPM2_RS_ !! 250 def __init__(self, session_handle=TPM2_RS_PW, nonce='', session_attributes=0,
252 session_attributes=0, hmac=by !! 251 hmac=''):
253 self.session_handle = session_handle 252 self.session_handle = session_handle
254 self.nonce = nonce 253 self.nonce = nonce
255 self.session_attributes = session_attr 254 self.session_attributes = session_attributes
256 self.hmac = hmac 255 self.hmac = hmac
257 256
258 def __bytes__(self): !! 257 def __str__(self):
259 fmt = '>I H%us B H%us' % (len(self.non 258 fmt = '>I H%us B H%us' % (len(self.nonce), len(self.hmac))
260 return struct.pack(fmt, self.session_h 259 return struct.pack(fmt, self.session_handle, len(self.nonce),
261 self.nonce, self.se 260 self.nonce, self.session_attributes, len(self.hmac),
262 self.hmac) 261 self.hmac)
263 262
264 def __len__(self): 263 def __len__(self):
265 fmt = '>I H%us B H%us' % (len(self.non 264 fmt = '>I H%us B H%us' % (len(self.nonce), len(self.hmac))
266 return struct.calcsize(fmt) 265 return struct.calcsize(fmt)
267 266
268 267
269 class SensitiveCreate(object): 268 class SensitiveCreate(object):
270 """TPMS_SENSITIVE_CREATE""" 269 """TPMS_SENSITIVE_CREATE"""
271 270
272 def __init__(self, user_auth=bytes(), data !! 271 def __init__(self, user_auth='', data=''):
273 self.user_auth = user_auth 272 self.user_auth = user_auth
274 self.data = data 273 self.data = data
275 274
276 def __bytes__(self): !! 275 def __str__(self):
277 fmt = '>H%us H%us' % (len(self.user_au 276 fmt = '>H%us H%us' % (len(self.user_auth), len(self.data))
278 return struct.pack(fmt, len(self.user_ 277 return struct.pack(fmt, len(self.user_auth), self.user_auth,
279 len(self.data), sel 278 len(self.data), self.data)
280 279
281 def __len__(self): 280 def __len__(self):
282 fmt = '>H%us H%us' % (len(self.user_au 281 fmt = '>H%us H%us' % (len(self.user_auth), len(self.data))
283 return struct.calcsize(fmt) 282 return struct.calcsize(fmt)
284 283
285 284
286 class Public(object): 285 class Public(object):
287 """TPMT_PUBLIC""" 286 """TPMT_PUBLIC"""
288 287
289 FIXED_TPM = (1 << 1) 288 FIXED_TPM = (1 << 1)
290 FIXED_PARENT = (1 << 4) 289 FIXED_PARENT = (1 << 4)
291 SENSITIVE_DATA_ORIGIN = (1 << 5) 290 SENSITIVE_DATA_ORIGIN = (1 << 5)
292 USER_WITH_AUTH = (1 << 6) 291 USER_WITH_AUTH = (1 << 6)
293 RESTRICTED = (1 << 16) 292 RESTRICTED = (1 << 16)
294 DECRYPT = (1 << 17) 293 DECRYPT = (1 << 17)
295 294
296 def __fmt(self): 295 def __fmt(self):
297 return '>HHIH%us%usH%us' % \ 296 return '>HHIH%us%usH%us' % \
298 (len(self.auth_policy), len(self.p 297 (len(self.auth_policy), len(self.parameters), len(self.unique))
299 298
300 def __init__(self, object_type, name_alg, !! 299 def __init__(self, object_type, name_alg, object_attributes, auth_policy='',
301 auth_policy=bytes(), paramete !! 300 parameters='', unique=''):
302 unique=bytes()): <<
303 self.object_type = object_type 301 self.object_type = object_type
304 self.name_alg = name_alg 302 self.name_alg = name_alg
305 self.object_attributes = object_attrib 303 self.object_attributes = object_attributes
306 self.auth_policy = auth_policy 304 self.auth_policy = auth_policy
307 self.parameters = parameters 305 self.parameters = parameters
308 self.unique = unique 306 self.unique = unique
309 307
310 def __bytes__(self): !! 308 def __str__(self):
311 return struct.pack(self.__fmt(), 309 return struct.pack(self.__fmt(),
312 self.object_type, 310 self.object_type,
313 self.name_alg, 311 self.name_alg,
314 self.object_attribu 312 self.object_attributes,
315 len(self.auth_polic 313 len(self.auth_policy),
316 self.auth_policy, 314 self.auth_policy,
317 self.parameters, 315 self.parameters,
318 len(self.unique), 316 len(self.unique),
319 self.unique) 317 self.unique)
320 318
321 def __len__(self): 319 def __len__(self):
322 return struct.calcsize(self.__fmt()) 320 return struct.calcsize(self.__fmt())
323 321
324 322
325 def get_digest_size(alg): 323 def get_digest_size(alg):
326 ds = ALG_DIGEST_SIZE_MAP.get(alg) 324 ds = ALG_DIGEST_SIZE_MAP.get(alg)
327 if not ds: 325 if not ds:
328 raise UnknownAlgorithmIdError(alg) 326 raise UnknownAlgorithmIdError(alg)
329 return ds 327 return ds
330 328
331 329
332 def get_hash_function(alg): 330 def get_hash_function(alg):
333 f = ALG_HASH_FUNCTION_MAP.get(alg) 331 f = ALG_HASH_FUNCTION_MAP.get(alg)
334 if not f: 332 if not f:
335 raise UnknownAlgorithmIdError(alg) 333 raise UnknownAlgorithmIdError(alg)
336 return f 334 return f
337 335
338 336
339 def get_algorithm(name): 337 def get_algorithm(name):
340 alg = NAME_ALG_MAP.get(name) 338 alg = NAME_ALG_MAP.get(name)
341 if not alg: 339 if not alg:
342 raise UnknownAlgorithmNameError(name) 340 raise UnknownAlgorithmNameError(name)
343 return alg 341 return alg
344 342
345 343
346 def hex_dump(d): 344 def hex_dump(d):
347 d = [format(x, '02x') for x in d] !! 345 d = [format(ord(x), '02x') for x in d]
348 d = [d[i: i + 16] for i in range(0, len(d) !! 346 d = [d[i: i + 16] for i in xrange(0, len(d), 16)]
349 d = [' '.join(x) for x in d] 347 d = [' '.join(x) for x in d]
350 d = os.linesep.join(d) 348 d = os.linesep.join(d)
351 349
352 return d 350 return d
353 351
354 class Client: 352 class Client:
355 FLAG_DEBUG = 0x01 353 FLAG_DEBUG = 0x01
356 FLAG_SPACE = 0x02 354 FLAG_SPACE = 0x02
357 FLAG_NONBLOCK = 0x04 355 FLAG_NONBLOCK = 0x04
358 TPM_IOC_NEW_SPACE = 0xa200 356 TPM_IOC_NEW_SPACE = 0xa200
359 357
360 def __init__(self, flags = 0): 358 def __init__(self, flags = 0):
361 self.flags = flags 359 self.flags = flags
362 360
363 if (self.flags & Client.FLAG_SPACE) == 361 if (self.flags & Client.FLAG_SPACE) == 0:
364 self.tpm = open('/dev/tpm0', 'r+b' 362 self.tpm = open('/dev/tpm0', 'r+b', buffering=0)
365 else: 363 else:
366 self.tpm = open('/dev/tpmrm0', 'r+ 364 self.tpm = open('/dev/tpmrm0', 'r+b', buffering=0)
367 365
368 if (self.flags & Client.FLAG_NONBLOCK) 366 if (self.flags & Client.FLAG_NONBLOCK):
369 flags = fcntl.fcntl(self.tpm, fcnt 367 flags = fcntl.fcntl(self.tpm, fcntl.F_GETFL)
370 flags |= os.O_NONBLOCK 368 flags |= os.O_NONBLOCK
371 fcntl.fcntl(self.tpm, fcntl.F_SETF 369 fcntl.fcntl(self.tpm, fcntl.F_SETFL, flags)
372 self.tpm_poll = select.poll() 370 self.tpm_poll = select.poll()
373 371
374 def __del__(self): <<
375 if self.tpm: <<
376 self.tpm.close() <<
377 <<
378 def close(self): 372 def close(self):
379 self.tpm.close() 373 self.tpm.close()
380 374
381 def send_cmd(self, cmd): 375 def send_cmd(self, cmd):
382 self.tpm.write(cmd) 376 self.tpm.write(cmd)
383 377
384 if (self.flags & Client.FLAG_NONBLOCK) 378 if (self.flags & Client.FLAG_NONBLOCK):
385 self.tpm_poll.register(self.tpm, s 379 self.tpm_poll.register(self.tpm, select.POLLIN)
386 self.tpm_poll.poll(10000) 380 self.tpm_poll.poll(10000)
387 381
388 rsp = self.tpm.read() 382 rsp = self.tpm.read()
389 383
390 if (self.flags & Client.FLAG_NONBLOCK) 384 if (self.flags & Client.FLAG_NONBLOCK):
391 self.tpm_poll.unregister(self.tpm) 385 self.tpm_poll.unregister(self.tpm)
392 386
393 if (self.flags & Client.FLAG_DEBUG) != 387 if (self.flags & Client.FLAG_DEBUG) != 0:
394 sys.stderr.write('cmd' + os.linese 388 sys.stderr.write('cmd' + os.linesep)
395 sys.stderr.write(hex_dump(cmd) + o 389 sys.stderr.write(hex_dump(cmd) + os.linesep)
396 sys.stderr.write('rsp' + os.linese 390 sys.stderr.write('rsp' + os.linesep)
397 sys.stderr.write(hex_dump(rsp) + o 391 sys.stderr.write(hex_dump(rsp) + os.linesep)
398 392
399 rc = struct.unpack('>I', rsp[6:10])[0] 393 rc = struct.unpack('>I', rsp[6:10])[0]
400 if rc != 0: 394 if rc != 0:
401 cc = struct.unpack('>I', cmd[6:10] 395 cc = struct.unpack('>I', cmd[6:10])[0]
402 raise ProtocolError(cc, rc) 396 raise ProtocolError(cc, rc)
403 397
404 return rsp 398 return rsp
405 399
406 def read_pcr(self, i, bank_alg = TPM2_ALG_ 400 def read_pcr(self, i, bank_alg = TPM2_ALG_SHA1):
407 pcrsel_len = max((i >> 3) + 1, 3) 401 pcrsel_len = max((i >> 3) + 1, 3)
408 pcrsel = [0] * pcrsel_len 402 pcrsel = [0] * pcrsel_len
409 pcrsel[i >> 3] = 1 << (i & 7) 403 pcrsel[i >> 3] = 1 << (i & 7)
410 pcrsel = ''.join(map(chr, pcrsel)).enc !! 404 pcrsel = ''.join(map(chr, pcrsel))
411 405
412 fmt = '>HII IHB%us' % (pcrsel_len) 406 fmt = '>HII IHB%us' % (pcrsel_len)
413 cmd = struct.pack(fmt, 407 cmd = struct.pack(fmt,
414 TPM2_ST_NO_SESSIONS, 408 TPM2_ST_NO_SESSIONS,
415 struct.calcsize(fmt) 409 struct.calcsize(fmt),
416 TPM2_CC_PCR_READ, 410 TPM2_CC_PCR_READ,
417 1, 411 1,
418 bank_alg, 412 bank_alg,
419 pcrsel_len, pcrsel) 413 pcrsel_len, pcrsel)
420 414
421 rsp = self.send_cmd(cmd) 415 rsp = self.send_cmd(cmd)
422 416
423 pcr_update_cnt, pcr_select_cnt = struc 417 pcr_update_cnt, pcr_select_cnt = struct.unpack('>II', rsp[10:18])
424 assert pcr_select_cnt == 1 418 assert pcr_select_cnt == 1
425 rsp = rsp[18:] 419 rsp = rsp[18:]
426 420
427 alg2, pcrsel_len2 = struct.unpack('>HB 421 alg2, pcrsel_len2 = struct.unpack('>HB', rsp[:3])
428 assert bank_alg == alg2 and pcrsel_len 422 assert bank_alg == alg2 and pcrsel_len == pcrsel_len2
429 rsp = rsp[3 + pcrsel_len:] 423 rsp = rsp[3 + pcrsel_len:]
430 424
431 digest_cnt = struct.unpack('>I', rsp[: 425 digest_cnt = struct.unpack('>I', rsp[:4])[0]
432 if digest_cnt == 0: 426 if digest_cnt == 0:
433 return None 427 return None
434 rsp = rsp[6:] 428 rsp = rsp[6:]
435 429
436 return rsp 430 return rsp
437 431
438 def extend_pcr(self, i, dig, bank_alg = TP 432 def extend_pcr(self, i, dig, bank_alg = TPM2_ALG_SHA1):
439 ds = get_digest_size(bank_alg) 433 ds = get_digest_size(bank_alg)
440 assert(ds == len(dig)) 434 assert(ds == len(dig))
441 435
442 auth_cmd = AuthCommand() 436 auth_cmd = AuthCommand()
443 437
444 fmt = '>HII I I%us IH%us' % (len(auth_ 438 fmt = '>HII I I%us IH%us' % (len(auth_cmd), ds)
445 cmd = struct.pack( 439 cmd = struct.pack(
446 fmt, 440 fmt,
447 TPM2_ST_SESSIONS, 441 TPM2_ST_SESSIONS,
448 struct.calcsize(fmt), 442 struct.calcsize(fmt),
449 TPM2_CC_PCR_EXTEND, 443 TPM2_CC_PCR_EXTEND,
450 i, 444 i,
451 len(auth_cmd), 445 len(auth_cmd),
452 bytes(auth_cmd), !! 446 str(auth_cmd),
453 1, bank_alg, dig) 447 1, bank_alg, dig)
454 448
455 self.send_cmd(cmd) 449 self.send_cmd(cmd)
456 450
457 def start_auth_session(self, session_type, 451 def start_auth_session(self, session_type, name_alg = TPM2_ALG_SHA1):
458 fmt = '>HII IIH16sHBHH' 452 fmt = '>HII IIH16sHBHH'
459 cmd = struct.pack(fmt, 453 cmd = struct.pack(fmt,
460 TPM2_ST_NO_SESSIONS, 454 TPM2_ST_NO_SESSIONS,
461 struct.calcsize(fmt) 455 struct.calcsize(fmt),
462 TPM2_CC_START_AUTH_S 456 TPM2_CC_START_AUTH_SESSION,
463 TPM2_RH_NULL, 457 TPM2_RH_NULL,
464 TPM2_RH_NULL, 458 TPM2_RH_NULL,
465 16, 459 16,
466 ('\0' * 16).encode() !! 460 '\0' * 16,
467 0, 461 0,
468 session_type, 462 session_type,
469 TPM2_ALG_NULL, 463 TPM2_ALG_NULL,
470 name_alg) 464 name_alg)
471 465
472 return struct.unpack('>I', self.send_c 466 return struct.unpack('>I', self.send_cmd(cmd)[10:14])[0]
473 467
474 def __calc_pcr_digest(self, pcrs, bank_alg 468 def __calc_pcr_digest(self, pcrs, bank_alg = TPM2_ALG_SHA1,
475 digest_alg = TPM2_AL 469 digest_alg = TPM2_ALG_SHA1):
476 x = [] 470 x = []
477 f = get_hash_function(digest_alg) 471 f = get_hash_function(digest_alg)
478 472
479 for i in pcrs: 473 for i in pcrs:
480 pcr = self.read_pcr(i, bank_alg) 474 pcr = self.read_pcr(i, bank_alg)
481 if pcr is None: !! 475 if pcr == None:
482 return None 476 return None
483 x += pcr 477 x += pcr
484 478
485 return f(bytearray(x)).digest() 479 return f(bytearray(x)).digest()
486 480
487 def policy_pcr(self, handle, pcrs, bank_al 481 def policy_pcr(self, handle, pcrs, bank_alg = TPM2_ALG_SHA1,
488 name_alg = TPM2_ALG_SHA1): 482 name_alg = TPM2_ALG_SHA1):
489 ds = get_digest_size(name_alg) 483 ds = get_digest_size(name_alg)
490 dig = self.__calc_pcr_digest(pcrs, ban 484 dig = self.__calc_pcr_digest(pcrs, bank_alg, name_alg)
491 if not dig: 485 if not dig:
492 raise UnknownPCRBankError(bank_alg 486 raise UnknownPCRBankError(bank_alg)
493 487
494 pcrsel_len = max((max(pcrs) >> 3) + 1, 488 pcrsel_len = max((max(pcrs) >> 3) + 1, 3)
495 pcrsel = [0] * pcrsel_len 489 pcrsel = [0] * pcrsel_len
496 for i in pcrs: 490 for i in pcrs:
497 pcrsel[i >> 3] |= 1 << (i & 7) 491 pcrsel[i >> 3] |= 1 << (i & 7)
498 pcrsel = ''.join(map(chr, pcrsel)).enc !! 492 pcrsel = ''.join(map(chr, pcrsel))
499 493
500 fmt = '>HII IH%usIHB3s' % ds 494 fmt = '>HII IH%usIHB3s' % ds
501 cmd = struct.pack(fmt, 495 cmd = struct.pack(fmt,
502 TPM2_ST_NO_SESSIONS, 496 TPM2_ST_NO_SESSIONS,
503 struct.calcsize(fmt) 497 struct.calcsize(fmt),
504 TPM2_CC_POLICY_PCR, 498 TPM2_CC_POLICY_PCR,
505 handle, 499 handle,
506 len(dig), !! 500 len(dig), str(dig),
507 bytes(dig), <<
508 1, 501 1,
509 bank_alg, 502 bank_alg,
510 pcrsel_len, pcrsel) 503 pcrsel_len, pcrsel)
511 504
512 self.send_cmd(cmd) 505 self.send_cmd(cmd)
513 506
514 def policy_password(self, handle): 507 def policy_password(self, handle):
515 fmt = '>HII I' 508 fmt = '>HII I'
516 cmd = struct.pack(fmt, 509 cmd = struct.pack(fmt,
517 TPM2_ST_NO_SESSIONS, 510 TPM2_ST_NO_SESSIONS,
518 struct.calcsize(fmt) 511 struct.calcsize(fmt),
519 TPM2_CC_POLICY_PASSW 512 TPM2_CC_POLICY_PASSWORD,
520 handle) 513 handle)
521 514
522 self.send_cmd(cmd) 515 self.send_cmd(cmd)
523 516
524 def get_policy_digest(self, handle): 517 def get_policy_digest(self, handle):
525 fmt = '>HII I' 518 fmt = '>HII I'
526 cmd = struct.pack(fmt, 519 cmd = struct.pack(fmt,
527 TPM2_ST_NO_SESSIONS, 520 TPM2_ST_NO_SESSIONS,
528 struct.calcsize(fmt) 521 struct.calcsize(fmt),
529 TPM2_CC_POLICY_GET_D 522 TPM2_CC_POLICY_GET_DIGEST,
530 handle) 523 handle)
531 524
532 return self.send_cmd(cmd)[12:] 525 return self.send_cmd(cmd)[12:]
533 526
534 def flush_context(self, handle): 527 def flush_context(self, handle):
535 fmt = '>HIII' 528 fmt = '>HIII'
536 cmd = struct.pack(fmt, 529 cmd = struct.pack(fmt,
537 TPM2_ST_NO_SESSIONS, 530 TPM2_ST_NO_SESSIONS,
538 struct.calcsize(fmt) 531 struct.calcsize(fmt),
539 TPM2_CC_FLUSH_CONTEX 532 TPM2_CC_FLUSH_CONTEXT,
540 handle) 533 handle)
541 534
542 self.send_cmd(cmd) 535 self.send_cmd(cmd)
543 536
544 def create_root_key(self, auth_value = byt !! 537 def create_root_key(self, auth_value = ''):
545 attributes = \ 538 attributes = \
546 Public.FIXED_TPM | \ 539 Public.FIXED_TPM | \
547 Public.FIXED_PARENT | \ 540 Public.FIXED_PARENT | \
548 Public.SENSITIVE_DATA_ORIGIN | \ 541 Public.SENSITIVE_DATA_ORIGIN | \
549 Public.USER_WITH_AUTH | \ 542 Public.USER_WITH_AUTH | \
550 Public.RESTRICTED | \ 543 Public.RESTRICTED | \
551 Public.DECRYPT 544 Public.DECRYPT
552 545
553 auth_cmd = AuthCommand() 546 auth_cmd = AuthCommand()
554 sensitive = SensitiveCreate(user_auth= 547 sensitive = SensitiveCreate(user_auth=auth_value)
555 548
556 public_parms = struct.pack( 549 public_parms = struct.pack(
557 '>HHHHHI', 550 '>HHHHHI',
558 TPM2_ALG_AES, 551 TPM2_ALG_AES,
559 128, 552 128,
560 TPM2_ALG_CFB, 553 TPM2_ALG_CFB,
561 TPM2_ALG_NULL, 554 TPM2_ALG_NULL,
562 2048, 555 2048,
563 0) 556 0)
564 557
565 public = Public( 558 public = Public(
566 object_type=TPM2_ALG_RSA, 559 object_type=TPM2_ALG_RSA,
567 name_alg=TPM2_ALG_SHA1, 560 name_alg=TPM2_ALG_SHA1,
568 object_attributes=attributes, 561 object_attributes=attributes,
569 parameters=public_parms) 562 parameters=public_parms)
570 563
571 fmt = '>HIII I%us H%us H%us HI' % \ 564 fmt = '>HIII I%us H%us H%us HI' % \
572 (len(auth_cmd), len(sensitive), le 565 (len(auth_cmd), len(sensitive), len(public))
573 cmd = struct.pack( 566 cmd = struct.pack(
574 fmt, 567 fmt,
575 TPM2_ST_SESSIONS, 568 TPM2_ST_SESSIONS,
576 struct.calcsize(fmt), 569 struct.calcsize(fmt),
577 TPM2_CC_CREATE_PRIMARY, 570 TPM2_CC_CREATE_PRIMARY,
578 TPM2_RH_OWNER, 571 TPM2_RH_OWNER,
579 len(auth_cmd), 572 len(auth_cmd),
580 bytes(auth_cmd), !! 573 str(auth_cmd),
581 len(sensitive), 574 len(sensitive),
582 bytes(sensitive), !! 575 str(sensitive),
583 len(public), 576 len(public),
584 bytes(public), !! 577 str(public),
585 0, 0) 578 0, 0)
586 579
587 return struct.unpack('>I', self.send_c 580 return struct.unpack('>I', self.send_cmd(cmd)[10:14])[0]
588 581
589 def seal(self, parent_key, data, auth_valu 582 def seal(self, parent_key, data, auth_value, policy_dig,
590 name_alg = TPM2_ALG_SHA1): 583 name_alg = TPM2_ALG_SHA1):
591 ds = get_digest_size(name_alg) 584 ds = get_digest_size(name_alg)
592 assert(not policy_dig or ds == len(pol 585 assert(not policy_dig or ds == len(policy_dig))
593 586
594 attributes = 0 587 attributes = 0
595 if not policy_dig: 588 if not policy_dig:
596 attributes |= Public.USER_WITH_AUT 589 attributes |= Public.USER_WITH_AUTH
597 policy_dig = bytes() !! 590 policy_dig = ''
598 591
599 auth_cmd = AuthCommand() 592 auth_cmd = AuthCommand()
600 sensitive = SensitiveCreate(user_auth= 593 sensitive = SensitiveCreate(user_auth=auth_value, data=data)
601 594
602 public = Public( 595 public = Public(
603 object_type=TPM2_ALG_KEYEDHASH, 596 object_type=TPM2_ALG_KEYEDHASH,
604 name_alg=name_alg, 597 name_alg=name_alg,
605 object_attributes=attributes, 598 object_attributes=attributes,
606 auth_policy=policy_dig, 599 auth_policy=policy_dig,
607 parameters=struct.pack('>H', TPM2_ 600 parameters=struct.pack('>H', TPM2_ALG_NULL))
608 601
609 fmt = '>HIII I%us H%us H%us HI' % \ 602 fmt = '>HIII I%us H%us H%us HI' % \
610 (len(auth_cmd), len(sensitive), le 603 (len(auth_cmd), len(sensitive), len(public))
611 cmd = struct.pack( 604 cmd = struct.pack(
612 fmt, 605 fmt,
613 TPM2_ST_SESSIONS, 606 TPM2_ST_SESSIONS,
614 struct.calcsize(fmt), 607 struct.calcsize(fmt),
615 TPM2_CC_CREATE, 608 TPM2_CC_CREATE,
616 parent_key, 609 parent_key,
617 len(auth_cmd), 610 len(auth_cmd),
618 bytes(auth_cmd), !! 611 str(auth_cmd),
619 len(sensitive), 612 len(sensitive),
620 bytes(sensitive), !! 613 str(sensitive),
621 len(public), 614 len(public),
622 bytes(public), !! 615 str(public),
623 0, 0) 616 0, 0)
624 617
625 rsp = self.send_cmd(cmd) 618 rsp = self.send_cmd(cmd)
626 619
627 return rsp[14:] 620 return rsp[14:]
628 621
629 def unseal(self, parent_key, blob, auth_va 622 def unseal(self, parent_key, blob, auth_value, policy_handle):
630 private_len = struct.unpack('>H', blob 623 private_len = struct.unpack('>H', blob[0:2])[0]
631 public_start = private_len + 2 624 public_start = private_len + 2
632 public_len = struct.unpack('>H', blob[ 625 public_len = struct.unpack('>H', blob[public_start:public_start + 2])[0]
633 blob = blob[:private_len + public_len 626 blob = blob[:private_len + public_len + 4]
634 627
635 auth_cmd = AuthCommand() 628 auth_cmd = AuthCommand()
636 629
637 fmt = '>HII I I%us %us' % (len(auth_cm 630 fmt = '>HII I I%us %us' % (len(auth_cmd), len(blob))
638 cmd = struct.pack( 631 cmd = struct.pack(
639 fmt, 632 fmt,
640 TPM2_ST_SESSIONS, 633 TPM2_ST_SESSIONS,
641 struct.calcsize(fmt), 634 struct.calcsize(fmt),
642 TPM2_CC_LOAD, 635 TPM2_CC_LOAD,
643 parent_key, 636 parent_key,
644 len(auth_cmd), 637 len(auth_cmd),
645 bytes(auth_cmd), !! 638 str(auth_cmd),
646 blob) 639 blob)
647 640
648 data_handle = struct.unpack('>I', self 641 data_handle = struct.unpack('>I', self.send_cmd(cmd)[10:14])[0]
649 642
650 if policy_handle: 643 if policy_handle:
651 auth_cmd = AuthCommand(session_han 644 auth_cmd = AuthCommand(session_handle=policy_handle, hmac=auth_value)
652 else: 645 else:
653 auth_cmd = AuthCommand(hmac=auth_v 646 auth_cmd = AuthCommand(hmac=auth_value)
654 647
655 fmt = '>HII I I%us' % (len(auth_cmd)) 648 fmt = '>HII I I%us' % (len(auth_cmd))
656 cmd = struct.pack( 649 cmd = struct.pack(
657 fmt, 650 fmt,
658 TPM2_ST_SESSIONS, 651 TPM2_ST_SESSIONS,
659 struct.calcsize(fmt), 652 struct.calcsize(fmt),
660 TPM2_CC_UNSEAL, 653 TPM2_CC_UNSEAL,
661 data_handle, 654 data_handle,
662 len(auth_cmd), 655 len(auth_cmd),
663 bytes(auth_cmd)) !! 656 str(auth_cmd))
664 657
665 try: 658 try:
666 rsp = self.send_cmd(cmd) 659 rsp = self.send_cmd(cmd)
667 finally: 660 finally:
668 self.flush_context(data_handle) 661 self.flush_context(data_handle)
669 662
670 data_len = struct.unpack('>I', rsp[10: 663 data_len = struct.unpack('>I', rsp[10:14])[0] - 2
671 664
672 return rsp[16:16 + data_len] 665 return rsp[16:16 + data_len]
673 666
674 def reset_da_lock(self): 667 def reset_da_lock(self):
675 auth_cmd = AuthCommand() 668 auth_cmd = AuthCommand()
676 669
677 fmt = '>HII I I%us' % (len(auth_cmd)) 670 fmt = '>HII I I%us' % (len(auth_cmd))
678 cmd = struct.pack( 671 cmd = struct.pack(
679 fmt, 672 fmt,
680 TPM2_ST_SESSIONS, 673 TPM2_ST_SESSIONS,
681 struct.calcsize(fmt), 674 struct.calcsize(fmt),
682 TPM2_CC_DICTIONARY_ATTACK_LOCK_RES 675 TPM2_CC_DICTIONARY_ATTACK_LOCK_RESET,
683 TPM2_RH_LOCKOUT, 676 TPM2_RH_LOCKOUT,
684 len(auth_cmd), 677 len(auth_cmd),
685 bytes(auth_cmd)) !! 678 str(auth_cmd))
686 679
687 self.send_cmd(cmd) 680 self.send_cmd(cmd)
688 681
689 def __get_cap_cnt(self, cap, pt, cnt): 682 def __get_cap_cnt(self, cap, pt, cnt):
690 handles = [] 683 handles = []
691 fmt = '>HII III' 684 fmt = '>HII III'
692 685
693 cmd = struct.pack(fmt, 686 cmd = struct.pack(fmt,
694 TPM2_ST_NO_SESSIONS, 687 TPM2_ST_NO_SESSIONS,
695 struct.calcsize(fmt) 688 struct.calcsize(fmt),
696 TPM2_CC_GET_CAPABILI 689 TPM2_CC_GET_CAPABILITY,
697 cap, pt, cnt) 690 cap, pt, cnt)
698 691
699 rsp = self.send_cmd(cmd)[10:] 692 rsp = self.send_cmd(cmd)[10:]
700 more_data, cap, cnt = struct.unpack('> 693 more_data, cap, cnt = struct.unpack('>BII', rsp[:9])
701 rsp = rsp[9:] 694 rsp = rsp[9:]
702 695
703 for i in range(0, cnt): !! 696 for i in xrange(0, cnt):
704 handle = struct.unpack('>I', rsp[: 697 handle = struct.unpack('>I', rsp[:4])[0]
705 handles.append(handle) 698 handles.append(handle)
706 rsp = rsp[4:] 699 rsp = rsp[4:]
707 700
708 return handles, more_data 701 return handles, more_data
709 702
710 def get_cap(self, cap, pt): 703 def get_cap(self, cap, pt):
711 handles = [] 704 handles = []
712 705
713 more_data = True 706 more_data = True
714 while more_data: 707 while more_data:
715 next_handles, more_data = self.__g 708 next_handles, more_data = self.__get_cap_cnt(cap, pt, 1)
716 handles += next_handles 709 handles += next_handles
717 pt += 1 710 pt += 1
718 711
719 return handles 712 return handles
720 <<
721 def get_cap_pcrs(self): <<
722 pcr_banks = {} <<
723 <<
724 fmt = '>HII III' <<
725 <<
726 cmd = struct.pack(fmt, <<
727 TPM2_ST_NO_SESSIONS, <<
728 struct.calcsize(fmt) <<
729 TPM2_CC_GET_CAPABILI <<
730 TPM2_CAP_PCRS, 0, 1) <<
731 rsp = self.send_cmd(cmd)[10:] <<
732 _, _, cnt = struct.unpack('>BII', rsp[ <<
733 rsp = rsp[9:] <<
734 <<
735 # items are TPMS_PCR_SELECTION's <<
736 for i in range(0, cnt): <<
737 hash, sizeOfSelect = struct.unpa <<
738 rsp = rsp[3:] <<
739 <<
740 pcrSelect = 0 <<
741 if sizeOfSelect > 0: <<
742 pcrSelect, = struct.unpack(' <<
743 r <<
744 rsp = rsp[sizeOfSelect:] <<
745 pcrSelect = int.from_bytes(p <<
746 <<
747 pcr_banks[hash] = pcrSelect <<
748 <<
749 return pcr_banks <<
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.