2 * Copyright (C) 2011 Sansar Choinyambuu
3 * HSR Hochschule fuer Technik Rapperswil
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 #include "imv_attestation_process.h"
18 #include <ietf/ietf_attr_pa_tnc_error.h>
22 #include <tcg/tcg_pts_attr_aik.h>
23 #include <tcg/tcg_pts_attr_dh_nonce_params_resp.h>
24 #include <tcg/tcg_pts_attr_file_meas.h>
25 #include <tcg/tcg_pts_attr_meas_algo.h>
26 #include <tcg/tcg_pts_attr_proto_caps.h>
27 #include <tcg/tcg_pts_attr_simple_comp_evid.h>
28 #include <tcg/tcg_pts_attr_simple_evid_final.h>
29 #include <tcg/tcg_pts_attr_tpm_version_info.h>
30 #include <tcg/tcg_pts_attr_unix_file_meta.h>
33 #include <crypto/hashers/hasher.h>
37 bool imv_attestation_process(pa_tnc_attr_t
*attr
, linked_list_t
*attr_list
,
38 imv_attestation_state_t
*attestation_state
,
39 pts_meas_algorithms_t supported_algorithms
,
40 pts_dh_group_t supported_dh_groups
,
41 pts_database_t
*pts_db
,
42 credential_manager_t
*pts_credmgr
)
47 pts
= attestation_state
->get_pts(attestation_state
);
49 switch (attr
->get_type(attr
))
51 case TCG_PTS_PROTO_CAPS
:
53 tcg_pts_attr_proto_caps_t
*attr_cast
;
54 pts_proto_caps_flag_t flags
;
56 attr_cast
= (tcg_pts_attr_proto_caps_t
*)attr
;
57 flags
= attr_cast
->get_flags(attr_cast
);
58 pts
->set_proto_caps(pts
, flags
);
61 case TCG_PTS_MEAS_ALGO_SELECTION
:
63 tcg_pts_attr_meas_algo_t
*attr_cast
;
64 pts_meas_algorithms_t selected_algorithm
;
66 attr_cast
= (tcg_pts_attr_meas_algo_t
*)attr
;
67 selected_algorithm
= attr_cast
->get_algorithms(attr_cast
);
68 if (!(selected_algorithm
& supported_algorithms
))
70 DBG1(DBG_IMV
, "PTS-IMC selected unsupported"
71 " measurement algorithm");
74 pts
->set_meas_algorithm(pts
, selected_algorithm
);
77 case TCG_PTS_DH_NONCE_PARAMS_RESP
:
79 tcg_pts_attr_dh_nonce_params_resp_t
*attr_cast
;
80 int nonce_len
, min_nonce_len
;
81 pts_dh_group_t dh_group
;
82 pts_meas_algorithms_t offered_algorithms
, selected_algorithm
;
83 chunk_t responder_value
, responder_nonce
;
85 attr_cast
= (tcg_pts_attr_dh_nonce_params_resp_t
*)attr
;
86 responder_nonce
= attr_cast
->get_responder_nonce(attr_cast
);
88 /* check compliance of responder nonce length */
89 min_nonce_len
= lib
->settings
->get_int(lib
->settings
,
90 "libimcv.plugins.imv-attestation.min_nonce_len", 0);
91 nonce_len
= responder_nonce
.len
;
92 if (nonce_len
< PTS_MIN_NONCE_LEN
||
93 (min_nonce_len
> 0 && nonce_len
< min_nonce_len
))
95 attr
= pts_dh_nonce_error_create(
96 max(PTS_MIN_NONCE_LEN
, min_nonce_len
),
98 attr_list
->insert_last(attr_list
, attr
);
102 dh_group
= attr_cast
->get_dh_group(attr_cast
);
103 if (!(dh_group
& supported_dh_groups
))
105 DBG1(DBG_IMV
, "PTS-IMC selected unsupported DH group");
109 offered_algorithms
= attr_cast
->get_hash_algo_set(attr_cast
);
110 selected_algorithm
= pts_meas_algo_select(supported_algorithms
,
112 if (selected_algorithm
== PTS_MEAS_ALGO_NONE
)
114 attr
= pts_hash_alg_error_create(supported_algorithms
);
115 attr_list
->insert_last(attr_list
, attr
);
118 pts
->set_dh_hash_algorithm(pts
, selected_algorithm
);
120 if (!pts
->create_dh_nonce(pts
, dh_group
, nonce_len
))
125 responder_value
= attr_cast
->get_responder_value(attr_cast
);
126 pts
->set_peer_public_value(pts
, responder_value
,
129 /* Calculate secret assessment value */
130 if (!pts
->calculate_secret(pts
))
136 case TCG_PTS_TPM_VERSION_INFO
:
138 tcg_pts_attr_tpm_version_info_t
*attr_cast
;
139 chunk_t tpm_version_info
;
141 attr_cast
= (tcg_pts_attr_tpm_version_info_t
*)attr
;
142 tpm_version_info
= attr_cast
->get_tpm_version_info(attr_cast
);
143 pts
->set_tpm_version_info(pts
, tpm_version_info
);
148 tcg_pts_attr_aik_t
*attr_cast
;
149 certificate_t
*aik
, *issuer
;
151 bool trusted
= FALSE
;
153 attr_cast
= (tcg_pts_attr_aik_t
*)attr
;
154 aik
= attr_cast
->get_aik(attr_cast
);
157 DBG1(DBG_IMV
, "AIK unavailable");
160 if (aik
->get_type(aik
) == CERT_X509
)
162 DBG1(DBG_IMV
, "verifying AIK certificate");
163 e
= pts_credmgr
->create_trusted_enumerator(pts_credmgr
,
164 KEY_ANY
, aik
->get_issuer(aik
), FALSE
);
165 while (e
->enumerate(e
, &issuer
))
167 if (aik
->issued_by(aik
, issuer
))
174 DBG1(DBG_IMV
, "AIK certificate is %strusted",
175 trusted ?
"" : "not ");
177 pts
->set_aik(pts
, aik
);
180 case TCG_PTS_FILE_MEAS
:
182 tcg_pts_attr_file_meas_t
*attr_cast
;
183 u_int16_t request_id
;
184 int file_count
, file_id
;
185 pts_meas_algorithms_t algo
;
186 pts_file_meas_t
*measurements
;
188 enumerator_t
*e_hash
;
191 platform_info
= pts
->get_platform_info(pts
);
192 if (!pts_db
|| !platform_info
)
194 DBG1(DBG_IMV
, "%s%s%s not available",
195 (pts_db
) ?
"" : "pts database",
196 (!pts_db
&& !platform_info
) ?
"and" : "",
197 (platform_info
) ?
"" : "platform info");
201 attr_cast
= (tcg_pts_attr_file_meas_t
*)attr
;
202 measurements
= attr_cast
->get_measurements(attr_cast
);
203 algo
= pts
->get_meas_algorithm(pts
);
204 request_id
= measurements
->get_request_id(measurements
);
205 file_count
= measurements
->get_file_count(measurements
);
207 DBG1(DBG_IMV
, "measurement request %d returned %d file%s:",
208 request_id
, file_count
, (file_count
== 1) ?
"":"s");
210 if (!attestation_state
->check_off_file_meas_request(attestation_state
,
211 request_id
, &file_id
, &is_dir
))
213 DBG1(DBG_IMV
, " no entry found for file measurement request %d",
218 /* check hashes from database against measurements */
219 e_hash
= pts_db
->create_file_hash_enumerator(pts_db
,
220 platform_info
, algo
, file_id
, is_dir
);
221 if (!measurements
->verify(measurements
, e_hash
, is_dir
))
223 attestation_state
->set_measurement_error(attestation_state
);
225 e_hash
->destroy(e_hash
);
228 case TCG_PTS_UNIX_FILE_META
:
230 tcg_pts_attr_file_meta_t
*attr_cast
;
232 pts_file_meta_t
*metadata
;
233 pts_file_metadata_t
*entry
;
234 time_t created
, modified
, accessed
;
238 attr_cast
= (tcg_pts_attr_file_meta_t
*)attr
;
239 metadata
= attr_cast
->get_metadata(attr_cast
);
240 file_count
= metadata
->get_file_count(metadata
);
242 DBG1(DBG_IMV
, "metadata request returned %d file%s:",
243 file_count
, (file_count
== 1) ?
"":"s");
245 e
= metadata
->create_enumerator(metadata
);
246 while (e
->enumerate(e
, &entry
))
248 DBG1(DBG_IMV
, " '%s' (%"PRIu64
" bytes)"
249 " owner %"PRIu64
", group %"PRIu64
", type %N",
250 entry
->filename
, entry
->filesize
, entry
->owner
,
251 entry
->group
, pts_file_type_names
, entry
->type
);
253 created
= entry
->created
;
254 modified
= entry
->modified
;
255 accessed
= entry
->accessed
;
257 DBG1(DBG_IMV
, " created %T, modified %T, accessed %T",
258 &created
, utc
, &modified
, utc
, &accessed
, utc
);
263 case TCG_PTS_SIMPLE_COMP_EVID
:
265 tcg_pts_attr_simple_comp_evid_t
*attr_cast
;
266 pts_comp_func_name_t
*name
;
267 pts_comp_evidence_t
*evidence
;
268 pts_component_t
*comp
;
272 attr_cast
= (tcg_pts_attr_simple_comp_evid_t
*)attr
;
273 evidence
= attr_cast
->get_comp_evidence(attr_cast
);
274 name
= evidence
->get_comp_func_name(evidence
, &depth
);
276 comp
= attestation_state
->check_off_component(attestation_state
, name
);
279 DBG1(DBG_IMV
, " no entry found for component evidence request");
280 evidence
->destroy(evidence
);
283 status
= comp
->verify(comp
, pts
, pts_db
, evidence
);
289 attestation_state
->set_measurement_error(attestation_state
);
290 /* fall through to next case */
295 /* re-enter component into list */
296 attestation_state
->add_component(attestation_state
, comp
);
298 evidence
->destroy(evidence
);
301 case TCG_PTS_SIMPLE_EVID_FINAL
:
303 tcg_pts_attr_simple_evid_final_t
*attr_cast
;
304 pts_simple_evid_final_flag_t flags
;
305 pts_meas_algorithms_t composite_algorithm
;
307 chunk_t tpm_quote_sign
;
309 bool evid_signature_included
= FALSE
, use_quote2
= FALSE
,
310 ver_info_included
= FALSE
;
311 chunk_t pcr_composite
, quote_info
;
313 attr_cast
= (tcg_pts_attr_simple_evid_final_t
*)attr
;
314 evid_signature_included
= attr_cast
->is_evid_sign_included(attr_cast
);
315 flags
= attr_cast
->get_flags(attr_cast
);
317 /** Optional Composite Hash Algorithm field is always present
318 * Field has value of all zeroes if not used.
319 * Implemented adhering the suggestion of Paul Sangster 28.Oct.2011
321 composite_algorithm
= attr_cast
->get_comp_hash_algorithm(attr_cast
);
323 if (flags
!= PTS_SIMPLE_EVID_FINAL_FLAG_NO
)
325 if ((flags
== PTS_SIMPLE_EVID_FINAL_FLAG_TPM_QUOTE_INFO2
) ||
326 (flags
== PTS_SIMPLE_EVID_FINAL_FLAG_TPM_QUOTE_INFO2_CAP_VER
))
330 if (flags
== PTS_SIMPLE_EVID_FINAL_FLAG_TPM_QUOTE_INFO2_CAP_VER
)
332 ver_info_included
= TRUE
;
335 pcr_comp
= attr_cast
->get_pcr_comp(attr_cast
);
336 tpm_quote_sign
= attr_cast
->get_tpm_quote_sign(attr_cast
);
338 if (!pcr_comp
.ptr
|| !tpm_quote_sign
.ptr
)
340 DBG1(DBG_IMV
, "PCR composite: %B", &pcr_comp
);
341 DBG1(DBG_IMV
, "TPM Quote Signature: %B", &tpm_quote_sign
);
342 DBG1(DBG_IMV
, "Either PCR Composite or Quote Signature missing");
346 /* Construct PCR Composite and TPM Quote Info structures */
347 if (!pts
->get_quote_info(pts
, use_quote2
, ver_info_included
,
348 composite_algorithm
, &pcr_composite
, "e_info
))
350 DBG1(DBG_IMV
, "unable to contruct TPM Quote Info");
354 /* Check calculated PCR composite matches with received */
355 if (!chunk_equals(pcr_comp
, pcr_composite
))
357 DBG1(DBG_IMV
, "received PCR Compsosite didn't match"
358 " with constructed");
359 chunk_clear(&pcr_composite
);
360 chunk_clear("e_info
);
363 DBG2(DBG_IMV
, "received PCR Composite matches with constructed");
364 chunk_clear(&pcr_composite
);
366 if (!pts
->verify_quote_signature(pts
, quote_info
, tpm_quote_sign
))
368 chunk_clear("e_info
);
372 DBG2(DBG_IMV
, "signature verification succeeded for "
374 chunk_clear("e_info
);
377 if (evid_signature_included
)
379 /** TODO: What to do with Evidence Signature */
380 evid_sign
= attr_cast
->get_evid_sign(attr_cast
);
381 DBG1(DBG_IMV
, "This version of Attestation IMV can not handle"
382 " Optional Evidence Signature field");
388 /* TODO: Not implemented yet */
389 case TCG_PTS_INTEG_MEAS_LOG
:
390 /* Attributes using XML */
391 case TCG_PTS_TEMPL_REF_MANI_SET_META
:
392 case TCG_PTS_VERIFICATION_RESULT
:
393 case TCG_PTS_INTEG_REPORT
:
395 case TCG_PTS_WIN_FILE_META
:
396 case TCG_PTS_REGISTRY_VALUE
:
397 /* Received on IMC side only*/
398 case TCG_PTS_REQ_PROTO_CAPS
:
399 case TCG_PTS_DH_NONCE_PARAMS_REQ
:
400 case TCG_PTS_DH_NONCE_FINISH
:
401 case TCG_PTS_MEAS_ALGO
:
402 case TCG_PTS_GET_TPM_VERSION_INFO
:
403 case TCG_PTS_REQ_TEMPL_REF_MANI_SET_META
:
404 case TCG_PTS_UPDATE_TEMPL_REF_MANI
:
405 case TCG_PTS_GET_AIK
:
406 case TCG_PTS_REQ_FUNC_COMP_EVID
:
407 case TCG_PTS_GEN_ATTEST_EVID
:
408 case TCG_PTS_REQ_FILE_META
:
409 case TCG_PTS_REQ_FILE_MEAS
:
410 case TCG_PTS_REQ_INTEG_MEAS_LOG
:
412 DBG1(DBG_IMV
, "received unsupported attribute '%N'",
413 tcg_attr_names
, attr
->get_type(attr
));