Skip to content

Commit 1cb6c75

Browse files
danielinuxdanielinux
committed
Reject oversized TPM ROT auth input
F/1480
1 parent ec094fc commit 1cb6c75

3 files changed

Lines changed: 248 additions & 1 deletion

File tree

‎tools/tpm/rot.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,8 @@ static int TPM2_Boot_SecureROT_Example(TPMI_RH_NV_AUTH authHandle, word32 nvBase
148148
/* Setup a read/lock structure */
149149
XMEMSET(&nv, 0, sizeof(nv));
150150
nv.handle.hndl = handle;
151+
if (authBufSz > (int)sizeof(nv.handle.auth.buffer))
152+
return BAD_FUNC_ARG;
151153
nv.handle.auth.size = authBufSz;
152154
XMEMCPY(nv.handle.auth.buffer, authBuf, nv.handle.auth.size);
153155

‎tools/unit-tests/Makefile‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ TESTS:=unit-parser unit-extflash unit-string unit-spi-flash unit-aes128 \
4949
unit-update-flash-enc unit-update-ram unit-pkcs11_store unit-psa_store unit-disk \
5050
unit-update-disk unit-multiboot unit-boot-x86-fsp unit-qspi-flash unit-tpm-rsa-exp \
5151
unit-image-nopart unit-image-sha384 unit-image-sha3-384 unit-store-sbrk \
52-
unit-tpm-blob unit-policy-sign unit-sdhci-response-bits unit-hal-otp
52+
unit-tpm-blob unit-policy-sign unit-rot-auth unit-sdhci-response-bits unit-hal-otp
5353

5454
all: $(TESTS)
5555

@@ -139,6 +139,12 @@ unit-policy-sign: ../../include/target.h unit-policy-sign.c \
139139
-DHAVE_ECC_KEY_IMPORT \
140140
-ffunction-sections -fdata-sections $(LDFLAGS) -Wl,--gc-sections
141141

142+
unit-rot-auth: ../../include/target.h unit-rot-auth.c \
143+
$(WOLFBOOT_LIB_WOLFSSL)/wolfcrypt/src/memory.c
144+
gcc -o $@ $^ -I../tpm $(CFLAGS) -I$(WOLFBOOT_LIB_WOLFTPM) -DWOLFBOOT_TPM \
145+
-DWOLFTPM_USER_SETTINGS -DWOLFBOOT_SIGN_ECC256 -DWOLFBOOT_HASH_SHA256 \
146+
-ffunction-sections -fdata-sections $(LDFLAGS) -Wl,--gc-sections
147+
142148
unit-store-sbrk: unit-store-sbrk.c ../../src/store_sbrk.c
143149
gcc -o $@ $^ $(CFLAGS) $(LDFLAGS)
144150

‎tools/unit-tests/unit-rot-auth.c‎

Lines changed: 239 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,239 @@
1+
#include <check.h>
2+
#include <stdlib.h>
3+
#include <stdint.h>
4+
#include <string.h>
5+
6+
#include <wolfssl/wolfcrypt/settings.h>
7+
#include <wolftpm/tpm2_wrap.h>
8+
#include "tpm.h"
9+
10+
static uint8_t test_pubkey[32];
11+
static int symmetric_corrupted;
12+
13+
#define TPM2_IoCb NULL
14+
#define XSTRTOL strtol
15+
16+
int wolfTPM2_Init(WOLFTPM2_DEV* dev, TPM2HalIoCb ioCb, void* userCtx)
17+
{
18+
(void)dev;
19+
(void)ioCb;
20+
(void)userCtx;
21+
return TPM_RC_SUCCESS;
22+
}
23+
24+
int wolfTPM2_StartSession(WOLFTPM2_DEV* dev, WOLFTPM2_SESSION* session,
25+
WOLFTPM2_KEY* tpmKey, WOLFTPM2_HANDLE* bind, TPM_SE sesType,
26+
int encDecAlg)
27+
{
28+
(void)dev;
29+
(void)tpmKey;
30+
(void)bind;
31+
(void)sesType;
32+
(void)encDecAlg;
33+
session->handle.hndl = 1;
34+
return 0;
35+
}
36+
37+
int wolfTPM2_SetAuthSession(WOLFTPM2_DEV* dev, int index,
38+
WOLFTPM2_SESSION* session, TPMA_SESSION sessionAttributes)
39+
{
40+
(void)dev;
41+
(void)index;
42+
(void)session;
43+
(void)sessionAttributes;
44+
return 0;
45+
}
46+
47+
int wolfTPM2_UnloadHandle(WOLFTPM2_DEV* dev, WOLFTPM2_HANDLE* handle)
48+
{
49+
(void)dev;
50+
(void)handle;
51+
return 0;
52+
}
53+
54+
int wolfTPM2_Cleanup(WOLFTPM2_DEV* dev)
55+
{
56+
(void)dev;
57+
return 0;
58+
}
59+
60+
int wolfTPM2_NVReadPublic(WOLFTPM2_DEV* dev, TPM_HANDLE nvIndex,
61+
TPMS_NV_PUBLIC* nvPublic)
62+
{
63+
(void)dev;
64+
(void)nvIndex;
65+
memset(nvPublic, 0, sizeof(*nvPublic));
66+
nvPublic->dataSize = 32;
67+
return 0;
68+
}
69+
70+
int wolfTPM2_NVReadAuth(WOLFTPM2_DEV* dev, WOLFTPM2_NV* nv, TPM_HANDLE nvIndex,
71+
uint8_t* dataBuf, uint32_t* dataSz, uint32_t offset)
72+
{
73+
TPMT_SYM_DEF zero_sym;
74+
75+
(void)dev;
76+
(void)nv;
77+
(void)nvIndex;
78+
(void)offset;
79+
memset(&zero_sym, 0, sizeof(zero_sym));
80+
symmetric_corrupted =
81+
memcmp(&nv->handle.symmetric, &zero_sym, sizeof(zero_sym)) != 0;
82+
memset(dataBuf, 0xA5, *dataSz);
83+
return 0;
84+
}
85+
86+
int wolfTPM2_GetNvAttributesTemplate(TPMI_RH_NV_AUTH authHandle,
87+
word32* nvAttributes)
88+
{
89+
(void)authHandle;
90+
*nvAttributes = 0;
91+
return 0;
92+
}
93+
94+
int wolfTPM2_NVCreateAuth(WOLFTPM2_DEV* dev, WOLFTPM2_HANDLE* parent,
95+
WOLFTPM2_NV* nv, TPM_HANDLE nvIndex, word32 nvAttributes, word32 nvSize,
96+
const uint8_t* auth, int authSz)
97+
{
98+
(void)dev;
99+
(void)parent;
100+
(void)nv;
101+
(void)nvIndex;
102+
(void)nvAttributes;
103+
(void)nvSize;
104+
(void)auth;
105+
(void)authSz;
106+
return 0;
107+
}
108+
109+
int wolfTPM2_NVWriteAuth(WOLFTPM2_DEV* dev, WOLFTPM2_NV* nv, TPM_HANDLE nvIndex,
110+
uint8_t* dataBuf, word32 dataSz, word32 offset)
111+
{
112+
(void)dev;
113+
(void)nv;
114+
(void)nvIndex;
115+
(void)dataBuf;
116+
(void)dataSz;
117+
(void)offset;
118+
return 0;
119+
}
120+
121+
int wolfTPM2_NVWriteLock(WOLFTPM2_DEV* dev, WOLFTPM2_NV* nv)
122+
{
123+
(void)dev;
124+
(void)nv;
125+
return 0;
126+
}
127+
128+
const char* TPM2_GetAlgName(TPM_ALG_ID alg)
129+
{
130+
(void)alg;
131+
return "stub";
132+
}
133+
134+
const char* wolfTPM2_GetRCString(int rc)
135+
{
136+
(void)rc;
137+
return "stub";
138+
}
139+
140+
void TPM2_PrintBin(const uint8_t* buffer, uint32_t length)
141+
{
142+
(void)buffer;
143+
(void)length;
144+
}
145+
146+
int keystore_num_pubkeys(void)
147+
{
148+
return 1;
149+
}
150+
151+
uint32_t keystore_get_key_type(int id)
152+
{
153+
(void)id;
154+
return 0;
155+
}
156+
157+
int keystore_get_size(int id)
158+
{
159+
(void)id;
160+
return (int)sizeof(test_pubkey);
161+
}
162+
163+
uint8_t* keystore_get_buffer(int id)
164+
{
165+
(void)id;
166+
return test_pubkey;
167+
}
168+
169+
int wc_HashGetDigestSize(enum wc_HashType hash_type)
170+
{
171+
(void)hash_type;
172+
return 32;
173+
}
174+
175+
int wc_Hash(enum wc_HashType hash_type, const byte* data, word32 len, byte* hash,
176+
word32 hash_len)
177+
{
178+
(void)hash_type;
179+
(void)data;
180+
(void)len;
181+
memset(hash, 0x5A, hash_len);
182+
return 0;
183+
}
184+
185+
int printf(const char* fmt, ...)
186+
{
187+
(void)fmt;
188+
return 0;
189+
}
190+
191+
#define main rot_tool_main
192+
#include "../tpm/rot.c"
193+
#undef main
194+
195+
START_TEST(test_rot_rejects_oversized_auth)
196+
{
197+
char auth[sizeof(((WOLFTPM2_NV*)0)->handle.auth.buffer) + 2];
198+
int rc;
199+
200+
memset(test_pubkey, 0x11, sizeof(test_pubkey));
201+
symmetric_corrupted = 0;
202+
memset(auth, 'A', sizeof(auth) - 1);
203+
auth[sizeof(auth) - 1] = '\0';
204+
205+
rc = TPM2_Boot_SecureROT_Example(TPM_RH_PLATFORM,
206+
WOLFBOOT_TPM_KEYSTORE_NV_BASE, WC_HASH_TYPE_SHA256, 0, 0, auth,
207+
(int)strlen(auth));
208+
209+
ck_assert_int_eq(symmetric_corrupted, 0);
210+
ck_assert_int_eq(rc, BAD_FUNC_ARG);
211+
}
212+
END_TEST
213+
214+
static Suite* rot_auth_suite(void)
215+
{
216+
Suite* s;
217+
TCase* tc;
218+
219+
s = suite_create("rot_auth");
220+
tc = tcase_create("auth_validation");
221+
tcase_add_test(tc, test_rot_rejects_oversized_auth);
222+
suite_add_tcase(s, tc);
223+
return s;
224+
}
225+
226+
int main(void)
227+
{
228+
Suite* s;
229+
SRunner* sr;
230+
int failures;
231+
232+
s = rot_auth_suite();
233+
sr = srunner_create(s);
234+
srunner_run_all(sr, CK_ENV);
235+
failures = srunner_ntests_failed(sr);
236+
srunner_free(sr);
237+
238+
return failures == 0 ? 0 : 1;
239+
}

0 commit comments

Comments
 (0)