1 /* SPDX-License-Identifier: BSD-2-Clause */ 2 /******************************************************************************* 3 * Copyright 2018-2019, Fraunhofer SIT sponsored by Infineon Technologies AG 4 * All rights reserved. 5 *******************************************************************************/ 6 #ifndef FAPI_POLICY_EXECUTE_H 7 #define FAPI_POLICY_EXECUTE_H 8 9 #include <stdint.h> 10 #include <stdarg.h> 11 #include <stdbool.h> 12 #include <sys/stat.h> 13 #include <json-c/json.h> 14 #include <json-c/json_util.h> 15 16 #include "tss2_esys.h" 17 #include "tss2_fapi.h" 18 19 TSS2_RC 20 ifapi_extend_authorization( 21 TPMS_POLICY *policy, 22 TPMS_POLICYAUTHORIZATION *authorization); 23 24 typedef TSS2_RC(*Policy_Compare_Object)( 25 TPMS_POLICY *policy, 26 void *object1, 27 void *object2, 28 bool *found); 29 30 /** List of policies which fulfill a certain predicate. 31 * 32 * The elements are stored in a linked list. 33 */ 34 struct POLICY_LIST { 35 const char *path; /**< The path of the policy object */ 36 TPMS_POLICY policy; /**< The policy object */ 37 struct POLICY_LIST *next; /**< Pointer to next element */ 38 }; 39 40 /** List of policies which fulfill a certain predicate. 41 * 42 * The elements are stored in a linked list. 43 */ 44 struct policy_object_node { 45 const char *path; /**< The path of the policy object */ 46 TPMS_POLICY policy; /**< The policy object */ 47 struct policy_object_node *next; /**< Pointer to next element */ 48 }; 49 50 typedef TSS2_RC (*ifapi_policyexec_cbauth) ( 51 TPM2B_NAME *name, 52 ESYS_TR *object_handle, 53 ESYS_TR *auth_handle, 54 ESYS_TR *authSession, 55 void *userdata); 56 57 typedef TSS2_RC (*ifapi_policyexec_cbdup) ( 58 TPM2B_NAME *name, 59 void *userdata); 60 61 typedef TSS2_RC (*ifapi_policyexec_cbpolsel) ( 62 TPML_POLICYBRANCHES *branches, 63 size_t *branch_idx, 64 void *userdata); 65 66 typedef TSS2_RC (*ifapi_policyexec_cbsign) ( 67 char *key_pem, 68 char *public_key_hint, 69 TPMI_ALG_HASH key_pem_hash_alg, 70 uint8_t *buffer, 71 size_t buffer_size, 72 uint8_t **signature, 73 size_t *signature_size, 74 void *userdata); 75 76 typedef TSS2_RC (*ifapi_policyexec_cbauthpol) ( 77 TPMT_PUBLIC *key_public, 78 TPMI_ALG_HASH hash_alg, 79 TPM2B_DIGEST *digest, 80 TPMT_SIGNATURE *signature, 81 void *userdata); 82 83 typedef TSS2_RC (*ifapi_policyexec_cbauthnv) ( 84 TPM2B_NV_PUBLIC *nv_public, 85 TPMI_ALG_HASH hash_alg, 86 void *userdata); 87 88 typedef TSS2_RC (*ifapi_policyexec_cbaction) ( 89 const char *action, 90 void *userdata); 91 92 typedef struct { 93 ifapi_policyexec_cbauth cbauth; /**< Callback to authorize an object 94 retrieved by name in keystore */ 95 void *cbauth_userdata; 96 ifapi_policyexec_cbpolsel cbpolsel; /**< Callback for selection of policy 97 branch */ 98 void *cbpolsel_userdata; 99 ifapi_policyexec_cbsign cbsign; /**< Callback for policy sign */ 100 void *cbsign_userdata; 101 ifapi_policyexec_cbauthpol cbauthpol; /**< Callback for policy authorize */ 102 void *cbauthpol_userdata; 103 ifapi_policyexec_cbauthnv cbauthnv; /**< Callback for policy authorize nv */ 104 void *cbauthnv_userdata; 105 ifapi_policyexec_cbdup cbdup; /**< Callback for policy duplication 106 select */ 107 void *cbdup_userdata; 108 ifapi_policyexec_cbaction cbaction; /**< Callback for policy action */ 109 void *cbaction_userdata; 110 } ifapi_policyeval_EXEC_CB; 111 112 /** The states for policy execution */ 113 enum IFAPI_STATE_POLICY_EXCECUTE { 114 POLICY_EXECUTE_INIT = 0, 115 POLICY_EXECUTE_FINISH, 116 POLICY_EXECUTE_CALLBACK, 117 POLICY_LOAD_KEY, 118 POLICY_FLUSH_KEY, 119 POLICY_VERIFY, 120 POLICY_AUTH_CALLBACK, 121 POLICY_AUTH_SENT, 122 POLICY_EXEC_ESYS 123 }; 124 125 typedef struct IFAPI_POLICY_CALLBACK_CTX IFAPI_POLICY_CALLBACK_CTX; 126 127 /** The context of the policy execution */ 128 struct IFAPI_POLICY_EXEC_CTX { 129 enum IFAPI_STATE_POLICY_EXCECUTE state; 130 /**< The execution state of the current 131 policy command */ 132 TPML_DIGEST digest_list; /** The digest list of policy or */ 133 IFAPI_POLICY_EXEC_CTX *next; /**< Pointer to next policy */ 134 IFAPI_POLICY_EXEC_CTX *prev; /**< Pointer to previous policy */ 135 ESYS_TR session; /**< The current policy session */ 136 TPMS_POLICY *policy; 137 ESYS_TR policySessionSav; /**< Backup policy session */ 138 ESYS_TR object_handle; 139 ESYS_TR nv_index; 140 ESYS_TR auth_handle; 141 IFAPI_OBJECT auth_object; /**< Object used for authentication */ 142 ESYS_TR auth_session; 143 TPMI_ALG_HASH hash_alg; 144 void *app_data; /**< Application data for policy execution callbacks */ 145 NODE_OBJECT_T *policy_elements; /**< The policy elements to be executed */ 146 TPM2B_DIGEST *nonceTPM; 147 uint8_t *buffer; 148 size_t buffer_size; 149 TPM2B_NAME name; 150 char *pem_key; /**< Pem key recreated during policy execution */ 151 struct POLICY_LIST *policy_list; 152 /**< List of policies for authorization selection */ 153 ifapi_policyeval_EXEC_CB callbacks; 154 /**< callbacks used for execution of sub 155 policies and actions which require access 156 to the FAPI context. */ 157 }; 158 159 TSS2_RC 160 ifapi_policyeval_execute_prepare( 161 IFAPI_POLICY_EXEC_CTX *pol_ctx, 162 TPMI_ALG_HASH hash_alg, 163 TPMS_POLICY *policy); 164 165 TSS2_RC 166 ifapi_policyeval_execute( 167 ESYS_CONTEXT *esys_ctx, 168 IFAPI_POLICY_EXEC_CTX *current_policy); 169 170 #endif /* FAPI_POLICY_EXECUTE_H */ 171