tpm2-tools/SOURCES/0001-Refactor-fix_esys_hierarchies.patch

From 2e7839b905f7a493f739d36e3e550e0cee30049e Mon Sep 17 00:00:00 2001
From: Andreas Fuchs <andreas.fuchs@sit.fraunhofer.de>
Date: Thu, 7 May 2020 19:12:36 +0200
Subject: [PATCH] Refactor fix_esys_hierarchies()

Refactor fix_esys_hierarchies() to return an actual TSS2_RC return code
and have an output parameter.

Signed-off-by: Andreas Fuchs <andreas.fuchs@sit.fraunhofer.de>
---
 lib/tpm2.c                | 88 +++++++++++++++++++++++++++++----------
 lib/tpm2.h                |  2 +-
 tools/tpm2_loadexternal.c |  9 +++-
 3 files changed, 75 insertions(+), 24 deletions(-)

diff --git a/lib/tpm2.c b/lib/tpm2.c
index 909a4422339d..744fed8c529f 100644
--- a/lib/tpm2.c
+++ b/lib/tpm2.c
@@ -645,39 +645,51 @@ tool_rc tpm2_evictcontrol(ESYS_CONTEXT *esys_context,
 }
 
 /* This function addresses ESAPI change that changes parameter type from
- * Esys_TR to TPMI_RH_HIERARCHY and breaks backwards compatibility.
+ * Esys_TR to TPMI_RH_HIERARCHY or TPMI_RH_ENABLES and breaks backwards
+ * compatibility.
  * To keep the tools parameters consistent after v4.0 release we need to
  * map the values to appropriate type based on the version of the ESYS API.
  * Note: the mapping is based on the ESYS version recognized at compile time.
  * The TSS change can be found here:
  * https://github.com/tpm2-software/tpm2-tss/pull/1531
  */
-uint32_t fix_esys_hierarchy(TPMI_RH_HIERARCHY hierarchy)
+TSS2_RC fix_esys_hierarchy(uint32_t in, uint32_t *out)
 {
 #if defined(ESYS_3_0)
-    switch (hierarchy) {
+    switch (in) {
         case ESYS_TR_RH_NULL:
+            /* FALLTHRU */
         case ESYS_TR_RH_OWNER:
+            /* FALLTHRU */
         case ESYS_TR_RH_ENDORSEMENT:
+            /* FALLTHRU */
         case ESYS_TR_RH_PLATFORM:
+            /* FALLTHRU */
         case ESYS_TR_RH_PLATFORM_NV:
-            return hierarchy;
+            *out = in;
+            return TSS2_RC_SUCCESS;
         case TPM2_RH_NULL:
-            return ESYS_TR_RH_NULL;
+            *out = ESYS_TR_RH_NULL;
+            return TSS2_RC_SUCCESS;
         case TPM2_RH_OWNER:
-            return ESYS_TR_RH_OWNER;
+            *out = ESYS_TR_RH_OWNER;
+            return TSS2_RC_SUCCESS;
         case TPM2_RH_ENDORSEMENT:
-            return ESYS_TR_RH_ENDORSEMENT;
+            *out = ESYS_TR_RH_ENDORSEMENT;
+            return TSS2_RC_SUCCESS;
         case TPM2_RH_PLATFORM:
-            return ESYS_TR_RH_PLATFORM;
+            *out = ESYS_TR_RH_PLATFORM;
+            return TSS2_RC_SUCCESS;
         case TPM2_RH_PLATFORM_NV:
-            return ESYS_TR_RH_PLATFORM_NV;
+            *out = ESYS_TR_RH_PLATFORM_NV;
+            return TSS2_RC_SUCCESS;
         default:
-            LOG_ERR("An unknown hierarchy handle was passed: 0x%08x", hierarchy);
-            return 0xffffffff;
+            LOG_ERR("An unknown hierarchy handle was passed: 0x%08x", in);
+            return TSS2_ESYS_RC_BAD_VALUE;
     }
 #elif defined(ESYS_2_3)
-    return hierarchy;
+    *out = in;
+    return TSS2_RC_SUCCESS;
 #else
 #error "Need to define either ESYS_3_0 or ESYS_2_3"
 #endif
@@ -688,8 +700,14 @@ tool_rc tpm2_hash(ESYS_CONTEXT *esys_context, ESYS_TR shandle1, ESYS_TR shandle2
         TPMI_RH_HIERARCHY hierarchy, TPM2B_DIGEST **out_hash,
         TPMT_TK_HASHCHECK **validation) {
 
-    TSS2_RC rval = Esys_Hash(esys_context, shandle1, shandle2, shandle3, data,
-            hash_alg, fix_esys_hierarchy(hierarchy), out_hash, validation);
+    TSS2_RC rval = fix_esys_hierarchy(hierarchy, &hierarchy);
+    if (rval != TSS2_RC_SUCCESS) {
+        LOG_ERR("Unknown hierarchy");
+        return tool_rc_from_tpm(rval);
+    }
+
+    rval = Esys_Hash(esys_context, shandle1, shandle2, shandle3, data,
+            hash_alg, hierarchy, out_hash, validation);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_Hash, rval);
         return tool_rc_from_tpm(rval);
@@ -729,9 +747,15 @@ tool_rc tpm2_sequence_complete(ESYS_CONTEXT *esys_context,
         TPMI_RH_HIERARCHY hierarchy, TPM2B_DIGEST **result,
         TPMT_TK_HASHCHECK **validation) {
 
-    TSS2_RC rval = Esys_SequenceComplete(esys_context, sequence_handle,
+    TSS2_RC rval = fix_esys_hierarchy(hierarchy, &hierarchy);
+    if (rval != TSS2_RC_SUCCESS) {
+        LOG_ERR("Unknown hierarchy");
+        return tool_rc_from_tpm(rval);
+    }
+
+    rval = Esys_SequenceComplete(esys_context, sequence_handle,
             ESYS_TR_PASSWORD, ESYS_TR_NONE, ESYS_TR_NONE, buffer,
-            fix_esys_hierarchy(hierarchy), result, validation);
+            hierarchy, result, validation);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_SequenceComplete, rval);
         return tool_rc_from_tpm(rval);
@@ -1161,8 +1185,14 @@ tool_rc tpm2_hierarchycontrol(ESYS_CONTEXT *esys_context,
         return rc;
     }
 
-    TSS2_RC rval = Esys_HierarchyControl(esys_context, auth_hierarchy->tr_handle,
-            shandle, ESYS_TR_NONE, ESYS_TR_NONE, fix_esys_hierarchy(enable), state);
+    TSS2_RC rval = fix_esys_hierarchy(enable, &enable);
+    if (rval != TSS2_RC_SUCCESS) {
+        LOG_ERR("Unknown hierarchy");
+        return tool_rc_from_tpm(rval);
+    }
+
+    rval = Esys_HierarchyControl(esys_context, auth_hierarchy->tr_handle,
+            shandle, ESYS_TR_NONE, ESYS_TR_NONE, enable, state);
     if (rval != TPM2_RC_SUCCESS && rval != TPM2_RC_INITIALIZE) {
         LOG_PERR(Esys_HierarchyControl, rval);
         return tool_rc_from_tpm(rval);
@@ -1257,9 +1287,17 @@ tool_rc tpm2_hmac_sequencecomplete(ESYS_CONTEXT *esys_context,
         return rc;
     }
 
-    TPM2_RC rval = Esys_SequenceComplete(esys_context, sequence_handle,
+    uint32_t hierarchy;
+
+    TSS2_RC rval = fix_esys_hierarchy(TPM2_RH_NULL, &hierarchy);
+    if (rval != TSS2_RC_SUCCESS) {
+        LOG_ERR("Unknown hierarchy");
+        return tool_rc_from_tpm(rval);
+    }
+
+    rval = Esys_SequenceComplete(esys_context, sequence_handle,
             hmac_key_obj_shandle, ESYS_TR_NONE, ESYS_TR_NONE, input_buffer,
-            fix_esys_hierarchy(TPM2_RH_NULL), result, validation);
+            hierarchy, result, validation);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_HMAC, rval);
         return tool_rc_from_tpm(rval);
@@ -1913,9 +1951,15 @@ tool_rc tpm2_loadexternal(ESYS_CONTEXT *ectx, const TPM2B_SENSITIVE *private,
         const TPM2B_PUBLIC *public, TPMI_RH_HIERARCHY hierarchy,
         ESYS_TR *object_handle) {
 
-    TSS2_RC rval = Esys_LoadExternal(ectx,
+    TSS2_RC rval = fix_esys_hierarchy(hierarchy, &hierarchy);
+    if (rval != TSS2_RC_SUCCESS) {
+        LOG_ERR("Unknown hierarchy");
+        return tool_rc_from_tpm(rval);
+    }
+
+    rval = Esys_LoadExternal(ectx,
             ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE,
-            private, public, fix_esys_hierarchy(hierarchy),
+            private, public, hierarchy,
             object_handle);
     if (rval != TSS2_RC_SUCCESS) {
         LOG_PERR(Esys_LoadExternal, rval);
diff --git a/lib/tpm2.h b/lib/tpm2.h
index a37e05606c7a..2e4ae5e7dddc 100644
--- a/lib/tpm2.h
+++ b/lib/tpm2.h
@@ -389,7 +389,7 @@ tool_rc tpm2_policy_nv_written(ESYS_CONTEXT *esys_context,
         ESYS_TR policy_session, ESYS_TR shandle1, ESYS_TR shandle2,
         ESYS_TR shandle3, TPMI_YES_NO written_set);
 
-uint32_t fix_esys_hierarchy(TPMI_RH_HIERARCHY hierarchy);
+TSS2_RC fix_esys_hierarchy(uint32_t in, uint32_t *out);
 
 tool_rc tpm2_certifycreation(ESYS_CONTEXT *esys_context,
     tpm2_loaded_object *signingkey_obj, tpm2_loaded_object *certifiedkey_obj,
diff --git a/tools/tpm2_loadexternal.c b/tools/tpm2_loadexternal.c
index 70fb72877aae..4127ca1b524b 100644
--- a/tools/tpm2_loadexternal.c
+++ b/tools/tpm2_loadexternal.c
@@ -48,9 +48,16 @@ static tpm_loadexternal_ctx ctx = {
 static tool_rc load_external(ESYS_CONTEXT *ectx, TPM2B_PUBLIC *pub,
         TPM2B_SENSITIVE *priv, bool has_priv, TPM2B_NAME **name) {
 
+    uint32_t hierarchy;
+    TSS2_RC rval = fix_esys_hierarchy(ctx.hierarchy_value, &hierarchy);
+    if (rval != TSS2_RC_SUCCESS) {
+        LOG_ERR("Unknown hierarchy");
+        return tool_rc_from_tpm(rval);
+    }
+
     tool_rc rc = tpm2_loadexternal(ectx,
             has_priv ? priv : NULL, pub,
-            fix_esys_hierarchy(ctx.hierarchy_value), &ctx.handle);
+            hierarchy, &ctx.handle);
     if (rc != tool_rc_success) {
         return rc;
     }
-- 
2.27.0