From 3f9c713d3bff4abf417edf0f74e0b049bfd1b31f Mon Sep 17 00:00:00 2001

From: jetwhiz <Charles.Munson@ll.mit.edu>

Date: Fri, 3 May 2019 08:03:45 -0400

Subject: [PATCH] Add ability to check quotes and output PCR values for

 quotes

Add new tpm2_checkquote tool for checking quotes

  Pull shared functionality from tpm2_pcrlist into pcr library

  is_pcr_select_bit_set moved into tpm2_util library

  Add new functionality to openssl, pcr and util libraries

The tpm2_quote tool can now output PCR hash lists

Signed-off-by: jetwhiz <Charles.Munson@ll.mit.edu>

---

 CHANGELOG.md                        |   2 +

 Makefile.am                         |   3 +

 lib/pcr.c                           | 232 ++++++++++++++++

 lib/pcr.h                           |  27 ++

 lib/tpm2_openssl.c                  | 163 +++++++++++

 lib/tpm2_openssl.h                  |  57 ++++

 lib/tpm2_util.c                     | 148 ++++++++++

 lib/tpm2_util.h                     |  33 +++

 man/tpm2_checkquote.1.md            |  95 +++++++

 man/tpm2_quote.1.md                 |   9 +-

 test/system/test_tpm2_checkquote.sh |  86 ++++++

 test/system/test_tpm2_quote.sh      |  12 +-

 tools/tpm2_checkquote.c             | 409 ++++++++++++++++++++++++++++

 tools/tpm2_pcrlist.c                | 205 +-------------

 tools/tpm2_quote.c                  | 124 ++++++++-

 15 files changed, 1398 insertions(+), 207 deletions(-)

 create mode 100644 man/tpm2_checkquote.1.md

 create mode 100755 test/system/test_tpm2_checkquote.sh

 create mode 100644 tools/tpm2_checkquote.c

diff --git a/CHANGELOG.md b/CHANGELOG.md

index a8e4f39afde..7e83c6b7e6f 100644

--- a/CHANGELOG.md

+++ b/CHANGELOG.md

@@ -1,5 +1,7 @@

 ## Changelog

 ### 3.2.0 - next

+* tpm2_checkquote: Introduce new tool for checking validity of quotes.

+* tpm2_quote: Add ability to output PCR values for quotes.

 * tpm2_makecredential: add support for executing tool off-TPM.

 * tpm2_pcrreset: introduce new tool for resetting PCRs.

 * tpm2_quote: Fix AK auth password not being used.

diff --git a/Makefile.am b/Makefile.am

index 2195537ce01..854c24a03e3 100644

--- a/Makefile.am

+++ b/Makefile.am

@@ -59,6 +59,7 @@ LDADD = \

 # keep me sorted

 bin_PROGRAMS = \

+    tools/tpm2_checkquote \

     tools/tpm2_activatecredential \

     tools/tpm2_certify \

     tools/tpm2_create \

@@ -145,6 +146,7 @@ lib_libcommon_a_SOURCES = \

 TOOL_SRC := tools/tpm2_tool.c tools/tpm2_tool.h

+tools_tpm2_checkquote_SOURCES = tools/tpm2_checkquote.c $(TOOL_SRC)

 tools_tpm2_create_SOURCES = tools/tpm2_create.c $(TOOL_SRC)

 tools_tpm2_createprimary_SOURCES = tools/tpm2_createprimary.c $(TOOL_SRC)

 tools_tpm2_getcap_SOURCES = tools/tpm2_getcap.c $(TOOL_SRC)

@@ -259,6 +261,7 @@ if HAVE_MAN_PAGES

     man1_MANS := \

     man/man1/tpm2_activatecredential.1 \

     man/man1/tpm2_certify.1 \

+    man/man1/tpm2_checkquote.1 \

     man/man1/tpm2_create.1 \

     man/man1/tpm2_createpolicy.1 \

     man/man1/tpm2_createprimary.1 \

diff --git a/lib/pcr.c b/lib/pcr.c

index 5552b336f66..9b00dd6e0e3 100644

--- a/lib/pcr.c

+++ b/lib/pcr.c

@@ -33,13 +33,21 @@

 #include <string.h>

 #include <tss2/tss2_sys.h>

+#include <inttypes.h>

 #include <stdbool.h>

 #include "pcr.h"

 #include "log.h"

+#include "tpm2_tool.h"

 #include "tpm2_util.h"

 #include "tpm2_alg_util.h"

+static inline void set_pcr_select_size(TPMS_PCR_SELECTION *pcr_selection,

+        UINT8 size) {

+

+    pcr_selection->sizeofSelect = size;

+}

+

 static int pcr_get_id(const char *arg, UINT32 *pcrId)

 {

     UINT32 n = 0;

@@ -96,6 +104,111 @@ static bool pcr_parse_selection(const char *str, size_t len, TPMS_PCR_SELECTION

     return true;

 }

+static void shrink_pcr_selection(TPML_PCR_SELECTION *s) {

+

+    UINT32 i, j;

+

+    //seek for the first empty item

+    for (i = 0; i < s->count; i++)

+        if (!s->pcrSelections[i].hash)

+            break;

+    j = i + 1;

+

+    for (; i < s->count; i++) {

+        if (!s->pcrSelections[i].hash) {

+            for (; j < s->count; j++)

+                if (s->pcrSelections[j].hash)

+                    break;

+            if (j >= s->count)

+                break;

+

+            memcpy(&s->pcrSelections[i], &s->pcrSelections[j], sizeof(s->pcrSelections[i]));

+            s->pcrSelections[j].hash = 0;

+            j++;

+        }

+    }

+

+    s->count = i;

+}

+

+static void pcr_update_pcr_selections(TPML_PCR_SELECTION *s1, TPML_PCR_SELECTION *s2) {

+    UINT32 i1, i2, j;

+    for (i2 = 0; i2 < s2->count; i2++) {

+        for (i1 = 0; i1 < s1->count; i1++) {

+            if (s2->pcrSelections[i2].hash != s1->pcrSelections[i1].hash)

+                continue;

+

+            for (j = 0; j < s1->pcrSelections[i1].sizeofSelect; j++)

+                s1->pcrSelections[i1].pcrSelect[j] &=

+                        ~s2->pcrSelections[i2].pcrSelect[j];

+        }

+    }

+}

+

+static bool pcr_unset_pcr_sections(TPML_PCR_SELECTION *s) {

+    UINT32 i, j;

+    for (i = 0; i < s->count; i++) {

+        for (j = 0; j < s->pcrSelections[i].sizeofSelect; j++) {

+            if (s->pcrSelections[i].pcrSelect[j]) {

+                return false;

+            }

+        }

+    }

+

+    return true;

+}

+

+bool pcr_print_pcr_struct(TPML_PCR_SELECTION *pcrSelect, tpm2_pcrs *pcrs) {

+

+    UINT32 vi = 0, di = 0, i;

+    bool result = true;

+

+    tpm2_tool_output("pcrs:\n");

+

+    // Loop through all PCR/hash banks 

+    for (i = 0; i < pcrSelect->count; i++) {

+        const char *alg_name = tpm2_alg_util_algtostr(pcrSelect->pcrSelections[i].hash);

+

+        tpm2_tool_output("  %s:\n", alg_name);

+

+        // Loop through all PCRs in this bank

+        UINT8 pcr_id;

+        for (pcr_id = 0; pcr_id < pcrSelect->pcrSelections[i].sizeofSelect * 8; pcr_id++) {

+            if (!tpm2_util_is_pcr_select_bit_set(&pcrSelect->pcrSelections[i],

+                    pcr_id)) {

+                // skip non-selected banks

+                continue;

+            }

+            if (vi >= pcrs->count || di >= pcrs->pcr_values[vi].count) {

+                LOG_ERR("Something wrong, trying to print but nothing more");

+                return false;

+            }

+

+            // Print out PCR ID

+            tpm2_tool_output("    %-2d: 0x", pcr_id);

+

+            // Print out current PCR digest value

+            TPM2B_DIGEST *b = &pcrs->pcr_values[vi].digests[di];

+            int k;

+            for (k = 0; k < b->size; k++) {

+                tpm2_tool_output("%02X", b->buffer[k]);

+            }

+            tpm2_tool_output("\n");

+

+            if (++di < pcrs->pcr_values[vi].count) {

+                continue;

+            }

+

+            di = 0;

+            if (++vi < pcrs->count) {

+                continue;

+            }

+        }

+    }

+

+    return result;

+}

+

 bool pcr_parse_selections(const char *arg, TPML_PCR_SELECTION *pcrSels) {

     const char *strLeft = arg;

@@ -194,3 +307,122 @@ TSS2_RC get_max_supported_pcrs(TSS2_SYS_CONTEXT *sapi_context, UINT32 *max_pcrs)

     return TPM2_RC_SUCCESS;

 }

+

+bool pcr_get_banks(TSS2_SYS_CONTEXT *sapi_context, TPMS_CAPABILITY_DATA *capability_data, tpm2_algorithm *algs) {

+

+    TPMI_YES_NO more_data;

+    UINT32 rval;

+

+    rval = TSS2_RETRY_EXP(Tss2_Sys_GetCapability(sapi_context, no_argument, TPM2_CAP_PCRS, no_argument, required_argument,

+            &more_data, capability_data, 0));

+    if (rval != TPM2_RC_SUCCESS) {

+        LOG_ERR(

+                "GetCapability: Get PCR allocation status Error. TPM Error:0x%x......",

+                rval);

+        return false;

+    }

+

+    unsigned i;

+

+    // If the TPM support more bank algorithm that we currently

+    // able to manage, throw an error

+    if (capability_data->data.assignedPCR.count > sizeof(algs->alg)) {

+        LOG_ERR("Current implementation does not support more than %zu banks, "

+                "got %" PRIu32 " banks supported by TPM", 

+                sizeof(algs->alg), 

+                capability_data->data.assignedPCR.count);

+        return false;

+    }

+

+    for (i = 0; i < capability_data->data.assignedPCR.count; i++) {

+        algs->alg[i] =

+                capability_data->data.assignedPCR.pcrSelections[i].hash;

+    }

+    algs->count = capability_data->data.assignedPCR.count;

+

+    return true;

+}

+

+bool pcr_init_pcr_selection(TPMS_CAPABILITY_DATA *cap_data, TPML_PCR_SELECTION *pcr_sel, TPMI_ALG_HASH alg_id) {

+

+    UINT32 i, j;

+

+    pcr_sel->count = 0;

+

+    for (i = 0; i < cap_data->data.assignedPCR.count; i++) {

+        if (alg_id && (cap_data->data.assignedPCR.pcrSelections[i].hash != alg_id))

+            continue;

+        pcr_sel->pcrSelections[pcr_sel->count].hash = cap_data->data.assignedPCR.pcrSelections[i].hash;

+        set_pcr_select_size(&pcr_sel->pcrSelections[pcr_sel->count], cap_data->data.assignedPCR.pcrSelections[i].sizeofSelect);

+        for (j = 0; j < pcr_sel->pcrSelections[pcr_sel->count].sizeofSelect; j++)

+            pcr_sel->pcrSelections[pcr_sel->count].pcrSelect[j] = cap_data->data.assignedPCR.pcrSelections[i].pcrSelect[j];

+        pcr_sel->count++;

+    }

+

+    if (pcr_sel->count == 0)

+        return false;

+

+    return true;

+}

+

+bool pcr_check_pcr_selection(TPMS_CAPABILITY_DATA *cap_data, TPML_PCR_SELECTION *pcr_sel) {

+

+    UINT32 i, j, k;

+

+    for (i = 0; i < pcr_sel->count; i++) {

+        for (j = 0; j < cap_data->data.assignedPCR.count; j++) {

+            if (pcr_sel->pcrSelections[i].hash == cap_data->data.assignedPCR.pcrSelections[j].hash) {

+                for (k = 0; k < pcr_sel->pcrSelections[i].sizeofSelect; k++)

+                    pcr_sel->pcrSelections[i].pcrSelect[k] &= cap_data->data.assignedPCR.pcrSelections[j].pcrSelect[k];

+                break;

+            }

+        }

+

+        if (j >= cap_data->data.assignedPCR.count) {

+            const char *alg_name = tpm2_alg_util_algtostr(pcr_sel->pcrSelections[i].hash);

+            LOG_WARN("Ignore unsupported bank/algorithm: %s(0x%04x)", alg_name, pcr_sel->pcrSelections[i].hash);

+            pcr_sel->pcrSelections[i].hash = 0; //mark it as to be removed

+        }

+    }

+

+    shrink_pcr_selection(pcr_sel);

+    if (pcr_sel->count == 0)

+        return false;

+

+    return true;

+}

+

+bool pcr_read_pcr_values(TSS2_SYS_CONTEXT *sapi_context, TPML_PCR_SELECTION *pcrSelections, tpm2_pcrs *pcrs) {

+

+    TPML_PCR_SELECTION pcr_selection_tmp;

+    TPML_PCR_SELECTION pcr_selection_out;

+    UINT32 pcr_update_counter;

+

+    //1. prepare pcrSelectionIn with g_pcrSelections

+    memcpy(&pcr_selection_tmp, pcrSelections, sizeof(pcr_selection_tmp));

+

+    //2. call pcr_read

+    pcrs->count = 0;

+    do {

+        UINT32 rval = TSS2_RETRY_EXP(Tss2_Sys_PCR_Read(sapi_context, no_argument, &pcr_selection_tmp,

+                &pcr_update_counter, &pcr_selection_out,

+                &pcrs->pcr_values[pcrs->count], 0));

+

+        if (rval != TPM2_RC_SUCCESS) {

+            LOG_ERR("read pcr failed. tpm error 0x%0x", rval);

+            return -1;

+        }

+

+        //3. unmask pcrSelectionOut bits from pcrSelectionIn

+        pcr_update_pcr_selections(&pcr_selection_tmp, &pcr_selection_out);

+

+        //4. goto step 2 if pcrSelctionIn still has bits set

+    } while (++pcrs->count < sizeof(pcrs->pcr_values) && !pcr_unset_pcr_sections(&pcr_selection_tmp));

+

+    if (pcrs->count >= sizeof(pcrs->pcr_values) && !pcr_unset_pcr_sections(&pcr_selection_tmp)) {

+        LOG_ERR("too much pcrs to get! try to split into multiple calls...");

+        return false;

+    }

+

+    return true;

+}

diff --git a/lib/pcr.h b/lib/pcr.h

index ad6946b3c04..82d5dd696d4 100644

--- a/lib/pcr.h

+++ b/lib/pcr.h

@@ -35,8 +35,35 @@

 #include <tss2/tss2_sys.h>

+typedef struct tpm2_algorithm tpm2_algorithm;

+struct tpm2_algorithm {

+    int count;

+    TPMI_ALG_HASH alg[TPM2_NUM_PCR_BANKS];

+};

+

+typedef struct tpm2_pcrs tpm2_pcrs;

+struct tpm2_pcrs {

+    size_t count;

+    TPML_DIGEST pcr_values[TPM2_MAX_PCRS];

+};

+

+/**

+ * Echo out all PCR banks according to g_pcrSelection & g_pcrs->.

+ * @param pcrSelect

+ *  Description of which PCR registers are selected.

+ * @param pcrs

+ *  Struct containing PCR digests.

+ * @return

+ *  True on success, false otherwise.

+ */

+bool pcr_print_pcr_struct(TPML_PCR_SELECTION *pcrSelect, tpm2_pcrs *pcrs);

+

 bool pcr_parse_selections(const char *arg, TPML_PCR_SELECTION *pcrSels);

 bool pcr_parse_list(const char *str, size_t len, TPMS_PCR_SELECTION *pcrSel);

 TSS2_RC get_max_supported_pcrs(TSS2_SYS_CONTEXT *sapi_context, UINT32 *max_pcrs);

+bool pcr_get_banks(TSS2_SYS_CONTEXT *sapi_context, TPMS_CAPABILITY_DATA *capability_data, tpm2_algorithm *algs);

+bool pcr_init_pcr_selection(TPMS_CAPABILITY_DATA *cap_data, TPML_PCR_SELECTION *pcr_sel, TPMI_ALG_HASH alg_id);

+bool pcr_check_pcr_selection(TPMS_CAPABILITY_DATA *cap_data, TPML_PCR_SELECTION *pcr_sel);

+bool pcr_read_pcr_values(TSS2_SYS_CONTEXT *sapi_context, TPML_PCR_SELECTION *pcrSelections, tpm2_pcrs *pcrs);

 #endif /* SRC_PCR_H_ */

diff --git a/lib/tpm2_openssl.c b/lib/tpm2_openssl.c

index 0bfc95bd1ef..8d7314cba8e 100644

--- a/lib/tpm2_openssl.c

+++ b/lib/tpm2_openssl.c

@@ -44,9 +44,26 @@

 #include "files.h"

 #include "log.h"

 #include "tpm2_alg_util.h"

+#include "tpm_kdfa.h"

 #include "tpm2_openssl.h"

 #include "tpm2_util.h"

+int tpm2_openssl_halgid_from_tpmhalg(TPMI_ALG_HASH algorithm) {

+

+    switch (algorithm) {

+    case TPM2_ALG_SHA1:

+        return NID_sha1;

+    case TPM2_ALG_SHA256:

+        return NID_sha256;

+    case TPM2_ALG_SHA384:

+        return NID_sha384;

+    case TPM2_ALG_SHA512:

+        return NID_sha512;

+    default:

+        return NID_sha256;

+    }

+    /* no return, not possible */

+}

 const EVP_MD *tpm2_openssl_halg_from_tpmhalg(TPMI_ALG_HASH algorithm) {

@@ -122,6 +139,127 @@ void tpm2_openssl_cipher_free(EVP_CIPHER_CTX *ctx) {

 #endif

 }

+bool tpm2_openssl_hash_compute_data(TPMI_ALG_HASH halg,

+        BYTE *buffer, UINT16 length, TPM2B_DIGEST *digest) {

+

+    bool result = false;

+

+    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(halg);

+    if (!md) {

+        return false;

+    }

+

+    EVP_MD_CTX *mdctx = EVP_MD_CTX_create();

+    if (!mdctx) {

+        LOG_ERR("%s", get_openssl_err());

+        return false;

+    }

+

+    int rc = EVP_DigestInit_ex(mdctx, md, NULL);

+    if (!rc) {

+        LOG_ERR("%s", get_openssl_err());

+        goto out;

+    }

+

+    rc = EVP_DigestUpdate(mdctx, buffer, length);

+    if (!rc) {

+        LOG_ERR("%s", get_openssl_err());

+        goto out;

+    }

+

+    unsigned size = EVP_MD_size(md);

+    rc = EVP_DigestFinal_ex(mdctx, digest->buffer, &size);

+    if (!rc) {

+        LOG_ERR("%s", get_openssl_err());

+        goto out;

+    }

+

+    digest->size = size;

+

+    result = true;

+

+out:

+    EVP_MD_CTX_destroy(mdctx);

+    return result;

+}

+

+// show all PCR banks according to g_pcrSelection & g_pcrs->

+bool tpm2_openssl_hash_pcr_banks(TPMI_ALG_HASH hashAlg, 

+                TPML_PCR_SELECTION *pcrSelect, 

+                tpm2_pcrs *pcrs, TPM2B_DIGEST *digest) {

+

+    UINT32 vi = 0, di = 0, i;

+    bool result = false;

+

+    const EVP_MD *md = tpm2_openssl_halg_from_tpmhalg(hashAlg);

+    if (!md) {

+        return false;

+    }

+

+    EVP_MD_CTX *mdctx = EVP_MD_CTX_create();

+    if (!mdctx) {

+        LOG_ERR("%s", get_openssl_err());

+        return false;

+    }

+

+    int rc = EVP_DigestInit_ex(mdctx, md, NULL);

+    if (!rc) {

+        LOG_ERR("%s", get_openssl_err());

+        goto out;

+    }

+

+    // Loop through all PCR/hash banks 

+    for (i = 0; i < pcrSelect->count; i++) {

+

+        // Loop through all PCRs in this bank

+        UINT8 pcr_id;

+        for (pcr_id = 0; pcr_id < pcrSelect->pcrSelections[i].sizeofSelect * 8; pcr_id++) {

+            if (!tpm2_util_is_pcr_select_bit_set(&pcrSelect->pcrSelections[i],

+                    pcr_id)) {

+                // skip non-selected banks

+                continue;

+            }

+            if (vi >= pcrs->count || di >= pcrs->pcr_values[vi].count) {

+                LOG_ERR("Something wrong, trying to print but nothing more");

+                goto out;

+            }

+

+            // Update running digest (to compare with quote)

+            TPM2B_DIGEST *b = &pcrs->pcr_values[vi].digests[di];

+            rc = EVP_DigestUpdate(mdctx, b->buffer, b->size);

+            if (!rc) {

+                LOG_ERR("%s", get_openssl_err());

+                goto out;

+            }

+

+            if (++di < pcrs->pcr_values[vi].count) {

+                continue;

+            }

+

+            di = 0;

+            if (++vi < pcrs->count) {

+                continue;

+            }

+        }

+    }

+

+    // Finalize running digest

+    unsigned size = EVP_MD_size(md);

+    rc = EVP_DigestFinal_ex(mdctx, digest->buffer, &size);

+    if (!rc) {

+        LOG_ERR("%s", get_openssl_err());

+        goto out;

+    }

+

+    digest->size = size;

+

+    result = true;

+

+out:

+    EVP_MD_CTX_destroy(mdctx);

+    return result;

+}

+

 digester tpm2_openssl_halg_to_digester(TPMI_ALG_HASH halg) {

     switch(halg) {

@@ -160,3 +298,28 @@ digester tpm2_openssl_halg_to_digester(TPMI_ALG_HASH halg) {

  */

 typedef bool (*pfn_ossl_pw_handler)(const char *passin, char **pass);

+

+

+RSA *tpm2_openssl_get_public_RSA_from_pem(FILE *f, const char *path) {

+

+    /*

+     * Public PEM files appear in two formats:

+     * 1. PEM format, read with PEM_read_RSA_PUBKEY

+     * 2. PKCS#1 format, read with PEM_read_RSAPublicKey

+     *

+     * See:

+     *  - https://stackoverflow.com/questions/7818117/why-i-cant-read-openssl-generated-rsa-pub-key-with-pem-read-rsapublickey

+     */

+    RSA *pub = PEM_read_RSA_PUBKEY(f, NULL, NULL, NULL);

+    if (!pub) {

+        pub = PEM_read_RSAPublicKey(f, NULL, NULL, NULL);

+    }

+

+    if (!pub) {

+         ERR_print_errors_fp (stderr);

+         LOG_ERR("Reading public PEM file \"%s\" failed", path);

+         return NULL;

+    }

+

+    return pub;

+}

diff --git a/lib/tpm2_openssl.h b/lib/tpm2_openssl.h

index d749cb350ac..d3f4a0d7a32 100644

--- a/lib/tpm2_openssl.h

+++ b/lib/tpm2_openssl.h

@@ -34,6 +34,8 @@

 #include <openssl/hmac.h>

 #include <openssl/rsa.h>

+#include "pcr.h"

+

 #if (OPENSSL_VERSION_NUMBER < 0x1010000fL && !defined(LIBRESSL_VERSION_NUMBER)) || (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20700000L) /* OpenSSL 1.1.0 */

 #define LIB_TPM2_OPENSSL_OPENSSL_PRE11

 #endif

@@ -60,6 +62,16 @@ int RSA_set0_key(RSA *r, BIGNUM *n, BIGNUM *e, BIGNUM *d);

  */

 typedef unsigned char *(*digester)(const unsigned char *d, size_t n, unsigned char *md);

+/**

+

+ * Get an openssl hash algorithm ID from a tpm hashing algorithm ID.

+ * @param algorithm

+ *  The tpm algorithm to get the corresponding openssl version of.

+ * @return

+ *  The openssl hash algorithm id.

+ */

+int tpm2_openssl_halgid_from_tpmhalg(TPMI_ALG_HASH algorithm);

+

 /**

  * Get an openssl message digest from a tpm hashing algorithm.

  * @param algorithm

@@ -86,6 +98,39 @@ EVP_CIPHER_CTX *tpm2_openssl_cipher_new(void);

  */

 void tpm2_openssl_cipher_free(EVP_CIPHER_CTX *ctx);

+/**

+ * Hash a byte buffer.

+ * @param halg

+ *  The hashing algorithm to use.

+ * @param buffer

+ *  The byte buffer to be hashed.

+ * @param length

+ *  The length of the byte buffer to hash.

+^ * @param digest

+^ *  The result of hashing digests with halg.

+ * @return

+ *  true on success, false on error.

+ */

+bool tpm2_openssl_hash_compute_data(TPMI_ALG_HASH halg,

+        BYTE *buffer, UINT16 length, TPM2B_DIGEST *digest);

+

+/**

+ * Hash a list of PCR digests, supporting multiple banks.

+ * @param halg

+ *  The hashing algorithm to use.

+ * @param pcrSelect

+ *  The list that specifies which PCRs are selected.

+ * @param pcrs

+ *  The list of PCR banks, each containing a list of PCR digests to hash.

+^ * @param digest

+^ *  The result of hashing digests with halg.

+ * @return

+ *  true on success, false on error.

+ */

+bool tpm2_openssl_hash_pcr_banks(TPMI_ALG_HASH hashAlg, 

+        TPML_PCR_SELECTION *pcrSelect, 

+        tpm2_pcrs *pcrs, TPM2B_DIGEST *digest);

+

 /**

  * Returns a function pointer capable of performing the

  * given digest from a TPMI_HASH_ALG.

@@ -105,4 +150,16 @@ enum tpm2_openssl_load_rc {

 };

+/**

+ * Retrieves a public portion of an RSA key from a PEM file.

+ *

+ * @param f

+ *  The FILE object that is open for reading the path.

+ * @param path

+ *  The path to load from.

+ * @return

+ *  The public structure.

+ */

+RSA* tpm2_openssl_get_public_RSA_from_pem(FILE *f, const char *path);

+

 #endif /* LIB_TPM2_OPENSSL_H_ */

diff --git a/lib/tpm2_util.c b/lib/tpm2_util.c

index 57d6c762a70..edfda4a8b0b 100644

--- a/lib/tpm2_util.c

+++ b/lib/tpm2_util.c

@@ -41,6 +41,154 @@

 #include "tpm2_tool.h"

 #include "tpm2_util.h"

+

+bool tpm2_util_get_digest_from_quote(TPM2B_ATTEST *quoted, TPM2B_DIGEST *digest, TPM2B_DATA *extraData) {

+    TPM2_GENERATED magic;

+    TPMI_ST_ATTEST type;

+    UINT16 nameSize = 0;

+    UINT32 i = 0;

+

+    // Ensure required headers are at least there

+    if (quoted->size < 6) {

+        LOG_ERR("Malformed TPM2B_ATTEST headers");

+        return false;

+    }

+

+    memcpy(&magic, &quoted->attestationData[i], 4);i += 4;

+    memcpy(&type, &quoted->attestationData[i], 2);i += 2;

+    if (!tpm2_util_is_big_endian()) {

+        magic = tpm2_util_endian_swap_32(magic);

+        type = tpm2_util_endian_swap_16(type);

+    }

+

+    if (magic != TPM2_GENERATED_VALUE) {

+        LOG_ERR("Malformed TPM2_GENERATED magic value");

+        return false;

+    }

+

+    if (type != TPM2_ST_ATTEST_QUOTE) {

+        LOG_ERR("Malformed TPMI_ST_ATTEST quote value");

+        return false;

+    }

+

+    // Qualified signer name (skip)

+    if (i+2 >= quoted->size) {

+        LOG_ERR("Malformed TPM2B_NAME value");

+        return false;

+    }

+    memcpy(&nameSize, &quoted->attestationData[i], 2);i += 2;

+    if (!tpm2_util_is_big_endian()) {

+        nameSize = tpm2_util_endian_swap_16(nameSize);

+    }

+    i += nameSize;

+

+    // Extra data (skip)

+    if (i+2 >= quoted->size) {

+        LOG_ERR("Malformed TPM2B_DATA value");

+        return false;

+    }

+    memcpy(&extraData->size, &quoted->attestationData[i], 2);i += 2;

+    if (!tpm2_util_is_big_endian()) {

+        extraData->size = tpm2_util_endian_swap_16(extraData->size);

+    }

+    if (extraData->size+i > quoted->size) {

+        LOG_ERR("Malformed extraData TPM2B_DATA value");

+        return false;

+    }

+    memcpy(&extraData->buffer, &quoted->attestationData[i], extraData->size);i += extraData->size;

+

+    // Clock info (skip)

+    i += 17;

+    if (i >= quoted->size) {

+        LOG_ERR("Malformed TPMS_CLOCK_INFO value");

+        return false;

+    }

+

+    // Firmware info (skip)

+    i += 8;

+    if (i >= quoted->size) {

+        LOG_ERR("Malformed firmware version value");

+        return false;

+    }

+

+    // PCR select info

+    UINT8 sos;

+    TPMI_ALG_HASH hashAlg;

+    UINT32 pcrSelCount = 0, j = 0;

+    if (i+4 >= quoted->size) {

+        LOG_ERR("Malformed TPML_PCR_SELECTION value");

+        return false;

+    }

+    memcpy(&pcrSelCount, &quoted->attestationData[i], 4);i += 4;

+    if (!tpm2_util_is_big_endian()) {

+        pcrSelCount = tpm2_util_endian_swap_32(pcrSelCount);

+    }

+    for (j = 0; j < pcrSelCount; j++) {

+        // Hash 

+        if (i+2 >= quoted->size) {

+            LOG_ERR("Malformed TPMS_PCR_SELECTION value");

+            return false;

+        }

+        memcpy(&hashAlg, &quoted->attestationData[i], 2);i += 2;

+        if (!tpm2_util_is_big_endian()) {

+            hashAlg = tpm2_util_endian_swap_16(hashAlg);

+        }

+

+        // SizeOfSelected

+        if (i+1 >= quoted->size) {

+            LOG_ERR("Malformed TPMS_PCR_SELECTION value");

+            return false;

+        }

+        memcpy(&sos, &quoted->attestationData[i], 1);i += 1;

+

+        // PCR Select (skip)

+        i += sos;

+        if (i >= quoted->size) {

+            LOG_ERR("Malformed TPMS_PCR_SELECTION value");

+            return false;

+        }

+    }

+

+    // Digest

+    if (i+2 >= quoted->size) {

+        LOG_ERR("Malformed TPM2B_DIGEST value");

+        return false;

+    }

+    memcpy(&digest->size, &quoted->attestationData[i], 2);i += 2;

+    if (!tpm2_util_is_big_endian()) {

+        digest->size = tpm2_util_endian_swap_16(digest->size);

+    }

+

+    if (digest->size+i > quoted->size) {

+        LOG_ERR("Malformed TPM2B_DIGEST value");

+        return false;

+    }

+    memcpy(&digest->buffer, &quoted->attestationData[i], digest->size);

+

+    return true;

+}

+

+// verify that the quote digest equals the digest we calculated

+bool tpm2_util_verify_digests(TPM2B_DIGEST *quoteDigest, TPM2B_DIGEST *pcrDigest) {

+

+    // Sanity check -- they should at least be same size!

+    if (quoteDigest->size != pcrDigest->size) {

+        LOG_ERR("FATAL ERROR: PCR values failed to match quote's digest!");

+        return false;

+    }

+

+    // Compare running digest with quote's digest

+    int k;

+    for (k = 0; k < quoteDigest->size; k++) {

+        if (quoteDigest->buffer[k] != pcrDigest->buffer[k]) {

+            LOG_ERR("FATAL ERROR: PCR values failed to match quote's digest!");

+            return false;

+        }

+    }

+

+    return true;

+}

+

 bool tpm2_util_concat_buffer(TPM2B_MAX_BUFFER *result, TPM2B *append) {

     if (!result || !append) {

diff --git a/lib/tpm2_util.h b/lib/tpm2_util.h

index e803dc1c30e..8b77c9e5374 100644

--- a/lib/tpm2_util.h

+++ b/lib/tpm2_util.h

@@ -111,6 +111,30 @@ struct TPM2B {

 int tpm2_util_hex_to_byte_structure(const char *inStr, UINT16 *byteLenth, BYTE *byteBuffer);

+/**

+ * Pulls the TPM2B_DIGEST out of a TPM2B_ATTEST quote.

+ * @param quoted

+ *  The attestation quote structure.

+^ * @param digest

+^ *  The digest from the quote.

+^ * @param extraData

+^ *  The extraData from the quote.

+ * @return

+ *  True on success, false otherwise.

+ */

+bool tpm2_util_get_digest_from_quote(TPM2B_ATTEST *quoted, TPM2B_DIGEST *digest, TPM2B_DATA *extraData);

+

+/**

+ * Compares two digests to ensure they are equal (for validation).

+ * @param quoteDigest

+ *  The digest from the quote.

+ * @param pcrDigest

+ *  The digest calculated off-TMP from the PCRs.

+ * @return

+ *  True on success, false otherwise.

+ */

+bool tpm2_util_verify_digests(TPM2B_DIGEST *quoteDigest, TPM2B_DIGEST *pcrDigest);

+

 /**

  * Appends a TPM2B_DIGEST buffer to a TPM2B_MAX buffer.

  * @param result

@@ -170,6 +194,15 @@ static inline void tpm2_util_print_tpm2b(TPM2B *buffer) {

 void tpm2_util_print_tpm2b(TPM2B *buffer);

+/**

+ * Determines if given PCR value is selected in TPMS_PCR_SELECTION structure.

+ * @param pcr_selection the TPMS_PCR_SELECTION structure to check pcr against.

+ * @param pcr the PCR ID to check selection status of.

+ */

+static inline bool tpm2_util_is_pcr_select_bit_set(TPMS_PCR_SELECTION *pcr_selection, UINT32 pcr) {

+    return (pcr_selection->pcrSelect[((pcr) / 8)] & (1 << ((pcr) % 8)));

+}

+

 /**

  * Copies a tpm2b from dest to src and clears dest if src is NULL.

  * If src is NULL, it is a NOP.

diff --git a/man/tpm2_checkquote.1.md b/man/tpm2_checkquote.1.md

new file mode 100644

index 00000000000..00bb4bee9a7

--- /dev/null

+++ b/man/tpm2_checkquote.1.md

@@ -0,0 +1,95 @@

+% tpm2_checkquote(1) tpm2-tools | General Commands Manual

+%

+% JANUARY 2019

+

+# NAME

+

+**tpm2_checkquote**(1) - Validates a quote provided by a TPM.

+

+# SYNOPSIS

+

+**tpm2_checkquote** [*OPTIONS*]

+

+# DESCRIPTION

+