This series of patches fixes two issues with TPM2 selftest.
- Probes for available PCR banks
- Resets DA lock on TPM2 to avoid subsequent test failures
Stefan
Stefan Berger (2):
selftests: tpm: Probe for available PCR bank
selftests: tpm2: Reset the dictionary attack lock
tools/testing/selftests/tpm2/tpm2_tests.py | 32 ++++++++++++++++------
1 file changed, 24 insertions(+), 8 deletions(-)
--
2.31.1
Probe for an available PCR bank to accommodate devices that do not have a
SHA-1 PCR bank or whose SHA-1 bank is deactivated.
Signed-off-by: Stefan Berger <[email protected]>
---
tools/testing/selftests/tpm2/tpm2_tests.py | 31 ++++++++++++++++------
1 file changed, 23 insertions(+), 8 deletions(-)
diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
index 9d764306887b..a569c8d0db08 100644
--- a/tools/testing/selftests/tpm2/tpm2_tests.py
+++ b/tools/testing/selftests/tpm2/tpm2_tests.py
@@ -27,7 +27,21 @@ class SmokeTest(unittest.TestCase):
result = self.client.unseal(self.root_key, blob, auth, None)
self.assertEqual(data, result)
+ def determine_bank_alg(self):
+ # Probe for available PCR bank
+ for bank_alg in [tpm2.TPM2_ALG_SHA1, tpm2.TPM2_ALG_SHA256]:
+ try:
+ handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
+ self.client.policy_pcr(handle, [17], bank_alg=bank_alg)
+ break
+ except tpm2.UnknownPCRBankError:
+ pass
+ finally:
+ self.client.flush_context(handle)
+ return bank_alg
+
def test_seal_with_policy(self):
+ bank_alg = self.determine_bank_alg()
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
data = ('X' * 64).encode()
@@ -35,7 +49,7 @@ class SmokeTest(unittest.TestCase):
pcrs = [16]
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
policy_dig = self.client.get_policy_digest(handle)
@@ -47,7 +61,7 @@ class SmokeTest(unittest.TestCase):
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
result = self.client.unseal(self.root_key, blob, auth, handle)
@@ -72,6 +86,7 @@ class SmokeTest(unittest.TestCase):
self.assertEqual(rc, tpm2.TPM2_RC_AUTH_FAIL)
def test_unseal_with_wrong_policy(self):
+ bank_alg = self.determine_bank_alg()
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
data = ('X' * 64).encode()
@@ -79,7 +94,7 @@ class SmokeTest(unittest.TestCase):
pcrs = [16]
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
policy_dig = self.client.get_policy_digest(handle)
@@ -91,13 +106,13 @@ class SmokeTest(unittest.TestCase):
# Extend first a PCR that is not part of the policy and try to unseal.
# This should succeed.
- ds = tpm2.get_digest_size(tpm2.TPM2_ALG_SHA1)
- self.client.extend_pcr(1, ('X' * ds).encode())
+ ds = tpm2.get_digest_size(bank_alg)
+ self.client.extend_pcr(1, ('X' * ds).encode(), bank_alg=bank_alg)
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
result = self.client.unseal(self.root_key, blob, auth, handle)
@@ -109,14 +124,14 @@ class SmokeTest(unittest.TestCase):
# Then, extend a PCR that is part of the policy and try to unseal.
# This should fail.
- self.client.extend_pcr(16, ('X' * ds).encode())
+ self.client.extend_pcr(16, ('X' * ds).encode(), bank_alg=bank_alg)
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
rc = 0
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
result = self.client.unseal(self.root_key, blob, auth, handle)
--
2.31.1
Reset the dictionary attack lock to avoid the following types of test
failures after running the test 2 times:
======================================================================
ERROR: test_unseal_with_wrong_policy (tpm2_tests.SmokeTest)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2_tests.py", line 105, in test_unseal_with_wrong_policy
blob = self.client.seal(self.root_key, data, auth, policy_dig)
File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 620, in seal
rsp = self.send_cmd(cmd)
File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 397, in send_cmd
raise ProtocolError(cc, rc)
tpm2.ProtocolError: TPM_RC_LOCKOUT: cc=0x00000153, rc=0x00000921
Signed-off-by: Stefan Berger <[email protected]>
---
tools/testing/selftests/tpm2/tpm2_tests.py | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
index a569c8d0db08..109ffd736c73 100644
--- a/tools/testing/selftests/tpm2/tpm2_tests.py
+++ b/tools/testing/selftests/tpm2/tpm2_tests.py
@@ -100,6 +100,7 @@ class SmokeTest(unittest.TestCase):
policy_dig = self.client.get_policy_digest(handle)
finally:
self.client.flush_context(handle)
+ self.client.reset_da_lock()
blob = self.client.seal(self.root_key, data, auth, policy_dig)
--
2.31.1
On Mon, Nov 22, 2021 at 11:18 PM Stefan Berger <[email protected]> wrote:
>
> Probe for an available PCR bank to accommodate devices that do not have a
> SHA-1 PCR bank or whose SHA-1 bank is deactivated.
>
> Signed-off-by: Stefan Berger <[email protected]>
Tested-by: Marc-André Lureau <[email protected]>
> ---
> tools/testing/selftests/tpm2/tpm2_tests.py | 31 ++++++++++++++++------
> 1 file changed, 23 insertions(+), 8 deletions(-)
>
> diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
> index 9d764306887b..a569c8d0db08 100644
> --- a/tools/testing/selftests/tpm2/tpm2_tests.py
> +++ b/tools/testing/selftests/tpm2/tpm2_tests.py
> @@ -27,7 +27,21 @@ class SmokeTest(unittest.TestCase):
> result = self.client.unseal(self.root_key, blob, auth, None)
> self.assertEqual(data, result)
>
> + def determine_bank_alg(self):
> + # Probe for available PCR bank
> + for bank_alg in [tpm2.TPM2_ALG_SHA1, tpm2.TPM2_ALG_SHA256]:
> + try:
> + handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
> + self.client.policy_pcr(handle, [17], bank_alg=bank_alg)
> + break
> + except tpm2.UnknownPCRBankError:
> + pass
> + finally:
> + self.client.flush_context(handle)
> + return bank_alg
> +
> def test_seal_with_policy(self):
> + bank_alg = self.determine_bank_alg()
> handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
>
> data = ('X' * 64).encode()
> @@ -35,7 +49,7 @@ class SmokeTest(unittest.TestCase):
> pcrs = [16]
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> policy_dig = self.client.get_policy_digest(handle)
> @@ -47,7 +61,7 @@ class SmokeTest(unittest.TestCase):
> handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> result = self.client.unseal(self.root_key, blob, auth, handle)
> @@ -72,6 +86,7 @@ class SmokeTest(unittest.TestCase):
> self.assertEqual(rc, tpm2.TPM2_RC_AUTH_FAIL)
>
> def test_unseal_with_wrong_policy(self):
> + bank_alg = self.determine_bank_alg()
> handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
>
> data = ('X' * 64).encode()
> @@ -79,7 +94,7 @@ class SmokeTest(unittest.TestCase):
> pcrs = [16]
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> policy_dig = self.client.get_policy_digest(handle)
> @@ -91,13 +106,13 @@ class SmokeTest(unittest.TestCase):
> # Extend first a PCR that is not part of the policy and try to unseal.
> # This should succeed.
>
> - ds = tpm2.get_digest_size(tpm2.TPM2_ALG_SHA1)
> - self.client.extend_pcr(1, ('X' * ds).encode())
> + ds = tpm2.get_digest_size(bank_alg)
> + self.client.extend_pcr(1, ('X' * ds).encode(), bank_alg=bank_alg)
>
> handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> result = self.client.unseal(self.root_key, blob, auth, handle)
> @@ -109,14 +124,14 @@ class SmokeTest(unittest.TestCase):
>
> # Then, extend a PCR that is part of the policy and try to unseal.
> # This should fail.
> - self.client.extend_pcr(16, ('X' * ds).encode())
> + self.client.extend_pcr(16, ('X' * ds).encode(), bank_alg=bank_alg)
>
> handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
>
> rc = 0
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> result = self.client.unseal(self.root_key, blob, auth, handle)
> --
> 2.31.1
>
On Mon, Nov 22, 2021 at 11:18 PM Stefan Berger <[email protected]> wrote:
>
> Reset the dictionary attack lock to avoid the following types of test
> failures after running the test 2 times:
>
> ======================================================================
> ERROR: test_unseal_with_wrong_policy (tpm2_tests.SmokeTest)
> ----------------------------------------------------------------------
> Traceback (most recent call last):
> File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2_tests.py", line 105, in test_unseal_with_wrong_policy
> blob = self.client.seal(self.root_key, data, auth, policy_dig)
> File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 620, in seal
> rsp = self.send_cmd(cmd)
> File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 397, in send_cmd
> raise ProtocolError(cc, rc)
> tpm2.ProtocolError: TPM_RC_LOCKOUT: cc=0x00000153, rc=0x00000921
>
> Signed-off-by: Stefan Berger <[email protected]>
Tested-by: Marc-André Lureau <[email protected]>
> ---
> tools/testing/selftests/tpm2/tpm2_tests.py | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
> index a569c8d0db08..109ffd736c73 100644
> --- a/tools/testing/selftests/tpm2/tpm2_tests.py
> +++ b/tools/testing/selftests/tpm2/tpm2_tests.py
> @@ -100,6 +100,7 @@ class SmokeTest(unittest.TestCase):
> policy_dig = self.client.get_policy_digest(handle)
> finally:
> self.client.flush_context(handle)
> + self.client.reset_da_lock()
>
> blob = self.client.seal(self.root_key, data, auth, policy_dig)
>
> --
> 2.31.1
>
On Mon, 2021-11-22 at 14:17 -0500, Stefan Berger wrote:
> Probe for an available PCR bank to accommodate devices that do not have a
> SHA-1 PCR bank or whose SHA-1 bank is deactivated.
>
> Signed-off-by: Stefan Berger <[email protected]>
1. I don't understand what the patch does by reading this description.
2. linux-kselftest missing.
/Jarkko