This series of patches fixes two issues with TPM2 selftest.
- Probes for available PCR banks
- Resets DA lock on TPM2 to avoid subsequent test failures
It also extends the test cases with support for SHA-384 and SHA-512
PCR banks.
Stefan
v2:
- Clarified patch 1 description
- Added patch 3 with support for SHA-384 and SHA-512
Stefan Berger (3):
selftests: tpm2: Probe for available PCR bank
selftests: tpm2: Reset the dictionary attack lock
selftests: tpm2: Add support for SHA-384 and SHA-512
tools/testing/selftests/tpm2/tpm2.py | 12 ++++++-
tools/testing/selftests/tpm2/tpm2_tests.py | 37 +++++++++++++++++-----
2 files changed, 40 insertions(+), 9 deletions(-)
--
2.31.1
Reset the dictionary attack lock to avoid the following types of test
failures after running the test 2 times:
======================================================================
ERROR: test_unseal_with_wrong_policy (tpm2_tests.SmokeTest)
----------------------------------------------------------------------
Traceback (most recent call last):
File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2_tests.py", line 105, in test_unseal_with_wrong_policy
blob = self.client.seal(self.root_key, data, auth, policy_dig)
File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 620, in seal
rsp = self.send_cmd(cmd)
File "/root/linux-ima-namespaces/tools/testing/selftests/tpm2/tpm2.py", line 397, in send_cmd
raise ProtocolError(cc, rc)
tpm2.ProtocolError: TPM_RC_LOCKOUT: cc=0x00000153, rc=0x00000921
Signed-off-by: Stefan Berger <[email protected]>
---
tools/testing/selftests/tpm2/tpm2_tests.py | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
index 6b88ff0e47b9..ae88d8866e5d 100644
--- a/tools/testing/selftests/tpm2/tpm2_tests.py
+++ b/tools/testing/selftests/tpm2/tpm2_tests.py
@@ -104,6 +104,7 @@ class SmokeTest(unittest.TestCase):
policy_dig = self.client.get_policy_digest(handle)
finally:
self.client.flush_context(handle)
+ self.client.reset_da_lock()
blob = self.client.seal(self.root_key, data, auth, policy_dig)
--
2.31.1
Add support for SHA-384 and SHA-512 to the TPM2 library and extend
the test case's PCR bank probing function to also probe for SHA-384
and SHA-512 banks in case SHA-1 and SHA-256 banks are not available
for use.
Signed-off-by: Stefan Berger <[email protected]>
---
tools/testing/selftests/tpm2/tpm2.py | 12 +++++++++++-
tools/testing/selftests/tpm2/tpm2_tests.py | 3 ++-
2 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/tpm2/tpm2.py b/tools/testing/selftests/tpm2/tpm2.py
index f34486cd7342..d0960fe0e029 100644
--- a/tools/testing/selftests/tpm2/tpm2.py
+++ b/tools/testing/selftests/tpm2/tpm2.py
@@ -37,6 +37,8 @@ TPM2_ALG_SHA1 = 0x0004
TPM2_ALG_AES = 0x0006
TPM2_ALG_KEYEDHASH = 0x0008
TPM2_ALG_SHA256 = 0x000B
+TPM2_ALG_SHA384 = 0x000C
+TPM2_ALG_SHA512 = 0x000D
TPM2_ALG_NULL = 0x0010
TPM2_ALG_CBC = 0x0042
TPM2_ALG_CFB = 0x0043
@@ -67,6 +69,8 @@ HR_TRANSIENT = 0x80000000
SHA1_DIGEST_SIZE = 20
SHA256_DIGEST_SIZE = 32
+SHA384_DIGEST_SIZE = 48
+SHA512_DIGEST_SIZE = 64
TPM2_VER0_ERRORS = {
0x000: "TPM_RC_SUCCESS",
@@ -186,16 +190,22 @@ RC_WARN = 0x900
ALG_DIGEST_SIZE_MAP = {
TPM2_ALG_SHA1: SHA1_DIGEST_SIZE,
TPM2_ALG_SHA256: SHA256_DIGEST_SIZE,
+ TPM2_ALG_SHA384: SHA384_DIGEST_SIZE,
+ TPM2_ALG_SHA512: SHA512_DIGEST_SIZE,
}
ALG_HASH_FUNCTION_MAP = {
TPM2_ALG_SHA1: hashlib.sha1,
- TPM2_ALG_SHA256: hashlib.sha256
+ TPM2_ALG_SHA256: hashlib.sha256,
+ TPM2_ALG_SHA384: hashlib.sha384,
+ TPM2_ALG_SHA512: hashlib.sha512,
}
NAME_ALG_MAP = {
"sha1": TPM2_ALG_SHA1,
"sha256": TPM2_ALG_SHA256,
+ "sha384": TPM2_ALG_SHA384,
+ "sha512": TPM2_ALG_SHA512,
}
diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
index ae88d8866e5d..3feca25038f5 100644
--- a/tools/testing/selftests/tpm2/tpm2_tests.py
+++ b/tools/testing/selftests/tpm2/tpm2_tests.py
@@ -29,7 +29,8 @@ class SmokeTest(unittest.TestCase):
def determine_bank_alg(self):
# Probe for available PCR bank
- for bank_alg in [tpm2.TPM2_ALG_SHA1, tpm2.TPM2_ALG_SHA256]:
+ for bank_alg in [tpm2.TPM2_ALG_SHA1, tpm2.TPM2_ALG_SHA256,
+ tpm2.TPM2_ALG_SHA384, tpm2.TPM2_ALG_SHA512]:
try:
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
self.client.policy_pcr(handle, [17], bank_alg=bank_alg)
--
2.31.1
Probe for an available PCR bank to accommodate devices that do not have a
SHA-1 PCR bank or whose SHA-1 bank is deactivated. Use the bank that can
be used in the TPM2 commands. Assert on the probing function to not
return None.
Signed-off-by: Stefan Berger <[email protected]>
---
tools/testing/selftests/tpm2/tpm2_tests.py | 35 +++++++++++++++++-----
1 file changed, 27 insertions(+), 8 deletions(-)
diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
index 9d764306887b..6b88ff0e47b9 100644
--- a/tools/testing/selftests/tpm2/tpm2_tests.py
+++ b/tools/testing/selftests/tpm2/tpm2_tests.py
@@ -27,7 +27,23 @@ class SmokeTest(unittest.TestCase):
result = self.client.unseal(self.root_key, blob, auth, None)
self.assertEqual(data, result)
+ def determine_bank_alg(self):
+ # Probe for available PCR bank
+ for bank_alg in [tpm2.TPM2_ALG_SHA1, tpm2.TPM2_ALG_SHA256]:
+ try:
+ handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
+ self.client.policy_pcr(handle, [17], bank_alg=bank_alg)
+ return bank_alg
+ except tpm2.UnknownPCRBankError:
+ pass
+ finally:
+ self.client.flush_context(handle)
+ return None
+
def test_seal_with_policy(self):
+ bank_alg = self.determine_bank_alg()
+ self.assertIsNotNone(bank_alg)
+
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
data = ('X' * 64).encode()
@@ -35,7 +51,7 @@ class SmokeTest(unittest.TestCase):
pcrs = [16]
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
policy_dig = self.client.get_policy_digest(handle)
@@ -47,7 +63,7 @@ class SmokeTest(unittest.TestCase):
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
result = self.client.unseal(self.root_key, blob, auth, handle)
@@ -72,6 +88,9 @@ class SmokeTest(unittest.TestCase):
self.assertEqual(rc, tpm2.TPM2_RC_AUTH_FAIL)
def test_unseal_with_wrong_policy(self):
+ bank_alg = self.determine_bank_alg()
+ self.assertIsNotNone(bank_alg)
+
handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
data = ('X' * 64).encode()
@@ -79,7 +98,7 @@ class SmokeTest(unittest.TestCase):
pcrs = [16]
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
policy_dig = self.client.get_policy_digest(handle)
@@ -91,13 +110,13 @@ class SmokeTest(unittest.TestCase):
# Extend first a PCR that is not part of the policy and try to unseal.
# This should succeed.
- ds = tpm2.get_digest_size(tpm2.TPM2_ALG_SHA1)
- self.client.extend_pcr(1, ('X' * ds).encode())
+ ds = tpm2.get_digest_size(bank_alg)
+ self.client.extend_pcr(1, ('X' * ds).encode(), bank_alg=bank_alg)
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
result = self.client.unseal(self.root_key, blob, auth, handle)
@@ -109,14 +128,14 @@ class SmokeTest(unittest.TestCase):
# Then, extend a PCR that is part of the policy and try to unseal.
# This should fail.
- self.client.extend_pcr(16, ('X' * ds).encode())
+ self.client.extend_pcr(16, ('X' * ds).encode(), bank_alg=bank_alg)
handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
rc = 0
try:
- self.client.policy_pcr(handle, pcrs)
+ self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
self.client.policy_password(handle)
result = self.client.unseal(self.root_key, blob, auth, handle)
--
2.31.1
On Wed, Nov 24, 2021 at 09:13:12AM -0500, Stefan Berger wrote:
> Probe for an available PCR bank to accommodate devices that do not have a
> SHA-1 PCR bank or whose SHA-1 bank is deactivated. Use the bank that can
> be used in the TPM2 commands. Assert on the probing function to not
> return None.
What is *the bank* that can be used?
In addition, I don't understand the last sentence.
/Jarkko
>
> Signed-off-by: Stefan Berger <[email protected]>
> ---
> tools/testing/selftests/tpm2/tpm2_tests.py | 35 +++++++++++++++++-----
> 1 file changed, 27 insertions(+), 8 deletions(-)
>
> diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
> index 9d764306887b..6b88ff0e47b9 100644
> --- a/tools/testing/selftests/tpm2/tpm2_tests.py
> +++ b/tools/testing/selftests/tpm2/tpm2_tests.py
> @@ -27,7 +27,23 @@ class SmokeTest(unittest.TestCase):
> result = self.client.unseal(self.root_key, blob, auth, None)
> self.assertEqual(data, result)
>
> + def determine_bank_alg(self):
> + # Probe for available PCR bank
> + for bank_alg in [tpm2.TPM2_ALG_SHA1, tpm2.TPM2_ALG_SHA256]:
> + try:
> + handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
> + self.client.policy_pcr(handle, [17], bank_alg=bank_alg)
> + return bank_alg
> + except tpm2.UnknownPCRBankError:
> + pass
> + finally:
> + self.client.flush_context(handle)
> + return None
> +
> def test_seal_with_policy(self):
> + bank_alg = self.determine_bank_alg()
> + self.assertIsNotNone(bank_alg)
> +
> handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
>
> data = ('X' * 64).encode()
> @@ -35,7 +51,7 @@ class SmokeTest(unittest.TestCase):
> pcrs = [16]
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> policy_dig = self.client.get_policy_digest(handle)
> @@ -47,7 +63,7 @@ class SmokeTest(unittest.TestCase):
> handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> result = self.client.unseal(self.root_key, blob, auth, handle)
> @@ -72,6 +88,9 @@ class SmokeTest(unittest.TestCase):
> self.assertEqual(rc, tpm2.TPM2_RC_AUTH_FAIL)
>
> def test_unseal_with_wrong_policy(self):
> + bank_alg = self.determine_bank_alg()
> + self.assertIsNotNone(bank_alg)
> +
> handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
>
> data = ('X' * 64).encode()
> @@ -79,7 +98,7 @@ class SmokeTest(unittest.TestCase):
> pcrs = [16]
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> policy_dig = self.client.get_policy_digest(handle)
> @@ -91,13 +110,13 @@ class SmokeTest(unittest.TestCase):
> # Extend first a PCR that is not part of the policy and try to unseal.
> # This should succeed.
>
> - ds = tpm2.get_digest_size(tpm2.TPM2_ALG_SHA1)
> - self.client.extend_pcr(1, ('X' * ds).encode())
> + ds = tpm2.get_digest_size(bank_alg)
> + self.client.extend_pcr(1, ('X' * ds).encode(), bank_alg=bank_alg)
>
> handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> result = self.client.unseal(self.root_key, blob, auth, handle)
> @@ -109,14 +128,14 @@ class SmokeTest(unittest.TestCase):
>
> # Then, extend a PCR that is part of the policy and try to unseal.
> # This should fail.
> - self.client.extend_pcr(16, ('X' * ds).encode())
> + self.client.extend_pcr(16, ('X' * ds).encode(), bank_alg=bank_alg)
>
> handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
>
> rc = 0
>
> try:
> - self.client.policy_pcr(handle, pcrs)
> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> self.client.policy_password(handle)
>
> result = self.client.unseal(self.root_key, blob, auth, handle)
> --
> 2.31.1
>
On 11/24/21 18:54, Jarkko Sakkinen wrote:
> On Wed, Nov 24, 2021 at 09:13:12AM -0500, Stefan Berger wrote:
>> Probe for an available PCR bank to accommodate devices that do not have a
>> SHA-1 PCR bank or whose SHA-1 bank is deactivated. Use the bank that can
>> be used in the TPM2 commands. Assert on the probing function to not
>> return None.
> What is *the bank* that can be used?
The bank can be either SHA-1 or SHA-256 at this point.
>
> In addition, I don't understand the last sentence.
If the probing function returns None the test fails due to an
assertIsNotNone().
stefan
>
> /Jarkko
>
>
>> Signed-off-by: Stefan Berger <[email protected]>
>> ---
>> tools/testing/selftests/tpm2/tpm2_tests.py | 35 +++++++++++++++++-----
>> 1 file changed, 27 insertions(+), 8 deletions(-)
>>
>> diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
>> index 9d764306887b..6b88ff0e47b9 100644
>> --- a/tools/testing/selftests/tpm2/tpm2_tests.py
>> +++ b/tools/testing/selftests/tpm2/tpm2_tests.py
>> @@ -27,7 +27,23 @@ class SmokeTest(unittest.TestCase):
>> result = self.client.unseal(self.root_key, blob, auth, None)
>> self.assertEqual(data, result)
>>
>> + def determine_bank_alg(self):
>> + # Probe for available PCR bank
>> + for bank_alg in [tpm2.TPM2_ALG_SHA1, tpm2.TPM2_ALG_SHA256]:
>> + try:
>> + handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
>> + self.client.policy_pcr(handle, [17], bank_alg=bank_alg)
>> + return bank_alg
>> + except tpm2.UnknownPCRBankError:
>> + pass
>> + finally:
>> + self.client.flush_context(handle)
>> + return None
>> +
>> def test_seal_with_policy(self):
>> + bank_alg = self.determine_bank_alg()
>> + self.assertIsNotNone(bank_alg)
>> +
>> handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
>>
>> data = ('X' * 64).encode()
>> @@ -35,7 +51,7 @@ class SmokeTest(unittest.TestCase):
>> pcrs = [16]
>>
>> try:
>> - self.client.policy_pcr(handle, pcrs)
>> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
>> self.client.policy_password(handle)
>>
>> policy_dig = self.client.get_policy_digest(handle)
>> @@ -47,7 +63,7 @@ class SmokeTest(unittest.TestCase):
>> handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
>>
>> try:
>> - self.client.policy_pcr(handle, pcrs)
>> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
>> self.client.policy_password(handle)
>>
>> result = self.client.unseal(self.root_key, blob, auth, handle)
>> @@ -72,6 +88,9 @@ class SmokeTest(unittest.TestCase):
>> self.assertEqual(rc, tpm2.TPM2_RC_AUTH_FAIL)
>>
>> def test_unseal_with_wrong_policy(self):
>> + bank_alg = self.determine_bank_alg()
>> + self.assertIsNotNone(bank_alg)
>> +
>> handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
>>
>> data = ('X' * 64).encode()
>> @@ -79,7 +98,7 @@ class SmokeTest(unittest.TestCase):
>> pcrs = [16]
>>
>> try:
>> - self.client.policy_pcr(handle, pcrs)
>> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
>> self.client.policy_password(handle)
>>
>> policy_dig = self.client.get_policy_digest(handle)
>> @@ -91,13 +110,13 @@ class SmokeTest(unittest.TestCase):
>> # Extend first a PCR that is not part of the policy and try to unseal.
>> # This should succeed.
>>
>> - ds = tpm2.get_digest_size(tpm2.TPM2_ALG_SHA1)
>> - self.client.extend_pcr(1, ('X' * ds).encode())
>> + ds = tpm2.get_digest_size(bank_alg)
>> + self.client.extend_pcr(1, ('X' * ds).encode(), bank_alg=bank_alg)
>>
>> handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
>>
>> try:
>> - self.client.policy_pcr(handle, pcrs)
>> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
>> self.client.policy_password(handle)
>>
>> result = self.client.unseal(self.root_key, blob, auth, handle)
>> @@ -109,14 +128,14 @@ class SmokeTest(unittest.TestCase):
>>
>> # Then, extend a PCR that is part of the policy and try to unseal.
>> # This should fail.
>> - self.client.extend_pcr(16, ('X' * ds).encode())
>> + self.client.extend_pcr(16, ('X' * ds).encode(), bank_alg=bank_alg)
>>
>> handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
>>
>> rc = 0
>>
>> try:
>> - self.client.policy_pcr(handle, pcrs)
>> + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
>> self.client.policy_password(handle)
>>
>> result = self.client.unseal(self.root_key, blob, auth, handle)
>> --
>> 2.31.1
>>
On Wed, 2021-11-24 at 19:15 -0500, Stefan Berger wrote:
>
> On 11/24/21 18:54, Jarkko Sakkinen wrote:
> > On Wed, Nov 24, 2021 at 09:13:12AM -0500, Stefan Berger wrote:
> > > Probe for an available PCR bank to accommodate devices that do not have a
> > > SHA-1 PCR bank or whose SHA-1 bank is deactivated. Use the bank that can
> > > be used in the TPM2 commands. Assert on the probing function to not
> > > return None.
> > What is *the bank* that can be used?
>
> The bank can be either SHA-1 or SHA-256 at this point.
>
> >
> > In addition, I don't understand the last sentence.
>
>
> If the probing function returns None the test fails due to an
> assertIsNotNone().
You should have all this written down to the commit message.
/Jarkko
>
> stefan
>
> >
> > /Jarkko
> >
> >
> > > Signed-off-by: Stefan Berger <[email protected]>
> > > ---
> > > tools/testing/selftests/tpm2/tpm2_tests.py | 35 +++++++++++++++++-----
> > > 1 file changed, 27 insertions(+), 8 deletions(-)
> > >
> > > diff --git a/tools/testing/selftests/tpm2/tpm2_tests.py b/tools/testing/selftests/tpm2/tpm2_tests.py
> > > index 9d764306887b..6b88ff0e47b9 100644
> > > --- a/tools/testing/selftests/tpm2/tpm2_tests.py
> > > +++ b/tools/testing/selftests/tpm2/tpm2_tests.py
> > > @@ -27,7 +27,23 @@ class SmokeTest(unittest.TestCase):
> > > result = self.client.unseal(self.root_key, blob, auth, None)
> > > self.assertEqual(data, result)
> > >
> > > + def determine_bank_alg(self):
> > > + # Probe for available PCR bank
> > > + for bank_alg in [tpm2.TPM2_ALG_SHA1, tpm2.TPM2_ALG_SHA256]:
> > > + try:
> > > + handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
> > > + self.client.policy_pcr(handle, [17], bank_alg=bank_alg)
> > > + return bank_alg
> > > + except tpm2.UnknownPCRBankError:
> > > + pass
> > > + finally:
> > > + self.client.flush_context(handle)
> > > + return None
> > > +
> > > def test_seal_with_policy(self):
> > > + bank_alg = self.determine_bank_alg()
> > > + self.assertIsNotNone(bank_alg)
> > > +
> > > handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
> > >
> > > data = ('X' * 64).encode()
> > > @@ -35,7 +51,7 @@ class SmokeTest(unittest.TestCase):
> > > pcrs = [16]
> > >
> > > try:
> > > - self.client.policy_pcr(handle, pcrs)
> > > + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> > > self.client.policy_password(handle)
> > >
> > > policy_dig = self.client.get_policy_digest(handle)
> > > @@ -47,7 +63,7 @@ class SmokeTest(unittest.TestCase):
> > > handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
> > >
> > > try:
> > > - self.client.policy_pcr(handle, pcrs)
> > > + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> > > self.client.policy_password(handle)
> > >
> > > result = self.client.unseal(self.root_key, blob, auth, handle)
> > > @@ -72,6 +88,9 @@ class SmokeTest(unittest.TestCase):
> > > self.assertEqual(rc, tpm2.TPM2_RC_AUTH_FAIL)
> > >
> > > def test_unseal_with_wrong_policy(self):
> > > + bank_alg = self.determine_bank_alg()
> > > + self.assertIsNotNone(bank_alg)
> > > +
> > > handle = self.client.start_auth_session(tpm2.TPM2_SE_TRIAL)
> > >
> > > data = ('X' * 64).encode()
> > > @@ -79,7 +98,7 @@ class SmokeTest(unittest.TestCase):
> > > pcrs = [16]
> > >
> > > try:
> > > - self.client.policy_pcr(handle, pcrs)
> > > + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> > > self.client.policy_password(handle)
> > >
> > > policy_dig = self.client.get_policy_digest(handle)
> > > @@ -91,13 +110,13 @@ class SmokeTest(unittest.TestCase):
> > > # Extend first a PCR that is not part of the policy and try to unseal.
> > > # This should succeed.
> > >
> > > - ds = tpm2.get_digest_size(tpm2.TPM2_ALG_SHA1)
> > > - self.client.extend_pcr(1, ('X' * ds).encode())
> > > + ds = tpm2.get_digest_size(bank_alg)
> > > + self.client.extend_pcr(1, ('X' * ds).encode(), bank_alg=bank_alg)
> > >
> > > handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
> > >
> > > try:
> > > - self.client.policy_pcr(handle, pcrs)
> > > + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> > > self.client.policy_password(handle)
> > >
> > > result = self.client.unseal(self.root_key, blob, auth, handle)
> > > @@ -109,14 +128,14 @@ class SmokeTest(unittest.TestCase):
> > >
> > > # Then, extend a PCR that is part of the policy and try to unseal.
> > > # This should fail.
> > > - self.client.extend_pcr(16, ('X' * ds).encode())
> > > + self.client.extend_pcr(16, ('X' * ds).encode(), bank_alg=bank_alg)
> > >
> > > handle = self.client.start_auth_session(tpm2.TPM2_SE_POLICY)
> > >
> > > rc = 0
> > >
> > > try:
> > > - self.client.policy_pcr(handle, pcrs)
> > > + self.client.policy_pcr(handle, pcrs, bank_alg=bank_alg)
> > > self.client.policy_password(handle)
> > >
> > > result = self.client.unseal(self.root_key, blob, auth, handle)
> > > --
> > > 2.31.1
> > >