Policy_spt.c

// This file was extracted from the TCG Published
// Trusted Platform Module Library
// Part 4: Supporting Routines
// Family "2.0"
// Level 00 Revision 01.16
// October 30, 2014

#include   "InternalRoutines.h"
#include   "Policy_spt_fp.h"
#include   "PolicySigned_fp.h"
#include   "PolicySecret_fp.h"
#include   "PolicyTicket_fp.h"
//
//
//           PolicyParameterChecks()
//
//      This function validates the common parameters of TPM2_PolicySiged() and TPM2_PolicySecret(). The
//      common parameters are nonceTPM, expiration, and cpHashA.
//
TPM_RC
PolicyParameterChecks(
     SESSION          *session,
     UINT64            authTimeout,
     TPM2B_DIGEST     *cpHashA,
     TPM2B_NONCE      *nonce,
     TPM_RC            nonceParameterNumber,
     TPM_RC            cpHashParameterNumber,
     TPM_RC            expirationParameterNumber
     )
{
     TPM_RC            result;
     // Validate that input nonceTPM is correct if present
     if(nonce != NULL && nonce->t.size != 0)
//
   {
         if(!Memory2BEqual(&nonce->b, &session->nonceTPM.b))
             return TPM_RC_NONCE + RC_PolicySigned_nonceTPM;
   }
   // If authTimeout is set (expiration != 0...
   if(authTimeout != 0)
   {
       // ...then nonce must be present
       // nonce present isn't checked in PolicyTicket
       if(nonce != NULL && nonce->t.size == 0)
           // This error says that the time has expired but it is pointing
           // at the nonceTPM value.
           return TPM_RC_EXPIRED + nonceParameterNumber;
         // Validate input expiration.
         // Cannot compare time if clock stop advancing. A TPM_RC_NV_UNAVAILABLE
         // or TPM_RC_NV_RATE error may be returned here.
         result = NvIsAvailable();
         if(result != TPM_RC_SUCCESS)
             return result;
         if(authTimeout < go.clock)
             return TPM_RC_EXPIRED + expirationParameterNumber;
   }
   // If the cpHash is present, then check it
   if(cpHashA != NULL && cpHashA->t.size != 0)
   {
       // The cpHash input has to have the correct size
       if(cpHashA->t.size != session->u2.policyDigest.t.size)
           return TPM_RC_SIZE + cpHashParameterNumber;
         // If the cpHash has already been set, then this input value
         // must match the current value.
         if(     session->u1.cpHash.b.size != 0
             && !Memory2BEqual(&cpHashA->b, &session->u1.cpHash.b))
                 return TPM_RC_CPHASH;
   }
   return TPM_RC_SUCCESS;
}
//
//
//          PolicyContextUpdate()
//
//     Update policy hash Update the policyDigest in policy session by extending policyRef and objectName to
//     it. This will also update the cpHash if it is present.
//
void
PolicyContextUpdate(
   TPM_CC              commandCode,     //   IN:   command code
   TPM2B_NAME         *name,            //   IN:   name of entity
   TPM2B_NONCE        *ref,             //   IN:   the reference data
   TPM2B_DIGEST       *cpHash,          //   IN:   the cpHash (optional)
   UINT64              policyTimeout,
   SESSION            *session          // IN/OUT: policy session to be updated
   )
{
   HASH_STATE               hashState;
   UINT16                   policyDigestSize;
   // Start hash
   policyDigestSize = CryptStartHash(session->authHashAlg, &hashState);
   // policyDigest size should always be the digest size of session hash algorithm.
   pAssert(session->u2.policyDigest.t.size == policyDigestSize);
     // add old digest
     CryptUpdateDigest2B(&hashState, &session->u2.policyDigest.b);
     // add commandCode
     CryptUpdateDigestInt(&hashState, sizeof(commandCode), &commandCode);
     // add name if applicable
     if(name != NULL)
         CryptUpdateDigest2B(&hashState, &name->b);
     // Complete the digest and get the results
     CryptCompleteHash2B(&hashState, &session->u2.policyDigest.b);
     // Start second hash computation
     CryptStartHash(session->authHashAlg, &hashState);
     // add policyDigest
     CryptUpdateDigest2B(&hashState, &session->u2.policyDigest.b);
     // add policyRef
     if(ref != NULL)
         CryptUpdateDigest2B(&hashState, &ref->b);
     // Complete second digest
     CryptCompleteHash2B(&hashState, &session->u2.policyDigest.b);
     // Deal with the cpHash. If the cpHash value is present
     // then it would have already been checked to make sure that
     // it is compatible with the current value so all we need
     // to do here is copy it and set the iscoHashDefined attribute
     if(cpHash != NULL && cpHash->t.size != 0)
     {
         session->u1.cpHash = *cpHash;
         session->attributes.iscpHashDefined = SET;
     }
     // update the timeout if it is specified
     if(policyTimeout!= 0)
     {
     // If the timeout has not been set, then set it to the new value
         if(session->timeOut == 0)
             session->timeOut = policyTimeout;
         else if(session->timeOut > policyTimeout)
             session->timeOut = policyTimeout;
     }
     return;
}