// This file was extracted from the TCG Published

// Trusted Platform Module Library

// Part 4: Supporting Routines

// Family "2.0"

// Level 00 Revision 01.16

// October 30, 2014

#define SESSION_PROCESS_C

#include "InternalRoutines.h"

#include "SessionProcess_fp.h"

#include "Platform.h"

//

//

//          Authorization Support Functions

//

//           IsDAExempted()

//

//     This function indicates if a handle is exempted from DA logic. A handle is exempted if it is

//     a) a primary seed handle,

//     b) an object with noDA bit SET,

//     c) an NV Index with TPMA_NV_NO_DA bit SET, or

//     d) a PCR handle.

//

//     Return Value                      Meaning

//

//     TRUE                              handle is exempted from DA logic

//     FALSE                             handle is not exempted from DA logic

//

BOOL

IsDAExempted(

     TPM_HANDLE          handle              // IN: entity handle

     )

{

     BOOL          result = FALSE;

     switch(HandleGetType(handle))

     {

         case TPM_HT_PERMANENT:

             // All permanent handles, other than TPM_RH_LOCKOUT, are exempt from

             // DA protection.

             result = (handle != TPM_RH_LOCKOUT);

             break;

         // When this function is called, a persistent object will have been loaded

         // into an object slot and assigned a transient handle.

         case TPM_HT_TRANSIENT:

         {

             OBJECT      *object;

             object = ObjectGet(handle);

             result = (object->publicArea.objectAttributes.noDA == SET);

             break;

         }

         case TPM_HT_NV_INDEX:

         {

             NV_INDEX        nvIndex;

                NvGetIndexInfo(handle, &nvIndex);

                result = (nvIndex.publicArea.attributes.TPMA_NV_NO_DA == SET);

                break;

         }

         case TPM_HT_PCR:

             // PCRs are always exempted from DA.

             result = TRUE;

             break;

         default:

             break;

   }

   return result;

}

//

//

//          IncrementLockout()

//

//     This function is called after an authorization failure that involves use of an authValue. If the entity

//     referenced by the handle is not exempt from DA protection, then the failedTries counter will be

//     incremented.

//

//     Error Returns                  Meaning

//

//     TPM_RC_AUTH_FAIL               authorization failure that caused DA lockout to increment

//     TPM_RC_BAD_AUTH                authorization failure did not cause DA lockout to increment

//

static TPM_RC

IncrementLockout(

   UINT32                sessionIndex

   )

{

   TPM_HANDLE            handle = s_associatedHandles[sessionIndex];

   TPM_HANDLE            sessionHandle = s_sessionHandles[sessionIndex];

   TPM_RC                result;

   SESSION              *session = NULL;

   // Don't increment lockout unless the handle associated with the session

   // is DA protected or the session is bound to a DA protected entity.

   if(sessionHandle == TPM_RS_PW)

   {

       if(IsDAExempted(handle))

           return TPM_RC_BAD_AUTH;

   }

   else

   {

       session = SessionGet(sessionHandle);

       // If the session is bound to lockout, then use that as the relevant

       // handle. This means that an auth failure with a bound session

       // bound to lockoutAuth will take precedence over any other

       // lockout check

       if(session->attributes.isLockoutBound == SET)

           handle = TPM_RH_LOCKOUT;

         if(      session->attributes.isDaBound == CLEAR

               && IsDAExempted(handle)

           )

               // If the handle was changed to TPM_RH_LOCKOUT, this will not return

               // TPM_RC_BAD_AUTH

                return TPM_RC_BAD_AUTH;

   }

   if(handle == TPM_RH_LOCKOUT)

    {

         pAssert(gp.lockOutAuthEnabled);

         gp.lockOutAuthEnabled = FALSE;

         // For TPM_RH_LOCKOUT, if lockoutRecovery is 0, no need to update NV since

         // the lockout auth will be reset at startup.

         if(gp.lockoutRecovery != 0)

         {

             result = NvIsAvailable();

             if(result != TPM_RC_SUCCESS)

             {

                 // No NV access for now. Put the TPM in pending mode.

                 s_DAPendingOnNV = TRUE;

             }

             else

             {

                 // Update NV.

                 NvWriteReserved(NV_LOCKOUT_AUTH_ENABLED, &gp.lockOutAuthEnabled);

                 g_updateNV = TRUE;

             }

         }

    }

    else

    {

        if(gp.recoveryTime != 0)

        {

            gp.failedTries++;

            result = NvIsAvailable();

            if(result != TPM_RC_SUCCESS)

            {

                // No NV access for now. Put the TPM in pending mode.

                s_DAPendingOnNV = TRUE;

            }

            else

            {

                // Record changes to NV.

                NvWriteReserved(NV_FAILED_TRIES, &gp.failedTries);

                g_updateNV = TRUE;

            }

        }

    }

    // Register a DA failure and reset the timers.

    DARegisterFailure(handle);

    return TPM_RC_AUTH_FAIL;

}

//

//

//           IsSessionBindEntity()

//

//      This function indicates if the entity associated with the handle is the entity, to which this session is bound.

//      The binding would occur by making the bind parameter in TPM2_StartAuthSession() not equal to

//      TPM_RH_NULL. The binding only occurs if the session is an HMAC session. The bind value is a

//      combination of the Name and the authValue of the entity.

//

//      Return Value                      Meaning

//

//      TRUE                              handle points to the session start entity

//      FALSE                             handle does not point to the session start entity

//

static BOOL

IsSessionBindEntity(

    TPM_HANDLE           associatedHandle,         // IN: handle to be authorized

    SESSION             *session                   // IN: associated session

    )

{

    TPM2B_NAME        entity;                    // The bind value for the entity

    // If the session is not bound, return FALSE.

    if(!session->attributes.isBound)

        return FALSE;

    // Compute the bind value for the entity.

    SessionComputeBoundEntity(associatedHandle, &entity);

    // Compare to the bind value in the session.

    session->attributes.requestWasBound =

            Memory2BEqual(&entity.b, &session->u1.boundEntity.b);

    return session->attributes.requestWasBound;

}

//

//

//           IsPolicySessionRequired()

//

//      Checks if a policy session is required for a command. If a command requires DUP or ADMIN role

//      authorization, then the handle that requires that role is the first handle in the command. This simplifies

//      this checking. If a new command is created that requires multiple ADMIN role authorizations, then it will

//      have to be special-cased in this function. A policy session is required if:

//      a) the command requires the DUP role,

//      b) the command requires the ADMIN role and the authorized entity is an object and its adminWithPolicy

//         bit is SET, or

//      c) the command requires the ADMIN role and the authorized entity is a permanent handle or an NV

//         Index.

//      d) The authorized entity is a PCR belonging to a policy group, and has its policy initialized

//

//      Return Value                     Meaning

//

//      TRUE                             policy session is required

//      FALSE                            policy session is not required

//

static BOOL

IsPolicySessionRequired(

    TPM_CC               commandCode,        // IN: command code

    UINT32               sessionIndex        // IN: session index

    )

{

    AUTH_ROLE           role = CommandAuthRole(commandCode, sessionIndex);

    TPM_HT              type = HandleGetType(s_associatedHandles[sessionIndex]);

    if(role == AUTH_DUP)

        return TRUE;

    if(role == AUTH_ADMIN)

    {

        if(type == TPM_HT_TRANSIENT)

        {

            OBJECT      *object = ObjectGet(s_associatedHandles[sessionIndex]);

              if(object->publicArea.objectAttributes.adminWithPolicy == CLEAR)

                  return FALSE;

         }

         return TRUE;

    }

//

    if(type == TPM_HT_PCR)

    {

        if(PCRPolicyIsAvailable(s_associatedHandles[sessionIndex]))

        {

            TPM2B_DIGEST        policy;

            TPMI_ALG_HASH       policyAlg;

            policyAlg = PCRGetAuthPolicy(s_associatedHandles[sessionIndex],

                                          &policy);

            if(policyAlg != TPM_ALG_NULL)

                return TRUE;

        }

    }

    return FALSE;

}

//

//

//           IsAuthValueAvailable()

//

//      This function indicates if authValue is available and allowed for USER role authorization of an entity.

//      This function is similar to IsAuthPolicyAvailable() except that it does not check the size of the authValue

//      as IsAuthPolicyAvailable() does (a null authValue is a valid auth, but a null policy is not a valid policy).

//      This function does not check that the handle reference is valid or if the entity is in an enabled hierarchy.

//      Those checks are assumed to have been performed during the handle unmarshaling.

//

//      Return Value                      Meaning

//

//      TRUE                              authValue is available

//      FALSE                             authValue is not available

//

static BOOL

IsAuthValueAvailable(

    TPM_HANDLE           handle,             // IN: handle of entity

    TPM_CC               commandCode,        // IN: commandCode

    UINT32               sessionIndex        // IN: session index

    )

{

    BOOL             result = FALSE;

   switch(HandleGetType(handle))

   {

       case TPM_HT_PERMANENT:

           switch(handle)

           {

                   // At this point hierarchy availability has already been

                   // checked so primary seed handles are always available here

               case TPM_RH_OWNER:

               case TPM_RH_ENDORSEMENT:

               case TPM_RH_PLATFORM:

#ifdef VENDOR_PERMANENT

                   // This vendor defined handle associated with the

                   // manufacturer's shared secret

               case VENDOR_PERMANENT:

#endif

                   // NullAuth is always available.

               case TPM_RH_NULL:

                    // At the point when authValue availability is checked, control

                   // path has already passed the DA check so LockOut auth is

                   // always available here

               case TPM_RH_LOCKOUT:

                      result = TRUE;

                      break;

                  default:

                      // Otherwise authValue is not available.

                      break;

            }

            break;

        case TPM_HT_TRANSIENT:

            // A persistent object has already been loaded and the internal

            // handle changed.

            {

                OBJECT          *object;

                object = ObjectGet(handle);

                  // authValue is always available for a sequence object.

                  if(ObjectIsSequence(object))

                  {

                       result = TRUE;

                       break;

                  }

                  // authValue is available for an object if it has its sensitive

                  // portion loaded and

                  // 1. userWithAuth bit is SET, or

                  // 2. ADMIN role is required

                  if(    object->attributes.publicOnly == CLEAR

                      &&    (object->publicArea.objectAttributes.userWithAuth == SET

                         || (CommandAuthRole(commandCode, sessionIndex) == AUTH_ADMIN

                            && object->publicArea.objectAttributes.adminWithPolicy

                               == CLEAR)))

                       result = TRUE;

            }

            break;

        case TPM_HT_NV_INDEX:

            // NV Index.

            {

                NV_INDEX         nvIndex;

                NvGetIndexInfo(handle, &nvIndex);

                if(IsWriteOperation(commandCode))

                {

                    if (nvIndex.publicArea.attributes.TPMA_NV_AUTHWRITE == SET)

                         result = TRUE;

                  }

                  else

                  {

                      if (nvIndex.publicArea.attributes.TPMA_NV_AUTHREAD == SET)

                          result = TRUE;

                  }

            }

            break;

        case TPM_HT_PCR:

            // PCR handle.

            // authValue is always allowed for PCR

            result = TRUE;

            break;

        default:

            // Otherwise, authValue is not available

            break;

   }

   return result;

}

//

//

//

//           IsAuthPolicyAvailable()

//

//      This function indicates if an authPolicy is available and allowed.

//      This function does not check that the handle reference is valid or if the entity is in an enabled hierarchy.

//      Those checks are assumed to have been performed during the handle unmarshaling.

//

//      Return Value                      Meaning

//

//      TRUE                              authPolicy is available

//      FALSE                             authPolicy is not available

//

static BOOL

IsAuthPolicyAvailable(

    TPM_HANDLE           handle,              // IN: handle of entity

    TPM_CC               commandCode,         // IN: commandCode

    UINT32               sessionIndex         // IN: session index

    )

{

    BOOL            result = FALSE;

    switch(HandleGetType(handle))

    {

        case TPM_HT_PERMANENT:

            switch(handle)

            {

                // At this point hierarchy availability has already been checked.

                case TPM_RH_OWNER:

                    if (gp.ownerPolicy.t.size != 0)

                        result = TRUE;

                    break;

                   case TPM_RH_ENDORSEMENT:

                       if (gp.endorsementPolicy.t.size != 0)

                           result = TRUE;

                       break;

                   case TPM_RH_PLATFORM:

                       if (gc.platformPolicy.t.size != 0)

                            result = TRUE;

                       break;

                   case TPM_RH_LOCKOUT:

                       if(gp.lockoutPolicy.t.size != 0)

                            result = TRUE;

                       break;

                   default:

                       break;

             }

             break;

         case TPM_HT_TRANSIENT:

             {

                 // Object handle.

                 // An evict object would already have been loaded and given a

                 // transient object handle by this point.

                 OBJECT *object = ObjectGet(handle);

                 // Policy authorization is not available for an object with only

                 // public portion loaded.

                 if(object->attributes.publicOnly == CLEAR)

                 {

                     // Policy authorization is always available for an object but

                     // is never available for a sequence.

                     if(!ObjectIsSequence(object))

                         result = TRUE;

                 }

                 break;

             }

         case TPM_HT_NV_INDEX:

             // An NV Index.

             {

                  NV_INDEX          nvIndex;

                  NvGetIndexInfo(handle, &nvIndex);

                  // If the policy size is not zero, check if policy can be used.

                  if(nvIndex.publicArea.authPolicy.t.size != 0)

                  {

                      // If policy session is required for this handle, always

                      // uses policy regardless of the attributes bit setting

                      if(IsPolicySessionRequired(commandCode, sessionIndex))

                           result = TRUE;

                      // Otherwise, the presence of the policy depends on the NV

                      // attributes.

                      else if(IsWriteOperation(commandCode))

                      {

                           if (   nvIndex.publicArea.attributes.TPMA_NV_POLICYWRITE

                               == SET)

                               result = TRUE;

                      }

                      else

                      {

                           if (    nvIndex.publicArea.attributes.TPMA_NV_POLICYREAD

                               == SET)

                               result = TRUE;

                      }

                  }

             }

             break;

         case TPM_HT_PCR:

             // PCR handle.

             if(PCRPolicyIsAvailable(handle))

                  result = TRUE;

             break;

         default:

             break;

   }

   return result;

}

//

//

//           Session Parsing Functions

//

//           ComputeCpHash()

//

//      This function computes the cpHash as defined in Part 2 and described in Part 1.

//

static void

ComputeCpHash(

   TPMI_ALG_HASH        hashAlg,               //   IN: hash algorithm

   TPM_CC               commandCode,           //   IN: command code

   UINT32               handleNum,             //   IN: number of handle

   TPM_HANDLE           handles[],             //   IN: array of handle

   UINT32               parmBufferSize,        //   IN: size of input parameter area

   BYTE                *parmBuffer,            //   IN: input parameter area

   TPM2B_DIGEST        *cpHash,                //   OUT: cpHash

   TPM2B_DIGEST        *nameHash               //   OUT: name hash of command

   )

{

   UINT32               i;

   HASH_STATE           hashState;

   TPM2B_NAME           name;

//

   // cpHash = hash(commandCode [ || authName1

   //                           [ || authName2

   //                           [ || authName 3 ]]]

   //                           [ || parameters])

   // A cpHash can contain just a commandCode only if the lone session is

   // an audit session.

   // Start cpHash.

   cpHash->t.size = CryptStartHash(hashAlg, &hashState);

   // Add commandCode.

   CryptUpdateDigestInt(&hashState, sizeof(TPM_CC), &commandCode);

   // Add authNames for each of the handles.

   for(i = 0; i < handleNum; i++)

   {

       name.t.size = EntityGetName(handles[i], &name.t.name);

       CryptUpdateDigest2B(&hashState, &name.b);

   }

   // Add the parameters.

   CryptUpdateDigest(&hashState, parmBufferSize, parmBuffer);

   // Complete the hash.

   CryptCompleteHash2B(&hashState, &cpHash->b);

   // If the nameHash is needed, compute it here.

   if(nameHash != NULL)

   {

       // Start name hash. hashState may be reused.

       nameHash->t.size = CryptStartHash(hashAlg, &hashState);

         // Adding names.

         for(i = 0; i < handleNum; i++)

         {

             name.t.size = EntityGetName(handles[i], &name.t.name);

             CryptUpdateDigest2B(&hashState, &name.b);

         }

         // Complete hash.

         CryptCompleteHash2B(&hashState, &nameHash->b);

   }

   return;

}

//

//

//           CheckPWAuthSession()

//

//      This function validates the authorization provided in a PWAP session. It compares the input value to

//      authValue of the authorized entity. Argument sessionIndex is used to get handles handle of the

//      referenced entities from s_inputAuthValues[] and s_associatedHandles[].

//

//      Error Returns                     Meaning

//

//      TPM_RC_AUTH_FAIL                  auth fails and increments DA failure count

//      TPM_RC_BAD_AUTH                   auth fails but DA does not apply

//

static TPM_RC

CheckPWAuthSession(

   UINT32              sessionIndex          // IN: index of session to be processed

   )

{

   TPM2B_AUTH         authValue;

   TPM_HANDLE         associatedHandle = s_associatedHandles[sessionIndex];

   // Strip trailing zeros from the password.

   MemoryRemoveTrailingZeros(&s_inputAuthValues[sessionIndex]);

   // Get the auth value and size.

   authValue.t.size = EntityGetAuthValue(associatedHandle, &authValue.t.buffer);

   // Success if the digests are identical.

   if(Memory2BEqual(&s_inputAuthValues[sessionIndex].b, &authValue.b))

   {

       return TPM_RC_SUCCESS;

   }

   else                    // if the digests are not identical

   {

       // Invoke DA protection if applicable.

       return IncrementLockout(sessionIndex);

   }

}

//

//

//          ComputeCommandHMAC()

//

//      This function computes the HMAC for an authorization session in a command.

//

static void

ComputeCommandHMAC(

   UINT32              sessionIndex,    // IN: index of session to be processed

   TPM2B_DIGEST       *cpHash,          // IN: cpHash

   TPM2B_DIGEST       *hmac             // OUT: authorization HMAC

   )

{

   TPM2B_TYPE(KEY,    (sizeof(AUTH_VALUE) * 2));

   TPM2B_KEY           key;

   BYTE                marshalBuffer[sizeof(TPMA_SESSION)];

   BYTE               *buffer;

   INT32               bufferSize;

   UINT32              marshalSize;

   HMAC_STATE          hmacState;

   TPM2B_NONCE        *nonceDecrypt;

   TPM2B_NONCE        *nonceEncrypt;

   SESSION            *session;

   TPM_HT              sessionHandleType =

                               HandleGetType(s_sessionHandles[sessionIndex]);

   nonceDecrypt = NULL;

   nonceEncrypt = NULL;

   // Determine if extra nonceTPM values are going to be required.

   // If this is the first session (sessionIndex = 0) and it is an authorization

   // session that uses an HMAC, then check if additional session nonces are to be

   // included.

   if(   sessionIndex == 0

      && s_associatedHandles[sessionIndex] != TPM_RH_UNASSIGNED)

   {

       // If there is a decrypt session and if this is not the decrypt session,

       // then an extra nonce may be needed.

       if(    s_decryptSessionIndex != UNDEFINED_INDEX

           && s_decryptSessionIndex != sessionIndex)

       {

            // Will add the nonce for the decrypt session.

            SESSION *decryptSession

                        = SessionGet(s_sessionHandles[s_decryptSessionIndex]);

            nonceDecrypt = &decryptSession->nonceTPM;

       }

       // Now repeat for the encrypt session.

       if(    s_encryptSessionIndex != UNDEFINED_INDEX

           && s_encryptSessionIndex != sessionIndex

//

             && s_encryptSessionIndex != s_decryptSessionIndex)

         {

             // Have to have the nonce for the encrypt session.

             SESSION *encryptSession

                         = SessionGet(s_sessionHandles[s_encryptSessionIndex]);

             nonceEncrypt = &encryptSession->nonceTPM;

         }

   }

   // Continue with the HMAC processing.

   session = SessionGet(s_sessionHandles[sessionIndex]);

   // Generate HMAC key.

   MemoryCopy2B(&key.b, &session->sessionKey.b, sizeof(key.t.buffer));

   //   Check if the session has an associated handle and if the associated entity

   //   is the one to which the session is bound. If not, add the authValue of

   //   this entity to the HMAC key.

   //   If the session is bound to the object or the session is a policy session

   //   with no authValue required, do not include the authValue in the HMAC key.

   //   Note: For a policy session, its isBound attribute is CLEARED.

   // If the session isn't used for authorization, then there is no auth value

   // to add

   if(s_associatedHandles[sessionIndex] != TPM_RH_UNASSIGNED)

   {

       // used for auth so see if this is a policy session with authValue needed

       // or an hmac session that is not bound

           if (((sessionHandleType == TPM_HT_POLICY_SESSION)

                && (session->attributes.isAuthValueNeeded == SET))

               || ((sessionHandleType == TPM_HT_HMAC_SESSION)

                   && !IsSessionBindEntity(s_associatedHandles[sessionIndex], session))

         )

       {

           // add the authValue to the HMAC key

           pAssert((sizeof(AUTH_VALUE) + key.t.size) <= sizeof(key.t.buffer));

           key.t.size =   key.t.size

                        + EntityGetAuthValue(s_associatedHandles[sessionIndex],

                                        (AUTH_VALUE *)&(key.t.buffer[key.t.size]));

       }

   }

    // if the HMAC key size is 0, a NULL string HMAC is allowed

    if(    key.t.size == 0

        && s_inputAuthValues[sessionIndex].t.size == 0)

    {

        hmac->t.size = 0;

        return;

    }

   // Start HMAC

   hmac->t.size = CryptStartHMAC2B(session->authHashAlg, &key.b, &hmacState);

   // Add cpHash

   CryptUpdateDigest2B(&hmacState, &cpHash->b);

   // Add nonceCaller

   CryptUpdateDigest2B(&hmacState, &s_nonceCaller[sessionIndex].b);

   // Add nonceTPM

   CryptUpdateDigest2B(&hmacState, &session->nonceTPM.b);

   // If needed, add nonceTPM for decrypt session

   if(nonceDecrypt != NULL)

       CryptUpdateDigest2B(&hmacState, &nonceDecrypt->b);

    // If needed, add nonceTPM for encrypt session

    if(nonceEncrypt != NULL)

        CryptUpdateDigest2B(&hmacState, &nonceEncrypt->b);

    // Add sessionAttributes

    buffer = marshalBuffer;

    bufferSize = sizeof(TPMA_SESSION);

    marshalSize = TPMA_SESSION_Marshal(&(s_attributes[sessionIndex]),

                                       &buffer, &bufferSize);

    CryptUpdateDigest(&hmacState, marshalSize, marshalBuffer);

    // Complete the HMAC computation

    CryptCompleteHMAC2B(&hmacState, &hmac->b);

    return;

}

//

//

//           CheckSessionHMAC()

//

//      This function checks the HMAC of in a session. It uses ComputeCommandHMAC() to compute the

//      expected HMAC value and then compares the result with the HMAC in the authorization session. The

//      authorization is successful if they are the same.

//      If the authorizations are not the same, IncrementLockout() is called. It will return TPM_RC_AUTH_FAIL if

//      the failure caused the failureCount to increment. Otherwise, it will return TPM_RC_BAD_AUTH.

//

//      Error Returns                    Meaning

//

//      TPM_RC_AUTH_FAIL                 auth failure caused failureCount increment

//      TPM_RC_BAD_AUTH                  auth failure did not cause failureCount increment

//

static TPM_RC

CheckSessionHMAC(

    UINT32               sessionIndex,      // IN: index of session to be processed

    TPM2B_DIGEST        *cpHash             // IN: cpHash of the command

    )

{

    TPM2B_DIGEST             hmac;                // authHMAC for comparing

    // Compute authHMAC

    ComputeCommandHMAC(sessionIndex, cpHash, &hmac);

    // Compare the input HMAC with the authHMAC computed above.

    if(!Memory2BEqual(&s_inputAuthValues[sessionIndex].b, &hmac.b))

    {

        // If an HMAC session has a failure, invoke the anti-hammering

        // if it applies to the authorized entity or the session.

        // Otherwise, just indicate that the authorization is bad.

        return IncrementLockout(sessionIndex);

    }

    return TPM_RC_SUCCESS;

}

//

//

//           CheckPolicyAuthSession()

//

//      This function is used to validate the authorization in a policy session. This function performs the following

//      comparisons to see if a policy authorization is properly provided. The check are:

//      a) compare policyDigest in session with authPolicy associated with the entity to be authorized;

//      b) compare timeout if applicable;

//      c) compare commandCode if applicable;

//

//      d) compare cpHash if applicable; and

//      e) see if PCR values have changed since computed.

//      If all the above checks succeed, the handle is authorized. The order of these comparisons is not

//      important because any failure will result in the same error code.

//

//      Error Returns                     Meaning

//

//      TPM_RC_PCR_CHANGED                PCR value is not current

//      TPM_RC_POLICY_FAIL                policy session fails

//      TPM_RC_LOCALITY                   command locality is not allowed

//      TPM_RC_POLICY_CC                  CC doesn't match

//      TPM_RC_EXPIRED                    policy session has expired

//      TPM_RC_PP                         PP is required but not asserted

//      TPM_RC_NV_UNAVAILABLE             NV is not available for write

//      TPM_RC_NV_RATE                    NV is rate limiting

//

static TPM_RC

CheckPolicyAuthSession(

   UINT32              sessionIndex,          //   IN: index of session to be processed

   TPM_CC              commandCode,           //   IN: command code

   TPM2B_DIGEST       *cpHash,                //   IN: cpHash using the algorithm of this

                                              //       session

   TPM2B_DIGEST       *nameHash               //   IN: nameHash using the session algorithm

   )

{

   TPM_RC              result = TPM_RC_SUCCESS;

   SESSION            *session;

   TPM2B_DIGEST        authPolicy;

   TPMI_ALG_HASH       policyAlg;

   UINT8               locality;

   // Initialize pointer to the auth session.

   session = SessionGet(s_sessionHandles[sessionIndex]);

   // If the command is TPM_RC_PolicySecret(), make sure that

   // either password or authValue is required

   if(     commandCode == TPM_CC_PolicySecret

       && session->attributes.isPasswordNeeded == CLEAR

       && session->attributes.isAuthValueNeeded == CLEAR)

       return TPM_RC_MODE;

   // See if the PCR counter for the session is still valid.

   if( !SessionPCRValueIsCurrent(s_sessionHandles[sessionIndex]) )

       return TPM_RC_PCR_CHANGED;

   // Get authPolicy.

   policyAlg = EntityGetAuthPolicy(s_associatedHandles[sessionIndex],

                                   &authPolicy);

   // Compare authPolicy.

   if(!Memory2BEqual(&session->u2.policyDigest.b, &authPolicy.b))

       return TPM_RC_POLICY_FAIL;

   // Policy is OK so check if the other factors are correct

   // Compare policy hash algorithm.

   if(policyAlg != session->authHashAlg)

       return TPM_RC_POLICY_FAIL;

   // Compare timeout.

   if(session->timeOut != 0)

   {

       // Cannot compare time if clock stop advancing. An TPM_RC_NV_UNAVAILABLE

       // or TPM_RC_NV_RATE error may be returned here.

       result = NvIsAvailable();

       if(result != TPM_RC_SUCCESS)

           return result;

        if(session->timeOut < go.clock)

            return TPM_RC_EXPIRED;

   }

   // If command code is provided it must match

   if(session->commandCode != 0)

   {

       if(session->commandCode != commandCode)

            return TPM_RC_POLICY_CC;

   }

   else

   {

       // If command requires a DUP or ADMIN authorization, the session must have

       // command code set.

       AUTH_ROLE    role = CommandAuthRole(commandCode, sessionIndex);

       if(role == AUTH_ADMIN || role == AUTH_DUP)

            return TPM_RC_POLICY_FAIL;

   }

   // Check command locality.

   {

       BYTE          sessionLocality[sizeof(TPMA_LOCALITY)];

       BYTE         *buffer = sessionLocality;

       INT32         bufferSize = sizeof(TPMA_LOCALITY);

        // Get existing locality setting in canonical form

        TPMA_LOCALITY_Marshal(&session->commandLocality, &buffer, &bufferSize);

       // See if the locality has been set

       if(sessionLocality[0] != 0)

       {

           // If so, get the current locality

           locality = _plat__LocalityGet();

           if (locality < 5)

           {

               if(    ((sessionLocality[0] & (1 << locality)) == 0)

                   || sessionLocality[0] > 31)

                   return TPM_RC_LOCALITY;

           }

           else if (locality > 31)

           {

               if(sessionLocality[0] != locality)

                   return TPM_RC_LOCALITY;

           }

           else

           {

               // Could throw an assert here but a locality error is just

               // as good. It just means that, whatever the locality is, it isn't

               // the locality requested so...

               return TPM_RC_LOCALITY;

           }

       }

   } // end of locality check

   // Check physical presence.

   if(   session->attributes.isPPRequired == SET

      && !_plat__PhysicalPresenceAsserted())

       return TPM_RC_PP;

   // Compare cpHash/nameHash if defined, or if the command requires an ADMIN or

   // DUP role for this handle.

   if(session->u1.cpHash.b.size != 0)

   {

       if(session->attributes.iscpHashDefined)

       {

            // Compare cpHash.

            if(!Memory2BEqual(&session->u1.cpHash.b, &cpHash->b))

                return TPM_RC_POLICY_FAIL;

       }

       else

       {

            // Compare nameHash.

            // When cpHash is not defined, nameHash is placed in its space.

            if(!Memory2BEqual(&session->u1.cpHash.b, &nameHash->b))

                return TPM_RC_POLICY_FAIL;

       }

   }

   if(session->attributes.checkNvWritten)

   {

       NV_INDEX         nvIndex;

         // If this is not an NV index, the policy makes no sense so fail it.

         if(HandleGetType(s_associatedHandles[sessionIndex])!= TPM_HT_NV_INDEX)

             return TPM_RC_POLICY_FAIL;

         // Get the index data

         NvGetIndexInfo(s_associatedHandles[sessionIndex], &nvIndex);

         // Make sure that the TPMA_WRITTEN_ATTRIBUTE has the desired state

         if(    (nvIndex.publicArea.attributes.TPMA_NV_WRITTEN == SET)

             != (session->attributes.nvWrittenState == SET))

             return TPM_RC_POLICY_FAIL;

   }

   return TPM_RC_SUCCESS;

}

//

//

//           RetrieveSessionData()

//

//      This function will unmarshal the sessions in the session area of a command. The values are placed in the

//      arrays that are defined at the beginning of this file. The normal unmarshaling errors are possible.

//

//      Error Returns                     Meaning

//

//      TPM_RC_SUCCSS                     unmarshaled without error

//      TPM_RC_SIZE                       the number of bytes unmarshaled is not the same as the value for

//                                        authorizationSize in the command

//

static TPM_RC

RetrieveSessionData (

   TPM_CC               commandCode,         //   IN: command   code

   UINT32              *sessionCount,        //   OUT: number   of sessions found

   BYTE                *sessionBuffer,       //   IN: pointer   to the session buffer

   INT32                bufferSize           //   IN: size of   the session buffer

   )

{

   int             sessionIndex;

   int             i;

   TPM_RC          result;

   SESSION        *session;

   TPM_HT          sessionType;

   s_decryptSessionIndex = UNDEFINED_INDEX;

   s_encryptSessionIndex = UNDEFINED_INDEX;

#if IS_CC_ENABLED(GetSessionAuditDigest)

   s_auditSessionIndex = UNDEFINED_INDEX;

#endif

   for(sessionIndex = 0; bufferSize > 0; sessionIndex++)

   {

       // If maximum allowed number of sessions has been parsed, return a size

       // error with a session number that is larger than the number of allowed

       // sessions

       if(sessionIndex == MAX_SESSION_NUM)

           return TPM_RC_SIZE + TPM_RC_S + g_rcIndex[sessionIndex+1];

        // make sure that the associated handle for each session starts out

        // unassigned

        s_associatedHandles[sessionIndex] = TPM_RH_UNASSIGNED;

        // First parameter: Session handle.

        result = TPMI_SH_AUTH_SESSION_Unmarshal(&s_sessionHandles[sessionIndex],

                                                &sessionBuffer, &bufferSize, TRUE);

        if(result != TPM_RC_SUCCESS)

            return result + TPM_RC_S + g_rcIndex[sessionIndex];

        // Second parameter: Nonce.

        result = TPM2B_NONCE_Unmarshal(&s_nonceCaller[sessionIndex],

                                       &sessionBuffer, &bufferSize);

        if(result != TPM_RC_SUCCESS)

            return result + TPM_RC_S + g_rcIndex[sessionIndex];

        // Third parameter: sessionAttributes.

        result = TPMA_SESSION_Unmarshal(&s_attributes[sessionIndex],

                                        &sessionBuffer, &bufferSize);

        if(result != TPM_RC_SUCCESS)

            return result + TPM_RC_S + g_rcIndex[sessionIndex];

        // Fourth parameter: authValue (PW or HMAC).

        result = TPM2B_AUTH_Unmarshal(&s_inputAuthValues[sessionIndex],

                                      &sessionBuffer, &bufferSize);

        if(result != TPM_RC_SUCCESS)

            return result + TPM_RC_S + g_rcIndex[sessionIndex];

        if(s_sessionHandles[sessionIndex] == TPM_RS_PW)

        {

            // A PWAP session needs additional processing.

            //      Can't have any attributes set other than continueSession bit

            if(    s_attributes[sessionIndex].encrypt

                || s_attributes[sessionIndex].decrypt

                || s_attributes[sessionIndex].audit

                || s_attributes[sessionIndex].auditExclusive

                || s_attributes[sessionIndex].auditReset

              )

                 return TPM_RC_ATTRIBUTES + TPM_RC_S + g_rcIndex[sessionIndex];

              //     The nonce size must be zero.

              if(s_nonceCaller[sessionIndex].t.size != 0)

                  return TPM_RC_NONCE + TPM_RC_S + g_rcIndex[sessionIndex];

            continue;

        }

        // For not password sessions...

        // Find out if the session is loaded.

        if(!SessionIsLoaded(s_sessionHandles[sessionIndex]))