FAPI: Enable usage of existing NV indexes for Fapi_NvCreate

Fapi_NvCreate can now create FAPI objects in keystore for existing
NV indexes unless the NV index is defined with a policy which does
not match the policy defined by Fapi_CreateNv.
If a policy is defined but the attributes NV_AUTHWRITE and
NV_AUTHREAD are set the object will be created without
a policy in keystore.
In other cases with a policy Fapi_NvCreate will return
TSS2_FAPI_RC_BAD_VALUE.

Signed-off-by: Juergen Repp <juergen_repp@web.de>

Author: JuergenReppSIT

src/tss2-fapi/api/Fapi_CreateNv.c

@@ -296,10 +296,12 @@ Fapi_CreateNv_Finish(
     IFAPI_OBJECT *hierarchy = &nvCmd->auth_object;
     IFAPI_NV * miscNv = &(nvCmd->nv_object.misc.nv);
     TPM2B_NV_PUBLIC *publicInfo = &miscNv->public;
+    TPM2B_NV_PUBLIC *existing_nv_public = NULL;
     TPM2B_DIGEST * authPolicy = &(miscNv->public.nvPublic.authPolicy);
     TPMS_POLICY * policy = &(context->policy.policy);
     TPMS_POLICY ** nvCmdPolicy = &nvCmd->nv_object.policy;
     ESYS_TR auth_session;
+    bool nv_exists;
 
     switch (context->state) {
         statecase(context->state, NV_CREATE_READ_PROFILE)
@@ -381,8 +383,11 @@ Fapi_CreateNv_Finish(
             fallthrough;
 
         statecase(context->state, NV_CREATE_GET_INDEX)
-            /* Check whether nv index was already defined */
-            if (!nvCmd->public_templ.public.nvIndex) {
+            if (nvCmd->public_templ.public.nvIndex) {
+                 /* Check nv index passed by user was already defined*/
+                context->state = NV_CREATE_CHECK_EXISTING;
+                return TSS2_FAPI_RC_TRY_AGAIN;
+            } else {
                 r = ifapi_get_nv_start_index(nvCmd->nvPath,
                                              &publicInfo->nvPublic.nvIndex);
                 goto_if_error_reset_state(r, "FAPI get handle index.", error_cleanup);
@@ -396,13 +401,14 @@ Fapi_CreateNv_Finish(
             fallthrough;
 
         statecase(context->state, NV_CREATE_FIND_INDEX)
-            if (!nvCmd->public_templ.public.nvIndex) {
-                /* Get nv index if not already defined. */
-                r = ifapi_get_free_handle_finish(context, &publicInfo->nvPublic.nvIndex,
+            /* Get nv index if not already defined. */
+            r = ifapi_get_free_handle_finish(context, &publicInfo->nvPublic.nvIndex,
                                              nvCmd->maxNvIndex);
-                return_try_again(r);
-                goto_if_error_reset_state(r, "FAPI get handle index.", error_cleanup);
-            }
+            return_try_again(r);
+            goto_if_error_reset_state(r, "FAPI get handle index.", error_cleanup);
+
+            fallthrough;
+        statecase(context->state, NV_CREATE_INDEX)
 
             /* Start a authorization session for the NV creation. */
             context->primary_state = PRIMARY_INIT;
@@ -418,11 +424,10 @@ Fapi_CreateNv_Finish(
             return_try_again(r);
             goto_if_error_reset_state(r, " FAPI create session", error_cleanup);
 
-
             fallthrough;
 
         statecase(context->state, NV_CREATE_AUTHORIZE_HIERARCHY)
-            /* Authorize with the storage hierarhcy / "owner" for NV creation. */
+            /* Authorize with the storage hierarchy "owner" for NV creation. */
             r = ifapi_authorize_object(context, &nvCmd->auth_object, &auth_session);
             FAPI_SYNC(r, "Authorize hierarchy.", error_cleanup);
 
@@ -443,8 +448,12 @@ Fapi_CreateNv_Finish(
 
             goto_if_error_reset_state(r, "FAPI CreateWithTemplate_Finish", error_cleanup);
 
-            /* Store whether the NV index requires a password. */
             nvCmd->nv_object.public.handle = nvHandle;
+
+            fallthrough;
+
+        statecase(context->state, NV_CREATE_SERIALIZE)
+            /* Store whether the NV index requires a password. */
             if (nvCmd->auth.size > 0)
                 miscNv->with_auth = TPM2_YES;
             else
@@ -481,6 +490,60 @@ Fapi_CreateNv_Finish(
 
             break;
 
+        statecase(context->state, NV_CREATE_CHECK_EXISTING)
+            r = ifapi_check_existing_nv(context, publicInfo->nvPublic.nvIndex, &nv_exists,
+                                        &nvCmd->nv_object.public.handle,
+                                        &existing_nv_public);
+            return_try_again(r);
+            return_if_error_reset_state(r, "checking whether nv index exists failed");
+
+            if (nv_exists) {
+                if (publicInfo->nvPublic.dataSize != existing_nv_public->nvPublic.dataSize) {
+                    LOG_WARNING("Data size from TPM will be used: %u",
+                                existing_nv_public->nvPublic.dataSize);
+                }
+                /* Check whether type is equal */
+                if (!((existing_nv_public->nvPublic.attributes & TPMA_NV_TPM2_NT_MASK) ==
+                      (publicInfo->nvPublic.attributes & TPMA_NV_TPM2_NT_MASK))) {
+                    goto_error(r, TSS2_FAPI_RC_BAD_VALUE,
+                               "The existing NV object and the NV object defined "
+                               "have different types.",
+                               error_cleanup);
+                }
+                if (existing_nv_public->nvPublic.authPolicy.size) {
+                    if (existing_nv_public->nvPublic.attributes & TPMA_NV_POLICYWRITE &&
+                        existing_nv_public->nvPublic.attributes & TPMA_NV_POLICYREAD) {
+                        /* Check that the two policies are equal */
+                        if (existing_nv_public->nvPublic.authPolicy.size ==
+                            publicInfo->nvPublic.authPolicy.size &&
+                            memcmp(&existing_nv_public->nvPublic.authPolicy.buffer[0],
+                                   &publicInfo->nvPublic.authPolicy.buffer[0],
+                                   publicInfo->nvPublic.authPolicy.size) == 0) {
+                            context->state = NV_CREATE_SERIALIZE;
+                        } else {
+                            goto_error(r, TSS2_FAPI_RC_BAD_VALUE,
+                                       "The two policies do not match.",
+                                       error_cleanup);
+                        }
+                    } else if ((publicInfo->nvPublic.attributes & TPMA_NV_AUTHWRITE) &&
+                               (publicInfo->nvPublic.attributes & TPMA_NV_AUTHREAD)) {
+                        publicInfo->nvPublic.authPolicy.size = 0;
+                        LOG_WARNING("Policy defined for object will be ignored");
+                        context->state = NV_CREATE_SERIALIZE;
+                    } else {
+                        goto_error(r, TSS2_FAPI_RC_BAD_VALUE,
+                                   "Object with policy can't be used in FAPI.",
+                                   error_cleanup);
+                    }
+                } else {
+                    context->state = NV_CREATE_SERIALIZE;
+                }
+                *publicInfo = *existing_nv_public;
+            } else {
+                context->state  = NV_CREATE_INDEX;
+            }
+            return TSS2_FAPI_RC_TRY_AGAIN;
+
         statecasedefault(context->state);
     }
 
@@ -498,6 +561,7 @@ Fapi_CreateNv_Finish(
     SAFE_FREE(miscNv->policyInstance);
     SAFE_FREE(nvCmd->nvPath);
     ifapi_session_clean(context);
+    SAFE_FREE(existing_nv_public);
     LOG_TRACE("finished");
     return r;
 }

src/tss2-fapi/fapi_int.h

@@ -153,6 +153,15 @@ enum IFAPI_READ_NV_PUBLIC_STATE {
     READ_NV_PUBLIC_GET_PUBLIC
 };
 
+/** The states for checking whether an nv index exits */
+enum IFAPI_CHECK_NV_STATE {
+    CHECK_NV_INIT = 0,
+    CHECK_NV_WAIT_FOR_GET_CAP,
+    CHECK_NV_GET_ESYS_HANDLE,
+    CHECK_NV_WAIT_FOR_READ_PUBLIC
+};
+
+
 #define IFAPI_MAX_CAP_INFO 17
 
 typedef struct {
@@ -248,6 +257,8 @@ typedef struct {
     IFAPI_EVENT pcr_event;       /**< Event to be added to log */
     TPML_DIGEST_VALUES digests;  /**< Digest for the event data of an extend */
     bool skip_policy_computation; /**< switch whether policy needs to be computed */
+    enum IFAPI_CHECK_NV_STATE nv_check; /**< state for checking existing nv indexes */
+    TPMS_CAPABILITY_DATA *capability; /* TPM capability data to check nv index */
 } IFAPI_NV_Cmds;
 
 /** The data structure holding internal state of Fapi_Initialize command.
@@ -975,6 +986,9 @@ enum FAPI_STATE {
     NV_CREATE_AUTH_SENT,
     NV_CREATE_WRITE,
     NV_CREATE_CALCULATE_POLICY,
+    NV_CREATE_CHECK_EXISTING,
+    NV_CREATE_INDEX,
+    NV_CREATE_SERIALIZE,
 
     NV_WRITE_READ,
     NV_WRITE_WRITE,

src/tss2-fapi/fapi_util.c

@@ -5180,6 +5180,14 @@ ifapi_create_nv_objects(FAPI_CONTEXT *fapi_ctx, IFAPI_CREATE_NV *ctx)
             return TSS2_FAPI_RC_TRY_AGAIN;
         }
 
+        if (existing_nv_public->nvPublic.authPolicy.size > 0) {
+            /* NV objects with existing policy will not be automatically added. */
+            ctx->nv_cap_idx++;
+            SAFE_FREE(existing_nv_public);
+            ctx->state = CREATE_NV_CHECK_NV_INDEX;
+            return TSS2_FAPI_RC_TRY_AGAIN;
+        }
+
         memset(&ctx->nv_object, 0, sizeof(IFAPI_OBJECT));
         ctx->nv_object.objectType = IFAPI_NV_OBJ;
         if (existing_nv_public->nvPublic.attributes & TPMA_NV_PLATFORMCREATE) {
@@ -5254,3 +5262,89 @@ ifapi_create_nv_objects(FAPI_CONTEXT *fapi_ctx, IFAPI_CREATE_NV *ctx)
 
     return r;
 }
+
+/** Check whether an NV index exist on TPM and in keystore.
+ *
+ *  It will be checked whether an NV index exists in the TPM.
+ *  An error will be returned if the index already exists in
+ *  the keystore.
+ *
+ * @param[in] context The FAPI_CONTEXT.
+ * @param[in] template The template which defines the key attributes and whether the
+ *            key will be persistent.
+ * @param[out] The boolean which defines whether the index exists.
+ * @retval TSS2_RC_SUCCESS on success.
+ * @retval TSS2_FAPI_RC_BAD_VALUE if the index already exists.
+ * @retval TSS2_ESYS_RC_* possible error codes of ESAPI.
+ * @retval TSS2_FAPI_RC_MEMORY if not enough memory can be allocated.
+ * @retval TSS2_FAPI_RC_BAD_REFERENCE a invalid null pointer is passed.
+ * @retval TSS2_FAPI_RC_TRY_AGAIN if an I/O operation is not finished yet and
+ *         this function needs to be called again.
+ * @retval TSS2_FAPI_RC_IO_ERROR if an error occurred while accessing the
+ *         object store.
+ * @retval TSS2_FAPI_RC_GENERAL_FAILURE if an internal error occurred.
+ * @retval TSS2_FAPI_RC_BAD_PATH if the path is used in inappropriate context
+ *         or contains illegal characters.
+ * @retval TSS2_FAPI_RC_PATH_ALREADY_EXISTS if the object already exists in object store.
+ */
+TSS2_RC
+ifapi_check_existing_nv(FAPI_CONTEXT *context, TPMI_RH_NV_INDEX nv_index, bool *nv_exists,
+                        ESYS_TR *esys_nv_handle,
+                        TPM2B_NV_PUBLIC **nvPublic)
+{
+    TSS2_RC r;
+    *nv_exists = false;
+    TPMI_YES_NO moreData;
+    TPMS_CAPABILITY_DATA **capabilityData = &context->nv_cmd.capability;
+
+    switch (context->nv_cmd.nv_check) {
+    statecase(context->nv_cmd.nv_check, CHECK_NV_INIT);
+        *capabilityData = NULL;
+        r = Esys_GetCapability_Async(context->esys,
+                 ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE, TPM2_CAP_HANDLES,
+                 nv_index, 1);
+        return_if_error(r, "Esys_GetCapability_Async");
+        fallthrough;
+    statecase(context->nv_cmd.nv_check, CHECK_NV_WAIT_FOR_GET_CAP);
+        r = Esys_GetCapability_Finish(context->esys, &moreData, capabilityData);
+        return_try_again(r);
+        return_if_error_reset_state(r, "GetCapablity_Finish");
+        if ((*capabilityData)->data.handles.count == 0 ||
+            (*capabilityData)->data.handles.handle[0] != nv_index) {
+            context->nv_cmd.nv_check = CHECK_NV_INIT;
+            SAFE_FREE(*capabilityData);
+            *nv_exists = false;
+            break;
+        }
+        SAFE_FREE(*capabilityData);
+
+        r = Esys_TR_FromTPMPublic_Async(context->esys, nv_index,
+                                        ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE);
+        return_if_error(r, "Esys_TR_FromTPMPublic_Async");
+
+        fallthrough;
+
+    statecase(context->nv_cmd.nv_check, CHECK_NV_GET_ESYS_HANDLE);
+        r = Esys_TR_FromTPMPublic_Finish(context->esys, esys_nv_handle);
+        return_try_again(r);
+
+        return_if_error(r, "Esys_TR_FromTPMPublic_Finish");
+
+        /* Read public from the existing nv object */
+        r = Esys_NV_ReadPublic_Async(context->esys, *esys_nv_handle,
+                     ESYS_TR_NONE, ESYS_TR_NONE, ESYS_TR_NONE);
+        return_if_error(r, "Esys_NV_ReadPublic_Async");
+        fallthrough;
+
+    statecase(context->nv_cmd.nv_check, CHECK_NV_WAIT_FOR_READ_PUBLIC);
+        r = Esys_NV_ReadPublic_Finish(context->esys, nvPublic, NULL);
+        return_try_again(r);
+        return_if_error(r, "Error: nv read public");
+        *nv_exists = true;
+        break;
+    statecasedefault(context->cmd.Key_Create.state);
+    }
+
+    return TSS2_RC_SUCCESS;
+
+}

src/tss2-fapi/fapi_util.h

@@ -269,4 +269,10 @@ ifapi_create_primary(FAPI_CONTEXT *context, IFAPI_KEY_TEMPLATE *template);
 
 TSS2_RC
 ifapi_create_nv_objects(FAPI_CONTEXT *fapi_ctx, IFAPI_CREATE_NV *ctx);
+
+TSS2_RC
+ifapi_check_existing_nv(FAPI_CONTEXT *context, TPMI_RH_NV_INDEX nv_index,
+                        bool *nv_exists,
+                        ESYS_TR *esys_nv_handle, TPM2B_NV_PUBLIC **nvPublic);
+
 #endif /* FAPI_UTIL_H */