usr/src/cmd/cmd-crypto/tpmadm/admin_cmds.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  */
  26
  27 #include <unistd.h>
  28 #include <stdlib.h>
  29 #include <stdio.h>
  30 #include <strings.h>
  31 #include <fcntl.h>
  32 #include <sys/types.h>
  33 #include <netinet/in.h>
  34 #include <inttypes.h>
  35 #include <sha1.h>
  36 #include <uuid/uuid.h>
  37 #include <sys/stat.h>
  38 #include <libintl.h>
  39
  40 #include <tss/tss_defines.h>
  41 #include <tss/tspi.h>
  42
  43 #include "tpmadm.h"
  44
  45 int cmd_status(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[]);
  46 int cmd_init(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[]);
  47 int cmd_clear(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[]);
  48 int cmd_auth(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[]);
  49 int cmd_keyinfo(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[]);
  50 int cmd_deletekey(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[]);
  51
  52 cmdtable_t commands[] = {
  53         { "status", "", cmd_status },
  54         { "init", "", cmd_init },
  55         { "clear", "[owner | lock]", cmd_clear },
  56         { "auth", "", cmd_auth },
  57         { "keyinfo", "[uuid]", cmd_keyinfo },
  58         { "deletekey", "uuid", cmd_deletekey },
  59         { NULL, NULL, NULL },
  60 };
  61
  62 BYTE well_known[] = TSS_WELL_KNOWN_SECRET;
  63 TSS_UUID srk_uuid = TSS_UUID_SRK;
  64
  65
  66 /*
  67  * TPM status
  68  */
  69
  70 static int
  71 print_tpm_version(TSS_HCONTEXT hContext, TSS_HOBJECT hTPM)
  72 {
  73         struct {
  74                 TPM_CAP_VERSION_INFO vers_info;
  75                 char extra[20]; /* vendor extensions */
  76         } info;
  77
  78         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_VERSION_VAL,
  79             0, &info, sizeof (info)))
  80                 return (ERR_FAIL);
  81
  82         (void) printf(gettext("TPM Version: %d.%d (%c%c%c%c Rev: %d.%d, "
  83             "SpecLevel: %d, ErrataRev: %d)\n"),
  84             info.vers_info.version.major,
  85             info.vers_info.version.minor,
  86             info.vers_info.tpmVendorID[0],
  87             info.vers_info.tpmVendorID[1],
  88             info.vers_info.tpmVendorID[2],
  89             info.vers_info.tpmVendorID[3],
  90             info.vers_info.version.revMajor,
  91             info.vers_info.version.revMinor,
  92             (int)ntohs(info.vers_info.specLevel),
  93             info.vers_info.errataRev);
  94
  95         return (0);
  96 }
  97
  98 static int
  99 tpm_is_owned(TSS_HCONTEXT hContext, TSS_HOBJECT hTPM)
 100 {
 101         BYTE owned;
 102
 103         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 104             TSS_TPMCAP_PROP_OWNER, &owned, sizeof (owned)))
 105                 return (0);
 106
 107         return (owned);
 108 }
 109
 110 static int
 111 print_tpm_resources(TSS_HCONTEXT hContext, TSS_HOBJECT hTPM)
 112 {
 113         UINT32 avail, max;
 114
 115         (void) printf(gettext("TPM resources\n"));
 116
 117         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 118             TSS_TPMCAP_PROP_MAXCONTEXTS, &max, sizeof (max)))
 119                 return (ERR_FAIL);
 120         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 121             TSS_TPMCAP_PROP_CONTEXTS, &avail, sizeof (avail)))
 122                 return (ERR_FAIL);
 123         (void) printf(gettext("\tContexts: %d/%d available\n"), avail, max);
 124
 125         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 126             TSS_TPMCAP_PROP_MAXSESSIONS, &max, sizeof (max)))
 127                 return (ERR_FAIL);
 128         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 129             TSS_TPMCAP_PROP_SESSIONS, &avail, sizeof (avail)))
 130                 return (ERR_FAIL);
 131         (void) printf(gettext("\tSessions: %d/%d available\n"), avail, max);
 132
 133         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 134             TSS_TPMCAP_PROP_MAXAUTHSESSIONS, &max, sizeof (max)))
 135                 return (ERR_FAIL);
 136         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 137             TSS_TPMCAP_PROP_AUTHSESSIONS, &avail, sizeof (avail)))
 138                 return (ERR_FAIL);
 139         (void) printf(gettext("\tAuth Sessions: %d/%d available\n"),
 140             avail, max);
 141
 142         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 143             TSS_TPMCAP_PROP_MAXKEYS, &max, sizeof (max)))
 144                 return (ERR_FAIL);
 145         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 146             TSS_TPMCAP_PROP_KEYS, &avail, sizeof (avail)))
 147                 return (ERR_FAIL);
 148         (void) printf(gettext("\tLoaded Keys: %d/%d available\n"), avail, max);
 149
 150         return (0);
 151 }
 152
 153 static int
 154 print_tpm_pcrs(TSS_HCONTEXT hContext, TSS_HOBJECT hTPM)
 155 {
 156         UINT32 num_pcrs;
 157         int i;
 158
 159         if (get_tpm_capability(hContext, hTPM, TSS_TPMCAP_PROPERTY,
 160             TSS_TPMCAP_PROP_PCR, &num_pcrs, sizeof (num_pcrs)))
 161                 return (ERR_FAIL);
 162         (void) printf(gettext("Platform Configuration Registers (%u)\n"),
 163             num_pcrs);
 164
 165         /* Print each PCR */
 166         for (i = 0; i < num_pcrs; i++) {
 167                 TSS_RESULT ret;
 168                 UINT32 datalen;
 169                 BYTE *data;
 170
 171                 ret = Tspi_TPM_PcrRead(hTPM, i, &datalen, &data);
 172                 if (ret) {
 173                         print_error(ret, gettext("Read PCR"));
 174                         return (ret);
 175                 }
 176
 177                 (void) printf("\tPCR %u:\t", i);
 178                 print_bytes(data, datalen, FALSE);
 179
 180                 ret = Tspi_Context_FreeMemory(hContext, data);
 181                 if (ret) {
 182                         print_error(ret, gettext("Free PCR memory"));
 183                         return (ret);
 184                 }
 185         }
 186         return (0);
 187 }
 188
 189 /*ARGSUSED*/
 190 int
 191 cmd_status(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[])
 192 {
 193         if (set_object_policy(hTPM, TSS_SECRET_MODE_POPUP, NULL, 0, NULL))
 194                 return (ERR_FAIL);
 195
 196         (void) print_tpm_version(hContext, hTPM);
 197         if (tpm_is_owned(hContext, hTPM)) {
 198                 (void) print_tpm_resources(hContext, hTPM);
 199                 (void) print_tpm_pcrs(hContext, hTPM);
 200         } else {
 201                 (void) printf(gettext("No TPM owner installed.\n"));
 202         }
 203
 204         return (0);
 205 }
 206
 207
 208 /*
 209  * Key Information
 210  */
 211
 212 typedef struct {
 213         UINT32 code;
 214         char *str;
 215 } decode_map_t;
 216
 217 decode_map_t key_usage[] = {
 218         { TSS_KEYUSAGE_SIGN, "Signing" },
 219         { TSS_KEYUSAGE_STORAGE, "Storage" },
 220         { TSS_KEYUSAGE_IDENTITY, "Identity" },
 221         { TSS_KEYUSAGE_AUTHCHANGE, "Authchange" },
 222         { TSS_KEYUSAGE_BIND, "Bind" },
 223         { TSS_KEYUSAGE_LEGACY, "Legacy" },
 224         { TSS_KEYUSAGE_MIGRATE, "Migrate" },
 225         { 0, NULL },
 226 };
 227
 228 decode_map_t key_algorithm[] = {
 229         { TSS_ALG_RSA, "RSA" },
 230         { TSS_ALG_DES, "DES" },
 231         { TSS_ALG_3DES, "3-DES" },
 232         { TSS_ALG_SHA, "SHA" },
 233         { TSS_ALG_HMAC, "HMAC" },
 234         { TSS_ALG_AES, "AES" },
 235         { TSS_ALG_MGF1, "MGF1" },
 236         { TSS_ALG_AES192, "AES192" },
 237         { TSS_ALG_AES256, "AES256" },
 238         { TSS_ALG_XOR, "XOR" },
 239         { 0, NULL },
 240 };
 241
 242 decode_map_t key_sigscheme[] = {
 243         { TSS_SS_NONE, "None" },
 244         { TSS_SS_RSASSAPKCS1V15_SHA1, "RSASSAPKCS1v15_SHA1" },
 245         { TSS_SS_RSASSAPKCS1V15_DER, "RSASSAPKCS1v15_DER" },
 246         { 0, NULL },
 247 };
 248
 249 decode_map_t key_encscheme[] = {
 250         { TSS_ES_NONE, "None" },
 251         { TSS_ES_RSAESPKCSV15, "RSAESPKCSv15" },
 252         { TSS_ES_RSAESOAEP_SHA1_MGF1, "RSAESOAEP_SHA1_MGF1" },
 253         { TSS_ES_SYM_CNT, "SYM_CNT" },
 254         { TSS_ES_SYM_OFB, "SYM_OFB" },
 255         { 0, NULL },
 256 };
 257
 258 static char *
 259 decode(decode_map_t *table, UINT32 code)
 260 {
 261         static char buf[20];
 262         int i;
 263
 264         for (i = 0; table[i].str != NULL; i++) {
 265                 if (table[i].code == code)
 266                         return (table[i].str);
 267         }
 268
 269         (void) snprintf(buf, sizeof (buf), gettext("Unknown (%u)"), code);
 270         return (buf);
 271 }
 272
 273 static void
 274 print_key_info(TSS_HCONTEXT hContext, TSS_HOBJECT hKey)
 275 {
 276         TSS_RESULT ret;
 277         UINT32 attrib;
 278         UINT32 keyInfoSize;
 279         BYTE *keyInfo;
 280
 281         /* Key size */
 282         ret = Tspi_GetAttribUint32(hKey, TSS_TSPATTRIB_KEY_INFO,
 283             TSS_TSPATTRIB_KEYINFO_SIZE, &attrib);
 284         if (ret) {
 285                 print_error(ret, gettext("Get key size"));
 286         }
 287         (void) printf(gettext("Key Size: %d bits\n"), attrib);
 288
 289         /* Key usage */
 290         ret = Tspi_GetAttribUint32(hKey, TSS_TSPATTRIB_KEY_INFO,
 291             TSS_TSPATTRIB_KEYINFO_USAGE, &attrib);
 292         if (ret) {
 293                 print_error(ret, gettext("Get key usage"));
 294         }
 295         (void) printf(gettext("Key Usage: %s\n"), decode(key_usage, attrib));
 296
 297         /* Algorithm */
 298         ret = Tspi_GetAttribUint32(hKey, TSS_TSPATTRIB_KEY_INFO,
 299             TSS_TSPATTRIB_KEYINFO_ALGORITHM, &attrib);
 300         if (ret) {
 301                 print_error(ret, gettext("Get key algorithm"));
 302         }
 303         (void) printf(gettext("Algorithm: %s\n"),
 304             decode(key_algorithm, attrib));
 305
 306         /* Authorization required */
 307         ret = Tspi_GetAttribUint32(hKey, TSS_TSPATTRIB_KEY_INFO,
 308             TSS_TSPATTRIB_KEYINFO_AUTHUSAGE, &attrib);
 309         if (ret) {
 310                 print_error(ret, gettext("Get key authusage"));
 311         }
 312         (void) printf(gettext("Authorization required: %s\n"),
 313             attrib ? gettext("Yes") : gettext("No"));
 314
 315         /* Signature scheme */
 316         ret = Tspi_GetAttribUint32(hKey, TSS_TSPATTRIB_KEY_INFO,
 317             TSS_TSPATTRIB_KEYINFO_SIGSCHEME, &attrib);
 318         if (ret) {
 319                 print_error(ret, gettext("Get key signature scheme"));
 320         }
 321         (void) printf(gettext("Signature scheme: %s\n"),
 322             decode(key_sigscheme, attrib));
 323
 324         /* Encoding scheme */
 325         ret = Tspi_GetAttribUint32(hKey, TSS_TSPATTRIB_KEY_INFO,
 326             TSS_TSPATTRIB_KEYINFO_ENCSCHEME, &attrib);
 327         if (ret) {
 328                 print_error(ret, gettext("Get key encoding scheme"));
 329         }
 330         (void) printf(gettext("Encoding scheme: %s\n"),
 331             decode(key_encscheme, attrib));
 332
 333         /* Key blob */
 334         ret = Tspi_GetAttribData(hKey, TSS_TSPATTRIB_KEY_BLOB,
 335             TSS_TSPATTRIB_KEYBLOB_BLOB, &keyInfoSize, &keyInfo);
 336         if (ret) {
 337                 print_error(ret, gettext("Get key blob"));
 338         }
 339         (void) printf(gettext("TPM Key Blob:\n"));
 340         print_bytes(keyInfo, keyInfoSize, TRUE);
 341         ret = Tspi_Context_FreeMemory(hContext, keyInfo);
 342         if (ret) {
 343                 print_error(ret, gettext("Free key info buffer"));
 344         }
 345 }
 346
 347 typedef struct hash_node {
 348         struct hash_node *next, *sibling, *child;
 349         TSS_UUID uuid;
 350         TSS_KM_KEYINFO2 *key_data;
 351 } hash_node_t;
 352
 353 #define HASHSIZE 17
 354 hash_node_t *hash_table[HASHSIZE];
 355
 356 static hash_node_t *
 357 hash_insert(TSS_UUID uuid, TSS_KM_KEYINFO2 *key_data)
 358 {
 359         UINT32 i, index = 0;
 360         hash_node_t *node;
 361         char *cp;
 362
 363         cp = (char *)&uuid;
 364         for (i = 0; i < sizeof (TSS_UUID); i++)
 365                 index += cp[i];
 366         index = index % HASHSIZE;
 367
 368         for (node = hash_table[index]; node != NULL; node = node->next) {
 369                 if (memcmp(&(node->uuid), &uuid, sizeof (TSS_UUID)) == 0)
 370                         break;
 371         }
 372
 373         if (node == NULL) {
 374                 node = calloc(1, sizeof (hash_node_t));
 375                 node->uuid = uuid;
 376                 node->next = hash_table[index];
 377                 hash_table[index] = node;
 378         }
 379         if (node->key_data == NULL)
 380                 node->key_data = key_data;
 381
 382         return (node);
 383 }
 384
 385 static void
 386 add_child(hash_node_t *parent, hash_node_t *child)
 387 {
 388         hash_node_t *node;
 389
 390         for (node = parent->child; node != NULL; node = node->next) {
 391                 if (node == child)
 392                         return;
 393         }
 394
 395         child->sibling = parent->child;
 396         parent->child = child;
 397 }
 398
 399 static void
 400 print_all(hash_node_t *parent, int indent)
 401 {
 402         char uuidstr[UUID_PRINTABLE_STRING_LENGTH];
 403         hash_node_t *node;
 404         char *type, *loaded;
 405
 406         uuid_unparse(*(uuid_t *)&parent->uuid, uuidstr);
 407         type = (parent->key_data->persistentStorageType == TSS_PS_TYPE_USER) ?
 408             "USER" : "SYSTEM";
 409         loaded = parent->key_data->fIsLoaded ? "(loaded)" : "";
 410         (void) printf("%*s[%s] %s %s\n", indent, "",
 411             type, uuidstr, loaded);
 412
 413         for (node = parent->child; node != NULL; node = node->sibling)
 414                 print_all(node, indent + 4);
 415 }
 416
 417 /*ARGSUSED*/
 418 int
 419 cmd_keyinfo(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[])
 420 {
 421         TSS_RESULT ret;
 422         UINT32 i, num_keys;
 423         TSS_KM_KEYINFO2 *keys;
 424         hash_node_t *parent, *child, *srk = NULL;
 425         TSS_HKEY hKey;
 426         union {
 427                 uuid_t arr_uuid;
 428                 TSS_UUID tss_uuid;
 429         } uuid;
 430
 431         switch (argc) {
 432         case 1:
 433                 /* Print key hierarchy */
 434                 ret = Tspi_Context_GetRegisteredKeysByUUID2(hContext,
 435                     TSS_PS_TYPE_USER, NULL, &num_keys, &keys);
 436                 if (ret) {
 437                         print_error(ret, gettext("Get key hierarchy"));
 438                         return (ERR_FAIL);
 439                 }
 440
 441                 for (i = 0; i < num_keys; i++) {
 442                         parent = hash_insert(keys[i].parentKeyUUID, NULL);
 443                         child = hash_insert(keys[i].keyUUID, &keys[i]);
 444                         add_child(parent, child);
 445                         if (memcmp(&(keys[i].keyUUID), &srk_uuid,
 446                             sizeof (TSS_UUID)) == 0)
 447                                 srk = child;
 448                 }
 449
 450                 if (srk != NULL)
 451                         print_all(srk, 0);
 452                 ret = Tspi_Context_FreeMemory(hContext, (BYTE *) keys);
 453                 if (ret) {
 454                         print_error(ret, gettext("Free key list"));
 455                         return (ERR_FAIL);
 456                 }
 457                 return (0);
 458
 459         case 2:
 460                 /* Print detailed info about a single key */
 461                 if (uuid_parse(argv[1], uuid.arr_uuid))
 462                         return (ERR_FAIL);
 463                 ret = Tspi_Context_GetKeyByUUID(hContext, TSS_PS_TYPE_USER,
 464                     uuid.tss_uuid, &hKey);
 465                 if (ret == TSP_ERROR(TSS_E_PS_KEY_NOTFOUND)) {
 466                         ret = Tspi_Context_GetKeyByUUID(hContext,
 467                             TSS_PS_TYPE_SYSTEM, uuid.tss_uuid, &hKey);
 468                 }
 469                 if (ret) {
 470                         print_error(ret, gettext("Get key by UUID"));
 471                         return (ERR_FAIL);
 472                 }
 473                 print_key_info(hContext, hKey);
 474                 return (0);
 475
 476         default:
 477                 (void) fprintf(stderr, gettext("Usage:\n"));
 478                 (void) fprintf(stderr, "\tkeyinfo [uuid]\n");
 479                 return (ERR_USAGE);
 480         }
 481 }
 482
 483 /*ARGSUSED*/
 484 int
 485 cmd_deletekey(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[])
 486 {
 487         TSS_RESULT ret;
 488         TSS_HOBJECT hKey;
 489         union {
 490                 uuid_t arr_uuid;
 491                 TSS_UUID tss_uuid;
 492         } uuid;
 493
 494         if (argc < 2) {
 495                 (void) fprintf(stderr, gettext("Usage:\n"));
 496                 (void) fprintf(stderr, "\tdeletekey [uuid]\n");
 497                 return (ERR_USAGE);
 498         }
 499         if (uuid_parse(argv[1], uuid.arr_uuid))
 500                 return (ERR_FAIL);
 501         ret = Tspi_Context_UnregisterKey(hContext, TSS_PS_TYPE_USER,
 502             uuid.tss_uuid, &hKey);
 503         if (ret == TSP_ERROR(TSS_E_PS_KEY_NOTFOUND)) {
 504                 ret = Tspi_Context_UnregisterKey(hContext, TSS_PS_TYPE_SYSTEM,
 505                     uuid.tss_uuid, &hKey);
 506         }
 507         if (ret) {
 508                 print_error(ret, gettext("Unregister key"));
 509                 return (ERR_FAIL);
 510         }
 511         return (0);
 512 }
 513
 514 /*
 515  * Clear
 516  */
 517
 518 static int
 519 clearowner(TSS_HTPM hTPM)
 520 {
 521         TSS_RESULT ret;
 522
 523         if (set_object_policy(hTPM, TSS_SECRET_MODE_POPUP,
 524             gettext("= TPM owner passphrase ="), 0, NULL))
 525                 return (ERR_FAIL);
 526
 527         ret = Tspi_TPM_ClearOwner(hTPM, FALSE);
 528         if (ret) {
 529                 print_error(ret, gettext("Clear TPM owner"));
 530                 return (ERR_FAIL);
 531         }
 532         return (0);
 533 }
 534
 535 static int
 536 resetlock(TSS_HTPM hTPM)
 537 {
 538         TSS_RESULT ret;
 539
 540         if (set_object_policy(hTPM, TSS_SECRET_MODE_POPUP,
 541             gettext("= TPM owner passphrase ="), 0, NULL))
 542                 return (ERR_FAIL);
 543
 544         ret = Tspi_TPM_SetStatus(hTPM, TSS_TPMSTATUS_RESETLOCK, TRUE);
 545         if (ret) {
 546                 print_error(ret, gettext("Reset Lock"));
 547                 return (ERR_FAIL);
 548         }
 549         return (0);
 550 }
 551
 552 /*ARGSUSED*/
 553 int
 554 cmd_clear(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[])
 555 {
 556         char *subcmd = argv[1];
 557
 558         if (subcmd && strcmp(subcmd, "lock") == 0) {
 559                 return (resetlock(hTPM));
 560         } else if (subcmd && strcmp(subcmd, "owner") == 0) {
 561                 return (clearowner(hTPM));
 562         } else {
 563                 (void) fprintf(stderr, gettext("Usage:\n"));
 564                 (void) fprintf(stderr, "\tclear owner\n");
 565                 (void) fprintf(stderr, "\tclear lock\n");
 566                 return (ERR_USAGE);
 567         }
 568 }
 569
 570
 571 /*
 572  * TPM initialization
 573  */
 574
 575 static int
 576 get_random(UINT32 size, BYTE *randomBytes)
 577 {
 578         int fd, len;
 579         BYTE *buf;
 580
 581         fd = open("/dev/random", O_RDONLY);
 582         if (fd == -1) {
 583                 (void) fprintf(stderr, gettext("Unable to open /dev/random"));
 584                 return (-1);
 585         }
 586
 587         buf = randomBytes;
 588         while (size > 0) {
 589                 len = read(fd, buf, size);
 590                 if (len <= 0) {
 591                         (void) close(fd);
 592                         (void) fprintf(stderr,
 593                             gettext("Error reading /dev/random"));
 594                         return (-1);
 595                 }
 596                 size -= len;
 597                 buf += len;
 598         }
 599
 600         (void) close(fd);
 601         return (0);
 602 }
 603
 604 static int
 605 createek(TSS_HCONTEXT hContext, TSS_HTPM hTPM)
 606 {
 607         TSS_RESULT ret;
 608         TSS_HOBJECT hKeyEK;
 609         TSS_VALIDATION ValidationData;
 610         TPM_NONCE nonce;
 611         TPM_DIGEST digest;
 612
 613         /* Create the empty key struct for EK */
 614         ret = Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_RSAKEY,
 615             (TSS_KEY_NO_AUTHORIZATION | TSS_KEY_NON_VOLATILE |
 616             TSS_KEY_NOT_MIGRATABLE | TSS_KEY_TYPE_STORAGE |
 617             TSS_KEY_SIZE_2048 | TSS_KEY_NOT_CERTIFIED_MIGRATABLE |
 618             TSS_KEY_STRUCT_KEY12 | TSS_KEY_EMPTY_KEY),
 619             &hKeyEK);
 620         if (ret) {
 621                 print_error(ret, gettext("Create endorsement key object"));
 622                 return (ERR_FAIL);
 623         }
 624
 625         ValidationData.ulExternalDataLength = sizeof (nonce);
 626         ValidationData.rgbExternalData = (BYTE *) &nonce;
 627         ret = get_random(sizeof (nonce), (BYTE *) &nonce);
 628         if (ret)
 629                 return (ERR_FAIL);
 630         ValidationData.ulValidationDataLength = sizeof (digest);
 631         ValidationData.rgbValidationData = (BYTE *) &digest;
 632
 633         ret = Tspi_TPM_CreateEndorsementKey(hTPM, hKeyEK, &ValidationData);
 634         if (ret) {
 635                 print_error(ret, gettext("Create endorsement key"));
 636                 return (ERR_FAIL);
 637         }
 638
 639         return (0);
 640 }
 641
 642 /*ARGSUSED*/
 643 int
 644 cmd_init(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[])
 645 {
 646         TSS_RESULT ret;
 647         TSS_HOBJECT hKeySRK;
 648
 649         if (set_object_policy(hTPM, TSS_SECRET_MODE_POPUP,
 650             gettext("= TPM owner passphrase ="), 0, NULL))
 651                 return (ERR_FAIL);
 652
 653         ret = Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_RSAKEY,
 654             TSS_KEY_TSP_SRK | TSS_KEY_AUTHORIZATION, &hKeySRK);
 655         if (ret) {
 656                 print_error(ret, gettext("Create storage root key"));
 657                 return (ERR_FAIL);
 658         }
 659
 660         if (set_object_policy(hKeySRK, TSS_SECRET_MODE_SHA1, NULL,
 661             sizeof (well_known), well_known))
 662                 return (ERR_FAIL);
 663
 664         ret = Tspi_TPM_TakeOwnership(hTPM, hKeySRK, NULL);
 665         if (ret == TPM_E_NO_ENDORSEMENT) {
 666                 if (createek(hContext, hTPM))
 667                         return (ERR_FAIL);
 668                 ret = Tspi_TPM_TakeOwnership(hTPM, hKeySRK, NULL);
 669         }
 670         if (ret) {
 671                 print_error(ret, gettext("Take ownership"));
 672                 return (ERR_FAIL);
 673         }
 674
 675         return (0);
 676 }
 677
 678 /*
 679  * Auth
 680  */
 681
 682 /*ARGSUSED*/
 683 int
 684 cmd_auth(TSS_HCONTEXT hContext, TSS_HTPM hTPM, int argc, char *argv[])
 685 {
 686         TSS_RESULT ret;
 687         TSS_HPOLICY hNewPolicy;
 688
 689         if (set_object_policy(hTPM, TSS_SECRET_MODE_POPUP,
 690             gettext("= TPM owner passphrase ="), 0, NULL))
 691                 return (ERR_FAIL);
 692
 693         /* policy object for new passphrase */
 694         ret = Tspi_Context_CreateObject(hContext, TSS_OBJECT_TYPE_POLICY,
 695             TSS_POLICY_USAGE, &hNewPolicy);
 696         if (ret) {
 697                 print_error(ret, gettext("Create policy object"));
 698                 return (ERR_FAIL);
 699         }
 700         if (set_policy_options(hNewPolicy, TSS_SECRET_MODE_POPUP,
 701             gettext("= New TPM owner passphrase ="), 0, NULL))
 702                 return (ERR_FAIL);
 703
 704         ret = Tspi_ChangeAuth(hTPM, NULL, hNewPolicy);
 705         if (ret && ret != TSP_ERROR(TSS_E_POLICY_NO_SECRET)) {
 706                 print_error(ret, gettext("Change authorization"));
 707                 return (ERR_FAIL);
 708         }
 709
 710         return (0);
 711 }