dh/ima-evm-utils-mirror
1
0
Fork 0
mirror of https://git.code.sf.net/p/linux-ima/ima-evm-utils synced 2025-04-27 06:12:32 +02:00
Code Releases Activity

Replace the low level SHA1 calls when calculating the TPM 1.2 PCRs

Browse Source 
OpenSSL v3 emits deprecated warnings for SHA1 functions.  Use the
EVP_ functions when walking the TPM 1.2 binary bios measurements
to calculate the TPM 1.2 PCRs.

Reviewed-by: Petr Vorel <pvorel@suse.cz>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Mimi Zohar 2022-08-04 18:41:18 -04:00
parent 751a395772
commit b9c9759a7e
1 changed files with 63 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
src/evmctl.c
View File

@ -2299,6 +2299,11 @@ static int cmd_ima_measurement(struct command *cmd)
return ima_measurement(file);
}
/*
* read_binary_bios_measurements - read the TPM 1.2 event log
*
* Returns 0 on success, 1 on failure.
*/
#define MAX_EVENT_DATA_SIZE 200000
static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank)
{
@ -2311,17 +2316,22 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank)
} header;
unsigned char data[MAX_EVENT_DATA_SIZE];
} event;
EVP_MD_CTX *mdctx;
const EVP_MD *md;
unsigned int mdlen;
int evp_err = 1; /* success */
struct stat s;
FILE *fp;
SHA_CTX c;
int err = 0;
int len;
int i;
#if OPENSSL_VERSION_NUMBER < 0x10100000
EVP_MD_CTX ctx;
mdctx = &ctx;
#endif
if (stat(file, &s) == -1) {
errno = 0;
if (stat(file, &s) == -1)
return 1;
}
if (!S_ISREG(s.st_mode)) {
log_info("Bios event log: not a regular file or link to regular file\n");
@ -2329,13 +2339,27 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank)
}
fp = fopen(file, "r");
if (!fp) {
log_errno("Failed to open TPM 1.2 event log.\n");
if (!fp)
return 1;
if (imaevm_params.verbose > LOG_INFO)
log_info("Reading the TPM 1.2 event log (%s)\n", file);
md = EVP_get_digestbyname(bank->algo_name);
if (!md) {
log_err("Unknown message digest %s\n", bank->algo_name);
fclose(fp);
return 1;
}
if (imaevm_params.verbose > LOG_INFO)
log_info("Reading the TPM 1.2 event log %s.\n", file);
#if OPENSSL_VERSION_NUMBER >= 0x10100000
mdctx = EVP_MD_CTX_new();
if (!mdctx) {
log_err("EVP_MD_CTX_new failed\n");
fclose(fp);
return 1;
}
#endif
/* Extend the pseudo TPM PCRs with the event digest */
while (fread(&event, sizeof(event.header), 1, fp) == 1) {
@ -2345,13 +2369,30 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank)
}
if (event.header.pcr >= NUM_PCRS) {
log_err("Invalid PCR %d.\n", event.header.pcr);
err = 1;
break;
}
SHA1_Init(&c);
SHA1_Update(&c, bank->pcr[event.header.pcr], 20);
SHA1_Update(&c, event.header.digest, 20);
SHA1_Final(bank->pcr[event.header.pcr], &c);
evp_err = EVP_DigestInit(mdctx, md);
if (evp_err == 0) {
log_err("EVP_DigestInit() failed\n");
break;
}
evp_err = EVP_DigestUpdate(mdctx, bank->pcr[event.header.pcr], 20);
if (evp_err == 0) {
log_err("EVP_DigestUpdate() failed\n");
break;
}
evp_err = EVP_DigestUpdate(mdctx, event.header.digest, 20);
if (evp_err == 0) {
log_err("EVP_DigestUpdate() failed\n");
break;
}
evp_err = EVP_DigestFinal(mdctx, bank->pcr[event.header.pcr], &mdlen);
if (evp_err == 0) {
log_err("EVP_DigestFinal() failed\n");
break;
}
if (event.header.len > MAX_EVENT_DATA_SIZE) {
log_err("Event data event too long.\n");
err = 1;
@ -2360,10 +2401,17 @@ static int read_binary_bios_measurements(char *file, struct tpm_bank_info *bank)
len = fread(event.data, event.header.len, 1, fp);
if (len != 1) {
log_errno("Failed reading event data (short read)\n");
err = 1;
break;
}
}
if (evp_err == 0) /* EVP_ functions return 1 on success, 0 on failure */
err = 1;
fclose(fp);
#if OPENSSL_VERSION_NUMBER >= 0x10100000
EVP_MD_CTX_free(mdctx);
#endif
if (imaevm_params.verbose <= LOG_INFO)
return err;
@ -2487,8 +2535,8 @@ static int cmd_ima_bootaggr(struct command *cmd)
err = read_binary_bios_measurements(file, tpm_banks);
if (err) {
log_info("Failed reading the TPM 1.2 event log %s.\n",
file);
log_err("Failed reading the TPM 1.2 event log (%s)\n",
file);
return -1;
}
} else {