WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity

fwTPM: always set continueSession in password authorization response (issue #529)

pull/530/head
aidan garske 2026-06-16 13:46:24 -07:00
parent 69d7ae1a17
commit 8512df5bf7
2 changed files with 49 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/fwtpm/fwtpm_command.c
View File

@ -16379,7 +16379,10 @@ int FWTPM_ProcessCommand(FWTPM_CTX* ctx,
#endif /* !FWTPM_NO_PARAM_ENC */
if (cmdAuths[j].sess == NULL) {
/* Password session: empty nonce + attributes + empty hmac */
/* Password session: continueSession is always SET in the
* response per TPM 2.0 Part 1 Section 16.4. Empty nonce +
* attributes + empty hmac. */
rspAttribs |= TPMA_SESSION_continueSession;
TPM2_Packet_AppendU16(&rspPkt, 0); /* nonce size = 0 */
TPM2_Packet_AppendU8(&rspPkt, rspAttribs);
TPM2_Packet_AppendU16(&rspPkt, 0); /* hmac size = 0 */

45
tests/fwtpm_unit_tests.c
View File

@ -792,6 +792,50 @@ static void test_fwtpm_pcr_extend_and_read(void)
fwtpm_pass("PCR_Extend + Read(16):", 0);
}
/* Per TPM 2.0 Part 1 Section 16.4, a password authorization (TPM_RS_PW)
* must return sessionAttributes with continueSession SET, regardless of
* whether the command set the bit. */
static void test_fwtpm_pw_session_continue_set(void)
{
FWTPM_CTX ctx;
int rc, rspSize = 0, cmdSz;
byte attr;
memset(&ctx, 0, sizeof(ctx));
AssertIntEQ(fwtpm_test_startup(&ctx), 0);
/* PCR_Extend on PCR 16 with an empty-password session; command
* attributes byte is 0 (continueSession not set). */
cmdSz = 0;
PutU16BE(gCmd + cmdSz, TPM_ST_SESSIONS); cmdSz += 2;
PutU32BE(gCmd + cmdSz, 0); cmdSz += 4;
PutU32BE(gCmd + cmdSz, TPM_CC_PCR_Extend); cmdSz += 4;
PutU32BE(gCmd + cmdSz, 16); cmdSz += 4;
PutU32BE(gCmd + cmdSz, 9); cmdSz += 4;
PutU32BE(gCmd + cmdSz, TPM_RS_PW); cmdSz += 4;
PutU16BE(gCmd + cmdSz, 0); cmdSz += 2;
gCmd[cmdSz++] = 0;
PutU16BE(gCmd + cmdSz, 0); cmdSz += 2;
PutU32BE(gCmd + cmdSz, 1); cmdSz += 4;
PutU16BE(gCmd + cmdSz, TPM_ALG_SHA256); cmdSz += 2;
memset(gCmd + cmdSz, 0x42, 32); cmdSz += 32;
PutU32BE(gCmd + 2, (UINT32)cmdSz);
rc = FWTPM_ProcessCommand(&ctx, gCmd, cmdSz, gRsp, &rspSize, 0);
AssertIntEQ(rc, TPM_RC_SUCCESS);
AssertIntEQ(GetRspRC(gRsp), TPM_RC_SUCCESS);
/* Response auth area tail: nonce(2)=0 + attr(1) + hmac(2)=0.
* The attributes byte is the 3rd byte from the end. */
AssertIntGT(rspSize, 4);
attr = gRsp[rspSize - 3];
AssertIntEQ(attr & TPMA_SESSION_continueSession,
TPMA_SESSION_continueSession);
FWTPM_Cleanup(&ctx);
printf("Test fwTPM:\tPassword session continueSession SET:\tPassed\n");
}
/* PCR_Event into DRTM PCR 17 must require locality 4 (Part 1 Sec.11.4.6). */
static void test_fwtpm_pcr_event_drtm_locality_enforced(void)
{
@ -9204,6 +9248,7 @@ int fwtpm_unit_tests(int argc, char *argv[])
/* PCR operations */
test_fwtpm_pcr_read();
test_fwtpm_pcr_extend_and_read();
test_fwtpm_pw_session_continue_set();
test_fwtpm_pcr_event_drtm_locality_enforced();
test_fwtpm_pcr_extend_empty_pw_rejected_after_setauth();
test_fwtpm_pcr_reset();