Skip to content

provider: enable store loader in fips mode #180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
moritzbuhl wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

provider: enable store loader in fips mode #180

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 29 additions & 1 deletion src/tpm2-provider.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,10 @@ tpm2_get_params(void *provctx, OSSL_PARAM params[])
}

#define TPM2_PROPS(op) ("provider=tpm2,tpm2." #op)
#define TPM2_FIPS_PROPS(op) ("provider=tpm2,tpm2." #op ",fips=yes")
#ifndef TPMA_MODES_FIPS_140_3
#define TPMA_MODES_FIPS_140_3 ((TPMA_MODES) 0x00000002)
#endif

typedef struct {
const char *algs;
Expand Down Expand Up @@ -247,6 +251,29 @@ static const OSSL_ALGORITHM tpm2_stores[] = {
{ NULL, NULL, NULL }
};

static const OSSL_ALGORITHM tpm2_fips_stores[] = {
{ "handle", TPM2_FIPS_PROPS(store), tpm2_handle_store_functions },
{ "object", TPM2_FIPS_PROPS(store), tpm2_handle_store_functions },
{ NULL, NULL, NULL }
};

static int
tpm2_is_fips_mode(const TPMS_CAPABILITY_DATA *caps)
{
UINT32 i;

for (i = 0; i < caps->data.tpmProperties.count; i++) {
const TPMS_TAGGED_PROPERTY *property =
&caps->data.tpmProperties.tpmProperty[i];

if (property->property == TPM2_PT_MODES)
return property->value & (TPMA_MODES_FIPS_140_2 |
TPMA_MODES_FIPS_140_3);
}

return 0;
}

#define NELEMS(x) (sizeof(x) / sizeof((x)[0]))

static const OSSL_ALGORITHM *
Expand Down Expand Up @@ -282,6 +309,8 @@ tpm2_query_operation(void *provctx, int operation_id, int *no_cache)
case OSSL_OP_DECODER:
return tpm2_decoders;
case OSSL_OP_STORE:
if (tpm2_is_fips_mode(cprov->capability.properties))
return tpm2_fips_stores;
return tpm2_stores;
}
return NULL;
Expand Down Expand Up @@ -541,4 +570,3 @@ OSSL_provider_init(const OSSL_CORE_HANDLE *handle,
OPENSSL_clear_free(cprov, sizeof(TPM2_PROVIDER_CTX));
return 0;
}

Loading