[mirror_edk2.git] / SecurityPkg / Library / Tpm2CommandLib / Tpm2DictionaryAttack.c

/** @file\r
  Implement TPM2 DictionaryAttack related command.\r
\r
Copyright (c) 2013, Intel Corporation. All rights reserved. <BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution.  The full text of the license may be found at\r
http://opensource.org/licenses/bsd-license.php\r
\r
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
\r
**/\r
\r
#include <IndustryStandard/UefiTcgPlatform.h>\r
#include <Library/Tpm2CommandLib.h>\r
#include <Library/Tpm2DeviceLib.h>\r
#include <Library/BaseMemoryLib.h>\r
#include <Library/BaseLib.h>\r
#include <Library/DebugLib.h>\r
\r
#pragma pack(1)\r
\r
typedef struct {\r
  TPM2_COMMAND_HEADER       Header;\r
  TPMI_RH_LOCKOUT           LockHandle;\r
  UINT32                    AuthSessionSize;\r
  TPMS_AUTH_COMMAND         AuthSession;\r
} TPM2_DICTIONARY_ATTACK_LOCK_RESET_COMMAND;\r
\r
typedef struct {\r
  TPM2_RESPONSE_HEADER       Header;\r
  UINT32                     AuthSessionSize;\r
  TPMS_AUTH_RESPONSE         AuthSession;\r
} TPM2_DICTIONARY_ATTACK_LOCK_RESET_RESPONSE;\r
\r
typedef struct {\r
  TPM2_COMMAND_HEADER       Header;\r
  TPMI_RH_LOCKOUT           LockHandle;\r
  UINT32                    AuthSessionSize;\r
  TPMS_AUTH_COMMAND         AuthSession;\r
  UINT32                    NewMaxTries;\r
  UINT32                    NewRecoveryTime;\r
  UINT32                    LockoutRecovery;\r
} TPM2_DICTIONARY_ATTACK_PARAMETERS_COMMAND;\r
\r
typedef struct {\r
  TPM2_RESPONSE_HEADER       Header;\r
  UINT32                     AuthSessionSize;\r
  TPMS_AUTH_RESPONSE         AuthSession;\r
} TPM2_DICTIONARY_ATTACK_PARAMETERS_RESPONSE;\r
\r
#pragma pack()\r
\r
/**\r
  This command cancels the effect of a TPM lockout due to a number of successive authorization failures.\r
  If this command is properly authorized, the lockout counter is set to zero.\r
\r
  @param[in]  LockHandle            TPM_RH_LOCKOUT\r
  @param[in]  AuthSession           Auth Session context\r
\r
  @retval EFI_SUCCESS      Operation completed successfully.\r
  @retval EFI_DEVICE_ERROR Unexpected device behavior.\r
**/\r
EFI_STATUS\r
EFIAPI\r
Tpm2DictionaryAttackLockReset (\r
  IN  TPMI_RH_LOCKOUT           LockHandle,\r
  IN  TPMS_AUTH_COMMAND         *AuthSession\r
  )\r
{\r
  EFI_STATUS                                 Status;\r
  TPM2_DICTIONARY_ATTACK_LOCK_RESET_COMMAND  SendBuffer;\r
  TPM2_DICTIONARY_ATTACK_LOCK_RESET_RESPONSE RecvBuffer;\r
  UINT32                                     SendBufferSize;\r
  UINT32                                     RecvBufferSize;\r
  UINT8                                      *Buffer;\r
  UINT32                                     SessionInfoSize;\r
\r
  //\r
  // Construct command\r
  //\r
  SendBuffer.Header.tag = SwapBytes16(TPM_ST_SESSIONS);\r
  SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_DictionaryAttackLockReset);\r
\r
  SendBuffer.LockHandle = SwapBytes32 (LockHandle);\r
\r
  //\r
  // Add in Auth session\r
  //\r
  Buffer = (UINT8 *)&SendBuffer.AuthSession;\r
\r
  // sessionInfoSize\r
  SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);\r
  Buffer += SessionInfoSize;\r
  SendBuffer.AuthSessionSize = SwapBytes32(SessionInfoSize);\r
\r
  SendBufferSize = (UINT32)((UINTN)Buffer - (UINTN)&SendBuffer);\r
  SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);\r
\r
  //\r
  // send Tpm command\r
  //\r
  RecvBufferSize = sizeof (RecvBuffer);\r
  Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);\r
  if (EFI_ERROR (Status)) {\r
    return Status;\r
  }\r
\r
  if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {\r
    DEBUG ((EFI_D_ERROR, "Tpm2DictionaryAttackLockReset - RecvBufferSize Error - %x\n", RecvBufferSize));\r
    return EFI_DEVICE_ERROR;\r
  }\r
  if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {\r
    DEBUG ((EFI_D_ERROR, "Tpm2DictionaryAttackLockReset - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));\r
    return EFI_DEVICE_ERROR;\r
  }\r
\r
  return EFI_SUCCESS;\r
}\r
\r
/**\r
  This command cancels the effect of a TPM lockout due to a number of successive authorization failures.\r
  If this command is properly authorized, the lockout counter is set to zero.\r
\r
  @param[in]  LockHandle            TPM_RH_LOCKOUT\r
  @param[in]  AuthSession           Auth Session context\r
  @param[in]  NewMaxTries           Count of authorization failures before the lockout is imposed\r
  @param[in]  NewRecoveryTime       Time in seconds before the authorization failure count is automatically decremented\r
  @param[in]  LockoutRecovery       Time in seconds after a lockoutAuth failure before use of lockoutAuth is allowed\r
\r
  @retval EFI_SUCCESS      Operation completed successfully.\r
  @retval EFI_DEVICE_ERROR Unexpected device behavior.\r
**/\r
EFI_STATUS\r
EFIAPI\r
Tpm2DictionaryAttackParameters (\r
  IN  TPMI_RH_LOCKOUT           LockHandle,\r
  IN  TPMS_AUTH_COMMAND         *AuthSession,\r
  IN  UINT32                    NewMaxTries,\r
  IN  UINT32                    NewRecoveryTime,\r
  IN  UINT32                    LockoutRecovery\r
  )\r
{\r
  EFI_STATUS                                 Status;\r
  TPM2_DICTIONARY_ATTACK_PARAMETERS_COMMAND  SendBuffer;\r
  TPM2_DICTIONARY_ATTACK_PARAMETERS_RESPONSE RecvBuffer;\r
  UINT32                                     SendBufferSize;\r
  UINT32                                     RecvBufferSize;\r
  UINT8                                      *Buffer;\r
  UINT32                                     SessionInfoSize;\r
\r
  //\r
  // Construct command\r
  //\r
  SendBuffer.Header.tag = SwapBytes16(TPM_ST_SESSIONS);\r
  SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_DictionaryAttackParameters);\r
\r
  SendBuffer.LockHandle = SwapBytes32 (LockHandle);\r
\r
  //\r
  // Add in Auth session\r
  //\r
  Buffer = (UINT8 *)&SendBuffer.AuthSession;\r
\r
  // sessionInfoSize\r
  SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);\r
  Buffer += SessionInfoSize;\r
  SendBuffer.AuthSessionSize = SwapBytes32(SessionInfoSize);\r
\r
  //\r
  // Real data\r
  //\r
  WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32(NewMaxTries));\r
  Buffer += sizeof(UINT32);\r
  WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32(NewRecoveryTime));\r
  Buffer += sizeof(UINT32);\r
  WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32(LockoutRecovery));\r
  Buffer += sizeof(UINT32);\r
\r
  SendBufferSize = (UINT32)((UINTN)Buffer - (UINTN)&SendBuffer);\r
  SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);\r
\r
  //\r
  // send Tpm command\r
  //\r
  RecvBufferSize = sizeof (RecvBuffer);\r
  Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 *)&SendBuffer, &RecvBufferSize, (UINT8 *)&RecvBuffer);\r
  if (EFI_ERROR (Status)) {\r
    return Status;\r
  }\r
\r
  if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {\r
    DEBUG ((EFI_D_ERROR, "Tpm2DictionaryAttackParameters - RecvBufferSize Error - %x\n", RecvBufferSize));\r
    return EFI_DEVICE_ERROR;\r
  }\r
  if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {\r
    DEBUG ((EFI_D_ERROR, "Tpm2DictionaryAttackParameters - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));\r
    return EFI_DEVICE_ERROR;\r
  }\r
\r
  return EFI_SUCCESS;\r
}\r
Commit	Line	Data
c1d93242 JY	1	/** @file\r
	2	Implement TPM2 DictionaryAttack related command.\r
	3	\r
	4	Copyright (c) 2013, Intel Corporation. All rights reserved. <BR>\r
	5	This program and the accompanying materials\r
	6	are licensed and made available under the terms and conditions of the BSD License\r
	7	which accompanies this distribution. The full text of the license may be found at\r
	8	http://opensource.org/licenses/bsd-license.php\r
	9	\r
	10	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
	11	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
	12	\r
	13	**/\r
	14	\r
	15	#include <IndustryStandard/UefiTcgPlatform.h>\r
	16	#include <Library/Tpm2CommandLib.h>\r
	17	#include <Library/Tpm2DeviceLib.h>\r
	18	#include <Library/BaseMemoryLib.h>\r
	19	#include <Library/BaseLib.h>\r
	20	#include <Library/DebugLib.h>\r
	21	\r
	22	#pragma pack(1)\r
	23	\r
	24	typedef struct {\r
	25	TPM2_COMMAND_HEADER Header;\r
	26	TPMI_RH_LOCKOUT LockHandle;\r
	27	UINT32 AuthSessionSize;\r
	28	TPMS_AUTH_COMMAND AuthSession;\r
	29	} TPM2_DICTIONARY_ATTACK_LOCK_RESET_COMMAND;\r
	30	\r
	31	typedef struct {\r
	32	TPM2_RESPONSE_HEADER Header;\r
	33	UINT32 AuthSessionSize;\r
	34	TPMS_AUTH_RESPONSE AuthSession;\r
	35	} TPM2_DICTIONARY_ATTACK_LOCK_RESET_RESPONSE;\r
	36	\r
	37	typedef struct {\r
	38	TPM2_COMMAND_HEADER Header;\r
	39	TPMI_RH_LOCKOUT LockHandle;\r
	40	UINT32 AuthSessionSize;\r
	41	TPMS_AUTH_COMMAND AuthSession;\r
	42	UINT32 NewMaxTries;\r
	43	UINT32 NewRecoveryTime;\r
	44	UINT32 LockoutRecovery;\r
	45	} TPM2_DICTIONARY_ATTACK_PARAMETERS_COMMAND;\r
	46	\r
	47	typedef struct {\r
	48	TPM2_RESPONSE_HEADER Header;\r
	49	UINT32 AuthSessionSize;\r
	50	TPMS_AUTH_RESPONSE AuthSession;\r
	51	} TPM2_DICTIONARY_ATTACK_PARAMETERS_RESPONSE;\r
	52	\r
	53	#pragma pack()\r
	54	\r
	55	/**\r
	56	This command cancels the effect of a TPM lockout due to a number of successive authorization failures.\r
	57	If this command is properly authorized, the lockout counter is set to zero.\r
	58	\r
	59	@param[in] LockHandle TPM_RH_LOCKOUT\r
	60	@param[in] AuthSession Auth Session context\r
	61	\r
	62	@retval EFI_SUCCESS Operation completed successfully.\r
	63	@retval EFI_DEVICE_ERROR Unexpected device behavior.\r
	64	**/\r
65	EFI_STATUS\r
66	EFIAPI\r
67	Tpm2DictionaryAttackLockReset (\r
68	IN TPMI_RH_LOCKOUT LockHandle,\r
69	IN TPMS_AUTH_COMMAND *AuthSession\r
70	)\r
71	{\r
72	EFI_STATUS Status;\r
73	TPM2_DICTIONARY_ATTACK_LOCK_RESET_COMMAND SendBuffer;\r
74	TPM2_DICTIONARY_ATTACK_LOCK_RESET_RESPONSE RecvBuffer;\r
75	UINT32 SendBufferSize;\r
76	UINT32 RecvBufferSize;\r
77	UINT8 *Buffer;\r
78	UINT32 SessionInfoSize;\r
79	\r
80	//\r
81	// Construct command\r
82	//\r
83	SendBuffer.Header.tag = SwapBytes16(TPM_ST_SESSIONS);\r
84	SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_DictionaryAttackLockReset);\r
85	\r
86	SendBuffer.LockHandle = SwapBytes32 (LockHandle);\r
87	\r
88	//\r
89	// Add in Auth session\r
90	//\r
91	Buffer = (UINT8 *)&SendBuffer.AuthSession;\r
92	\r
93	// sessionInfoSize\r
94	SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);\r
95	Buffer += SessionInfoSize;\r
96	SendBuffer.AuthSessionSize = SwapBytes32(SessionInfoSize);\r
97	\r
98	SendBufferSize = (UINT32)((UINTN)Buffer - (UINTN)&SendBuffer);\r
99	SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);\r
100	\r
101	//\r
102	// send Tpm command\r
103	//\r
104	RecvBufferSize = sizeof (RecvBuffer);\r
105	Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 )&SendBuffer, &RecvBufferSize, (UINT8 )&RecvBuffer);\r
106	if (EFI_ERROR (Status)) {\r
107	return Status;\r
108	}\r
109	\r
110	if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {\r
111	DEBUG ((EFI_D_ERROR, "Tpm2DictionaryAttackLockReset - RecvBufferSize Error - %x\n", RecvBufferSize));\r
112	return EFI_DEVICE_ERROR;\r
113	}\r
114	if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {\r
115	DEBUG ((EFI_D_ERROR, "Tpm2DictionaryAttackLockReset - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));\r
116	return EFI_DEVICE_ERROR;\r
117	}\r
118	\r
119	return EFI_SUCCESS;\r
120	}\r
121	\r
122	/**\r
123	This command cancels the effect of a TPM lockout due to a number of successive authorization failures.\r
124	If this command is properly authorized, the lockout counter is set to zero.\r
125	\r
126	@param[in] LockHandle TPM_RH_LOCKOUT\r
127	@param[in] AuthSession Auth Session context\r
128	@param[in] NewMaxTries Count of authorization failures before the lockout is imposed\r
129	@param[in] NewRecoveryTime Time in seconds before the authorization failure count is automatically decremented\r
130	@param[in] LockoutRecovery Time in seconds after a lockoutAuth failure before use of lockoutAuth is allowed\r
131	\r
132	@retval EFI_SUCCESS Operation completed successfully.\r
133	@retval EFI_DEVICE_ERROR Unexpected device behavior.\r
134	**/\r
135	EFI_STATUS\r
136	EFIAPI\r
137	Tpm2DictionaryAttackParameters (\r
138	IN TPMI_RH_LOCKOUT LockHandle,\r
139	IN TPMS_AUTH_COMMAND *AuthSession,\r
140	IN UINT32 NewMaxTries,\r
141	IN UINT32 NewRecoveryTime,\r
142	IN UINT32 LockoutRecovery\r
143	)\r
144	{\r
145	EFI_STATUS Status;\r
146	TPM2_DICTIONARY_ATTACK_PARAMETERS_COMMAND SendBuffer;\r
147	TPM2_DICTIONARY_ATTACK_PARAMETERS_RESPONSE RecvBuffer;\r
148	UINT32 SendBufferSize;\r
149	UINT32 RecvBufferSize;\r
150	UINT8 *Buffer;\r
151	UINT32 SessionInfoSize;\r
152	\r
153	//\r
154	// Construct command\r
155	//\r
156	SendBuffer.Header.tag = SwapBytes16(TPM_ST_SESSIONS);\r
157	SendBuffer.Header.commandCode = SwapBytes32(TPM_CC_DictionaryAttackParameters);\r
158	\r
159	SendBuffer.LockHandle = SwapBytes32 (LockHandle);\r
160	\r
161	//\r
162	// Add in Auth session\r
163	//\r
164	Buffer = (UINT8 *)&SendBuffer.AuthSession;\r
165	\r
166	// sessionInfoSize\r
167	SessionInfoSize = CopyAuthSessionCommand (AuthSession, Buffer);\r
168	Buffer += SessionInfoSize;\r
169	SendBuffer.AuthSessionSize = SwapBytes32(SessionInfoSize);\r
170	\r
171	//\r
172	// Real data\r
173	//\r
174	WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32(NewMaxTries));\r
175	Buffer += sizeof(UINT32);\r
176	WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32(NewRecoveryTime));\r
177	Buffer += sizeof(UINT32);\r
178	WriteUnaligned32 ((UINT32 *)Buffer, SwapBytes32(LockoutRecovery));\r
179	Buffer += sizeof(UINT32);\r
180	\r
181	SendBufferSize = (UINT32)((UINTN)Buffer - (UINTN)&SendBuffer);\r
182	SendBuffer.Header.paramSize = SwapBytes32 (SendBufferSize);\r
183	\r
184	//\r
185	// send Tpm command\r
186	//\r
187	RecvBufferSize = sizeof (RecvBuffer);\r
188	Status = Tpm2SubmitCommand (SendBufferSize, (UINT8 )&SendBuffer, &RecvBufferSize, (UINT8 )&RecvBuffer);\r
189	if (EFI_ERROR (Status)) {\r
190	return Status;\r
191	}\r
192	\r
193	if (RecvBufferSize < sizeof (TPM2_RESPONSE_HEADER)) {\r
194	DEBUG ((EFI_D_ERROR, "Tpm2DictionaryAttackParameters - RecvBufferSize Error - %x\n", RecvBufferSize));\r
195	return EFI_DEVICE_ERROR;\r
196	}\r
197	if (SwapBytes32(RecvBuffer.Header.responseCode) != TPM_RC_SUCCESS) {\r
198	DEBUG ((EFI_D_ERROR, "Tpm2DictionaryAttackParameters - responseCode - %x\n", SwapBytes32(RecvBuffer.Header.responseCode)));\r
199	return EFI_DEVICE_ERROR;\r
200	}\r
201	\r
202	return EFI_SUCCESS;\r
203	}\r