Improved return values of pcr_read.

- Changed pcr_read to return a DigestList instead of PcrData.

- Moved PcrData to abstractions and made it possible to construct
  PcrData from rust native types.

- Added subtract to PcrSelectionList.

- Added a pcr_read_all functiion to the pcr module
  in abstractions. This function tries to read all the
  values in a PcrSelectionList.

- Removed lower limit for DigestList.

- Improved linage between the read pcr list and the read pcr digests
  in tests.

Signed-off-by: Jesper Brynolf <[email protected]>

Author: Superhepper

tss-esapi/src/abstraction/mod.rs

@@ -5,6 +5,7 @@ pub mod ak;
 pub mod cipher;
 pub mod ek;
 pub mod nv;
+pub mod pcr;
 pub mod transient;
 
 use crate::{attributes::ObjectAttributesBuilder, structures::PublicBuilder};

tss-esapi/src/abstraction/pcr.rs

@@ -0,0 +1,71 @@
+// Copyright 2021 Contributors to the Parsec project.
+// SPDX-License-Identifier: Apache-2.0
+mod bank;
+mod data;
+
+use crate::{structures::PcrSelectionList, Context, Result};
+
+pub use bank::PcrBank;
+pub use data::PcrData;
+
+/// Function that reads all the PCRs in a selection list and returns
+/// the result as PCR data.
+///
+/// # Example
+///
+/// ```rust
+/// # use tss_esapi::{Context, TctiNameConf};
+/// # // Create context
+/// # let mut context =
+/// #     Context::new(
+/// #         TctiNameConf::from_environment_variable().expect("Failed to get TCTI"),
+/// #     ).expect("Failed to create Context");
+/// #
+/// use tss_esapi::{
+///     interface_types::algorithm::HashingAlgorithm,
+///     structures::{PcrSelectionListBuilder, PcrSlot},
+/// };
+/// // Create PCR selection list with slots in a bank
+/// // that is going to be read.
+/// let pcr_selection_list = PcrSelectionListBuilder::new()
+///     .with_selection(HashingAlgorithm::Sha256,
+///         &[
+///             PcrSlot::Slot0,
+///             PcrSlot::Slot1,
+///             PcrSlot::Slot2,
+///             PcrSlot::Slot3,
+///             PcrSlot::Slot4,
+///             PcrSlot::Slot5,
+///             PcrSlot::Slot6,
+///             PcrSlot::Slot7,
+///             PcrSlot::Slot8,
+///             PcrSlot::Slot9,
+///             PcrSlot::Slot10,
+///             PcrSlot::Slot11,
+///             PcrSlot::Slot12,
+///             PcrSlot::Slot13,
+///             PcrSlot::Slot14,
+///             PcrSlot::Slot15,
+///             PcrSlot::Slot16,
+///             PcrSlot::Slot17,
+///             PcrSlot::Slot18,
+///             PcrSlot::Slot19,
+///             PcrSlot::Slot20,
+///             PcrSlot::Slot21,
+///     ])
+///     .build();
+/// let _pcr_data = tss_esapi::abstraction::pcr::read_all(&mut context, pcr_selection_list)
+///     .expect("pcr::read_all failed");
+/// ```
+pub fn read_all(
+    context: &mut Context,
+    mut pcr_selection_list: PcrSelectionList,
+) -> Result<PcrData> {
+    let mut pcr_data = PcrData::new();
+    while !pcr_selection_list.is_empty() {
+        let (_, pcrs_read, pcr_digests) = context.pcr_read(&pcr_selection_list)?;
+        pcr_data.add(&pcrs_read, &pcr_digests)?;
+        pcr_selection_list.subtract(&pcrs_read)?;
+    }
+    Ok(pcr_data)
+}

tss-esapi/src/abstraction/pcr/bank.rs

@@ -0,0 +1,134 @@
+// Copyright 2021 Contributors to the Parsec project.
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{
+    structures::{Digest, PcrSlot},
+    Error, Result, WrapperErrorKind,
+};
+use log::error;
+use std::collections::BTreeMap;
+
+/// Struct for holding PcrSlots and their
+/// corresponding values.
+#[derive(Debug, Clone, Eq, PartialEq)]
+pub struct PcrBank {
+    bank: BTreeMap<PcrSlot, Digest>,
+}
+
+impl PcrBank {
+    /// Function that creates PcrBank from a vector of pcr slots and
+    /// a vector of pcr digests.
+    ///
+    /// # Details
+    /// The order of pcr slots are assumed to match the order of the Digests.
+    ///
+    /// # Error
+    /// - If number of pcr slots does not match the number of pcr digests
+    ///   InconsistentParams error is returned.
+    ///
+    /// - If the vector of pcr slots contains duplicates then
+    ///   InconsistentParams error is returned.
+    pub fn create(mut pcr_slots: Vec<PcrSlot>, mut digests: Vec<Digest>) -> Result<PcrBank> {
+        if pcr_slots.len() != digests.len() {
+            error!(
+                "Number of PcrSlots does not match the number of PCR digests. ({} != {})",
+                pcr_slots.len(),
+                digests.len()
+            );
+            return Err(Error::local_error(WrapperErrorKind::InconsistentParams));
+        }
+        pcr_slots
+            .drain(..)
+            .zip(digests.drain(..))
+            .try_fold(BTreeMap::<PcrSlot, Digest>::new(), |mut data, (pcr_slot, digest)| {
+                if data.insert(pcr_slot, digest).is_none() {
+                    Ok(data)
+                } else {
+                    error!("Error trying to insert data into PcrSlot {:?} where data have already been inserted", pcr_slot);
+                    Err(Error::local_error(WrapperErrorKind::InconsistentParams))
+                }
+            })
+            .map(|bank|  PcrBank { bank })
+    }
+
+    /// Retrieves reference to a [Digest] associated with the provided [PcrSlot].
+    ///
+    /// # Details
+    /// Returns a reference to a [Digest] associated with the provided [PcrSlot]
+    /// if one exists else returns None.
+    pub fn get_digest(&self, pcr_slot: PcrSlot) -> Option<&Digest> {
+        self.bank.get(&pcr_slot)
+    }
+
+    /// Returns true if the [PcrBank] contains a digest
+    /// for the provided [PcrSlot].
+    pub fn has_digest(&self, pcr_slot: PcrSlot) -> bool {
+        self.bank.contains_key(&pcr_slot)
+    }
+
+    /// Number of digests in the [PcrBank]]
+    pub fn len(&self) -> usize {
+        self.bank.len()
+    }
+
+    /// Returns true if the [PcrBank] is empty
+    pub fn is_empty(&self) -> bool {
+        self.bank.is_empty()
+    }
+
+    /// Removees the [Digest] associated with the [PcrSlot] and
+    /// returns it.
+    ///
+    /// # Details
+    /// Removes the [Digest] associated with the provided [PcrSlot]
+    /// out of the bank and returns it if it exists else returns None.
+    pub fn remove_digest(&mut self, pcr_slot: PcrSlot) -> Option<Digest> {
+        self.bank.remove(&pcr_slot)
+    }
+
+    /// Inserts [Digest] value associated with a [PcrSlot] into the bank.
+    ///
+    /// # Error
+    /// Returns an error if a [Digest] is already associated with the
+    /// provided [PcrSlot].
+    pub fn insert_digest(&mut self, pcr_slot: PcrSlot, digest: Digest) -> Result<()> {
+        self.ensure_non_existing(pcr_slot, "Failed to insert")?;
+        let _ = self.bank.insert(pcr_slot, digest);
+        Ok(())
+    }
+
+    /// Attempts to extend the [PcrBank] with `other`.
+    ///
+    /// # Error
+    /// Returns an error if the a value in `other`already
+    /// exists.
+    pub fn try_extend(&mut self, other: PcrBank) -> Result<()> {
+        other
+            .bank
+            .keys()
+            .try_for_each(|&pcr_slot| self.ensure_non_existing(pcr_slot, "Failed to extend"))?;
+        self.bank.extend(other.bank);
+        Ok(())
+    }
+
+    /// Returns an error if a [Digest] for [PcrSlot] already exists in the bank
+    fn ensure_non_existing(&self, pcr_slot: PcrSlot, error_msg: &str) -> Result<()> {
+        if self.has_digest(pcr_slot) {
+            error!(
+                "{}, a digest already for PcrSlot {:?} exists in the bank",
+                error_msg, pcr_slot
+            );
+            return Err(Error::local_error(WrapperErrorKind::InvalidParam));
+        }
+        Ok(())
+    }
+}
+
+impl<'a> IntoIterator for &'a PcrBank {
+    type Item = (&'a PcrSlot, &'a Digest);
+    type IntoIter = ::std::collections::btree_map::Iter<'a, PcrSlot, Digest>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.bank.iter()
+    }
+}

tss-esapi/src/abstraction/pcr/data.rs

@@ -0,0 +1,134 @@
+// Copyright 2021 Contributors to the Parsec project.
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{
+    abstraction::pcr::PcrBank,
+    interface_types::algorithm::HashingAlgorithm,
+    structures::{Digest, DigestList, PcrSelectionList},
+    tss2_esys::TPML_DIGEST,
+    Error, Result, WrapperErrorKind,
+};
+use log::error;
+/// Struct holding pcr banks and their associated
+/// hashing algorithm
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PcrData {
+    data: Vec<(HashingAlgorithm, PcrBank)>,
+}
+
+impl PcrData {
+    /// Creates new empty PcrData
+    pub const fn new() -> Self {
+        PcrData { data: Vec::new() }
+    }
+
+    /// Function for creating PcrData from a pcr selection list and pcr digests list.
+    pub fn create(
+        pcr_selection_list: &PcrSelectionList,
+        digest_list: &DigestList,
+    ) -> Result<PcrData> {
+        Ok(PcrData {
+            data: Self::create_data(pcr_selection_list, digest_list.value().to_vec())?,
+        })
+    }
+
+    /// Adds data to the PcrData
+    pub fn add(
+        &mut self,
+        pcr_selection_list: &PcrSelectionList,
+        digest_list: &DigestList,
+    ) -> Result<()> {
+        Self::create_data(pcr_selection_list, digest_list.value().to_vec())?
+            .drain(..)
+            .try_for_each(|(hashing_algorithm, pcr_bank)| {
+                if let Some(existing_pcr_bank) = self.pcr_bank_mut(hashing_algorithm) {
+                    existing_pcr_bank.try_extend(pcr_bank)?;
+                } else {
+                    self.data.push((hashing_algorithm, pcr_bank));
+                }
+                Ok(())
+            })
+    }
+
+    /// Function for turning a pcr selection list and pcr digests values
+    /// into the format in which data is stored in PcrData.
+    fn create_data(
+        pcr_selection_list: &PcrSelectionList,
+        mut digests: Vec<Digest>,
+    ) -> Result<Vec<(HashingAlgorithm, PcrBank)>> {
+        pcr_selection_list
+            .get_selections()
+            .iter()
+            .map(|pcr_selection| {
+                let pcr_slots = pcr_selection.selected();
+                if pcr_slots.len() > digests.len() {
+                    error!("More pcr slots in selection then available digests");
+                    return Err(Error::local_error(WrapperErrorKind::InconsistentParams));
+                }
+                let digests_in_bank = digests.drain(..pcr_slots.len()).collect();
+                Ok((
+                    pcr_selection.hashing_algorithm(),
+                    PcrBank::create(pcr_slots, digests_in_bank)?,
+                ))
+            })
+            .collect()
+    }
+
+    /// Function for retrieving the first PCR values associated with hashing_algorithm.
+    pub fn pcr_bank(&self, hashing_algorithm: HashingAlgorithm) -> Option<&PcrBank> {
+        self.data
+            .iter()
+            .find(|(alg, _)| *alg == hashing_algorithm)
+            .map(|(_, bank)| bank)
+    }
+
+    /// Function for retrieving the number of banks in the data.
+    pub fn len(&self) -> usize {
+        self.data.len()
+    }
+
+    /// Returns true if there are no banks in the data.
+    pub fn is_empty(&self) -> bool {
+        self.data.is_empty()
+    }
+
+    /// Private method for finding a PCR bank.
+    fn pcr_bank_mut(&mut self, hashing_algorithm: HashingAlgorithm) -> Option<&mut PcrBank> {
+        self.data
+            .iter_mut()
+            .find(|(alg, _)| *alg == hashing_algorithm)
+            .map(|(_, bank)| bank)
+    }
+}
+
+impl<'a> IntoIterator for PcrData {
+    type Item = (HashingAlgorithm, PcrBank);
+    type IntoIter = ::std::vec::IntoIter<(HashingAlgorithm, PcrBank)>;
+
+    fn into_iter(self) -> Self::IntoIter {
+        self.data.into_iter()
+    }
+}
+
+impl From<PcrData> for Vec<TPML_DIGEST> {
+    fn from(pcr_data: PcrData) -> Self {
+        pcr_data
+            .data
+            .iter()
+            .flat_map(|(_, pcr_bank)| pcr_bank.into_iter())
+            .map(|(_, digest)| digest)
+            .collect::<Vec<&Digest>>()
+            .chunks(DigestList::MAX_SIZE)
+            .map(|digests| {
+                let mut tpml_digest: TPML_DIGEST = Default::default();
+                for (index, digest) in digests.iter().enumerate() {
+                    tpml_digest.count += 1;
+                    tpml_digest.digests[index].size = digest.len() as u16;
+                    tpml_digest.digests[index].buffer[..digest.len()]
+                        .copy_from_slice(digest.value());
+                }
+                tpml_digest
+            })
+            .collect()
+    }
+}

tss-esapi/src/context/tpm_commands/enhanced_authorization_ea_commands.rs

@@ -131,7 +131,7 @@ impl Context {
     /// by the value of the different hashes.
     ///
     /// # Constraints
-    /// * `hash_list` must be at least 2 and at most 8 elements long
+    /// * `digest_list` must be at least 2 and at most 8 elements long
     ///
     /// # Errors
     /// * if the hash list provided is too short or too long, a `WrongParamSize` wrapper error will be returned
@@ -140,7 +140,13 @@ impl Context {
         policy_session: PolicySession,
         digest_list: DigestList,
     ) -> Result<()> {
-        let digest_list = TPML_DIGEST::try_from(digest_list)?;
+        if 2 > digest_list.len() {
+            error!(
+                "The digest list only contains {} digests, it must contain at least 2",
+                digest_list.len()
+            );
+            return Err(Error::local_error(ErrorKind::WrongParamSize));
+        }
 
         let ret = unsafe {
             Esys_PolicyOR(
@@ -149,7 +155,7 @@ impl Context {
                 self.optional_session_1(),
                 self.optional_session_2(),
                 self.optional_session_3(),
-                &digest_list,
+                &TPML_DIGEST::try_from(digest_list)?,
             )
         };
         let ret = Error::from_tss_rc(ret);