ExternalVendorCode/go-attestation
1
0
Fork 0
mirror of https://github.com/google/go-attestation.git synced 2024-12-22 06:17:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Attempt fix for EKCert parsing errors when falling back to NVRAM (#38)

Browse Source 
* Fix parsing errors for EKCert when falling back to NVRAM
This commit is contained in:
Tom D 2019-06-11 10:52:49 -07:00 committed by GitHub
parent 7f17046a60
commit 8ac2846c80
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
attest/pcp_windows.go
View File

@ -404,8 +404,8 @@ func (h *winPCP) EKCerts() ([]*x509.Certificate, error) {
var out []*x509.Certificate var out []*x509.Certificate
for _, der := range c { for _, der := range c {
cert, err := x509.ParseCertificate(der) cert, err := parseCert(der)
if err != nil && x509.IsFatal(err) { if err != nil {
return nil, err return nil, err
} }
out = append(out, cert) out = append(out, cert)

19
attest/tpm.go
View File

@ -15,8 +15,10 @@
package attest package attest
import ( import (
"bytes"
"crypto" "crypto"
"encoding/asn1" "encoding/asn1"
"encoding/binary"
"fmt" "fmt"
"io" "io"
"math/big" "math/big"
@ -128,6 +130,17 @@ func readTPM2VendorAttributes(tpm io.ReadWriter) (TCGVendorID, string, error) {
} }
func parseCert(ekCert []byte) (*x509.Certificate, error) { func parseCert(ekCert []byte) (*x509.Certificate, error) {
// TCG PC Specific Implementation section 7.3.2 specifies
// a prefix when storing a certificate in NVRAM. We look
// for and unwrap the certificate if its present.
if len(ekCert) > 5 && bytes.Equal(ekCert[:3], []byte{0x10, 0x01, 0x00}) {
certLen := binary.BigEndian.Uint16(ekCert[3:5])
if len(ekCert) < int(certLen+5) {
return nil, fmt.Errorf("parsing nvram header: ekCert size %d smaller than specified cert length %d", len(ekCert), certLen)
}
ekCert = ekCert[5 : 5+certLen]
}
// If the cert parses fine without any changes, we are G2G. // If the cert parses fine without any changes, we are G2G.
if c, err := x509.ParseCertificate(ekCert); err == nil { if c, err := x509.ParseCertificate(ekCert); err == nil {
return c, nil return c, nil
@ -142,7 +155,11 @@ func parseCert(ekCert []byte) (*x509.Certificate, error) {
if _, err := asn1.Unmarshal(ekCert, &cert); err != nil { if _, err := asn1.Unmarshal(ekCert, &cert); err != nil {
return nil, err return nil, err
} }
return x509.ParseCertificate(cert.Raw) c, err := x509.ParseCertificate(cert.Raw)
if err != nil && x509.IsFatal(err) {
return nil, err
}
return c, nil
} }
func readEKCertFromNVRAM20(tpm io.ReadWriter) (*x509.Certificate, error) { func readEKCertFromNVRAM20(tpm io.ReadWriter) (*x509.Certificate, error) {