diff --git a/service/biz/tpm20_utils.go b/service/biz/tpm20_utils.go index 5ee1869..5eb6ee6 100644 --- a/service/biz/tpm20_utils.go +++ b/service/biz/tpm20_utils.go @@ -827,8 +827,18 @@ func (u *DefaultTPM20Utils) ParseTCGCSRIDevIDContent(csrBytes []byte) (*TCGCSRID } ekCert, err := certificateDerToPem(ekCertBytes) if err != nil { - return nil, fmt.Errorf("failed to convert EK Cert to PEM: %w", err) + pub, tpmErr := tpm20.Unmarshal[tpm20.TPMTPublic](ekCertBytes) + if tpmErr != nil { + return nil, fmt.Errorf("failed to parse ekCert as X509 certificate (%v) or TPMTPublic (%v)", err, tpmErr) + } + + log.Infof("Successfully parsed ekCertBytes as TPMTPublic structure. Converting to PEM.") + ekCert, err = u.TPMTPublicToPEM(pub) + if err != nil { + return nil, fmt.Errorf("failed to convert TPMTPublic to PEM: %w", err) + } } + result.EKCert = ekCert // attestPub - Attestation Key public key (IAK) diff --git a/service/biz/tpm20_utils_test.go b/service/biz/tpm20_utils_test.go index c5822a5..6ae601c 100644 --- a/service/biz/tpm20_utils_test.go +++ b/service/biz/tpm20_utils_test.go @@ -636,6 +636,23 @@ func generateCsrBytes(options CsrOptions) []byte { } func TestParseTCGCSRIDevIDContent(t *testing.T) { + u := DefaultTPM20Utils{} + privKey, err := rsa.GenerateKey(rand.Reader, 2048) + if err != nil { + t.Fatalf("Failed to generate RSA key for testing: %v", err) + } + tpmtPub, err := u.RSAEKPublicKeyToTPMTPublic(&privKey.PublicKey) + if err != nil { + t.Fatalf("Failed to create TPMT Public for testing: %v", err) + } + tpmtPubPEM, err := u.TPMTPublicToPEM(tpmtPub) + if err != nil { + t.Fatalf("Failed to convert TPMT Public to PEM for testing: %v", err) + } + tpmtPubBytes := tpm20.Marshal(tpmtPub) + + validCSRWithTPMTPub := *validCSR + validCSRWithTPMTPub.EKCert = tpmtPubPEM // Define test cases tests := []struct { name string @@ -736,7 +753,7 @@ func TestParseTCGCSRIDevIDContent(t *testing.T) { { name: "Invalid EK Cert", csrBytes: generateCsrBytes(CsrOptions{EKCert: []byte("invalid-ek-cert")}), - expectedError: errors.New("failed to convert EK Cert to PEM"), + expectedError: errors.New("failed to parse ekCert as X509 certificate"), }, { name: "Invalid Attest Pub Bytes", @@ -763,6 +780,12 @@ func TestParseTCGCSRIDevIDContent(t *testing.T) { csrBytes: generateCsrBytes(CsrOptions{AddExtraBytesToEnd: true}), expectedError: errors.New("leftover bytes in TCG_CSR_IDEVID_CONTENT block after parsing"), }, + { + name: "Valid CSR bytes: PPK in EkCert field as TPMTPublic", + csrBytes: generateCsrBytes(CsrOptions{EKCert: tpmtPubBytes}), + expectedError: nil, + expectedResult: &validCSRWithTPMTPub, + }, } for _, tc := range tests {