Merge pull request #378 from Superhepper/ffi-data-zeroizing-v2

Improvement of FFI data zeroizing(version 2).

Author: Superhepper

tss-esapi/Cargo.toml

@@ -21,7 +21,7 @@ num-derive = "0.3.2"
 num-traits = "0.2.12"
 hostname-validator = "1.1.0"
 regex = "1.3.9"
-zeroize = { version = "1.1.0", features = ["zeroize_derive"] }
+zeroize = { version = "1.5.7", features = ["zeroize_derive"] }
 tss-esapi-sys = { path = "../tss-esapi-sys", version = "0.3.0" }
 oid = "0.2.1"
 picky-asn1 = "0.3.0"

tss-esapi/src/context/tpm_commands/object_commands.rs

@@ -1,20 +1,24 @@
 // Copyright 2021 Contributors to the Parsec project.
 // SPDX-License-Identifier: Apache-2.0
+mod create_command_input;
+mod create_command_output;
+
 use crate::{
     context::handle_manager::HandleDropAction,
     handles::{KeyHandle, ObjectHandle, TpmHandle},
     interface_types::resource_handles::Hierarchy,
     structures::{
-        Auth, CreateKeyResult, CreationData, CreationTicket, Data, Digest, EncryptedSecret,
-        IdObject, Name, PcrSelectionList, Private, Public, Sensitive, SensitiveCreate,
-        SensitiveData,
+        Auth, CreateKeyResult, Data, Digest, EncryptedSecret, IdObject, Name, PcrSelectionList,
+        Private, Public, Sensitive, SensitiveData,
     },
     tss2_esys::{
         Esys_ActivateCredential, Esys_Create, Esys_Load, Esys_LoadExternal, Esys_MakeCredential,
         Esys_ObjectChangeAuth, Esys_ReadPublic, Esys_Unseal,
     },
     Context, Result, ReturnCode,
 };
+use create_command_input::CreateCommandInputHandler;
+use create_command_output::CreateCommandOutputHandler;
 use log::error;
 use std::convert::{TryFrom, TryInto};
 use std::ptr::{null, null_mut};
@@ -49,53 +53,42 @@ impl Context {
         outside_info: Option<Data>,
         creation_pcrs: Option<PcrSelectionList>,
     ) -> Result<CreateKeyResult> {
-        let sensitive_create = SensitiveCreate::new(
-            auth_value.unwrap_or_default(),
-            sensitive_data.unwrap_or_default(),
-        );
-        let creation_pcrs = PcrSelectionList::list_from_option(creation_pcrs);
+        let input_parameters = CreateCommandInputHandler::create(
+            parent_handle,
+            public,
+            auth_value,
+            sensitive_data,
+            outside_info,
+            creation_pcrs,
+        )?;
 
-        let mut out_public_ptr = null_mut();
-        let mut out_private_ptr = null_mut();
-        let mut creation_data_ptr = null_mut();
-        let mut creation_hash_ptr = null_mut();
-        let mut creation_ticket_ptr = null_mut();
+        let mut output_parameters = CreateCommandOutputHandler::new();
 
         ReturnCode::ensure_success(
             unsafe {
                 Esys_Create(
                     self.mut_context(),
-                    parent_handle.into(),
+                    input_parameters.ffi_in_parent_handle(),
                     self.optional_session_1(),
                     self.optional_session_2(),
                     self.optional_session_3(),
-                    &sensitive_create.try_into()?,
-                    &public.try_into()?,
-                    &outside_info.unwrap_or_default().into(),
-                    &creation_pcrs.into(),
-                    &mut out_private_ptr,
-                    &mut out_public_ptr,
-                    &mut creation_data_ptr,
-                    &mut creation_hash_ptr,
-                    &mut creation_ticket_ptr,
+                    input_parameters.ffi_in_sensitive(),
+                    input_parameters.ffi_in_public(),
+                    input_parameters.ffi_outside_info(),
+                    input_parameters.ffi_creation_pcr(),
+                    output_parameters.ffi_out_private_ptr(),
+                    output_parameters.ffi_out_public_ptr(),
+                    output_parameters.ffi_creation_data_ptr(),
+                    output_parameters.ffi_creation_hash_ptr(),
+                    output_parameters.ffi_creation_ticket_ptr(),
                 )
             },
             |ret| {
                 error!("Error in creating derived key: {:#010X}", ret);
             },
         )?;
-        let out_private_owned = Context::ffi_data_to_owned(out_private_ptr);
-        let out_public_owned = Context::ffi_data_to_owned(out_public_ptr);
-        let creation_data_owned = Context::ffi_data_to_owned(creation_data_ptr);
-        let creation_hash_owned = Context::ffi_data_to_owned(creation_hash_ptr);
-        let creation_ticket_owned = Context::ffi_data_to_owned(creation_ticket_ptr);
-        Ok(CreateKeyResult {
-            out_private: Private::try_from(out_private_owned)?,
-            out_public: Public::try_from(out_public_owned)?,
-            creation_data: CreationData::try_from(creation_data_owned)?,
-            creation_hash: Digest::try_from(creation_hash_owned)?,
-            creation_ticket: CreationTicket::try_from(creation_ticket_owned)?,
-        })
+
+        output_parameters.try_into()
     }
 
     /// Load a previously generated key back into the TPM and return its new handle.

tss-esapi/src/context/tpm_commands/object_commands/create_command_input.rs

@@ -0,0 +1,102 @@
+// Copyright 2022 Contributors to the Parsec project.
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{
+    ffi::data_zeroize::FfiDataZeroize,
+    handles::KeyHandle,
+    structures::{Auth, Data, PcrSelectionList, Public, SensitiveCreate, SensitiveData},
+    tss2_esys::{ESYS_TR, TPM2B_DATA, TPM2B_PUBLIC, TPM2B_SENSITIVE_CREATE, TPML_PCR_SELECTION},
+    Result,
+};
+use std::convert::TryInto;
+use zeroize::Zeroize;
+
+/// Struct that handles the input of the
+/// to the Esys_Create command and zeroizes
+/// the data when it gets dropped.
+pub struct CreateCommandInputHandler {
+    ffi_in_parent_handle: ESYS_TR,
+    ffi_in_sensitive: TPM2B_SENSITIVE_CREATE,
+    ffi_in_public: TPM2B_PUBLIC,
+    ffi_outside_info: TPM2B_DATA,
+    ffi_creation_pcr: TPML_PCR_SELECTION,
+}
+
+impl CreateCommandInputHandler {
+    /// Creates the CreateCommandInputHandler from the inputs
+    /// of the 'create' [crate::Context] method.
+    ///
+    /// # Details
+    /// Consumes the input parameters and converts them into their
+    /// TSS counterpart and zeroizes all the data when dropped.
+    ///
+    /// # Arguments
+    /// See the input arguments of 'crate' [crate::Context] method.
+    ///
+    /// # Returns
+    /// The created CreateCommandInputHandler.
+    ///
+    /// # Errors
+    /// WrapperErrors if the conversions to the TSS types fails.
+    pub(crate) fn create(
+        parent_handle: KeyHandle,
+        public: Public,
+        auth_value: Option<Auth>,
+        sensitive_data: Option<SensitiveData>,
+        outside_info: Option<Data>,
+        creation_pcrs: Option<PcrSelectionList>,
+    ) -> Result<Self> {
+        Ok(Self {
+            ffi_in_parent_handle: parent_handle.into(),
+            ffi_in_sensitive: SensitiveCreate::new(
+                auth_value.unwrap_or_default(),
+                sensitive_data.unwrap_or_default(),
+            )
+            .try_into()?,
+            ffi_in_public: public.try_into()?,
+            ffi_outside_info: outside_info.unwrap_or_default().into(),
+            ffi_creation_pcr: PcrSelectionList::list_from_option(creation_pcrs).into(),
+        })
+    }
+
+    /// The 'parentHandle' input parameter
+    pub const fn ffi_in_parent_handle(&self) -> ESYS_TR {
+        self.ffi_in_parent_handle
+    }
+
+    /// The 'inSensitive' input parameter.
+    pub const fn ffi_in_sensitive(&self) -> &TPM2B_SENSITIVE_CREATE {
+        &self.ffi_in_sensitive
+    }
+
+    /// The 'inPublic' input parameter.
+    pub const fn ffi_in_public(&self) -> &TPM2B_PUBLIC {
+        &self.ffi_in_public
+    }
+
+    /// The 'outsideInfo' input parameter.
+    pub const fn ffi_outside_info(&self) -> &TPM2B_DATA {
+        &self.ffi_outside_info
+    }
+
+    /// The 'creationPCR' input parameter.
+    pub const fn ffi_creation_pcr(&self) -> &TPML_PCR_SELECTION {
+        &self.ffi_creation_pcr
+    }
+}
+
+impl Zeroize for CreateCommandInputHandler {
+    fn zeroize(&mut self) {
+        self.ffi_in_parent_handle.zeroize();
+        self.ffi_in_sensitive.ffi_data_zeroize();
+        self.ffi_in_public.ffi_data_zeroize();
+        self.ffi_outside_info.ffi_data_zeroize();
+        self.ffi_creation_pcr.ffi_data_zeroize();
+    }
+}
+
+impl Drop for CreateCommandInputHandler {
+    fn drop(&mut self) {
+        self.zeroize();
+    }
+}

tss-esapi/src/context/tpm_commands/object_commands/create_command_output.rs

@@ -0,0 +1,83 @@
+// Copyright 2022 Contributors to the Parsec project.
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{
+    structures::{CreateKeyResult, CreationData, CreationTicket, Digest, Private, Public},
+    tss2_esys::{TPM2B_CREATION_DATA, TPM2B_DIGEST, TPM2B_PRIVATE, TPM2B_PUBLIC, TPMT_TK_CREATION},
+    Error, Result,
+};
+use std::convert::TryFrom;
+use std::ptr::null_mut;
+
+/// Struct that handles the output of the
+/// Create Esys_Create command and zeroizes
+/// the FFI data.
+pub(crate) struct CreateCommandOutputHandler {
+    ffi_out_public_ptr: *mut TPM2B_PUBLIC,
+    ffi_out_private_ptr: *mut TPM2B_PRIVATE,
+    ffi_creation_data_ptr: *mut TPM2B_CREATION_DATA,
+    ffi_creation_hash_ptr: *mut TPM2B_DIGEST,
+    ffi_creation_ticket_ptr: *mut TPMT_TK_CREATION,
+}
+
+/// Creates a new CreateCommandOutputHandler
+impl CreateCommandOutputHandler {
+    pub(crate) fn new() -> Self {
+        Self {
+            ffi_out_private_ptr: null_mut(),
+            ffi_out_public_ptr: null_mut(),
+            ffi_creation_data_ptr: null_mut(),
+            ffi_creation_hash_ptr: null_mut(),
+            ffi_creation_ticket_ptr: null_mut(),
+        }
+    }
+
+    /// A reference to the where 'outPrivate' output parameter pointer shall be stored.
+    pub fn ffi_out_private_ptr(&mut self) -> &mut *mut TPM2B_PRIVATE {
+        &mut self.ffi_out_private_ptr
+    }
+
+    /// A reference to the where 'outPublic' output parameter pointer shall be stored.
+    pub fn ffi_out_public_ptr(&mut self) -> &mut *mut TPM2B_PUBLIC {
+        &mut self.ffi_out_public_ptr
+    }
+
+    /// A reference to the where 'creationData' output parameter pointer shall be stored.
+    pub fn ffi_creation_data_ptr(&mut self) -> &mut *mut TPM2B_CREATION_DATA {
+        &mut self.ffi_creation_data_ptr
+    }
+
+    /// A reference to the where 'creationHash' output parameter pointer shall be stored.
+    pub fn ffi_creation_hash_ptr(&mut self) -> &mut *mut TPM2B_DIGEST {
+        &mut self.ffi_creation_hash_ptr
+    }
+
+    /// A reference to the where 'creationTicket' output parameter pointer shall be stored.
+    pub fn ffi_creation_ticket_ptr(&mut self) -> &mut *mut TPMT_TK_CREATION {
+        &mut self.ffi_creation_ticket_ptr
+    }
+}
+
+impl TryFrom<CreateCommandOutputHandler> for CreateKeyResult {
+    type Error = Error;
+
+    fn try_from(ffi_data_handler: CreateCommandOutputHandler) -> Result<CreateKeyResult> {
+        let out_private_owned =
+            crate::ffi::to_owned_with_zeroized_source(ffi_data_handler.ffi_out_private_ptr);
+        let out_public_owned =
+            crate::ffi::to_owned_with_zeroized_source(ffi_data_handler.ffi_out_public_ptr);
+        let creation_data_owned =
+            crate::ffi::to_owned_with_zeroized_source(ffi_data_handler.ffi_creation_data_ptr);
+        let creation_hash_owned =
+            crate::ffi::to_owned_with_zeroized_source(ffi_data_handler.ffi_creation_hash_ptr);
+        let creation_ticket_owned =
+            crate::ffi::to_owned_with_zeroized_source(ffi_data_handler.ffi_creation_ticket_ptr);
+        Ok(CreateKeyResult {
+            out_private: Private::try_from(out_private_owned)?,
+            out_public: Public::try_from(out_public_owned)?,
+            creation_data: CreationData::try_from(creation_data_owned)?,
+            creation_hash: Digest::try_from(creation_hash_owned)?,
+            creation_ticket: CreationTicket::try_from(creation_ticket_owned)?,
+        })
+    }
+}

tss-esapi/src/ffi.rs

@@ -0,0 +1,27 @@
+// Copyright 2022 Contributors to the Parsec project.
+// SPDX-License-Identifier: Apache-2.0
+
+pub(crate) mod data_zeroize;
+
+use crate::ffi::data_zeroize::FfiDataZeroize;
+use mbox::MBox;
+use std::ops::Deref;
+
+/// Function that takes ownership of data that has been
+/// allocated with C memory allocation functions in TSS while also
+/// zeroizing the memory before freeing it.
+///
+/// # Arguments
+/// * `ffi_data_ptr` - A pointer to the FFI data.
+///
+/// # Returns
+/// The owned version of the FFI data.
+pub(crate) fn to_owned_with_zeroized_source<T>(ffi_data_ptr: *mut T) -> T
+where
+    T: FfiDataZeroize + Copy,
+{
+    let mut ffi_data = unsafe { MBox::from_raw(ffi_data_ptr) };
+    let owned_ffi_data: T = *ffi_data.deref();
+    ffi_data.ffi_data_zeroize();
+    owned_ffi_data
+}