feat(tpm): add read-only TPM validation

audit/internal/collector/tpm_test.go

@@ -0,0 +1,106 @@
+package collector
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"reflect"
+	"testing"
+)
+
+func TestParseTPMProperties(t *testing.T) {
+	properties := parseTPMProperties(`TPM2_PT_FAMILY_INDICATOR:
+  raw: 0x322E3000
+  value: "2.0"
+TPM2_PT_MANUFACTURER:
+  raw: 0x49465800
+  value: "IFX"
+TPM2_PT_FIRMWARE_VERSION_1:
+  raw: 0x0007003F
+TPM2_PT_FIRMWARE_VERSION_2:
+  raw: 0x00100023
+`)
+
+	if got := tpmPropertyValue(properties, "TPM2_PT_FAMILY_INDICATOR"); got != "2.0" {
+		t.Fatalf("family indicator = %q, want 2.0", got)
+	}
+	if got := tpmManufacturer(properties["TPM2_PT_MANUFACTURER"]); got != "IFX" {
+		t.Fatalf("manufacturer = %q, want IFX", got)
+	}
+	if got := tpmPropertyRaw(properties, "TPM2_PT_FIRMWARE_VERSION_1"); got != "0x0007003F" {
+		t.Fatalf("firmware version 1 = %q", got)
+	}
+}
+
+func TestTPMManufacturerDecodesRawVendorID(t *testing.T) {
+	if got := tpmManufacturer(tpmProperty{raw: "0x49465800"}); got != "IFX" {
+		t.Fatalf("manufacturer = %q, want IFX", got)
+	}
+}
+
+func TestCollectTPMPlatformConfig(t *testing.T) {
+	originalGlob, originalStat, originalRun := tpmGlob, tpmStat, tpmRun
+	t.Cleanup(func() {
+		tpmGlob, tpmStat, tpmRun = originalGlob, originalStat, originalRun
+	})
+
+	tpmGlob = func(string) ([]string, error) { return []string{"/sys/class/tpm/tpm0"}, nil }
+	tpmStat = func(path string) (os.FileInfo, error) {
+		if path == "/dev/tpmrm0" {
+			return nil, nil
+		}
+		return nil, os.ErrNotExist
+	}
+	tpmRun = func(name string, args ...string) ([]byte, error) {
+		if name != "tpm2_getcap" || !reflect.DeepEqual(args, []string{"properties-fixed"}) {
+			t.Fatalf("unexpected command: %s %v", name, args)
+		}
+		return []byte(`TPM2_PT_FAMILY_INDICATOR:
+  value: "2.0"
+TPM2_PT_MANUFACTURER:
+  raw: 0x49465800
+TPM2_PT_FIRMWARE_VERSION_1:
+  raw: 0x0007003F
+TPM2_PT_FIRMWARE_VERSION_2:
+  raw: 0x00100023
+`), nil
+	}
+
+	got := decodeTPMConfig(t, collectTPMPlatformConfig())
+	want := map[string]any{
+		"TpmPresent":         true,
+		"TpmEnabled":         true,
+		"TpmDevice":          "tpm0",
+		"TpmInterface":       "/dev/tpmrm0",
+		"TpmVersion":         "2.0",
+		"TpmManufacturer":    "IFX",
+		"TpmFirmwareVersion": "0x0007003F/0x00100023",
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("config = %#v, want %#v", got, want)
+	}
+}
+
+func TestCollectTPMPlatformConfigAbsent(t *testing.T) {
+	originalGlob := tpmGlob
+	t.Cleanup(func() { tpmGlob = originalGlob })
+	tpmGlob = func(string) ([]string, error) { return nil, errors.New("not found") }
+
+	got := decodeTPMConfig(t, collectTPMPlatformConfig())
+	want := map[string]any{"TpmPresent": false, "TpmEnabled": false}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("config = %#v, want %#v", got, want)
+	}
+}
+
+func decodeTPMConfig(t *testing.T, raw *json.RawMessage) map[string]any {
+	t.Helper()
+	if raw == nil {
+		t.Fatal("platform config is nil")
+	}
+	var config map[string]any
+	if err := json.Unmarshal(*raw, &config); err != nil {
+		t.Fatalf("unmarshal config: %v", err)
+	}
+	return config
+}