Skip to content

Commit 16bbbc7

Browse files
steven-bellockjyao1
steven-bellock
authored and
jyao1
committed
Move local_used_cert_chain_slot_id
Fix #3405 and move local_used_cert_chain_slot_id from connection_info to session_info. Signed-off-by: Steven Bellock <[email protected]>
1 parent f0950fc commit 16bbbc7

File tree

19 files changed

+119
-354
lines changed

19 files changed

+119
-354
lines changed

‎include/internal/libspdm_common_lib.h‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -150,11 +150,6 @@ typedef struct {
150150
libspdm_peer_used_cert_chain_t peer_used_cert_chain[SPDM_MAX_SLOT_COUNT];
151151
uint8_t peer_used_cert_chain_slot_id;
152152

153-
/* Local Used CertificateChain (for responder, or requester in mut auth) */
154-
const uint8_t *local_used_cert_chain_buffer;
155-
size_t local_used_cert_chain_buffer_size;
156-
uint8_t local_used_cert_chain_slot_id;
157-
158153
/* Specifies whether the cached negotiated state should be invalidated. (responder only)
159154
* This is a "sticky" bit wherein if it is set to 1 then it cannot be set to 0. */
160155
uint8_t end_session_attributes;
@@ -477,6 +472,8 @@ typedef struct {
477472
/* Register for the last KEY_UPDATE token and operation (responder only)*/
478473
spdm_key_update_request_t last_key_update_request;
479474
void *secured_message_context;
475+
/* Only present in session info as it is currently only used within a secure session. */
476+
uint8_t local_used_cert_chain_slot_id;
480477
} libspdm_session_info_t;
481478

482479
#define LIBSPDM_MAX_ENCAP_REQUEST_OP_CODE_SEQUENCE_COUNT 3

‎include/library/spdm_common_lib.h‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -879,11 +879,9 @@ bool libspdm_get_peer_cert_chain_data(void *spdm_context,
879879
* @param spdm_context A pointer to the SPDM context.
880880
* @param cert_chain_buffer Certificate chain buffer including spdm_cert_chain_t header.
881881
* @param cert_chain_buffer_size Size in bytes of the certificate chain buffer.
882-
*
883-
* @retval true Local used certificate chain buffer including spdm_cert_chain_t header is returned.
884-
* @retval false Local used certificate chain buffer including spdm_cert_chain_t header is not found.
885882
**/
886-
bool libspdm_get_local_cert_chain_buffer(void *spdm_context,
883+
void libspdm_get_local_cert_chain_buffer(void *spdm_context,
884+
uint8_t slot_id,
887885
const void **cert_chain_buffer,
888886
size_t *cert_chain_buffer_size);
889887

@@ -898,6 +896,7 @@ bool libspdm_get_local_cert_chain_buffer(void *spdm_context,
898896
* @retval false Local used certificate chain data without spdm_cert_chain_t header is not found.
899897
**/
900898
bool libspdm_get_local_cert_chain_data(void *spdm_context,
899+
uint8_t slot_id,
901900
const void **cert_chain_data,
902901
size_t *cert_chain_data_size);
903902

‎library/spdm_common_lib/libspdm_com_context_data.c‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1999,20 +1999,20 @@ libspdm_return_t libspdm_append_message_k(libspdm_context_t *spdm_context,
19991999
hash_size);
20002000
}
20012001
} else {
2002-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
2002+
slot_id = spdm_session_info->local_used_cert_chain_slot_id;
20032003
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
20042004
if (slot_id == 0xFF) {
20052005
result = libspdm_get_local_public_key_buffer(
20062006
spdm_context, (const void **)&cert_chain_buffer,
20072007
&cert_chain_buffer_size);
2008+
if (!result) {
2009+
return LIBSPDM_STATUS_INVALID_STATE_LOCAL;
2010+
}
20082011
} else {
2009-
result = libspdm_get_local_cert_chain_buffer(
2010-
spdm_context, (const void **)&cert_chain_buffer,
2012+
libspdm_get_local_cert_chain_buffer(
2013+
spdm_context, slot_id, (const void **)&cert_chain_buffer,
20112014
&cert_chain_buffer_size);
20122015
}
2013-
if (!result) {
2014-
return LIBSPDM_STATUS_INVALID_STATE_LOCAL;
2015-
}
20162016

20172017
result = libspdm_hash_all(
20182018
spdm_context->connection_info.algorithm.base_hash_algo,
@@ -2145,22 +2145,23 @@ libspdm_return_t libspdm_append_message_f(libspdm_context_t *spdm_context,
21452145

21462146
if (!spdm_session_info->use_psk && (spdm_session_info->mut_auth_requested != 0)) {
21472147
if (is_requester) {
2148-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
2148+
slot_id = spdm_session_info->local_used_cert_chain_slot_id;
21492149
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
21502150
if (slot_id == 0xFF) {
21512151
result = libspdm_get_local_public_key_buffer(
21522152
spdm_context,
21532153
(const void **)&mut_cert_chain_buffer,
21542154
&mut_cert_chain_buffer_size);
2155+
if (!result) {
2156+
return LIBSPDM_STATUS_INVALID_STATE_LOCAL;
2157+
}
21552158
} else {
2156-
result = libspdm_get_local_cert_chain_buffer(
2159+
libspdm_get_local_cert_chain_buffer(
21572160
spdm_context,
2161+
slot_id,
21582162
(const void **)&mut_cert_chain_buffer,
21592163
&mut_cert_chain_buffer_size);
21602164
}
2161-
if (!result) {
2162-
return LIBSPDM_STATUS_INVALID_STATE_LOCAL;
2163-
}
21642165

21652166
result = libspdm_hash_all(
21662167
spdm_context->connection_info.algorithm.base_hash_algo,
@@ -3253,8 +3254,6 @@ void libspdm_reset_context(void *spdm_context)
32533254
libspdm_zero_mem(&context->connection_info.algorithm, sizeof(libspdm_device_algorithm_t));
32543255
libspdm_zero_mem(&context->last_spdm_error, sizeof(libspdm_error_struct_t));
32553256
libspdm_zero_mem(&context->encap_context, sizeof(libspdm_encap_context_t));
3256-
context->connection_info.local_used_cert_chain_buffer_size = 0;
3257-
context->connection_info.local_used_cert_chain_buffer = NULL;
32583257
context->connection_info.multi_key_conn_req = false;
32593258
context->connection_info.multi_key_conn_rsp = false;
32603259
#if LIBSPDM_RESPOND_IF_READY_SUPPORT

‎library/spdm_common_lib/libspdm_com_crypto_service.c‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -115,19 +115,20 @@ bool libspdm_get_peer_cert_chain_data(void *spdm_context,
115115
* @retval true Local used certificate chain buffer including spdm_cert_chain_t header is returned.
116116
* @retval false Local used certificate chain buffer including spdm_cert_chain_t header is not found.
117117
**/
118-
bool libspdm_get_local_cert_chain_buffer(void *spdm_context,
118+
void libspdm_get_local_cert_chain_buffer(void *spdm_context,
119+
uint8_t slot_id,
119120
const void **cert_chain_buffer,
120121
size_t *cert_chain_buffer_size)
121122
{
122123
libspdm_context_t *context;
123124

124125
context = spdm_context;
125-
if (context->connection_info.local_used_cert_chain_buffer_size != 0) {
126-
*cert_chain_buffer = context->connection_info.local_used_cert_chain_buffer;
127-
*cert_chain_buffer_size = context->connection_info.local_used_cert_chain_buffer_size;
128-
return true;
129-
}
130-
return false;
126+
127+
LIBSPDM_ASSERT(context->local_context.local_cert_chain_provision[slot_id] != NULL);
128+
LIBSPDM_ASSERT(context->local_context.local_cert_chain_provision_size != 0);
129+
130+
*cert_chain_buffer = context->local_context.local_cert_chain_provision[slot_id];
131+
*cert_chain_buffer_size = context->local_context.local_cert_chain_provision_size[slot_id];
131132
}
132133

133134
/**
@@ -141,25 +142,22 @@ bool libspdm_get_local_cert_chain_buffer(void *spdm_context,
141142
* @retval false Local used certificate chain data without spdm_cert_chain_t header is not found.
142143
**/
143144
bool libspdm_get_local_cert_chain_data(void *spdm_context,
145+
uint8_t slot_id,
144146
const void **cert_chain_data,
145147
size_t *cert_chain_data_size)
146148
{
147149
libspdm_context_t *context;
148-
bool result;
149150
size_t hash_size;
150151

151152
context = spdm_context;
152153

153-
result = libspdm_get_local_cert_chain_buffer(context, cert_chain_data,
154-
cert_chain_data_size);
155-
if (!result) {
156-
return false;
157-
}
154+
libspdm_get_local_cert_chain_buffer(context, slot_id, cert_chain_data, cert_chain_data_size);
158155

159156
hash_size = libspdm_get_hash_size(context->connection_info.algorithm.base_hash_algo);
160157

161158
*cert_chain_data = (const uint8_t *)*cert_chain_data + sizeof(spdm_cert_chain_t) + hash_size;
162159
*cert_chain_data_size = *cert_chain_data_size - (sizeof(spdm_cert_chain_t) + hash_size);
160+
163161
return true;
164162
}
165163

‎library/spdm_common_lib/libspdm_com_crypto_service_session.c‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -471,16 +471,17 @@ bool libspdm_calculate_th1_hash(libspdm_context_t *spdm_context,
471471
&cert_chain_buffer_size);
472472
}
473473
} else {
474-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
474+
slot_id = session_info->local_used_cert_chain_slot_id;
475475
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
476476
if (slot_id == 0xFF) {
477477
result = libspdm_get_local_public_key_buffer(
478478
spdm_context, (const void **)&cert_chain_buffer,
479479
&cert_chain_buffer_size);
480480
} else {
481-
result = libspdm_get_local_cert_chain_buffer(
482-
spdm_context, (const void **)&cert_chain_buffer,
481+
libspdm_get_local_cert_chain_buffer(
482+
spdm_context, slot_id, (const void **)&cert_chain_buffer,
483483
&cert_chain_buffer_size);
484+
result = true;
484485
}
485486
}
486487
if (!result) {
@@ -563,33 +564,35 @@ bool libspdm_calculate_th2_hash(libspdm_context_t *spdm_context,
563564
&cert_chain_buffer_size);
564565
}
565566
} else {
566-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
567+
slot_id = session_info->local_used_cert_chain_slot_id;
567568
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
568569
if (slot_id == 0xFF) {
569570
result = libspdm_get_local_public_key_buffer(
570571
spdm_context, (const void **)&cert_chain_buffer,
571572
&cert_chain_buffer_size);
572573
} else {
573-
result = libspdm_get_local_cert_chain_buffer(
574-
spdm_context, (const void **)&cert_chain_buffer,
574+
libspdm_get_local_cert_chain_buffer(
575+
spdm_context, slot_id, (const void **)&cert_chain_buffer,
575576
&cert_chain_buffer_size);
577+
result = true;
576578
}
577579
}
578580
if (!result) {
579581
return false;
580582
}
581583
if (session_info->mut_auth_requested != 0) {
582584
if (is_requester) {
583-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
585+
slot_id = session_info->local_used_cert_chain_slot_id;
584586
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
585587
if (slot_id == 0xFF) {
586588
result = libspdm_get_local_public_key_buffer(
587589
spdm_context, (const void **)&mut_cert_chain_buffer,
588590
&mut_cert_chain_buffer_size);
589591
} else {
590-
result = libspdm_get_local_cert_chain_buffer(
591-
spdm_context, (const void **)&mut_cert_chain_buffer,
592+
libspdm_get_local_cert_chain_buffer(
593+
spdm_context, slot_id, (const void **)&mut_cert_chain_buffer,
592594
&mut_cert_chain_buffer_size);
595+
result = true;
593596
}
594597
} else {
595598
slot_id = spdm_context->connection_info.peer_used_cert_chain_slot_id;

‎library/spdm_requester_lib/libspdm_req_finish.c‎

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -63,14 +63,16 @@ bool libspdm_verify_finish_rsp_hmac(libspdm_context_t *spdm_context,
6363
}
6464

6565
if (session_info->mut_auth_requested != 0) {
66-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
66+
slot_id = session_info->local_used_cert_chain_slot_id;
6767
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
6868
if (slot_id == 0xFF) {
6969
result = libspdm_get_local_public_key_buffer(
7070
spdm_context, (const void **)&mut_cert_chain_buffer, &mut_cert_chain_buffer_size);
7171
} else {
72-
result = libspdm_get_local_cert_chain_buffer(
73-
spdm_context, (const void **)&mut_cert_chain_buffer, &mut_cert_chain_buffer_size);
72+
libspdm_get_local_cert_chain_buffer(
73+
spdm_context, slot_id, (const void **)&mut_cert_chain_buffer,
74+
&mut_cert_chain_buffer_size);
75+
result = true;
7476
}
7577
if (!result) {
7678
return false;
@@ -158,14 +160,16 @@ bool libspdm_generate_finish_req_hmac(libspdm_context_t *spdm_context,
158160
}
159161

160162
if (session_info->mut_auth_requested != 0) {
161-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
163+
slot_id = session_info->local_used_cert_chain_slot_id;
162164
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
163165
if (slot_id == 0xFF) {
164166
result = libspdm_get_local_public_key_buffer(
165167
spdm_context, (const void **)&mut_cert_chain_buffer, &mut_cert_chain_buffer_size);
166168
} else {
167-
result = libspdm_get_local_cert_chain_buffer(
168-
spdm_context, (const void **)&mut_cert_chain_buffer, &mut_cert_chain_buffer_size);
169+
libspdm_get_local_cert_chain_buffer(
170+
spdm_context, slot_id, (const void **)&mut_cert_chain_buffer,
171+
&mut_cert_chain_buffer_size);
172+
result = true;
169173
}
170174
if (!result) {
171175
return false;
@@ -264,14 +268,16 @@ bool libspdm_generate_finish_req_signature(libspdm_context_t *spdm_context,
264268
return false;
265269
}
266270

267-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
271+
slot_id = session_info->local_used_cert_chain_slot_id;
268272
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
269273
if (slot_id == 0xFF) {
270274
result = libspdm_get_local_public_key_buffer(
271275
spdm_context, (const void **)&mut_cert_chain_buffer, &mut_cert_chain_buffer_size);
272276
} else {
273-
result = libspdm_get_local_cert_chain_buffer(
274-
spdm_context, (const void **)&mut_cert_chain_buffer, &mut_cert_chain_buffer_size);
277+
libspdm_get_local_cert_chain_buffer(
278+
spdm_context, slot_id, (const void **)&mut_cert_chain_buffer,
279+
&mut_cert_chain_buffer_size);
280+
result = true;
275281
}
276282
if (!result) {
277283
return false;
@@ -476,14 +482,7 @@ static libspdm_return_t libspdm_try_send_receive_finish(
476482
}
477483
#endif
478484

479-
spdm_context->connection_info.local_used_cert_chain_slot_id = req_slot_id_param;
480-
if ((session_info->mut_auth_requested != 0) && (req_slot_id_param != 0xFF)) {
481-
LIBSPDM_ASSERT(req_slot_id_param < SPDM_MAX_SLOT_COUNT);
482-
spdm_context->connection_info.local_used_cert_chain_buffer =
483-
spdm_context->local_context.local_cert_chain_provision[req_slot_id_param];
484-
spdm_context->connection_info.local_used_cert_chain_buffer_size =
485-
spdm_context->local_context.local_cert_chain_provision_size[req_slot_id_param];
486-
}
485+
session_info->local_used_cert_chain_slot_id = req_slot_id_param;
487486

488487
hmac_size = libspdm_get_hash_size(spdm_context->connection_info.algorithm.base_hash_algo);
489488
LIBSPDM_ASSERT (spdm_request_size >= sizeof(spdm_finish_request_t) + opaque_data_entry_size +

‎library/spdm_responder_lib/libspdm_rsp_finish.c‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,15 @@ bool libspdm_verify_finish_req_hmac(libspdm_context_t *spdm_context,
3232
LIBSPDM_ASSERT(hmac_size == hash_size);
3333

3434
#if LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT
35-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
35+
slot_id = session_info->local_used_cert_chain_slot_id;
3636
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
3737
if (slot_id == 0xFF) {
3838
result = libspdm_get_local_public_key_buffer(
3939
spdm_context, (const void **)&cert_chain_buffer, &cert_chain_buffer_size);
4040
} else {
41-
result = libspdm_get_local_cert_chain_buffer(
42-
spdm_context, (const void **)&cert_chain_buffer, &cert_chain_buffer_size);
41+
libspdm_get_local_cert_chain_buffer(
42+
spdm_context, slot_id, (const void **)&cert_chain_buffer, &cert_chain_buffer_size);
43+
result = true;
4344
}
4445
if (!result) {
4546
return false;
@@ -136,17 +137,17 @@ bool libspdm_verify_finish_req_signature(libspdm_context_t *spdm_context,
136137
#endif
137138

138139
#if LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT
139-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
140+
slot_id = session_info->local_used_cert_chain_slot_id;
140141
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
141142
if (slot_id == 0xFF) {
142143
result = libspdm_get_local_public_key_buffer(
143144
spdm_context, (const void **)&cert_chain_buffer, &cert_chain_buffer_size);
145+
if (!result) {
146+
return false;
147+
}
144148
} else {
145-
result = libspdm_get_local_cert_chain_buffer(
146-
spdm_context, (const void **)&cert_chain_buffer, &cert_chain_buffer_size);
147-
}
148-
if (!result) {
149-
return false;
149+
libspdm_get_local_cert_chain_buffer(
150+
spdm_context, slot_id, (const void **)&cert_chain_buffer, &cert_chain_buffer_size);
150151
}
151152

152153
slot_id = spdm_context->connection_info.peer_used_cert_chain_slot_id;
@@ -323,17 +324,17 @@ bool libspdm_generate_finish_rsp_hmac(libspdm_context_t *spdm_context,
323324
hash_size = libspdm_get_hash_size(spdm_context->connection_info.algorithm.base_hash_algo);
324325

325326
#if LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT
326-
slot_id = spdm_context->connection_info.local_used_cert_chain_slot_id;
327+
slot_id = session_info->local_used_cert_chain_slot_id;
327328
LIBSPDM_ASSERT((slot_id < SPDM_MAX_SLOT_COUNT) || (slot_id == 0xFF));
328329
if (slot_id == 0xFF) {
329330
result = libspdm_get_local_public_key_buffer(
330331
spdm_context, (const void **)&cert_chain_buffer, &cert_chain_buffer_size);
332+
if (!result) {
333+
return false;
334+
}
331335
} else {
332-
result = libspdm_get_local_cert_chain_buffer(
333-
spdm_context, (const void **)&cert_chain_buffer, &cert_chain_buffer_size);
334-
}
335-
if (!result) {
336-
return false;
336+
libspdm_get_local_cert_chain_buffer(
337+
spdm_context, slot_id, (const void **)&cert_chain_buffer, &cert_chain_buffer_size);
337338
}
338339

339340
if (session_info->mut_auth_requested != 0) {

0 commit comments

Comments
 (0)