Skip to content

Commit 4a010ad

Browse files
jyao1jyao1
committed
Add 1.3 Challenge for BasicMutAuth
Signed-off-by: Jiewen Yao <[email protected]>
1 parent e5697dc commit 4a010ad

File tree

3 files changed

+83
-20
lines changed

3 files changed

+83
-20
lines changed

‎include/internal/libspdm_common_lib.h

+1
Original file line numberDiff line numberDiff line change
@@ -423,6 +423,7 @@ typedef struct {
423423
spdm_message_header_t last_encap_request_header;
424424
size_t last_encap_request_size;
425425
uint16_t cert_chain_total_len;
426+
uint8_t req_context[SPDM_REQ_CONTEXT_SIZE];
426427
} libspdm_encap_context_t;
427428

428429
#if LIBSPDM_ENABLE_CAPABILITY_CHUNK_CAP

‎library/spdm_requester_lib/libspdm_req_encap_challenge_auth.c

+21-2
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ libspdm_return_t libspdm_get_encap_response_challenge_auth(
2828
uint8_t slot_mask;
2929
uint8_t *opaque_data;
3030
size_t opaque_data_size;
31+
size_t spdm_request_size;
3132
size_t spdm_response_size;
3233

3334
context = spdm_context;
@@ -58,6 +59,15 @@ libspdm_return_t libspdm_get_encap_response_challenge_auth(
5859
context, SPDM_ERROR_CODE_INVALID_REQUEST, 0,
5960
response_size, response);
6061
}
62+
spdm_request_size = sizeof(spdm_challenge_request_t);
63+
if (spdm_request->header.spdm_version >= SPDM_MESSAGE_VERSION_13) {
64+
if (request_size < sizeof(spdm_challenge_request_t) + SPDM_REQ_CONTEXT_SIZE) {
65+
return libspdm_generate_encap_error_response(
66+
context, SPDM_ERROR_CODE_INVALID_REQUEST, 0,
67+
response_size, response);
68+
}
69+
spdm_request_size += SPDM_REQ_CONTEXT_SIZE;
70+
}
6171

6272
if (spdm_request->header.param2 != SPDM_CHALLENGE_REQUEST_NO_MEASUREMENT_SUMMARY_HASH) {
6373
return libspdm_generate_encap_error_response(
@@ -86,7 +96,7 @@ libspdm_return_t libspdm_get_encap_response_challenge_auth(
8696
/* response_size should be large enough to hold a challenge response without opaque data. */
8797
LIBSPDM_ASSERT(*response_size >= sizeof(spdm_challenge_auth_response_t) + hash_size +
8898
SPDM_NONCE_SIZE + measurement_summary_hash_size + sizeof(uint16_t) +
89-
signature_size);
99+
SPDM_REQ_CONTEXT_SIZE + signature_size);
90100

91101
libspdm_zero_mem(response, *response_size);
92102
spdm_response = response;
@@ -155,11 +165,20 @@ libspdm_return_t libspdm_get_encap_response_challenge_auth(
155165
/*the opaque_data is stored by libspdm_encap_challenge_opaque_data*/
156166
ptr += opaque_data_size;
157167

168+
if (spdm_request->header.spdm_version >= SPDM_MESSAGE_VERSION_13) {
169+
libspdm_copy_mem(ptr, SPDM_REQ_CONTEXT_SIZE,
170+
spdm_request + 1, SPDM_REQ_CONTEXT_SIZE);
171+
ptr += SPDM_REQ_CONTEXT_SIZE;
172+
}
173+
158174
/*get actual response size*/
159175
spdm_response_size =
160176
sizeof(spdm_challenge_auth_response_t) + hash_size +
161177
SPDM_NONCE_SIZE + measurement_summary_hash_size +
162178
sizeof(uint16_t) + opaque_data_size + signature_size;
179+
if (spdm_request->header.spdm_version >= SPDM_MESSAGE_VERSION_13) {
180+
spdm_response_size += SPDM_REQ_CONTEXT_SIZE;
181+
}
163182

164183
LIBSPDM_ASSERT(*response_size >= spdm_response_size);
165184

@@ -168,7 +187,7 @@ libspdm_return_t libspdm_get_encap_response_challenge_auth(
168187
/* Calc Sign*/
169188

170189
status = libspdm_append_message_mut_c(context, spdm_request,
171-
request_size);
190+
spdm_request_size);
172191
if (LIBSPDM_STATUS_IS_ERROR(status)) {
173192
return libspdm_generate_encap_error_response(
174193
context, SPDM_ERROR_CODE_UNSPECIFIED, 0,

‎library/spdm_responder_lib/libspdm_rsp_encap_challenge.c

+61-18
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ libspdm_return_t libspdm_get_encap_request_challenge(libspdm_context_t *spdm_con
1414
void *encap_request)
1515
{
1616
spdm_challenge_request_t *spdm_request;
17+
size_t spdm_request_size;
1718
libspdm_return_t status;
1819

1920
spdm_context->encap_context.last_encap_request_size = 0;
@@ -28,10 +29,15 @@ libspdm_return_t libspdm_get_encap_request_challenge(libspdm_context_t *spdm_con
2829
return LIBSPDM_STATUS_UNSUPPORTED_CAP;
2930
}
3031

31-
if(*encap_request_size < sizeof(spdm_challenge_request_t)) {
32+
spdm_request_size = sizeof(spdm_challenge_request_t);
33+
if (libspdm_get_connection_version (spdm_context) >= SPDM_MESSAGE_VERSION_13) {
34+
spdm_request_size = sizeof(spdm_challenge_request_t) + SPDM_REQ_CONTEXT_SIZE;
35+
}
36+
37+
if(*encap_request_size < spdm_request_size) {
3238
return LIBSPDM_STATUS_INVALID_MSG_SIZE;
3339
}
34-
*encap_request_size = sizeof(spdm_challenge_request_t);
40+
*encap_request_size = spdm_request_size;
3541

3642
spdm_request = encap_request;
3743

@@ -46,6 +52,13 @@ libspdm_return_t libspdm_get_encap_request_challenge(libspdm_context_t *spdm_con
4652
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "Encap RequesterNonce - "));
4753
LIBSPDM_INTERNAL_DUMP_DATA(spdm_request->nonce, SPDM_NONCE_SIZE);
4854
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "\n"));
55+
if (spdm_request->header.spdm_version >= SPDM_MESSAGE_VERSION_13) {
56+
libspdm_copy_mem(spdm_request + 1, SPDM_REQ_CONTEXT_SIZE,
57+
spdm_context->encap_context.req_context, SPDM_REQ_CONTEXT_SIZE);
58+
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "Encap RequesterContext - "));
59+
LIBSPDM_INTERNAL_DUMP_DATA((uint8_t *)(spdm_request + 1), SPDM_REQ_CONTEXT_SIZE);
60+
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "\n"));
61+
}
4962

5063
libspdm_reset_message_buffer_via_request_code(spdm_context, NULL,
5164
spdm_request->header.request_response_code);
@@ -54,15 +67,15 @@ libspdm_return_t libspdm_get_encap_request_challenge(libspdm_context_t *spdm_con
5467
/* Cache data*/
5568

5669
status = libspdm_append_message_mut_c(spdm_context, spdm_request,
57-
*encap_request_size);
70+
spdm_request_size);
5871
if (LIBSPDM_STATUS_IS_ERROR(status)) {
5972
return LIBSPDM_STATUS_BUFFER_FULL;
6073
}
6174

6275
libspdm_copy_mem(&spdm_context->encap_context.last_encap_request_header,
6376
sizeof(spdm_context->encap_context.last_encap_request_header),
6477
&spdm_request->header, sizeof(spdm_message_header_t));
65-
spdm_context->encap_context.last_encap_request_size = *encap_request_size;
78+
spdm_context->encap_context.last_encap_request_size = spdm_request_size;
6679

6780
return LIBSPDM_STATUS_SUCCESS;
6881
}
@@ -106,6 +119,11 @@ libspdm_return_t libspdm_process_encap_response_challenge_auth(
106119
if (spdm_response_size < sizeof(spdm_challenge_auth_response_t)) {
107120
return LIBSPDM_STATUS_INVALID_MSG_SIZE;
108121
}
122+
if (spdm_response->header.spdm_version >= SPDM_MESSAGE_VERSION_13) {
123+
if (spdm_response_size < sizeof(spdm_challenge_auth_response_t) + SPDM_REQ_CONTEXT_SIZE) {
124+
return LIBSPDM_STATUS_INVALID_MSG_SIZE;
125+
}
126+
}
109127

110128
auth_attribute = spdm_response->header.param1;
111129
if (spdm_context->encap_context.req_slot_id == 0xFF) {
@@ -182,20 +200,28 @@ libspdm_return_t libspdm_process_encap_response_challenge_auth(
182200
}
183201
ptr += sizeof(uint16_t);
184202

185-
if (spdm_response_size <
186-
sizeof(spdm_challenge_auth_response_t) + hash_size +
187-
SPDM_NONCE_SIZE + measurement_summary_hash_size +
188-
sizeof(uint16_t) + opaque_length + signature_size) {
189-
return LIBSPDM_STATUS_INVALID_MSG_SIZE;
190-
}
191-
spdm_response_size = sizeof(spdm_challenge_auth_response_t) +
192-
hash_size + SPDM_NONCE_SIZE +
193-
measurement_summary_hash_size + sizeof(uint16_t) +
194-
opaque_length + signature_size;
195-
status = libspdm_append_message_mut_c(spdm_context, spdm_response,
196-
spdm_response_size - signature_size);
197-
if (LIBSPDM_STATUS_IS_ERROR(status)) {
198-
return LIBSPDM_STATUS_BUFFER_FULL;
203+
if (spdm_response->header.spdm_version >= SPDM_MESSAGE_VERSION_13) {
204+
if (spdm_response_size <
205+
sizeof(spdm_challenge_auth_response_t) + hash_size +
206+
SPDM_NONCE_SIZE + measurement_summary_hash_size +
207+
sizeof(uint16_t) + opaque_length + SPDM_REQ_CONTEXT_SIZE + signature_size) {
208+
return LIBSPDM_STATUS_INVALID_MSG_SIZE;
209+
}
210+
spdm_response_size = sizeof(spdm_challenge_auth_response_t) +
211+
hash_size + SPDM_NONCE_SIZE +
212+
measurement_summary_hash_size + sizeof(uint16_t) +
213+
opaque_length + SPDM_REQ_CONTEXT_SIZE + signature_size;
214+
} else {
215+
if (spdm_response_size <
216+
sizeof(spdm_challenge_auth_response_t) + hash_size +
217+
SPDM_NONCE_SIZE + measurement_summary_hash_size +
218+
sizeof(uint16_t) + opaque_length + signature_size) {
219+
return LIBSPDM_STATUS_INVALID_MSG_SIZE;
220+
}
221+
spdm_response_size = sizeof(spdm_challenge_auth_response_t) +
222+
hash_size + SPDM_NONCE_SIZE +
223+
measurement_summary_hash_size + sizeof(uint16_t) +
224+
opaque_length + signature_size;
199225
}
200226

201227
LIBSPDM_DEBUG_CODE(
@@ -206,6 +232,23 @@ libspdm_return_t libspdm_process_encap_response_challenge_auth(
206232
);
207233
ptr += opaque_length;
208234

235+
if (spdm_response->header.spdm_version >= SPDM_MESSAGE_VERSION_13) {
236+
if (!libspdm_consttime_is_mem_equal(spdm_context->encap_context.req_context, ptr,
237+
SPDM_REQ_CONTEXT_SIZE)) {
238+
return LIBSPDM_STATUS_INVALID_MSG_FIELD;
239+
}
240+
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "Encap RequesterContext - "));
241+
LIBSPDM_INTERNAL_DUMP_DATA(ptr, SPDM_REQ_CONTEXT_SIZE);
242+
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "\n"));
243+
ptr += SPDM_REQ_CONTEXT_SIZE;
244+
}
245+
246+
status = libspdm_append_message_mut_c(spdm_context, spdm_response,
247+
spdm_response_size - signature_size);
248+
if (LIBSPDM_STATUS_IS_ERROR(status)) {
249+
return LIBSPDM_STATUS_BUFFER_FULL;
250+
}
251+
209252
signature = ptr;
210253
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "Encap signature (0x%x):\n", signature_size));
211254
LIBSPDM_INTERNAL_DUMP_HEX(signature, signature_size);

0 commit comments

Comments
 (0)