Skip to content

Commit e660843

Browse files
ShitalJumbadjyao1
ShitalJumbad
authored and
jyao1
committed
Make libspdm_get_certificate_choose_length[_ex]() public APIs
fix #2909 Signed-off-by: Shital Jumbad <[email protected]>
1 parent 793674c commit e660843

File tree

4 files changed

+82
-32
lines changed

4 files changed

+82
-32
lines changed

‎doc/api/requester_api.md

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,53 @@ libspdm will perform the following checks over the leaf certificate.
101101
- If the `BasicConstraints` field exists then verify that the `cA` is false.
102102
<br/><br/>
103103

104+
---
105+
### libspdm_get_certificate_choose_length_ex
106+
---
107+
108+
### Description
109+
Sends GET_CERTIFICATE and retrieves a certificate chain in one slot from the device, allowing the Integrator to specify the size of the certificate chain blocks.
110+
111+
### Parameters
112+
113+
**spdm_context**<br/>
114+
The SPDM context.
115+
116+
**session_id**<br/>
117+
Indicates if it is a secured message (non-NULL) or an unsecured message (NULL).
118+
119+
**slot_id**<br/>
120+
The certificate chain slot number.
121+
122+
**length**<br/>
123+
The length of the certificate chain block to be retrieved.
124+
125+
**cert_chain_size**<br/>
126+
On input, indicates the size, in bytes, of the buffer in which the certificate chain will be stored.
127+
The maximum size of an SPDM certificate chain is given by `SPDM_MAX_CERTIFICATE_CHAIN_SIZE` and is
128+
65535 bytes.
129+
On output, indicates the size, in bytes, of the certificate chain.
130+
131+
**cert_chain**<br/>
132+
A pointer to a buffer of size `cert_chain_size` in which the certificate chain will be stored.
133+
134+
**trust_anchor**<br/>
135+
A buffer to hold the trust anchor which is used to validate the peer certificate. If NULL, the trust anchor is not stored.
136+
137+
**trust_anchor_size**<br/>
138+
A buffer to hold the size of the trust anchor. If NULL, the trust anchor size is not stored.
139+
140+
### Details
141+
Before calling this function the Integrator should have determined which certificate chain slots are
142+
populated through `libspdm_get_digest`, although that is not strictly required. Once the certificate
143+
chain has been retrieved libspdm will validate the chain and its leaf certificate. This function performs the following operations:
144+
1. Sends the `GET_CERTIFICATE` request to the device for the specified slot.
145+
2. Retrieves the certificate chain in blocks of the specified size (`length`).
146+
3. Verifies the integrity of the certificate chain from the root certificate to the leaf certificate, following the structure:
147+
- root_hash -> Root certificate -> Intermediate certificate -> Leaf certificate.
148+
4. If a peer root certificate hash is deployed, validates the root certificate digest against the deployed root hash.
149+
<br/><br/>
150+
104151
---
105152
### libspdm_challenge
106153
---

‎include/internal/libspdm_requester_lib.h

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -177,36 +177,6 @@ libspdm_return_t libspdm_get_certificate_choose_length(void *spdm_context,
177177
uint16_t length,
178178
size_t *cert_chain_size,
179179
void *cert_chain);
180-
181-
/**
182-
* This function sends GET_CERTIFICATE to get certificate chain in one slot from device.
183-
*
184-
* This function verify the integrity of the certificate chain.
185-
* root_hash -> Root certificate -> Intermediate certificate -> Leaf certificate.
186-
*
187-
* If the peer root certificate hash is deployed,
188-
* this function also verifies the digest with the root hash in the certificate chain.
189-
*
190-
* @param spdm_context A pointer to the SPDM context.
191-
* @param session_id Indicates if it is a secured message protected via SPDM session.
192-
* If session_id is NULL, it is a normal message.
193-
* @param slot_id The number of slot for the certificate chain.
194-
* @param length LIBSPDM_MAX_CERT_CHAIN_BLOCK_LEN.
195-
* @param cert_chain_size On input, indicate the size in bytes of the destination buffer to store the digest buffer.
196-
* On output, indicate the size in bytes of the certificate chain.
197-
* @param cert_chain A pointer to a destination buffer to store the certificate chain.
198-
* @param trust_anchor A buffer to hold the trust_anchor which is used to validate the peer certificate, if not NULL.
199-
* @param trust_anchor_size A buffer to hold the trust_anchor_size, if not NULL.
200-
**/
201-
libspdm_return_t libspdm_get_certificate_choose_length_ex(void *spdm_context,
202-
const uint32_t *session_id,
203-
uint8_t slot_id,
204-
uint16_t length,
205-
size_t *cert_chain_size,
206-
void *cert_chain,
207-
const void **trust_anchor,
208-
size_t *trust_anchor_size);
209-
210180
#if LIBSPDM_ENABLE_CAPABILITY_MEL_CAP
211181
/**
212182
* This function sends GET_MEASUREMENT_EXTENSION_LOG to get MEL from device.

‎include/library/spdm_requester_lib.h

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,36 @@ libspdm_return_t libspdm_get_certificate_ex(void *spdm_context,
141141
void *cert_chain,
142142
const void **trust_anchor,
143143
size_t *trust_anchor_size);
144+
145+
/**
146+
* This function sends GET_CERTIFICATE to get certificate chain in one slot from the device,
147+
* and allows the Integrator to specify the size of the certificate chain blocks.
148+
*
149+
* This function verify the integrity of the certificate chain.
150+
* root_hash -> Root certificate -> Intermediate certificate -> Leaf certificate.
151+
*
152+
* If the peer root certificate hash is deployed,
153+
* this function also verifies the digest with the root hash in the certificate chain.
154+
*
155+
* @param spdm_context A pointer to the SPDM context.
156+
* @param session_id Indicates if it is a secured message protected via SPDM session.
157+
* If session_id is NULL, it is a normal message.
158+
* @param slot_id The number of slot for the certificate chain.
159+
* @param length The length of the certificate chain block to retrieve.
160+
* @param cert_chain_size On input, indicate the size in bytes of the destination buffer to store the digest buffer.
161+
* On output, indicate the size in bytes of the certificate chain.
162+
* @param cert_chain A pointer to a destination buffer to store the certificate chain.
163+
* @param trust_anchor A buffer to hold the trust_anchor which is used to validate the peer certificate, if not NULL.
164+
* @param trust_anchor_size A buffer to hold the trust_anchor_size, if not NULL.
165+
**/
166+
libspdm_return_t libspdm_get_certificate_choose_length_ex(void *spdm_context,
167+
const uint32_t *session_id,
168+
uint8_t slot_id,
169+
uint32_t length,
170+
size_t *cert_chain_size,
171+
void *cert_chain,
172+
const void **trust_anchor,
173+
size_t *trust_anchor_size);
144174
#endif /* LIBSPDM_SEND_GET_CERTIFICATE_SUPPORT */
145175

146176
/**

‎library/spdm_requester_lib/libspdm_req_get_certificate.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -471,7 +471,7 @@ libspdm_return_t libspdm_get_certificate_choose_length(void *spdm_context,
471471
libspdm_return_t libspdm_get_certificate_choose_length_ex(void *spdm_context,
472472
const uint32_t *session_id,
473473
uint8_t slot_id,
474-
uint16_t length,
474+
uint32_t length,
475475
size_t *cert_chain_size,
476476
void *cert_chain,
477477
const void **trust_anchor,
@@ -482,12 +482,15 @@ libspdm_return_t libspdm_get_certificate_choose_length_ex(void *spdm_context,
482482
uint64_t retry_delay_time;
483483
libspdm_return_t status;
484484

485+
/* -=[Check Parameters Phase]=- */
486+
LIBSPDM_ASSERT(length <= 0xFFFF);
487+
485488
context = spdm_context;
486489
context->crypto_request = true;
487490
retry = context->retry_times;
488491
retry_delay_time = context->retry_delay_time;
489492
do {
490-
status = libspdm_try_get_certificate(context, session_id, slot_id, length,
493+
status = libspdm_try_get_certificate(context, session_id, slot_id, (uint16_t)length,
491494
cert_chain_size, cert_chain, trust_anchor,
492495
trust_anchor_size);
493496
if (status != LIBSPDM_STATUS_BUSY_PEER) {

0 commit comments

Comments
 (0)