Skip to content

Commit 42788e0

Browse files
steven-bellockjyao1
steven-bellock
authored and
jyao1
committed
Remove basic mutual auth from context
Replace LIBSPDM_DATA_BASIC_MUT_AUTH_REQUESTED in the spdm_context with a hal call to the Integrator. Signed-off-by: Steven Bellock <[email protected]>
1 parent 61f4460 commit 42788e0

File tree

8 files changed

+68
-55
lines changed

8 files changed

+68
-55
lines changed

‎doc/api/common_api.md‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -276,14 +276,6 @@ Enumeration value used for the `libspdm_set_data` and/or `libspdm_get_data` func
276276
- Specifies the Responder's `HeartbeatPeriod` in units of seconds. This value is communicated to
277277
the Requester in the `KEY_EXCHANGE_RSP` and `PSK_EXCHANGE_RSP` messages. The actual timeout
278278
limit is twice the `HeartbeatPeriod`.
279-
- `LIBSPDM_DATA_BASIC_MUT_AUTH_REQUESTED`
280-
- Specifies whether the Responder requires basic mutual authentication with the Requester via
281-
the `CHALLENGE / CHALLENGE_AUTH` messages.
282-
- If `true` then Responder requires basic mutual authentication.
283-
- If `false` then Responder does not require basic mutual authentication.
284-
- Note that basic mutual authentication was deprecated in SPDM 1.2 and should also be considered
285-
deprecated in SPDM 1.1. If a Responder requires mutual authentication then it should use
286-
session-based mutual authentication via symmetric or asymmetric key exchange.
287279
- `LIBSPDM_DATA_MUT_AUTH_REQUESTED`
288280
- Specifies whether the Responder requires session-based mutual authentication with the
289281
Requester via asymmetric key exchange. Its value can be one of

‎include/hal/library/responder/asymsignlib.h‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,10 @@
1919
* @param spdm_context A pointer to the SPDM context.
2020
* @param spdm_version Indicates the negotiated version.
2121
*
22-
* @param slot_id The number of slot for the certificate chain.
22+
* @param slot_id Slot ID of the CHALLENGE request.
2323
* @param request_context_size The size, in bytes, of request_context.
2424
* @param request_context If spdm_version is greater than 1.2, then it is a pointer to the
25-
* Context field in the request message, else it is NULL and ignore
25+
* Context field in the request message, else it is NULL and ignore.
2626
*
2727
* @param opaque_data
2828
* A pointer to a destination buffer whose size, in bytes, is opaque_data_size. The opaque data is
@@ -40,7 +40,30 @@ extern bool libspdm_challenge_opaque_data(
4040
const void *request_context,
4141
void *opaque_data,
4242
size_t *opaque_data_size);
43-
#endif/*LIBSPDM_ENABLE_CAPABILITY_CHAL_CAP*/
43+
44+
#if LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP
45+
/**
46+
* Queries whether basic mutual authentication should be initiated or not.
47+
*
48+
* @param spdm_context A pointer to the SPDM context.
49+
* @param spdm_version Indicates the negotiated version.
50+
*
51+
* @param slot_id Slot ID of the CHALLENGE request.
52+
* @param request_context_size The size, in bytes, of request_context.
53+
* @param request_context If spdm_version is greater than 1.2, then it is a pointer to the
54+
* Context field in the request message, else it is NULL and ignore.
55+
*
56+
* @retval true Initiate the basic mutual authentication flow.
57+
* @retval false Do not initiate the basic mutual authentication flow.
58+
*/
59+
extern bool libspdm_challenge_start_mut_auth(
60+
void *spdm_context,
61+
spdm_version_number_t spdm_version,
62+
uint8_t slot_id,
63+
size_t request_context_size,
64+
const void *request_context);
65+
#endif /* LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP */
66+
#endif /* LIBSPDM_ENABLE_CAPABILITY_CHAL_CAP */
4467

4568
/**
4669
* Sign an SPDM message data.

‎include/library/spdm_common_lib.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,6 @@ typedef enum {
7777
LIBSPDM_DATA_LOCAL_CERT_INFO,
7878
LIBSPDM_DATA_LOCAL_KEY_USAGE_BIT_MASK,
7979

80-
LIBSPDM_DATA_BASIC_MUT_AUTH_REQUESTED,
8180
LIBSPDM_DATA_MUT_AUTH_REQUESTED,
8281
LIBSPDM_DATA_MANDATORY_MUT_AUTH,
8382
LIBSPDM_DATA_HEARTBEAT_PERIOD,

‎library/spdm_common_lib/libspdm_com_context_data.c‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -670,32 +670,6 @@ libspdm_return_t libspdm_set_data(void *spdm_context, libspdm_data_type_t data_t
670670
context->local_context.local_public_key_provision_size = data_size;
671671
context->local_context.local_public_key_provision = data;
672672
break;
673-
case LIBSPDM_DATA_BASIC_MUT_AUTH_REQUESTED:
674-
if (data_size != sizeof(bool)) {
675-
return LIBSPDM_STATUS_INVALID_PARAMETER;
676-
}
677-
if (parameter->location != LIBSPDM_DATA_LOCATION_LOCAL) {
678-
return LIBSPDM_STATUS_INVALID_PARAMETER;
679-
}
680-
mut_auth_requested = *(const uint8_t *)data;
681-
if (((mut_auth_requested != 0) && (mut_auth_requested != 1))) {
682-
return LIBSPDM_STATUS_INVALID_PARAMETER;
683-
}
684-
context->local_context.basic_mut_auth_requested = mut_auth_requested;
685-
context->encap_context.request_id = 0;
686-
slot_id = parameter->additional_data[0];
687-
if ((slot_id >= SPDM_MAX_SLOT_COUNT) && (slot_id != 0xFF)) {
688-
return LIBSPDM_STATUS_INVALID_PARAMETER;
689-
}
690-
context->encap_context.req_slot_id = slot_id;
691-
692-
#if LIBSPDM_DEBUG_PRINT_ENABLE
693-
if (mut_auth_requested) {
694-
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,
695-
"Basic mutual authentication is a deprecated feature.\n"));
696-
}
697-
#endif /* LIBSPDM_DEBUG_PRINT_ENABLE */
698-
break;
699673
case LIBSPDM_DATA_MUT_AUTH_REQUESTED:
700674
if (data_size != sizeof(uint8_t)) {
701675
return LIBSPDM_STATUS_INVALID_PARAMETER;

‎library/spdm_responder_lib/libspdm_rsp_challenge_auth.c‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,8 @@ libspdm_return_t libspdm_get_response_challenge_auth(libspdm_context_t *spdm_con
164164
spdm_response->header.spdm_version = spdm_request->header.spdm_version;
165165
spdm_response->header.request_response_code = SPDM_CHALLENGE_AUTH;
166166
auth_attribute = (uint8_t)(slot_id & 0xF);
167+
168+
#if LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP
167169
if (spdm_request->header.spdm_version >= SPDM_MESSAGE_VERSION_11) {
168170
if (libspdm_is_capabilities_flag_supported(
169171
spdm_context, false,
@@ -178,22 +180,19 @@ libspdm_return_t libspdm_get_response_challenge_auth(libspdm_context_t *spdm_con
178180
libspdm_is_capabilities_flag_supported(
179181
spdm_context, false,
180182
SPDM_GET_CAPABILITIES_REQUEST_FLAGS_PUB_KEY_ID_CAP, 0))) {
181-
if (spdm_context->local_context.basic_mut_auth_requested) {
182-
auth_attribute =
183-
(uint8_t)(auth_attribute |
184-
SPDM_CHALLENGE_AUTH_RESPONSE_ATTRIBUTE_BASIC_MUT_AUTH_REQ);
183+
if (libspdm_challenge_start_mut_auth(spdm_context,
184+
spdm_context->connection_info.version,
185+
slot_id,
186+
request_context_size,
187+
request_context)) {
188+
auth_attribute |= SPDM_CHALLENGE_AUTH_RESPONSE_ATTRIBUTE_BASIC_MUT_AUTH_REQ;
189+
libspdm_init_basic_mut_auth_encap_state(spdm_context);
190+
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO,
191+
"Basic mutual authentication is a deprecated feature.\n"));
185192
}
186193
}
187-
if ((auth_attribute & SPDM_CHALLENGE_AUTH_RESPONSE_ATTRIBUTE_BASIC_MUT_AUTH_REQ) != 0) {
188-
#if (LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP) && (LIBSPDM_SEND_CHALLENGE_SUPPORT)
189-
libspdm_init_basic_mut_auth_encap_state(spdm_context);
190-
#else
191-
auth_attribute =
192-
(uint8_t)(auth_attribute &
193-
~SPDM_CHALLENGE_AUTH_RESPONSE_ATTRIBUTE_BASIC_MUT_AUTH_REQ);
194-
#endif
195-
}
196194
}
195+
#endif /* LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP */
197196

198197
spdm_response->header.param1 = auth_attribute;
199198

‎os_stub/spdm_device_secret_lib_null/lib.c‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,7 @@ bool libspdm_challenge_opaque_data(
7777
{
7878
return false;
7979
}
80-
#endif /* LIBSPDM_ENABLE_CAPABILITY_CHAL_CAP */
8180

82-
#if LIBSPDM_ENABLE_CAPABILITY_CHAL_CAP
8381
bool libspdm_encap_challenge_opaque_data(
8482
void *spdm_context,
8583
spdm_version_number_t spdm_version,
@@ -91,6 +89,18 @@ bool libspdm_encap_challenge_opaque_data(
9189
{
9290
return false;
9391
}
92+
93+
#if LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP
94+
bool libspdm_challenge_start_mut_auth(
95+
void *spdm_context,
96+
spdm_version_number_t spdm_version,
97+
uint8_t slot_id,
98+
size_t request_context_size,
99+
const void *request_context)
100+
{
101+
return false;
102+
}
103+
#endif /* LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP */
94104
#endif /* LIBSPDM_ENABLE_CAPABILITY_CHAL_CAP */
95105

96106
#if LIBSPDM_ENABLE_CAPABILITY_MEL_CAP

‎os_stub/spdm_device_secret_lib_sample/chal.c‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
size_t libspdm_secret_lib_challenge_opaque_data_size;
2323
bool g_check_challenge_request_context = false;
2424
uint64_t g_challenge_request_context;
25+
bool g_start_basic_mut_auth = false;
2526

2627
bool libspdm_challenge_opaque_data(
2728
void *spdm_context,
@@ -88,4 +89,16 @@ bool libspdm_encap_challenge_opaque_data(
8889

8990
return true;
9091
}
92+
93+
#if LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP
94+
bool libspdm_challenge_start_mut_auth(
95+
void *spdm_context,
96+
spdm_version_number_t spdm_version,
97+
uint8_t slot_id,
98+
size_t request_context_size,
99+
const void *request_context)
100+
{
101+
return g_start_basic_mut_auth;
102+
}
103+
#endif /* LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP */
91104
#endif /* LIBSPDM_ENABLE_CAPABILITY_CHAL_CAP */

‎unit_test/fuzzing/test_responder/test_spdm_responder_challenge_auth/challenge_auth.c‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ libspdm_test_context_t m_libspdm_responder_challenge_test_context = {
2222
};
2323

2424
extern size_t libspdm_secret_lib_challenge_opaque_data_size;
25+
extern bool g_start_basic_mut_auth;
2526

2627
void libspdm_test_responder_challenge_case1(void **State)
2728
{
@@ -175,12 +176,13 @@ void libspdm_test_responder_challenge_case4(void **State)
175176
spdm_context->local_context.local_cert_chain_provision_size[0] = data_size;
176177

177178
libspdm_secret_lib_challenge_opaque_data_size = 0;
178-
spdm_context->local_context.basic_mut_auth_requested = 1;
179+
g_start_basic_mut_auth = true;
179180
response_size = sizeof(response);
180181
libspdm_reset_message_c(spdm_context);
181182
libspdm_get_response_challenge_auth(spdm_context, spdm_test_context->test_buffer_size,
182183
spdm_test_context->test_buffer, &response_size, response);
183184
free(data);
185+
g_start_basic_mut_auth = false;
184186
}
185187

186188
void libspdm_test_responder_challenge_case5(void **State)
@@ -259,12 +261,13 @@ void libspdm_test_responder_challenge_case6(void **State)
259261
spdm_context->local_context.local_cert_chain_provision_size[0] = data_size;
260262

261263
libspdm_secret_lib_challenge_opaque_data_size = 0;
262-
spdm_context->local_context.basic_mut_auth_requested = 1;
263264
response_size = sizeof(response);
264265
libspdm_reset_message_c(spdm_context);
266+
g_start_basic_mut_auth = true;
265267
libspdm_get_response_challenge_auth(spdm_context, spdm_test_context->test_buffer_size,
266268
spdm_test_context->test_buffer, &response_size, response);
267269
free(data);
270+
g_start_basic_mut_auth = false;
268271
}
269272

270273
void libspdm_test_responder_challenge_case7(void **State)

0 commit comments

Comments
 (0)