Skip to content

Commit 4a7836c

Browse files
steven-bellocksteven-bellock
committed
Refactor Responder's key exchange code
Refactor the code so that it is easier to read. Signed-off-by: Steven Bellock <sbellock@nvidia.com>
1 parent 582df76 commit 4a7836c

File tree

2 files changed

+42
-64
lines changed

2 files changed

+42
-64
lines changed

‎library/spdm_responder_lib/libspdm_rsp_finish.c

+14-21
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ bool libspdm_verify_finish_req_hmac(libspdm_context_t *spdm_context,
2626
size_t th_curr_data_size;
2727
libspdm_th_managed_buffer_t th_curr;
2828
uint8_t hash_data[LIBSPDM_MAX_HASH_SIZE];
29-
#endif
29+
#endif /* LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT */
3030

3131
hash_size = libspdm_get_hash_size(spdm_context->connection_info.algorithm.base_hash_algo);
3232
LIBSPDM_ASSERT(hmac_size == hash_size);
@@ -80,8 +80,7 @@ bool libspdm_verify_finish_req_hmac(libspdm_context_t *spdm_context,
8080
}
8181

8282
result = libspdm_hmac_all_with_request_finished_key(
83-
session_info->secured_message_context, hash_data,
84-
hash_size, hmac_data);
83+
session_info->secured_message_context, hash_data, hash_size, hmac_data);
8584
if (!result) {
8685
return false;
8786
}
@@ -91,7 +90,7 @@ bool libspdm_verify_finish_req_hmac(libspdm_context_t *spdm_context,
9190
if (!result) {
9291
return false;
9392
}
94-
#endif
93+
#endif /* LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT */
9594
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "th_curr hmac - "));
9695
LIBSPDM_INTERNAL_DUMP_DATA(hmac_data, hash_size);
9796
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "\n"));
@@ -187,7 +186,7 @@ bool libspdm_verify_finish_req_signature(libspdm_context_t *spdm_context,
187186
if (!result) {
188187
return false;
189188
}
190-
#endif
189+
#endif /* LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT */
191190
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "th_curr hash - "));
192191
LIBSPDM_INTERNAL_DUMP_DATA(hash_data, hash_size);
193192
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "\n"));
@@ -256,7 +255,7 @@ bool libspdm_verify_finish_req_signature(libspdm_context_t *spdm_context,
256255
if (slot_id == 0xFF) {
257256
libspdm_req_asym_free(spdm_context->connection_info.algorithm.req_base_asym_alg, context);
258257
}
259-
#endif
258+
#endif /* LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT */
260259

261260
if (!result) {
262261
LIBSPDM_DEBUG((LIBSPDM_DEBUG_ERROR, "!!! VerifyFinishSignature - FAIL !!!\n"));
@@ -266,7 +265,7 @@ bool libspdm_verify_finish_req_signature(libspdm_context_t *spdm_context,
266265

267266
return true;
268267
}
269-
#endif
268+
#endif /* LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP */
270269

271270
bool libspdm_generate_finish_rsp_hmac(libspdm_context_t *spdm_context,
272271
libspdm_session_info_t *session_info,
@@ -338,8 +337,7 @@ bool libspdm_generate_finish_rsp_hmac(libspdm_context_t *spdm_context,
338337
}
339338

340339
result = libspdm_hmac_all_with_response_finished_key(
341-
session_info->secured_message_context, hash_data,
342-
hash_size, hmac_data);
340+
session_info->secured_message_context, hash_data, hash_size, hmac_data);
343341
if (!result) {
344342
return false;
345343
}
@@ -486,19 +484,17 @@ libspdm_return_t libspdm_get_response_finish(libspdm_context_t *spdm_context, si
486484
signature_size = libspdm_get_req_asym_signature_size(
487485
spdm_context->connection_info.algorithm.req_base_asym_alg);
488486
}
489-
#endif
487+
#endif /* LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP */
490488

491-
if (request_size <
492-
sizeof(spdm_finish_request_t) + signature_size + hmac_size) {
489+
if (request_size < sizeof(spdm_finish_request_t) + signature_size + hmac_size) {
493490
return libspdm_generate_error_response(spdm_context,
494491
SPDM_ERROR_CODE_INVALID_REQUEST, 0,
495492
response_size, response);
496493
}
497494

498495
if ((spdm_request->header.param1 & SPDM_FINISH_REQUEST_ATTRIBUTES_SIGNATURE_INCLUDED) != 0) {
499496
req_slot_id = spdm_request->header.param2;
500-
if ((req_slot_id != 0xFF) &&
501-
(req_slot_id >= SPDM_MAX_SLOT_COUNT)) {
497+
if ((req_slot_id != 0xFF) && (req_slot_id >= SPDM_MAX_SLOT_COUNT)) {
502498
return libspdm_generate_error_response(spdm_context,
503499
SPDM_ERROR_CODE_INVALID_REQUEST, 0,
504500
response_size, response);
@@ -552,15 +548,14 @@ libspdm_return_t libspdm_get_response_finish(libspdm_context_t *spdm_context, si
552548
}
553549
status = libspdm_append_message_f(
554550
spdm_context, session_info, false,
555-
(const uint8_t *)request + sizeof(spdm_finish_request_t),
556-
signature_size);
551+
(const uint8_t *)request + sizeof(spdm_finish_request_t), signature_size);
557552
if (LIBSPDM_STATUS_IS_ERROR(status)) {
558553
return libspdm_generate_error_response(
559554
spdm_context, SPDM_ERROR_CODE_UNSPECIFIED,
560555
0, response_size, response);
561556
}
562557
}
563-
#endif
558+
#endif /* LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP */
564559

565560
result = libspdm_verify_finish_req_hmac(
566561
spdm_context, session_info, (const uint8_t *)request + signature_size +
@@ -621,8 +616,7 @@ libspdm_return_t libspdm_get_response_finish(libspdm_context_t *spdm_context, si
621616
SPDM_GET_CAPABILITIES_REQUEST_FLAGS_HANDSHAKE_IN_THE_CLEAR_CAP,
622617
SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_HANDSHAKE_IN_THE_CLEAR_CAP)) {
623618
result = libspdm_generate_finish_rsp_hmac(
624-
spdm_context, session_info,
625-
(uint8_t *)spdm_response + sizeof(spdm_finish_request_t));
619+
spdm_context, session_info, (uint8_t *)spdm_response + sizeof(spdm_finish_request_t));
626620
if (!result) {
627621
return libspdm_generate_error_response(
628622
spdm_context,
@@ -632,8 +626,7 @@ libspdm_return_t libspdm_get_response_finish(libspdm_context_t *spdm_context, si
632626

633627
status = libspdm_append_message_f(
634628
spdm_context, session_info, false,
635-
(uint8_t *)spdm_response + sizeof(spdm_finish_request_t),
636-
hmac_size);
629+
(uint8_t *)spdm_response + sizeof(spdm_finish_request_t), hmac_size);
637630
if (LIBSPDM_STATUS_IS_ERROR(status)) {
638631
return libspdm_generate_error_response(
639632
spdm_context, SPDM_ERROR_CODE_UNSPECIFIED,

‎library/spdm_responder_lib/libspdm_rsp_key_exchange.c

+28-43
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* Copyright Notice:
3-
* Copyright 2021-2024 DMTF. All rights reserved.
3+
* Copyright 2021-2025 DMTF. All rights reserved.
44
* License: BSD 3-Clause License. For full text see link: https://github.com/DMTF/libspdm/blob/main/LICENSE.md
55
**/
66

@@ -23,7 +23,7 @@ bool libspdm_generate_key_exchange_rsp_hmac(libspdm_context_t *spdm_context,
2323
size_t th_curr_data_size;
2424
libspdm_th_managed_buffer_t th_curr;
2525
uint8_t hash_data[LIBSPDM_MAX_HASH_SIZE];
26-
#endif
26+
#endif /* LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT */
2727
bool result;
2828

2929
hash_size = libspdm_get_hash_size(spdm_context->connection_info.algorithm.base_hash_algo);
@@ -43,8 +43,7 @@ bool libspdm_generate_key_exchange_rsp_hmac(libspdm_context_t *spdm_context,
4343
}
4444

4545
result = libspdm_calculate_th_for_exchange(
46-
spdm_context, session_info, cert_chain_buffer,
47-
cert_chain_buffer_size, &th_curr);
46+
spdm_context, session_info, cert_chain_buffer, cert_chain_buffer_size, &th_curr);
4847
if (!result) {
4948
return false;
5049
}
@@ -58,8 +57,7 @@ bool libspdm_generate_key_exchange_rsp_hmac(libspdm_context_t *spdm_context,
5857
}
5958

6059
result = libspdm_hmac_all_with_response_finished_key(
61-
session_info->secured_message_context, hash_data,
62-
hash_size, hmac_data);
60+
session_info->secured_message_context, hash_data, hash_size, hmac_data);
6361
if (!result) {
6462
return false;
6563
}
@@ -69,7 +67,7 @@ bool libspdm_generate_key_exchange_rsp_hmac(libspdm_context_t *spdm_context,
6967
if (!result) {
7068
return false;
7169
}
72-
#endif
70+
#endif /* LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT */
7371
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "th_curr hmac - "));
7472
LIBSPDM_INTERNAL_DUMP_DATA(hmac_data, hash_size);
7573
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "\n"));
@@ -91,7 +89,7 @@ bool libspdm_generate_key_exchange_rsp_signature(libspdm_context_t *spdm_context
9189
libspdm_th_managed_buffer_t th_curr;
9290
const uint8_t *cert_chain_buffer;
9391
size_t cert_chain_buffer_size;
94-
#endif
92+
#endif /* LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT */
9593
#if ((LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT) && (LIBSPDM_DEBUG_BLOCK_ENABLE)) || \
9694
!(LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT)
9795
uint8_t hash_data[LIBSPDM_MAX_HASH_SIZE];
@@ -120,8 +118,7 @@ bool libspdm_generate_key_exchange_rsp_signature(libspdm_context_t *spdm_context
120118
}
121119

122120
result = libspdm_calculate_th_for_exchange(
123-
spdm_context, session_info, cert_chain_buffer,
124-
cert_chain_buffer_size, &th_curr);
121+
spdm_context, session_info, cert_chain_buffer, cert_chain_buffer_size, &th_curr);
125122
if (!result) {
126123
return false;
127124
}
@@ -142,7 +139,7 @@ bool libspdm_generate_key_exchange_rsp_signature(libspdm_context_t *spdm_context
142139
if (!result) {
143140
return false;
144141
}
145-
#endif
142+
#endif /* LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT */
146143
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "th_curr hash - "));
147144
LIBSPDM_INTERNAL_DUMP_DATA(hash_data, hash_size);
148145
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "\n"));
@@ -151,7 +148,7 @@ bool libspdm_generate_key_exchange_rsp_signature(libspdm_context_t *spdm_context
151148
result = libspdm_responder_data_sign(
152149
#if LIBSPDM_HAL_PASS_SPDM_CONTEXT
153150
spdm_context,
154-
#endif
151+
#endif /* LIBSPDM_HAL_PASS_SPDM_CONTEXT */
155152
spdm_context->connection_info.version, SPDM_KEY_EXCHANGE_RSP,
156153
spdm_context->connection_info.algorithm.base_asym_algo,
157154
spdm_context->connection_info.algorithm.base_hash_algo,
@@ -160,12 +157,12 @@ bool libspdm_generate_key_exchange_rsp_signature(libspdm_context_t *spdm_context
160157
result = libspdm_responder_data_sign(
161158
#if LIBSPDM_HAL_PASS_SPDM_CONTEXT
162159
spdm_context,
163-
#endif
160+
#endif /* LIBSPDM_HAL_PASS_SPDM_CONTEXT */
164161
spdm_context->connection_info.version, SPDM_KEY_EXCHANGE_RSP,
165162
spdm_context->connection_info.algorithm.base_asym_algo,
166163
spdm_context->connection_info.algorithm.base_hash_algo,
167164
true, hash_data, hash_size, signature, &signature_size);
168-
#endif
165+
#endif /* LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT */
169166
if (result) {
170167
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "signature - "));
171168
LIBSPDM_INTERNAL_DUMP_DATA(signature, signature_size);
@@ -340,8 +337,7 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
340337
SPDM_ERROR_CODE_INVALID_REQUEST,
341338
0, response_size, response);
342339
}
343-
if (request_size < sizeof(spdm_key_exchange_request_t) + dhe_key_size +
344-
sizeof(uint16_t)) {
340+
if (request_size < sizeof(spdm_key_exchange_request_t) + dhe_key_size + sizeof(uint16_t)) {
345341
return libspdm_generate_error_response(spdm_context,
346342
SPDM_ERROR_CODE_INVALID_REQUEST, 0,
347343
response_size, response);
@@ -354,12 +350,12 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
354350
SPDM_ERROR_CODE_INVALID_REQUEST, 0,
355351
response_size, response);
356352
}
357-
request_size = sizeof(spdm_key_exchange_request_t) + dhe_key_size +
358-
sizeof(uint16_t) + opaque_data_length;
353+
request_size = sizeof(spdm_key_exchange_request_t) + dhe_key_size + sizeof(uint16_t) +
354+
opaque_data_length;
359355

360356
if (opaque_data_length != 0) {
361-
cptr = (const uint8_t *)request + sizeof(spdm_key_exchange_request_t) +
362-
dhe_key_size + sizeof(uint16_t);
357+
cptr = (const uint8_t *)request + sizeof(spdm_key_exchange_request_t) + dhe_key_size +
358+
sizeof(uint16_t);
363359
result = libspdm_process_general_opaque_data_check(spdm_context, opaque_data_length, cptr);
364360
if (!result) {
365361
return libspdm_generate_error_response(spdm_context,
@@ -434,8 +430,8 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
434430
}
435431

436432
spdm_response->rsp_session_id = rsp_session_id;
437-
438433
spdm_response->mut_auth_requested = 0;
434+
439435
if (libspdm_is_capabilities_flag_supported(
440436
spdm_context, false,
441437
SPDM_GET_CAPABILITIES_REQUEST_FLAGS_MUT_AUTH_CAP,
@@ -447,12 +443,10 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
447443
#if LIBSPDM_ENABLE_CAPABILITY_MUT_AUTH_CAP
448444
spdm_context->connection_info.peer_used_cert_chain_slot_id =
449445
spdm_context->encap_context.req_slot_id;
450-
libspdm_init_mut_auth_encap_state(
451-
spdm_context, spdm_response->mut_auth_requested);
446+
libspdm_init_mut_auth_encap_state(spdm_context, spdm_response->mut_auth_requested);
452447
if (spdm_response->mut_auth_requested == SPDM_KEY_EXCHANGE_RESPONSE_MUT_AUTH_REQUESTED) {
453448
/* no need to libspdm_init_mut_auth_encap_state() because of no ENCAP message */
454-
spdm_response->req_slot_id_param =
455-
(spdm_context->encap_context.req_slot_id & 0xF);
449+
spdm_response->req_slot_id_param = spdm_context->encap_context.req_slot_id & 0xF;
456450
} else {
457451
/* req_slot_id is always 0 if ENCAP message is needed */
458452
spdm_response->req_slot_id_param = 0;
@@ -484,12 +478,10 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
484478
}
485479

486480
result = libspdm_secured_message_dhe_generate_key(
487-
spdm_context->connection_info.algorithm.dhe_named_group,
488-
dhe_context, ptr, &dhe_key_size);
481+
spdm_context->connection_info.algorithm.dhe_named_group, dhe_context, ptr, &dhe_key_size);
489482
if (!result) {
490483
libspdm_secured_message_dhe_free(
491-
spdm_context->connection_info.algorithm.dhe_named_group,
492-
dhe_context);
484+
spdm_context->connection_info.algorithm.dhe_named_group, dhe_context);
493485
libspdm_free_session_id(spdm_context, session_id);
494486
return libspdm_generate_error_response(spdm_context,
495487
SPDM_ERROR_CODE_UNSPECIFIED, 0,
@@ -509,8 +501,7 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
509501
(const uint8_t *)request + sizeof(spdm_key_exchange_request_t),
510502
dhe_key_size, session_info->secured_message_context);
511503
libspdm_secured_message_dhe_free(
512-
spdm_context->connection_info.algorithm.dhe_named_group,
513-
dhe_context);
504+
spdm_context->connection_info.algorithm.dhe_named_group, dhe_context);
514505
if (!result) {
515506
libspdm_free_session_id(spdm_context, session_id);
516507
return libspdm_generate_error_response(spdm_context,
@@ -523,11 +514,10 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
523514
#if LIBSPDM_ENABLE_CAPABILITY_MEAS_CAP
524515
if (libspdm_is_capabilities_flag_supported(
525516
spdm_context, false, 0, SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_MEAS_CAP)) {
526-
527517
result = libspdm_generate_measurement_summary_hash(
528518
#if LIBSPDM_HAL_PASS_SPDM_CONTEXT
529519
spdm_context,
530-
#endif
520+
#endif /* LIBSPDM_HAL_PASS_SPDM_CONTEXT */
531521
spdm_context->connection_info.version,
532522
spdm_context->connection_info.algorithm.base_hash_algo,
533523
spdm_context->connection_info.algorithm.measurement_spec,
@@ -559,8 +549,7 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
559549
spdm_context->connection_info.local_used_cert_chain_buffer =
560550
spdm_context->local_context.local_cert_chain_provision[slot_id];
561551
spdm_context->connection_info.local_used_cert_chain_buffer_size =
562-
spdm_context->local_context
563-
.local_cert_chain_provision_size[slot_id];
552+
spdm_context->local_context.local_cert_chain_provision_size[slot_id];
564553
}
565554

566555
status = libspdm_append_message_k(spdm_context, session_info, false, request, request_size);
@@ -579,8 +568,7 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
579568
SPDM_ERROR_CODE_UNSPECIFIED, 0,
580569
response_size, response);
581570
}
582-
result = libspdm_generate_key_exchange_rsp_signature(spdm_context,
583-
session_info, ptr);
571+
result = libspdm_generate_key_exchange_rsp_signature(spdm_context, session_info, ptr);
584572
if (!result) {
585573
libspdm_free_session_id(spdm_context, session_id);
586574
return libspdm_generate_error_response(
@@ -596,10 +584,8 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
596584
response_size, response);
597585
}
598586

599-
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "libspdm_generate_session_handshake_key[%x]\n",
600-
session_id));
601-
result = libspdm_calculate_th1_hash(spdm_context, session_info, false,
602-
th1_hash_data);
587+
LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "libspdm_generate_session_handshake_key[%x]\n", session_id));
588+
result = libspdm_calculate_th1_hash(spdm_context, session_info, false, th1_hash_data);
603589
if (!result) {
604590
libspdm_free_session_id(spdm_context, session_id);
605591
return libspdm_generate_error_response(spdm_context,
@@ -621,8 +607,7 @@ libspdm_return_t libspdm_get_response_key_exchange(libspdm_context_t *spdm_conte
621607
spdm_context, false,
622608
SPDM_GET_CAPABILITIES_REQUEST_FLAGS_HANDSHAKE_IN_THE_CLEAR_CAP,
623609
SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_HANDSHAKE_IN_THE_CLEAR_CAP)) {
624-
result = libspdm_generate_key_exchange_rsp_hmac(spdm_context,
625-
session_info, ptr);
610+
result = libspdm_generate_key_exchange_rsp_hmac(spdm_context, session_info, ptr);
626611
if (!result) {
627612
libspdm_free_session_id(spdm_context, session_id);
628613
return libspdm_generate_error_response(

0 commit comments

Comments
 (0)