LCOV - code coverage report
Current view: top level - library/spdm_responder_lib - libspdm_rsp_psk_finish.c (source / functions) Coverage Total Hit
Test: coverage.info Lines: 78.4 % 102 80
Test Date: 2025-08-24 08:11:14 Functions: 100.0 % 2 2

            Line data    Source code
       1              : /**
       2              :  *  Copyright Notice:
       3              :  *  Copyright 2021-2025 DMTF. All rights reserved.
       4              :  *  License: BSD 3-Clause License. For full text see link: https://github.com/DMTF/libspdm/blob/main/LICENSE.md
       5              :  **/
       6              : 
       7              : #include "internal/libspdm_responder_lib.h"
       8              : #include "internal/libspdm_secured_message_lib.h"
       9              : 
      10              : #if LIBSPDM_ENABLE_CAPABILITY_PSK_CAP
      11              : 
      12            7 : bool libspdm_verify_psk_finish_req_hmac(libspdm_context_t *spdm_context,
      13              :                                         libspdm_session_info_t *session_info,
      14              :                                         const uint8_t *hmac, size_t hmac_size)
      15              : {
      16              :     uint8_t hmac_data[LIBSPDM_MAX_HASH_SIZE];
      17              :     size_t hash_size;
      18              :     bool result;
      19              : #if LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT
      20              :     uint8_t *th_curr_data;
      21              :     size_t th_curr_data_size;
      22              :     libspdm_th_managed_buffer_t th_curr;
      23              :     uint8_t hash_data[LIBSPDM_MAX_HASH_SIZE];
      24              : #endif
      25              : 
      26            7 :     hash_size = libspdm_get_hash_size(spdm_context->connection_info.algorithm.base_hash_algo);
      27            7 :     LIBSPDM_ASSERT(hmac_size == hash_size);
      28              : 
      29              : #if LIBSPDM_RECORD_TRANSCRIPT_DATA_SUPPORT
      30              :     result = libspdm_calculate_th_for_finish(spdm_context, session_info, NULL,
      31              :                                              0, NULL, 0, &th_curr);
      32              :     if (!result) {
      33              :         return false;
      34              :     }
      35              :     th_curr_data = libspdm_get_managed_buffer(&th_curr);
      36              :     th_curr_data_size = libspdm_get_managed_buffer_size(&th_curr);
      37              : 
      38              :     result = libspdm_hash_all (spdm_context->connection_info.algorithm.base_hash_algo,
      39              :                                th_curr_data, th_curr_data_size, hash_data);
      40              :     if (!result) {
      41              :         return false;
      42              :     }
      43              : 
      44              :     result = libspdm_hmac_all_with_request_finished_key(
      45              :         session_info->secured_message_context, hash_data,
      46              :         hash_size, hmac_data);
      47              :     if (!result) {
      48              :         return false;
      49              :     }
      50              : #else
      51            7 :     result = libspdm_calculate_th_hmac_for_finish_req(
      52              :         spdm_context, session_info, &hash_size, hmac_data);
      53            7 :     if (!result) {
      54            0 :         return false;
      55              :     }
      56              : #endif
      57            7 :     LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "Calc th_curr hmac - "));
      58            7 :     LIBSPDM_INTERNAL_DUMP_DATA(hmac_data, hash_size);
      59            7 :     LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "\n"));
      60              : 
      61            7 :     if (!libspdm_consttime_is_mem_equal(hmac, hmac_data, hash_size)) {
      62            2 :         LIBSPDM_DEBUG((LIBSPDM_DEBUG_ERROR, "!!! verify_psk_finish_req_hmac - FAIL !!!\n"));
      63            2 :         return false;
      64              :     }
      65            5 :     LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "!!! verify_psk_finish_req_hmac - PASS !!!\n"));
      66            5 :     return true;
      67              : }
      68              : 
      69           16 : libspdm_return_t libspdm_get_response_psk_finish(libspdm_context_t *spdm_context,
      70              :                                                  size_t request_size,
      71              :                                                  const void *request,
      72              :                                                  size_t *response_size,
      73              :                                                  void *response)
      74              : {
      75              :     uint32_t session_id;
      76              :     bool result;
      77              :     uint32_t hmac_size;
      78              :     spdm_psk_finish_response_t *spdm_response;
      79              :     libspdm_session_info_t *session_info;
      80              :     uint8_t th2_hash_data[LIBSPDM_MAX_HASH_SIZE];
      81              :     const spdm_psk_finish_request_t *spdm_request;
      82              :     libspdm_return_t status;
      83              :     libspdm_session_state_t session_state;
      84              :     uint8_t *ptr;
      85              :     size_t opaque_data_entry_size;
      86              :     size_t opaque_data_size;
      87              : 
      88           16 :     spdm_request = request;
      89              : 
      90              :     /* -=[Check Parameters Phase]=- */
      91           16 :     LIBSPDM_ASSERT(spdm_request->header.request_response_code == SPDM_PSK_FINISH);
      92              : 
      93           16 :     if (libspdm_get_connection_version(spdm_context) < SPDM_MESSAGE_VERSION_11) {
      94            0 :         return libspdm_generate_error_response(spdm_context,
      95              :                                                SPDM_ERROR_CODE_UNSUPPORTED_REQUEST,
      96              :                                                SPDM_PSK_FINISH,
      97              :                                                response_size, response);
      98              :     }
      99              : 
     100           16 :     if (spdm_request->header.spdm_version != libspdm_get_connection_version(spdm_context)) {
     101            0 :         return libspdm_generate_error_response(spdm_context,
     102              :                                                SPDM_ERROR_CODE_VERSION_MISMATCH, 0,
     103              :                                                response_size, response);
     104              :     }
     105           16 :     if (spdm_context->response_state != LIBSPDM_RESPONSE_STATE_NORMAL) {
     106            3 :         return libspdm_responder_handle_response_state(
     107              :             spdm_context,
     108            3 :             spdm_request->header.request_response_code,
     109              :             response_size, response);
     110              :     }
     111           13 :     if (!libspdm_is_capabilities_flag_supported(
     112              :             spdm_context, false,
     113              :             SPDM_GET_CAPABILITIES_REQUEST_FLAGS_PSK_CAP,
     114              :             SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_PSK_CAP_RESPONDER_WITH_CONTEXT)) {
     115            1 :         return libspdm_generate_error_response(
     116              :             spdm_context, SPDM_ERROR_CODE_UNSUPPORTED_REQUEST,
     117              :             SPDM_PSK_FINISH, response_size, response);
     118              :     }
     119           12 :     if (spdm_context->connection_info.connection_state < LIBSPDM_CONNECTION_STATE_NEGOTIATED) {
     120            1 :         return libspdm_generate_error_response(spdm_context,
     121              :                                                SPDM_ERROR_CODE_UNEXPECTED_REQUEST,
     122              :                                                0, response_size, response);
     123              :     }
     124              : 
     125           11 :     if (!spdm_context->last_spdm_request_session_id_valid) {
     126            0 :         if (libspdm_get_connection_version(spdm_context) >= SPDM_MESSAGE_VERSION_12) {
     127            0 :             return libspdm_generate_error_response(spdm_context,
     128              :                                                    SPDM_ERROR_CODE_SESSION_REQUIRED, 0,
     129              :                                                    response_size, response);
     130              :         } else {
     131            0 :             return libspdm_generate_error_response(spdm_context,
     132              :                                                    SPDM_ERROR_CODE_UNSPECIFIED, 0,
     133              :                                                    response_size, response);
     134              :         }
     135              :     }
     136           11 :     session_id = spdm_context->last_spdm_request_session_id;
     137              :     session_info =
     138           11 :         libspdm_get_session_info_via_session_id(spdm_context, session_id);
     139           11 :     if (session_info == NULL) {
     140            0 :         if (libspdm_get_connection_version(spdm_context) >= SPDM_MESSAGE_VERSION_12) {
     141            0 :             return libspdm_generate_error_response(spdm_context,
     142              :                                                    SPDM_ERROR_CODE_SESSION_REQUIRED, 0,
     143              :                                                    response_size, response);
     144              :         } else {
     145            0 :             return libspdm_generate_error_response(spdm_context,
     146              :                                                    SPDM_ERROR_CODE_UNSPECIFIED, 0,
     147              :                                                    response_size, response);
     148              :         }
     149              :     }
     150           11 :     if (!session_info->use_psk) {
     151            0 :         return libspdm_generate_error_response(spdm_context,
     152              :                                                SPDM_ERROR_CODE_UNEXPECTED_REQUEST, 0,
     153              :                                                response_size, response);
     154              :     }
     155           11 :     session_state = libspdm_secured_message_get_session_state(
     156              :         session_info->secured_message_context);
     157           11 :     if (session_state != LIBSPDM_SESSION_STATE_HANDSHAKING) {
     158            1 :         return libspdm_generate_error_response(spdm_context,
     159              :                                                SPDM_ERROR_CODE_UNEXPECTED_REQUEST, 0,
     160              :                                                response_size, response);
     161              :     }
     162              : 
     163              :     /* remove HMAC*/
     164           10 :     hmac_size = libspdm_get_hash_size(
     165              :         spdm_context->connection_info.algorithm.base_hash_algo);
     166              : 
     167           10 :     ptr = (uint8_t *)(size_t)spdm_request + sizeof(spdm_psk_finish_request_t);
     168           10 :     if (libspdm_get_connection_version(spdm_context) >= SPDM_MESSAGE_VERSION_14) {
     169            1 :         opaque_data_size = libspdm_read_uint16((const uint8_t *)request +
     170              :                                                sizeof(spdm_psk_finish_request_t));
     171            1 :         ptr += sizeof(uint16_t);
     172            1 :         if (request_size < sizeof(spdm_psk_finish_request_t) +
     173            1 :             sizeof(uint16_t) + opaque_data_size) {
     174            0 :             return libspdm_generate_error_response(spdm_context,
     175              :                                                    SPDM_ERROR_CODE_INVALID_REQUEST, 0,
     176              :                                                    response_size, response);
     177              :         }
     178            1 :         ptr += opaque_data_size;
     179            1 :         opaque_data_entry_size = sizeof(uint16_t) + opaque_data_size;
     180              :     } else {
     181            9 :         opaque_data_entry_size = 0;
     182              :     }
     183              : 
     184              :     /* this message can only be in secured session
     185              :      * thus don't need to consider transport layer padding, just check its exact size */
     186           10 :     if (request_size != sizeof(spdm_psk_finish_request_t) + opaque_data_entry_size + hmac_size) {
     187            3 :         return libspdm_generate_error_response(spdm_context,
     188              :                                                SPDM_ERROR_CODE_INVALID_REQUEST, 0,
     189              :                                                response_size, response);
     190              :     }
     191              : 
     192            7 :     libspdm_reset_message_buffer_via_request_code(spdm_context, session_info,
     193            7 :                                                   spdm_request->header.request_response_code);
     194              : 
     195            7 :     status = libspdm_append_message_f(spdm_context, session_info, false, request,
     196              :                                       request_size - hmac_size);
     197            7 :     if (LIBSPDM_STATUS_IS_ERROR(status)) {
     198            0 :         return libspdm_generate_error_response(spdm_context,
     199              :                                                SPDM_ERROR_CODE_UNSPECIFIED, 0,
     200              :                                                response_size, response);
     201              :     }
     202              : 
     203            7 :     result = libspdm_verify_psk_finish_req_hmac(
     204              :         spdm_context, session_info,
     205              :         ptr, hmac_size);
     206            7 :     if (!result) {
     207            2 :         if ((spdm_context->handle_error_return_policy &
     208              :              LIBSPDM_DATA_HANDLE_ERROR_RETURN_POLICY_DROP_ON_DECRYPT_ERROR) == 0) {
     209            2 :             return libspdm_generate_error_response(
     210              :                 spdm_context, SPDM_ERROR_CODE_DECRYPT_ERROR, 0,
     211              :                 response_size, response);
     212              :         } else {
     213              :             /**
     214              :              * just ignore this message
     215              :              * return UNSUPPORTED and clear response_size to continue the dispatch without send response
     216              :              **/
     217            0 :             *response_size = 0;
     218            0 :             return LIBSPDM_STATUS_UNSUPPORTED_CAP;
     219              :         }
     220              :     }
     221            5 :     status = libspdm_append_message_f(
     222              :         spdm_context, session_info, false,
     223              :         ptr, hmac_size);
     224            5 :     if (LIBSPDM_STATUS_IS_ERROR(status)) {
     225            0 :         return libspdm_generate_error_response(spdm_context,
     226              :                                                SPDM_ERROR_CODE_UNSPECIFIED, 0,
     227              :                                                response_size, response);
     228              :     }
     229              : 
     230            5 :     if (libspdm_get_connection_version(spdm_context) >= SPDM_MESSAGE_VERSION_14) {
     231            1 :         opaque_data_entry_size = sizeof(uint16_t);
     232              :     } else {
     233            4 :         opaque_data_entry_size = 0;
     234              :     }
     235              : 
     236            5 :     LIBSPDM_ASSERT(*response_size >= sizeof(spdm_psk_finish_response_t) + opaque_data_entry_size);
     237            5 :     *response_size = sizeof(spdm_psk_finish_response_t) + opaque_data_entry_size;
     238            5 :     libspdm_zero_mem(response, *response_size);
     239            5 :     spdm_response = response;
     240              : 
     241            5 :     spdm_response->header.spdm_version = spdm_request->header.spdm_version;
     242            5 :     spdm_response->header.request_response_code = SPDM_PSK_FINISH_RSP;
     243            5 :     spdm_response->header.param1 = 0;
     244            5 :     spdm_response->header.param2 = 0;
     245              : 
     246            5 :     ptr = (uint8_t *)spdm_response + sizeof(spdm_finish_response_t);
     247            5 :     if (libspdm_get_connection_version(spdm_context) >= SPDM_MESSAGE_VERSION_14) {
     248            1 :         opaque_data_size = 0;
     249            1 :         libspdm_write_uint16(ptr, (uint16_t)opaque_data_size);
     250            1 :         ptr += sizeof(uint16_t);
     251              :     }
     252              : 
     253            5 :     status = libspdm_append_message_f(spdm_context, session_info, false, spdm_response,
     254              :                                       *response_size);
     255            5 :     if (LIBSPDM_STATUS_IS_ERROR(status)) {
     256            0 :         return libspdm_generate_error_response(spdm_context,
     257              :                                                SPDM_ERROR_CODE_UNSPECIFIED, 0,
     258              :                                                response_size, response);
     259              :     }
     260              : 
     261            5 :     LIBSPDM_DEBUG((LIBSPDM_DEBUG_INFO, "libspdm_generate_session_data_key[%x]\n", session_id));
     262            5 :     result = libspdm_calculate_th2_hash(spdm_context, session_info, false,
     263              :                                         th2_hash_data);
     264            5 :     if (!result) {
     265            0 :         return libspdm_generate_error_response(spdm_context,
     266              :                                                SPDM_ERROR_CODE_UNSPECIFIED, 0,
     267              :                                                response_size, response);
     268              :     }
     269            5 :     result = libspdm_generate_session_data_key(
     270              :         session_info->secured_message_context, th2_hash_data);
     271            5 :     if (!result) {
     272            0 :         return libspdm_generate_error_response(spdm_context,
     273              :                                                SPDM_ERROR_CODE_UNSPECIFIED, 0,
     274              :                                                response_size, response);
     275              :     }
     276              : 
     277              :     #if LIBSPDM_ENABLE_CAPABILITY_HBEAT_CAP
     278            5 :     if (libspdm_is_capabilities_flag_supported(
     279              :             spdm_context, false,
     280              :             SPDM_GET_CAPABILITIES_REQUEST_FLAGS_HBEAT_CAP,
     281              :             SPDM_GET_CAPABILITIES_RESPONSE_FLAGS_HBEAT_CAP)) {
     282            0 :         result = libspdm_start_watchdog(
     283            0 :             session_id, spdm_context->local_context.heartbeat_period * 2);
     284            0 :         if (!result) {
     285            0 :             return libspdm_generate_error_response(spdm_context,
     286              :                                                    SPDM_ERROR_CODE_UNSPECIFIED, 0,
     287              :                                                    response_size, response);
     288              :         }
     289              :     }
     290              :     #endif /* LIBSPDM_ENABLE_CAPABILITY_HBEAT_CAP */
     291              : 
     292            5 :     return LIBSPDM_STATUS_SUCCESS;
     293              : }
     294              : 
     295              : #endif /* LIBSPDM_ENABLE_CAPABILITY_PSK_CAP */
        

Generated by: LCOV version 2.0-1