Skip to content

Commit 5ab43e0

Browse files
bigbrettbigbrett
committed
Add argument allowing client to set key usage flags for certificate cached public keys
1 parent 3f2a62b commit 5ab43e0

File tree

7 files changed

+106
-76
lines changed

7 files changed

+106
-76
lines changed

‎src/wh_client_cert.c‎

Lines changed: 42 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@
3939
/* Helper function to send a certificate verification request */
4040
static int _certVerifyRequest(whClientContext* c, const uint8_t* cert,
4141
uint32_t cert_len, whNvmId trustedRootNvmId,
42-
uint16_t flags, whKeyId keyId);
42+
uint16_t verifyFlags, whNvmFlags cachedKeyFlags,
43+
whKeyId keyId);
4344

4445
/* Helper function to receive a verify response */
4546
static int _certVerifyResponse(whClientContext* c, whKeyId* out_keyId,
@@ -48,7 +49,8 @@ static int _certVerifyResponse(whClientContext* c, whKeyId* out_keyId,
4849
/* Helper function to perform certificate verification */
4950
static int _certVerify(whClientContext* c, const uint8_t* cert,
5051
uint32_t cert_len, whNvmId trustedRootNvmId,
51-
uint16_t flags, whKeyId* inout_keyId, int32_t* out_rc);
52+
uint16_t flags, whNvmFlags cachedKeyFlags,
53+
whKeyId* inout_keyId, int32_t* out_rc);
5254

5355

5456
/* Initialize the certificate manager */
@@ -362,7 +364,8 @@ int wh_Client_CertReadTrusted(whClientContext* c, whNvmId id, uint8_t* cert,
362364
/* Helper function to send a verify request */
363365
static int _certVerifyRequest(whClientContext* c, const uint8_t* cert,
364366
uint32_t cert_len, whNvmId trustedRootNvmId,
365-
uint16_t flags, whKeyId keyId)
367+
uint16_t verifyFlags, whNvmFlags cachedKeyFlags,
368+
whKeyId keyId)
366369
{
367370
whMessageCert_VerifyRequest req = {0};
368371
uint8_t buffer[WOLFHSM_CFG_COMM_DATA_LEN] = {0};
@@ -377,7 +380,8 @@ static int _certVerifyRequest(whClientContext* c, const uint8_t* cert,
377380
/* Prepare request */
378381
req.cert_len = cert_len;
379382
req.trustedRootNvmId = trustedRootNvmId;
380-
req.flags = flags;
383+
req.flags = verifyFlags;
384+
req.cachedKeyFlags = cachedKeyFlags;
381385
req.keyId = keyId;
382386

383387
/* Copy request struct and certificate data */
@@ -427,7 +431,8 @@ static int _certVerifyResponse(whClientContext* c, whKeyId* out_keyId,
427431

428432
static int _certVerify(whClientContext* c, const uint8_t* cert,
429433
uint32_t cert_len, whNvmId trustedRootNvmId,
430-
uint16_t flags, whKeyId* inout_keyId, int32_t* out_rc)
434+
uint16_t flags, whNvmFlags cachedKeyFlags,
435+
whKeyId* inout_keyId, int32_t* out_rc)
431436
{
432437
int rc = 0;
433438
whKeyId keyId = WH_KEYID_ERASED;
@@ -442,7 +447,7 @@ static int _certVerify(whClientContext* c, const uint8_t* cert,
442447

443448
do {
444449
rc = _certVerifyRequest(c, cert, cert_len, trustedRootNvmId, flags,
445-
keyId);
450+
cachedKeyFlags, keyId);
446451
} while (rc == WH_ERROR_NOTREADY);
447452

448453
if (rc == 0) {
@@ -458,7 +463,8 @@ int wh_Client_CertVerifyRequest(whClientContext* c, const uint8_t* cert,
458463
uint32_t cert_len, whNvmId trustedRootNvmId)
459464
{
460465
return _certVerifyRequest(c, cert, cert_len, trustedRootNvmId,
461-
WH_CERT_FLAGS_NONE, WH_KEYID_ERASED);
466+
WH_CERT_FLAGS_NONE, WH_NVM_FLAGS_USAGE_ANY,
467+
WH_KEYID_ERASED);
462468
}
463469

464470
int wh_Client_CertVerifyResponse(whClientContext* c, int32_t* out_rc)
@@ -471,17 +477,16 @@ int wh_Client_CertVerify(whClientContext* c, const uint8_t* cert,
471477
int32_t* out_rc)
472478
{
473479
return _certVerify(c, cert, cert_len, trustedRootNvmId, WH_CERT_FLAGS_NONE,
474-
NULL, out_rc);
480+
WH_NVM_FLAGS_USAGE_ANY, NULL, out_rc);
475481
}
476482

477-
int wh_Client_CertVerifyAndCacheLeafPubKeyRequest(whClientContext* c,
478-
const uint8_t* cert,
479-
uint32_t cert_len,
480-
whNvmId trustedRootNvmId,
481-
whKeyId keyId)
483+
int wh_Client_CertVerifyAndCacheLeafPubKeyRequest(
484+
whClientContext* c, const uint8_t* cert, uint32_t cert_len,
485+
whNvmId trustedRootNvmId, whNvmFlags cachedKeyFlags, whKeyId keyId)
482486
{
483487
return _certVerifyRequest(c, cert, cert_len, trustedRootNvmId,
484-
WH_CERT_FLAGS_CACHE_LEAF_PUBKEY, keyId);
488+
WH_CERT_FLAGS_CACHE_LEAF_PUBKEY, cachedKeyFlags,
489+
keyId);
485490
}
486491

487492
int wh_Client_CertVerifyAndCacheLeafPubKeyResponse(whClientContext* c,
@@ -494,10 +499,12 @@ int wh_Client_CertVerifyAndCacheLeafPubKeyResponse(whClientContext* c,
494499

495500
int wh_Client_CertVerifyAndCacheLeafPubKey(
496501
whClientContext* c, const uint8_t* cert, uint32_t cert_len,
497-
whNvmId trustedRootNvmId, whKeyId* inout_keyId, int32_t* out_rc)
502+
whNvmId trustedRootNvmId, whNvmFlags cachedKeyFlags, whKeyId* inout_keyId,
503+
int32_t* out_rc)
498504
{
499505
return _certVerify(c, cert, cert_len, trustedRootNvmId,
500-
WH_CERT_FLAGS_CACHE_LEAF_PUBKEY, inout_keyId, out_rc);
506+
WH_CERT_FLAGS_CACHE_LEAF_PUBKEY, cachedKeyFlags,
507+
inout_keyId, out_rc);
501508
}
502509

503510
#ifdef WOLFHSM_CFG_DMA
@@ -658,7 +665,8 @@ int wh_Client_CertReadTrustedDma(whClientContext* c, whNvmId id, void* cert,
658665

659666
static int _certVerifyDmaRequest(whClientContext* c, const void* cert,
660667
uint32_t cert_len, whNvmId trustedRootNvmId,
661-
uint16_t flags, whKeyId keyId)
668+
uint16_t flags, whNvmFlags cachedKeyFlags,
669+
whKeyId keyId)
662670
{
663671
whMessageCert_VerifyDmaRequest req = {0};
664672

@@ -671,6 +679,7 @@ static int _certVerifyDmaRequest(whClientContext* c, const void* cert,
671679
req.cert_len = cert_len;
672680
req.trustedRootNvmId = trustedRootNvmId;
673681
req.flags = flags;
682+
req.cachedKeyFlags = cachedKeyFlags;
674683
req.keyId = keyId;
675684
return wh_Client_SendRequest(c, WH_MESSAGE_GROUP_CERT,
676685
WH_MESSAGE_CERT_ACTION_VERIFY_DMA, sizeof(req),
@@ -713,7 +722,8 @@ static int _certVerifyDmaResponse(whClientContext* c, whKeyId* out_keyId,
713722

714723
static int _certVerifyDma(whClientContext* c, const void* cert,
715724
uint32_t cert_len, whNvmId trustedRootNvmId,
716-
uint16_t flags, whKeyId* inout_keyId, int32_t* out_rc)
725+
uint16_t flags, whNvmFlags cachedKeyFlags,
726+
whKeyId* inout_keyId, int32_t* out_rc)
717727
{
718728
int rc = 0;
719729
whKeyId keyId = WH_KEYID_ERASED;
@@ -731,7 +741,7 @@ static int _certVerifyDma(whClientContext* c, const void* cert,
731741

732742
do {
733743
rc = _certVerifyDmaRequest(c, cert, cert_len, trustedRootNvmId, flags,
734-
keyId);
744+
cachedKeyFlags, keyId);
735745
} while (rc == WH_ERROR_NOTREADY);
736746

737747
if (rc == 0) {
@@ -747,7 +757,8 @@ int wh_Client_CertVerifyDmaRequest(whClientContext* c, const void* cert,
747757
uint32_t cert_len, whNvmId trustedRootNvmId)
748758
{
749759
return _certVerifyDmaRequest(c, cert, cert_len, trustedRootNvmId,
750-
WH_CERT_FLAGS_NONE, WH_KEYID_ERASED);
760+
WH_CERT_FLAGS_NONE, WH_NVM_FLAGS_USAGE_ANY,
761+
WH_KEYID_ERASED);
751762
}
752763

753764
int wh_Client_CertVerifyDmaResponse(whClientContext* c, int32_t* out_rc)
@@ -760,17 +771,17 @@ int wh_Client_CertVerifyDma(whClientContext* c, const void* cert,
760771
int32_t* out_rc)
761772
{
762773
return _certVerifyDma(c, cert, cert_len, trustedRootNvmId,
763-
WH_CERT_FLAGS_NONE, NULL, out_rc);
774+
WH_CERT_FLAGS_NONE, WH_NVM_FLAGS_USAGE_ANY, NULL,
775+
out_rc);
764776
}
765777

766-
int wh_Client_CertVerifyDmaAndCacheLeafPubKeyRequest(whClientContext* c,
767-
const void* cert,
768-
uint32_t cert_len,
769-
whNvmId trustedRootNvmId,
770-
whKeyId keyId)
778+
int wh_Client_CertVerifyDmaAndCacheLeafPubKeyRequest(
779+
whClientContext* c, const void* cert, uint32_t cert_len,
780+
whNvmId trustedRootNvmId, whNvmFlags cachedKeyFlags, whKeyId keyId)
771781
{
772782
return _certVerifyDmaRequest(c, cert, cert_len, trustedRootNvmId,
773-
WH_CERT_FLAGS_CACHE_LEAF_PUBKEY, keyId);
783+
WH_CERT_FLAGS_CACHE_LEAF_PUBKEY,
784+
cachedKeyFlags, keyId);
774785
}
775786

776787
int wh_Client_CertVerifyDmaAndCacheLeafPubKeyResponse(whClientContext* c,
@@ -782,10 +793,12 @@ int wh_Client_CertVerifyDmaAndCacheLeafPubKeyResponse(whClientContext* c,
782793

783794
int wh_Client_CertVerifyDmaAndCacheLeafPubKey(
784795
whClientContext* c, const void* cert, uint32_t cert_len,
785-
whNvmId trustedRootNvmId, whKeyId* inout_keyId, int32_t* out_rc)
796+
whNvmId trustedRootNvmId, whNvmFlags cachedKeyFlags, whKeyId* inout_keyId,
797+
int32_t* out_rc)
786798
{
787799
return _certVerifyDma(c, cert, cert_len, trustedRootNvmId,
788-
WH_CERT_FLAGS_CACHE_LEAF_PUBKEY, inout_keyId, out_rc);
800+
WH_CERT_FLAGS_CACHE_LEAF_PUBKEY, cachedKeyFlags,
801+
inout_keyId, out_rc);
789802
}
790803

791804
#endif /* WOLFHSM_CFG_DMA */

‎src/wh_message_cert.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,8 @@ int wh_MessageCert_TranslateVerifyRequest(
105105
WH_T32(magic, dest, src, cert_len);
106106
WH_T16(magic, dest, src, trustedRootNvmId);
107107
WH_T16(magic, dest, src, flags);
108+
WH_T16(magic, dest, src, cachedKeyFlags);
109+
WH_T16(magic, dest, src, keyId);
108110
return 0;
109111
}
110112

@@ -193,4 +195,4 @@ int wh_MessageCert_TranslateVerifyAcertRequest(
193195
return 0;
194196
}
195197
#endif /* WOLFHSM_CFG_CERTIFICATE_MANAGER_ACERT */
196-
#endif /* WOLFHSM_CFG_CERTIFICATE_MANAGER && !WOLFHSM_CFG_NO_CRYPTO */
198+
#endif /* WOLFHSM_CFG_CERTIFICATE_MANAGER && !WOLFHSM_CFG_NO_CRYPTO */

‎src/wh_server_cert.c‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,9 @@
4646
static int _verifyChainAgainstCmStore(whServerContext* server,
4747
WOLFSSL_CERT_MANAGER* cm,
4848
const uint8_t* chain, uint32_t chain_len,
49-
whCertFlags flags, whKeyId* inout_keyId)
49+
whCertFlags flags,
50+
whNvmFlags cachedKeyFlags,
51+
whKeyId* inout_keyId)
5052
{
5153
int rc = 0;
5254
const uint8_t* cert_ptr = chain;
@@ -133,7 +135,7 @@ static int _verifyChainAgainstCmStore(whServerContext* server,
133135
if (rc == 0) {
134136
const char label[] = "cert_pubkey";
135137
cacheMeta->len = (whNvmSize)cacheBufSize;
136-
cacheMeta->flags = WH_NVM_FLAGS_NONE;
138+
cacheMeta->flags = cachedKeyFlags;
137139
cacheMeta->access = WH_NVM_ACCESS_ANY;
138140
cacheMeta->id = *inout_keyId;
139141
memset(cacheMeta->label, 0,
@@ -258,7 +260,8 @@ int wh_Server_CertReadTrusted(whServerContext* server, whNvmId id,
258260
/* Verify a certificate against trusted certificates */
259261
int wh_Server_CertVerify(whServerContext* server, const uint8_t* cert,
260262
uint32_t cert_len, whNvmId trustedRootNvmId,
261-
whCertFlags flags, whKeyId* inout_keyId)
263+
whCertFlags flags, whNvmFlags cachedKeyFlags,
264+
whKeyId* inout_keyId)
262265
{
263266
WOLFSSL_CERT_MANAGER* cm = NULL;
264267

@@ -293,7 +296,7 @@ int wh_Server_CertVerify(whServerContext* server, const uint8_t* cert,
293296
if (rc == WOLFSSL_SUCCESS) {
294297
/* Verify the certificate */
295298
rc = _verifyChainAgainstCmStore(server, cm, cert, cert_len, flags,
296-
inout_keyId);
299+
cachedKeyFlags, inout_keyId);
297300
if (rc != WH_ERROR_OK) {
298301
rc = WH_ERROR_CERT_VERIFY;
299302
}
@@ -511,7 +514,7 @@ int wh_Server_HandleCertRequest(whServerContext* server, uint16_t magic,
511514
/* Process the verify action */
512515
resp.rc = wh_Server_CertVerify(server, cert_data, req.cert_len,
513516
req.trustedRootNvmId, req.flags,
514-
&keyId);
517+
req.cachedKeyFlags, &keyId);
515518

516519
/* Propagate the keyId back to the client with flags preserved
517520
*/
@@ -641,7 +644,7 @@ int wh_Server_HandleCertRequest(whServerContext* server, uint16_t magic,
641644
/* Process the verify action */
642645
resp.rc = wh_Server_CertVerify(server, cert_data, req.cert_len,
643646
req.trustedRootNvmId, req.flags,
644-
&keyId);
647+
req.cachedKeyFlags, &keyId);
645648

646649
/* Propagate the keyId back to the client with flags preserved
647650
*/

‎test/wh_test_cert.c‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -88,16 +88,16 @@ int whTest_CertServerCfg(whServerConfig* serverCfg)
8888
"Verifying valid single certificate...using intermediate cert\n");
8989
WH_TEST_RETURN_ON_FAIL(wh_Server_CertVerify(
9090
server, INTERMEDIATE_A_CERT, INTERMEDIATE_A_CERT_len, rootCertA,
91-
WH_CERT_FLAGS_NONE, NULL));
91+
WH_CERT_FLAGS_NONE, WH_NVM_FLAGS_USAGE_ANY, NULL));
9292

9393
/* attempt to verify invalid cert (leaf w/o intermediate), should fail */
9494
WH_TEST_DEBUG_PRINT(
9595
"Attempting to verify invalid single certificate...using leaf cert "
9696
"without intermediate\n");
97-
WH_TEST_ASSERT_RETURN(WH_ERROR_CERT_VERIFY ==
98-
wh_Server_CertVerify(server, LEAF_A_CERT,
99-
LEAF_A_CERT_len, rootCertA,
100-
WH_CERT_FLAGS_NONE, NULL));
97+
WH_TEST_ASSERT_RETURN(
98+
WH_ERROR_CERT_VERIFY ==
99+
wh_Server_CertVerify(server, LEAF_A_CERT, LEAF_A_CERT_len, rootCertA,
100+
WH_CERT_FLAGS_NONE, WH_NVM_FLAGS_USAGE_ANY, NULL));
101101

102102
/* attempt to verify invalid cert (intermediate with different root),
103103
* should fail */
@@ -107,30 +107,32 @@ int whTest_CertServerCfg(whServerConfig* serverCfg)
107107
wh_Server_CertVerify(server, INTERMEDIATE_B_CERT,
108108
INTERMEDIATE_B_CERT_len,
109109
rootCertA, WH_CERT_FLAGS_NONE,
110-
NULL));
110+
WH_NVM_FLAGS_USAGE_ANY, NULL));
111111

112112
/* Verify valid chain */
113113
WH_TEST_DEBUG_PRINT("Verifying valid certificate chain...\n");
114-
WH_TEST_RETURN_ON_FAIL(wh_Server_CertVerify(server, RAW_CERT_CHAIN_A,
115-
RAW_CERT_CHAIN_A_len, rootCertA,
116-
WH_CERT_FLAGS_NONE, NULL));
114+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertVerify(
115+
server, RAW_CERT_CHAIN_A, RAW_CERT_CHAIN_A_len, rootCertA,
116+
WH_CERT_FLAGS_NONE, WH_NVM_FLAGS_USAGE_ANY, NULL));
117117

118118
/* Verify valid chain B */
119119
WH_TEST_DEBUG_PRINT("Verifying valid certificate chain B...\n");
120-
WH_TEST_RETURN_ON_FAIL(wh_Server_CertVerify(server, RAW_CERT_CHAIN_B,
121-
RAW_CERT_CHAIN_B_len, rootCertB,
122-
WH_CERT_FLAGS_NONE, NULL));
120+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertVerify(
121+
server, RAW_CERT_CHAIN_B, RAW_CERT_CHAIN_B_len, rootCertB,
122+
WH_CERT_FLAGS_NONE, WH_NVM_FLAGS_USAGE_ANY, NULL));
123123

124124
/* attempt to verify invalid chains, should fail */
125125
WH_TEST_DEBUG_PRINT("Attempting to verify invalid certificate chains...\n");
126126
WH_TEST_ASSERT_RETURN(WH_ERROR_CERT_VERIFY ==
127127
wh_Server_CertVerify(server, RAW_CERT_CHAIN_A,
128128
RAW_CERT_CHAIN_A_len, rootCertB,
129-
WH_CERT_FLAGS_NONE, NULL));
129+
WH_CERT_FLAGS_NONE,
130+
WH_NVM_FLAGS_USAGE_ANY, NULL));
130131
WH_TEST_ASSERT_RETURN(WH_ERROR_CERT_VERIFY ==
131132
wh_Server_CertVerify(server, RAW_CERT_CHAIN_B,
132133
RAW_CERT_CHAIN_B_len, rootCertA,
133-
WH_CERT_FLAGS_NONE, NULL));
134+
WH_CERT_FLAGS_NONE,
135+
WH_NVM_FLAGS_USAGE_ANY, NULL));
134136

135137
/* remove trusted root certificate for chain A */
136138
WH_TEST_DEBUG_PRINT("Removing trusted root certificates...\n");
@@ -224,7 +226,7 @@ int whTest_CertClient(whClientContext* client)
224226
WH_TEST_PRINT("Testing verify with cached leaf public key...\n");
225227
WH_TEST_RETURN_ON_FAIL(wh_Client_CertVerifyAndCacheLeafPubKey(
226228
client, RAW_CERT_CHAIN_A, RAW_CERT_CHAIN_A_len, rootCertA_id,
227-
&out_keyId, &out_rc));
229+
WH_NVM_FLAGS_USAGE_ANY, &out_keyId, &out_rc));
228230
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
229231

230232
/* Export the cached public key so we can verify it matches the expected
@@ -409,7 +411,7 @@ int whTest_CertClientDma_ClientServerTestInternal(whClientContext* client)
409411
WH_TEST_PRINT("Testing verify with cached leaf public key using DMA...\n");
410412
WH_TEST_RETURN_ON_FAIL(wh_Client_CertVerifyDmaAndCacheLeafPubKey(
411413
client, RAW_CERT_CHAIN_A, RAW_CERT_CHAIN_A_len, rootCertA_id,
412-
&out_keyId, &out_rc));
414+
WH_NVM_FLAGS_USAGE_ANY, &out_keyId, &out_rc));
413415
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
414416

415417
/* Export the cached public key so we can verify it matches the expected

0 commit comments

Comments
 (0)