fix hardware identity oid check logic. #16
Conversation
spdmlib/src/crypto/x509v3.rs
Outdated
| // IN (extension sequences slice, target oid) | ||
| // OUT true when find target oid | ||
| // OUT false when not find target oid | ||
| fn find_target_object_identifiers_in_extensions( |
There was a problem hiding this comment.
find_target_object_identifiers can enter sequence slice or extnValue to find the target oid, so It's fine to keep using find_target_object_identifiers to search hardware oid, no need additional function to do the search work.
spdm-rs/spdmlib/src/crypto/x509v3.rs
Lines 461 to 463 in cb06559
spdmlib/src/crypto/x509v3.rs
Outdated
| @@ -1223,7 +1283,7 @@ mod tests { | |||
| assert!(check_leaf_certificate(&end1, true).is_ok()); | |||
| assert!(check_leaf_certificate(&end1, false).is_ok()); | |||
| assert!(check_leaf_certificate(&end2, false).is_ok()); | |||
| assert!(check_leaf_certificate(&end2, true).is_err()); | |||
| assert!(check_leaf_certificate(&end2, true).is_ok()); | |||
There was a problem hiding this comment.
end2 contains hardware oid and alias cert shall not have hardware oid. Need return Err.
|
Synced with @OuyangHang33 and @xiaoyuxlu, we both agreed that:
|
spdmlib/src/crypto/x509v3.rs
Outdated
| info!("Hardware identity OID shall not be present in alias cert!\n"); | ||
| Err(SPDM_STATUS_VERIF_FAIL) | ||
| } else if !is_alias_cert_model | ||
| && !find_target_object_identifiers(extension_data, OID_DMTF_SPDM_HARDWARE_IDENTITY)? | ||
| && !find_hardware_object_identifiers_in_extensions(extension_data)? |
There was a problem hiding this comment.
Why we change a generic function to a specific function?
There was a problem hiding this comment.
Why we change a generic function to a specific function?
Because, it is confusing for a generic function to find a target oid. RFC 5280 says
Extension ::= SEQUENCE {
extnID OBJECT IDENTIFIER,
critical BOOLEAN DEFAULT FALSE,
extnValue OCTET STRING
-- contains the DER encoding of an ASN.1 value
-- corresponding to the extension type identified
-- by extnID
}
to find a target oid in extnValue need the context of extension type. So it is better to add some specific items in function name to indicate the context of extension type. In this PR, hardware_object_identifiers indicates this function works under SPDM context, to find a
id-DMTF-hardware-identity id-spdm-cert-oid :: = {
spdmOID { id-DMTF-spdm 2 }
spdmOIDdefinition ABSENT
}
it should be more precise.
fix ccc-spdm-tools#14 Signed-off-by: Yang, Longlong <[email protected]>
fix #14