diff options
author | Howard Yang <hcyang@google.com> | 2022-05-26 12:29:01 +0800 |
---|---|---|
committer | Chromeos LUCI <chromeos-scoped@luci-project-accounts.iam.gserviceaccount.com> | 2022-06-03 07:55:37 +0000 |
commit | e5b0f03a6f132d57337212c3928c820d785072e0 (patch) | |
tree | 92d598703fba4aacef54bb882e945f4ffb099a4e /common | |
parent | 1e27cdddad231f9cd75c77923d1e952883f6125e (diff) | |
download | chrome-ec-e5b0f03a6f132d57337212c3928c820d785072e0.tar.gz |
cr50: Add corp format to u2f_attest
Add a format for u2fd-corp attestation to u2f_attest, and corresponding
test case in u2f_test.py
BUG=b:233147441
TEST=make buildall -j
TEST=u2f_test.py
Change-Id: I4d12345fd0531a4be091c05670215444fe38e706
Signed-off-by: Howard Yang <hcyang@google.com>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/3670107
Reviewed-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Diffstat (limited to 'common')
-rw-r--r-- | common/u2f.c | 44 |
1 files changed, 31 insertions, 13 deletions
diff --git a/common/u2f.c b/common/u2f.c index cccc6b06b9..1a4026b559 100644 --- a/common/u2f.c +++ b/common/u2f.c @@ -266,6 +266,8 @@ static inline size_t u2f_attest_format_size(uint8_t format) switch (format) { case U2F_ATTEST_FORMAT_REG_RESP: return sizeof(struct g2f_register_msg_v0); + case CORP_ATTEST_FORMAT_REG_RESP: + return sizeof(struct corp_attest_data); default: return 0; } @@ -277,9 +279,13 @@ enum vendor_cmd_rc u2f_attest_cmd(enum vendor_cmd_cc code, void *buf, { const struct u2f_attest_req *req = buf; struct u2f_attest_resp *resp; - struct g2f_register_msg_v0 *msg = (void *)req->data; + union u2f_attest_msg_variant *msg = (void *)req->data; enum ec_error_list result; + const union u2f_key_handle_variant *kh; + const uint8_t *origin; + const struct u2f_ec_point *pubKey; + size_t response_buf_size = *response_size; const struct u2f_state *state = u2f_get_state(); @@ -296,15 +302,30 @@ enum vendor_cmd_rc u2f_attest_cmd(enum vendor_cmd_cc code, void *buf, response_buf_size < sizeof(*resp)) return VENDOR_RC_BOGUS_ARGS; - /* Only one format is supported, key handle version is 0. */ - if (req->format != U2F_ATTEST_FORMAT_REG_RESP) - return VENDOR_RC_NOT_ALLOWED; + /* + * Two formats are supported, U2F Attest format and Corp Attest format, + * both with key handle version 0. + */ + if (req->format == U2F_ATTEST_FORMAT_REG_RESP) { + if (req->dataLen != sizeof(struct g2f_register_msg_v0)) + return VENDOR_RC_NOT_ALLOWED; - if (req->dataLen != sizeof(struct g2f_register_msg_v0)) - return VENDOR_RC_NOT_ALLOWED; + if (msg->g2f.reserved != 0) + return VENDOR_RC_NOT_ALLOWED; - if (msg->reserved != 0) + kh = (union u2f_key_handle_variant *)&msg->g2f.key_handle; + origin = msg->g2f.app_id; + pubKey = &msg->g2f.public_key; + } else if (req->format == CORP_ATTEST_FORMAT_REG_RESP) { + if (req->dataLen != sizeof(struct corp_register_msg_v0)) + return VENDOR_RC_NOT_ALLOWED; + + kh = (union u2f_key_handle_variant *)&msg->corp.key_handle; + origin = msg->corp.app_id; + pubKey = &msg->corp.data.public_key; + } else { return VENDOR_RC_NOT_ALLOWED; + } /* * u2f_attest first consume all data from request 'req', and compute @@ -316,18 +337,15 @@ enum vendor_cmd_rc u2f_attest_cmd(enum vendor_cmd_cc code, void *buf, resp = buf; /* TODO: If WebAuthn support is needed, pass AuthTimeSecret. */ - result = u2f_attest(state, - (union u2f_key_handle_variant *)&msg->key_handle, 0, - req->userSecret, msg->app_id, NULL, - &msg->public_key, req->data, - u2f_attest_format_size(req->format), + result = u2f_attest(state, kh, 0, req->userSecret, origin, NULL, pubKey, + req->data, u2f_attest_format_size(req->format), (struct u2f_signature *)resp); if (result == EC_ERROR_ACCESS_DENIED) return VENDOR_RC_NOT_ALLOWED; if (result != EC_SUCCESS) { - CPRINTF("G2F Attestation failed"); + CPRINTF("Attestation failed"); return VENDOR_RC_INTERNAL_ERROR; } |