Skip to content

Commit f8342c4

Browse files
bigbrettbigbrett
committed
add (placeholder) access and label fields to cert functions
1 parent c83d931 commit f8342c4

File tree

7 files changed

+116
-66
lines changed

7 files changed

+116
-66
lines changed

‎src/wh_client_cert.c‎

Lines changed: 33 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,9 @@ int wh_Client_CertInit(whClientContext* c, int32_t* out_rc)
115115

116116
/* Add a trusted certificate */
117117
int wh_Client_CertAddTrustedRequest(whClientContext* c, whNvmId id,
118-
const uint8_t* cert, uint32_t cert_len,
119-
whNvmFlags flags)
118+
whNvmAccess access, whNvmFlags flags,
119+
uint8_t* label, whNvmSize label_len,
120+
const uint8_t* cert, uint32_t cert_len)
120121
{
121122
whMessageCert_AddTrustedRequest req;
122123
uint8_t buffer[WOLFHSM_CFG_COMM_DATA_LEN] = {0};
@@ -129,9 +130,16 @@ int wh_Client_CertAddTrustedRequest(whClientContext* c, whNvmId id,
129130
}
130131

131132
/* Prepare request */
133+
memset(&req, 0, sizeof(req));
132134
req.id = id;
133-
req.cert_len = cert_len;
135+
req.access = access;
134136
req.flags = flags;
137+
req.cert_len = cert_len;
138+
if (label != NULL && label_len > 0) {
139+
whNvmSize copy_len =
140+
(label_len > WH_NVM_LABEL_LEN) ? WH_NVM_LABEL_LEN : label_len;
141+
memcpy(req.label, label, copy_len);
142+
}
135143

136144
/* Copy request struct and certificate data */
137145
memcpy(buffer, &req, hdr_len);
@@ -173,9 +181,10 @@ int wh_Client_CertAddTrustedResponse(whClientContext* c, int32_t* out_rc)
173181
return rc;
174182
}
175183

176-
int wh_Client_CertAddTrusted(whClientContext* c, whNvmId id,
177-
const uint8_t* cert, uint32_t cert_len,
178-
whNvmFlags flags, int32_t* out_rc)
184+
int wh_Client_CertAddTrusted(whClientContext* c, whNvmId id, whNvmAccess access,
185+
whNvmFlags flags, uint8_t* label,
186+
whNvmSize label_len, const uint8_t* cert,
187+
uint32_t cert_len, int32_t* out_rc)
179188
{
180189
int rc = 0;
181190

@@ -184,7 +193,8 @@ int wh_Client_CertAddTrusted(whClientContext* c, whNvmId id,
184193
}
185194

186195
do {
187-
rc = wh_Client_CertAddTrustedRequest(c, id, cert, cert_len, flags);
196+
rc = wh_Client_CertAddTrustedRequest(c, id, access, flags, label,
197+
label_len, cert, cert_len);
188198
} while (rc == WH_ERROR_NOTREADY);
189199

190200
if (rc == 0) {
@@ -493,8 +503,9 @@ int wh_Client_CertVerifyAndCacheLeafPubKey(
493503
#ifdef WOLFHSM_CFG_DMA
494504

495505
int wh_Client_CertAddTrustedDmaRequest(whClientContext* c, whNvmId id,
496-
const void* cert, uint32_t cert_len,
497-
whNvmFlags flags)
506+
whNvmAccess access, whNvmFlags flags,
507+
uint8_t* label, whNvmSize label_len,
508+
const void* cert, uint32_t cert_len)
498509
{
499510
whMessageCert_AddTrustedDmaRequest req;
500511

@@ -503,10 +514,17 @@ int wh_Client_CertAddTrustedDmaRequest(whClientContext* c, whNvmId id,
503514
}
504515

505516
/* Prepare and send request */
517+
memset(&req, 0, sizeof(req));
506518
req.id = id;
519+
req.access = access;
520+
req.flags = flags;
507521
req.cert_addr = (uint64_t)(uintptr_t)cert;
508522
req.cert_len = cert_len;
509-
req.flags = flags;
523+
if (label != NULL && label_len > 0) {
524+
whNvmSize copy_len =
525+
(label_len > WH_NVM_LABEL_LEN) ? WH_NVM_LABEL_LEN : label_len;
526+
memcpy(req.label, label, copy_len);
527+
}
510528
return wh_Client_SendRequest(c, WH_MESSAGE_GROUP_CERT,
511529
WH_MESSAGE_CERT_ACTION_ADDTRUSTED_DMA,
512530
sizeof(req), &req);
@@ -543,8 +561,10 @@ int wh_Client_CertAddTrustedDmaResponse(whClientContext* c, int32_t* out_rc)
543561
}
544562

545563
int wh_Client_CertAddTrustedDma(whClientContext* c, whNvmId id,
564+
whNvmAccess access, whNvmFlags flags,
565+
uint8_t* label, whNvmSize label_len,
546566
const void* cert, uint32_t cert_len,
547-
whNvmFlags flags, int32_t* out_rc)
567+
int32_t* out_rc)
548568
{
549569
int rc = 0;
550570

@@ -553,7 +573,8 @@ int wh_Client_CertAddTrustedDma(whClientContext* c, whNvmId id,
553573
}
554574

555575
do {
556-
rc = wh_Client_CertAddTrustedDmaRequest(c, id, cert, cert_len, flags);
576+
rc = wh_Client_CertAddTrustedDmaRequest(c, id, access, flags, label,
577+
label_len, cert, cert_len);
557578
} while (rc == WH_ERROR_NOTREADY);
558579

559580
if (rc == 0) {

‎src/wh_message_cert.c‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,12 @@ int wh_MessageCert_TranslateAddTrustedRequest(
5252
if ((src == NULL) || (dest == NULL)) {
5353
return WH_ERROR_BADARGS;
5454
}
55-
WH_T16(magic, dest, src, id);
5655
WH_T32(magic, dest, src, cert_len);
56+
WH_T16(magic, dest, src, id);
57+
WH_T16(magic, dest, src, access);
5758
WH_T16(magic, dest, src, flags);
59+
/* Label array doesn't need byte-order translation */
60+
memcpy(dest->label, src->label, WH_NVM_LABEL_LEN);
5861
return 0;
5962
}
6063

@@ -126,10 +129,13 @@ int wh_MessageCert_TranslateAddTrustedDmaRequest(
126129
if ((src == NULL) || (dest == NULL)) {
127130
return WH_ERROR_BADARGS;
128131
}
129-
WH_T16(magic, dest, src, id);
130132
WH_T64(magic, dest, src, cert_addr);
131133
WH_T32(magic, dest, src, cert_len);
134+
WH_T16(magic, dest, src, id);
135+
WH_T16(magic, dest, src, access);
132136
WH_T16(magic, dest, src, flags);
137+
/* Label array doesn't need byte-order translation */
138+
memcpy(dest->label, src->label, WH_NVM_LABEL_LEN);
133139
return 0;
134140
}
135141

‎src/wh_server_cert.c‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -175,12 +175,11 @@ int wh_Server_CertInit(whServerContext* server)
175175

176176
/* Add a trusted certificate to NVM storage */
177177
int wh_Server_CertAddTrusted(whServerContext* server, whNvmId id,
178-
const uint8_t* cert, uint32_t cert_len,
179-
whNvmFlags flags)
178+
whNvmAccess access, whNvmFlags flags,
179+
const uint8_t* label, whNvmSize label_len,
180+
const uint8_t* cert, uint32_t cert_len)
180181
{
181182
int rc;
182-
whNvmAccess access = WH_NVM_ACCESS_ANY;
183-
uint8_t label[WH_NVM_LABEL_LEN] = "trusted_cert";
184183
whNvmMetadata metadata;
185184

186185
if ((server == NULL) || (cert == NULL) || (cert_len == 0)) {
@@ -192,7 +191,16 @@ int wh_Server_CertAddTrusted(whServerContext* server, whNvmId id,
192191
metadata.access = access;
193192
metadata.flags = flags;
194193
metadata.len = cert_len;
195-
memcpy(metadata.label, label, sizeof(label));
194+
memset(metadata.label, 0, WH_NVM_LABEL_LEN);
195+
if (label != NULL && label_len > 0) {
196+
whNvmSize copy_len =
197+
(label_len > WH_NVM_LABEL_LEN) ? WH_NVM_LABEL_LEN : label_len;
198+
memcpy(metadata.label, label, copy_len);
199+
}
200+
else {
201+
/* Default label if none provided */
202+
memcpy(metadata.label, "trusted_cert", sizeof("trusted_cert"));
203+
}
196204

197205
rc = wh_Nvm_AddObject(server->nvm, &metadata, cert_len, cert);
198206

@@ -386,8 +394,9 @@ int wh_Server_HandleCertRequest(whServerContext* server, uint16_t magic,
386394
cert_data = (const uint8_t*)req_packet + sizeof(req);
387395

388396
/* Process the add trusted action */
389-
rc = wh_Server_CertAddTrusted(server, req.id, cert_data,
390-
req.cert_len, req.flags);
397+
rc = wh_Server_CertAddTrusted(server, req.id, req.access, req.flags,
398+
req.label, WH_NVM_LABEL_LEN,
399+
cert_data, req.cert_len);
391400
resp.rc = rc;
392401

393402
/* Convert the response struct */
@@ -520,8 +529,9 @@ int wh_Server_HandleCertRequest(whServerContext* server, uint16_t magic,
520529
}
521530
if (resp.rc == WH_ERROR_OK) {
522531
/* Process the add trusted action */
523-
resp.rc = wh_Server_CertAddTrusted(server, req.id, cert_data,
524-
req.cert_len, req.flags);
532+
resp.rc = wh_Server_CertAddTrusted(
533+
server, req.id, req.access, req.flags, req.label,
534+
WH_NVM_LABEL_LEN, cert_data, req.cert_len);
525535
}
526536
if (resp.rc == WH_ERROR_OK) {
527537
/* Post-process client address */

‎test/wh_test_cert.c‎

Lines changed: 27 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -69,15 +69,15 @@ int whTest_CertServerCfg(whServerConfig* serverCfg)
6969

7070
/* Add trusted root certificate for chain A */
7171
WH_DEBUG_PRINT("Adding trusted root certificate for chain A...\n");
72-
WH_TEST_RETURN_ON_FAIL(
73-
wh_Server_CertAddTrusted(server, rootCertA, ROOT_A_CERT,
74-
ROOT_A_CERT_len, WH_NVM_FLAGS_IMMUTABLE));
72+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertAddTrusted(
73+
server, rootCertA, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL, 0,
74+
ROOT_A_CERT, ROOT_A_CERT_len));
7575

7676
/* Add trusted root certificate for chain B */
7777
WH_DEBUG_PRINT("Adding trusted root certificate for chain B...\n");
78-
WH_TEST_RETURN_ON_FAIL(
79-
wh_Server_CertAddTrusted(server, rootCertB, ROOT_B_CERT,
80-
ROOT_B_CERT_len, WH_NVM_FLAGS_IMMUTABLE));
78+
WH_TEST_RETURN_ON_FAIL(wh_Server_CertAddTrusted(
79+
server, rootCertB, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL, 0,
80+
ROOT_B_CERT, ROOT_B_CERT_len));
8181

8282
/* Verify valid single cert (intermediate) */
8383
WH_DEBUG_PRINT(
@@ -159,14 +159,14 @@ int whTest_CertClient(whClientContext* client)
159159
/* Add root certificates to NVM */
160160
WH_DEBUG_PRINT("Adding root certificate A to NVM...\n");
161161
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrusted(
162-
client, rootCertA_id, ROOT_A_CERT, ROOT_A_CERT_len,
163-
WH_NVM_FLAGS_IMMUTABLE, &out_rc));
162+
client, rootCertA_id, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL,
163+
0, ROOT_A_CERT, ROOT_A_CERT_len, &out_rc));
164164
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
165165

166166
WH_DEBUG_PRINT("Adding root certificate B to NVM...\n");
167167
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrusted(
168-
client, rootCertB_id, ROOT_B_CERT, ROOT_B_CERT_len,
169-
WH_NVM_FLAGS_IMMUTABLE, &out_rc));
168+
client, rootCertB_id, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL,
169+
0, ROOT_B_CERT, ROOT_B_CERT_len, &out_rc));
170170
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
171171

172172
/* Verify valid single cert (intermediate) */
@@ -277,14 +277,14 @@ int whTest_CertClientAcert(whClientContext* client)
277277
/* Add trusted certificate to NVM */
278278
WH_DEBUG_PRINT("Adding trusted certificate to NVM...\n");
279279
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrusted(
280-
client, trustedCertId, caCert_der, caCert_der_len,
281-
WH_NVM_FLAGS_IMMUTABLE, &out_rc));
280+
client, trustedCertId, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL,
281+
0, caCert_der, caCert_der_len, &out_rc));
282282
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
283283

284284
WH_DEBUG_PRINT("Adding root certificate B to NVM...\n");
285285
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrusted(
286-
client, rootCertB_id, ROOT_B_CERT, ROOT_B_CERT_len,
287-
WH_NVM_FLAGS_IMMUTABLE, &out_rc));
286+
client, rootCertB_id, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL,
287+
0, ROOT_B_CERT, ROOT_B_CERT_len, &out_rc));
288288
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
289289

290290
/* Verify attribute certificate */
@@ -344,14 +344,14 @@ int whTest_CertClientDma_ClientServerTestInternal(whClientContext* client)
344344
/* Add root certificates to NVM */
345345
WH_DEBUG_PRINT("Adding root certificate A to NVM...\n");
346346
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrustedDma(
347-
client, rootCertA_id, ROOT_A_CERT, ROOT_A_CERT_len,
348-
WH_NVM_FLAGS_IMMUTABLE, &out_rc));
347+
client, rootCertA_id, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL,
348+
0, ROOT_A_CERT, ROOT_A_CERT_len, &out_rc));
349349
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
350350

351351
WH_DEBUG_PRINT("Adding root certificate B to NVM...\n");
352352
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrustedDma(
353-
client, rootCertB_id, ROOT_B_CERT, ROOT_B_CERT_len,
354-
WH_NVM_FLAGS_IMMUTABLE, &out_rc));
353+
client, rootCertB_id, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL,
354+
0, ROOT_B_CERT, ROOT_B_CERT_len, &out_rc));
355355
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
356356

357357
/* Verify valid single cert (intermediate) */
@@ -464,14 +464,14 @@ int whTest_CertClientAcertDma_ClientServerTestInternal(whClientContext* client)
464464
/* Add trusted certificate to NVM */
465465
WH_DEBUG_PRINT("Adding trusted certificate to NVM...\n");
466466
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrustedDma(
467-
client, trustedCertId, caCert_der, caCert_der_len,
468-
WH_NVM_FLAGS_IMMUTABLE, &out_rc));
467+
client, trustedCertId, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL,
468+
0, caCert_der, caCert_der_len, &out_rc));
469469
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
470470

471471
WH_DEBUG_PRINT("Adding root certificate B to NVM...\n");
472472
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrustedDma(
473-
client, rootCertB_id, ROOT_B_CERT, ROOT_B_CERT_len,
474-
WH_NVM_FLAGS_IMMUTABLE, &out_rc));
473+
client, rootCertB_id, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE, NULL,
474+
0, ROOT_B_CERT, ROOT_B_CERT_len, &out_rc));
475475
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
476476

477477
/* Verify attribute certificate */
@@ -521,15 +521,16 @@ static int whTest_CertNonExportable(whClientContext* client)
521521
/* Add exportable certificate */
522522
WH_DEBUG_PRINT("Adding exportable certificate...\n");
523523
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrusted(
524-
client, exportable_cert_id, ROOT_A_CERT, ROOT_A_CERT_len,
525-
WH_NVM_FLAGS_IMMUTABLE, &out_rc));
524+
client, exportable_cert_id, WH_NVM_ACCESS_ANY, WH_NVM_FLAGS_IMMUTABLE,
525+
NULL, 0, ROOT_A_CERT, ROOT_A_CERT_len, &out_rc));
526526
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
527527

528528
/* Add non-exportable certificate */
529529
WH_DEBUG_PRINT("Adding non-exportable certificate...\n");
530530
WH_TEST_RETURN_ON_FAIL(wh_Client_CertAddTrusted(
531-
client, nonexportable_cert_id, ROOT_B_CERT, ROOT_B_CERT_len,
532-
WH_NVM_FLAGS_IMMUTABLE | WH_NVM_FLAGS_NONEXPORTABLE, &out_rc));
531+
client, nonexportable_cert_id, WH_NVM_ACCESS_ANY,
532+
WH_NVM_FLAGS_IMMUTABLE | WH_NVM_FLAGS_NONEXPORTABLE, NULL, 0,
533+
ROOT_B_CERT, ROOT_B_CERT_len, &out_rc));
533534
WH_TEST_ASSERT_RETURN(out_rc == WH_ERROR_OK);
534535

535536
/* Test reading exportable certificate - should succeed */

‎wolfhsm/wh_client.h‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1630,8 +1630,9 @@ int wh_Client_CertInit(whClientContext* c, int32_t* out_rc);
16301630
* @return int Returns 0 on success, or a negative error code on failure.
16311631
*/
16321632
int wh_Client_CertAddTrustedRequest(whClientContext* c, whNvmId id,
1633-
const uint8_t* cert, uint32_t cert_len,
1634-
whNvmFlags flags);
1633+
whNvmAccess access, whNvmFlags flags,
1634+
uint8_t* label, whNvmSize label_len,
1635+
const uint8_t* cert, uint32_t cert_len);
16351636

16361637
/**
16371638
* @brief Receives a response from the server after adding a trusted
@@ -1662,9 +1663,10 @@ int wh_Client_CertAddTrustedResponse(whClientContext* c, int32_t* out_rc);
16621663
* @param[out] out_rc Pointer to store the response code from the server.
16631664
* @return int Returns 0 on success, or a negative error code on failure.
16641665
*/
1665-
int wh_Client_CertAddTrusted(whClientContext* c, whNvmId id,
1666-
const uint8_t* cert, uint32_t cert_len,
1667-
whNvmFlags flags, int32_t* out_rc);
1666+
int wh_Client_CertAddTrusted(whClientContext* c, whNvmId id, whNvmAccess access,
1667+
whNvmFlags flags, uint8_t* label,
1668+
whNvmSize label_len, const uint8_t* cert,
1669+
uint32_t cert_len, int32_t* out_rc);
16681670

16691671
/**
16701672
* @brief Sends a request to erase a trusted certificate from NVM storage.
@@ -1892,8 +1894,9 @@ int wh_Client_CertVerifyAndCacheLeafPubKey(
18921894
* @return int Returns 0 on success, or a negative error code on failure.
18931895
*/
18941896
int wh_Client_CertAddTrustedDmaRequest(whClientContext* c, whNvmId id,
1895-
const void* cert, uint32_t cert_len,
1896-
whNvmFlags flags);
1897+
whNvmAccess access, whNvmFlags flags,
1898+
uint8_t* label, whNvmSize label_len,
1899+
const void* cert, uint32_t cert_len);
18971900

18981901
/**
18991902
* @brief Receives a response from the server after adding a trusted certificate
@@ -1926,8 +1929,10 @@ int wh_Client_CertAddTrustedDmaResponse(whClientContext* c, int32_t* out_rc);
19261929
* @return int Returns 0 on success, or a negative error code on failure.
19271930
*/
19281931
int wh_Client_CertAddTrustedDma(whClientContext* c, whNvmId id,
1932+
whNvmAccess access, whNvmFlags flags,
1933+
uint8_t* label, whNvmSize label_len,
19291934
const void* cert, uint32_t cert_len,
1930-
whNvmFlags flags, int32_t* out_rc);
1935+
int32_t* out_rc);
19311936

19321937
/**
19331938
* @brief Sends a request to read a trusted certificate from NVM storage using

‎wolfhsm/wh_message_cert.h‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,12 @@ int wh_MessageCert_TranslateSimpleResponse(
6262

6363
/* AddTrusted Request */
6464
typedef struct {
65-
uint32_t cert_len;
66-
whNvmId id;
67-
whNvmFlags flags;
65+
uint32_t cert_len;
66+
whNvmId id;
67+
whNvmAccess access;
68+
whNvmFlags flags;
69+
uint8_t label[WH_NVM_LABEL_LEN];
70+
uint8_t WH_PAD[2];
6871
/* Certificate data follows */
6972
} whMessageCert_AddTrustedRequest;
7073

@@ -138,10 +141,13 @@ int wh_MessageCert_TranslateVerifyResponse(
138141

139142
/* AddTrusted DMA Request */
140143
typedef struct {
141-
uint64_t cert_addr;
142-
uint32_t cert_len;
143-
whNvmId id;
144-
whNvmFlags flags;
144+
uint64_t cert_addr;
145+
uint32_t cert_len;
146+
whNvmId id;
147+
whNvmAccess access;
148+
whNvmFlags flags;
149+
uint8_t label[WH_NVM_LABEL_LEN];
150+
uint8_t WH_PAD[6];
145151
} whMessageCert_AddTrustedDmaRequest;
146152

147153
int wh_MessageCert_TranslateAddTrustedDmaRequest(

0 commit comments

Comments
 (0)