cr50: Add corp format to u2f_attest

Add a format for u2fd-corp attestation to u2f_attest, and corresponding
test case in u2f_test.py

BUG=b:233147441
TEST=make buildall -j
TEST=u2f_test.py

Change-Id: I4d12345fd0531a4be091c05670215444fe38e706
Signed-off-by: Howard Yang <hcyang@google.com>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/3670107
Reviewed-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Vadim Sukhomlinov <sukhomlinov@chromium.org>

1 files changed, 31 insertions, 13 deletions

diff --git a/common/u2f.c b/common/u2f.c
index cccc6b06b9..1a4026b559 100644
--- a/common/u2f.c
+++ b/common/u2f.c
@@ -266,6 +266,8 @@ static inline size_t u2f_attest_format_size(uint8_t format)
 	switch (format) {
 	case U2F_ATTEST_FORMAT_REG_RESP:
 		return sizeof(struct g2f_register_msg_v0);
+	case CORP_ATTEST_FORMAT_REG_RESP:
+		return sizeof(struct corp_attest_data);
 	default:
 		return 0;
 	}
@@ -277,9 +279,13 @@ enum vendor_cmd_rc u2f_attest_cmd(enum vendor_cmd_cc code, void *buf,
 {
 	const struct u2f_attest_req *req = buf;
 	struct u2f_attest_resp *resp;
-	struct g2f_register_msg_v0 *msg = (void *)req->data;
+	union u2f_attest_msg_variant *msg = (void *)req->data;
 	enum ec_error_list result;
 
+	const union u2f_key_handle_variant *kh;
+	const uint8_t *origin;
+	const struct u2f_ec_point *pubKey;
+
 	size_t response_buf_size = *response_size;
 
 	const struct u2f_state *state = u2f_get_state();
@@ -296,15 +302,30 @@ enum vendor_cmd_rc u2f_attest_cmd(enum vendor_cmd_cc code, void *buf,
 	    response_buf_size < sizeof(*resp))
 		return VENDOR_RC_BOGUS_ARGS;
 
-	/* Only one format is supported, key handle version is 0. */
-	if (req->format != U2F_ATTEST_FORMAT_REG_RESP)
-		return VENDOR_RC_NOT_ALLOWED;
+	/*
+	 * Two formats are supported, U2F Attest format and Corp Attest format,
+	 * both with key handle version 0.
+	 */
+	if (req->format == U2F_ATTEST_FORMAT_REG_RESP) {
+		if (req->dataLen != sizeof(struct g2f_register_msg_v0))
+			return VENDOR_RC_NOT_ALLOWED;
 
-	if (req->dataLen != sizeof(struct g2f_register_msg_v0))
-		return VENDOR_RC_NOT_ALLOWED;
+		if (msg->g2f.reserved != 0)
+			return VENDOR_RC_NOT_ALLOWED;
 
-	if (msg->reserved != 0)
+		kh = (union u2f_key_handle_variant *)&msg->g2f.key_handle;
+		origin = msg->g2f.app_id;
+		pubKey = &msg->g2f.public_key;
+	} else if (req->format == CORP_ATTEST_FORMAT_REG_RESP) {
+		if (req->dataLen != sizeof(struct corp_register_msg_v0))
+			return VENDOR_RC_NOT_ALLOWED;
+
+		kh = (union u2f_key_handle_variant *)&msg->corp.key_handle;
+		origin = msg->corp.app_id;
+		pubKey = &msg->corp.data.public_key;
+	} else {
 		return VENDOR_RC_NOT_ALLOWED;
+	}
 
 	/*
 	 * u2f_attest first consume all data from request 'req', and compute
@@ -316,18 +337,15 @@ enum vendor_cmd_rc u2f_attest_cmd(enum vendor_cmd_cc code, void *buf,
 	resp = buf;
 
 	/* TODO: If WebAuthn support is needed, pass AuthTimeSecret. */
-	result = u2f_attest(state,
-			    (union u2f_key_handle_variant *)&msg->key_handle, 0,
-			    req->userSecret, msg->app_id, NULL,
-			    &msg->public_key, req->data,
-			    u2f_attest_format_size(req->format),
+	result = u2f_attest(state, kh, 0, req->userSecret, origin, NULL, pubKey,
+			    req->data, u2f_attest_format_size(req->format),
 			    (struct u2f_signature *)resp);
 
 	if (result == EC_ERROR_ACCESS_DENIED)
 		return VENDOR_RC_NOT_ALLOWED;
 
 	if (result != EC_SUCCESS) {
-		CPRINTF("G2F Attestation failed");
+		CPRINTF("Attestation failed");
 		return VENDOR_RC_INTERNAL_ERROR;
 	}