[WIP] spdm mig attestation support history info

src/crypto/src/rustls_impl/tls.rs

@@ -55,6 +55,10 @@ where
     pub async fn read(&mut self, data: &mut [u8]) -> Result<usize> {
         self.conn.read(data).await
     }
+
+    pub fn peer_certs(&self) -> Option<Vec<&[u8]>> {
+        self.conn.peer_certs()
+    }
 }
 
 enum TlsConnection<T: AsyncRead + AsyncWrite + Unpin> {
@@ -94,6 +98,13 @@ impl<T: AsyncRead + AsyncWrite + Unpin> TlsConnection<T> {
         }
     }
 
+    fn peer_certs(&self) -> Option<Vec<&[u8]>> {
+        match self {
+            Self::Server(conn) => conn.peer_certs(),
+            Self::Client(conn) => conn.peer_certs(),
+        }
+    }
+
     fn transport_mut(&mut self) -> &mut T {
         match self {
             Self::Server(conn) => &mut conn.transport,
@@ -498,7 +509,7 @@ pub(crate) mod connection {
     }
 
     pub struct TlsServerConnection<T: AsyncRead + AsyncWrite + Unpin> {
-        conn: UnbufferedServerConnection,
+        pub(super) conn: UnbufferedServerConnection,
         input: TlsBuffer,
         output: TlsBuffer,
         pub transport: T,
@@ -518,6 +529,12 @@ pub(crate) mod connection {
             })
         }
 
+        pub fn peer_certs(&self) -> Option<Vec<&[u8]>> {
+            self.conn
+                .peer_certificates()
+                .map(|certs| certs.iter().map(|der| der.as_ref()).collect())
+        }
+
         pub async fn read(&mut self, data: &mut [u8]) -> Result<usize, TlsConnectionError> {
             if self.is_handshaking {
                 self.process_tls_status().await?;
@@ -776,6 +793,12 @@ pub(crate) mod connection {
             })
         }
 
+        pub fn peer_certs(&self) -> Option<Vec<&[u8]>> {
+            self.conn
+                .peer_certificates()
+                .map(|certs| certs.iter().map(|der| der.as_ref()).collect())
+        }
+
         pub async fn read(&mut self, data: &mut [u8]) -> Result<usize, TlsConnectionError> {
             if self.is_handshaking {
                 self.process_tls_status().await?;

src/migtd/src/event_log.rs

@@ -12,7 +12,7 @@ use cc_measurement::{
 };
 use core::mem::size_of;
 use crypto::hash::digest_sha384;
-use policy::{CcEvent, EventName, Report, REPORT_DATA_SIZE};
+use policy::{CcEvent, EventName};
 use spin::Once;
 use td_payload::acpi::get_acpi_tables;
 use td_shim::event_log::{
@@ -218,11 +218,17 @@ pub(crate) fn parse_events(event_log: &[u8]) -> Option<BTreeMap<EventName, CcEve
     Some(map)
 }
 
-pub fn verify_event_log(event_log: &[u8], report: &[u8]) -> Result<()> {
-    replay_event_log_with_report(event_log, report)
+pub fn verify_event_log(
+    event_log: &[u8],
+    report_rtmrs: &[[u8; SHA384_DIGEST_SIZE]; 4],
+) -> Result<()> {
+    replay_event_log_with_report(event_log, report_rtmrs)
 }
 
-fn replay_event_log_with_report(event_log: &[u8], report: &[u8]) -> Result<()> {
+fn replay_event_log_with_report(
+    event_log: &[u8],
+    report_rtmrs: &[[u8; SHA384_DIGEST_SIZE]; 4],
+) -> Result<()> {
     let mut rtmrs: [[u8; 96]; 4] = [[0; 96]; 4];
 
     let event_log = if let Some(event_log) = CcEventLogReader::new(event_log) {
@@ -250,14 +256,10 @@ fn replay_event_log_with_report(event_log: &[u8], report: &[u8]) -> Result<()> {
         }
     }
 
-    if report.len() < REPORT_DATA_SIZE {
-        return Err(anyhow!("Invalid report"));
-    }
-
-    if report[Report::R_MIGTD_RTMR0] == rtmrs[0][0..48]
-        && report[Report::R_MIGTD_RTMR1] == rtmrs[1][0..48]
-        && report[Report::R_MIGTD_RTMR2] == rtmrs[2][0..48]
-        && report[Report::R_MIGTD_RTMR3] == rtmrs[3][0..48]
+    if report_rtmrs[0] == rtmrs[0][0..48]
+        && report_rtmrs[1] == rtmrs[1][0..48]
+        && report_rtmrs[2] == rtmrs[2][0..48]
+        && report_rtmrs[3] == rtmrs[3][0..48]
     {
         Ok(())
     } else {