Accomodate pathLen when checking certificate

[steven-bellock]

Fix #2831.

Signed-off-by: Steven Bellock [email protected]

[steven-bellock]

@rw8896 as well.

[jyao1]

Question: How the logic is tested?

[jyao1]

How 10 is calculated? Is that enough?

[rw8896]

Both mbedtls and openssl seem to provide APIs to check if CA is true.
https://docs.openssl.org/3.0/man3/X509_check_ca/#copyright
https://github.com/Mbed-TLS/mbedtls/blob/development/include/mbedtls/x509_crt.h#L920

Maybe we could invent another libspdm_x509 API to return if CA is true instead of parsing the basic constraints raw bytes?

[steven-bellock]

How 10 is calculated? Is that enough?

It's probably more than enough, but let me check what the largest ASN.1 DER integer size is. I'll make a macro for it too.

[steven-bellock]

Both mbedtls and openssl seem to provide APIs to check if CA is true. https://docs.openssl.org/3.0/man3/X509_check_ca/#copyright https://github.com/Mbed-TLS/mbedtls/blob/development/include/mbedtls/x509_crt.h#L920

Maybe we could invent another libspdm_x509 API to return if CA is true instead of parsing the basic constraints raw bytes?

The benefit of having the logic in libspdm/library is that the Integrator doesn't need to provide new functions / functionality as the SPDM specification adds or removes certificate fields. But yes, maybe for libspdm 4.0 we could have a basic certificate parsing interface where the Integrator / cryptography library handles most of the logic, but then also have a catch-all interface where the Integrator provides the raw ASN.1 DER to libspdm.

[steven-bellock]

Question: How the logic is tested?

Assuming LIBSPDM_CERT_PARSE_SUPPORT is enabled then

libspdm/unit_test/test_spdm_responder/set_certificate_rsp.c

Lines 543 to 547 in 525ba87

	/**
	* Test 7: receives a valid SET_CERTIFICATE request message from Requester to set cert in slot_id:0 with alias_cert model
	* Expected Behavior: produces a valid SET_CERTIFICATE_RSP response message
	**/
	void libspdm_test_responder_set_cetificate_rsp_case7(void **state)

will exercise the logic, as shown in https://dmtf.github.io/libspdm/coverage_log/library/spdm_crypt_lib/libspdm_crypt_cert.c.gcov.html#853.