Extend libspdm API to expose SPDM message creation and handling without communication layer

[JakubLedworowski]

My team is trying to integrate libspdm into our Verifier (SPDM requestor written in Java) and we need to be able to invoke every message separately, using our own transport mechanism.

1. Currently, libspdm requires defining callbacks to communication methods (eg. TCP) and wrapping with additional headers (eg. MCTP) and uses these callbacks internally (prepare buffers, prepare SPDM message, wrap message with header using callback, send message using callback, receive response using callback and so on).

Would you consider to extend libspdm, so it could also provide API for every SPDM request creation and response handling, so other usages (like ours) could use as much SPDM protocol from libspdm?
I would expect i.e. extended SPDM requestor API like:
_status <req_message>creator(in required params, out &SPDM_request_message),
_status <resp_message>handler(in required params, in &SPDM_resp_message)
for each currently supported SPDM messages (GET_VERSION, etc.), that would be called by existent API in library but also exposed to be called by any library users.

2. Depending on device type we could also expect different kind of certificate types on devices. As I can see current libspdm tries to build and verify chain by itself with assumption that it is x509 certificates. Unfortunately in our case we have DICE extensions, that are probably not supported by neither libspdm nor openssl.

Would you consider adding value parameter to GET_CERTIFICATE method so it could be possible to build and validate chain outside of library flow and just receiving list of certificates after error handling of GET_CERTIFICATE response?

3. Currently SPDM RIM (Reference Integrity Manifest) is not standardized yet by DMTF.

Is there a way to collect measurements from GET_MEASUREMENT response (again after error handling), so we could compare evidence against RIM format that we currently support outside of library logic.

[steven-bellock]

1. Would be (pretty) straightforward once Phases of Request / Response Handling #453 is realized, as it would be easy to manage the different phases.
2. Currently the libspdm integrator can register a function to verify the certificate chain :

   libspdm/library/spdm_requester_lib/libspdm_req_get_certificate.c

   Lines 279 to 287 in 6a88277

   	if (spdm_context->local_context.verify_peer_spdm_cert_chain != NULL) {
   	result = spdm_context->local_context.verify_peer_spdm_cert_chain (
   	spdm_context, slot_id, libspdm_get_managed_buffer_size(&certificate_chain_buffer),
   	libspdm_get_managed_buffer(&certificate_chain_buffer),
   	trust_anchor, trust_anchor_size);
   	if (!result) {
   	status = LIBSPDM_STATUS_VERIF_FAIL;
   	goto done;
   	}

   Going even further Requester should parse peer certificate chain once #496 probably accomplishes what you want.
3. libspdm_get_measurement already returns the measurement record(s) to the integrator. Does that do what you want? See also libspdm Verifier Support #929 for my proposal on having the verifier check the signature over the measurements.

[jyao1]

Ref: #1164