};
+struct padding_algo padding_algos[] = {
+ {
+ .name = "pkcs-1.5",
+ .verify = padding_pkcs_15_verify,
+ },
+#ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT
+ {
+ .name = "pss",
+ .verify = padding_pss_verify,
+ }
+#endif /* CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT */
+};
+
struct checksum_algo *image_get_checksum_algo(const char *full_name)
{
int i;
const char *name;
+#if !defined(USE_HOSTCC) && defined(CONFIG_NEEDS_MANUAL_RELOC)
+ static bool done;
+
+ if (!done) {
+ done = true;
+ for (i = 0; i < ARRAY_SIZE(checksum_algos); i++) {
+ checksum_algos[i].name += gd->reloc_off;
+#if IMAGE_ENABLE_SIGN
+ checksum_algos[i].calculate_sign += gd->reloc_off;
+#endif
+ checksum_algos[i].calculate += gd->reloc_off;
+ }
+ }
+#endif
+
for (i = 0; i < ARRAY_SIZE(checksum_algos); i++) {
name = checksum_algos[i].name;
/* Make sure names match and next char is a comma */
int i;
const char *name;
+#if !defined(USE_HOSTCC) && defined(CONFIG_NEEDS_MANUAL_RELOC)
+ static bool done;
+
+ if (!done) {
+ done = true;
+ for (i = 0; i < ARRAY_SIZE(crypto_algos); i++) {
+ crypto_algos[i].name += gd->reloc_off;
+ crypto_algos[i].sign += gd->reloc_off;
+ crypto_algos[i].add_verify_data += gd->reloc_off;
+ crypto_algos[i].verify += gd->reloc_off;
+ }
+ }
+#endif
+
/* Move name to after the comma */
name = strchr(full_name, ',');
if (!name)
return NULL;
}
+struct padding_algo *image_get_padding_algo(const char *name)
+{
+ int i;
+
+ if (!name)
+ return NULL;
+
+ for (i = 0; i < ARRAY_SIZE(padding_algos); i++) {
+ if (!strcmp(padding_algos[i].name, name))
+ return &padding_algos[i];
+ }
+
+ return NULL;
+}
+
/**
* fit_region_make_list() - Make a list of image regions
*
char **err_msgp)
{
char *algo_name;
+ const char *padding_name;
+
+ if (fdt_totalsize(fit) > CONFIG_FIT_SIGNATURE_MAX_SIZE) {
+ *err_msgp = "Total size too large";
+ return 1;
+ }
if (fit_image_hash_get_algo(fit, noffset, &algo_name)) {
*err_msgp = "Can't get hash algo property";
return -1;
}
+
+ padding_name = fdt_getprop(fit, noffset, "padding", NULL);
+ if (!padding_name)
+ padding_name = RSA_DEFAULT_PADDING_NAME;
+
memset(info, '\0', sizeof(*info));
- info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL);
+ info->keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
info->fit = (void *)fit;
info->node_offset = noffset;
info->name = algo_name;
info->checksum = image_get_checksum_algo(algo_name);
info->crypto = image_get_crypto_algo(algo_name);
+ info->padding = image_get_padding_algo(padding_name);
info->fdt_blob = gd_fdt_blob();
info->required_keynode = required_keynode;
printf("%s:%s", algo_name, info->keyname);
- if (!info->checksum || !info->crypto) {
+ if (!info->checksum || !info->crypto || !info->padding) {
*err_msgp = "Unknown signature algorithm";
return -1;
}
const char *required;
int ret;
- required = fdt_getprop(sig_blob, noffset, "required", NULL);
+ required = fdt_getprop(sig_blob, noffset, FIT_KEY_REQUIRED,
+ NULL);
if (!required || strcmp(required, "image"))
continue;
ret = fit_image_verify_sig(fit, image_noffset, data, size,
return 0;
}
-int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
- char **err_msgp)
+/**
+ * fit_config_check_sig() - Check the signature of a config
+ *
+ * @fit: FIT to check
+ * @noffset: Offset of configuration node (e.g. /configurations/conf-1)
+ * @required_keynode: Offset in the control FDT of the required key node,
+ * if any. If this is given, then the configuration wil not
+ * pass verification unless that key is used. If this is
+ * -1 then any signature will do.
+ * @conf_noffset: Offset of the configuration subnode being checked (e.g.
+ * /configurations/conf-1/kernel)
+ * @err_msgp: In the event of an error, this will be pointed to a
+ * help error string to display to the user.
+ * @return 0 if all verified ok, <0 on error
+ */
+static int fit_config_check_sig(const void *fit, int noffset,
+ int required_keynode, int conf_noffset,
+ char **err_msgp)
{
char * const exc_prop[] = {"data"};
const char *prop, *end, *name;
struct image_sign_info info;
const uint32_t *strings;
+ const char *config_name;
uint8_t *fit_value;
int fit_value_len;
+ bool found_config;
int max_regions;
int i, prop_len;
char path[200];
int count;
+ config_name = fit_get_name(fit, conf_noffset, NULL);
debug("%s: fdt=%p, conf='%s', sig='%s'\n", __func__, gd_fdt_blob(),
fit_get_name(fit, noffset, NULL),
fit_get_name(gd_fdt_blob(), required_keynode, NULL));
return -1;
}
+ if (prop && prop_len > 0 && prop[prop_len - 1] != '\0') {
+ *err_msgp = "hashed-nodes property must be null-terminated";
+ return -1;
+ }
+
/* Add a sanity check here since we are using the stack */
if (count > IMAGE_MAX_HASHED_NODES) {
*err_msgp = "Number of hashed nodes exceeds maximum";
char *node_inc[count];
debug("Hash nodes (%d):\n", count);
+ found_config = false;
for (name = prop, i = 0; name < end; name += strlen(name) + 1, i++) {
debug(" '%s'\n", name);
node_inc[i] = (char *)name;
+ if (!strncmp(FIT_CONFS_PATH, name, strlen(FIT_CONFS_PATH)) &&
+ name[sizeof(FIT_CONFS_PATH) - 1] == '/' &&
+ !strcmp(name + sizeof(FIT_CONFS_PATH), config_name)) {
+ debug(" (found config node %s)", config_name);
+ found_config = true;
+ }
+ }
+ if (!found_config) {
+ *err_msgp = "Selected config not in hashed nodes";
+ return -1;
}
/*
/* Add the strings */
strings = fdt_getprop(fit, noffset, "hashed-strings", NULL);
if (strings) {
- fdt_regions[count].offset = fdt_off_dt_strings(fit) +
- fdt32_to_cpu(strings[0]);
+ /*
+ * The strings region offset must be a static 0x0.
+ * This is set in tool/image-host.c
+ */
+ fdt_regions[count].offset = fdt_off_dt_strings(fit);
fdt_regions[count].size = fdt32_to_cpu(strings[1]);
count++;
}
if (!strncmp(name, FIT_SIG_NODENAME,
strlen(FIT_SIG_NODENAME))) {
ret = fit_config_check_sig(fit, noffset, sig_offset,
- &err_msg);
+ conf_noffset, &err_msg);
if (ret) {
puts("- ");
} else {
goto error;
}
- return verified ? 0 : -EPERM;
+ if (verified)
+ return 0;
error:
printf(" error!\n%s for '%s' hash node in '%s' config node\n",
err_msg, fit_get_name(fit, noffset, NULL),
fit_get_name(fit, conf_noffset, NULL));
- return -1;
+ return -EPERM;
}
int fit_config_verify_required_sigs(const void *fit, int conf_noffset,
const char *required;
int ret;
- required = fdt_getprop(sig_blob, noffset, "required", NULL);
+ required = fdt_getprop(sig_blob, noffset, FIT_KEY_REQUIRED,
+ NULL);
if (!required || strcmp(required, "conf"))
continue;
ret = fit_config_verify_sig(fit, conf_noffset, sig_blob,
projects / oweals / u-boot.git / blobdiff