imx: hab: Check if CSF is valid before authenticating image

[people/ms/u-boot.git] / tools / kwbimage.c

diff --git a/tools/kwbimage.c b/tools/kwbimage.c
index 8c0e730e7bbb6f04934417764bfb448676baf08d..ccecf8718537b04250a252adbf91f56ba6509772 100644 (file)
--- a/tools/kwbimage.c
+++ b/tools/kwbimage.c
@@ -24,7 +24,7 @@
 #include <openssl/err.h>
 #include <openssl/evp.h>
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
 static void RSA_get0_key(const RSA *r,
                  const BIGNUM **n, const BIGNUM **e, const BIGNUM **d)
 {
@@ -290,6 +290,33 @@ static uint8_t image_checksum8(void *start, uint32_t len)
        return csum;
 }
 
+size_t kwbimage_header_size(unsigned char *ptr)
+{
+       if (image_version((void *)ptr) == 0)
+               return sizeof(struct main_hdr_v0);
+       else
+               return KWBHEADER_V1_SIZE((struct main_hdr_v1 *)ptr);
+}
+
+/*
+ * Verify checksum over a complete header that includes the checksum field.
+ * Return 1 when OK, otherwise 0.
+ */
+static int main_hdr_checksum_ok(void *hdr)
+{
+       /* Offsets of checksum in v0 and v1 headers are the same */
+       struct main_hdr_v0 *main_hdr = (struct main_hdr_v0 *)hdr;
+       uint8_t checksum;
+
+       checksum = image_checksum8(hdr, kwbimage_header_size(hdr));
+       /* Calculated checksum includes the header checksum field. Compensate
+        * for that.
+        */
+       checksum -= main_hdr->checksum;
+
+       return checksum == main_hdr->checksum;
+}
+
 static uint32_t image_checksum32(void *start, uint32_t len)
 {
        uint32_t csum = 0;
@@ -1476,47 +1503,6 @@ static int image_get_version(void)
        return e->version;
 }
 
-static int image_version_file(const char *input)
-{
-       FILE *fcfg;
-       int version;
-       int ret;
-
-       fcfg = fopen(input, "r");
-       if (!fcfg) {
-               fprintf(stderr, "Could not open input file %s\n", input);
-               return -1;
-       }
-
-       image_cfg = malloc(IMAGE_CFG_ELEMENT_MAX *
-                          sizeof(struct image_cfg_element));
-       if (!image_cfg) {
-               fprintf(stderr, "Cannot allocate memory\n");
-               fclose(fcfg);
-               return -1;
-       }
-
-       memset(image_cfg, 0,
-              IMAGE_CFG_ELEMENT_MAX * sizeof(struct image_cfg_element));
-       rewind(fcfg);
-
-       ret = image_create_config_parse(fcfg);
-       fclose(fcfg);
-       if (ret) {
-               free(image_cfg);
-               return -1;
-       }
-
-       version = image_get_version();
-       /* Fallback to version 0 is no version is provided in the cfg file */
-       if (version == -1)
-               version = 0;
-
-       free(image_cfg);
-
-       return version;
-}
-
 static void kwbimage_set_header(void *ptr, struct stat *sbuf, int ifd,
                                struct image_tool_params *params)
 {
@@ -1628,14 +1614,9 @@ static int kwbimage_check_image_types(uint8_t type)
 static int kwbimage_verify_header(unsigned char *ptr, int image_size,
                                  struct image_tool_params *params)
 {
-       struct main_hdr_v0 *main_hdr;
        uint8_t checksum;
 
-       main_hdr = (struct main_hdr_v0 *)ptr;
-       checksum = image_checksum8(ptr,
-                                  sizeof(struct main_hdr_v0)
-                                  - sizeof(uint8_t));
-       if (checksum != main_hdr->checksum)
+       if (!main_hdr_checksum_ok(ptr))
                return -FDT_ERR_BADSTRUCTURE;
 
        /* Only version 0 extended header has checksum */
@@ -1657,18 +1638,62 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
 static int kwbimage_generate(struct image_tool_params *params,
                             struct image_type_params *tparams)
 {
+       FILE *fcfg;
        int alloc_len;
+       int version;
        void *hdr;
-       int version = 0;
+       int ret;
+
+       fcfg = fopen(params->imagename, "r");
+       if (!fcfg) {
+               fprintf(stderr, "Could not open input file %s\n",
+                       params->imagename);
+               exit(EXIT_FAILURE);
+       }
+
+       image_cfg = malloc(IMAGE_CFG_ELEMENT_MAX *
+                          sizeof(struct image_cfg_element));
+       if (!image_cfg) {
+               fprintf(stderr, "Cannot allocate memory\n");
+               fclose(fcfg);
+               exit(EXIT_FAILURE);
+       }
+
+       memset(image_cfg, 0,
+              IMAGE_CFG_ELEMENT_MAX * sizeof(struct image_cfg_element));
+       rewind(fcfg);
+
+       ret = image_create_config_parse(fcfg);
+       fclose(fcfg);
+       if (ret) {
+               free(image_cfg);
+               exit(EXIT_FAILURE);
+       }
 
-       version = image_version_file(params->imagename);
-       if (version == 0) {
+       version = image_get_version();
+       switch (version) {
+               /*
+                * Fallback to version 0 if no version is provided in the
+                * cfg file
+                */
+       case -1:
+       case 0:
                alloc_len = sizeof(struct main_hdr_v0) +
                        sizeof(struct ext_hdr_v0);
-       } else {
+               break;
+
+       case 1:
                alloc_len = image_headersz_v1(NULL);
+               break;
+
+       default:
+               fprintf(stderr, "Unsupported version %d\n", version);
+               free(image_cfg);
+               exit(EXIT_FAILURE);
        }
 
+       free(image_cfg);
+
        hdr = malloc(alloc_len);
        if (!hdr) {
                fprintf(stderr, "%s: malloc return failure: %s\n",