X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=common%2Fimage-sig.c;h=f65d883994be42e81b12e4f8c2921f90346e943f;hb=86fbad2492cc51f0489253d50ce5f06b5e5b2fb9;hp=8601edaca35f41d0c996e15fb7f447179a8255b3;hpb=d6694aff569a0838a9d0ef352128f5aa309d73ff;p=u-boot diff --git a/common/image-sig.c b/common/image-sig.c index 8601edaca3..f65d883994 100644 --- a/common/image-sig.c +++ b/common/image-sig.c @@ -1,7 +1,6 @@ +// SPDX-License-Identifier: GPL-2.0+ /* * Copyright (c) 2013, Google Inc. - * - * SPDX-License-Identifier: GPL-2.0+ */ #ifdef USE_HOSTCC @@ -32,70 +31,76 @@ void *image_get_host_blob(void) struct checksum_algo checksum_algos[] = { { - "sha1", - SHA1_SUM_LEN, - RSA2048_BYTES, -#if IMAGE_ENABLE_SIGN - EVP_sha1, -#endif - sha1_calculate, - padding_sha1_rsa2048, - }, - { - "sha256", - SHA256_SUM_LEN, - RSA2048_BYTES, + .name = "sha1", + .checksum_len = SHA1_SUM_LEN, + .der_len = SHA1_DER_LEN, + .der_prefix = sha1_der_prefix, #if IMAGE_ENABLE_SIGN - EVP_sha256, + .calculate_sign = EVP_sha1, #endif - sha256_calculate, - padding_sha256_rsa2048, + .calculate = hash_calculate, }, { - "sha256", - SHA256_SUM_LEN, - RSA4096_BYTES, + .name = "sha256", + .checksum_len = SHA256_SUM_LEN, + .der_len = SHA256_DER_LEN, + .der_prefix = sha256_der_prefix, #if IMAGE_ENABLE_SIGN - EVP_sha256, + .calculate_sign = EVP_sha256, #endif - sha256_calculate, - padding_sha256_rsa4096, + .calculate = hash_calculate, } }; -struct image_sig_algo image_sig_algos[] = { - { - "sha1,rsa2048", - rsa_sign, - rsa_add_verify_data, - rsa_verify, - &checksum_algos[0], - }, +struct crypto_algo crypto_algos[] = { { - "sha256,rsa2048", - rsa_sign, - rsa_add_verify_data, - rsa_verify, - &checksum_algos[1], + .name = "rsa2048", + .key_len = RSA2048_BYTES, + .sign = rsa_sign, + .add_verify_data = rsa_add_verify_data, + .verify = rsa_verify, }, { - "sha256,rsa4096", - rsa_sign, - rsa_add_verify_data, - rsa_verify, - &checksum_algos[2], + .name = "rsa4096", + .key_len = RSA4096_BYTES, + .sign = rsa_sign, + .add_verify_data = rsa_add_verify_data, + .verify = rsa_verify, } }; -struct image_sig_algo *image_get_sig_algo(const char *name) +struct checksum_algo *image_get_checksum_algo(const char *full_name) +{ + int i; + const char *name; + + for (i = 0; i < ARRAY_SIZE(checksum_algos); i++) { + name = checksum_algos[i].name; + /* Make sure names match and next char is a comma */ + if (!strncmp(name, full_name, strlen(name)) && + full_name[strlen(name)] == ',') + return &checksum_algos[i]; + } + + return NULL; +} + +struct crypto_algo *image_get_crypto_algo(const char *full_name) { int i; + const char *name; + + /* Move name to after the comma */ + name = strchr(full_name, ','); + if (!name) + return NULL; + name += 1; - for (i = 0; i < ARRAY_SIZE(image_sig_algos); i++) { - if (!strcmp(image_sig_algos[i].name, name)) - return &image_sig_algos[i]; + for (i = 0; i < ARRAY_SIZE(crypto_algos); i++) { + if (!strcmp(crypto_algos[i].name, name)) + return &crypto_algos[i]; } return NULL; @@ -159,12 +164,14 @@ static int fit_image_setup_verify(struct image_sign_info *info, info->keyname = fdt_getprop(fit, noffset, "key-name-hint", NULL); info->fit = (void *)fit; info->node_offset = noffset; - info->algo = image_get_sig_algo(algo_name); + info->name = algo_name; + info->checksum = image_get_checksum_algo(algo_name); + info->crypto = image_get_crypto_algo(algo_name); info->fdt_blob = gd_fdt_blob(); info->required_keynode = required_keynode; printf("%s:%s", algo_name, info->keyname); - if (!info->algo) { + if (!info->checksum || !info->crypto) { *err_msgp = "Unknown signature algorithm"; return -1; } @@ -194,7 +201,7 @@ int fit_image_check_sig(const void *fit, int noffset, const void *data, region.data = data; region.size = size; - if (info.algo->verify(&info, ®ion, 1, fit_value, fit_value_len)) { + if (info.crypto->verify(&info, ®ion, 1, fit_value, fit_value_len)) { *err_msgp = "Verification failed"; return -1; } @@ -212,9 +219,7 @@ static int fit_image_verify_sig(const void *fit, int image_noffset, int ret; /* Process all hash subnodes of the component image node */ - for (noffset = fdt_first_subnode(fit, image_noffset); - noffset >= 0; - noffset = fdt_next_subnode(fit, noffset)) { + fdt_for_each_subnode(noffset, fit, image_noffset) { const char *name = fit_get_name(fit, noffset, NULL); if (!strncmp(name, FIT_SIG_NODENAME, @@ -262,9 +267,7 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset, return 0; } - for (noffset = fdt_first_subnode(sig_blob, sig_node); - noffset >= 0; - noffset = fdt_next_subnode(sig_blob, noffset)) { + fdt_for_each_subnode(noffset, sig_blob, sig_node) { const char *required; int ret; @@ -343,7 +346,7 @@ int fit_config_check_sig(const void *fit, int noffset, int required_keynode, /* * Each node can generate one region for each sub-node. Allow for - * 7 sub-nodes (hash@1, signature@1, etc.) and some extra. + * 7 sub-nodes (hash-1, signature-1, etc.) and some extra. */ max_regions = 20 + count * 7; struct fdt_region fdt_regions[max_regions]; @@ -379,8 +382,8 @@ int fit_config_check_sig(const void *fit, int noffset, int required_keynode, struct image_region region[count]; fit_region_make_list(fit, fdt_regions, count, region); - if (info.algo->verify(&info, region, count, fit_value, - fit_value_len)) { + if (info.crypto->verify(&info, region, count, fit_value, + fit_value_len)) { *err_msgp = "Verification failed"; return -1; } @@ -397,9 +400,7 @@ static int fit_config_verify_sig(const void *fit, int conf_noffset, int ret; /* Process all hash subnodes of the component conf node */ - for (noffset = fdt_first_subnode(fit, conf_noffset); - noffset >= 0; - noffset = fdt_next_subnode(fit, noffset)) { + fdt_for_each_subnode(noffset, fit, conf_noffset) { const char *name = fit_get_name(fit, noffset, NULL); if (!strncmp(name, FIT_SIG_NODENAME, @@ -444,9 +445,7 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset, return 0; } - for (noffset = fdt_first_subnode(sig_blob, sig_node); - noffset >= 0; - noffset = fdt_next_subnode(sig_blob, noffset)) { + fdt_for_each_subnode(noffset, sig_blob, sig_node) { const char *required; int ret;