From patchwork Fri Dec 15 14:19:44 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Glembotzki X-Patchwork-Id: 1876656 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=googlegroups.com header.i=@googlegroups.com header.a=rsa-sha256 header.s=20230601 header.b=GETo9+uS; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=buuMtYZg; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=googlegroups.com (client-ip=2a00:1450:4864:20::13a; helo=mail-lf1-x13a.google.com; envelope-from=swupdate+bncbdy5juxlviebbtwc6gvqmgqeimjqdmy@googlegroups.com; receiver=patchwork.ozlabs.org) Received: from mail-lf1-x13a.google.com (mail-lf1-x13a.google.com [IPv6:2a00:1450:4864:20::13a]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SsBJz0543z23p1 for ; Sat, 16 Dec 2023 01:23:15 +1100 (AEDT) Received: by mail-lf1-x13a.google.com with SMTP id 2adb3069b0e04-50bec8466b6sf557440e87.0 for ; Fri, 15 Dec 2023 06:23:14 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1702650192; cv=pass; d=google.com; s=arc-20160816; b=X0+SlyxG7fLzSnVBv33vVClQ9Ag6kjpl8hL8s0LuIR+IbBorfSebHZUGl33oFA12Cc idtk4qP667a7XiLfaujcuXpzETpBRRwpszldI4TfuCTH7fgxiZJT8HwnDRqXZaV0gV9f ktta3fNuF3FvksHIXAA7oYhwnB21qLOnKnHt/9Kr6wcO/Oy7X/ze9NDpvNtl6F+WdUJo e6f5zZmef/ff+fzkTOSzabOL35tXtcosBHyKMUO1v20noQZPY/NMEOgQh7YMHXHG3sUJ fZOfHofCyg2kUjqRuhgb6tjccPG9vyypK188eVzr55WvDrbv1DTEuI+oZAaL6h/6zxCu BBcg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:dkim-signature :dkim-signature; bh=Y9hMbETDzwj0BofYoHg6AivHn7oDLujGAEp7Wck3hjU=; fh=zydHuzCQWrku2OPQyZfraJZFcOpEXLQ/YBcu3QNiBd0=; b=O5mA+QsF4pZSNqcmpcjUJIcgevyn7/urjwJyKTZPucJaSVRiNM3igKUnoBHbFQ8Zuj Hy7uwtBtMPIMn0unZmIxsLyO9qE+4KgXX+ufWFZixLaV8W6056wlb1XEhiTCWrYOBzvJ LOePxY/arm7D45Ys0ybrzVhIGK5C97pdWk7D0B/EDyyL0jd1/C/CV3W49WR7Odhs4MTw pU+zSRJpcOQSStc+Own1lSd1hmj3qVTcjF9B1PvdCKE/QV8Gobn7uj+FtkLRvmbhLXJm iSnvd2+ZMYH/8/3vbwQY5ugYTomZkwYcQenMoIIs1aPG7WxBldvulmOvlMqjM3yGc2E/ qOdA== ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=avgGXVYS; spf=pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::52b as permitted sender) smtp.mailfrom=m.glembo@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1702650192; x=1703254992; darn=patchwork.ozlabs.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:mime-version:references:in-reply-to:message-id :date:subject:cc:to:from:sender:from:to:cc:subject:date:message-id :reply-to; bh=Y9hMbETDzwj0BofYoHg6AivHn7oDLujGAEp7Wck3hjU=; b=GETo9+uSV+zVDL/tTZhu0zy1Pj+MMdwJSS3bQGni3dUiwbHqGj5/lMNTT3ASWpjnh1 uRQRqHVCNxilK0rhrEq0uUclGj6vCfsfwsLP1rWT+zNt2Qwp8AHQVn1+FI/vLYGWbbGo XusEFbvU+Usj/YvRTW/LcfHoLNL9z83nUyJMwf5RJquSUxy/PRpXUeFWLhUkEhQdHlTx G59D/PfjpgAqybUT6casEcZZr+RjTmFCd9jGd1xNO70Z3V/DOCm+pbHGUyAdWEZI/On/ VJBrsJGUvMzYnsFWw/GKTSaRd2o2KOSX3p4lstYJXCav1CS6B/ODWk5QIIn6gQr1ulDL veYA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1702650192; x=1703254992; darn=patchwork.ozlabs.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:mime-version:references:in-reply-to:message-id :date:subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to; bh=Y9hMbETDzwj0BofYoHg6AivHn7oDLujGAEp7Wck3hjU=; b=buuMtYZgzXmEMZtfgw5S4KUYfvrxTwpUU8yGd0X+dJriM+4jBacuwe4k6Dv3qhlhvS xN/v8zD7dpts9PidJAJsNbteAOPqMe//dzjEHAotyUMDrN8J4GC3iJuD/Bf9kAjnSizv 9KnzmyjBIYj4qgWQ05Grh155IUB04yC2bgWPRn0XmS/MwY+A4tCGkcJW3wTD5lLPpSrm 49Y9qYV7XTO3hCrmJsQCkef5kXkin5YPemhYEYEAjyUT80sjHC6a6ofTHyGn/NiKx6u7 MpOao3XpXffQiWT9Z9uPFkbuCR+vjIwo4HEK5X5/aPOG3ofTauY1889YoOhh1FeTG0F+ RwnQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702650192; x=1703254992; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :x-beenthere:x-gm-message-state:sender:from:to:cc:subject:date :message-id:reply-to; bh=Y9hMbETDzwj0BofYoHg6AivHn7oDLujGAEp7Wck3hjU=; b=XDuH5iWv6Y/6RjyMhJgg31hKkrBpoyu4rhxVBDLKdyKPgTXXhaTHow9tOZpSsKI3V5 3i4+eUsuIS7aPQqNtmiMjAqwJ/ArVSPaYIAXy9N2naTucn+oew195Wpo7anZn84Bb1Ur NO7shV2cshHE3dCswzQ8hZ+7L0qHXQS0iXz0ZoXuYZW3eJRuqsIBXGMU242Aov1wK6sQ 9cGVhFeSv0VELCgE1X0m+u8123w8FOmKvJ6mTQ5JgEUbrMs+HZlJha4ygX9qFoyqOTch sxgv1hZejs7YDS4gtf3zIebh4Uf/jcFDwLFimnmyyo00p8yrJ1pbceE2aD3DmU7oeVBm BCgg== Sender: swupdate@googlegroups.com X-Gm-Message-State: AOJu0Yy+d+CS5Gx8U1pWeJwvdmg1rMIl5jEC9o8iAgp7BhrUY3dgJqz2 AzUGvl7RRTxUEKA6Oz/p5Mo= X-Google-Smtp-Source: AGHT+IHGkkqy0fH9tmBbELVJfMDnl3ZQMt1OY1dEg/bbz0r47Tj6CNEZLjYWaGbg0FO7MAWbYZKtog== X-Received: by 2002:ac2:57ce:0:b0:50b:fce6:bbd6 with SMTP id k14-20020ac257ce000000b0050bfce6bbd6mr4608268lfo.48.1702650191413; Fri, 15 Dec 2023 06:23:11 -0800 (PST) X-BeenThere: swupdate@googlegroups.com Received: by 2002:a05:6512:4010:b0:50b:fcd4:97e3 with SMTP id br16-20020a056512401000b0050bfcd497e3ls45952lfb.2.-pod-prod-07-eu; Fri, 15 Dec 2023 06:23:09 -0800 (PST) X-Received: by 2002:ac2:4341:0:b0:50b:f334:136d with SMTP id o1-20020ac24341000000b0050bf334136dmr5114327lfl.50.1702650188930; Fri, 15 Dec 2023 06:23:08 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702650188; cv=none; d=google.com; s=arc-20160816; b=XmvxojT9cLvaH+2BTHCxCVn2Udwtkdq0M45jrgIjgfVexZnBRctqF9iWg0nOooIZRd mKtQvqEb2tx/0nzqN81owWOqeTlBoDT7SLndKlRMAIkR9fvwjCgXuMIXScbTdHO48nM3 tOX2E20nvQXlzJ/OlPI3rx7hzkJTRE0cn+mnpW2n1eCL3NFkTUi/fQIneyGYfCEUzTuB LuaPjRkRhpvgPxxEaBmJPMutMKLsY9IWe715NtCzR8n4wA0BSgkAuh+6IzeBEI6CfwIc KJgYhfvGMdPFV+ItnezQH4fCGe6JKKumWBFLY+YPkZWv753n2W1nvPZbAM6QpYzupq/v 6W0A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=mAjdpuB9jiw90iKmUrNKCudoJa9JPhYfim+X8PODYwk=; fh=zydHuzCQWrku2OPQyZfraJZFcOpEXLQ/YBcu3QNiBd0=; b=UHcdLzo7hBkXTz3ubSjVj4q8ql/N/EqJOzcJ+GudXyMltPWCDnTW0z25P4v8hx1gQk hmZTb28Va3J9ttye2kPhryoFWajsj3ch08G9bS7DV7zVk7iLpBu5e23CYFxSVPW06RAR x/Exum33Jtem/znV+O8g5QoilNNyFbzWv56LoKP9YDSG9600T6e6GDIEXsAtVW20dwLL 4QE93K4tsYSP5d00kVzmtRNm7bhoV5UrlIRAuMwCOgzgsbc020D5xKCSPbsyG0vxl9eK o65fUFcAqg3gvmvJ9f8apmds0OXwEz5L0cyfYM0ZWhKqFGTRBhGHIdaFWeMmHfUxYAtC j6jQ== ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=avgGXVYS; spf=pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::52b as permitted sender) smtp.mailfrom=m.glembo@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from mail-ed1-x52b.google.com (mail-ed1-x52b.google.com. [2a00:1450:4864:20::52b]) by gmr-mx.google.com with ESMTPS id 7-20020ac25f47000000b0050e223da6f7si9956lfz.5.2023.12.15.06.23.08 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 15 Dec 2023 06:23:08 -0800 (PST) Received-SPF: pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::52b as permitted sender) client-ip=2a00:1450:4864:20::52b; Received: by mail-ed1-x52b.google.com with SMTP id 4fb4d7f45d1cf-552dc0d0e28so529439a12.0 for ; Fri, 15 Dec 2023 06:23:08 -0800 (PST) X-Received: by 2002:a17:907:9686:b0:a18:92db:282b with SMTP id hd6-20020a170907968600b00a1892db282bmr7501946ejc.39.1702650187816; Fri, 15 Dec 2023 06:23:07 -0800 (PST) Received: from PC-2635.irisgmbh.local (dslb-002-203-161-041.002.203.pools.vodafone-ip.de. [2.203.161.41]) by smtp.gmail.com with ESMTPSA id vx6-20020a170907a78600b00a1e852ab3f0sm10944029ejc.15.2023.12.15.06.23.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Dec 2023 06:23:07 -0800 (PST) From: Michael Glembotzki To: swupdate@googlegroups.com Cc: Michael Glembotzki Subject: [swupdate] [V3][PATCH 07/10] swupdate: Initalize the recipient key pair for asym decryption Date: Fri, 15 Dec 2023 15:19:44 +0100 Message-ID: <20231215142251.52393-8-Michael.Glembotzki@iris-sensing.com> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231215142251.52393-1-Michael.Glembotzki@iris-sensing.com> References: <20231215142251.52393-1-Michael.Glembotzki@iris-sensing.com> MIME-Version: 1.0 X-Original-Sender: m.glembo@gmail.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=avgGXVYS; spf=pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::52b as permitted sender) smtp.mailfrom=m.glembo@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Precedence: list Mailing-list: list swupdate@googlegroups.com; contact swupdate+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: swupdate@googlegroups.com X-Google-Group-Id: 605343134186 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , Add recipient key fname to swupdate_cfg for asym decryption. Read and initalize the recip-keypair from argument -r or configuration file. Signed-off-by: Michael Glembotzki --- core/swupdate.c | 44 ++++++++++++++++++++++++++--- examples/configuration/swupdate.cfg | 3 ++ include/swupdate.h | 1 + 3 files changed, 44 insertions(+), 4 deletions(-) diff --git a/core/swupdate.c b/core/swupdate.c index 6f9938e..5e03846 100644 --- a/core/swupdate.c +++ b/core/swupdate.c @@ -101,8 +101,11 @@ static struct option long_options[] = { {"forced-signer-name", required_argument, NULL, '2'}, #endif #endif -#ifdef CONFIG_ENCRYPTED_IMAGES +#if defined(CONFIG_ENCRYPTED_IMAGES) && !defined(CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION) {"key-aes", required_argument, NULL, 'K'}, +#endif +#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION + {"recip-keypair", required_argument, NULL, 'r'}, #endif {"loglevel", required_argument, NULL, 'l'}, {"max-version", required_argument, NULL, '3'}, @@ -162,9 +165,12 @@ static void usage(char *programname) " --ca-path : path to the Certificate Authority (PEM)\n" #endif #endif -#ifdef CONFIG_ENCRYPTED_IMAGES +#if defined(CONFIG_ENCRYPTED_IMAGES) && !defined(CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION) " -K, --key-aes : the file contains the symmetric key to be used\n" " to decrypt images\n" +#endif +#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION + " -r, --recip-keypair : path to the recipient keypair (PEM)\n" #endif " -n, --dry-run : run SWUpdate without installing the software\n" " -N, --no-downgrading : not install a release older as \n" @@ -310,8 +316,14 @@ static int read_globals_settings(void *elem, void *data) "public-key-file", sw->publickeyfname); GET_FIELD_STRING(LIBCFG_PARSER, elem, "ca-path", sw->publickeyfname); +#if defined(CONFIG_ENCRYPTED_IMAGES) && !defined(CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION) GET_FIELD_STRING(LIBCFG_PARSER, elem, "aes-key-file", sw->aeskeyfname); +#endif +#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION + GET_FIELD_STRING(LIBCFG_PARSER, elem, + "recip-keypair", sw->recipkeypairfname); +#endif GET_FIELD_STRING(LIBCFG_PARSER, elem, "mtd-blacklist", sw->mtdblacklist); GET_FIELD_STRING(LIBCFG_PARSER, elem, @@ -497,9 +509,12 @@ int main(int argc, char **argv) public_key_mandatory = 1; #endif #endif -#ifdef CONFIG_ENCRYPTED_IMAGES +#if defined(CONFIG_ENCRYPTED_IMAGES) && !defined(CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION) strcat(main_options, "K:"); #endif +#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION + strcat(main_options, "r:"); +#endif memset(fname, 0, sizeof(fname)); @@ -656,12 +671,19 @@ int main(int argc, char **argv) strlcpy(swcfg.maximum_version, optarg, sizeof(swcfg.maximum_version)); break; -#ifdef CONFIG_ENCRYPTED_IMAGES +#if defined(CONFIG_ENCRYPTED_IMAGES) && !defined(CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION) case 'K': strlcpy(swcfg.aeskeyfname, optarg, sizeof(swcfg.aeskeyfname)); break; +#endif +#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION + case 'r': + strlcpy(swcfg.recipkeypairfname, + optarg, + sizeof(swcfg.recipkeypairfname)); + break; #endif case 'N': swcfg.no_downgrading = true; @@ -842,6 +864,19 @@ int main(int argc, char **argv) mtd_set_ubiblacklist(swcfg.mtdblacklist); #endif +#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION + if (strlen(swcfg.recipkeypairfname)) { + if (swupdate_dgst_add_recipient_keypair(&swcfg, swcfg.recipkeypairfname)) { + fprintf(stderr, + "Error: Recipient keypair cannot be initialized.\n"); + exit(EXIT_FAILURE); + } + } else { + fprintf(stderr, + "Error: SWUpdate is built for asym encrypted images, provide a recipient key pair.\n"); + exit(EXIT_FAILURE); + } +#else /* * If an AES key is passed, load it to allow * to decrypt images @@ -853,6 +888,7 @@ int main(int argc, char **argv) exit(EXIT_FAILURE); } } +#endif lua_handlers_init(); diff --git a/examples/configuration/swupdate.cfg b/examples/configuration/swupdate.cfg index 8b8a6b1..8e2c8cb 100644 --- a/examples/configuration/swupdate.cfg +++ b/examples/configuration/swupdate.cfg @@ -25,6 +25,9 @@ # aes-key-file : string # file containing the symmetric key for # image decryption +# recip-keypair : string +# file containing the key pair (private key and cert) in PEM for +# asymmetric image decryption # preupdatecmd : string # command to be executed right before the update # is installed diff --git a/include/swupdate.h b/include/swupdate.h index c1f86b3..cdfb971 100644 --- a/include/swupdate.h +++ b/include/swupdate.h @@ -57,6 +57,7 @@ struct swupdate_cfg { char output[SWUPDATE_GENERAL_STRING_SIZE]; char publickeyfname[SWUPDATE_GENERAL_STRING_SIZE]; char aeskeyfname[SWUPDATE_GENERAL_STRING_SIZE]; + char recipkeypairfname[SWUPDATE_GENERAL_STRING_SIZE]; char postupdatecmd[SWUPDATE_GENERAL_STRING_SIZE]; char preupdatecmd[SWUPDATE_GENERAL_STRING_SIZE]; char minimum_version[SWUPDATE_GENERAL_STRING_SIZE];