From patchwork Mon Jan 15 19:26:41 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Glembotzki X-Patchwork-Id: 1886823 X-Patchwork-Delegate: sbabic@denx.de Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=googlegroups.com header.i=@googlegroups.com header.a=rsa-sha256 header.s=20230601 header.b=xrlHw6f9; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=MdtZFRRd; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=googlegroups.com (client-ip=2a00:1450:4864:20::23b; helo=mail-lj1-x23b.google.com; envelope-from=swupdate+bncbdy5juxlviebbaeps2wqmgqe2vbcrwi@googlegroups.com; receiver=patchwork.ozlabs.org) Received: from mail-lj1-x23b.google.com (mail-lj1-x23b.google.com [IPv6:2a00:1450:4864:20::23b]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4TDMdd2wl3z23dv for ; Tue, 16 Jan 2024 06:29:09 +1100 (AEDT) Received: by mail-lj1-x23b.google.com with SMTP id 38308e7fff4ca-2cd84e8c959sf36162821fa.3 for ; Mon, 15 Jan 2024 11:29:08 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1705346945; cv=pass; d=google.com; s=arc-20160816; b=Z6sN/C10pBlKXGQvs02QwHXj/Kz2WkEf//QwWdsqwYndUA8Ye64eLDeqpT3CdRCEgf 6SOSroBlZtiJ4KmVz5uuhaBxaFc1apc1KhAGVbMkgKJCnOlOBM1pBYFtOjIuD4navt2B Cbfv0zo7MdkTnOnoeZDjK0ahWpzjijlp3atINDj5JVh4eF40edSqlH6emLhjqDn8ZHkx tSGv6W7xRJkFYV36vvvaJnXMdWyWIN1fo2MYle86nluaeNNALKNVMHAusyKV/TwpVr2s /F1GpaZ0BQ9cSCyuWDkYbjrQDym/8+aIgQQMin2FrLPxoRvQdNB4iBX7za64IMgfzXF6 QexA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:dkim-signature :dkim-signature; bh=g/SoXrEQBNKD4kdm5znjxdv2FA11uZFHQY8NEs3k0+s=; fh=zydHuzCQWrku2OPQyZfraJZFcOpEXLQ/YBcu3QNiBd0=; b=GLjl+Ga0bEloTRSxwecki1dcjEAUABrvGBAvcyRGAipGtBG5yriHV01J9VZXUoRvaA 34sUiZAsJc5xnl309FQl1FR0JYiK4pdVk09KVLCf5IYzsn1/b353Ti2bf0x/xP5Xk1wA DP4bsxpO/xCRsDEHCk5v0kAJpD+szFqv+IS2IuWSB4DujaFWKK5RkAd/IEaKQ6oUoHwY OK7OfsCm7YJPGkcMpFOCWI05ExaynFQg+h+hBpNKGczLL6yfiLQ13IESZZpIBGNByiEB UxvJiILhcIjhjKYmwPKh3+tyFa9xJBhMg+o2iF6mo35bP9yJxprLvMkAgL9SUAdKwhJW dSjQ== ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=kU6Fw6Hf; spf=pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::131 as permitted sender) smtp.mailfrom=m.glembo@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1705346945; x=1705951745; darn=patchwork.ozlabs.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:mime-version:references:in-reply-to:message-id :date:subject:cc:to:from:sender:from:to:cc:subject:date:message-id :reply-to; bh=g/SoXrEQBNKD4kdm5znjxdv2FA11uZFHQY8NEs3k0+s=; b=xrlHw6f92a0jN2574q9RgQ20XB8Rfxqbb9YLnPSMCKKwRSjQQrC9v/3JX0suqsSfW8 QO6WABDJdY12ahBdHNHX6jGwMn3TrLv27kgY9a31XR/+LLVJBu2R0o9OG/MGsoFE4JhZ QHgcI0au5Kwq2f7c7sWaqbkCCmn8bm0ua1F042LzPT/fYqIJ1rpcRPIEKm+SlYQh/huA c0jI3u0uf8xNk8QZBvANjEL8oCo0MqMomFB8LS0wXVOrYp505YRGXids/k6gNqdHCgmY H5opP42QwHj6/SO/TrNzD/N96Gg5Efc6Gu0unppESQW0iNRmVq447uj6ZRt0TNV6NGGk ConQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1705346945; x=1705951745; darn=patchwork.ozlabs.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:mime-version:references:in-reply-to:message-id :date:subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to; bh=g/SoXrEQBNKD4kdm5znjxdv2FA11uZFHQY8NEs3k0+s=; b=MdtZFRRdiroeOyaKGKdsONW2tsl9ieiysRbmZaDji1UB80/pS0mGgfpXpdn+LRA8Qc lF2rABO/i4rDFGSeu+7qdm9A1aF9OvFk46bgrpuXAks61e5mBiPxvovGGbSOanGas+Ri sVyJXn2dY5NkhSyqegjEugV5yLP+7cQK+Cp7bvHhuKMv7iKecBovZ0Oz71QFmfy8cDtm vkDCN6qxBiPoS2n57Gt11Vx6FgwcCw0aCBcieh23GHXSAs7dyNivm8e/wexrMjSPM7rI 0qcyohnfST9ZF/NXkcQZyoG2Jy68emKvSA2YuVjbRNO3yfSTUR3+BkIjIDd0C6+hc9rt zGHw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1705346945; x=1705951745; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :x-beenthere:x-gm-message-state:sender:from:to:cc:subject:date :message-id:reply-to; bh=g/SoXrEQBNKD4kdm5znjxdv2FA11uZFHQY8NEs3k0+s=; b=BIP4kGWH+xRerzxRLg7wLL63LCjuh70BALKUZe/0oXMlF71N79sVhZHlAwLap/+7dy xDI8xwN7KmntYePxIj+tio0MpURLqmAgmm03zrcxjCvarrEDcCusMY2HL3J7mW6Tlnvn Hq65Eq78oOvIWfPujLrWH8OKKcingDoXnbs/dah0JaJZmtlntIwdCKRMPu5WXN5qqahg 3mRKkFh0jNE6j7av0hiVT3Z5QBlD4HTDnVIA70tAhaZU8inPBzoYHRCxOhfLWAG+/nm2 LSUZ4jlPn+WD8SwZWJLQgxd2saK2VEbe7JCcb+ICMZmT2mTZvzjNY85NyvvgnkQlsmt0 Ts3w== Sender: swupdate@googlegroups.com X-Gm-Message-State: AOJu0YzyAWS0X5cvyJonzeApO9nApjDwFmAjwInPMMNnM1Ee4F1A07Dj BYeoShzNPDUO1dGZjUUMHFE= X-Google-Smtp-Source: AGHT+IEeu/e642sldK5kdl8X3t1phGRKSPeKFsdLcBU8BrE754iqGdEx35mwG+ddZyRrAJpcteh0Fw== X-Received: by 2002:a2e:86da:0:b0:2cd:11f9:a629 with SMTP id n26-20020a2e86da000000b002cd11f9a629mr2821825ljj.16.1705346944576; Mon, 15 Jan 2024 11:29:04 -0800 (PST) X-BeenThere: swupdate@googlegroups.com Received: by 2002:a2e:300a:0:b0:2cd:613a:8cc3 with SMTP id w10-20020a2e300a000000b002cd613a8cc3ls149676ljw.0.-pod-prod-04-eu; Mon, 15 Jan 2024 11:29:02 -0800 (PST) X-Received: by 2002:a05:651c:1075:b0:2cc:7db2:acb6 with SMTP id y21-20020a05651c107500b002cc7db2acb6mr2576130ljm.7.1705346941779; Mon, 15 Jan 2024 11:29:01 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1705346941; cv=none; d=google.com; s=arc-20160816; b=ndoC9q1BCINf/xeb/uiAc7IALaVGRwvQwbyV4egBv9UhJmcpF7k9i2RXDiwFc1DIri mT3al1FRzO2BiaCrKyEivwIAQZmj4oy4NNkOXDKq9JIbAhQhTq6OAYDtFGoQsnYXsdfv 5upiGrEzzWzKzi/vqjcy6KAlVXeK8iosISNlN2o7c89sYF6fFlG5vzrgmP0gnnYfzkIW BF0Mlylc+KSp8g3dDDOMyn2X3UCtC7BEaamOCIXVkgsaS3+x4XoR/81ru3MX0wvO/gLq 4uUM+NT4vW1vQYcLuOnlDOlMFPMfGaW2bbDH7vEe6PDxK7bFPKowmoEFTiXXUET555Mt gmXQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=hWqzP31Fy8CrWNa3dJjVH+oEwnEdiC3ER1srbVO8cqY=; fh=zydHuzCQWrku2OPQyZfraJZFcOpEXLQ/YBcu3QNiBd0=; b=Nhit5Yhs/nSbsQ1WNenKZgdzxNHuG3uwoOsDlZyvKRoKHFhfvoW+kYbjxt8GUVC2V+ Ge4Xjlxt2S21yYA8+qLtjW6By8aK/PG9V8O0DiKwxx2KZz9Uf0n4rjiexEVaMF/hYJxW 4W7aUBt4i0Vv0or4Y63KdzL0aTxQprYj2jd6CoEGirOzIGRYVQ2eeHLB/OMKr1aybEUD S7/LXoO7CjBQZoIc0N5l+p/LYAnYkLIgv8FC6Q7wHDXC2Cl5jF19U4ZJDNnJbTMl/q4c AKeWy5iiiWVQfepZDshSRr7zNJmD4MR8//OTCjlLu3oZFjHIhwFevlJq/02ktop83O4F DV/Q== ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=kU6Fw6Hf; spf=pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::131 as permitted sender) smtp.mailfrom=m.glembo@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from mail-lf1-x131.google.com (mail-lf1-x131.google.com. [2a00:1450:4864:20::131]) by gmr-mx.google.com with ESMTPS id e9-20020a2e8189000000b002cd6569c00asi311891ljg.0.2024.01.15.11.29.01 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 15 Jan 2024 11:29:01 -0800 (PST) Received-SPF: pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::131 as permitted sender) client-ip=2a00:1450:4864:20::131; Received: by mail-lf1-x131.google.com with SMTP id 2adb3069b0e04-50e7d6565b5so10723907e87.0 for ; Mon, 15 Jan 2024 11:29:01 -0800 (PST) X-Received: by 2002:a05:6512:239c:b0:50b:e724:62a8 with SMTP id c28-20020a056512239c00b0050be72462a8mr3312183lfv.92.1705346940952; Mon, 15 Jan 2024 11:29:00 -0800 (PST) Received: from PC-2635.irisgmbh.local (dslb-002-203-161-041.002.203.pools.vodafone-ip.de. [2.203.161.41]) by smtp.gmail.com with ESMTPSA id tl7-20020a170907c30700b00a2de58581f6sm1289255ejc.74.2024.01.15.11.29.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Jan 2024 11:29:00 -0800 (PST) From: Michael Glembotzki To: swupdate@googlegroups.com Cc: Michael Glembotzki Subject: [swupdate] [V4][PATCH 4/8] Add functions for asymmetric file decryption with CMS Date: Mon, 15 Jan 2024 20:26:41 +0100 Message-ID: <20240115192845.51530-5-Michael.Glembotzki@iris-sensing.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240115192845.51530-1-Michael.Glembotzki@iris-sensing.com> References: <20240115192845.51530-1-Michael.Glembotzki@iris-sensing.com> MIME-Version: 1.0 X-Original-Sender: m.glembo@gmail.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=kU6Fw6Hf; spf=pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::131 as permitted sender) smtp.mailfrom=m.glembo@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Precedence: list Mailing-list: list swupdate@googlegroups.com; contact swupdate+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: swupdate@googlegroups.com X-Google-Group-Id: 605343134186 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , Decryption with OpenSSL CMS is limited to entire files, preventing the ability to decrypt data in chunks, as is possible with symmetric decryption. Signed-off-by: Michael Glembotzki --- corelib/Makefile | 3 + corelib/swupdate_cms_decrypt.c | 115 +++++++++++++++++++++++++++++++++ include/sslapi.h | 9 +++ 3 files changed, 127 insertions(+) create mode 100644 corelib/swupdate_cms_decrypt.c diff --git a/corelib/Makefile b/corelib/Makefile index c9ca4aa..06690d8 100644 --- a/corelib/Makefile +++ b/corelib/Makefile @@ -18,6 +18,9 @@ endif lib-$(CONFIG_SIGALG_RAWRSA) += swupdate_rsa_verify.o lib-$(CONFIG_SIGALG_RSAPSS) += swupdate_rsa_verify.o endif +ifeq ($(CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION),y) +lib-$(CONFIG_ENCRYPTED_IMAGES) += swupdate_cms_decrypt.o +endif ifeq ($(CONFIG_SSL_IMPL_OPENSSL),y) lib-$(CONFIG_SIGALG_CMS) += swupdate_cms_verify.o endif diff --git a/corelib/swupdate_cms_decrypt.c b/corelib/swupdate_cms_decrypt.c new file mode 100644 index 0000000..45aa596 --- /dev/null +++ b/corelib/swupdate_cms_decrypt.c @@ -0,0 +1,115 @@ +/* + * (C) Copyright 2024 + * Michael Glembotzki, iris-GmbH infrared & intelligent sensors, michael.glembotzki@iris-sensing.com + * + * SPDX-License-Identifier: GPL-2.0-only + * + * Code mostly taken from openssl examples + */ +#include +#include "swupdate.h" +#include "sslapi.h" +#include "util.h" + +int swupdate_dgst_add_asym_keypair(struct swupdate_cfg *sw, const char *keypair_file) +{ + X509 *asym_decryption_cert = NULL; + EVP_PKEY *asym_decryption_key = NULL; + BIO *tbio = NULL; + struct swupdate_digest *dgst = sw->dgst; + int ret = 0; + + if (!dgst) { + dgst = calloc(1, sizeof(*dgst)); + if (!dgst) { + ret = 1; + goto err; + } + } + + tbio = BIO_new_file(keypair_file, "r"); + + if (!tbio) { + ERROR("%s cannot be opened", keypair_file); + ret = 1; + goto err; + } + + asym_decryption_cert = PEM_read_bio_X509(tbio, NULL, 0, NULL); + if (!asym_decryption_cert) + WARN("Decryption cert not found"); + + BIO_reset(tbio); + + asym_decryption_key = PEM_read_bio_PrivateKey(tbio, NULL, 0, NULL); + BIO_free(tbio); + if (!asym_decryption_key) { + ERROR("Decryption key not found"); + ret = 1; + goto err; + } + + dgst->asym_decryption_cert = asym_decryption_cert; + dgst->asym_decryption_key = asym_decryption_key; + + return ret; + +err: + if (dgst) + free(dgst); + + return ret; +} + +int swupdate_decrypt_file(struct swupdate_digest *dgst, const char *infile, const char *outfile) +{ + BIO *in = NULL, *out = NULL; + CMS_ContentInfo *cms = NULL; + int ret = 0; + + if (!dgst || !infile || !outfile) + return 1; + + /* Open CMS message to decrypt */ + in = BIO_new_file(infile, "rb"); + if (!in) { + ERROR("%s cannot be opened", infile); + ret = 1; + goto err; + } + + /* Parse message */ + cms = d2i_CMS_bio(in, NULL); + if (!cms) { + ERROR("%s cannot be parsed as DER-encoded CMS blob", infile); + ret = 1; + goto err; + } + + out = BIO_new_file(outfile, "wb"); + if (!out) { + ERROR("%s cannot be opened", outfile); + ret = 1; + goto err; + } + + if (chmod(outfile, 0600)) { + ERROR("Setting file permissions"); + ret = 1; + goto err; + } + + /* Decrypt CMS message */ + if (!CMS_decrypt(cms, dgst->asym_decryption_key, dgst->asym_decryption_cert, NULL, out, 0)) { + ERR_print_errors_fp(stderr); + ERROR("Decrypting %s failed", infile); + ret = 1; + goto err; + } + +err: + BIO_free(in); + BIO_free(out); + CMS_ContentInfo_free(cms); + return ret; +} diff --git a/include/sslapi.h b/include/sslapi.h index 83efd9f..d27a23c 100644 --- a/include/sslapi.h +++ b/include/sslapi.h @@ -113,6 +113,10 @@ struct swupdate_digest { int verbose; char *gpgme_protocol; #endif +#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION + EVP_PKEY *asym_decryption_key; + X509 *asym_decryption_cert; +#endif }; #if OPENSSL_VERSION_NUMBER < 0x10100000L @@ -222,6 +226,11 @@ UNUSED static inline struct swupdate_digest *swupdate_DECRYPT_init( #define swupdate_DECRYPT_cleanup(p) #endif +#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION +int swupdate_dgst_add_asym_keypair(struct swupdate_cfg *sw, const char *keypair_file); +int swupdate_decrypt_file(struct swupdate_digest *dgst, const char *infile, const char *outfile); +#endif + #ifndef SSL_PURPOSE_DEFAULT #define SSL_PURPOSE_EMAIL_PROT -1 #define SSL_PURPOSE_CODE_SIGN -1