1 /* 2 * Copyright (c) 2013, Google Inc. 3 * 4 * SPDX-License-Identifier: GPL-2.0+ 5 */ 6 7 #include "mkimage.h" 8 #include <stdio.h> 9 #include <string.h> 10 #include <image.h> 11 #include <time.h> 12 #include <openssl/bn.h> 13 #include <openssl/rsa.h> 14 #include <openssl/pem.h> 15 #include <openssl/err.h> 16 #include <openssl/ssl.h> 17 #include <openssl/evp.h> 18 #include <openssl/engine.h> 19 20 #if OPENSSL_VERSION_NUMBER >= 0x10000000L 21 #define HAVE_ERR_REMOVE_THREAD_STATE 22 #endif 23 24 #if OPENSSL_VERSION_NUMBER < 0x10100000L 25 static void RSA_get0_key(const RSA *r, 26 const BIGNUM **n, const BIGNUM **e, const BIGNUM **d) 27 { 28 if (n != NULL) 29 *n = r->n; 30 if (e != NULL) 31 *e = r->e; 32 if (d != NULL) 33 *d = r->d; 34 } 35 #endif 36 37 static int rsa_err(const char *msg) 38 { 39 unsigned long sslErr = ERR_get_error(); 40 41 fprintf(stderr, "%s", msg); 42 fprintf(stderr, ": %s\n", 43 ERR_error_string(sslErr, 0)); 44 45 return -1; 46 } 47 48 /** 49 * rsa_pem_get_pub_key() - read a public key from a .crt file 50 * 51 * @keydir: Directory containins the key 52 * @name Name of key file (will have a .crt extension) 53 * @rsap Returns RSA object, or NULL on failure 54 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 55 */ 56 static int rsa_pem_get_pub_key(const char *keydir, const char *name, RSA **rsap) 57 { 58 char path[1024]; 59 EVP_PKEY *key; 60 X509 *cert; 61 RSA *rsa; 62 FILE *f; 63 int ret; 64 65 *rsap = NULL; 66 snprintf(path, sizeof(path), "%s/%s.crt", keydir, name); 67 f = fopen(path, "r"); 68 if (!f) { 69 fprintf(stderr, "Couldn't open RSA certificate: '%s': %s\n", 70 path, strerror(errno)); 71 return -EACCES; 72 } 73 74 /* Read the certificate */ 75 cert = NULL; 76 if (!PEM_read_X509(f, &cert, NULL, NULL)) { 77 rsa_err("Couldn't read certificate"); 78 ret = -EINVAL; 79 goto err_cert; 80 } 81 82 /* Get the public key from the certificate. */ 83 key = X509_get_pubkey(cert); 84 if (!key) { 85 rsa_err("Couldn't read public key\n"); 86 ret = -EINVAL; 87 goto err_pubkey; 88 } 89 90 /* Convert to a RSA_style key. */ 91 rsa = EVP_PKEY_get1_RSA(key); 92 if (!rsa) { 93 rsa_err("Couldn't convert to a RSA style key"); 94 ret = -EINVAL; 95 goto err_rsa; 96 } 97 fclose(f); 98 EVP_PKEY_free(key); 99 X509_free(cert); 100 *rsap = rsa; 101 102 return 0; 103 104 err_rsa: 105 EVP_PKEY_free(key); 106 err_pubkey: 107 X509_free(cert); 108 err_cert: 109 fclose(f); 110 return ret; 111 } 112 113 /** 114 * rsa_engine_get_pub_key() - read a public key from given engine 115 * 116 * @keydir: Key prefix 117 * @name Name of key 118 * @engine Engine to use 119 * @rsap Returns RSA object, or NULL on failure 120 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 121 */ 122 static int rsa_engine_get_pub_key(const char *keydir, const char *name, 123 ENGINE *engine, RSA **rsap) 124 { 125 const char *engine_id; 126 char key_id[1024]; 127 EVP_PKEY *key; 128 RSA *rsa; 129 int ret; 130 131 *rsap = NULL; 132 133 engine_id = ENGINE_get_id(engine); 134 135 if (engine_id && !strcmp(engine_id, "pkcs11")) { 136 if (keydir) 137 snprintf(key_id, sizeof(key_id), 138 "pkcs11:%s;object=%s;type=public", 139 keydir, name); 140 else 141 snprintf(key_id, sizeof(key_id), 142 "pkcs11:object=%s;type=public", 143 name); 144 } else { 145 fprintf(stderr, "Engine not supported\n"); 146 return -ENOTSUP; 147 } 148 149 key = ENGINE_load_public_key(engine, key_id, NULL, NULL); 150 if (!key) 151 return rsa_err("Failure loading public key from engine"); 152 153 /* Convert to a RSA_style key. */ 154 rsa = EVP_PKEY_get1_RSA(key); 155 if (!rsa) { 156 rsa_err("Couldn't convert to a RSA style key"); 157 ret = -EINVAL; 158 goto err_rsa; 159 } 160 161 EVP_PKEY_free(key); 162 *rsap = rsa; 163 164 return 0; 165 166 err_rsa: 167 EVP_PKEY_free(key); 168 return ret; 169 } 170 171 /** 172 * rsa_get_pub_key() - read a public key 173 * 174 * @keydir: Directory containing the key (PEM file) or key prefix (engine) 175 * @name Name of key file (will have a .crt extension) 176 * @engine Engine to use 177 * @rsap Returns RSA object, or NULL on failure 178 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 179 */ 180 static int rsa_get_pub_key(const char *keydir, const char *name, 181 ENGINE *engine, RSA **rsap) 182 { 183 if (engine) 184 return rsa_engine_get_pub_key(keydir, name, engine, rsap); 185 return rsa_pem_get_pub_key(keydir, name, rsap); 186 } 187 188 /** 189 * rsa_pem_get_priv_key() - read a private key from a .key file 190 * 191 * @keydir: Directory containing the key 192 * @name Name of key file (will have a .key extension) 193 * @rsap Returns RSA object, or NULL on failure 194 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 195 */ 196 static int rsa_pem_get_priv_key(const char *keydir, const char *name, 197 RSA **rsap) 198 { 199 char path[1024]; 200 RSA *rsa; 201 FILE *f; 202 203 *rsap = NULL; 204 snprintf(path, sizeof(path), "%s/%s.key", keydir, name); 205 f = fopen(path, "r"); 206 if (!f) { 207 fprintf(stderr, "Couldn't open RSA private key: '%s': %s\n", 208 path, strerror(errno)); 209 return -ENOENT; 210 } 211 212 rsa = PEM_read_RSAPrivateKey(f, 0, NULL, path); 213 if (!rsa) { 214 rsa_err("Failure reading private key"); 215 fclose(f); 216 return -EPROTO; 217 } 218 fclose(f); 219 *rsap = rsa; 220 221 return 0; 222 } 223 224 /** 225 * rsa_engine_get_priv_key() - read a private key from given engine 226 * 227 * @keydir: Key prefix 228 * @name Name of key 229 * @engine Engine to use 230 * @rsap Returns RSA object, or NULL on failure 231 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 232 */ 233 static int rsa_engine_get_priv_key(const char *keydir, const char *name, 234 ENGINE *engine, RSA **rsap) 235 { 236 const char *engine_id; 237 char key_id[1024]; 238 EVP_PKEY *key; 239 RSA *rsa; 240 int ret; 241 242 *rsap = NULL; 243 244 engine_id = ENGINE_get_id(engine); 245 246 if (engine_id && !strcmp(engine_id, "pkcs11")) { 247 if (keydir) 248 snprintf(key_id, sizeof(key_id), 249 "pkcs11:%s;object=%s;type=private", 250 keydir, name); 251 else 252 snprintf(key_id, sizeof(key_id), 253 "pkcs11:object=%s;type=private", 254 name); 255 } else { 256 fprintf(stderr, "Engine not supported\n"); 257 return -ENOTSUP; 258 } 259 260 key = ENGINE_load_private_key(engine, key_id, NULL, NULL); 261 if (!key) 262 return rsa_err("Failure loading private key from engine"); 263 264 /* Convert to a RSA_style key. */ 265 rsa = EVP_PKEY_get1_RSA(key); 266 if (!rsa) { 267 rsa_err("Couldn't convert to a RSA style key"); 268 ret = -EINVAL; 269 goto err_rsa; 270 } 271 272 EVP_PKEY_free(key); 273 *rsap = rsa; 274 275 return 0; 276 277 err_rsa: 278 EVP_PKEY_free(key); 279 return ret; 280 } 281 282 /** 283 * rsa_get_priv_key() - read a private key 284 * 285 * @keydir: Directory containing the key (PEM file) or key prefix (engine) 286 * @name Name of key 287 * @engine Engine to use for signing 288 * @rsap Returns RSA object, or NULL on failure 289 * @return 0 if ok, -ve on error (in which case *rsap will be set to NULL) 290 */ 291 static int rsa_get_priv_key(const char *keydir, const char *name, 292 ENGINE *engine, RSA **rsap) 293 { 294 if (engine) 295 return rsa_engine_get_priv_key(keydir, name, engine, rsap); 296 return rsa_pem_get_priv_key(keydir, name, rsap); 297 } 298 299 static int rsa_init(void) 300 { 301 int ret; 302 303 #if OPENSSL_VERSION_NUMBER < 0x10100000L 304 ret = SSL_library_init(); 305 #else 306 ret = OPENSSL_init_ssl(0, NULL); 307 #endif 308 if (!ret) { 309 fprintf(stderr, "Failure to init SSL library\n"); 310 return -1; 311 } 312 #if OPENSSL_VERSION_NUMBER < 0x10100000L 313 SSL_load_error_strings(); 314 315 OpenSSL_add_all_algorithms(); 316 OpenSSL_add_all_digests(); 317 OpenSSL_add_all_ciphers(); 318 #endif 319 320 return 0; 321 } 322 323 static int rsa_engine_init(const char *engine_id, ENGINE **pe) 324 { 325 ENGINE *e; 326 int ret; 327 328 ENGINE_load_builtin_engines(); 329 330 e = ENGINE_by_id(engine_id); 331 if (!e) { 332 fprintf(stderr, "Engine isn't available\n"); 333 ret = -1; 334 goto err_engine_by_id; 335 } 336 337 if (!ENGINE_init(e)) { 338 fprintf(stderr, "Couldn't initialize engine\n"); 339 ret = -1; 340 goto err_engine_init; 341 } 342 343 if (!ENGINE_set_default_RSA(e)) { 344 fprintf(stderr, "Couldn't set engine as default for RSA\n"); 345 ret = -1; 346 goto err_set_rsa; 347 } 348 349 *pe = e; 350 351 return 0; 352 353 err_set_rsa: 354 ENGINE_finish(e); 355 err_engine_init: 356 ENGINE_free(e); 357 err_engine_by_id: 358 #if OPENSSL_VERSION_NUMBER < 0x10100000L 359 ENGINE_cleanup(); 360 #endif 361 return ret; 362 } 363 364 static void rsa_remove(void) 365 { 366 #if OPENSSL_VERSION_NUMBER < 0x10100000L 367 CRYPTO_cleanup_all_ex_data(); 368 ERR_free_strings(); 369 #ifdef HAVE_ERR_REMOVE_THREAD_STATE 370 ERR_remove_thread_state(NULL); 371 #else 372 ERR_remove_state(0); 373 #endif 374 EVP_cleanup(); 375 #endif 376 } 377 378 static void rsa_engine_remove(ENGINE *e) 379 { 380 if (e) { 381 ENGINE_finish(e); 382 ENGINE_free(e); 383 } 384 } 385 386 /* 387 * With this data2sign.bin, we can provide it to who real holds the RAS-private 388 * key to sign current fit image. Then we replace the signature in fit image 389 * with a valid one. 390 */ 391 static int gen_data2sign(const struct image_region region[], int region_count) 392 { 393 char *file = "data2sign.bin"; 394 FILE *fd; 395 int i; 396 397 fd = fopen(file, "wb"); 398 if (!fd) { 399 fprintf(stderr, "Failed to create %s: %s\n", 400 file, strerror(errno)); 401 return -ENOENT; 402 } 403 404 for (i = 0; i < region_count; i++) 405 fwrite(region[i].data, region[i].size, 1, fd); 406 407 fclose(fd); 408 409 return 0; 410 } 411 412 static int rsa_sign_with_key(RSA *rsa, struct padding_algo *padding_algo, 413 struct checksum_algo *checksum_algo, 414 const struct image_region region[], int region_count, 415 uint8_t **sigp, uint *sig_size) 416 { 417 EVP_PKEY *key; 418 EVP_PKEY_CTX *ckey; 419 EVP_MD_CTX *context; 420 int ret = 0; 421 size_t size; 422 uint8_t *sig; 423 int i; 424 425 key = EVP_PKEY_new(); 426 if (!key) 427 return rsa_err("EVP_PKEY object creation failed"); 428 429 if (!EVP_PKEY_set1_RSA(key, rsa)) { 430 ret = rsa_err("EVP key setup failed"); 431 goto err_set; 432 } 433 434 size = EVP_PKEY_size(key); 435 sig = malloc(size); 436 if (!sig) { 437 fprintf(stderr, "Out of memory for signature (%zu bytes)\n", 438 size); 439 ret = -ENOMEM; 440 goto err_alloc; 441 } 442 443 context = EVP_MD_CTX_create(); 444 if (!context) { 445 ret = rsa_err("EVP context creation failed"); 446 goto err_create; 447 } 448 EVP_MD_CTX_init(context); 449 450 ckey = EVP_PKEY_CTX_new(key, NULL); 451 if (!ckey) { 452 ret = rsa_err("EVP key context creation failed"); 453 goto err_create; 454 } 455 456 if (EVP_DigestSignInit(context, &ckey, 457 checksum_algo->calculate_sign(), 458 NULL, key) <= 0) { 459 ret = rsa_err("Signer setup failed"); 460 goto err_sign; 461 } 462 463 #ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT 464 if (padding_algo && !strcmp(padding_algo->name, "pss")) { 465 if (EVP_PKEY_CTX_set_rsa_padding(ckey, 466 RSA_PKCS1_PSS_PADDING) <= 0) { 467 ret = rsa_err("Signer padding setup failed"); 468 goto err_sign; 469 } 470 } 471 #endif /* CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT */ 472 473 for (i = 0; i < region_count; i++) { 474 if (!EVP_DigestSignUpdate(context, region[i].data, 475 region[i].size)) { 476 ret = rsa_err("Signing data failed"); 477 goto err_sign; 478 } 479 } 480 481 if (!EVP_DigestSignFinal(context, sig, &size)) { 482 ret = rsa_err("Could not obtain signature"); 483 goto err_sign; 484 } 485 486 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 487 (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x02070000fL) 488 EVP_MD_CTX_cleanup(context); 489 #else 490 EVP_MD_CTX_reset(context); 491 #endif 492 EVP_MD_CTX_destroy(context); 493 EVP_PKEY_free(key); 494 495 debug("Got signature: %d bytes, expected %zu\n", *sig_size, size); 496 *sigp = sig; 497 *sig_size = size; 498 499 gen_data2sign(region, region_count); 500 501 return 0; 502 503 err_sign: 504 EVP_MD_CTX_destroy(context); 505 err_create: 506 free(sig); 507 err_alloc: 508 err_set: 509 EVP_PKEY_free(key); 510 return ret; 511 } 512 513 int rsa_sign(struct image_sign_info *info, 514 const struct image_region region[], int region_count, 515 uint8_t **sigp, uint *sig_len) 516 { 517 RSA *rsa; 518 ENGINE *e = NULL; 519 int ret; 520 521 ret = rsa_init(); 522 if (ret) 523 return ret; 524 525 if (info->engine_id) { 526 ret = rsa_engine_init(info->engine_id, &e); 527 if (ret) 528 goto err_engine; 529 } 530 531 ret = rsa_get_priv_key(info->keydir, info->keyname, e, &rsa); 532 if (ret) 533 goto err_priv; 534 ret = rsa_sign_with_key(rsa, info->padding, info->checksum, region, 535 region_count, sigp, sig_len); 536 if (ret) 537 goto err_sign; 538 539 RSA_free(rsa); 540 if (info->engine_id) 541 rsa_engine_remove(e); 542 rsa_remove(); 543 544 return ret; 545 546 err_sign: 547 RSA_free(rsa); 548 err_priv: 549 if (info->engine_id) 550 rsa_engine_remove(e); 551 err_engine: 552 rsa_remove(); 553 return ret; 554 } 555 556 /* 557 * rsa_get_exponent(): - Get the public exponent from an RSA key 558 */ 559 static int rsa_get_exponent(RSA *key, uint64_t *e) 560 { 561 int ret; 562 BIGNUM *bn_te; 563 const BIGNUM *key_e; 564 uint64_t te; 565 566 ret = -EINVAL; 567 bn_te = NULL; 568 569 if (!e) 570 goto cleanup; 571 572 RSA_get0_key(key, NULL, &key_e, NULL); 573 if (BN_num_bits(key_e) > 64) 574 goto cleanup; 575 576 *e = BN_get_word(key_e); 577 578 if (BN_num_bits(key_e) < 33) { 579 ret = 0; 580 goto cleanup; 581 } 582 583 bn_te = BN_dup(key_e); 584 if (!bn_te) 585 goto cleanup; 586 587 if (!BN_rshift(bn_te, bn_te, 32)) 588 goto cleanup; 589 590 if (!BN_mask_bits(bn_te, 32)) 591 goto cleanup; 592 593 te = BN_get_word(bn_te); 594 te <<= 32; 595 *e |= te; 596 ret = 0; 597 598 cleanup: 599 if (bn_te) 600 BN_free(bn_te); 601 602 return ret; 603 } 604 605 /* 606 * rsa_get_params(): - Get the important parameters of an RSA public key 607 */ 608 int rsa_get_params(RSA *key, uint64_t *exponent, uint32_t *n0_invp, 609 BIGNUM **modulusp, BIGNUM **exponent_BN, BIGNUM **r_squaredp, 610 BIGNUM **c_factorp, BIGNUM **np_factorp) 611 { 612 BIGNUM *big1, *big2, *big32, *big2_32, *big4100, *big2180; 613 BIGNUM *n, *e, *r, *r_squared, *tmp, *c_factor, *np_factor; 614 const BIGNUM *key_n, *key_e; 615 BN_CTX *bn_ctx = BN_CTX_new(); 616 int ret = 0; 617 618 /* Initialize BIGNUMs */ 619 big1 = BN_new(); 620 big2 = BN_new(); 621 big32 = BN_new(); 622 big4100 = BN_new(); 623 big2180 = BN_new(); 624 625 r = BN_new(); 626 r_squared = BN_new(); 627 c_factor = BN_new(); 628 np_factor = BN_new(); 629 tmp = BN_new(); 630 big2_32 = BN_new(); 631 n = BN_new(); 632 e = BN_new(); 633 if (!big1 || !big2 || !big32 || !big4100 || !big2180 || !r || 634 !r_squared || !tmp || !big2_32 || !n || !e || 635 !c_factor || !np_factor) { 636 fprintf(stderr, "Out of memory (bignum)\n"); 637 return -ENOMEM; 638 } 639 640 if (0 != rsa_get_exponent(key, exponent)) 641 ret = -1; 642 643 RSA_get0_key(key, &key_n, &key_e, NULL); 644 if (!BN_copy(n, key_n) || !BN_copy(e, key_e) || 645 !BN_set_word(big1, 1L) || 646 !BN_set_word(big2, 2L) || !BN_set_word(big32, 32L) || 647 !BN_set_word(big4100, 4100L) || !BN_set_word(big2180, 2180L)) 648 ret = -1; 649 650 /* big2_32 = 2^32 */ 651 if (!BN_exp(big2_32, big2, big32, bn_ctx)) 652 ret = -1; 653 654 /* Calculate n0_inv = -1 / n[0] mod 2^32 */ 655 if (!BN_mod_inverse(tmp, n, big2_32, bn_ctx) || 656 !BN_sub(tmp, big2_32, tmp)) 657 ret = -1; 658 *n0_invp = BN_get_word(tmp); 659 660 /* Calculate R = 2^(# of key bits) */ 661 if (!BN_set_word(tmp, BN_num_bits(n)) || 662 !BN_exp(r, big2, tmp, bn_ctx)) 663 ret = -1; 664 665 /* Calculate r_squared = R^2 mod n */ 666 if (!BN_copy(r_squared, r) || 667 !BN_mul(tmp, r_squared, r, bn_ctx) || 668 !BN_mod(r_squared, tmp, n, bn_ctx)) 669 ret = -1; 670 671 /* Calculate c_factor = 2^4100 mod n */ 672 if (!BN_exp(tmp, big2, big4100, bn_ctx) || 673 !BN_mod(c_factor, tmp, n, bn_ctx)) 674 ret = -1; 675 676 /* Calculate np_factor = 2^2180 div n */ 677 if (!BN_exp(tmp, big2, big2180, bn_ctx) || 678 !BN_div(np_factor, NULL, tmp, n, bn_ctx)) 679 ret = -1; 680 681 *modulusp = n; 682 *exponent_BN = e; 683 *r_squaredp = r_squared; 684 *c_factorp = c_factor; 685 *np_factorp = np_factor; 686 687 BN_free(big1); 688 BN_free(big2); 689 BN_free(big32); 690 BN_free(big4100); 691 BN_free(big2180); 692 BN_free(r); 693 BN_free(tmp); 694 BN_free(big2_32); 695 if (ret) { 696 fprintf(stderr, "Bignum operations failed\n"); 697 return -ENOMEM; 698 } 699 700 return ret; 701 } 702 703 static void rsa_convert_big_endian(uint32_t *dst, const uint32_t *src, int len) 704 { 705 int i; 706 707 for (i = 0; i < len; i++) 708 dst[i] = fdt32_to_cpu(src[len - 1 - i]); 709 } 710 711 static int rsa_set_key_hash(void *keydest, int key_node, 712 int key_len, const char *csum_algo) 713 { 714 const void *rsa_n, *rsa_e, *rsa_c, *rsa_np; 715 void *n, *e, *c, *np; 716 uint8_t value[FIT_MAX_HASH_LEN]; 717 char hash_c[] = "hash@c"; 718 char hash_np[] = "hash@np"; 719 char *rsa_key; 720 int key_word; 721 int hash_node; 722 int value_len; 723 int ret = -ENOSPC; 724 725 rsa_key = malloc(key_len * 3); 726 if (!rsa_key) 727 return -ENOSPC; 728 729 rsa_n = fdt_getprop(keydest, key_node, "rsa,modulus", NULL); 730 rsa_e = fdt_getprop(keydest, key_node, "rsa,exponent-BN", NULL); 731 rsa_c = fdt_getprop(keydest, key_node, "rsa,c", NULL); 732 rsa_np = fdt_getprop(keydest, key_node, "rsa,np", NULL); 733 if (!rsa_c || !rsa_np || !rsa_n || !rsa_e) 734 goto err_nospc; 735 736 n = rsa_key; 737 e = rsa_key + key_len; 738 key_word = key_len / sizeof(uint32_t); 739 rsa_convert_big_endian(n, rsa_n, key_word); 740 rsa_convert_big_endian(e, rsa_e, key_word); 741 742 /* hash@c node: n, e, c */ 743 c = rsa_key + key_len * 2; 744 rsa_convert_big_endian(c, rsa_c, key_word); 745 hash_node = fdt_add_subnode(keydest, key_node, hash_c); 746 if (hash_node < 0) 747 goto err_nospc; 748 ret = calculate_hash(rsa_key, key_len * 3, csum_algo, value, &value_len); 749 if (ret) 750 goto err_nospc; 751 ret = fdt_setprop(keydest, hash_node, FIT_VALUE_PROP, value, value_len); 752 if (ret) 753 goto err_nospc; 754 ret = fdt_setprop_string(keydest, hash_node, FIT_ALGO_PROP, csum_algo); 755 if (ret < 0) 756 goto err_nospc; 757 758 /* hash@np node: n, e, np */ 759 np = rsa_key + key_len * 2; 760 rsa_convert_big_endian(np, rsa_np, key_word); 761 hash_node = fdt_add_subnode(keydest, key_node, hash_np); 762 if (hash_node < 0) 763 goto err_nospc; 764 765 ret = calculate_hash(rsa_key, key_len * 2 + 20, csum_algo, value, &value_len); 766 if (ret) 767 goto err_nospc; 768 ret = fdt_setprop(keydest, hash_node, FIT_VALUE_PROP, value, value_len); 769 if (ret < 0) 770 goto err_nospc; 771 ret = fdt_setprop_string(keydest, hash_node, FIT_ALGO_PROP, csum_algo); 772 773 err_nospc: 774 if (rsa_key) 775 free(rsa_key); 776 777 return ret ? -ENOSPC : 0; 778 } 779 780 static int fdt_add_bignum(void *blob, int noffset, const char *prop_name, 781 BIGNUM *num, int num_bits) 782 { 783 int nwords = num_bits / 32; 784 int size; 785 uint32_t *buf, *ptr; 786 BIGNUM *tmp, *big2, *big32, *big2_32; 787 BN_CTX *ctx; 788 int ret; 789 790 tmp = BN_new(); 791 big2 = BN_new(); 792 big32 = BN_new(); 793 big2_32 = BN_new(); 794 if (!tmp || !big2 || !big32 || !big2_32) { 795 fprintf(stderr, "Out of memory (bignum)\n"); 796 return -ENOMEM; 797 } 798 ctx = BN_CTX_new(); 799 if (!tmp) { 800 fprintf(stderr, "Out of memory (bignum context)\n"); 801 return -ENOMEM; 802 } 803 BN_set_word(big2, 2L); 804 BN_set_word(big32, 32L); 805 BN_exp(big2_32, big2, big32, ctx); /* B = 2^32 */ 806 807 size = nwords * sizeof(uint32_t); 808 buf = malloc(size); 809 if (!buf) { 810 fprintf(stderr, "Out of memory (%d bytes)\n", size); 811 return -ENOMEM; 812 } 813 814 /* Write out modulus as big endian array of integers */ 815 for (ptr = buf + nwords - 1; ptr >= buf; ptr--) { 816 BN_mod(tmp, num, big2_32, ctx); /* n = N mod B */ 817 *ptr = cpu_to_fdt32(BN_get_word(tmp)); 818 BN_rshift(num, num, 32); /* N = N/B */ 819 } 820 821 /* 822 * We try signing with successively increasing size values, so this 823 * might fail several times 824 */ 825 ret = fdt_setprop(blob, noffset, prop_name, buf, size); 826 if (ret) 827 return -FDT_ERR_NOSPACE; 828 free(buf); 829 BN_free(tmp); 830 BN_free(big2); 831 BN_free(big32); 832 BN_free(big2_32); 833 834 return ret; 835 } 836 837 int rsa_add_verify_data(struct image_sign_info *info, void *keydest) 838 { 839 BIGNUM *modulus, *exponent_BN, *r_squared, *c_factor, *np_factor; 840 uint64_t exponent; 841 uint32_t n0_inv; 842 int parent, node; 843 char name[100]; 844 int ret; 845 int bits; 846 RSA *rsa; 847 ENGINE *e = NULL; 848 849 debug("%s: Getting verification data\n", __func__); 850 if (info->engine_id) { 851 ret = rsa_engine_init(info->engine_id, &e); 852 if (ret) 853 return ret; 854 } 855 ret = rsa_get_pub_key(info->keydir, info->keyname, e, &rsa); 856 if (ret) 857 goto err_get_pub_key; 858 ret = rsa_get_params(rsa, &exponent, &n0_inv, &modulus, 859 &exponent_BN, &r_squared, &c_factor, &np_factor); 860 if (ret) 861 goto err_get_params; 862 bits = BN_num_bits(modulus); 863 parent = fdt_subnode_offset(keydest, 0, FIT_SIG_NODENAME); 864 if (parent == -FDT_ERR_NOTFOUND) { 865 parent = fdt_add_subnode(keydest, 0, FIT_SIG_NODENAME); 866 if (parent < 0) { 867 ret = parent; 868 if (ret != -FDT_ERR_NOSPACE) { 869 fprintf(stderr, "Couldn't create signature node: %s\n", 870 fdt_strerror(parent)); 871 } 872 } 873 } 874 if (ret) 875 goto done; 876 877 /* Either create or overwrite the named key node */ 878 snprintf(name, sizeof(name), "key-%s", info->keyname); 879 node = fdt_subnode_offset(keydest, parent, name); 880 if (node == -FDT_ERR_NOTFOUND) { 881 node = fdt_add_subnode(keydest, parent, name); 882 if (node < 0) { 883 ret = node; 884 if (ret != -FDT_ERR_NOSPACE) { 885 fprintf(stderr, "Could not create key subnode: %s\n", 886 fdt_strerror(node)); 887 } 888 } 889 } else if (node < 0) { 890 fprintf(stderr, "Cannot select keys parent: %s\n", 891 fdt_strerror(node)); 892 ret = node; 893 } 894 895 if (!ret) { 896 ret = fdt_setprop_string(keydest, node, "key-name-hint", 897 info->keyname); 898 } 899 if (!ret) 900 ret = fdt_setprop_u32(keydest, node, "rsa,num-bits", bits); 901 if (!ret) 902 ret = fdt_setprop_u32(keydest, node, "rsa,n0-inverse", n0_inv); 903 if (!ret) { 904 ret = fdt_setprop_u64(keydest, node, "rsa,exponent", exponent); 905 } 906 if (!ret) { 907 ret = fdt_add_bignum(keydest, node, "rsa,exponent-BN", 908 exponent_BN, bits); 909 } 910 if (!ret) { 911 ret = fdt_add_bignum(keydest, node, "rsa,modulus", modulus, 912 bits); 913 } 914 if (!ret) { 915 ret = fdt_add_bignum(keydest, node, "rsa,r-squared", r_squared, 916 bits); 917 } 918 if (!ret) { 919 ret = fdt_add_bignum(keydest, node, "rsa,c", c_factor, 920 bits); 921 } 922 if (!ret) { 923 ret = fdt_add_bignum(keydest, node, "rsa,np", np_factor, 924 bits); 925 } 926 if (!ret) { 927 ret = fdt_setprop_string(keydest, node, FIT_ALGO_PROP, 928 info->name); 929 } 930 if (!ret && info->require_keys) { 931 ret = fdt_setprop_string(keydest, node, "required", 932 info->require_keys); 933 } 934 if (!ret) { 935 ret = rsa_set_key_hash(keydest, node, info->crypto->key_len, 936 info->checksum->name); 937 } 938 done: 939 BN_free(modulus); 940 BN_free(r_squared); 941 if (ret) 942 ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO; 943 err_get_params: 944 RSA_free(rsa); 945 err_get_pub_key: 946 if (info->engine_id) 947 rsa_engine_remove(e); 948 949 return ret; 950 } 951