Tom Rini | 10e4779 | 2018-05-06 17:58:06 -0400 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0+ |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 2 | /* |
| 3 | * Copyright (c) 2013, Google Inc. |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 4 | */ |
| 5 | |
| 6 | #include "mkimage.h" |
Jonathan Gray | cc3ed40 | 2020-05-15 22:20:34 +1000 | [diff] [blame] | 7 | #include <stdlib.h> |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 8 | #include <stdio.h> |
| 9 | #include <string.h> |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 10 | #include <image.h> |
| 11 | #include <time.h> |
Alexandru Gagniuc | 32abcbd | 2021-02-19 12:45:11 -0600 | [diff] [blame] | 12 | #include <u-boot/fdt-libcrypto.h> |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 13 | #include <openssl/bn.h> |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 14 | #include <openssl/ec.h> |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 15 | #include <openssl/rsa.h> |
| 16 | #include <openssl/pem.h> |
| 17 | #include <openssl/err.h> |
| 18 | #include <openssl/ssl.h> |
| 19 | #include <openssl/evp.h> |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 20 | #include <openssl/engine.h> |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 21 | |
| 22 | #if OPENSSL_VERSION_NUMBER >= 0x10000000L |
| 23 | #define HAVE_ERR_REMOVE_THREAD_STATE |
| 24 | #endif |
| 25 | |
Caliph Nomble | 1a31b02 | 2018-07-25 22:13:03 -0400 | [diff] [blame] | 26 | #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ |
| 27 | (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x02070000fL) |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 28 | static void RSA_get0_key(const RSA *r, |
| 29 | const BIGNUM **n, const BIGNUM **e, const BIGNUM **d) |
| 30 | { |
| 31 | if (n != NULL) |
| 32 | *n = r->n; |
| 33 | if (e != NULL) |
| 34 | *e = r->e; |
| 35 | if (d != NULL) |
| 36 | *d = r->d; |
| 37 | } |
| 38 | #endif |
| 39 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 40 | static int rsa_err(const char *msg) |
| 41 | { |
| 42 | unsigned long sslErr = ERR_get_error(); |
| 43 | |
| 44 | fprintf(stderr, "%s", msg); |
| 45 | fprintf(stderr, ": %s\n", |
| 46 | ERR_error_string(sslErr, 0)); |
| 47 | |
| 48 | return -1; |
| 49 | } |
| 50 | |
| 51 | /** |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 52 | * rsa_pem_get_pub_key() - read a public key from a .crt file |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 53 | * |
| 54 | * @keydir: Directory containins the key |
| 55 | * @name Name of key file (will have a .crt extension) |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 56 | * @evpp Returns EVP_PKEY object, or NULL on failure |
| 57 | * @return 0 if ok, -ve on error (in which case *evpp will be set to NULL) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 58 | */ |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 59 | static int rsa_pem_get_pub_key(const char *keydir, const char *name, EVP_PKEY **evpp) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 60 | { |
| 61 | char path[1024]; |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 62 | EVP_PKEY *key = NULL; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 63 | X509 *cert; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 64 | FILE *f; |
| 65 | int ret; |
| 66 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 67 | if (!evpp) |
| 68 | return -EINVAL; |
| 69 | |
| 70 | *evpp = NULL; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 71 | snprintf(path, sizeof(path), "%s/%s.crt", keydir, name); |
| 72 | f = fopen(path, "r"); |
| 73 | if (!f) { |
| 74 | fprintf(stderr, "Couldn't open RSA certificate: '%s': %s\n", |
| 75 | path, strerror(errno)); |
| 76 | return -EACCES; |
| 77 | } |
| 78 | |
| 79 | /* Read the certificate */ |
| 80 | cert = NULL; |
| 81 | if (!PEM_read_X509(f, &cert, NULL, NULL)) { |
| 82 | rsa_err("Couldn't read certificate"); |
| 83 | ret = -EINVAL; |
| 84 | goto err_cert; |
| 85 | } |
| 86 | |
| 87 | /* Get the public key from the certificate. */ |
| 88 | key = X509_get_pubkey(cert); |
| 89 | if (!key) { |
| 90 | rsa_err("Couldn't read public key\n"); |
| 91 | ret = -EINVAL; |
| 92 | goto err_pubkey; |
| 93 | } |
| 94 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 95 | fclose(f); |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 96 | *evpp = key; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 97 | X509_free(cert); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 98 | |
| 99 | return 0; |
| 100 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 101 | err_pubkey: |
| 102 | X509_free(cert); |
| 103 | err_cert: |
| 104 | fclose(f); |
| 105 | return ret; |
| 106 | } |
| 107 | |
| 108 | /** |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 109 | * rsa_engine_get_pub_key() - read a public key from given engine |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 110 | * |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 111 | * @keydir: Key prefix |
| 112 | * @name Name of key |
| 113 | * @engine Engine to use |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 114 | * @evpp Returns EVP_PKEY object, or NULL on failure |
| 115 | * @return 0 if ok, -ve on error (in which case *evpp will be set to NULL) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 116 | */ |
| 117 | static int rsa_engine_get_pub_key(const char *keydir, const char *name, |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 118 | ENGINE *engine, EVP_PKEY **evpp) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 119 | { |
| 120 | const char *engine_id; |
| 121 | char key_id[1024]; |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 122 | EVP_PKEY *key = NULL; |
| 123 | |
| 124 | if (!evpp) |
| 125 | return -EINVAL; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 126 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 127 | *evpp = NULL; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 128 | |
| 129 | engine_id = ENGINE_get_id(engine); |
| 130 | |
| 131 | if (engine_id && !strcmp(engine_id, "pkcs11")) { |
| 132 | if (keydir) |
Jan Luebbe | cd4eafb | 2020-05-13 12:26:24 +0200 | [diff] [blame] | 133 | if (strstr(keydir, "object=")) |
| 134 | snprintf(key_id, sizeof(key_id), |
| 135 | "pkcs11:%s;type=public", |
| 136 | keydir); |
| 137 | else |
| 138 | snprintf(key_id, sizeof(key_id), |
| 139 | "pkcs11:%s;object=%s;type=public", |
| 140 | keydir, name); |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 141 | else |
| 142 | snprintf(key_id, sizeof(key_id), |
| 143 | "pkcs11:object=%s;type=public", |
| 144 | name); |
Vesa Jääskeläinen | abf8eb2 | 2019-06-16 20:53:38 +0300 | [diff] [blame] | 145 | } else if (engine_id) { |
| 146 | if (keydir) |
| 147 | snprintf(key_id, sizeof(key_id), |
| 148 | "%s%s", |
| 149 | keydir, name); |
| 150 | else |
| 151 | snprintf(key_id, sizeof(key_id), |
| 152 | "%s", |
| 153 | name); |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 154 | } else { |
| 155 | fprintf(stderr, "Engine not supported\n"); |
| 156 | return -ENOTSUP; |
| 157 | } |
| 158 | |
| 159 | key = ENGINE_load_public_key(engine, key_id, NULL, NULL); |
| 160 | if (!key) |
| 161 | return rsa_err("Failure loading public key from engine"); |
| 162 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 163 | *evpp = key; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 164 | |
| 165 | return 0; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 166 | } |
| 167 | |
| 168 | /** |
| 169 | * rsa_get_pub_key() - read a public key |
| 170 | * |
| 171 | * @keydir: Directory containing the key (PEM file) or key prefix (engine) |
| 172 | * @name Name of key file (will have a .crt extension) |
| 173 | * @engine Engine to use |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 174 | * @evpp Returns EVP_PKEY object, or NULL on failure |
| 175 | * @return 0 if ok, -ve on error (in which case *evpp will be set to NULL) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 176 | */ |
| 177 | static int rsa_get_pub_key(const char *keydir, const char *name, |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 178 | ENGINE *engine, EVP_PKEY **evpp) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 179 | { |
| 180 | if (engine) |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 181 | return rsa_engine_get_pub_key(keydir, name, engine, evpp); |
| 182 | return rsa_pem_get_pub_key(keydir, name, evpp); |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 183 | } |
| 184 | |
| 185 | /** |
| 186 | * rsa_pem_get_priv_key() - read a private key from a .key file |
| 187 | * |
| 188 | * @keydir: Directory containing the key |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 189 | * @name Name of key file (will have a .key extension) |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 190 | * @evpp Returns EVP_PKEY object, or NULL on failure |
| 191 | * @return 0 if ok, -ve on error (in which case *evpp will be set to NULL) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 192 | */ |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 193 | static int rsa_pem_get_priv_key(const char *keydir, const char *name, |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 194 | const char *keyfile, EVP_PKEY **evpp) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 195 | { |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 196 | char path[1024] = {0}; |
| 197 | FILE *f = NULL; |
| 198 | |
| 199 | if (!evpp) |
| 200 | return -EINVAL; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 201 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 202 | *evpp = NULL; |
Alexandru Gagniuc | a35da20 | 2021-02-19 12:45:18 -0600 | [diff] [blame] | 203 | if (keydir && name) |
| 204 | snprintf(path, sizeof(path), "%s/%s.key", keydir, name); |
| 205 | else if (keyfile) |
| 206 | snprintf(path, sizeof(path), "%s", keyfile); |
| 207 | else |
| 208 | return -EINVAL; |
| 209 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 210 | f = fopen(path, "r"); |
| 211 | if (!f) { |
| 212 | fprintf(stderr, "Couldn't open RSA private key: '%s': %s\n", |
| 213 | path, strerror(errno)); |
| 214 | return -ENOENT; |
| 215 | } |
| 216 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 217 | if (!PEM_read_PrivateKey(f, evpp, NULL, path)) { |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 218 | rsa_err("Failure reading private key"); |
| 219 | fclose(f); |
| 220 | return -EPROTO; |
| 221 | } |
| 222 | fclose(f); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 223 | |
| 224 | return 0; |
| 225 | } |
| 226 | |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 227 | /** |
| 228 | * rsa_engine_get_priv_key() - read a private key from given engine |
| 229 | * |
| 230 | * @keydir: Key prefix |
| 231 | * @name Name of key |
| 232 | * @engine Engine to use |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 233 | * @evpp Returns EVP_PKEY object, or NULL on failure |
| 234 | * @return 0 if ok, -ve on error (in which case *evpp will be set to NULL) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 235 | */ |
| 236 | static int rsa_engine_get_priv_key(const char *keydir, const char *name, |
Alexandru Gagniuc | a35da20 | 2021-02-19 12:45:18 -0600 | [diff] [blame] | 237 | const char *keyfile, |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 238 | ENGINE *engine, EVP_PKEY **evpp) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 239 | { |
| 240 | const char *engine_id; |
| 241 | char key_id[1024]; |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 242 | EVP_PKEY *key = NULL; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 243 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 244 | if (!evpp) |
| 245 | return -EINVAL; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 246 | |
| 247 | engine_id = ENGINE_get_id(engine); |
| 248 | |
| 249 | if (engine_id && !strcmp(engine_id, "pkcs11")) { |
Alexandru Gagniuc | a35da20 | 2021-02-19 12:45:18 -0600 | [diff] [blame] | 250 | if (!keydir && !name) { |
| 251 | fprintf(stderr, "Please use 'keydir' with PKCS11\n"); |
| 252 | return -EINVAL; |
| 253 | } |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 254 | if (keydir) |
Jan Luebbe | cd4eafb | 2020-05-13 12:26:24 +0200 | [diff] [blame] | 255 | if (strstr(keydir, "object=")) |
| 256 | snprintf(key_id, sizeof(key_id), |
| 257 | "pkcs11:%s;type=private", |
| 258 | keydir); |
| 259 | else |
| 260 | snprintf(key_id, sizeof(key_id), |
| 261 | "pkcs11:%s;object=%s;type=private", |
| 262 | keydir, name); |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 263 | else |
| 264 | snprintf(key_id, sizeof(key_id), |
| 265 | "pkcs11:object=%s;type=private", |
| 266 | name); |
Vesa Jääskeläinen | abf8eb2 | 2019-06-16 20:53:38 +0300 | [diff] [blame] | 267 | } else if (engine_id) { |
Alexandru Gagniuc | a35da20 | 2021-02-19 12:45:18 -0600 | [diff] [blame] | 268 | if (keydir && name) |
Vesa Jääskeläinen | abf8eb2 | 2019-06-16 20:53:38 +0300 | [diff] [blame] | 269 | snprintf(key_id, sizeof(key_id), |
| 270 | "%s%s", |
| 271 | keydir, name); |
Alexandru Gagniuc | a35da20 | 2021-02-19 12:45:18 -0600 | [diff] [blame] | 272 | else if (keydir) |
Vesa Jääskeläinen | abf8eb2 | 2019-06-16 20:53:38 +0300 | [diff] [blame] | 273 | snprintf(key_id, sizeof(key_id), |
| 274 | "%s", |
| 275 | name); |
Alexandru Gagniuc | a35da20 | 2021-02-19 12:45:18 -0600 | [diff] [blame] | 276 | else if (keyfile) |
| 277 | snprintf(key_id, sizeof(key_id), "%s", keyfile); |
| 278 | else |
| 279 | return -EINVAL; |
| 280 | |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 281 | } else { |
| 282 | fprintf(stderr, "Engine not supported\n"); |
| 283 | return -ENOTSUP; |
| 284 | } |
| 285 | |
| 286 | key = ENGINE_load_private_key(engine, key_id, NULL, NULL); |
| 287 | if (!key) |
| 288 | return rsa_err("Failure loading private key from engine"); |
| 289 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 290 | *evpp = key; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 291 | |
| 292 | return 0; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 293 | } |
| 294 | |
| 295 | /** |
| 296 | * rsa_get_priv_key() - read a private key |
| 297 | * |
| 298 | * @keydir: Directory containing the key (PEM file) or key prefix (engine) |
| 299 | * @name Name of key |
| 300 | * @engine Engine to use for signing |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 301 | * @evpp Returns EVP_PKEY object, or NULL on failure |
| 302 | * @return 0 if ok, -ve on error (in which case *evpp will be set to NULL) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 303 | */ |
| 304 | static int rsa_get_priv_key(const char *keydir, const char *name, |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 305 | const char *keyfile, ENGINE *engine, EVP_PKEY **evpp) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 306 | { |
| 307 | if (engine) |
Alexandru Gagniuc | a35da20 | 2021-02-19 12:45:18 -0600 | [diff] [blame] | 308 | return rsa_engine_get_priv_key(keydir, name, keyfile, engine, |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 309 | evpp); |
| 310 | return rsa_pem_get_priv_key(keydir, name, keyfile, evpp); |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 311 | } |
| 312 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 313 | static int rsa_init(void) |
| 314 | { |
| 315 | int ret; |
| 316 | |
Caliph Nomble | 1a31b02 | 2018-07-25 22:13:03 -0400 | [diff] [blame] | 317 | #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ |
| 318 | (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x02070000fL) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 319 | ret = SSL_library_init(); |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 320 | #else |
| 321 | ret = OPENSSL_init_ssl(0, NULL); |
| 322 | #endif |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 323 | if (!ret) { |
| 324 | fprintf(stderr, "Failure to init SSL library\n"); |
| 325 | return -1; |
| 326 | } |
Caliph Nomble | 1a31b02 | 2018-07-25 22:13:03 -0400 | [diff] [blame] | 327 | #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ |
| 328 | (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x02070000fL) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 329 | SSL_load_error_strings(); |
| 330 | |
| 331 | OpenSSL_add_all_algorithms(); |
| 332 | OpenSSL_add_all_digests(); |
| 333 | OpenSSL_add_all_ciphers(); |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 334 | #endif |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 335 | |
| 336 | return 0; |
| 337 | } |
| 338 | |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 339 | static int rsa_engine_init(const char *engine_id, ENGINE **pe) |
| 340 | { |
| 341 | ENGINE *e; |
| 342 | int ret; |
| 343 | |
| 344 | ENGINE_load_builtin_engines(); |
| 345 | |
| 346 | e = ENGINE_by_id(engine_id); |
| 347 | if (!e) { |
| 348 | fprintf(stderr, "Engine isn't available\n"); |
| 349 | ret = -1; |
| 350 | goto err_engine_by_id; |
| 351 | } |
| 352 | |
| 353 | if (!ENGINE_init(e)) { |
| 354 | fprintf(stderr, "Couldn't initialize engine\n"); |
| 355 | ret = -1; |
| 356 | goto err_engine_init; |
| 357 | } |
| 358 | |
| 359 | if (!ENGINE_set_default_RSA(e)) { |
| 360 | fprintf(stderr, "Couldn't set engine as default for RSA\n"); |
| 361 | ret = -1; |
| 362 | goto err_set_rsa; |
| 363 | } |
| 364 | |
| 365 | *pe = e; |
| 366 | |
| 367 | return 0; |
| 368 | |
| 369 | err_set_rsa: |
| 370 | ENGINE_finish(e); |
| 371 | err_engine_init: |
| 372 | ENGINE_free(e); |
| 373 | err_engine_by_id: |
Caliph Nomble | 1a31b02 | 2018-07-25 22:13:03 -0400 | [diff] [blame] | 374 | #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ |
| 375 | (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x02070000fL) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 376 | ENGINE_cleanup(); |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 377 | #endif |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 378 | return ret; |
| 379 | } |
| 380 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 381 | static void rsa_remove(void) |
| 382 | { |
Caliph Nomble | 1a31b02 | 2018-07-25 22:13:03 -0400 | [diff] [blame] | 383 | #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ |
| 384 | (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x02070000fL) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 385 | CRYPTO_cleanup_all_ex_data(); |
| 386 | ERR_free_strings(); |
| 387 | #ifdef HAVE_ERR_REMOVE_THREAD_STATE |
| 388 | ERR_remove_thread_state(NULL); |
| 389 | #else |
| 390 | ERR_remove_state(0); |
| 391 | #endif |
| 392 | EVP_cleanup(); |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 393 | #endif |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 394 | } |
| 395 | |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 396 | static void rsa_engine_remove(ENGINE *e) |
| 397 | { |
| 398 | if (e) { |
| 399 | ENGINE_finish(e); |
| 400 | ENGINE_free(e); |
| 401 | } |
| 402 | } |
| 403 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 404 | static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo, |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 405 | struct checksum_algo *checksum_algo, |
Heiko Schocher | edaf9b1 | 2014-03-03 12:19:26 +0100 | [diff] [blame] | 406 | const struct image_region region[], int region_count, |
| 407 | uint8_t **sigp, uint *sig_size) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 408 | { |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 409 | EVP_PKEY_CTX *ckey; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 410 | EVP_MD_CTX *context; |
Philippe Reynes | 8161ff8 | 2018-11-14 13:50:59 +0100 | [diff] [blame] | 411 | int ret = 0; |
| 412 | size_t size; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 413 | uint8_t *sig; |
| 414 | int i; |
| 415 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 416 | size = EVP_PKEY_size(pkey); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 417 | sig = malloc(size); |
| 418 | if (!sig) { |
Philippe Reynes | 8161ff8 | 2018-11-14 13:50:59 +0100 | [diff] [blame] | 419 | fprintf(stderr, "Out of memory for signature (%zu bytes)\n", |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 420 | size); |
| 421 | ret = -ENOMEM; |
| 422 | goto err_alloc; |
| 423 | } |
| 424 | |
| 425 | context = EVP_MD_CTX_create(); |
| 426 | if (!context) { |
| 427 | ret = rsa_err("EVP context creation failed"); |
| 428 | goto err_create; |
| 429 | } |
| 430 | EVP_MD_CTX_init(context); |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 431 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 432 | ckey = EVP_PKEY_CTX_new(pkey, NULL); |
Philippe Reynes | 1246835 | 2018-11-14 13:51:00 +0100 | [diff] [blame] | 433 | if (!ckey) { |
| 434 | ret = rsa_err("EVP key context creation failed"); |
| 435 | goto err_create; |
| 436 | } |
| 437 | |
| 438 | if (EVP_DigestSignInit(context, &ckey, |
Philippe Reynes | 8161ff8 | 2018-11-14 13:50:59 +0100 | [diff] [blame] | 439 | checksum_algo->calculate_sign(), |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 440 | NULL, pkey) <= 0) { |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 441 | ret = rsa_err("Signer setup failed"); |
| 442 | goto err_sign; |
| 443 | } |
| 444 | |
Philippe Reynes | 47d73f0 | 2018-11-14 13:51:01 +0100 | [diff] [blame] | 445 | #ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT |
| 446 | if (padding_algo && !strcmp(padding_algo->name, "pss")) { |
| 447 | if (EVP_PKEY_CTX_set_rsa_padding(ckey, |
| 448 | RSA_PKCS1_PSS_PADDING) <= 0) { |
| 449 | ret = rsa_err("Signer padding setup failed"); |
| 450 | goto err_sign; |
| 451 | } |
| 452 | } |
| 453 | #endif /* CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT */ |
| 454 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 455 | for (i = 0; i < region_count; i++) { |
Philippe Reynes | 8161ff8 | 2018-11-14 13:50:59 +0100 | [diff] [blame] | 456 | if (!EVP_DigestSignUpdate(context, region[i].data, |
| 457 | region[i].size)) { |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 458 | ret = rsa_err("Signing data failed"); |
| 459 | goto err_sign; |
| 460 | } |
| 461 | } |
| 462 | |
Philippe Reynes | 8161ff8 | 2018-11-14 13:50:59 +0100 | [diff] [blame] | 463 | if (!EVP_DigestSignFinal(context, sig, &size)) { |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 464 | ret = rsa_err("Could not obtain signature"); |
| 465 | goto err_sign; |
| 466 | } |
Philippe Reynes | 8161ff8 | 2018-11-14 13:50:59 +0100 | [diff] [blame] | 467 | |
Caliph Nomble | 1a31b02 | 2018-07-25 22:13:03 -0400 | [diff] [blame] | 468 | #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ |
| 469 | (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x02070000fL) |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 470 | EVP_MD_CTX_cleanup(context); |
| 471 | #else |
| 472 | EVP_MD_CTX_reset(context); |
| 473 | #endif |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 474 | EVP_MD_CTX_destroy(context); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 475 | |
Philippe Reynes | 8161ff8 | 2018-11-14 13:50:59 +0100 | [diff] [blame] | 476 | debug("Got signature: %d bytes, expected %zu\n", *sig_size, size); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 477 | *sigp = sig; |
| 478 | *sig_size = size; |
| 479 | |
| 480 | return 0; |
| 481 | |
| 482 | err_sign: |
| 483 | EVP_MD_CTX_destroy(context); |
| 484 | err_create: |
| 485 | free(sig); |
| 486 | err_alloc: |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 487 | return ret; |
| 488 | } |
| 489 | |
| 490 | int rsa_sign(struct image_sign_info *info, |
| 491 | const struct image_region region[], int region_count, |
| 492 | uint8_t **sigp, uint *sig_len) |
| 493 | { |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 494 | EVP_PKEY *pkey = NULL; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 495 | ENGINE *e = NULL; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 496 | int ret; |
| 497 | |
| 498 | ret = rsa_init(); |
| 499 | if (ret) |
| 500 | return ret; |
| 501 | |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 502 | if (info->engine_id) { |
| 503 | ret = rsa_engine_init(info->engine_id, &e); |
| 504 | if (ret) |
| 505 | goto err_engine; |
| 506 | } |
| 507 | |
Alexandru Gagniuc | a35da20 | 2021-02-19 12:45:18 -0600 | [diff] [blame] | 508 | ret = rsa_get_priv_key(info->keydir, info->keyname, info->keyfile, |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 509 | e, &pkey); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 510 | if (ret) |
| 511 | goto err_priv; |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 512 | ret = rsa_sign_with_key(pkey, info->padding, info->checksum, region, |
Heiko Schocher | edaf9b1 | 2014-03-03 12:19:26 +0100 | [diff] [blame] | 513 | region_count, sigp, sig_len); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 514 | if (ret) |
| 515 | goto err_sign; |
| 516 | |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 517 | EVP_PKEY_free(pkey); |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 518 | if (info->engine_id) |
| 519 | rsa_engine_remove(e); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 520 | rsa_remove(); |
| 521 | |
| 522 | return ret; |
| 523 | |
| 524 | err_sign: |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 525 | EVP_PKEY_free(pkey); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 526 | err_priv: |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 527 | if (info->engine_id) |
| 528 | rsa_engine_remove(e); |
| 529 | err_engine: |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 530 | rsa_remove(); |
| 531 | return ret; |
| 532 | } |
| 533 | |
| 534 | /* |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 535 | * rsa_get_exponent(): - Get the public exponent from an RSA key |
| 536 | */ |
| 537 | static int rsa_get_exponent(RSA *key, uint64_t *e) |
| 538 | { |
| 539 | int ret; |
| 540 | BIGNUM *bn_te; |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 541 | const BIGNUM *key_e; |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 542 | uint64_t te; |
| 543 | |
| 544 | ret = -EINVAL; |
| 545 | bn_te = NULL; |
| 546 | |
| 547 | if (!e) |
| 548 | goto cleanup; |
| 549 | |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 550 | RSA_get0_key(key, NULL, &key_e, NULL); |
| 551 | if (BN_num_bits(key_e) > 64) |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 552 | goto cleanup; |
| 553 | |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 554 | *e = BN_get_word(key_e); |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 555 | |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 556 | if (BN_num_bits(key_e) < 33) { |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 557 | ret = 0; |
| 558 | goto cleanup; |
| 559 | } |
| 560 | |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 561 | bn_te = BN_dup(key_e); |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 562 | if (!bn_te) |
| 563 | goto cleanup; |
| 564 | |
| 565 | if (!BN_rshift(bn_te, bn_te, 32)) |
| 566 | goto cleanup; |
| 567 | |
| 568 | if (!BN_mask_bits(bn_te, 32)) |
| 569 | goto cleanup; |
| 570 | |
| 571 | te = BN_get_word(bn_te); |
| 572 | te <<= 32; |
| 573 | *e |= te; |
| 574 | ret = 0; |
| 575 | |
| 576 | cleanup: |
| 577 | if (bn_te) |
| 578 | BN_free(bn_te); |
| 579 | |
| 580 | return ret; |
| 581 | } |
| 582 | |
| 583 | /* |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 584 | * rsa_get_params(): - Get the important parameters of an RSA public key |
| 585 | */ |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 586 | int rsa_get_params(RSA *key, uint64_t *exponent, uint32_t *n0_invp, |
| 587 | BIGNUM **modulusp, BIGNUM **r_squaredp) |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 588 | { |
| 589 | BIGNUM *big1, *big2, *big32, *big2_32; |
| 590 | BIGNUM *n, *r, *r_squared, *tmp; |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 591 | const BIGNUM *key_n; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 592 | BN_CTX *bn_ctx = BN_CTX_new(); |
| 593 | int ret = 0; |
| 594 | |
| 595 | /* Initialize BIGNUMs */ |
| 596 | big1 = BN_new(); |
| 597 | big2 = BN_new(); |
| 598 | big32 = BN_new(); |
| 599 | r = BN_new(); |
| 600 | r_squared = BN_new(); |
| 601 | tmp = BN_new(); |
| 602 | big2_32 = BN_new(); |
| 603 | n = BN_new(); |
| 604 | if (!big1 || !big2 || !big32 || !r || !r_squared || !tmp || !big2_32 || |
| 605 | !n) { |
| 606 | fprintf(stderr, "Out of memory (bignum)\n"); |
| 607 | return -ENOMEM; |
| 608 | } |
| 609 | |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 610 | if (0 != rsa_get_exponent(key, exponent)) |
| 611 | ret = -1; |
| 612 | |
Jelle van der Waa | e980590 | 2017-05-08 21:31:19 +0200 | [diff] [blame] | 613 | RSA_get0_key(key, &key_n, NULL, NULL); |
| 614 | if (!BN_copy(n, key_n) || !BN_set_word(big1, 1L) || |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 615 | !BN_set_word(big2, 2L) || !BN_set_word(big32, 32L)) |
| 616 | ret = -1; |
| 617 | |
| 618 | /* big2_32 = 2^32 */ |
| 619 | if (!BN_exp(big2_32, big2, big32, bn_ctx)) |
| 620 | ret = -1; |
| 621 | |
| 622 | /* Calculate n0_inv = -1 / n[0] mod 2^32 */ |
| 623 | if (!BN_mod_inverse(tmp, n, big2_32, bn_ctx) || |
| 624 | !BN_sub(tmp, big2_32, tmp)) |
| 625 | ret = -1; |
| 626 | *n0_invp = BN_get_word(tmp); |
| 627 | |
| 628 | /* Calculate R = 2^(# of key bits) */ |
| 629 | if (!BN_set_word(tmp, BN_num_bits(n)) || |
| 630 | !BN_exp(r, big2, tmp, bn_ctx)) |
| 631 | ret = -1; |
| 632 | |
| 633 | /* Calculate r_squared = R^2 mod n */ |
| 634 | if (!BN_copy(r_squared, r) || |
| 635 | !BN_mul(tmp, r_squared, r, bn_ctx) || |
| 636 | !BN_mod(r_squared, tmp, n, bn_ctx)) |
| 637 | ret = -1; |
| 638 | |
| 639 | *modulusp = n; |
| 640 | *r_squaredp = r_squared; |
| 641 | |
| 642 | BN_free(big1); |
| 643 | BN_free(big2); |
| 644 | BN_free(big32); |
| 645 | BN_free(r); |
| 646 | BN_free(tmp); |
| 647 | BN_free(big2_32); |
| 648 | if (ret) { |
| 649 | fprintf(stderr, "Bignum operations failed\n"); |
| 650 | return -ENOMEM; |
| 651 | } |
| 652 | |
| 653 | return ret; |
| 654 | } |
| 655 | |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 656 | int rsa_add_verify_data(struct image_sign_info *info, void *keydest) |
| 657 | { |
| 658 | BIGNUM *modulus, *r_squared; |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 659 | uint64_t exponent; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 660 | uint32_t n0_inv; |
| 661 | int parent, node; |
| 662 | char name[100]; |
| 663 | int ret; |
| 664 | int bits; |
| 665 | RSA *rsa; |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 666 | EVP_PKEY *pkey = NULL; |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 667 | ENGINE *e = NULL; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 668 | |
| 669 | debug("%s: Getting verification data\n", __func__); |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 670 | if (info->engine_id) { |
| 671 | ret = rsa_engine_init(info->engine_id, &e); |
| 672 | if (ret) |
| 673 | return ret; |
| 674 | } |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 675 | ret = rsa_get_pub_key(info->keydir, info->keyname, e, &pkey); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 676 | if (ret) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 677 | goto err_get_pub_key; |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 678 | #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ |
| 679 | (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x02070000fL) |
| 680 | rsa = EVP_PKEY_get1_RSA(pkey); |
| 681 | #else |
| 682 | rsa = EVP_PKEY_get0_RSA(pkey); |
| 683 | #endif |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 684 | ret = rsa_get_params(rsa, &exponent, &n0_inv, &modulus, &r_squared); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 685 | if (ret) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 686 | goto err_get_params; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 687 | bits = BN_num_bits(modulus); |
| 688 | parent = fdt_subnode_offset(keydest, 0, FIT_SIG_NODENAME); |
| 689 | if (parent == -FDT_ERR_NOTFOUND) { |
| 690 | parent = fdt_add_subnode(keydest, 0, FIT_SIG_NODENAME); |
| 691 | if (parent < 0) { |
Simon Glass | 9423bad | 2014-06-12 07:24:42 -0600 | [diff] [blame] | 692 | ret = parent; |
| 693 | if (ret != -FDT_ERR_NOSPACE) { |
| 694 | fprintf(stderr, "Couldn't create signature node: %s\n", |
| 695 | fdt_strerror(parent)); |
| 696 | } |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 697 | } |
| 698 | } |
Simon Glass | 9423bad | 2014-06-12 07:24:42 -0600 | [diff] [blame] | 699 | if (ret) |
| 700 | goto done; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 701 | |
| 702 | /* Either create or overwrite the named key node */ |
| 703 | snprintf(name, sizeof(name), "key-%s", info->keyname); |
| 704 | node = fdt_subnode_offset(keydest, parent, name); |
| 705 | if (node == -FDT_ERR_NOTFOUND) { |
| 706 | node = fdt_add_subnode(keydest, parent, name); |
| 707 | if (node < 0) { |
Simon Glass | 9423bad | 2014-06-12 07:24:42 -0600 | [diff] [blame] | 708 | ret = node; |
| 709 | if (ret != -FDT_ERR_NOSPACE) { |
| 710 | fprintf(stderr, "Could not create key subnode: %s\n", |
| 711 | fdt_strerror(node)); |
| 712 | } |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 713 | } |
| 714 | } else if (node < 0) { |
| 715 | fprintf(stderr, "Cannot select keys parent: %s\n", |
| 716 | fdt_strerror(node)); |
Simon Glass | 9423bad | 2014-06-12 07:24:42 -0600 | [diff] [blame] | 717 | ret = node; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 718 | } |
| 719 | |
Simon Glass | 9423bad | 2014-06-12 07:24:42 -0600 | [diff] [blame] | 720 | if (!ret) { |
Simon Glass | d7aabcc | 2020-03-18 11:44:06 -0600 | [diff] [blame] | 721 | ret = fdt_setprop_string(keydest, node, FIT_KEY_HINT, |
| 722 | info->keyname); |
Simon Glass | 9423bad | 2014-06-12 07:24:42 -0600 | [diff] [blame] | 723 | } |
Simon Glass | af2f9d5 | 2014-06-02 22:04:51 -0600 | [diff] [blame] | 724 | if (!ret) |
| 725 | ret = fdt_setprop_u32(keydest, node, "rsa,num-bits", bits); |
| 726 | if (!ret) |
| 727 | ret = fdt_setprop_u32(keydest, node, "rsa,n0-inverse", n0_inv); |
| 728 | if (!ret) { |
Michael van der Westhuizen | 89f4ed1 | 2014-07-02 10:17:26 +0200 | [diff] [blame] | 729 | ret = fdt_setprop_u64(keydest, node, "rsa,exponent", exponent); |
| 730 | } |
| 731 | if (!ret) { |
Simon Glass | af2f9d5 | 2014-06-02 22:04:51 -0600 | [diff] [blame] | 732 | ret = fdt_add_bignum(keydest, node, "rsa,modulus", modulus, |
| 733 | bits); |
| 734 | } |
| 735 | if (!ret) { |
| 736 | ret = fdt_add_bignum(keydest, node, "rsa,r-squared", r_squared, |
| 737 | bits); |
| 738 | } |
| 739 | if (!ret) { |
| 740 | ret = fdt_setprop_string(keydest, node, FIT_ALGO_PROP, |
Andrew Duda | 6616c82 | 2016-11-08 18:53:41 +0000 | [diff] [blame] | 741 | info->name); |
Simon Glass | af2f9d5 | 2014-06-02 22:04:51 -0600 | [diff] [blame] | 742 | } |
mario.six@gdsys.cc | 99fc6ea | 2016-07-19 11:07:07 +0200 | [diff] [blame] | 743 | if (!ret && info->require_keys) { |
Simon Glass | d7aabcc | 2020-03-18 11:44:06 -0600 | [diff] [blame] | 744 | ret = fdt_setprop_string(keydest, node, FIT_KEY_REQUIRED, |
Simon Glass | af2f9d5 | 2014-06-02 22:04:51 -0600 | [diff] [blame] | 745 | info->require_keys); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 746 | } |
Simon Glass | 9423bad | 2014-06-12 07:24:42 -0600 | [diff] [blame] | 747 | done: |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 748 | BN_free(modulus); |
| 749 | BN_free(r_squared); |
| 750 | if (ret) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 751 | ret = ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO; |
| 752 | err_get_params: |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 753 | #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ |
| 754 | (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x02070000fL) |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 755 | RSA_free(rsa); |
Chan, Donald | 0bdd4ee | 2021-04-01 22:42:36 +0000 | [diff] [blame] | 756 | #endif |
| 757 | EVP_PKEY_free(pkey); |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 758 | err_get_pub_key: |
| 759 | if (info->engine_id) |
| 760 | rsa_engine_remove(e); |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 761 | |
George McCollister | 23d1489 | 2017-01-06 13:14:17 -0600 | [diff] [blame] | 762 | return ret; |
Simon Glass | 35191a3 | 2013-06-13 15:10:02 -0700 | [diff] [blame] | 763 | } |