1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
# SPDX-License-Identifier: GPL-2.0+
#
# Copyright (c) 2020,2021 Alexandru Gagniuc <mr.nuke.me@gmail.com>
"""
Test ECDSA signing of FIT images
This test uses mkimage to sign an existing FIT image with an ECDSA key. The
signature is then extracted, and verified against pyCryptodome.
This test doesn't run the sandbox. It only checks the host tool 'mkimage'
"""
import os
import pytest
import u_boot_utils as util
from Cryptodome.Hash import SHA256
from Cryptodome.PublicKey import ECC
from Cryptodome.Signature import DSS
class SignableFitImage(object):
""" Helper to manipulate a FIT image on disk """
def __init__(self, cons, file_name):
self.fit = file_name
self.cons = cons
self.signable_nodes = set()
def __fdt_list(self, path):
return util.run_and_log(self.cons, f'fdtget -l {self.fit} {path}')
def __fdt_set(self, node, **prop_value):
for prop, value in prop_value.items():
util.run_and_log(self.cons, f'fdtput -ts {self.fit} {node} {prop} {value}')
def __fdt_get_binary(self, node, prop):
numbers = util.run_and_log(self.cons, f'fdtget -tbi {self.fit} {node} {prop}')
bignum = bytearray()
for little_num in numbers.split():
bignum.append(int(little_num))
return bignum
def find_signable_image_nodes(self):
for node in self.__fdt_list('/images').split():
image = f'/images/{node}'
if 'signature' in self.__fdt_list(image):
self.signable_nodes.add(image)
return self.signable_nodes
def change_signature_algo_to_ecdsa(self):
for image in self.signable_nodes:
self.__fdt_set(f'{image}/signature', algo='sha256,ecdsa256')
def sign(self, mkimage, key_file):
util.run_and_log(self.cons, [mkimage, '-F', self.fit, f'-G{key_file}'])
def check_signatures(self, key):
for image in self.signable_nodes:
raw_sig = self.__fdt_get_binary(f'{image}/signature', 'value')
raw_bin = self.__fdt_get_binary(image, 'data')
sha = SHA256.new(raw_bin)
verifier = DSS.new(key, 'fips-186-3')
verifier.verify(sha, bytes(raw_sig))
@pytest.mark.buildconfigspec('fit_signature')
@pytest.mark.requiredtool('dtc')
@pytest.mark.requiredtool('fdtget')
@pytest.mark.requiredtool('fdtput')
def test_fit_ecdsa(u_boot_console):
""" Test that signatures generated by mkimage are legible. """
def generate_ecdsa_key():
return ECC.generate(curve='prime256v1')
def assemble_fit_image(dest_fit, its, destdir):
dtc_args = f'-I dts -O dtb -i {destdir}'
util.run_and_log(cons, [mkimage, '-D', dtc_args, '-f', its, dest_fit])
def dtc(dts):
dtb = dts.replace('.dts', '.dtb')
util.run_and_log(cons, f'dtc {datadir}/{dts} -O dtb -o {tempdir}/{dtb}')
cons = u_boot_console
mkimage = cons.config.build_dir + '/tools/mkimage'
datadir = cons.config.source_dir + '/test/py/tests/vboot/'
tempdir = os.path.join(cons.config.result_dir, 'ecdsa')
os.makedirs(tempdir, exist_ok=True)
key_file = f'{tempdir}/ecdsa-test-key.pem'
fit_file = f'{tempdir}/test.fit'
dtc('sandbox-kernel.dts')
key = generate_ecdsa_key()
# Create a fake kernel image -- zeroes will do just fine
with open(f'{tempdir}/test-kernel.bin', 'w') as fd:
fd.write(500 * chr(0))
# invocations of mkimage expect to read the key from disk
with open(key_file, 'w') as f:
f.write(key.export_key(format='PEM'))
assemble_fit_image(fit_file, f'{datadir}/sign-images-sha256.its', tempdir)
fit = SignableFitImage(cons, fit_file)
nodes = fit.find_signable_image_nodes()
if len(nodes) == 0:
raise ValueError('FIT image has no "/image" nodes with "signature"')
fit.change_signature_algo_to_ecdsa()
fit.sign(mkimage, key_file)
fit.check_signatures(key)
|