Re: [ima-evm-utils PATCH v2 12/13] Update sign_hash_v*() definition to include the key password

Stefan Berger
2024-01-02T13:44:27Z

On 12/6/23 14:27, Mimi Zohar wrote:
> The library sign_hash() definition already includes a key password as a
> parameter, but it isn't passed on to sign_hash_v*() functions. Update
> the sign_hash_v*() function definitions and callers.
>
> Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>

> ---
> src/libimaevm.c | 18 ++++++++++--------
> 1 file changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/src/libimaevm.c b/src/libimaevm.c
> index 10e1ed3eab4d..9d8f419ae64d 100644
> --- a/src/libimaevm.c
> +++ b/src/libimaevm.c
> @@ -1115,7 +1115,8 @@ static int get_hash_algo_v1(const char *algo)
> }
>
> static int sign_hash_v1(const char *hashalgo, const unsigned char *hash,
> - int size, const char *keyfile, unsigned char *sig)
> + int size, const char *keyfile, const char *keypass,
> + unsigned char *sig)
> {
> int len = -1, hashalgo_idx;
> SHA_CTX ctx;
> @@ -1149,7 +1150,7 @@ static int sign_hash_v1(const char *hashalgo, const unsigned char *hash,
> log_info("hash(%s): ", hashalgo);
> log_dump(hash, size);
>
> - key = read_priv_key(keyfile, imaevm_params.keypass);
> + key = read_priv_key(keyfile, keypass);
> if (!key)
> return -1;
>
> @@ -1202,7 +1203,8 @@ out:
> * Return: -1 signing error, >0 length of signature
> */
> static int sign_hash_v2(const char *algo, const unsigned char *hash,
> - int size, const char *keyfile, unsigned char *sig)
> + int size, const char *keyfile, const char *keypass,
> + unsigned char *sig)
> {
> struct signature_v2_hdr *hdr;
> int len = -1;
> @@ -1237,7 +1239,7 @@ static int sign_hash_v2(const char *algo, const unsigned char *hash,
> log_info("hash(%s): ", algo);
> log_dump(hash, size);
>
> - pkey = read_priv_pkey(keyfile, imaevm_params.keypass);
> + pkey = read_priv_pkey(keyfile, keypass);
> if (!pkey)
> return -1;
>
> @@ -1307,14 +1309,14 @@ err:
>
> int sign_hash(const char *hashalgo, const unsigned char *hash, int size, const char *keyfile, const char *keypass, unsigned char *sig)
> {
> - if (keypass)
> - imaevm_params.keypass = keypass;
> + if (!keypass) /* Avoid breaking existing libimaevm usage */
> + keypass = imaevm_params.keypass;
>
> if (imaevm_params.x509)
> - return sign_hash_v2(hashalgo, hash, size, keyfile, sig);
> + return sign_hash_v2(hashalgo, hash, size, keyfile, keypass, sig);
> #if CONFIG_SIGV1
> else
> - return sign_hash_v1(hashalgo, hash, size, keyfile, sig);
> + return sign_hash_v1(hashalgo, hash, size, keyfile, keypass, sig);
> #endif
> log_info("Signature version 1 deprecated.");
> return -1;