* [U-Boot] [PATCH] common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image
@ 2017-06-08 9:52 Heiko Schocher
2017-06-09 1:06 ` Tom Rini
2017-06-09 3:05 ` Simon Glass
0 siblings, 2 replies; 5+ messages in thread
From: Heiko Schocher @ 2017-06-08 9:52 UTC (permalink / raw)
To: u-boot
fit_image_verify_required_sigs() must return != 0, on error.
When fit_image_verify_required_sigs() does not find a signature
node, it returns 0, which leads in booting a signed FIT image.
Fix this!
Signed-off-by: Heiko Schocher <hs@denx.de>
---
Found on an imx28 based board, with key dtb appended to u-boot.bin.
Booting signed FIT image without an valid key dtb appended to u-boot.bin
shows:
Using FEC1 device
TFTP from server 192.168.1.1; our IP address is 192.168.20.103
Filename '/tftpboot/xxx/20170509/signed.fit'.
Load address: 0x42000000
Loading: #################################################################
[...]
###########
3.3 MiB/s
done
Bytes transferred = 12560801 (bfa9a1 hex)
Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage
Description: Linux kernel
Created: 2017-06-08 9:10:14 UTC
Type: Kernel Image
Compression: uncompressed
Data Start: 0x420000c0
Data Size: 4078928 Bytes = 3.9 MiB
Architecture: ARM
OS: Linux
Load Address: 0x40008000
Entry Point: 0x40008000
Hash algo: sha256
Hash value: 6d1dce3e08133ac4d34c0e07ce266f5cffc6f5a2713619c9ff76ca4b04df4a5b
Sign algo: sha256,rsa4096:dev
Sign value: xxx
Timestamp: 2017-06-08 9:10:15 UTC
Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Using 'conf at 1' configuration
Trying 'ramdisk at 1' ramdisk subimage
Description: miro ramdisk
Created: 2017-06-08 9:10:14 UTC
Type: RAMDisk Image
Compression: gzip compressed
Data Start: 0x423e92b0
Data Size: 8457506 Bytes = 8.1 MiB
Architecture: ARM
OS: Linux
Load Address: 0x00000000
Entry Point: 0x00000000
Hash algo: sha256
Hash value: da60884efa4373e7003940a56271c326f159ff74356ded28d8ebe108af807cda
Sign algo: sha256,rsa4096:dev
Sign value: xxx
Timestamp: 2017-06-08 9:10:15 UTC
Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Using 'conf at 1' configuration
Trying 'fdt at 1' fdt subimage
Description: miro device tree
Created: 2017-06-08 9:10:14 UTC
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x423e41b4
Data Size: 19852 Bytes = 19.4 KiB
Architecture: ARM
Hash algo: sha256
Hash value: 9b39c3ab6227bb8f0bcebc0bb64439248a6670dfe873bb1c6536764e0dc1623c
Sign algo: sha256,rsa4096:dev
Sign value: xxx
Timestamp: 2017-06-08 9:10:15 UTC
Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Booting using the fdt blob at 0x423e41b4
Loading Kernel Image ... OK
Loading Ramdisk to 47303000, end 47b13d22 ... OK
Loading Device Tree to 472fb000, end 47302d8b ... OK
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 4.11.0 (hs at hercules.denx.de) (gcc version 6.2.0 (GCC) ) #1 Tue May 16 07:31:30 CEST 2017
[...]
And linux boots ... which is bad, as we have no valid key appended
to u-boot.bin ...
With this patch it shows:
Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage
Description: Linux kernel
Created: 2017-06-08 9:34:28 UTC
Type: Kernel Image
Compression: uncompressed
Data Start: 0x420000c0
Data Size: 4078928 Bytes = 3.9 MiB
Architecture: ARM
OS: Linux
Load Address: 0x40008000
Entry Point: 0x40008000
Hash algo: sha256
Hash value: 6d1dce3e08133ac4d34c0e07ce266f5cffc6f5a2713619c9ff76ca4b04df4a5b
Sign algo: sha256,rsa4096:dev
Sign value: xxx
Timestamp: 2017-06-08 9:34:29 UTC
Verifying Hash Integrity ... error!
Unable to verify required signature for '' hash node in 'kernel at 1' image node
Bad Data Hash
ERROR: can't get kernel image!
=>
common/image-sig.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/common/image-sig.c b/common/image-sig.c
index 455f2b9..646fb08 100644
--- a/common/image-sig.c
+++ b/common/image-sig.c
@@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
if (sig_node < 0) {
debug("%s: No signature node found: %s\n", __func__,
fdt_strerror(sig_node));
- return 0;
+ return 1;
}
fdt_for_each_subnode(noffset, sig_blob, sig_node) {
--
2.7.4
^ permalink raw reply related [flat|nested] 5+ messages in thread* [U-Boot] [PATCH] common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image 2017-06-08 9:52 [U-Boot] [PATCH] common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image Heiko Schocher @ 2017-06-09 1:06 ` Tom Rini 2017-06-09 3:05 ` Simon Glass 1 sibling, 0 replies; 5+ messages in thread From: Tom Rini @ 2017-06-09 1:06 UTC (permalink / raw) To: u-boot On Thu, Jun 08, 2017 at 11:52:45AM +0200, Heiko Schocher wrote: > fit_image_verify_required_sigs() must return != 0, on error. > > When fit_image_verify_required_sigs() does not find a signature > node, it returns 0, which leads in booting a signed FIT image. > > Fix this! > > Signed-off-by: Heiko Schocher <hs@denx.de> Good catch. Did you confirm that the sandbox tests still work? And can you construct a new test for this case? Thanks! -- Tom -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 819 bytes Desc: Digital signature URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170608/9bccc5d7/attachment.sig> ^ permalink raw reply [flat|nested] 5+ messages in thread
* [U-Boot] [PATCH] common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image 2017-06-08 9:52 [U-Boot] [PATCH] common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image Heiko Schocher 2017-06-09 1:06 ` Tom Rini @ 2017-06-09 3:05 ` Simon Glass 2017-06-09 4:52 ` Heiko Schocher 1 sibling, 1 reply; 5+ messages in thread From: Simon Glass @ 2017-06-09 3:05 UTC (permalink / raw) To: u-boot Hi Heiko, On 8 June 2017 at 03:52, Heiko Schocher <hs@denx.de> wrote: > fit_image_verify_required_sigs() must return != 0, on error. > > When fit_image_verify_required_sigs() does not find a signature > node, it returns 0, which leads in booting a signed FIT image. > > Fix this! > > Signed-off-by: Heiko Schocher <hs@denx.de> > --- > > Found on an imx28 based board, with key dtb appended to u-boot.bin. > > Booting signed FIT image without an valid key dtb appended to u-boot.bin > shows: > > Using FEC1 device > TFTP from server 192.168.1.1; our IP address is 192.168.20.103 > Filename '/tftpboot/xxx/20170509/signed.fit'. > Load address: 0x42000000 > Loading: ################################################################# > [...] > ########### > 3.3 MiB/s > done > Bytes transferred = 12560801 (bfa9a1 hex) > Using 'conf at 1' configuration > Verifying Hash Integrity ... OK > Trying 'kernel at 1' kernel subimage > Description: Linux kernel > Created: 2017-06-08 9:10:14 UTC > Type: Kernel Image > Compression: uncompressed > Data Start: 0x420000c0 > Data Size: 4078928 Bytes = 3.9 MiB > Architecture: ARM > OS: Linux > Load Address: 0x40008000 > Entry Point: 0x40008000 > Hash algo: sha256 > Hash value: 6d1dce3e08133ac4d34c0e07ce266f5cffc6f5a2713619c9ff76ca4b04df4a5b > Sign algo: sha256,rsa4096:dev > Sign value: xxx > Timestamp: 2017-06-08 9:10:15 UTC > Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > Using 'conf at 1' configuration > Trying 'ramdisk at 1' ramdisk subimage > Description: miro ramdisk > Created: 2017-06-08 9:10:14 UTC > Type: RAMDisk Image > Compression: gzip compressed > Data Start: 0x423e92b0 > Data Size: 8457506 Bytes = 8.1 MiB > Architecture: ARM > OS: Linux > Load Address: 0x00000000 > Entry Point: 0x00000000 > Hash algo: sha256 > Hash value: da60884efa4373e7003940a56271c326f159ff74356ded28d8ebe108af807cda > Sign algo: sha256,rsa4096:dev > Sign value: xxx > Timestamp: 2017-06-08 9:10:15 UTC > Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > Using 'conf at 1' configuration > Trying 'fdt at 1' fdt subimage > Description: miro device tree > Created: 2017-06-08 9:10:14 UTC > Type: Flat Device Tree > Compression: uncompressed > Data Start: 0x423e41b4 > Data Size: 19852 Bytes = 19.4 KiB > Architecture: ARM > Hash algo: sha256 > Hash value: 9b39c3ab6227bb8f0bcebc0bb64439248a6670dfe873bb1c6536764e0dc1623c > Sign algo: sha256,rsa4096:dev > Sign value: xxx > Timestamp: 2017-06-08 9:10:15 UTC > Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > Booting using the fdt blob at 0x423e41b4 > Loading Kernel Image ... OK > Loading Ramdisk to 47303000, end 47b13d22 ... OK > Loading Device Tree to 472fb000, end 47302d8b ... OK > > Starting kernel ... > > [ 0.000000] Booting Linux on physical CPU 0x0 > [ 0.000000] Linux version 4.11.0 (hs at hercules.denx.de) (gcc version 6.2.0 (GCC) ) #1 Tue May 16 07:31:30 CEST 2017 > [...] > > And linux boots ... which is bad, as we have no valid key appended > to u-boot.bin ... > > With this patch it shows: > > Using 'conf at 1' configuration > Verifying Hash Integrity ... OK > Trying 'kernel at 1' kernel subimage > Description: Linux kernel > Created: 2017-06-08 9:34:28 UTC > Type: Kernel Image > Compression: uncompressed > Data Start: 0x420000c0 > Data Size: 4078928 Bytes = 3.9 MiB > Architecture: ARM > OS: Linux > Load Address: 0x40008000 > Entry Point: 0x40008000 > Hash algo: sha256 > Hash value: 6d1dce3e08133ac4d34c0e07ce266f5cffc6f5a2713619c9ff76ca4b04df4a5b > Sign algo: sha256,rsa4096:dev > Sign value: xxx > Timestamp: 2017-06-08 9:34:29 UTC > Verifying Hash Integrity ... error! > Unable to verify required signature for '' hash node in 'kernel at 1' image node > Bad Data Hash > ERROR: can't get kernel image! > => > > > common/image-sig.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/common/image-sig.c b/common/image-sig.c > index 455f2b9..646fb08 100644 > --- a/common/image-sig.c > +++ b/common/image-sig.c > @@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset, > if (sig_node < 0) { > debug("%s: No signature node found: %s\n", __func__, > fdt_strerror(sig_node)); > - return 0; > + return 1; Thanks for finding/fixing this! I suggest returning -EPERM. Also note that using image-based security is somewhat insecure since people can mix and match them. Configuration signing is preferred if you can do it. As Tom said, can you add a test please? > } > > fdt_for_each_subnode(noffset, sig_blob, sig_node) { > -- > 2.7.4 > Regards, Simon ^ permalink raw reply [flat|nested] 5+ messages in thread
* [U-Boot] [PATCH] common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image 2017-06-09 3:05 ` Simon Glass @ 2017-06-09 4:52 ` Heiko Schocher 2017-08-04 22:20 ` Simon Glass 0 siblings, 1 reply; 5+ messages in thread From: Heiko Schocher @ 2017-06-09 4:52 UTC (permalink / raw) To: u-boot Hello Simon, Am 09.06.2017 um 05:05 schrieb Simon Glass: > Hi Heiko, > > On 8 June 2017 at 03:52, Heiko Schocher <hs@denx.de> wrote: >> fit_image_verify_required_sigs() must return != 0, on error. >> >> When fit_image_verify_required_sigs() does not find a signature >> node, it returns 0, which leads in booting a signed FIT image. >> >> Fix this! >> >> Signed-off-by: Heiko Schocher <hs@denx.de> >> --- >> >> Found on an imx28 based board, with key dtb appended to u-boot.bin. >> >> Booting signed FIT image without an valid key dtb appended to u-boot.bin >> shows: [...] >> common/image-sig.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/common/image-sig.c b/common/image-sig.c >> index 455f2b9..646fb08 100644 >> --- a/common/image-sig.c >> +++ b/common/image-sig.c >> @@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset, >> if (sig_node < 0) { >> debug("%s: No signature node found: %s\n", __func__, >> fdt_strerror(sig_node)); >> - return 0; >> + return 1; > > Thanks for finding/fixing this! I suggest returning -EPERM. Ok, changed. > Also note that using image-based security is somewhat insecure since > people can mix and match them. Configuration signing is preferred if > you can do it. I do this, here my configurations node from the its file: configurations { default = "conf at 1"; conf at 1 { description = "board config 1"; kernel = "kernel at 1"; fdt = "fdt at 1"; ramdisk = "ramdisk at 1"; signature at 1 { algo = "sha256,rsa4096"; key-name-hint = "dev"; }; }; }; > As Tom said, can you add a test please? Hmm... tried with current U-Boot, the steps described in test/image/test-fit.py # make O=sandbox sandbox_config # make O=sandbox # ./test/image/test-fit.py -u sandbox/u-boot and get: pollux:u-boot hs [master] $ ./test/image/test-fit.py -u sandbox/u-boot FIT Tests ========= Warning (unit_address_vs_reg): Node /reset at 0 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/kernel at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/kernel at 2 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/fdt at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/fdt at 1/signature at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/ramdisk at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/ramdisk at 2 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /configurations/conf at 1 has a unit name, but no reg property Kernel load U-Boot 2017.07-rc1-00997-gad701b1 (Jun 09 2017 - 06:18:46 +0200) DRAM: 128 MiB MMC: Using default environment In: serial Out: serial Err: serial SCSI: Net: No ethernet found. IDE: Bus 0: not available 18474 bytes read in 0 ms ## Loading kernel from FIT Image at 00001000 ... Using 'conf at 1' configuration Verifying Hash Integrity ... OK Trying 'kernel at 1' kernel subimage Description: unavailable Created: 2017-06-09 4:19:13 UTC Type: Kernel Image Compression: uncompressed Data Start: 0x000010c8 Data Size: 3491 Bytes = 3.4 KiB Architecture: Sandbox OS: Linux Load Address: 0x00040000 Entry Point: 0x00000008 Verifying Hash Integrity ... OK ## Loading fdt from FIT Image at 00001000 ... Using 'conf at 1' configuration Trying 'fdt at 1' fdt subimage Description: snow Created: 2017-06-09 4:19:13 UTC Type: Flat Device Tree Compression: uncompressed Data Start: 0x00002d30 Data Size: 193 Bytes = 193 Bytes Architecture: Sandbox Sign algo: sha1,rsa2048:dev Sign value: unavailable Timestamp: unavailable Verifying Hash Integrity ... sha1,rsa2048:dev- OK Booting using the fdt blob at 0x002d30 Loading Kernel Image ... OK 3491 bytes written in 0 ms 193 bytes written in 0 ms 4591 bytes written in 0 ms 3491 bytes written in 0 ms 4591 bytes written in 0 ms Expected '%s' but not found in output: U-Boot 2017.07-rc1-00997-gad701b1 (Jun 09 2017 - 06:18:46 +0200) DRAM: 128 MiB MMC: Using default environment In: serial Out: serial Err: serial SCSI: Net: No ethernet found. IDE: Bus 0: not available 18474 bytes read in 0 ms ## Loading kernel from FIT Image at 00001000 ... Using 'conf at 1' configuration Verifying Hash Integrity ... OK Trying 'kernel at 1' kernel subimage Description: unavailable Created: 2017-06-09 4:19:13 UTC Type: Kernel Image Compression: uncompressed Data Start: 0x000010c8 Data Size: 3491 Bytes = 3.4 KiB Architecture: Sandbox OS: Linux Load Address: 0x00040000 Entry Point: 0x00000008 Verifying Hash Integrity ... OK ## Loading fdt from FIT Image at 00001000 ... Using 'conf at 1' configuration Trying 'fdt at 1' fdt subimage Description: snow Created: 2017-06-09 4:19:13 UTC Type: Flat Device Tree Compression: uncompressed Data Start: 0x00002d30 Data Size: 193 Bytes = 193 Bytes Architecture: Sandbox Sign algo: sha1,rsa2048:dev Sign value: unavailable Timestamp: unavailable Verifying Hash Integrity ... sha1,rsa2048:dev- OK Booting using the fdt blob at 0x002d30 Loading Kernel Image ... OK 3491 bytes written in 0 ms 193 bytes written in 0 ms 4591 bytes written in 0 ms 3491 bytes written in 0 ms 4591 bytes written in 0 ms Traceback (most recent call last): File "./test/image/test-fit.py", line 481, in <module> run_tests() File "./test/image/test-fit.py", line 470, in run_tests run_fit_test(mkimage, options.u_boot) File "./test/image/test-fit.py", line 395, in run_fit_test line = find_matching(stdout, 'Booting using the FDT blob at ') File "./test/image/test-fit.py", line 286, in find_matching raise ValueError('Test aborted') ValueError: Test aborted :-( With my patch: pollux:u-boot hs [master] $ git diff diff --git a/common/image-sig.c b/common/image-sig.c index 455f2b9..e5ba85a 100644 --- a/common/image-sig.c +++ b/common/image-sig.c @@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset, if (sig_node < 0) { debug("%s: No signature node found: %s\n", __func__, fdt_strerror(sig_node)); - return 0; + return -EPERM; } fdt_for_each_subnode(noffset, sig_blob, sig_node) { pollux:u-boot hs [master] $ ./test/image/test-fit.py -u sandbox/u-boot FIT Tests ========= Warning (unit_address_vs_reg): Node /reset at 0 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/kernel at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/kernel at 2 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/fdt at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/fdt at 1/signature at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/ramdisk at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/ramdisk at 2 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /configurations/conf at 1 has a unit name, but no reg property Kernel load U-Boot 2017.07-rc1-00997-gad701b1-dirty (Jun 09 2017 - 06:21:36 +0200) DRAM: 128 MiB MMC: Using default environment In: serial Out: serial Err: serial SCSI: Net: No ethernet found. IDE: Bus 0: not available 18474 bytes read in 1 ms (17.6 MiB/s) ## Loading kernel from FIT Image at 00001000 ... Using 'conf at 1' configuration Verifying Hash Integrity ... OK Trying 'kernel at 1' kernel subimage Description: unavailable Created: 2017-06-09 4:22:07 UTC Type: Kernel Image Compression: uncompressed Data Start: 0x000010c8 Data Size: 3491 Bytes = 3.4 KiB Architecture: Sandbox OS: Linux Load Address: 0x00040000 Entry Point: 0x00000008 Verifying Hash Integrity ... error! Unable to verify required signature for '' hash node in 'kernel at 1' image node Bad Data Hash ERROR: can't get kernel image! XIP Invalid Image ... OK 3491 bytes written in 0 ms 193 bytes written in 0 ms 4591 bytes written in 0 ms 3491 bytes written in 0 ms 4591 bytes written in 0 ms U-Boot 2017.07-rc1-00997-gad701b1-dirty (Jun 09 2017 - 06:21:36 +0200) DRAM: 128 MiB MMC: Using default environment In: serial Out: serial Err: serial SCSI: Net: No ethernet found. IDE: Bus 0: not available 18474 bytes read in 1 ms (17.6 MiB/s) ## Loading kernel from FIT Image at 00001000 ... Using 'conf at 1' configuration Verifying Hash Integrity ... OK Trying 'kernel at 1' kernel subimage Description: unavailable Created: 2017-06-09 4:22:07 UTC Type: Kernel Image Compression: uncompressed Data Start: 0x000010c8 Data Size: 3491 Bytes = 3.4 KiB Architecture: Sandbox OS: Linux Load Address: 0x00040000 Entry Point: 0x00000008 Verifying Hash Integrity ... error! Unable to verify required signature for '' hash node in 'kernel@1' image node Bad Data Hash ERROR: can't get kernel image! XIP Invalid Image ... OK 3491 bytes written in 0 ms 193 bytes written in 0 ms 4591 bytes written in 0 ms 3491 bytes written in 0 ms 4591 bytes written in 0 ms Traceback (most recent call last): File "./test/image/test-fit.py", line 481, in <module> run_tests() File "./test/image/test-fit.py", line 470, in run_tests run_fit_test(mkimage, options.u_boot) File "./test/image/test-fit.py", line 388, in run_fit_test fail('Kernel not loaded', stdout) File "./test/image/test-fit.py", line 306, in fail raise ValueError("Test '%s' failed: %s" % (test_name, msg)) ValueError: Test 'Kernel load' failed: Kernel not loaded pollux:u-boot hs [master] $ Can you verify this? Thanks! bye, Heiko > >> } >> >> fdt_for_each_subnode(noffset, sig_blob, sig_node) { >> -- >> 2.7.4 >> > > Regards, > Simon > -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany ^ permalink raw reply related [flat|nested] 5+ messages in thread
* [U-Boot] [PATCH] common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image 2017-06-09 4:52 ` Heiko Schocher @ 2017-08-04 22:20 ` Simon Glass 0 siblings, 0 replies; 5+ messages in thread From: Simon Glass @ 2017-08-04 22:20 UTC (permalink / raw) To: u-boot Hi Heiko, On 8 June 2017 at 22:52, Heiko Schocher <hs@denx.de> wrote: > Hello Simon, > > Am 09.06.2017 um 05:05 schrieb Simon Glass: >> >> Hi Heiko, >> >> On 8 June 2017 at 03:52, Heiko Schocher <hs@denx.de> wrote: >>> >>> fit_image_verify_required_sigs() must return != 0, on error. >>> >>> When fit_image_verify_required_sigs() does not find a signature >>> node, it returns 0, which leads in booting a signed FIT image. >>> >>> Fix this! >>> >>> Signed-off-by: Heiko Schocher <hs@denx.de> >>> --- >>> >>> Found on an imx28 based board, with key dtb appended to u-boot.bin. >>> >>> Booting signed FIT image without an valid key dtb appended to u-boot.bin >>> shows: > > [...] >>> >>> common/image-sig.c | 2 +- >>> 1 file changed, 1 insertion(+), 1 deletion(-) >>> >>> diff --git a/common/image-sig.c b/common/image-sig.c >>> index 455f2b9..646fb08 100644 >>> --- a/common/image-sig.c >>> +++ b/common/image-sig.c >>> @@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit, >>> int image_noffset, >>> if (sig_node < 0) { >>> debug("%s: No signature node found: %s\n", __func__, >>> fdt_strerror(sig_node)); >>> - return 0; >>> + return 1; >> >> >> Thanks for finding/fixing this! I suggest returning -EPERM. > > > Ok, changed. > >> Also note that using image-based security is somewhat insecure since >> people can mix and match them. Configuration signing is preferred if >> you can do it. > > > I do this, here my configurations node from the its file: > > configurations { > default = "conf at 1"; > conf at 1 { > description = "board config 1"; > kernel = "kernel at 1"; > fdt = "fdt at 1"; > ramdisk = "ramdisk at 1"; > signature at 1 { > algo = "sha256,rsa4096"; > key-name-hint = "dev"; > }; > }; > }; > >> As Tom said, can you add a test please? > > > Hmm... tried with current U-Boot, the steps described in > > test/image/test-fit.py > > # make O=sandbox sandbox_config > # make O=sandbox > # ./test/image/test-fit.py -u sandbox/u-boot > > and get: > > pollux:u-boot hs [master] $ ./test/image/test-fit.py -u sandbox/u-boot > FIT Tests > ========= [...] > Traceback (most recent call last): > File "./test/image/test-fit.py", line 481, in <module> > run_tests() > File "./test/image/test-fit.py", line 470, in run_tests > run_fit_test(mkimage, options.u_boot) > File "./test/image/test-fit.py", line 388, in run_fit_test > fail('Kernel not loaded', stdout) > File "./test/image/test-fit.py", line 306, in fail > raise ValueError("Test '%s' failed: %s" % (test_name, msg)) > ValueError: Test 'Kernel load' failed: Kernel not loaded > pollux:u-boot hs [master] $ > > Can you verify this? > Yes I see that too. I bisected it and sent a patch. Regards, Simon > Thanks! > > bye, > Heiko > >> >>> } >>> >>> fdt_for_each_subnode(noffset, sig_blob, sig_node) { >>> -- >>> 2.7.4 >>> >> >> Regards, >> Simon >> > > -- > DENX Software Engineering GmbH, Managing Director: Wolfgang Denk > HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2017-08-04 22:20 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2017-06-08 9:52 [U-Boot] [PATCH] common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image Heiko Schocher 2017-06-09 1:06 ` Tom Rini 2017-06-09 3:05 ` Simon Glass 2017-06-09 4:52 ` Heiko Schocher 2017-08-04 22:20 ` Simon Glass
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox