Skip to contentSkip to conversation

common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image

PATCH New Heiko Schocher 3 participants 5 messages Jun 8, 2017 – Aug 4, 2017

lore
Share & tools
lore

Heiko Schocher

author
#0 lore raw

PATCH 1/1 common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image

fit_image_verify_required_sigs() must return != 0, on error.

When fit_image_verify_required_sigs() does not find a signature node, it returns 0, which leads in booting a signed FIT image.

Fix this!

Signed-off-by Heiko Schocher <[email protected]>

---

Found on an imx28 based board, with key dtb appended to u-boot.bin.

Booting signed FIT image without an valid key dtb appended to u-boot.bin shows:

Using FEC1 device
TFTP from server 192.168.1.1; our IP address is 192.168.20.103 Filename '/tftpboot/xxx/20170509/signed.fit'.
Load address: 0x42000000
Loading: ################################################################# [...]

         ###########
         3.3 MiB/s

done
Bytes transferred = 12560801 (bfa9a1 hex)
Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage

     Description:  Linux kernel
     Created:      2017-06-08   9:10:14 UTC
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x420000c0
     Data Size:    4078928 Bytes = 3.9 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x40008000
     Entry Point:  0x40008000
     Hash algo:    sha256
     Hash value:   6d1dce3e08133ac4d34c0e07ce266f5cffc6f5a2713619c9ff76ca4b04df4a5b
     Sign algo:    sha256,rsa4096:dev
     Sign value:   xxx
     Timestamp:    2017-06-08   9:10:15 UTC
   Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Using 'conf at 1' configuration
Trying 'ramdisk at 1' ramdisk subimage

     Description:  miro ramdisk
     Created:      2017-06-08   9:10:14 UTC
     Type:         RAMDisk Image
     Compression:  gzip compressed
     Data Start:   0x423e92b0
     Data Size:    8457506 Bytes = 8.1 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x00000000
     Entry Point:  0x00000000
     Hash algo:    sha256
     Hash value:   da60884efa4373e7003940a56271c326f159ff74356ded28d8ebe108af807cda
     Sign algo:    sha256,rsa4096:dev
     Sign value:   xxx
     Timestamp:    2017-06-08   9:10:15 UTC
   Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   Using 'conf at 1' configuration
   Trying 'fdt at 1' fdt subimage
     Description:  miro device tree
     Created:      2017-06-08   9:10:14 UTC
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x423e41b4
     Data Size:    19852 Bytes = 19.4 KiB
     Architecture: ARM
     Hash algo:    sha256
     Hash value:   9b39c3ab6227bb8f0bcebc0bb64439248a6670dfe873bb1c6536764e0dc1623c
     Sign algo:    sha256,rsa4096:dev
     Sign value:   xxx
     Timestamp:    2017-06-08   9:10:15 UTC
   Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Booting using the fdt blob at 0x423e41b4 Loading Kernel Image ... OK
Loading Ramdisk to 47303000, end 47b13d22 ... OK Loading Device Tree to 472fb000, end 47302d8b ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.11.0 (hs at hercules.denx.de) (gcc version 6.2.0 (GCC) ) #1 Tue May 16 07:31:30 CEST 2017

[...]

And linux boots ... which is bad, as we have no valid key appended to u-boot.bin ...

With this patch it shows:

Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage

     Description:  Linux kernel
     Created:      2017-06-08   9:34:28 UTC
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x420000c0
     Data Size:    4078928 Bytes = 3.9 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x40008000
     Entry Point:  0x40008000
     Hash algo:    sha256
     Hash value:   6d1dce3e08133ac4d34c0e07ce266f5cffc6f5a2713619c9ff76ca4b04df4a5b
     Sign algo:    sha256,rsa4096:dev
     Sign value:   xxx
     Timestamp:    2017-06-08   9:34:29 UTC

Verifying Hash Integrity ... error!
Unable to verify required signature for '' hash node in 'kernel at 1' image node Bad Data Hash
ERROR: can't get kernel image!
=>

 common/image-sig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
common/image-sig.c +1 -1
index 455f2b9..646fb08 100644
@@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
 	if (sig_node < 0) {
 		debug("%s: No signature node found: %s\n", __func__,
 		      fdt_strerror(sig_node));
-		return 0;
+		return 1;
 	}
 
 	fdt_for_each_subnode(noffset, sig_blob, sig_node) {
Signature · 1 line
2.7.4
#1 lore raw

PATCH 1/1 common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image

Quoted 8 lines · Heiko Schocher

fit_image_verify_required_sigs() must return != 0, on error.

When fit_image_verify_required_sigs() does not find a signature node, it returns 0, which leads in booting a signed FIT image.

Fix this!

Signed-off-by Heiko Schocher <[email protected]>

Good catch. Did you confirm that the sandbox tests still work? And can you construct a new test for this case? Thanks!

Signature · 8 lines
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170608/9bccc5d7/attachment.sig>
#2 lore raw

PATCH 1/1 common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image

In reply to Heiko Schocher

Hi Heiko,

Quoted 130 lines · Heiko Schocher

fit_image_verify_required_sigs() must return != 0, on error.

When fit_image_verify_required_sigs() does not find a signature node, it returns 0, which leads in booting a signed FIT image.

Fix this!

Signed-off-by Heiko Schocher <[email protected]>

---

Found on an imx28 based board, with key dtb appended to u-boot.bin.

Booting signed FIT image without an valid key dtb appended to u-boot.bin shows:

Using FEC1 device
TFTP from server 192.168.1.1; our IP address is 192.168.20.103 Filename '/tftpboot/xxx/20170509/signed.fit'.
Load address: 0x42000000
Loading: ################################################################# [...]

         ###########
         3.3 MiB/s

done
Bytes transferred = 12560801 (bfa9a1 hex)
Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage

     Description:  Linux kernel
     Created:      2017-06-08   9:10:14 UTC
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x420000c0
     Data Size:    4078928 Bytes = 3.9 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x40008000
     Entry Point:  0x40008000
     Hash algo:    sha256
     Hash value:   6d1dce3e08133ac4d34c0e07ce266f5cffc6f5a2713619c9ff76ca4b04df4a5b
     Sign algo:    sha256,rsa4096:dev
     Sign value:   xxx
     Timestamp:    2017-06-08   9:10:15 UTC
   Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   Using 'conf at 1' configuration
   Trying 'ramdisk at 1' ramdisk subimage
     Description:  miro ramdisk
     Created:      2017-06-08   9:10:14 UTC
     Type:         RAMDisk Image
     Compression:  gzip compressed
     Data Start:   0x423e92b0
     Data Size:    8457506 Bytes = 8.1 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x00000000
     Entry Point:  0x00000000
     Hash algo:    sha256
     Hash value:   da60884efa4373e7003940a56271c326f159ff74356ded28d8ebe108af807cda
     Sign algo:    sha256,rsa4096:dev
     Sign value:   xxx
     Timestamp:    2017-06-08   9:10:15 UTC
   Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   Using 'conf at 1' configuration
   Trying 'fdt at 1' fdt subimage
     Description:  miro device tree
     Created:      2017-06-08   9:10:14 UTC
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x423e41b4
     Data Size:    19852 Bytes = 19.4 KiB
     Architecture: ARM
     Hash algo:    sha256
     Hash value:   9b39c3ab6227bb8f0bcebc0bb64439248a6670dfe873bb1c6536764e0dc1623c
     Sign algo:    sha256,rsa4096:dev
     Sign value:   xxx
     Timestamp:    2017-06-08   9:10:15 UTC
   Verifying Hash Integrity ... sha256+ sha256,rsa4096:dev- OK
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   Booting using the fdt blob at 0x423e41b4
   Loading Kernel Image ... OK
   Loading Ramdisk to 47303000, end 47b13d22 ... OK
   Loading Device Tree to 472fb000, end 47302d8b ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.11.0 (hs at hercules.denx.de) (gcc version 6.2.0 (GCC) ) #1 Tue May 16 07:31:30 CEST 2017

[...]

And linux boots ... which is bad, as we have no valid key appended to u-boot.bin ...

With this patch it shows:

Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage

     Description:  Linux kernel
     Created:      2017-06-08   9:34:28 UTC
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x420000c0
     Data Size:    4078928 Bytes = 3.9 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x40008000
     Entry Point:  0x40008000
     Hash algo:    sha256
     Hash value:   6d1dce3e08133ac4d34c0e07ce266f5cffc6f5a2713619c9ff76ca4b04df4a5b
     Sign algo:    sha256,rsa4096:dev
     Sign value:   xxx
     Timestamp:    2017-06-08   9:34:29 UTC

Verifying Hash Integrity ... error!
Unable to verify required signature for '' hash node in 'kernel at 1' image node Bad Data Hash
ERROR: can't get kernel image!
=>

 common/image-sig.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
common/image-sig.c +0 -0
index 455f2b9..646fb08 100644

common/image-sig.c int fit_image_verify_required_sigs(const void *fit, int image_noffset, · line 268

Quoted 5 lines
common/image-sig.c +1 -1
@@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
        if (sig_node < 0) {
                debug("%s: No signature node found: %s\n", __func__,
                      fdt_strerror(sig_node));
-               return 0;
+               return 1;

Thanks for finding/fixing this! I suggest returning -EPERM.

Also note that using image-based security is somewhat insecure since people can mix and match them. Configuration signing is preferred if you can do it.

As Tom said, can you add a test please?

Quoted 6 lines
common/image-sig.c +0 -1
        }
 
        fdt_for_each_subnode(noffset, sig_blob, sig_node) {
--

2.7.4

Regards,
Simon

author
#3 lore raw

PATCH 1/1 common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image

Hello Simon,

Am 09.06.2017 um 05:05 schrieb Simon Glass:

Quoted 17 lines

Hi Heiko,

Quoted 14 lines · Heiko Schocher

fit_image_verify_required_sigs() must return != 0, on error.

When fit_image_verify_required_sigs() does not find a signature node, it returns 0, which leads in booting a signed FIT image.

Fix this!

Signed-off-by Heiko Schocher <[email protected]>

---

Found on an imx28 based board, with key dtb appended to u-boot.bin.

Booting signed FIT image without an valid key dtb appended to u-boot.bin shows:

[...]

Quoted 15 lines

common/image-sig.c int fit_image_verify_required_sigs(const void *fit, int image_noffset, · line 268

Quoted 13 lines
  common/image-sig.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
common/image-sig.c +1 -1
index 455f2b9..646fb08 100644
@@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
         if (sig_node < 0) {
                 debug("%s: No signature node found: %s\n", __func__,
                       fdt_strerror(sig_node));
-               return 0;
+               return 1;

Thanks for finding/fixing this! I suggest returning -EPERM.

Ok, changed.

Quoted 3 lines

Also note that using image-based security is somewhat insecure since people can mix and match them. Configuration signing is preferred if you can do it.

I do this, here my configurations node from the its file:

         configurations {
                 default = "conf at 1";
                 conf at 1 {
                         description = "board config 1";
                         kernel = "kernel at 1";
                         fdt = "fdt at 1";
                         ramdisk = "ramdisk at 1";
                         signature at 1 {
                                 algo = "sha256,rsa4096";
                                 key-name-hint = "dev";
                         };
                 };
         };
Quoted 1 line

As Tom said, can you add a test please?

Hmm... tried with current U-Boot, the steps described in

test/image/test-fit.py

# make O=sandbox sandbox_config
# make O=sandbox
# ./test/image/test-fit.py -u sandbox/u-boot

and get:

pollux:u-boot hs [master] $ ./test/image/test-fit.py -u sandbox/u-boot
FIT Tests
=========
Warning (unit_address_vs_reg): Node /reset at 0 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/kernel at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/kernel at 2 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/fdt at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/fdt at 1/signature at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/ramdisk at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/ramdisk at 2 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /configurations/conf at 1 has a unit name, but no reg property Kernel load

U-Boot 2017.07-rc1-00997-gad701b1 (Jun 09 2017 - 06:18:46 +0200)

DRAM: 128 MiB
MMC:
Using default environment

In:    serial
Out:   serial
Err:   serial
SCSI:  Net:   No ethernet found.
IDE:   Bus 0: not available

18474 bytes read in 0 ms
## Loading kernel from FIT Image at 00001000 ...
Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage
Description: unavailable
Created: 2017-06-09 4:19:13 UTC
Type: Kernel Image
Compression: uncompressed
Data Start: 0x000010c8
Data Size: 3491 Bytes = 3.4 KiB
Architecture: Sandbox
OS: Linux
Load Address: 0x00040000
Entry Point: 0x00000008
Verifying Hash Integrity ... OK
## Loading fdt from FIT Image at 00001000 ...
Using 'conf at 1' configuration
Trying 'fdt at 1' fdt subimage
Description: snow
Created: 2017-06-09 4:19:13 UTC
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x00002d30
Data Size: 193 Bytes = 193 Bytes
Architecture: Sandbox
Sign algo: sha1,rsa2048:dev
Sign value: unavailable
Timestamp: unavailable
Verifying Hash Integrity ... sha1,rsa2048:dev- OK Booting using the fdt blob at 0x002d30 Loading Kernel Image ... OK
3491 bytes written in 0 ms
193 bytes written in 0 ms
4591 bytes written in 0 ms
3491 bytes written in 0 ms
4591 bytes written in 0 ms

Expected '%s' but not found in output:

U-Boot 2017.07-rc1-00997-gad701b1 (Jun 09 2017 - 06:18:46 +0200)

DRAM: 128 MiB
MMC:
Using default environment

In:    serial
Out:   serial
Err:   serial
SCSI:  Net:   No ethernet found.
IDE:   Bus 0: not available

18474 bytes read in 0 ms
## Loading kernel from FIT Image at 00001000 ...
Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage
Description: unavailable
Created: 2017-06-09 4:19:13 UTC
Type: Kernel Image
Compression: uncompressed
Data Start: 0x000010c8
Data Size: 3491 Bytes = 3.4 KiB
Architecture: Sandbox
OS: Linux
Load Address: 0x00040000
Entry Point: 0x00000008
Verifying Hash Integrity ... OK
## Loading fdt from FIT Image at 00001000 ...
Using 'conf at 1' configuration
Trying 'fdt at 1' fdt subimage
Description: snow
Created: 2017-06-09 4:19:13 UTC
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x00002d30
Data Size: 193 Bytes = 193 Bytes
Architecture: Sandbox
Sign algo: sha1,rsa2048:dev
Sign value: unavailable
Timestamp: unavailable
Verifying Hash Integrity ... sha1,rsa2048:dev- OK Booting using the fdt blob at 0x002d30 Loading Kernel Image ... OK
3491 bytes written in 0 ms
193 bytes written in 0 ms
4591 bytes written in 0 ms
3491 bytes written in 0 ms
4591 bytes written in 0 ms

Traceback (most recent call last):
File "./test/image/test-fit.py", line 481, in <module>

     run_tests()

File "./test/image/test-fit.py", line 470, in run_tests
run_fit_test(mkimage, options.u_boot)
File "./test/image/test-fit.py", line 395, in run_fit_test
line = find_matching(stdout, 'Booting using the FDT blob at ')
File "./test/image/test-fit.py", line 286, in find_matching
raise ValueError('Test aborted')
ValueError: Test aborted

:-(

With my patch:
pollux:u-boot hs [master] $ git diff

common/image-sig.c +1 -1
index 455f2b9..e5ba85a 100644
@@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit, int image_noffset,
         if (sig_node < 0) {
                 debug("%s: No signature node found: %s\n", __func__,
                       fdt_strerror(sig_node));
-               return 0;
+               return -EPERM;
         }
 
         fdt_for_each_subnode(noffset, sig_blob, sig_node) {

pollux:u-boot hs [master] $ ./test/image/test-fit.py -u sandbox/u-boot
FIT Tests
=========
Warning (unit_address_vs_reg): Node /reset at 0 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/kernel at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/kernel at 2 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/fdt at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/fdt at 1/signature at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/ramdisk at 1 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /images/ramdisk at 2 has a unit name, but no reg property Warning (unit_address_vs_reg): Node /configurations/conf at 1 has a unit name, but no reg property Kernel load

U-Boot 2017.07-rc1-00997-gad701b1-dirty (Jun 09 2017 - 06:21:36 +0200)

DRAM: 128 MiB
MMC:
Using default environment

In:    serial
Out:   serial
Err:   serial
SCSI:  Net:   No ethernet found.
IDE:   Bus 0: not available

18474 bytes read in 1 ms (17.6 MiB/s)
## Loading kernel from FIT Image at 00001000 ...
Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage
Description: unavailable
Created: 2017-06-09 4:22:07 UTC
Type: Kernel Image
Compression: uncompressed
Data Start: 0x000010c8
Data Size: 3491 Bytes = 3.4 KiB
Architecture: Sandbox
OS: Linux
Load Address: 0x00040000
Entry Point: 0x00000008
Verifying Hash Integrity ... error!
Unable to verify required signature for '' hash node in 'kernel at 1' image node Bad Data Hash
ERROR: can't get kernel image!
XIP Invalid Image ... OK
3491 bytes written in 0 ms
193 bytes written in 0 ms
4591 bytes written in 0 ms
3491 bytes written in 0 ms
4591 bytes written in 0 ms

U-Boot 2017.07-rc1-00997-gad701b1-dirty (Jun 09 2017 - 06:21:36 +0200)

DRAM: 128 MiB
MMC:
Using default environment

In:    serial
Out:   serial
Err:   serial
SCSI:  Net:   No ethernet found.
IDE:   Bus 0: not available

18474 bytes read in 1 ms (17.6 MiB/s)
## Loading kernel from FIT Image at 00001000 ...
Using 'conf at 1' configuration
Verifying Hash Integrity ... OK
Trying 'kernel at 1' kernel subimage
Description: unavailable
Created: 2017-06-09 4:22:07 UTC
Type: Kernel Image
Compression: uncompressed
Data Start: 0x000010c8
Data Size: 3491 Bytes = 3.4 KiB
Architecture: Sandbox
OS: Linux
Load Address: 0x00040000
Entry Point: 0x00000008
Verifying Hash Integrity ... error!
Unable to verify required signature for '' hash node in 'kernel@1' image node Bad Data Hash
ERROR: can't get kernel image!
XIP Invalid Image ... OK
3491 bytes written in 0 ms
193 bytes written in 0 ms
4591 bytes written in 0 ms
3491 bytes written in 0 ms
4591 bytes written in 0 ms

Traceback (most recent call last):
File "./test/image/test-fit.py", line 481, in <module>

     run_tests()

File "./test/image/test-fit.py", line 470, in run_tests
run_fit_test(mkimage, options.u_boot)
File "./test/image/test-fit.py", line 388, in run_fit_test
fail('Kernel not loaded', stdout)
File "./test/image/test-fit.py", line 306, in fail
raise ValueError("Test '%s' failed: %s" % (test_name, msg))
ValueError: Test 'Kernel load' failed: Kernel not loaded pollux:u-boot hs [master] $

Can you verify this?

Thanks!

bye,
Heiko

Quoted 11 lines
Quoted 7 lines
common/image-sig.c +0 -1
         }
 
         fdt_for_each_subnode(noffset, sig_blob, sig_node) {
--

2.7.4

Regards,
Simon

Signature · 2 lines
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
#4 lore raw

PATCH 1/1 common, image-sig: [BUG?] if no valid signature node found, do not boot signed FIT image

Hi Heiko,

Quoted 83 lines · Heiko Schocher

Hello Simon,

Am 09.06.2017 um 05:05 schrieb Simon Glass:

Quoted 19 lines

Hi Heiko,

Quoted 15 lines · Heiko Schocher

fit_image_verify_required_sigs() must return != 0, on error.

When fit_image_verify_required_sigs() does not find a signature node, it returns 0, which leads in booting a signed FIT image.

Fix this!

Signed-off-by Heiko Schocher <[email protected]>

---

Found on an imx28 based board, with key dtb appended to u-boot.bin.

Booting signed FIT image without an valid key dtb appended to u-boot.bin shows:

[...]

Quoted 4 lines
Quoted 4 lines
  common/image-sig.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
Quoted 14 lines

common/image-sig.c int fit_image_verify_required_sigs(const void *fit, · line 269

Quoted 11 lines
common/image-sig.c +1 -1
index 455f2b9..646fb08 100644
@@ -265,7 +265,7 @@ int fit_image_verify_required_sigs(const void *fit,
 int image_noffset,
         if (sig_node < 0) {
                 debug("%s: No signature node found: %s\n", __func__,
                       fdt_strerror(sig_node));
-               return 0;
+               return 1;

Thanks for finding/fixing this! I suggest returning -EPERM.

Ok, changed.

Quoted 3 lines

Also note that using image-based security is somewhat insecure since people can mix and match them. Configuration signing is preferred if you can do it.

I do this, here my configurations node from the its file:

        configurations {
                default = "conf at 1";
                conf at 1 {
                        description = "board config 1";
                        kernel = "kernel at 1";
                        fdt = "fdt at 1";
                        ramdisk = "ramdisk at 1";
                        signature at 1 {
                                algo = "sha256,rsa4096";
                                key-name-hint = "dev";
                        };
                };
        };
Quoted 1 line

As Tom said, can you add a test please?

Hmm... tried with current U-Boot, the steps described in

test/image/test-fit.py

# make O=sandbox sandbox_config
# make O=sandbox
# ./test/image/test-fit.py -u sandbox/u-boot

and get:

pollux:u-boot hs [master] $ ./test/image/test-fit.py -u sandbox/u-boot FIT Tests
=========

[...]

Quoted 12 lines

Traceback (most recent call last):
File "./test/image/test-fit.py", line 481, in <module>

    run_tests()

File "./test/image/test-fit.py", line 470, in run_tests
run_fit_test(mkimage, options.u_boot)
File "./test/image/test-fit.py", line 388, in run_fit_test
fail('Kernel not loaded', stdout)
File "./test/image/test-fit.py", line 306, in fail
raise ValueError("Test '%s' failed: %s" % (test_name, msg))
ValueError: Test 'Kernel load' failed: Kernel not loaded pollux:u-boot hs [master] $

Quoted 2 lines

Can you verify this?

Yes I see that too. I bisected it and sent a patch.

Regards,
Simon

Quoted 20 lines

Thanks!

bye,
Heiko

Quoted 11 lines
Quoted 7 lines
         }

         fdt_for_each_subnode(noffset, sig_blob, sig_node) {

--
2.7.4

Regards,
Simon

--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany