Skip to content

Commit 1c477bd

Browse files
marioicastalmarioicastal
committed
[MICRSE-3703] Create build_pkcs11_uri routine for the pkcs11 string and Support for NOCAK Fast Authentication
Signed-off-by: Mario Castaneda <mario.ignacio.castaneda.lopez@nxp.com>
1 parent 2c5a694 commit 1c477bd

1 file changed

Lines changed: 115 additions & 95 deletions

File tree

‎src/imx_signer.c‎

Lines changed: 115 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
#include <fdt.h>
1313

1414
#define RSIZE 256
15+
#define PKCS11_URI_BUFFER_SIZE 511
1516

1617
uint32_t g_image_offset = 0;
1718
unsigned long g_ivt_off_cve = 0x0;
@@ -425,6 +426,96 @@ static int detect_pkcs11_config(const char *config_value) {
425426
return flags;
426427
}
427428

429+
/*
430+
* @brief Build PKCS11 URI string from configuration value
431+
*
432+
* @param[in] rvalue : Configuration value string containing PKCS11 parameters
433+
*
434+
* @retval pkcs11_uri : Complete PKCS11 URI string, or NULL on failure
435+
* Caller is responsible for freeing the returned string
436+
*/
437+
static char *build_pkcs11_uri(const char *rvalue) {
438+
ASSERT(rvalue, NULL);
439+
440+
char *pkcs11_uri = NULL; /* PKCS11 URI string buffer */
441+
char *env_result = NULL; /* Env result for Token*/
442+
char *config_object = NULL; /* Configuration object identifier */
443+
char *pkcs11_token_pin = NULL; /* Token or Pin values*/
444+
445+
/* Allocate buffer for the complete PKCS11 URI */
446+
pkcs11_uri = calloc(PKCS11_URI_BUFFER_SIZE+1, sizeof(char));
447+
if (NULL == pkcs11_uri) {
448+
DEBUG("ERROR: Error allocating memory for PKCS11 URI\n");
449+
return NULL;
450+
}
451+
452+
/* Check if configuration is complete */
453+
g_pkcs11_token = detect_pkcs11_config(rvalue); /* Set global flag*/
454+
if ( g_pkcs11_token != COMPLETE_CONF) {
455+
DEBUG("ERROR: Invalid PKCS11 configuration \n");
456+
goto err;
457+
}
458+
459+
/* Start building the PKCS11 URI */
460+
strncpy(pkcs11_uri, "\"pkcs11:token=", 15);
461+
462+
/* Extract and process token configuration */
463+
env_result = extract_config_value(rvalue);
464+
if (env_result != NULL) {
465+
pkcs11_token_pin = getenv(env_result);
466+
if (pkcs11_token_pin != NULL) {
467+
DEBUG("Token env variable PKCS11_Token: %s\n", pkcs11_token_pin);
468+
strncat(pkcs11_uri, pkcs11_token_pin, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
469+
} else
470+
strncat(pkcs11_uri, env_result, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
471+
} else
472+
goto err;
473+
474+
/* Extract and add object configuration */
475+
config_object = extract_config_value(strchr(rvalue, ';'));
476+
if (config_object != NULL) {
477+
strncat(pkcs11_uri, ";object=", PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
478+
strncat(pkcs11_uri, config_object, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
479+
} else
480+
goto err;
481+
482+
pkcs11_token_pin = NULL;
483+
env_result = NULL;
484+
485+
/* Add type=cert */
486+
strncat(pkcs11_uri, ";type=cert", PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
487+
488+
/* Extract and add PIN configuration */
489+
env_result = extract_config_value(strrchr(rvalue, ';'));
490+
if (env_result != NULL) {
491+
pkcs11_token_pin = getenv(env_result);
492+
DEBUG("USR_PIN environment variable %s and %s\n", env_result, pkcs11_token_pin);
493+
strncat(pkcs11_uri, ";pin-value=", PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
494+
if (pkcs11_token_pin != NULL)
495+
strncat(pkcs11_uri, pkcs11_token_pin, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
496+
else
497+
strncat(pkcs11_uri, env_result, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
498+
FREE(env_result);
499+
} else
500+
goto err;
501+
502+
/* Close the URI string */
503+
strncat(pkcs11_uri, "\"", PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
504+
505+
FREE(pkcs11_token_pin);
506+
FREE(config_object);
507+
FREE(env_result);
508+
FREE(pkcs11_uri);
509+
510+
return pkcs11_uri;
511+
512+
err:
513+
FREE(pkcs11_token_pin);
514+
FREE(config_object);
515+
FREE(env_result);
516+
FREE(pkcs11_uri);
517+
return NULL;
518+
}
428519
/*
429520
* @brief Create CSF source file for IVT type v1
430521
*
@@ -513,7 +604,15 @@ static int create_csf_file_v1(image_block_t *blocks, int idx, char *ofname)
513604
fast_auth = true;
514605
/* Install NOCAK */
515606
fprintf(fp_csf_file, "[Install NOCAK]\n");
516-
fprintf(fp_csf_file, "\tFile = \"%s/crts/%s\"\n", g_sig_tool_path, rvalue);
607+
if (!strncmp (&rvalue[0], "pkcs11",6)) { /* PKCS11 Based Signing */
608+
char *pkcs11_uri = build_pkcs11_uri(rvalue);
609+
if (pkcs11_uri != NULL) {
610+
fprintf(fp_csf_file, "\tFile = %s\n", pkcs11_uri);
611+
FREE(pkcs11_uri);
612+
} else
613+
return -E_FAILURE;
614+
} else
615+
fprintf(fp_csf_file, "\tFile = \"%s/crts/%s\"\n", g_sig_tool_path, rvalue);
517616
} else {
518617
/* Prepare normal authentication parameters */
519618
/* Install CSFK */
@@ -522,48 +621,13 @@ static int create_csf_file_v1(image_block_t *blocks, int idx, char *ofname)
522621
if ('\0' == rvalue[0])
523622
fprintf(fp_csf_file, "\tFile = \"%s/crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem\"\n", g_sig_tool_path);
524623
else if (!strncmp (&rvalue[0], "pkcs11",6)) { /* PKCS11 Based Signing */
525-
fprintf(fp_csf_file, "\tFile = ");
526-
g_pkcs11_token = detect_pkcs11_config(&rvalue[0]);
527-
/* Prepare Token and USR PIN Parameters */
528-
if ( g_pkcs11_token == COMPLETE_CONF) {
529-
char *env_result_csfk = extract_config_value(rvalue);
530-
if (env_result_csfk != NULL) {
531-
char *pkcs11_token = getenv(&env_result_csfk[0]);
532-
if (pkcs11_token != NULL){
533-
DEBUG("Token env variable pkcs11_token : %s\n", pkcs11_token);
534-
fprintf(fp_csf_file, "\"pkcs11:token=%s;",pkcs11_token);
535-
}
536-
else
537-
fprintf(fp_csf_file, "\"pkcs11:token=%s;",env_result_csfk);
538-
} else
539-
return -E_FAILURE;
540-
FREE(env_result_csfk);
541-
542-
// Looking for object config value
543-
char *config_object = extract_config_value(strchr(rvalue, ';'));
544-
fprintf(fp_csf_file, "object=%s;",config_object);
545-
FREE(config_object);
546-
547-
// Adding Type = Cert
548-
fprintf(fp_csf_file, "type=cert;");
549-
550-
// Looking for USR_PIN environment variable
551-
char *env_result = extract_config_value(strrchr(rvalue,';'));
552-
char *pkcs11_pin = getenv(env_result);
553-
DEBUG("USR_PIN environment variable %senv_result and %s \n", env_result,pkcs11_pin);
554-
555-
if (pkcs11_pin != NULL)
556-
fprintf(fp_csf_file, "pin-value=%s",pkcs11_pin);
557-
else
558-
fprintf(fp_csf_file, "pin-value=%s",env_result);
559-
FREE(env_result);
560-
} else {
561-
fprintf(stderr, "ERROR: Invalid PKCS11 configuration\n");
624+
char *pkcs11_uri = build_pkcs11_uri(rvalue);
625+
if (pkcs11_uri != NULL) {
626+
fprintf(fp_csf_file, "\tFile = %s\n", pkcs11_uri);
627+
FREE(pkcs11_uri);
628+
} else
562629
return -E_FAILURE;
563-
}
564-
fprintf(fp_csf_file, "\"\n");
565-
}
566-
else /* File Based Signing */
630+
} else /* File Based Signing */
567631
fprintf(fp_csf_file, "\tFile = \"%s/crts/%s\"\n", g_sig_tool_path, rvalue);
568632
}
569633

@@ -667,59 +731,15 @@ static int create_csf_file_v1(image_block_t *blocks, int idx, char *ofname)
667731
cfg_parser(fp_cfg, rvalue, RSIZE, "img_file");
668732
if ('\0' == rvalue[0])
669733
fprintf(fp_csf_file, "\tFile = \"%s/crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem\"\n", g_sig_tool_path);
670-
else {
671-
/* Search PCKS11 String*/
672-
g_pkcs11_token = 0;
673-
for (int i = 0; rvalue[i] != '\0' ; i++) {
674-
if (!strncmp(&rvalue[i], "pkcs11", 6)) {
675-
g_pkcs11_token |= PCKS11_ENV;
676-
break;
677-
}
678-
}
679-
/* File Based Signing */
680-
fprintf(fp_csf_file, "\tFile = ");
681-
if (!g_pkcs11_token)
682-
fprintf(fp_csf_file, "\"%s/crts/%s", g_sig_data_path, rvalue);
683-
/* PKCS11 Based Signing */
684-
else {
685-
g_pkcs11_token |= detect_pkcs11_config(&rvalue[6]);
686-
/* Prepare Token and USR PIN Parameters */
687-
if ( g_pkcs11_token == COMPLETE_CONF) {
688-
char *env_result_img = extract_config_value(rvalue);
689-
if (env_result_img != NULL) {
690-
char *pkcs11_token = getenv(env_result_img);
691-
if (pkcs11_token != NULL){
692-
fprintf(fp_csf_file, "\"pkcs11:token=%s;",pkcs11_token);
693-
}
694-
else
695-
fprintf(fp_csf_file, "\"pkcs11:token=%s;",env_result_img);
696-
} else
697-
return -E_FAILURE;
698-
FREE(env_result_img);
699-
700-
// Looking for object config value
701-
char *config_object = extract_config_value(strchr(rvalue, ';'));
702-
fprintf(fp_csf_file, "object=%s;",config_object);
703-
FREE(config_object);
704-
705-
// Adding Type = Cert
706-
fprintf(fp_csf_file, "type=cert;");
707-
708-
// Looking for USR_PIN environment variable
709-
char *env_result = extract_config_value(strrchr(rvalue,';'));
710-
char *pkcs11_pin = getenv(env_result);
711-
if (pkcs11_pin != NULL)
712-
fprintf(fp_csf_file, "pin-value=%s",pkcs11_pin);
713-
else
714-
fprintf(fp_csf_file, "pin-value=%s",env_result);
715-
FREE(env_result);
716-
} else {
717-
fprintf(stderr, "ERROR: Invalid PKCS11 configuration\n");
718-
return -E_FAILURE;
719-
}
720-
}
721-
fprintf(fp_csf_file, "\"\n");
722-
}
734+
else if (!strncmp (&rvalue[0], "pkcs11",6)) { /* PKCS11 Based Signing */
735+
char *pkcs11_uri = build_pkcs11_uri(rvalue);
736+
if (pkcs11_uri != NULL) {
737+
fprintf(fp_csf_file, "\tFile = %s\n", pkcs11_uri);
738+
FREE(pkcs11_uri);
739+
} else
740+
return -E_FAILURE;
741+
} else /* File Based Signing */
742+
fprintf(fp_csf_file, "\tFile = \"%s/crts/%s\"\n", g_sig_tool_path, rvalue);
723743
}
724744

725745
/* Authenticate Data */

0 commit comments

Comments
 (0)