Pull request #5: Feature/MICRSE-3703 imx signer add pkcs11 backend for cst hab and spsdk ahab

Merge in IMXS/cst-signer from feature/MICRSE-3703-imx-signer-add-pkcs11-backend-for-cst-hab-and-spsdk-ahab to master

* commit '1c477bda6e2625cae88832212a2457868002b6cb':
  [MICRSE-3703] Create build_pkcs11_uri routine for the pkcs11 string and Support for NOCAK Fast Authentication
  Applying Suggestion, env_result, replacing conditions about the pkcs11 token
  Applying suggestion. The parse method is looking for an extact string.
  Fix format and adding .gitignore
  [MICRSE-3703] Updating Pull Request Requirements
  MICRSE-3703: PCKS11 Support for HAB, with/wihtout token and usr pin definition
  PCKS11 Implementation withe img file.
  PKCS11 Support for CSF Complete TODO: Working to create a function that implements this routine
  PCKS11 Implementation defining token in the csf file
  PKCS11 Token support. 	- CSF config file is looking for the token in the csfk_file and img_file 	- Adding -b pkcs11 extra param 	- TODO Implement a new strncpy and avoid overwrite --verbose command
  Adding verify routing if there is a Interact Token for the image0

Author: marioicastal

.gitignore

@@ -0,0 +1,7 @@
+# Compiled object files
+src/cst_signer
+*.bin
+*.o
+*.obj
+*.out
+

README.md

@@ -65,15 +65,28 @@ YAML config file filled with appropriate values based on the setup.
 To help start the signing process, sample CSF/YAML configuration files have 
 been provided as part of this package.
 
-CFG file supporting HAB images: *csf_hab4.cfg.sample*
-CFG file supporting AHAB images: *csf_ahab.cfg.sample*, *spsdk_ahab.cfg.sample*
+- **CFG file supporting HAB images:** *csf_hab4.cfg.sample* or *csf_hab4_pkcs11.cfg.sample* for PKCS#11 Support
+- **CFG file supporting AHAB images:** *csf_ahab.cfg.sample*, *spsdk_ahab.cfg.sample*
+
+**_NOTE_**: Be sure the PKCS#11 support is enabled and Token and USR_PIN environmental variables are defined.
 
 Invoke the *imx_signer* executable as follows (example):
-CST Example: `SIG_TOOL_PATH=<cst> SIG_DATA_PATH=<keys/crts folder> ./imx_signer -i flash.bin -c csf.cfg`
-SPSDK Example: `SIG_TOOL_PATH=<spsdk> SIG_DATA_PATH=<keys/crts folder> ./imx_signer -i flash.bin -c spsdk.cfg`
+```sh
+# CST Example: 
+$ SIG_TOOL_PATH=<cst> SIG_DATA_PATH=<keys/crts folder> ./imx_signer -i flash.bin -c csf.cfg
+# SPSDK Example:
+$ SIG_TOOL_PATH=<spsdk> SIG_DATA_PATH=<keys/crts folder> ./imx_signer -i flash.bin -c spsdk.cfg
+```
 
----
+### PKCS#11 Support HAB
+For PKCS#11-based signing with Hardware Security Modules (HSMs), configure your CSF file using the **exact format**:
+```sh
+csfk_file=pkcs11:token=${PKCS-TOKEN};object=CSF1_1_sha256_2048_65537_v3_usr;type=cert;pin-value=${USR_PIN}
+img_file=pkcs11:token=${PKCS-TOKEN};object=IMG1_1_sha256_2048_65537_v3_usr;type=cert;pin-value=${USR_PIN}
+```
+**_NOTE_**: Be sure the PKCS#11 support is enabled and Token and USR_PIN environmental variables are defined.
 
+---
 ### Results
 
 This tool generates final signed binary as "**signed-\<input_filename\>**". In 

csf_hab4_pkcs11.cfg.sample

@@ -0,0 +1,21 @@
+#Header
+header_version=4.3
+header_eng=ANY
+header_eng_config=0
+#Install SRK
+srktable_file=SRK_1_2_3_4_table_8mini.bin
+srk_source_index=0
+#Install NOCAK
+nocak_file=
+#Install CSFK
+csfk_file=pkcs11:token=${PKCS-DEMO};object=CSF1_1_sha256_2048_65537_v3_usr;type=cert;pin-value=${USR_PIN}
+#Unlock
+unlock_engine=
+unlock_features=
+unlock_uid=
+#Install Key
+img_verification_index=0
+img_target_index=2
+img_file=pkcs11:token=${PKCS-DEMO};object=IMG1_1_sha256_2048_65537_v3_usr;type=cert;pin-value=${USR_PIN}
+#Authenticate Data
+auth_verification_index=2

inc/imx_signer.h

@@ -102,6 +102,15 @@ typedef enum SOC_TYPE {
     ULP,
 } soc_type_t;
 
+typedef enum PKCS_TOKEN {
+    PCKS11_ENV = 1,
+    TOKEN_EN = 2,
+    OBJ_TYPE = 4,
+    TYPE_CERT = 8,
+    USRPIN = 16,
+    COMPLETE_CONF = 31,
+} pkcs11token_type_t;
+
 #define E_OK 0
 #define E_FAILURE 1
 

src/imx_signer.c

@@ -12,11 +12,13 @@
 #include <fdt.h>
 
 #define RSIZE   256
+#define PKCS11_URI_BUFFER_SIZE 511
 
 uint32_t g_image_offset = 0;
 unsigned long g_ivt_off_cve = 0x0;
 unsigned long g_ivt_search_step = 0;
 int g_last_img_idx = 0;
+int g_pkcs11_token = 0;
 
 typedef struct {
     int cntr_num;
@@ -264,13 +266,16 @@ int sign_csf(char *cfgname, char *ofname)
     ASSERT(ofname, -1);
 
     char sys_cmd[SYS_CMD_LEN] = {0};
-    char cst_extra_param[10] = {0};
+    char cst_extra_param[20] = {0};
 
     /* Add debug info to the tool output */
     if (g_debug) {
         strncpy(cst_extra_param, "--verbose", 10);
     }
-
+    /* Add -b pcks11 command*/
+    if(g_pkcs11_token) {
+        strncpy(cst_extra_param, "-b pkcs11", 10);
+    }
     /* Find if tool exists and capture path */
     if (!find_cst_tool(&sys_cmd[0])) {
         if (0 > (snprintf(sys_cmd + strlen(sys_cmd), (SYS_CMD_LEN - strlen(sys_cmd)), " %s --i %s --o %s", cst_extra_param, cfgname, ofname))) {
@@ -357,7 +362,160 @@ int copy_files(char *ifname, char *ofname)
     FCLOSE(fp_ofname);
     return -E_FAILURE;
 }
+/*
+ * @brief       Extract config value from a string with environment variable handling
+ *
+ * @param[in]   rvalue        : Configuration value string
+ *
+ * @retval      config_value  : Extracted config value with env variable resolved
+ */
+static char *extract_config_value(const char *rvalue)
+{
+    char *search_equal = strchr(rvalue, '=');
+    char *config_value = malloc(100);
+    int skip = 0;
+
+    if (search_equal == NULL || config_value == NULL ) {
+        DEBUG("Search Token Error\n");
+        DEBUG("Memory allocation failed\n");
+        return NULL;
+    }
+
+    strncpy(&config_value[0],&search_equal[1],99);
+    config_value[99]='\0';
+    strtok(config_value, ";");
+    if (config_value == NULL) {
+        FREE(config_value);
+        return NULL;
+    }
+
+    char *source = &config_value[0];
+    if (*source == '$') {
+        skip++;
+        if (source[1] == '{') {
+            skip++;
+        }
+    }
+    strncpy(&config_value[0], source + skip,99);
+    config_value[99]='\0';
+    strtok(&config_value[0], "}");
+
+    return config_value;
+}
+/*
+ * @brief       Detect and validate PKCS11 Config Param
+ *
+ * @param[in]   config_value : String with the PKCS11 configuration parameters
+ *
+ * @retval      flags        : PKCS11 configuration validation flags
+ */
+static int detect_pkcs11_config(const char *config_value) {
+    if (!config_value)
+        return 0;
+    int flags = 0;
+    if (strstr(config_value, "pkcs11"))
+        flags |= PCKS11_ENV;
+    if (strstr(config_value, "token="))
+        flags |= TOKEN_EN;
+    if (strstr(config_value, "object="))
+            flags |= OBJ_TYPE;
+    if (strstr(config_value, "type=cert"))
+        flags |= TYPE_CERT;
+    if (strstr(config_value, "pin-value"))
+        flags |= USRPIN;
+    return flags;
+}
 
+/*
+ * @brief       Build PKCS11 URI string from configuration value
+ *
+ * @param[in]   rvalue : Configuration value string containing PKCS11 parameters
+ *
+ * @retval      pkcs11_uri : Complete PKCS11 URI string, or NULL on failure
+ *                          Caller is responsible for freeing the returned string
+ */
+static char *build_pkcs11_uri(const char *rvalue) {
+    ASSERT(rvalue, NULL);
+
+    char *pkcs11_uri = NULL;        /* PKCS11 URI string buffer */
+    char *env_result = NULL;        /* Env result for Token*/
+    char *config_object = NULL;     /* Configuration object identifier */
+    char *pkcs11_token_pin = NULL;  /* Token or Pin values*/
+
+    /* Allocate buffer for the complete PKCS11 URI */
+    pkcs11_uri = calloc(PKCS11_URI_BUFFER_SIZE+1, sizeof(char));
+    if (NULL == pkcs11_uri) {
+        DEBUG("ERROR: Error allocating memory for PKCS11 URI\n");
+        return NULL;
+    }
+
+    /* Check if configuration is complete */
+    g_pkcs11_token = detect_pkcs11_config(rvalue); /* Set global flag*/
+    if ( g_pkcs11_token != COMPLETE_CONF) {
+        DEBUG("ERROR: Invalid PKCS11 configuration \n");
+        goto err;
+    }
+
+    /* Start building the PKCS11 URI */
+    strncpy(pkcs11_uri, "\"pkcs11:token=", 15);
+
+    /* Extract and process token configuration */
+    env_result = extract_config_value(rvalue);
+    if (env_result != NULL) {
+        pkcs11_token_pin = getenv(env_result);
+        if (pkcs11_token_pin != NULL) {
+            DEBUG("Token env variable PKCS11_Token: %s\n", pkcs11_token_pin);
+            strncat(pkcs11_uri, pkcs11_token_pin, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
+        } else
+            strncat(pkcs11_uri, env_result, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
+    } else
+        goto err;
+
+    /* Extract and add object configuration */
+    config_object = extract_config_value(strchr(rvalue, ';'));
+    if (config_object != NULL) {
+        strncat(pkcs11_uri, ";object=", PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
+        strncat(pkcs11_uri, config_object, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
+    } else
+        goto err;
+
+    pkcs11_token_pin = NULL;
+    env_result = NULL;
+
+    /* Add type=cert */
+    strncat(pkcs11_uri, ";type=cert", PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
+
+    /* Extract and add PIN configuration */
+    env_result = extract_config_value(strrchr(rvalue, ';'));
+    if (env_result != NULL) {
+        pkcs11_token_pin = getenv(env_result);
+        DEBUG("USR_PIN environment variable %s and %s\n", env_result, pkcs11_token_pin);
+        strncat(pkcs11_uri, ";pin-value=", PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
+        if (pkcs11_token_pin != NULL)
+            strncat(pkcs11_uri, pkcs11_token_pin, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
+        else
+            strncat(pkcs11_uri, env_result, PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
+        FREE(env_result);
+    } else
+        goto err;
+
+    /* Close the URI string */
+    strncat(pkcs11_uri, "\"", PKCS11_URI_BUFFER_SIZE - strlen(pkcs11_uri));
+
+    FREE(pkcs11_token_pin);
+    FREE(config_object);
+    FREE(env_result);
+    FREE(pkcs11_uri);
+
+    return pkcs11_uri;
+
+err:
+    FREE(pkcs11_token_pin);
+    FREE(config_object);
+    FREE(env_result);
+    FREE(pkcs11_uri);
+    return NULL;
+}
 /*
  * @brief       Create CSF source file for IVT type v1
  *
@@ -446,15 +604,30 @@ static int create_csf_file_v1(image_block_t *blocks, int idx, char *ofname)
         fast_auth = true;
         /* Install NOCAK */
         fprintf(fp_csf_file, "[Install NOCAK]\n");
-        fprintf(fp_csf_file, "\tFile = \"%s/crts/%s\"\n", g_sig_tool_path, rvalue);
+        if (!strncmp (&rvalue[0], "pkcs11",6)) { /* PKCS11 Based Signing */
+            char *pkcs11_uri = build_pkcs11_uri(rvalue);
+            if (pkcs11_uri != NULL) {
+                fprintf(fp_csf_file, "\tFile = %s\n", pkcs11_uri);
+                FREE(pkcs11_uri);
+            } else
+                return -E_FAILURE;
+        } else
+            fprintf(fp_csf_file, "\tFile = \"%s/crts/%s\"\n", g_sig_tool_path, rvalue);
     } else {
         /* Prepare normal authentication parameters */
         /* Install CSFK */
         fprintf(fp_csf_file, "[Install CSFK]\n");
         cfg_parser(fp_cfg, rvalue, RSIZE, "csfk_file");
         if ('\0' == rvalue[0])
             fprintf(fp_csf_file, "\tFile = \"%s/crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem\"\n", g_sig_tool_path);
-        else
+        else if (!strncmp (&rvalue[0], "pkcs11",6)) { /* PKCS11 Based Signing */
+            char *pkcs11_uri = build_pkcs11_uri(rvalue);
+            if (pkcs11_uri != NULL) {
+                fprintf(fp_csf_file, "\tFile = %s\n", pkcs11_uri);
+                FREE(pkcs11_uri);
+            } else
+                return -E_FAILURE;
+        } else  /* File Based Signing */
             fprintf(fp_csf_file, "\tFile = \"%s/crts/%s\"\n", g_sig_tool_path, rvalue);
     }
 
@@ -558,7 +731,14 @@ static int create_csf_file_v1(image_block_t *blocks, int idx, char *ofname)
         cfg_parser(fp_cfg, rvalue, RSIZE, "img_file");
         if ('\0' == rvalue[0])
             fprintf(fp_csf_file, "\tFile = \"%s/crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem\"\n", g_sig_tool_path);
-        else
+        else if (!strncmp (&rvalue[0], "pkcs11",6)) { /* PKCS11 Based Signing */
+            char *pkcs11_uri = build_pkcs11_uri(rvalue);
+            if (pkcs11_uri != NULL) {
+                fprintf(fp_csf_file, "\tFile = %s\n", pkcs11_uri);
+                FREE(pkcs11_uri);
+            } else
+                return -E_FAILURE;
+        } else  /* File Based Signing */
             fprintf(fp_csf_file, "\tFile = \"%s/crts/%s\"\n", g_sig_tool_path, rvalue);
     }
 
@@ -664,7 +844,7 @@ static int create_csf_file_v3(char *csf_filename, char *ifname, csf_params_t *cs
     if ('\0' == rvalue[0])
         fprintf(fp_csf_file, "\tSource = \"%s/crts/SRK1_sha256_prime256v1_v3_ca_crt.pem\"\n", g_sig_tool_path);
     else
-        fprintf(fp_csf_file, "\tSource = \"%s/crts/%s\"\n", g_sig_tool_path, rvalue);
+        fprintf(fp_csf_file, "\tSource = \"%s/crts/%s\"\n", g_sig_data_path, rvalue);
 
     cfg_parser(fp_cfg, rvalue, RSIZE, "srk_source_index");
     if ('\0' == rvalue[0])