summaryrefslogtreecommitdiff
path: root/drivers
Commit message (Collapse)AuthorAgeFilesLines
* Merge "fix(mbedtls): fix mbedtls coverity issues" into integrationManish V Badarkhe2023-03-031-1/+2
|\
| * fix(mbedtls): fix mbedtls coverity issuesGovindraj Raja2023-03-011-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit (a8eadc51a refactor(mbedtls): avoid including MBEDTLS_CONFIG_FILE) avoids using config file directly and relies on config file usage from mbedtls version.h But we could build trusted boot without mbedtls dir so guard version.h include in cot_def.h with availability of config file. Also we refactored in same commit to break dependencies between auth_mod.h and cot_def.h, So add cot_def.h include in nxp tbbr cot file. Change-Id: I4779e90c18f04c73d2121c88df6420b4b1109c8b Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
* | refactor(auth): use a single function for parsing extensionsDemi Marie Obenour2023-03-021-68/+49
|/ | | | | | | | | | | | | | Previously, extensions were parsed twice: once with error checking for validation, and a second time without error checking to extract the extension data. This is error prone and caused TFV-10 (CVE-2022-47630). A simpler approach is to have get_ext() be responsible for all extension parsing, and to treat a NULL OID as an indicator that get_ext() is only being called for validation. cert_parse() checks that get_ext() returns IMG_PARSER_OK and fails otherwise. Change-Id: I65a2ff053a188351ba54799827a2b7bd833bb037 Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
* refactor(auth): clean up certificate length checksDemi Marie Obenour2023-02-271-18/+6
| | | | | | | The previous code was correct but unnecessarily verbose. Change-Id: Ia19c667811a7c3b6957a0274d36076b0b16e36b7 Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
* refactor(auth): remove code duplicationDemi Marie Obenour2023-02-271-20/+14
| | | | | | | | The unique IDs are handled identically, so just use a for loop to get both of them. Change-Id: I44baaa4747ca7f314d364a79dfcbce97315f5a92 Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
* Merge changes I960771e6,I291dc627,I57f31664 into integrationMadhukar Pappireddy2023-02-271-25/+24
|\ | | | | | | | | | | | | * changes: fix(ufs): set the PRDT length field properly fix(ufs): flush the entire PRDT fix(ufs): only allow using one slot
| * fix(ufs): set the PRDT length field properlyJorge Troncoso2023-02-251-9/+6
| | | | | | | | | | | | | | | | | | | | | | The PRDT length field contains the count of the entries in the PRDT. See JEDEC Standard No. 223E, section 6.1.1, "UTP Transfer Request Descriptor," page 66. Previously we were setting the PRDT length field to the number of bytes in the PRDT divided by four (the size in units of 32 bits). This was incorrect according to the spec. Signed-off-by: Jorge Troncoso <jatron@google.com> Change-Id: I960771e6ce57002872392993042fae9ec505447e
| * fix(ufs): flush the entire PRDTJorge Troncoso2023-02-251-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, if the image being read exceeded 12,800 KB (or 50 PRDT entries of size 256 KB), the UFS driver would not flush the entire Physical Region Descriptor Table (PRDT). This would cause the UFS host controller to read empty PRDT entries, which eventually would make the system crash. This change updates the UFS driver to flush the entire PRDT, irrespective of the size of the image being read. This change also throws an error if the memory allocated for UFS descriptors is not sufficient to hold the entire Physical Region Descriptor Table (PRDT). Signed-off-by: Jorge Troncoso <jatron@google.com> Change-Id: I291dc62748992481be3cc156ce1474a6e3990ea9
| * fix(ufs): only allow using one slotJorge Troncoso2023-02-251-17/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the UFS driver places the Command UPIU, Response UPIU, and PRDT immediately after the UTP Transfer Request Descriptor. This space would normally be reserved for other slots in the UTP Transfer Request List, but because we always use slot zero, the other slots in the UTP Transfer Request List are never used and this is okay. Because the Command UPIU, Response UPIU, and PRDT are placed inside the UTP Transfer Request List, the UFS driver would break if two or more slots were used at the same time. Therefore, in a sense the get_empty_slot() function is misleading. It gives developers the illusion that they can use two or more slots simultaneously but in reality they cannot. This change deletes the get_empty_slot() function and replaces it with is_slot_available() so that only one slot can be used. Signed-off-by: Jorge Troncoso <jatron@google.com> Change-Id: I57f316640a1cdd56493505ede61f3012ceb2f305
* | Merge changes from topic "mbedtls3_support" into integrationManish V Badarkhe2023-02-2711-124/+235
|\ \ | |/ |/| | | | | | | | | | | | | | | | | * changes: feat(stm32mp1): add mbedtls-3.3 support config refactor(fvp): minor cleanup with TRUSTED_BOARD_BOOT style(crypto): add braces for if statement feat(fvp): increase BL1_RW and BL2 size feat(mbedtls): add support for mbedtls-3.3 refactor(crypto): avoid using struct mbedtls_pk_rsassa_pss_options refactor(mbedtls): avoid including MBEDTLS_CONFIG_FILE
| * style(crypto): add braces for if statementGovindraj Raja2023-02-212-61/+119
| | | | | | | | | | | | | | | | | | | | As per TF-A coding style[1] braces around single if statement is preferred. Minor cleanup to adhere to it. [1]: https://trustedfirmware-a.readthedocs.io/en/latest/process/coding-style.html#conditional-statement-bodies Change-Id: I771fdcbf105eac9377002ac67d0615ef29440904 Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
| * feat(mbedtls): add support for mbedtls-3.3Govindraj Raja2023-02-212-30/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TF-A support for mbedtls3.x has been overdue by number of releases. As per mbedtls support it was advised to use latest and greatest mbedtls-3.3. But mbedtls-3.x breaks API compatibility with mbedtls-2.x To maintain comptability for mbedtls-2.x and enable mbedtls-3.x support add a functionality into makefile to determine the major version of mbedtls and use that to selective include or compile files that are present. With mbedtls-3.x numerous other config changes have been done. Some of the config options deprecated or enabled by default. Thus we decided to introduce a new 3.x config file part of this change for building TF-A with mbedtls-3.3. For futher information on migrating to mbedtls 3.x refer to: https://github.com/Mbed-TLS/mbedtls/blob/development/docs/3.0-migration-guide.md Change-Id: Ia8106d6f526809df927d608db27fe149623258ed Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
| * refactor(crypto): avoid using struct mbedtls_pk_rsassa_pss_optionsGovindraj Raja2023-02-212-17/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In preparation for supporting mbedtls 3.3, usage of mbedtls_pk_rsassa_pss_options[1] is made private and is broken on 3.3 However looking closely into the usage in 'verify_signature' function is no hard reason behind usage of this struct and they could be easily replaced with independent variables. This Minor refactor to avoid using the struct mbedtls_pk_rsassa_pss_options and use independent variable will provide compatibility with both 2.x and 3.x [1]: https://github.com/Mbed-TLS/mbedtls/issues/7040 Change-Id: If0107d860d11d13cba7fd5d7941e7142e70c7b11 Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
| * refactor(mbedtls): avoid including MBEDTLS_CONFIG_FILEGovindraj Raja2023-02-218-21/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we include MBEDTLS_CONFIG_FILE directly and if a custom config file is used it will included. However from mbedtls-3.x onwards it discourages usage of MBEDTLS_CONFIG_FILE include directly, so to resolve this and keep 2.28 compatibility include version.h which would include the custom config file if present and also would expose us with mbedtls-major-version number which could be used for selecting features and functions for mbedtls 2.28 or 3.3 Change-Id: I029992311be2a38b588ebbb350875b03ea29acdb Signed-off-by: Govindraj Raja <govindraj.raja@arm.com>
* | Merge "fix: remove useless "return" at void functions" into integrationMadhukar Pappireddy2023-02-231-3/+0
|\ \
| * | fix: remove useless "return" at void functionsElyes Haouas2023-02-161-3/+0
| |/ | | | | | | | | | | | | | | | | | | | | void functions() returns nothing. So remove useless "return". found using checkpatch.pl[1] [1]: https://review.coreboot.org/plugins/gitiles/coreboot/+/refs/heads/master/util/lint/checkpatch.pl Change-Id: I3daab2abec225a657af48f7d8c215cc554713074 Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
* | Merge "fix(ufs): device present (DP) field is set to '1'" into integrationMadhukar Pappireddy2023-02-211-1/+1
|\ \
| * | fix(ufs): device present (DP) field is set to '1'Jorge Troncoso2023-02-201-1/+1
| |/ | | | | | | | | | | | | | | | | | | | | | | The Device Present (DP) field is set to '1' after host controller receive 'SUCCESS' return code on the response of the DME_LINKSTARTUP UIC CMD during host controller initialization. JEDEC Standard No. 223E Page 28 Signed-off-by: Jorge Troncoso <jatron@google.com> Change-Id: I9db0374c1df3530d64187b9e449cde3b27d63072
* | Merge "fix(gicv3): fixed bug in the initialization of GICv3 SGIs/(E)PPIs ↵Madhukar Pappireddy2023-02-211-2/+2
|\ \ | |/ |/| | | interrupt priorities" into integration
| * fix(gicv3): fixed bug in the initialization of GICv3 SGIs/(E)PPIs interrupt ↵Sylwester Garncarek2023-01-101-2/+2
| | | | | | | | | | | | | | | | | | priorities Default priority was not being set for all interrupts (gicr_write_ipriorityr takes INTID, not register number). The fix makes the loop to pass INTID in range 0, 4, 8, 12, ... Signed-off-by: Sylwester Garncarek <sylwester.garncarek@sciopta.com> Change-Id: Iaa975f6af49f5826c2811161f55242844c28ea81
* | refactor(allwinner): use fdt_node_is_enabled() in AXP driverAndre Przywara2023-02-031-11/+2
| | | | | | | | | | | | | | | | The Allwinner AXP driver was using a private implementation of that function, remove that in favour of our now common implementation. Change-Id: I7bd311d73060d4bc83f93cff6bedf6c78dddd3ca Signed-off-by: Andre Przywara <andre.przywara@arm.com>
* | Merge changes from topic "fix_misra_partition_mmc" into integrationMadhukar Pappireddy2023-01-242-9/+9
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | * changes: fix(mmc): align part config type fix(mmc): do not modify r_data in mmc_send_cmd() fix(mmc): explicitly check operators precedence fix(partition): add U suffix for unsigned numbers fix(partition): add missing curly braces
| * | fix(mmc): align part config typeYann Gautier2022-12-071-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This corrects MISRA C2012 10.3: The value of an expression shall not be assigned to an object with a narrower essential type or of a different essential type category. Set part_config to be an unsigned char everywhere it is used. Signed-off-by: Yann Gautier <yann.gautier@st.com> Change-Id: I9cf87848fb016a5630b3c8091290419e3bc62b91
| * | fix(mmc): do not modify r_data in mmc_send_cmd()Yann Gautier2022-12-071-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | Fix MISRA C2012-17.8: A function parameter should not be modified Signed-off-by: Yann Gautier <yann.gautier@st.com> Change-Id: I08ed4c6768c7988a98de21da181b97b0885139de
| * | fix(mmc): explicitly check operators precedenceYann Gautier2022-12-071-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | This corrects the MISRA violation C2012-12.1: The precedence of operators within expressions should be made explicit While at it put the test on one line. Signed-off-by: Yann Gautier <yann.gautier@st.com> Change-Id: Id19231faaf033c1e7dbe703690e0dddc7aa8f346
| * | fix(partition): add missing curly bracesYann Gautier2022-12-071-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add braces to correct MISRA C2012 15.6 warning: The body of an iteration-statement or a selection-statement shall be a compound-statement. Signed-off-by: Yann Gautier <yann.gautier@st.com> Change-Id: I4041b0080b678f5ffdbe074e3cee9ac0afd5e176
* | | Merge changes from topic "fix_sparse_warnings" into integrationMadhukar Pappireddy2023-01-203-8/+8
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * changes: fix(libc): remove __putchar alias fix(console): correct scopes for console symbols fix(auth): use NULL instead of 0 for pointer check fix(io): compare function pointers with NULL fix(fdt-wrappers): use correct prototypes
| * | | fix(console): correct scopes for console symbolsYann Gautier2023-01-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | console_state is only used in multi_console.c, it is then declared as static. console_list is used by several files, declare it as extern. This corrects the 2 sparse warnings: drivers/console/multi_console.c:13:11: warning: symbol 'console_list' was not declared. Should it be static? drivers/console/multi_console.c:14:9: warning: symbol 'console_state' was not declared. Should it be static? Signed-off-by: Yann Gautier <yann.gautier@st.com> Change-Id: Id1891595906c258e8cb8aa325226f0a43723ca0e
| * | | fix(auth): use NULL instead of 0 for pointer checkYann Gautier2023-01-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This was triggered by sparse tool: drivers/auth/mbedtls/mbedtls_x509_parser.c:481:42: warning: Using plain integer as NULL pointer Signed-off-by: Yann Gautier <yann.gautier@st.com> Change-Id: I392316c2a81ef8da7597e35f136e038f152d19d1
| * | | fix(io): compare function pointers with NULLYann Gautier2023-01-101-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ops->read and ops->write existence was checked with 0, change it to NULL. This corrects sparse issues: drivers/io/io_block.c:272:9: warning: Using plain integer as NULL pointer drivers/io/io_block.c:384:9: warning: Using plain integer as NULL pointer drivers/io/io_block.c:384:9: warning: Using plain integer as NULL pointer Signed-off-by: Yann Gautier <yann.gautier@st.com> Change-Id: I039050a645107523d8263ddf820e539c260d956c
* | | | Merge changes from topic "deprecate_io_drivers" into integrationManish Pandey2023-01-161-143/+0
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | * changes: refactor(st): remove unused io_mmc driver docs: deprecate io_dummy driver
| * | | | refactor(st): remove unused io_mmc driverYann Gautier2022-12-191-143/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This driver was used when STM32MP_USE_STM32IMAGE was enabled. This flag is now removed, so the ST io_mmc driver can now be removed. Signed-off-by: Yann Gautier <yann.gautier@st.com> Change-Id: I3c1280dec8926b921534c81e143e86cfe6d4ee0d
* | | | | fix(auth): properly validate X.509 extensionsDemi Marie Obenour2023-01-101-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | get_ext() does not check the return value of the various mbedtls_* functions, as cert_parse() is assumed to have guaranteed that they will always succeed. However, it passes the end of an extension as the end pointer to these functions, whereas cert_parse() passes the end of the TBSCertificate. Furthermore, cert_parse() does *not* check that the contents of the extension have the same length as the extension itself. Before fd37982a19a4a291 ("fix(auth): forbid junk after extensions"), cert_parse() also does not check that the extension block extends to the end of the TBSCertificate. This is a problem, as mbedtls_asn1_get_tag() leaves *p and *len undefined on failure. In practice, this results in get_ext() continuing to parse at different offsets than were used (and validated) by cert_parse(), which means that the in-bounds guarantee provided by cert_parse() no longer holds. This patch fixes the remaining flaw by enforcing that the contents of an extension are the same length as the extension itself. Change-Id: Id4570f911402e34d5d6c799ae01a01f184c68d7c Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com> Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
* | | | | fix(auth): avoid out-of-bounds read in auth_nvctr()Demi Marie Obenour2023-01-101-6/+14
| |/ / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | auth_nvctr() does not check that the buffer provided is long enough to hold an ASN.1 INTEGER, or even that the buffer is non-empty. Since auth_nvctr() will only ever read 6 bytes, it is possible to read up to 6 bytes past the end of the buffer. This out-of-bounds read turns out to be harmless. The only caller of auth_nvctr() always passes a pointer into an X.509 TBSCertificate, and all in-tree chains of trust require that the certificate’s signature has already been validated. This means that the signature algorithm identifier is at least 4 bytes and the signature itself more than that. Therefore, the data read will be from the certificate itself. Even if the certificate signature has not been validated, an out-of-bounds read is still not possible. Since there are at least two bytes (tag and length) in both the signature algorithm ID and the signature itself, an out-of-bounds read would require that the tag byte of the signature algorithm ID would need to be either the tag or length byte of the DER-encoded nonvolatile counter. However, this byte must be (MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE) (0x30), which is greater than 4 and not equal to MBEDTLS_ASN1_INTEGER (2). Therefore, auth_nvctr() will error out before reading the integer itself, preventing an out-of-bounds read. Change-Id: Ibdf1af702fbeb98a94c0c96456ebddd3d392ad44 Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
* | | | Merge changes from topic "bk/warnings" into integrationManish Pandey2023-01-109-35/+44
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * changes: docs: describe the new warning levels build: add -Wunused-const-variable=2 to W=2 build: include -Wextra in generic builds docs(porting-guide): update a reference fix(st-usb): replace redundant checks with asserts fix(brcm): add braces around bodies of conditionals fix(renesas): align incompatible function pointers fix(zynqmp): remove redundant api_version check fix: remove old-style declarations fix: unify fallthrough annotations
| * | | | fix(st-usb): replace redundant checks with assertsBoyan Karatotev2022-12-011-7/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Returning enum usb_status in an enum usb_action function is wrong as they have different meanings. However, usb_dwc2_ep0_out_start() and usb_dwc2_activate_setup() only return USBD_OK so we will never get to there. Replace these checks with asserts in case the code changes in future. This also silences a warning when compiling with -Wextra. Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com> Change-Id: I73dfd5c189a357544c15ceb3f4268da82ce272b9
| * | | | fix(brcm): add braces around bodies of conditionalsBoyan Karatotev2022-12-012-17/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On release builds EMMC_TRACE doesn't expand to anything. Some conditionals with no braces end up with empty bodies. This produces a warning when compiling with -Werror=empty-body (enabled by -Wextra). Since TF-A coding guidelines require braces to comply with MISRA guidelines anyway, add them in the whole file. Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com> Change-Id: Ib4e691efc7acdb8fb8692278c7a9772fc894f77f
| * | | | fix(renesas): align incompatible function pointersBoyan Karatotev2022-12-012-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | secure_boot_api_f is defined to take uint32_t, uint32_t, and void * parameters. However rom_secure_boot_api_f is defined to take uint32_t *, uint32_t *, void *. These are incompatible and cause a warning when compiling with -Wextra. Align the rom definition to the more generic definition from where it's called. Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com> Change-Id: Ia030803b3c2335d220aff09fc0eef5c7615276aa
| * | | | fix: remove old-style declarationsBoyan Karatotev2022-12-012-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | TF-A wants to eventually enable -Wold-style-definition globally. Convert the rare few instances where this is still the case. Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com> Change-Id: I9c450fc875cf097e6de2ed577ea3b085821c9f5e
| * | | | fix: unify fallthrough annotationsBoyan Karatotev2022-12-012-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Compiling with -Wimplicit-fallthrough=3 (enabled by -Wextra) produces many warnings about fallthrough comments either missing or being wrong. Unify the comments so we comply with -Wextra. Note that Coverity recommends against using the __attribute__ directive. Also, zlib does not build with a higher value of -Wimplicit-fallthrough. Finally, compilers strip comments before expanding macros. As such, checkpatch's fallthrough annotation (or higher levels of the flag) isn't really possible. Signed-off-by: Boyan Karatotev <boyan.karatotev@arm.com> Change-Id: I060cf4f8dc04c02cbb45cf4ceb69569a8369ccee
* | | | | Merge "refactor(auth): avoid parsing signature algorithm twice" into integrationSandrine Bailleux2023-01-041-18/+7
|\ \ \ \ \
| * | | | | refactor(auth): avoid parsing signature algorithm twiceDemi Marie Obenour2022-12-291-18/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the two instances of the signature algorithm in a certificate must be bitwise identical, it is not necessary to parse both of them. Instead, it suffices to parse one of them, and then check that the other fits in the remaining buffer space and is equal to the first. Change-Id: Id0a0663165f147879ac83b6a540378fd4873b0dd Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
* | | | | | refactor(auth): do not include SEQUENCE tag in saved extensionsDemi Marie Obenour2023-01-031-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes the code a little bit smaller. No functional change intended. Change-Id: I794d2927fcd034a79e29c9bba1f8e4410203f547 Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
* | | | | | fix(auth): reject junk after certificatesDemi Marie Obenour2023-01-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Certificates must not allow trailing junk after them. Change-Id: Ie33205fb051fc63af5b72c326822da7f62eec1d1 Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
* | | | | | fix(auth): require bit strings to have no unused bitsDemi Marie Obenour2023-01-031-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is already checked by the crypto module or by mbedTLS, but checking it in the X.509 parser is harmless. Change-Id: Ifdbe3b4c6d04481bb8e93106ee04b49a70f50d5d Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
* | | | | | Merge changes Ia748b6ae,Id8a48e14,Id25ab231,Ie26eed8a,Idf48f716, ... into ↵Sandrine Bailleux2023-01-032-19/+65
|\ \ \ \ \ \ | |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | integration * changes: refactor(auth): partially validate SubjectPublicKeyInfo early fix(auth): reject padding after BIT STRING in signatures fix(auth): reject invalid padding in digests fix(auth): require at least one extension to be present fix(auth): forbid junk after extensions fix(auth): only accept v3 X.509 certificates
| * | | | | refactor(auth): partially validate SubjectPublicKeyInfo earlyDemi Marie Obenour2022-12-291-2/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reduces the likelihood of future problems later. Change-Id: Ia748b6ae31a7a48f17ec7f0fc08310a50cd1b135 Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
| * | | | | fix(auth): reject padding after BIT STRING in signaturesDemi Marie Obenour2022-12-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is forbidden by ASN.1 DER. Change-Id: Id8a48e14bb8a1a17a6481ea3fde0803723c05e31 Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
| * | | | | fix(auth): reject invalid padding in digestsDemi Marie Obenour2022-12-291-4/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Digests must not have padding after the SEQUENCE or OCTET STRING. Change-Id: Id25ab23111781f8c8a97c2c3c8edf1cc4a4384c0 Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
| * | | | | fix(auth): require at least one extension to be presentDemi Marie Obenour2022-12-291-4/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | X.509 and RFC5280 allow omitting the extensions entirely, but require that if the extensions field is present at all, it must contain at least one certificate. TF-A already requires the extensions to be present, but allows them to be empty. However, a certificate with an empty extensions field will always fail later on, as the extensions contain the information needed to validate the next stage in the boot chain. Therefore, it is simpler to require the extension field to be present and contain at least one extension. Also add a comment explaining why the extensions field is required, even though it is OPTIONAL in the ASN.1 syntax. Change-Id: Ie26eed8a7924bf50937a6b27ccdf7cc9a390588d Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>
View Lorry Controller Status