Change VerifyFirmware() to take separate pointers to firmware verification header and firmware data.

The firmware verification code no longer assumes that verification data and firmware data are contiguous and follow each other. Needed for EFI where the actual firmware must be stored in its own firmware volume.

BUG=1704
TEST=modified existing tests for the new API, and they still pass

Review URL: http://codereview.chromium.org/1578035

8 files changed, 104 insertions, 76 deletions

diff --git a/tests/big_firmware_tests.c b/tests/big_firmware_tests.c
index eb451149..1f83cd2a 100644
--- a/tests/big_firmware_tests.c
+++ b/tests/big_firmware_tests.c
@@ -52,7 +52,7 @@ int BigFirmwareTest(void) {
           VERIFY_FIRMWARE_SUCCESS,
           "Big FirmwareImage Verification");
   firmware_blob = GetFirmwareBlob(image, &len);
-  TEST_EQ(VerifyFirmware(root_key_blob, firmware_blob),
+  TEST_EQ(VerifyFirmware(root_key_blob, image->firmware_data, firmware_blob),
           VERIFY_FIRMWARE_SUCCESS,
           "Big Firmware Blob Verification");
 
diff --git a/tests/firmware_image_tests.c b/tests/firmware_image_tests.c
index a2ce472f..96cf9551 100644
--- a/tests/firmware_image_tests.c
+++ b/tests/firmware_image_tests.c
@@ -15,8 +15,12 @@
 #include "utility.h"
 
 /* Normal Firmware Blob Verification Tests. */
-void VerifyFirmwareTest(uint8_t* firmware_blob, uint8_t* root_key_blob) {
-  TEST_EQ(VerifyFirmware(root_key_blob, firmware_blob),
+void VerifyFirmwareTest(uint8_t* verification_header,
+                        uint8_t* firmware_data,
+                        uint8_t* root_key_blob) {
+  TEST_EQ(VerifyFirmware(root_key_blob,
+                         verification_header,
+                         firmware_data),
           VERIFY_FIRMWARE_SUCCESS,
           "Normal Firmware Blob Verification");
 }
@@ -92,7 +96,9 @@ int main(int argc, char* argv[]) {
   firmware_blob = GetFirmwareBlob(image, &firmware_blob_len);
 
   /* Test Firmware blob verify operations. */
-  VerifyFirmwareTest(firmware_blob, root_key_blob);
+  VerifyFirmwareTest(firmware_blob,
+                     image->firmware_data,
+                     root_key_blob);
 
   /* Test FirmwareImage verify operations. */
   VerifyFirmwareImageTest(image, root_key_pub);
diff --git a/tests/firmware_rollback_tests.c b/tests/firmware_rollback_tests.c
index 3608db73..14c0475c 100644
--- a/tests/firmware_rollback_tests.c
+++ b/tests/firmware_rollback_tests.c
@@ -16,14 +16,14 @@
 #include "test_common.h"
 
 const char* kRootKeyPublicFile = "testkeys/key_rsa8192.keyb";
+uint8_t kValidFirmwareData[1] = { 'F' };
+uint8_t kCorruptFirmwareData[1] = { 'X' };
 
 /* Tests that check for correctness of the VerifyFirmwareDriver_f() logic
  * and rollback prevention. */
 void VerifyFirmwareDriverTest(void) {
-  uint8_t* valid_firmwareA = NULL;
-  uint8_t* valid_firmwareB = NULL;
-  uint8_t* corrupt_firmwareA = NULL;
-  uint8_t* corrupt_firmwareB = NULL;
+  uint8_t* verification_blobA = NULL;
+  uint8_t* verification_blobB = NULL;
   uint64_t len;
   uint8_t* root_key_pub = BufferFromFile(kRootKeyPublicFile, &len);
 
@@ -31,43 +31,55 @@ void VerifyFirmwareDriverTest(void) {
   g_firmware_key_version = 1;
   g_firmware_version = 1;
 
-  valid_firmwareA = GenerateRollbackTestFirmwareBlob(1, 1, 0);
-  valid_firmwareB = GenerateRollbackTestFirmwareBlob(1, 1, 0);
-  corrupt_firmwareA = GenerateRollbackTestFirmwareBlob(1, 1, 1);
-  corrupt_firmwareB = GenerateRollbackTestFirmwareBlob(1, 1, 1);
+  verification_blobA = GenerateRollbackTestVerificationBlob(1, 1);
+  verification_blobB = GenerateRollbackTestVerificationBlob(1, 1);
 
   TEST_EQ(VerifyFirmwareDriver_f(root_key_pub,
-                                 valid_firmwareA, valid_firmwareB),
+                                 verification_blobA,
+                                 kValidFirmwareData,
+                                 verification_blobB,
+                                 kValidFirmwareData),
           BOOT_FIRMWARE_A_CONTINUE,
           "Firmware A (Valid with current version), "
           "Firmware B (Valid with current version)");
   TEST_EQ(VerifyFirmwareDriver_f(root_key_pub,
-                                 corrupt_firmwareA, valid_firmwareB),
+                                 verification_blobA,
+                                 kCorruptFirmwareData,
+                                 verification_blobB,
+                                 kValidFirmwareData),
           BOOT_FIRMWARE_B_CONTINUE,
           "Firmware A (Corrupt with current version), "
-          "FirmwareB (Valid with current version)");
+          "Firmware B (Valid with current version)");
   TEST_EQ(VerifyFirmwareDriver_f(root_key_pub,
-                                 valid_firmwareA, corrupt_firmwareB),
+                                 verification_blobA,
+                                 kValidFirmwareData,
+                                 verification_blobB,
+                                 kCorruptFirmwareData),
           BOOT_FIRMWARE_A_CONTINUE,
           "Firmware A (Valid with current version), "
-          "FirmwareB (Corrupt with current version)");
+          "Firmware B (Corrupt with current version)");
   TEST_EQ(VerifyFirmwareDriver_f(root_key_pub,
-                                 corrupt_firmwareA, corrupt_firmwareB),
+                                 verification_blobA,
+                                 kCorruptFirmwareData,
+                                 verification_blobB,
+                                 kCorruptFirmwareData),
           BOOT_FIRMWARE_RECOVERY_CONTINUE,
           "Firmware A (Corrupt with current version), "
-          "FirmwareB (Corrupt with current version");
+          "Firmware B (Corrupt with current version");
   g_firmware_key_version = 2;
   g_firmware_version = 2;
-  TEST_EQ(VerifyFirmwareDriver_f(root_key_pub, valid_firmwareA, valid_firmwareB),
+  TEST_EQ(VerifyFirmwareDriver_f(root_key_pub,
+                                 verification_blobA,
+                                 kValidFirmwareData,
+                                 verification_blobB,
+                                 kValidFirmwareData),
           BOOT_FIRMWARE_RECOVERY_CONTINUE,
           "Firmware A (Valid with old version), "
           "Old Firmware B (Valid with old version)");
 
   Free(root_key_pub);
-  Free(valid_firmwareA);
-  Free(valid_firmwareB);
-  Free(corrupt_firmwareA);
-  Free(corrupt_firmwareB);
+  Free(verification_blobA);
+  Free(verification_blobB);
 }
 
 int main(int argc, char* argv[]) {
diff --git a/tests/firmware_splicing_tests.c b/tests/firmware_splicing_tests.c
index c3259b76..97d16dfc 100644
--- a/tests/firmware_splicing_tests.c
+++ b/tests/firmware_splicing_tests.c
@@ -67,7 +67,7 @@ void VerifyFirmwareSplicingTest()
           VERIFY_FIRMWARE_SIGNATURE_FAILED,
           "FirmwareImage firmware_data Splicing");
   firmware_blob = GetFirmwareBlob(image2, &len);
-  TEST_EQ(VerifyFirmware(root_key_blob, firmware_blob),
+  TEST_EQ(VerifyFirmware(root_key_blob, firmware_blob, image2->firmware_data),
           VERIFY_FIRMWARE_SIGNATURE_FAILED,
           "Firmware Blob firmware_data Splicing");
 }
diff --git a/tests/firmware_verify_benchmark.c b/tests/firmware_verify_benchmark.c
index c69ada73..44e45661 100644
--- a/tests/firmware_verify_benchmark.c
+++ b/tests/firmware_verify_benchmark.c
@@ -49,6 +49,7 @@ int SpeedTestAlgorithm(int algorithm) {
     "sha1", "sha256", "sha512",  /* RSA-4096 */
     "sha1", "sha256", "sha512",  /* RSA-8192 */
   };
+  uint8_t* verification_blobs[NUM_SIZES_TO_TEST];
   uint8_t* firmware_blobs[NUM_SIZES_TO_TEST];
   for (i = 0; i < NUM_SIZES_TO_TEST; ++i)
     firmware_blobs[i] = NULL;
@@ -67,13 +68,16 @@ int SpeedTestAlgorithm(int algorithm) {
 
   /* Generate test images. */
   for (i = 0; i < NUM_SIZES_TO_TEST; ++i) {
-    firmware_blobs[i] = GenerateTestFirmwareBlob(algorithm,
-                                                 firmware_sign_key,
-                                                 1,  /* firmware key version. */
-                                                 1,  /* firmware version. */
-                                                 g_firmware_sizes_to_test[i],
-                                                 "testkeys/key_rsa8192.pem",
-                                                 firmware_sign_key_file);
+    firmware_blobs[i] = (uint8_t*) Malloc(g_firmware_sizes_to_test[i]);
+    Memset(firmware_blobs[i], 'F', g_firmware_sizes_to_test[i]);
+    verification_blobs[i] = GenerateTestVerificationBlob(
+        algorithm,
+        firmware_sign_key,
+        1,  /* firmware key version. */
+        1,  /* firmware version. */
+        g_firmware_sizes_to_test[i],
+        "testkeys/key_rsa8192.pem",
+        firmware_sign_key_file);
     if (!firmware_blobs[i]) {
       debug("Couldn't generate test firmware images.\n");
       error_code = 1;
@@ -94,7 +98,9 @@ int SpeedTestAlgorithm(int algorithm) {
     StartTimer(&ct);
     for (j = 0; j < NUM_OPERATIONS; ++j) {
       if (VERIFY_FIRMWARE_SUCCESS !=
-          VerifyFirmware(root_key_blob, firmware_blobs[i]))
+          VerifyFirmware(root_key_blob,
+                         verification_blobs[i],
+                         firmware_blobs[i]))
         debug("Warning: Firmware Verification Failed.\n");
     }
     StopTimer(&ct);
@@ -113,8 +119,10 @@ int SpeedTestAlgorithm(int algorithm) {
   }
 
  cleanup:
-  for (i = 0; i < NUM_SIZES_TO_TEST; i++)
+  for (i = 0; i < NUM_SIZES_TO_TEST; i++) {
     Free(firmware_blobs[i]);
+    Free(verification_blobs[i]);
+  }
   Free(root_key_blob);
   return error_code;
 }
diff --git a/tests/test_common.c b/tests/test_common.c
index 5fcdc5e7..6f68d352 100644
--- a/tests/test_common.c
+++ b/tests/test_common.c
@@ -80,13 +80,13 @@ FirmwareImage* GenerateTestFirmwareImage(int algorithm,
   return image;
 }
 
-uint8_t* GenerateTestFirmwareBlob(int algorithm,
-                                  const uint8_t* firmware_sign_key,
-                                  int firmware_key_version,
-                                  int firmware_version,
-                                  uint64_t firmware_len,
-                                  const char* root_key_file,
-                                  const char* firmware_key_file) {
+uint8_t* GenerateTestVerificationBlob(int algorithm,
+                                      const uint8_t* firmware_sign_key,
+                                      int firmware_key_version,
+                                      int firmware_version,
+                                      uint64_t firmware_len,
+                                      const char* root_key_file,
+                                      const char* firmware_key_file) {
   FirmwareImage* image = NULL;
   uint8_t* firmware_blob = NULL;
   uint64_t firmware_blob_len = 0;
@@ -104,12 +104,11 @@ uint8_t* GenerateTestFirmwareBlob(int algorithm,
   return firmware_blob;
 }
 
-uint8_t* GenerateRollbackTestFirmwareBlob(int firmware_key_version,
-                                          int firmware_version,
-                                          int is_corrupt) {
+uint8_t* GenerateRollbackTestVerificationBlob(int firmware_key_version,
+                                              int firmware_version) {
   FirmwareImage* image = NULL;
   uint64_t len;
-  uint8_t* firmware_blob = NULL;
+  uint8_t* verification_blob = NULL;
   uint8_t* firmware_sign_key = NULL;
 
   firmware_sign_key = BufferFromFile("testkeys/key_rsa1024.keyb",
@@ -126,14 +125,9 @@ uint8_t* GenerateRollbackTestFirmwareBlob(int firmware_key_version,
                                     'F');
   if (!image)
     return NULL;
-  if (is_corrupt) {
-    /* Invalidate image. */
-    Memset(image->firmware_data, 'X', image->firmware_len);
-  }
-
-  firmware_blob = GetFirmwareBlob(image, &len);
+  verification_blob = GetFirmwareBlob(image, &len);
   FirmwareImageFree(image);
-  return firmware_blob;
+  return verification_blob;
 }
 
 
diff --git a/tests/test_common.h b/tests/test_common.h
index 6fed1b48..d73dc0ea 100644
--- a/tests/test_common.h
+++ b/tests/test_common.h
@@ -26,13 +26,13 @@ FirmwareImage* GenerateTestFirmwareImage(int algorithm,
                                          const char* root_key_file,
                                          const char* firmware_key_file,
                                          uint8_t firmware_data_fill_char);
-uint8_t* GenerateTestFirmwareBlob(int algorithm,
-                                  const uint8_t* firmware_sign_key,
-                                  int firmware_key_version,
-                                  int firmware_version,
-                                  uint64_t firmware_len,
-                                  const char* root_key_file,
-                                  const char* firmware_key_file);
+uint8_t* GenerateTestVerificationBlob(int algorithm,
+                                      const uint8_t* firmware_sign_key,
+                                      int firmware_key_version,
+                                      int firmware_version,
+                                      uint64_t firmware_len,
+                                      const char* root_key_file,
+                                      const char* firmware_key_file);
 
 /* Test kernel image generation functions. */
 KernelImage* GenerateTestKernelImage(int firmware_sign_algorithm,
@@ -44,7 +44,6 @@ KernelImage* GenerateTestKernelImage(int firmware_sign_algorithm,
                                      const char* firmware_key_file,
                                      const char* kernel_key_file,
                                      uint8_t kernel_data_fill_char);
-;
 uint8_t* GenerateTestKernelBlob(int firmware_sign_algorithm,
                                 int kernel_sign_algorithm,
                                 const uint8_t* kernel_sign_key,
@@ -54,12 +53,12 @@ uint8_t* GenerateTestKernelBlob(int firmware_sign_algorithm,
                                 const char* firmware_key_file,
                                 const char* kernel_key_file);
 
-/* Generates a test firmware image for rollback tests with a given
- * [firmware_key_version] and [firmware_version]. If [is_corrupt] is 1,
- * then the image has invalid signatures and will fail verification. */
-uint8_t* GenerateRollbackTestFirmwareBlob(int firmware_key_version,
-                                          int firmware_version,
-                                          int is_corrupt);
+/* Generates a test verification block for rollback tests with a given
+ * [firmware_key_version] and [firmware_version]. The firmware length is
+ * assumed to be 1 bytes, and containing { 'F' }.
+ */
+uint8_t* GenerateRollbackTestVerificationBlob(int firmware_key_version,
+                                              int firmware_version);
 
 /* Generates a test kernel iamge for rollback tests with a given
  * [kernel_key_version} and [kernel_version]. If [is_corrupt] is 1,
diff --git a/tests/verify_firmware_fuzz_driver.c b/tests/verify_firmware_fuzz_driver.c
index 8ab33ad6..f04a7d5d 100644
--- a/tests/verify_firmware_fuzz_driver.c
+++ b/tests/verify_firmware_fuzz_driver.c
@@ -11,11 +11,13 @@
 #include "firmware_image.h"
 #include "utility.h"
 
-int VerifySignedFirmware(const char* image_file,
-                         const char* root_key_file) {
+int VerifySignedFirmware(const char* root_key_file,
+                         const char* verification_file,
+                         const char* firmware_file) {
   int error, error_code = 0;
   uint64_t len;
-  uint8_t* firmware_blob = BufferFromFile(image_file, &len);
+  uint8_t* verification_blob = BufferFromFile(verification_file, &len);
+  uint8_t* firmware_blob = BufferFromFile(firmware_file, &len);
   uint8_t* root_key_blob = BufferFromFile(root_key_file, &len);
 
   if (!root_key_blob) {
@@ -24,11 +26,18 @@ int VerifySignedFirmware(const char* image_file,
   }
 
   if (!error_code && !firmware_blob) {
-    fprintf(stderr, "Couldn't read firmware image or malformed image.\n");
+    fprintf(stderr, "Couldn't read firmware image.\n");
     error_code = 1;
   }
 
-  if (!error_code && (error = VerifyFirmware(root_key_blob, firmware_blob))) {
+  if (!error_code && !verification_blob) {
+    fprintf(stderr, "Couldn't read verification data image.\n");
+    error_code = 1;
+  }
+
+  if (!error_code && (error = VerifyFirmware(root_key_blob,
+                                             verification_blob,
+                                             firmware_blob))) {
     fprintf(stderr, "%s\n", VerifyFirmwareErrorString(error));
     error_code = 1;
   }
@@ -41,15 +50,15 @@ int VerifySignedFirmware(const char* image_file,
 }
 
 int main(int argc, char* argv[]) {
-  if (argc != 3) {
-    fprintf(stderr, "Usage: %s <image_to_verify> <root_keyb>\n", argv[0]);
+  if (argc != 4) {
+    fprintf(stderr, "Usage: %s <verification blob> <image_to_verify> <root_keyb>"
+            "\n", argv[0]);
     return -1;
   }
-  if (VerifySignedFirmware(argv[1], argv[2])) {
+  if (VerifySignedFirmware(argv[3], argv[1], argv[2])) {
     fprintf(stderr, "Verification SUCCESS!\n");
     return 0;
-  }
-  else {
+  } else {
     fprintf(stderr, "Verification FAILURE!\n");
     return -1;
   }