summaryrefslogtreecommitdiff
path: root/utility/vbutil_keyblock.c
Commit message (Collapse)AuthorAgeFilesLines
* Verified boot wrapper - add stub implementations for hostRandall Spangler2011-06-271-6/+6
| | | | | | | | | | | | | | | This is part 2 of the wrapper API refactor. It adds stub implementations for the host, and changes the host-side utilities to use them. Firmware implementation is unchanged in this CL (other than a few updates to macros). BUG=chromium_os:16997 TEST=make && make runtests Change-Id: I63989bd11de1f2239ddae256beaccd31bfb5acef Reviewed-on: http://gerrit.chromium.org/gerrit/3256 Reviewed-by: Stefan Reinauer <reinauer@chromium.org> Tested-by: Randall Spangler <rspangler@chromium.org>
* Add support for using external signing application and .pem private key ↵Gaurav Shah2010-10-291-15/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | files to vbutil_keyblock. This allows signing using a .pem file using an external program. It is assumed that the external program reads input from stdin, and outputs signed data on stdout. It takes one argument - the file name for the .pem private key reference. See external_rsa_signer.sh for an example external program. Example usage: vbutil_keyblock --pack 4096.keyblock \ --datapubkey 4096.vbpubk \ --signprivate_pem 4096.pem \ --pem_algorithm 8 \ --externalsigner "external_rsa_signer.sh" I have tried to make the change such that it doesn't impact existing tools/interfaces (since these are used at various places). That said, I am aware of the places where we could just extend an old interface an avoid code duplication but thought I'd put that re-factoring in as a TODO for now. Let me know if you disagree and I can merge them (and changing the existing interface). BUG=7576 TEST=Extended run_vbutil_tests.sh to test vbutil_keyblock packing using an external signer. To test, make && make runtests (or just run tests/gen_test_keys.sh; tests/run_vbutils_tests.sh) Review URL: http://codereview.chromium.org/4194003 Change-Id: I7cc52c8293c04ef9ba074794d046c9a4f19f6bdd
* Recommit a change that got accidently uncommitted.Bill Richardson2010-10-251-12/+3
| | | | | | | | | | | | | Display keyblock information, even if not checking the signature. Change-Id: Ie96ac39e2598fdfdc49898f92fd528edefd36313 BUG=none TEST=none Review URL: http://codereview.chromium.org/3602014 TBR=none
* Address some security concerns in the cgpt tool.Bill Richardson2010-10-121-3/+12
| | | | | | | | | | | | | | | | | | | | | | 1. Check for potential integer overflow in sector_bytes * sector_count. 2. Added O_NOFOLLOW to open() call - Is this enough? 3. Passing buffer length to GuidToStr(), PMBRToStr(). 4. Use unsigned int in GetEntry() to determine stride. 5. Address conversion between UTF16 and UTF8. Note: The UTF conversion is complex and troublesome, and needs careful consideration to get right. For now, I've just forced the interpretation of the partition name to 7-bit ASCII. That's sufficient for the needs of Chrome OS, and I can file a new issue to handle UTF correctly. BUG=chrome-os-partner:705 TEST=manual Running "make runtests" invokes the tests/run_cgpt_tests.sh script, which checks the behavior and output of the cgpt tool. Review URL: http://codereview.chromium.org/3594010 Change-Id: I5fd29796d8c929527e0cfbc6d5ccbcdc77502c6b
* Display keyblock information, even if not checking the signature.Bill Richardson2010-10-051-12/+3
| | | | | | | | | Change-Id: Ie96ac39e2598fdfdc49898f92fd528edefd36313 BUG=none TEST=none Review URL: http://codereview.chromium.org/3602014
* New tools to help debug vboot failures.Bill Richardson2010-09-091-0/+12
| | | | | | | | | | | | | | | | | | | This adds some tools to help us figure out why a particular kernel isn't booting. Often we suspect it's because it was signed with the wrong keys, or has flags restricting its use to certain boot modes. This change adds some tools to extract and display all the keys from the BIOS, and try them on the various kernels. We also display the sha1sum of all the keys we find, to make comparing them easier. Change-Id: I38e447bf95cb6c3a0b87aa949611bb135f2f94b4 BUG=chromeos-partner:888 TEST=manual To test, obtain a root shell, and run dev_debug_vboot. You should see lots of useful information go by. Review URL: http://codereview.chromium.org/3303018
* Fix KeyBlockVerify() to take an explicit param for whether to use hash only.Randall Spangler2010-08-171-1/+1
| | | | | | | | | Fix VerifyMemberInside(). BUG=chrome-os-partner:703 TEST=make && make runtests Review URL: http://codereview.chromium.org/3126013
* Changes to allow user-signed kernels to be generated.Bill Richardson2010-08-091-39/+61
| | | | | | | | | | | | | Make vbutil_keyblock handle unsigned blocks. Also enable --unpack option and add tests for it. Modify vbutil_kernel to allow unsigned keyblocks, correct usage message, and fix the --debug option which was somehow disabled. Update load_kernel_test to accept /dev/null for the public key, to test non-signed kernel keyblocks. Review URL: http://codereview.chromium.org/3124004
* Switch to using .vbprivk for signing everything now.Bill Richardson2010-07-011-45/+31
| | | | | | | | | | | | | | | | | This makes it much simpler to keep track of what we're doing. vbutil_key can now wrap both .keyb and .pem keys. It figures out which is which by trying both and just using the one that works. vbutil_keyblock and vbutil_kernel now use .vbprivk files for signing. replace debug() with VBDEBUG(()) in host-side sources, too. rename PrivateKeyRead to PrivateKeyReadPem Add real PrivateKeyRead and PrivateKeyWrite for .vbprivk files. Review URL: http://codereview.chromium.org/2871033
* Adding --repack and --headeronly options to vbutil_kernelBill Richardson2010-06-301-1/+1
| | | | | | | | | | | | The --repack option lets us sign a previously signed kernel blob with a new kernel data key. The --headeronly option is so we can emit the new verification header separately from the kernel blob. More work to come... Review URL: http://codereview.chromium.org/2812034
* Clean up of key block functionsRandall Spangler2010-06-111-5/+9
| | | | | | No substantial new code, just making the old code consistent. Review URL: http://codereview.chromium.org/2729021
* Added vbutil_kernel.Randall Spangler2010-06-111-0/+7
| | | | Review URL: http://codereview.chromium.org/2730011
* Add vbutil_keyblockRandall Spangler2010-06-101-0/+222
Review URL: http://codereview.chromium.org/2748008
View Lorry Controller Status