131 lines
4.5 KiB
Diff
131 lines
4.5 KiB
Diff
From f8cc9fc84827c03cecc9059dff254cb39d224696 Mon Sep 17 00:00:00 2001
|
|
From: Lionel Debieve <lionel.debieve@st.com>
|
|
Date: Tue, 19 Jan 2021 15:40:36 +0100
|
|
Subject: [PATCH 1/2] tools: allow to use a root key password from command line
|
|
|
|
By defining the ROT_KEY_PWD, user is able to define the private
|
|
root key password. Useful for build system management.
|
|
|
|
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
|
|
Change-Id: Ie692c5c6db5ddb093ca7659d80f6137a978aa7bf
|
|
---
|
|
make_helpers/tbbr/tbbr_tools.mk | 2 ++
|
|
tools/cert_create/include/key.h | 2 +-
|
|
tools/cert_create/src/key.c | 4 ++--
|
|
tools/cert_create/src/main.c | 16 +++++++++++++---
|
|
4 files changed, 18 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/make_helpers/tbbr/tbbr_tools.mk b/make_helpers/tbbr/tbbr_tools.mk
|
|
index 0a280b4ed..226d460f1 100644
|
|
--- a/make_helpers/tbbr/tbbr_tools.mk
|
|
+++ b/make_helpers/tbbr/tbbr_tools.mk
|
|
@@ -25,6 +25,7 @@
|
|
# KEY_SIZE
|
|
# ROT_KEY
|
|
# PROT_KEY
|
|
+# ROT_KEY_PWD
|
|
# TRUSTED_WORLD_KEY
|
|
# NON_TRUSTED_WORLD_KEY
|
|
# SCP_BL2_KEY
|
|
@@ -63,6 +64,7 @@ $(if ${HASH_ALG},$(eval $(call CERT_ADD_CMD_OPT,${HASH_ALG},--hash-alg,FWU_)))
|
|
$(if ${ROT_KEY},$(eval $(call CERT_ADD_CMD_OPT,${ROT_KEY},--rot-key)))
|
|
$(if ${ROT_KEY},$(eval $(call CERT_ADD_CMD_OPT,${ROT_KEY},--rot-key,FWU_)))
|
|
$(if ${PROT_KEY},$(eval $(call CERT_ADD_CMD_OPT,${PROT_KEY},--prot-key)))
|
|
+$(if ${ROT_KEY_PWD},$(eval $(call CERT_ADD_CMD_OPT,${ROT_KEY_PWD},--rot-key-pwd)))
|
|
$(if ${TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${TRUSTED_WORLD_KEY},--trusted-world-key)))
|
|
$(if ${NON_TRUSTED_WORLD_KEY},$(eval $(call CERT_ADD_CMD_OPT,${NON_TRUSTED_WORLD_KEY},--non-trusted-world-key)))
|
|
|
|
diff --git a/tools/cert_create/include/key.h b/tools/cert_create/include/key.h
|
|
index 128e7f7b4..5860abb4e 100644
|
|
--- a/tools/cert_create/include/key.h
|
|
+++ b/tools/cert_create/include/key.h
|
|
@@ -68,7 +68,7 @@ int key_init(void);
|
|
key_t *key_get_by_opt(const char *opt);
|
|
int key_new(key_t *key);
|
|
int key_create(key_t *key, int type, int key_bits);
|
|
-int key_load(key_t *key, unsigned int *err_code);
|
|
+int key_load(key_t *key, char *rot_key_pwd, unsigned int *err_code);
|
|
int key_store(key_t *key);
|
|
|
|
/* Macro to register the keys used in the CoT */
|
|
diff --git a/tools/cert_create/src/key.c b/tools/cert_create/src/key.c
|
|
index 64359756f..e2a1a4541 100644
|
|
--- a/tools/cert_create/src/key.c
|
|
+++ b/tools/cert_create/src/key.c
|
|
@@ -128,7 +128,7 @@ int key_create(key_t *key, int type, int key_bits)
|
|
return 0;
|
|
}
|
|
|
|
-int key_load(key_t *key, unsigned int *err_code)
|
|
+int key_load(key_t *key, char *rot_key_pwd, unsigned int *err_code)
|
|
{
|
|
FILE *fp;
|
|
EVP_PKEY *k;
|
|
@@ -137,7 +137,7 @@ int key_load(key_t *key, unsigned int *err_code)
|
|
/* Load key from file */
|
|
fp = fopen(key->fn, "r");
|
|
if (fp) {
|
|
- k = PEM_read_PrivateKey(fp, &key->key, NULL, NULL);
|
|
+ k = PEM_read_PrivateKey(fp, &key->key, NULL, rot_key_pwd);
|
|
fclose(fp);
|
|
if (k) {
|
|
*err_code = KEY_ERR_NONE;
|
|
diff --git a/tools/cert_create/src/main.c b/tools/cert_create/src/main.c
|
|
index b39378ca9..71bf85722 100644
|
|
--- a/tools/cert_create/src/main.c
|
|
+++ b/tools/cert_create/src/main.c
|
|
@@ -288,7 +288,12 @@ static const cmd_opt_t common_cmd_opt[] = {
|
|
{
|
|
{ "print-cert", no_argument, NULL, 'p' },
|
|
"Print the certificates in the standard output"
|
|
- }
|
|
+ },
|
|
+ {
|
|
+ { "rot-key-pwd", required_argument, NULL, 'r' },
|
|
+ "Password for the root key"
|
|
+ },
|
|
+
|
|
};
|
|
|
|
int main(int argc, char *argv[])
|
|
@@ -307,6 +312,7 @@ int main(int argc, char *argv[])
|
|
unsigned char md[SHA512_DIGEST_LENGTH];
|
|
unsigned int md_len;
|
|
const EVP_MD *md_info;
|
|
+ char *rot_key_pw = NULL;
|
|
|
|
NOTICE("CoT Generation Tool: %s\n", build_msg);
|
|
NOTICE("Target platform: %s\n", platform_msg);
|
|
@@ -344,7 +350,7 @@ int main(int argc, char *argv[])
|
|
|
|
while (1) {
|
|
/* getopt_long stores the option index here. */
|
|
- c = getopt_long(argc, argv, "a:b:hknps:", cmd_opt, &opt_idx);
|
|
+ c = getopt_long(argc, argv, "a:b:hknpr:s:", cmd_opt, &opt_idx);
|
|
|
|
/* Detect the end of the options. */
|
|
if (c == -1) {
|
|
@@ -378,6 +384,10 @@ int main(int argc, char *argv[])
|
|
case 'p':
|
|
print_cert = 1;
|
|
break;
|
|
+ case 'r':
|
|
+ rot_key_pw = malloc(sizeof(char) * strlen(optarg));
|
|
+ strncpy(rot_key_pw, optarg, strlen(optarg));
|
|
+ break;
|
|
case 's':
|
|
hash_alg = get_hash_alg(optarg);
|
|
if (hash_alg < 0) {
|
|
@@ -436,7 +446,7 @@ int main(int argc, char *argv[])
|
|
}
|
|
|
|
/* First try to load the key from disk */
|
|
- if (key_load(&keys[i], &err_code)) {
|
|
+ if (key_load(&keys[i], rot_key_pw, &err_code)) {
|
|
/* Key loaded successfully */
|
|
continue;
|
|
}
|
|
--
|
|
2.34.1
|
|
|