From ef40129c33396d90a42e10f4a772390ac5b2ba05 Mon Sep 17 00:00:00 2001 From: Patrick Oppenlander Date: Thu, 30 Jul 2020 14:30:47 +1000 Subject: [PATCH] mkimage: fit: include image cipher in configuration signature This patch addresses issue #2 for signed configurations. -----8<----- Including the image cipher properties in the configuration signature prevents an attacker from modifying cipher, key or iv properties. Signed-off-by: Patrick Oppenlander Reviewed-by: Philippe Reynes --- tools/image-host.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/tools/image-host.c b/tools/image-host.c index e5417be..3d52593 100644 --- a/tools/image-host.c +++ b/tools/image-host.c @@ -744,6 +744,23 @@ static int fit_config_get_hash_list(void *fit, int conf_noffset, return -ENOMSG; } + /* Add this image's cipher node if present */ + noffset = fdt_subnode_offset(fit, image_noffset, + FIT_CIPHER_NODENAME); + if (noffset != -FDT_ERR_NOTFOUND) { + if (noffset < 0) { + printf("Failed to get cipher node in configuration '%s/%s' image '%s': %s\n", + conf_name, sig_name, iname, + fdt_strerror(noffset)); + return -EIO; + } + ret = fdt_get_path(fit, noffset, path, sizeof(path)); + if (ret < 0) + goto err_path; + if (strlist_add(node_inc, path)) + goto err_mem; + } + image_count++; } -- 2.7.4