diff mbox series

[V4,3/8] parser: Read temporary AES key from sw-description

Message ID 20240115192845.51530-4-Michael.Glembotzki@iris-sensing.com
State New
Delegated to: Stefano Babic
Headers show
Series Add support for asymmetric decryption | expand

Commit Message

Michael Glembotzki Jan. 15, 2024, 7:26 p.m. UTC 
With CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION, a temporary AES key can be
provided with the sw-description file.

Make an explicit size check of the field string before setting the
temporary AES key. Only set the image AES key if a valid key length is
given.

Clear the temporary AES key after the update is done.

Signed-off-by: Michael Glembotzki <Michael.Glembotzki@iris-sensing.com>
---
 core/stream_interface.c |  4 ++++
 parser/parser.c         | 26 ++++++++++++++++++++++++++
 2 files changed, 30 insertions(+)
diff mbox series

Patch

diff --git a/core/stream_interface.c b/core/stream_interface.c
index 0b78329..1cd148f 100644
--- a/core/stream_interface.c
+++ b/core/stream_interface.c
@@ -703,6 +703,10 @@  void *network_initializer(void *data)
 		/* release temp files we may have created */
 		cleanup_files(software);
 
+#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION
+		clear_tmp_aes_key();
+#endif
+
 #ifndef CONFIG_NOCLEANUP
 		swupdate_remove_directory(SCRIPTS_DIR_SUFFIX);
 		swupdate_remove_directory(DATADST_DIR_SUFFIX);
diff --git a/parser/parser.c b/parser/parser.c
index 67ae1b3..70cc548 100644
--- a/parser/parser.c
+++ b/parser/parser.c
@@ -240,6 +240,32 @@  static bool get_common_fields(parsertype p, void *cfg, struct swupdate_cfg *swcf
 		TRACE("Namespaced used to store SWUpdate's vars: %s", swcfg->namespace_for_vars);
 	}
 
+#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION
+	/*
+	 * Set sw-description aes-key, if present
+	 */
+	if ((setting = find_node(p, cfg, "aes-key", swcfg)) != NULL) {
+		char aeskey_ascii[AES_256_KEY_LEN * 2 + 1] = {0};
+		size_t keylen;
+		const char *s = get_field_string(p, setting, NULL);
+
+		if (s) {
+			keylen = strnlen(s, SWUPDATE_GENERAL_STRING_SIZE);
+
+			if (!is_valid_aes_keylen(keylen))
+				return false;
+
+			strncpy(aeskey_ascii, s, keylen);
+		}
+		if (!s || !strlen(aeskey_ascii) || set_tmp_aes_key(aeskey_ascii)) {
+			ERROR("Provided aes-key in the sw-description file is invalid!");
+			return false;
+		}
+	} else {
+		TRACE("No AES key in the sw-description file.");
+	}
+#endif
+
 	return true;
 }