| Message ID | 0f920e6ee369718f3b7a0b9e07920383229715fd.1593045943.git.thiruan@linux.microsoft.com |
|---|---|
| State | Superseded |
| Delegated to: | Tom Rini |
| Headers | show |
| Series | Add support for multiple required keys | expand |
Hi Thirupathaiah, On Thu, 25 Jun 2020 at 09:51, Thirupathaiah Annapureddy <thiruan@linux.microsoft.com> wrote: > > Currently Verified Boot fails if there is a signature verification failure > using required key in U-boot DTB. This patch adds support for multiple > required keys. This means if verified boot passes with one of the required > keys, u-boot will continue the OS hand off. > > There was a prior attempt to resolve this with the following patch: > https://lists.denx.de/pipermail/u-boot/2019-April/366047.html > The above patch was failing "make tests". > > Signed-off-by: Thirupathaiah Annapureddy <thiruan@linux.microsoft.com> > --- > common/image-fit-sig.c | 12 +++++++++++- > 1 file changed, 11 insertions(+), 1 deletion(-) > > diff --git a/common/image-fit-sig.c b/common/image-fit-sig.c > index cc1967109e..4d25d4c541 100644 > --- a/common/image-fit-sig.c > +++ b/common/image-fit-sig.c > @@ -416,6 +416,8 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset, > { > int noffset; > int sig_node; > + int verified = 0; Can this be a bool? > + int reqd_sigs = 0; > > /* Work out what we need to verify */ > sig_node = fdt_subnode_offset(sig_blob, 0, FIT_SIG_NODENAME); > @@ -433,15 +435,23 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset, > NULL); > if (!required || strcmp(required, "conf")) > continue; > + > + reqd_sigs++; > + > ret = fit_config_verify_sig(fit, conf_noffset, sig_blob, > noffset); > if (ret) { > printf("Failed to verify required signature '%s'\n", > fit_get_name(sig_blob, noffset, NULL)); This message is confusing if we then decide that things are OK. I think it would be better to change the message to a positive "Verified required signatured xxx" if !ret > - return ret; > + } else { > + verified = 1; > + break; > } > } > > + if (reqd_sigs && !verified) > + return -EPERM; This needs a message, something like "No required signatures were verified" and then list them in a for() loop. > + > return 0; > } > > -- > 2.17.1 > Regards, Simon
Hi Thirupathaiah, On Mon, 29 Jun 2020 at 11:26, Simon Glass <sjg@chromium.org> wrote: > > Hi Thirupathaiah, > > On Thu, 25 Jun 2020 at 09:51, Thirupathaiah Annapureddy > <thiruan@linux.microsoft.com> wrote: > > > > Currently Verified Boot fails if there is a signature verification failure > > using required key in U-boot DTB. This patch adds support for multiple > > required keys. This means if verified boot passes with one of the required > > keys, u-boot will continue the OS hand off. > > > > There was a prior attempt to resolve this with the following patch: > > https://lists.denx.de/pipermail/u-boot/2019-April/366047.html > > The above patch was failing "make tests". > > > > Signed-off-by: Thirupathaiah Annapureddy <thiruan@linux.microsoft.com> > > --- > > common/image-fit-sig.c | 12 +++++++++++- > > 1 file changed, 11 insertions(+), 1 deletion(-) One more thing...this patch is changing the policy. I think we need a new string property in the DTB alongside the 'required' properly, that indicates whether the image must be signed with all required keys, or just one. Regards, Simon
On 25/06/2020 17.51, Thirupathaiah Annapureddy wrote: > Currently Verified Boot fails if there is a signature verification failure > using required key in U-boot DTB. This patch adds support for multiple > required keys. This means if verified boot passes with one of the required > keys, u-boot will continue the OS hand off. > > There was a prior attempt to resolve this with the following patch: > https://lists.denx.de/pipermail/u-boot/2019-April/366047.html > The above patch was failing "make tests". > > Signed-off-by: Thirupathaiah Annapureddy <thiruan@linux.microsoft.com> Hi Thirupathaiah This is something I'm quite interested in - see https://lists.denx.de/pipermail/u-boot/2020-January/396629.html . I just never got around to follow up on it due to other tasks. As Simon points out, the policy as to whether one or all (or some other choice) required keys must have signed the image needs to live in the .dtb. I'd appreciate it if you could cc me on subsequent revisions. Thanks, Rasmus
Hi Simon, Thanks a lot for reviewing the patch. I would appreciate if you could clarify the following in-line questions: On 6/29/2020 10:31 AM, Simon Glass wrote: > Hi Thirupathaiah, > > > On Mon, 29 Jun 2020 at 11:26, Simon Glass <sjg@chromium.org> wrote: >> >> Hi Thirupathaiah, >> >> On Thu, 25 Jun 2020 at 09:51, Thirupathaiah Annapureddy >> <thiruan@linux.microsoft.com> wrote: >>> >>> Currently Verified Boot fails if there is a signature verification failure >>> using required key in U-boot DTB. This patch adds support for multiple >>> required keys. This means if verified boot passes with one of the required >>> keys, u-boot will continue the OS hand off. >>> >>> There was a prior attempt to resolve this with the following patch: >>> https://lists.denx.de/pipermail/u-boot/2019-April/366047.html >>> The above patch was failing "make tests". >>> >>> Signed-off-by: Thirupathaiah Annapureddy <thiruan@linux.microsoft.com> >>> --- >>> common/image-fit-sig.c | 12 +++++++++++- >>> 1 file changed, 11 insertions(+), 1 deletion(-) > > One more thing...this patch is changing the policy. I assume you are referring to the policy of conf signing with all required keys instead of just one. I just wanted to double check. However I did not see any test in test_vboot.py for verifying this policy. So I thought signing with all required keys is not by design and it is an unintended bug. Could you please clarify on this? > > I think we need a new string property in the DTB alongside the > 'required' properly, that indicates whether the image must be signed > with all required keys, or just one. > > Regards, > Simon > Best Regards, Thiru
Hi Thirupathaiah, On Wed, 8 Jul 2020 at 16:47, Thirupathaiah Annapureddy <thiruan@linux.microsoft.com> wrote: > > Hi Simon, > > Thanks a lot for reviewing the patch. > > I would appreciate if you could clarify the following in-line questions: > > On 6/29/2020 10:31 AM, Simon Glass wrote: > > Hi Thirupathaiah, > > > > > > On Mon, 29 Jun 2020 at 11:26, Simon Glass <sjg@chromium.org> wrote: > >> > >> Hi Thirupathaiah, > >> > >> On Thu, 25 Jun 2020 at 09:51, Thirupathaiah Annapureddy > >> <thiruan@linux.microsoft.com> wrote: > >>> > >>> Currently Verified Boot fails if there is a signature verification failure > >>> using required key in U-boot DTB. This patch adds support for multiple > >>> required keys. This means if verified boot passes with one of the required > >>> keys, u-boot will continue the OS hand off. > >>> > >>> There was a prior attempt to resolve this with the following patch: > >>> https://lists.denx.de/pipermail/u-boot/2019-April/366047.html > >>> The above patch was failing "make tests". > >>> > >>> Signed-off-by: Thirupathaiah Annapureddy <thiruan@linux.microsoft.com> > >>> --- > >>> common/image-fit-sig.c | 12 +++++++++++- > >>> 1 file changed, 11 insertions(+), 1 deletion(-) > > > > One more thing...this patch is changing the policy. > > I assume you are referring to the policy of conf signing with all required > keys instead of just one. I just wanted to double check. The signing is a separate thing. My comment was about the verification step in U-Boot. We need a policy to say whether the config should be signed with all required keys or just one. > > However I did not see any test in test_vboot.py for verifying this policy. > So I thought signing with all required keys is not by design and it is > an unintended bug. Could you please clarify on this? As it is written, a required key is required, and the presence of a different required key doesn't change that. But I am happy to provide a way to change this policy. I just don't want to surprise people. Of course the policy change needs to be in the signature DTB, not the signed FIT. Yes you should add a test for the new behaviour. I am a bit worried about how long the vboot tests take so perhaps we can reduce this. > > > > > I think we need a new string property in the DTB alongside the > > 'required' properly, that indicates whether the image must be signed > > with all required keys, or just one. > > Regards, Simon
diff --git a/common/image-fit-sig.c b/common/image-fit-sig.c index cc1967109e..4d25d4c541 100644 --- a/common/image-fit-sig.c +++ b/common/image-fit-sig.c @@ -416,6 +416,8 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset, { int noffset; int sig_node; + int verified = 0; + int reqd_sigs = 0; /* Work out what we need to verify */ sig_node = fdt_subnode_offset(sig_blob, 0, FIT_SIG_NODENAME); @@ -433,15 +435,23 @@ int fit_config_verify_required_sigs(const void *fit, int conf_noffset, NULL); if (!required || strcmp(required, "conf")) continue; + + reqd_sigs++; + ret = fit_config_verify_sig(fit, conf_noffset, sig_blob, noffset); if (ret) { printf("Failed to verify required signature '%s'\n", fit_get_name(sig_blob, noffset, NULL)); - return ret; + } else { + verified = 1; + break; } } + if (reqd_sigs && !verified) + return -EPERM; + return 0; }
Currently Verified Boot fails if there is a signature verification failure using required key in U-boot DTB. This patch adds support for multiple required keys. This means if verified boot passes with one of the required keys, u-boot will continue the OS hand off. There was a prior attempt to resolve this with the following patch: https://lists.denx.de/pipermail/u-boot/2019-April/366047.html The above patch was failing "make tests". Signed-off-by: Thirupathaiah Annapureddy <thiruan@linux.microsoft.com> --- common/image-fit-sig.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)