diff mbox series

[v5,12/16] decrypt_keys.c: Store key filename for opensslCMS decryption

Message ID 20250904115704.58413-13-Michael.Glembotzki@iris-sensing.com
State Changes Requested
Delegated to: Stefano Babic
Headers show
Series Add support for asymmetric decryption | expand

Commit Message

Michael Glembotzki Sept. 4, 2025, 11:49 a.m. UTC 
From: Stefano Babic <stefano.babic@swupdate.org>

For asymmetric encrypted sw-description with OpenSSL CMS, the decryption
key is now stored as the provided filename instead of parsing the key in
advance. This lets the openssl_CMS_DECRYPT_init() handle key loading
directly from the file.

Signed-off-by: Michael Glembotzki <Michael.Glembotzki@iris-sensing.com>
---
 core/decrypt_keys.c | 29 ++++++++++++++++++++++++++++-
 include/util.h      |  1 +
 2 files changed, 29 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/core/decrypt_keys.c b/core/decrypt_keys.c
index f5b6296d..969a3cdc 100644
--- a/core/decrypt_keys.c
+++ b/core/decrypt_keys.c
@@ -17,7 +17,8 @@ 
 
 /*
  * key    is 256 bit for max aes_256
- *	  or is a pkcs#11 URL
+ *        or is a pkcs#11 URL
+ *        or a cms key file name
  * keylen is the actual aes key length
  * ivt    is 128 bit
  */
@@ -29,6 +30,28 @@  struct decryption_key {
 
 static struct decryption_key *decrypt_keys = NULL;
 
+int set_filename_as_key(const char *fname)
+{
+	size_t len;
+	if (!decrypt_keys) {
+		decrypt_keys = (struct decryption_key *)calloc(1, sizeof(*decrypt_keys));
+		if (!decrypt_keys)
+			return -ENOMEM;
+	}
+	len = strlen(fname);
+
+	if (decrypt_keys->key)
+		free(decrypt_keys->key);
+
+	decrypt_keys->key = calloc(1, len + 1);
+	if (!decrypt_keys->key)
+		return -ENOMEM;
+
+	decrypt_keys->keylen = len;
+	strncpy(decrypt_keys->key, fname, len);
+	return 0;
+}
+
 int set_aes_key(const char *key, const char *ivt)
 {
 	int ret;
@@ -98,6 +121,10 @@  int load_decryption_key(char *fname)
 	char *b1 = NULL, *b2 = NULL;
 	int ret;
 
+#ifdef CONFIG_ASYM_ENCRYPTED_SW_DESCRIPTION
+	return set_filename_as_key(fname);
+#endif
+
 	fp = fopen(fname, "r");
 	if (!fp)
 		return -EBADF;
diff --git a/include/util.h b/include/util.h
index e9704743..b3121ddb 100644
--- a/include/util.h
+++ b/include/util.h
@@ -296,6 +296,7 @@  char *swupdate_get_decrypt_key(void);
 char swupdate_get_decrypt_keylen(void);
 unsigned char *get_aes_ivt(void);
 int set_aes_key(const char *key, const char *ivt);
+int set_filename_as_key(const char *fname);
 
 /* Getting global information */
 int get_install_info(char *buf, size_t len);