From a739b59efe7996e3bdcbe8b17743dc05ac7c110a Mon Sep 17 00:00:00 2001 From: Sascha Hauer Date: Tue, 6 Aug 2019 12:49:28 +0200 Subject: mkfs.ubifs: Add authentication support This adds support for authenticated UBIFS images. In authenticated images all UBIFS nodes are hashed as described in the UBIFS authentication whitepaper. Additionally the superblock node contains a hash of the master node and itself is cryptographically signed in a node following the superblock node. The signature is in PKCS #7 CMS format. To generate an authenticated image these options are necessary: --hash-algo=NAME hash algorithm to use for signed images (Valid options include sha1, sha256, sha512) --auth-key=FILE filename or PKCS #11 uri containing the authentication key for signing --auth-cert=FILE Authentication certificate filename for signing. Unused when certificate is provided via PKCS #11 Signed-off-by: Sascha Hauer Signed-off-by: David Oberhollenzer --- ubifs-utils/mkfs.ubifs/lpt.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'ubifs-utils/mkfs.ubifs/lpt.c') diff --git a/ubifs-utils/mkfs.ubifs/lpt.c b/ubifs-utils/mkfs.ubifs/lpt.c index 6aa0b88..7ee739a 100644 --- a/ubifs-utils/mkfs.ubifs/lpt.c +++ b/ubifs-utils/mkfs.ubifs/lpt.c @@ -22,6 +22,10 @@ #include "mkfs.ubifs.h" +#ifdef WITH_CRYPTO +#include +#endif + /** * do_calc_lpt_geom - calculate sizes for the LPT area. * @c: the UBIFS file-system description object @@ -374,6 +378,7 @@ int create_lpt(struct ubifs_info *c) struct ubifs_nnode *nnode = NULL; void *buf = NULL, *p; int *lsave = NULL; + unsigned int md_len; pnode = malloc(sizeof(struct ubifs_pnode)); nnode = malloc(sizeof(struct ubifs_nnode)); @@ -386,6 +391,8 @@ int create_lpt(struct ubifs_info *c) memset(pnode, 0 , sizeof(struct ubifs_pnode)); memset(nnode, 0 , sizeof(struct ubifs_nnode)); + hash_digest_init(); + c->lscan_lnum = c->main_first; lnum = c->lpt_first; @@ -429,6 +436,9 @@ int create_lpt(struct ubifs_info *c) } } pack_pnode(c, p, pnode); + + hash_digest_update(p, c->pnode_sz); + p += c->pnode_sz; len += c->pnode_sz; /* @@ -439,6 +449,8 @@ int create_lpt(struct ubifs_info *c) pnode->num += 1; } + hash_digest_final(c->lpt_hash, &md_len); + row = c->lpt_hght - 1; /* Add all nnodes, one level at a time */ while (1) { -- cgit v1.2.3