Changes to allow user-signed kernels to be generated.

utility/vbutil_kernel.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Verified boot kernel utility
  */
 
 #include <errno.h>
 #include <getopt.h>
 #include <inttypes.h>  /* For PRIu64 */
@@ skipping 58 matching lines @@
 /* Print help and return error */
 static int PrintHelp(char *progname) {
   fprintf(stderr,
           "This program creates, signs, and verifies the kernel blob\n");
   fprintf(stderr,
           "\n"
           "Usage:  %s --pack <file> [PARAMETERS]\n"
           "\n"
           "  Required parameters:\n"
           "    --keyblock <file>         Key block in .keyblock format\n"
-          "    --signprivate <file>      Signing private key in .pem format\n"
+          "    --signprivate <file>"
+          "      Private key to sign kernel data, in .vbprivk format\n"
           "    --version <number>        Kernel version\n"
           "    --vmlinuz <file>          Linux kernel bzImage file\n"
           "    --bootloader <file>       Bootloader stub\n"
           "    --config <file>           Command line file\n"
           "\n"
           "  Optional:\n"
           "    --pad <number>            Verification padding size in bytes\n"
           "    --vblockonly              Emit just the verification blob\n",
           progname);
   fprintf(stderr,
           "\nOR\n\n"
           "Usage:  %s --repack <file> [PARAMETERS]\n"
           "\n"
           "  Required parameters (of --keyblock and --config at least "
           "one is required):\n"
           "    --keyblock <file>         Key block in .keyblock format\n"
-          "    --signprivate <file>      Signing private key in .pem format\n"
+          "    --signprivate <file>"
+          "      Private key to sign kernel data, in .vbprivk format\n"
           "    --oldblob <file>          Previously packed kernel blob\n"
           "    --config <file>           New command line file\n"
           "\n"
           "  Optional:\n"
           "    --pad <number>            Verification padding size in bytes\n"
           "    --vblockonly              Emit just the verification blob\n",
           progname);
   fprintf(stderr,
           "\nOR\n\n"
           "Usage:  %s --verify <file> [PARAMETERS]\n"
           "\n"
-          "  Required parameters:\n"
-          "    --signpubkey <file>       Signing public key in .vbpubk format\n"
-          "\n"
           "  Optional:\n"
+          "    --signpubkey <file>"
+          "       Public key to verify kernel keyblock, in .vbpubk format\n"
           "    --verbose                 Print a more detailed report\n"
           "\n",
           progname);
   return 1;
 }
 
 static void Debug(const char *format, ...) {
   if (!opt_debug)
     return;
 
@@ skipping 482 matching lines @@
   Memcpy(BpCmdLineLocation(bp), new_conf, config_size);
   Free(new_conf);
   return 0;
 }
 
 static int Verify(const char* infile, const char* signpubkey, int verbose) {
 
   VbKeyBlockHeader* key_block;
   VbKernelPreambleHeader* preamble;
   VbPublicKey* data_key;
-  VbPublicKey* sign_key;
+  VbPublicKey* sign_key = NULL;
   RSAPublicKey* rsa;
   blob_t* bp;
   uint64_t now;
   int rv = 1;
 
-  if (!infile || !signpubkey) {
-    error("Must specify filename and signpubkey\n");
+  if (!infile) {
+    error("Must specify filename\n");
     return 1;
   }
 
   /* Read public signing key */
-  sign_key = PublicKeyRead(signpubkey);
-  if (!sign_key) {
-    error("Error reading signpubkey.\n");
-    return 1;
+  if (signpubkey) {
+    sign_key = PublicKeyRead(signpubkey);
+    if (!sign_key) {
+      error("Error reading signpubkey.\n");
+      return 1;
+    }
   }
 
   /* Read blob */
   bp = OldBlob(infile);
   if (!bp) {
     error("Error reading input file\n");
     return 1;
   }
 
   /* Verify key block */
   key_block = bp->key_block;
   if (0 != KeyBlockVerify(key_block, bp->blob_size, sign_key)) {
     error("Error verifying key block.\n");
     goto verify_exit;
   }
   now = key_block->key_block_size;
 
   printf("Key block:\n");
   data_key = &key_block->data_key;
+  if (verbose)
+    printf("  Signature:           %s\n", sign_key ? "valid" : "ignored");
   printf("  Size:                0x%" PRIx64 "\n", key_block->key_block_size);
   printf("  Data key algorithm:  %" PRIu64 " %s\n", data_key->algorithm,
          (data_key->algorithm < kNumAlgorithms ?
           algo_strings[data_key->algorithm] : "(invalid)"));
   printf("  Data key version:    %" PRIu64 "\n", data_key->key_version);
   printf("  Flags:               %" PRIu64 "\n", key_block->key_block_flags);
 
   rsa = PublicKeyToRSA(&key_block->data_key);
   if (!rsa) {
     error("Error parsing data key.\n");
     goto verify_exit;
   }
 
   /* Verify preamble */
   preamble = bp->preamble;
   if (0 != VerifyKernelPreamble(
-          preamble, bp->blob_size - key_block->key_block_size, rsa)) {
+        preamble, bp->blob_size - key_block->key_block_size, rsa)) {
     error("Error verifying preamble.\n");
     goto verify_exit;
   }
   now += preamble->preamble_size;
 
   printf("Preamble:\n");
   printf("  Size:                0x%" PRIx64 "\n", preamble->preamble_size);
   printf("  Header version:      %" PRIu32 ".%" PRIu32"\n",
          preamble->header_version_major, preamble->header_version_minor);
   printf("  Kernel version:      %" PRIu64 "\n", preamble->kernel_version);
@@ skipping 54 matching lines @@
 
   while (((i = getopt_long(argc, argv, ":", long_opts, NULL)) != -1) &&
          !parse_error) {
     switch (i) {
       default:
       case '?':
         /* Unhandled option */
         parse_error = 1;
         break;
 
+      case 0:
+        /* silently handled option */
+        break;
+
       case OPT_MODE_PACK:
       case OPT_MODE_REPACK:
       case OPT_MODE_VERIFY:
         if (mode && (mode != i)) {
           fprintf(stderr, "Only single mode can be specified\n");
           parse_error = 1;
           break;
         }
         mode = i;
         filename = optarg;
@@ skipping 84 matching lines @@
 
     case OPT_MODE_VERIFY:
       return Verify(filename, signpubkey, verbose);
 
     default:
       fprintf(stderr,
               "You must specify a mode: --pack, --repack or --verify\n");
       return PrintHelp(progname);
   }
 }