OLD | NEW |
1 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved. | 1 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved. |
2 * Use of this source code is governed by a BSD-style license that can be | 2 * Use of this source code is governed by a BSD-style license that can be |
3 * found in the LICENSE file. | 3 * found in the LICENSE file. |
4 * | 4 * |
5 * Verified boot kernel utility | 5 * Verified boot kernel utility |
6 */ | 6 */ |
7 | 7 |
8 #include <errno.h> | 8 #include <errno.h> |
9 #include <getopt.h> | 9 #include <getopt.h> |
10 #include <inttypes.h> /* For PRIu64 */ | 10 #include <inttypes.h> /* For PRIu64 */ |
(...skipping 94 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
105 " --vblockonly Emit just the verification blob\n", | 105 " --vblockonly Emit just the verification blob\n", |
106 progname); | 106 progname); |
107 fprintf(stderr, | 107 fprintf(stderr, |
108 "\nOR\n\n" | 108 "\nOR\n\n" |
109 "Usage: %s --verify <file> [PARAMETERS]\n" | 109 "Usage: %s --verify <file> [PARAMETERS]\n" |
110 "\n" | 110 "\n" |
111 " Optional:\n" | 111 " Optional:\n" |
112 " --signpubkey <file>" | 112 " --signpubkey <file>" |
113 " Public key to verify kernel keyblock, in .vbpubk format\n" | 113 " Public key to verify kernel keyblock, in .vbpubk format\n" |
114 " --verbose Print a more detailed report\n" | 114 " --verbose Print a more detailed report\n" |
| 115 " --keyblock <file>" |
| 116 " Outputs the verified key block, in .keyblock format\n" |
115 "\n", | 117 "\n", |
116 progname); | 118 progname); |
117 return 1; | 119 return 1; |
118 } | 120 } |
119 | 121 |
120 static void Debug(const char *format, ...) { | 122 static void Debug(const char *format, ...) { |
121 if (!opt_debug) | 123 if (!opt_debug) |
122 return; | 124 return; |
123 | 125 |
124 va_list ap; | 126 va_list ap; |
(...skipping 499 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
624 return 1; | 626 return 1; |
625 } | 627 } |
626 | 628 |
627 /* fill the config buffer with zeros */ | 629 /* fill the config buffer with zeros */ |
628 Memset(BpCmdLineLocation(bp), 0, CROS_CONFIG_SIZE); | 630 Memset(BpCmdLineLocation(bp), 0, CROS_CONFIG_SIZE); |
629 Memcpy(BpCmdLineLocation(bp), new_conf, config_size); | 631 Memcpy(BpCmdLineLocation(bp), new_conf, config_size); |
630 Free(new_conf); | 632 Free(new_conf); |
631 return 0; | 633 return 0; |
632 } | 634 } |
633 | 635 |
634 static int Verify(const char* infile, const char* signpubkey, int verbose) { | 636 static int Verify(const char* infile, const char* signpubkey, int verbose, |
| 637 const char* key_block_file) { |
635 | 638 |
636 VbKeyBlockHeader* key_block; | 639 VbKeyBlockHeader* key_block; |
637 VbKernelPreambleHeader* preamble; | 640 VbKernelPreambleHeader* preamble; |
638 VbPublicKey* data_key; | 641 VbPublicKey* data_key; |
639 VbPublicKey* sign_key = NULL; | 642 VbPublicKey* sign_key = NULL; |
640 RSAPublicKey* rsa; | 643 RSAPublicKey* rsa; |
641 blob_t* bp; | 644 blob_t* bp; |
642 uint64_t now; | 645 uint64_t now; |
643 int rv = 1; | 646 int rv = 1; |
644 | 647 |
(...skipping 20 matching lines...) Expand all Loading... |
665 | 668 |
666 /* Verify key block */ | 669 /* Verify key block */ |
667 key_block = bp->key_block; | 670 key_block = bp->key_block; |
668 if (0 != KeyBlockVerify(key_block, bp->blob_size, sign_key, | 671 if (0 != KeyBlockVerify(key_block, bp->blob_size, sign_key, |
669 (sign_key ? 0 : 1))) { | 672 (sign_key ? 0 : 1))) { |
670 error("Error verifying key block.\n"); | 673 error("Error verifying key block.\n"); |
671 goto verify_exit; | 674 goto verify_exit; |
672 } | 675 } |
673 now = key_block->key_block_size; | 676 now = key_block->key_block_size; |
674 | 677 |
| 678 if (key_block_file) { |
| 679 FILE* f = NULL; |
| 680 f = fopen(key_block_file, "wb"); |
| 681 if (!f) { |
| 682 error("Can't open key block file %s\n", key_block_file); |
| 683 return 1; |
| 684 } |
| 685 if (1 != fwrite(key_block, key_block->key_block_size, 1, f)) { |
| 686 error("Can't write key block file %s\n", key_block_file); |
| 687 return 1; |
| 688 } |
| 689 fclose(f); |
| 690 } |
| 691 |
675 printf("Key block:\n"); | 692 printf("Key block:\n"); |
676 data_key = &key_block->data_key; | 693 data_key = &key_block->data_key; |
677 if (verbose) | 694 if (verbose) |
678 printf(" Signature: %s\n", sign_key ? "valid" : "ignored"); | 695 printf(" Signature: %s\n", sign_key ? "valid" : "ignored"); |
679 printf(" Size: 0x%" PRIx64 "\n", key_block->key_block_size); | 696 printf(" Size: 0x%" PRIx64 "\n", key_block->key_block_size); |
680 printf(" Flags: %" PRIu64 " ", key_block->key_block_flags); | 697 printf(" Flags: %" PRIu64 " ", key_block->key_block_flags); |
681 if (key_block->key_block_flags & KEY_BLOCK_FLAG_DEVELOPER_0) | 698 if (key_block->key_block_flags & KEY_BLOCK_FLAG_DEVELOPER_0) |
682 printf(" !DEV"); | 699 printf(" !DEV"); |
683 if (key_block->key_block_flags & KEY_BLOCK_FLAG_DEVELOPER_1) | 700 if (key_block->key_block_flags & KEY_BLOCK_FLAG_DEVELOPER_1) |
684 printf(" DEV"); | 701 printf(" DEV"); |
(...skipping 191 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
876 if (!r) { | 893 if (!r) { |
877 if (version >= 0) { | 894 if (version >= 0) { |
878 bp->kernel_version = (uint64_t) version; | 895 bp->kernel_version = (uint64_t) version; |
879 } | 896 } |
880 r = Pack(filename, key_block_file, signprivate, bp, pad, vblockonly); | 897 r = Pack(filename, key_block_file, signprivate, bp, pad, vblockonly); |
881 } | 898 } |
882 FreeBlob(bp); | 899 FreeBlob(bp); |
883 return r; | 900 return r; |
884 | 901 |
885 case OPT_MODE_VERIFY: | 902 case OPT_MODE_VERIFY: |
886 return Verify(filename, signpubkey, verbose); | 903 return Verify(filename, signpubkey, verbose, key_block_file); |
887 | 904 |
888 default: | 905 default: |
889 fprintf(stderr, | 906 fprintf(stderr, |
890 "You must specify a mode: --pack, --repack or --verify\n"); | 907 "You must specify a mode: --pack, --repack or --verify\n"); |
891 return PrintHelp(progname); | 908 return PrintHelp(progname); |
892 } | 909 } |
893 } | 910 } |
OLD | NEW |