1# SPDX-License-Identifier: GPL-2.0+
2# Copyright (c) 2022 Massimo Pegorer
3
4"""
5Test that mkimage generates auto-FIT with signatures and/or hashes as expected.
6
7The mkimage tool can create auto generated (i.e. without an ITS file
8provided as input) FIT in three different flavours: with crc32 checksums
9of 'images' subnodes; with signatures of 'images' subnodes; with sha1
10hashes of 'images' subnodes and signatures of 'configurations' subnodes.
11This test verifies that auto-FIT are generated as expected, in all of
12the three flavours, including check of hashes and signatures (except for
13configurations ones).
14
15The test does not run the sandbox. It only checks the host tool mkimage.
16"""
17
18import os
19import pytest
20import utils
21import binascii
22from Cryptodome.Hash import SHA1
23from Cryptodome.Hash import SHA256
24from Cryptodome.PublicKey import RSA
25from Cryptodome.Signature import pkcs1_15
26
27class SignedFitHelper(object):
28    """Helper to manipulate a FIT with signed/hashed images/configs."""
29    def __init__(self, ubman, file_name):
30        self.fit = file_name
31        self.ubman = ubman
32        self.images_nodes = set()
33        self.confgs_nodes = set()
34
35    def __fdt_list(self, path):
36        return utils.run_and_log(self.ubman,
37            f'fdtget -l {self.fit} {path}')
38
39    def __fdt_get_string(self, node, prop):
40        return utils.run_and_log(self.ubman,
41            f'fdtget -ts {self.fit} {node} {prop}')
42
43    def __fdt_get_binary(self, node, prop):
44        numbers = utils.run_and_log(self.ubman,
45            f'fdtget -tbi {self.fit} {node} {prop}')
46
47        bignum = bytearray()
48        for little_num in numbers.split():
49            bignum.append(int(little_num))
50
51        return bignum
52
53    def build_nodes_sets(self):
54        """Fill sets with FIT images and configurations subnodes."""
55        for node in self.__fdt_list('/images').split():
56            subnode = f'/images/{node}'
57            self.images_nodes.add(subnode)
58
59        for node in self.__fdt_list('/configurations').split():
60            subnode = f'/configurations/{node}'
61            self.confgs_nodes.add(subnode)
62
63        return len(self.images_nodes) + len(self.confgs_nodes)
64
65    def check_fit_crc32_images(self):
66        """Test that all images in the set are hashed as expected.
67
68        Each image must have an hash with algo=crc32 and hash value must match
69        the one calculated over image data.
70        """
71        for node in self.images_nodes:
72            algo = self.__fdt_get_string(f'{node}/hash', 'algo')
73            assert algo == "crc32\n", "Missing expected crc32 image hash!"
74
75            raw_crc32 = self.__fdt_get_binary(f'{node}/hash', 'value')
76            raw_bin = self.__fdt_get_binary(node, 'data')
77            assert raw_crc32 == (binascii.crc32(raw_bin) &
78                0xffffffff).to_bytes(4, 'big'), "Wrong crc32 hash!"
79
80    def check_fit_signed_images(self, key_name, sign_algo, verifier):
81        """Test that all images in the set are signed as expected.
82
83        Each image must have a signature with: key-name-hint matching key_name
84        argument; algo matching sign_algo argument; value matching the one
85        calculated over image data using verifier argument.
86        """
87        for node in self.images_nodes:
88            hint = self.__fdt_get_string(f'{node}/signature', 'key-name-hint')
89            assert hint == key_name + "\n", "Missing expected key name hint!"
90            algo = self.__fdt_get_string(f'{node}/signature', 'algo')
91            assert algo == sign_algo + "\n", "Missing expected signature algo!"
92
93            raw_sig = self.__fdt_get_binary(f'{node}/signature', 'value')
94            raw_bin = self.__fdt_get_binary(node, 'data')
95            verifier.verify(SHA256.new(raw_bin), bytes(raw_sig))
96
97    def check_fit_signed_confgs(self, key_name, sign_algo):
98        """Test that all configs are signed, and images hashed, as expected.
99
100        Each image must have an hash with algo=sha1 and hash value must match
101        the one calculated over image data. Each configuration must have a
102        signature with key-name-hint matching key_name argument and algo
103        matching sign_algo argument.
104        TODO: configurations signature checking.
105        """
106        for node in self.images_nodes:
107            algo = self.__fdt_get_string(f'{node}/hash', 'algo')
108            assert algo == "sha1\n", "Missing expected sha1 image hash!"
109
110            raw_hash = self.__fdt_get_binary(f'{node}/hash', 'value')
111            raw_bin = self.__fdt_get_binary(node, 'data')
112            assert raw_hash == SHA1.new(raw_bin).digest(), "Wrong sha1 hash!"
113
114        for node in self.confgs_nodes:
115            hint = self.__fdt_get_string(f'{node}/signature', 'key-name-hint')
116            assert hint == key_name + "\n", "Missing expected key name hint!"
117            algo = self.__fdt_get_string(f'{node}/signature', 'algo')
118            assert algo == sign_algo + "\n", "Missing expected signature algo!"
119
120
121@pytest.mark.buildconfigspec('fit_signature')
122@pytest.mark.requiredtool('fdtget')
123def test_fit_auto_signed(ubman):
124    """Test that mkimage generates auto-FIT with signatures/hashes as expected.
125
126    The mkimage tool can create auto generated (i.e. without an ITS file
127    provided as input) FIT in three different flavours: with crc32 checksums
128    of 'images' subnodes; with signatures of 'images' subnodes; with sha1
129    hashes of 'images' subnodes and signatures of 'configurations' subnodes.
130    This test verifies that auto-FIT are generated as expected, in all of
131    the three flavours, including check of hashes and signatures (except for
132    configurations ones).
133
134    The test does not run the sandbox. It only checks the host tool mkimage.
135    """
136    mkimage = ubman.config.build_dir + '/tools/mkimage'
137    tempdir = os.path.join(ubman.config.result_dir, 'auto_fit')
138    os.makedirs(tempdir, exist_ok=True)
139    kernel_file = f'{tempdir}/vmlinuz'
140    dt1_file = f'{tempdir}/dt-1.dtb'
141    dt2_file = f'{tempdir}/dt-2.dtb'
142    key_name = 'sign-key'
143    sign_algo = 'sha256,rsa4096'
144    key_file = f'{tempdir}/{key_name}.key'
145    fit_file = f'{tempdir}/test.fit'
146
147    # Create a fake kernel image and two dtb files with random data
148    with open(kernel_file, 'wb') as fd:
149        fd.write(os.urandom(512))
150
151    with open(dt1_file, 'wb') as fd:
152        fd.write(os.urandom(256))
153
154    with open(dt2_file, 'wb') as fd:
155        fd.write(os.urandom(256))
156
157    # Create 4096 RSA key and write to file to be read by mkimage
158    key = RSA.generate(bits=4096)
159    verifier = pkcs1_15.new(key)
160
161    with open(key_file, 'w') as fd:
162        fd.write(str(key.export_key(format='PEM').decode('ascii')))
163
164    b_args = " -d" + kernel_file + " -b" + dt1_file + " -b" + dt2_file
165    s_args = " -k" + tempdir + " -g" + key_name + " -o" + sign_algo
166
167    # 1 - Create auto FIT with images crc32 checksum, and verify it
168    utils.run_and_log(ubman, mkimage + ' -fauto' + b_args + " " + fit_file)
169
170    fit = SignedFitHelper(ubman, fit_file)
171    if fit.build_nodes_sets() == 0:
172        raise ValueError('FIT-1 has no "/image" nor "/configuration" nodes')
173
174    fit.check_fit_crc32_images()
175
176    # 2 - Create auto FIT with signed images, and verify it
177    utils.run_and_log(ubman, mkimage + ' -fauto' + b_args + s_args + " " +
178                      fit_file)
179
180    fit = SignedFitHelper(ubman, fit_file)
181    if fit.build_nodes_sets() == 0:
182        raise ValueError('FIT-2 has no "/image" nor "/configuration" nodes')
183
184    fit.check_fit_signed_images(key_name, sign_algo, verifier)
185
186    # 3 - Create auto FIT with signed configs and hashed images, and verify it
187    utils.run_and_log(ubman, mkimage + ' -fauto-conf' + b_args + s_args + " " +
188                      fit_file)
189
190    fit = SignedFitHelper(ubman, fit_file)
191    if fit.build_nodes_sets() == 0:
192        raise ValueError('FIT-3 has no "/image" nor "/configuration" nodes')
193
194    fit.check_fit_signed_confgs(key_name, sign_algo)
195