|
34 | 34 | #include "mbedtls/rsa.h" |
35 | 35 | #include "mbedtls/pk.h" |
36 | 36 | #include "mbedtls/ssl.h" |
| 37 | +#include "mbedtls/error.h" |
37 | 38 |
|
38 | 39 | #include <stdio.h> |
39 | 40 | #include <stdlib.h> |
@@ -279,44 +280,64 @@ static int _crypto_sha256(const unsigned char *src, size_t src_len, unsigned cha |
279 | 280 |
|
280 | 281 | static int _pk_verify(const unsigned char *sig, const unsigned char *hash) |
281 | 282 | { |
282 | | - int ret; |
| 283 | + int ret; |
283 | 284 |
|
284 | | - mbedtls_pk_context pk; |
| 285 | + mbedtls_pk_context pk; |
285 | 286 |
|
286 | | - unsigned char *public_key = (unsigned char *) public_key_start; |
287 | | - unsigned int public_key_len = public_key_end - public_key_start; |
| 287 | + unsigned char *public_key = (unsigned char *) public_key_start; |
| 288 | + unsigned int public_key_len = public_key_end - public_key_start; |
| 289 | + unsigned char *public_key_buffer = NULL; |
288 | 290 |
|
289 | | - mbedtls_pk_init( &pk ); |
| 291 | + public_key_buffer = (unsigned char *)malloc(public_key_len + 1); |
| 292 | + if (!public_key_buffer) { |
| 293 | + printf("Couldn't allocate memory \n"); |
| 294 | + return -1; |
| 295 | + } |
290 | 296 |
|
291 | | - ret = mbedtls_pk_parse_public_key( &pk, (const unsigned char *)public_key, public_key_len ); |
292 | | - if (ret != 0) { |
293 | | - printf("Parse error: 0x%04X\n", ret); |
294 | | - goto clean_up; |
295 | | - } |
| 297 | + memcpy(public_key_buffer, public_key, public_key_len); |
| 298 | + public_key_buffer[public_key_len] = '\0'; |
296 | 299 |
|
297 | | - if (!mbedtls_pk_can_do( &pk, MBEDTLS_PK_RSA)) |
298 | | - { |
299 | | - printf("Failed! Key is not an RSA key\n"); |
300 | | - ret = MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; |
301 | | - goto clean_up; |
302 | | - } |
| 300 | + mbedtls_pk_init( &pk ); |
303 | 301 |
|
304 | | - ret = mbedtls_rsa_check_pubkey(mbedtls_pk_rsa(pk)); |
305 | | - if (ret != 0) { |
306 | | - printf("Check pubkey failed: 0x%04X\n", ret); |
307 | | - goto clean_up; |
308 | | - } |
| 302 | + ret = mbedtls_pk_parse_public_key( &pk, (const unsigned char *)public_key_buffer, public_key_len + 1 ); |
| 303 | + if (ret != 0) { |
| 304 | + char error_buf[100]; |
| 305 | + mbedtls_strerror( ret, error_buf, 100); |
| 306 | + printf( "parse error -0x%04x - %s \n", -ret, error_buf ); |
| 307 | + goto clean_up; |
| 308 | + } |
309 | 309 |
|
310 | | - if ((ret = mbedtls_pk_verify(&pk, MBEDTLS_MD_SHA256, hash, OTA_CRYPTO_SHA256_LEN, sig, OTA_SIGNATURE_SIZE)) != 0 ) { |
311 | | - printf("Invalid firmware : 0x%04X\n", ret); |
312 | | - goto clean_up; |
313 | | - } |
| 310 | + if (!mbedtls_pk_can_do( &pk, MBEDTLS_PK_RSA)) |
| 311 | + { |
| 312 | + printf("Failed! Key is not an RSA key\n"); |
| 313 | + ret = MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; |
| 314 | + goto clean_up; |
| 315 | + } |
| 316 | + |
| 317 | + ret = mbedtls_rsa_check_pubkey(mbedtls_pk_rsa(pk)); |
| 318 | + if (ret != 0) { |
| 319 | + char error_buf[100]; |
| 320 | + mbedtls_strerror( ret, error_buf, 100); |
| 321 | + printf( "parse error -0x%04x - %s \n", -ret, error_buf ); |
| 322 | + goto clean_up; |
| 323 | + } |
| 324 | + |
| 325 | + if ((ret = mbedtls_pk_verify(&pk, MBEDTLS_MD_SHA256, hash, OTA_CRYPTO_SHA256_LEN, sig, OTA_SIGNATURE_SIZE)) != 0 ) { |
| 326 | + char error_buf[100]; |
| 327 | + mbedtls_strerror( ret, error_buf, 100); |
| 328 | + printf( "parse error -0x%04x - %s \n", -ret, error_buf ); |
| 329 | + goto clean_up; |
| 330 | + } |
314 | 331 |
|
315 | 332 | clean_up: |
316 | 333 |
|
317 | | - mbedtls_pk_free( &pk ); |
| 334 | + if (public_key_buffer) { |
| 335 | + free(public_key_buffer); |
| 336 | + } |
318 | 337 |
|
319 | | - return ret; |
| 338 | + mbedtls_pk_free( &pk ); |
| 339 | + |
| 340 | + return ret; |
320 | 341 | } |
321 | 342 |
|
322 | 343 | static bool _check_firmware_validation(const unsigned char *sha256, unsigned char *sig_data, unsigned int sig_len) |
|
0 commit comments