feat: brought updates from tock-tbf into tbf-parser

Author: AliwiWalid

.github/.lastcommsha

@@ -1 +1 @@
-4586a000ce72d970be7cfaef0ae40371c1e80177
+bc8ae6ddac5c165f9d0d14f1278be0068d225f5e

.lastcommsha

@@ -143,6 +143,7 @@ pub fn parse_tbf_header(
                     types::TbfHeaderV2StoragePermissions<8>,
                 > = None;
                 let mut kernel_version: Option<types::TbfHeaderV2KernelVersion> = None;
+                let mut short_id: Option<types::TbfHeaderV2ShortId> = None;
 
                 // Iterate the remainder of the header looking for TLV entries.
                 while !remaining.is_empty() {
@@ -282,6 +283,22 @@ pub fn parse_tbf_header(
                             }
                         }
 
+                        types::TbfHeaderTypes::TbfHeaderShortId => {
+                            let entry_len = mem::size_of::<types::TbfHeaderV2ShortId>();
+                            if tlv_header.length as usize == entry_len {
+                                short_id = Some(
+                                    remaining
+                                        .get(0..entry_len)
+                                        .ok_or(types::TbfParseError::NotEnoughFlash)?
+                                        .try_into()?,
+                                );
+                            } else {
+                                return Err(types::TbfParseError::BadTlvEntry(
+                                    tlv_header.tipe as usize,
+                                ));
+                            }
+                        }
+
                         _ => {}
                     }
 
@@ -303,6 +320,7 @@ pub fn parse_tbf_header(
                     permissions: permissions_pointer,
                     storage_permissions: storage_permissions_pointer,
                     kernel_version,
+                    short_id,
                 };
 
                 Ok(types::TbfHeader::TbfHeaderV2(tbf_header))

tbf-parser/src/parse.rs

@@ -106,7 +106,7 @@ impl fmt::Debug for TbfParseError {
             TbfParseError::TooManyEntries(tipe) => {
                 write!(
                     f,
-                    "There are too many variable entries of {tipe} for Tock to parse"
+                    "There are too many variable entries of {tipe} for Tock to parse",
                 )
             }
             TbfParseError::PackageNameTooLong => write!(f, "The package name is too long."),
@@ -137,6 +137,7 @@ pub enum TbfHeaderTypes {
     TbfHeaderStoragePermissions = 7,
     TbfHeaderKernelVersion = 8,
     TbfHeaderProgram = 9,
+    TbfHeaderShortId = 10,
     TbfFooterCredentials = 128,
 
     /// Some field in the header that we do not understand. Since the TLV format
@@ -254,6 +255,14 @@ pub struct TbfHeaderV2KernelVersion {
     minor: u16,
 }
 
+/// The v2 ShortId for apps.
+///
+/// Header to specify a fixed ShortID for an app.
+#[derive(Clone, Copy, Debug)]
+pub struct TbfHeaderV2ShortId {
+    short_id: Option<core::num::NonZeroU32>,
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum TbfFooterV2CredentialsType {
     Reserved = 0,
@@ -262,6 +271,7 @@ pub enum TbfFooterV2CredentialsType {
     SHA256 = 3,
     SHA384 = 4,
     SHA512 = 5,
+    EcdsaNistP256 = 6,
 }
 
 /// Reference: https://github.com/tock/tock/blob/master/doc/reference/trd-appid.md#52-credentials-footer
@@ -274,6 +284,7 @@ pub enum TbfFooterV2Credentials {
     SHA256(TbfFooterV2SHA<32>),
     SHA384(TbfFooterV2SHA<48>),
     SHA512(TbfFooterV2SHA<64>),
+    EcdsaNistP256(TbfFooterV2Ecdsa<32>),
 }
 
 #[derive(Clone, Copy, Debug)]
@@ -287,6 +298,12 @@ pub struct TbfFooterV2RSA<const L: usize> {
     signature: [u8; L],
 }
 
+#[derive(Clone, Copy, Debug)]
+pub struct TbfFooterV2Ecdsa<const L: usize> {
+    signature_r: [u8; L],
+    signature_s: [u8; L],
+}
+
 impl<const L: usize> TbfFooterV2SHA<L> {
     pub fn get_format(&self) -> Result<TbfFooterV2CredentialsType, TbfParseError> {
         match L {
@@ -320,6 +337,20 @@ impl<const L: usize> TbfFooterV2RSA<L> {
     }
 }
 
+impl<const L: usize> TbfFooterV2Ecdsa<L> {
+    pub fn get_format(&self) -> Result<TbfFooterV2CredentialsType, TbfParseError> {
+        Ok(TbfFooterV2CredentialsType::EcdsaNistP256)
+    }
+
+    pub fn get_signature_r(&self) -> &[u8; L] {
+        &self.signature_r
+    }
+
+    pub fn get_signature_s(&self) -> &[u8; L] {
+        &self.signature_s
+    }
+}
+
 // Conversion functions from slices to the various TBF fields.
 
 impl core::convert::TryFrom<&[u8]> for TbfHeaderV2Base {
@@ -372,6 +403,7 @@ impl core::convert::TryFrom<u16> for TbfHeaderTypes {
             7 => Ok(TbfHeaderTypes::TbfHeaderStoragePermissions),
             8 => Ok(TbfHeaderTypes::TbfHeaderKernelVersion),
             9 => Ok(TbfHeaderTypes::TbfHeaderProgram),
+            10 => Ok(TbfHeaderTypes::TbfHeaderShortId),
             128 => Ok(TbfHeaderTypes::TbfFooterCredentials),
             _ => Ok(TbfHeaderTypes::Unknown),
         }
@@ -675,6 +707,20 @@ impl core::convert::TryFrom<&[u8]> for TbfHeaderV2KernelVersion {
     }
 }
 
+impl core::convert::TryFrom<&[u8]> for TbfHeaderV2ShortId {
+    type Error = TbfParseError;
+
+    fn try_from(b: &[u8]) -> Result<TbfHeaderV2ShortId, Self::Error> {
+        Ok(TbfHeaderV2ShortId {
+            short_id: core::num::NonZeroU32::new(u32::from_le_bytes(
+                b.get(0..4)
+                    .ok_or(TbfParseError::InternalError)?
+                    .try_into()?,
+            )),
+        })
+    }
+}
+
 impl core::convert::TryFrom<&[u8]> for TbfFooterV2Credentials {
     type Error = TbfParseError;
 
@@ -691,6 +737,7 @@ impl core::convert::TryFrom<&[u8]> for TbfFooterV2Credentials {
             3 => TbfFooterV2CredentialsType::SHA256,
             4 => TbfFooterV2CredentialsType::SHA384,
             5 => TbfFooterV2CredentialsType::SHA512,
+            6 => TbfFooterV2CredentialsType::EcdsaNistP256,
             _ => {
                 return Err(TbfParseError::InternalError);
             }
@@ -702,6 +749,7 @@ impl core::convert::TryFrom<&[u8]> for TbfFooterV2Credentials {
             TbfFooterV2CredentialsType::SHA256 => 32,
             TbfFooterV2CredentialsType::SHA384 => 48,
             TbfFooterV2CredentialsType::SHA512 => 64,
+            TbfFooterV2CredentialsType::EcdsaNistP256 => 64,
         };
 
         let data = b
@@ -747,6 +795,16 @@ impl core::convert::TryFrom<&[u8]> for TbfFooterV2Credentials {
                         .map_err(|_| TbfParseError::InternalError)?,
                 }))
             }
+            TbfFooterV2CredentialsType::EcdsaNistP256 => {
+                Ok(TbfFooterV2Credentials::EcdsaNistP256(TbfFooterV2Ecdsa {
+                    signature_r: data[0..32]
+                        .try_into()
+                        .map_err(|_| TbfParseError::InternalError)?,
+                    signature_s: data[32..64]
+                        .try_into()
+                        .map_err(|_| TbfParseError::InternalError)?,
+                }))
+            }
         }
     }
 }
@@ -760,6 +818,7 @@ impl TbfFooterV2Credentials {
             TbfFooterV2Credentials::SHA256(_) => "SHA256",
             TbfFooterV2Credentials::SHA384(_) => "SHA384",
             TbfFooterV2Credentials::SHA512(_) => "SHA512",
+            TbfFooterV2Credentials::EcdsaNistP256(_) => "EcdsaNistP256",
         }
     }
 }
@@ -794,6 +853,7 @@ pub struct TbfHeaderV2 {
     pub(crate) permissions: Option<TbfHeaderV2Permissions<8>>,
     pub(crate) storage_permissions: Option<TbfHeaderV2StoragePermissions<NUM_STORAGE_PERMISSIONS>>,
     pub(crate) kernel_version: Option<TbfHeaderV2KernelVersion>,
+    pub(crate) short_id: Option<TbfHeaderV2ShortId>,
 }
 
 /// Type that represents the fields of the Tock Binary Format header.
@@ -967,13 +1027,13 @@ impl TbfHeader {
     }
 
     /// Get the offset and size of a given flash region.
-    pub fn get_writeable_flash_region(&self, index: usize) -> (u32, u32) {
+    pub fn get_writeable_flash_region(&self, index: usize) -> (usize, usize) {
         match *self {
             TbfHeader::TbfHeaderV2(hd) => hd.writeable_regions.map_or((0, 0), |wrs| {
                 wrs.get(index).unwrap_or(&None).map_or((0, 0), |wr| {
                     (
-                        wr.writeable_flash_region_offset,
-                        wr.writeable_flash_region_size,
+                        wr.writeable_flash_region_offset as usize,
+                        wr.writeable_flash_region_size as usize,
                     )
                 })
             }),
@@ -1114,4 +1174,13 @@ impl TbfHeader {
             _ => 0,
         }
     }
+
+    /// Return the fixed ShortId of the application if it was specified in the
+    /// TBF header.
+    pub fn get_fixed_short_id(&self) -> Option<core::num::NonZeroU32> {
+        match self {
+            TbfHeader::TbfHeaderV2(hd) => hd.short_id.and_then(|si| si.short_id),
+            _ => None,
+        }
+    }
 }

tbf-parser/src/types.rs

@@ -120,3 +120,92 @@ fn footer_rsa4096() {
         panic!("Footer is not of type 'Reserved'!");
     }
 }
+
+#[test]
+fn shortid_valid() {
+    let buffer: Vec<u8> = vec![
+        0x02, 0x00, 0x2c, 0x00, 0x90, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6a, 0x70, 0x41,
+        0x73, 0x03, 0x00, 0x08, 0x00, 0x5f, 0x74, 0x65, 0x73, 0x74, 0x00, 0x00, 0x00, 0x08, 0x00,
+        0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x04, 0x00, 0xd2, 0x04, 0x00, 0x00,
+    ];
+
+    let (_ver, header_len, _) = parse_tbf_header_lengths(&buffer[0..8].try_into().unwrap())
+        .ok()
+        .unwrap();
+
+    let header = parse_tbf_header(&buffer[0..header_len as usize], 2).unwrap();
+    dbg!(&header);
+
+    // Corrected: The expected ShortID is 1234 (0x4d2 in hex), not 0x12345678.
+    let expected_short_id = core::num::NonZeroU32::new(1234);
+    assert_eq!(header.get_fixed_short_id(), expected_short_id);
+}
+
+#[test]
+fn shortid_invalid() {
+    // The buffer generated by the previous step
+    let invalid_short_buffer: Vec<u8> = vec![
+        0x02, 0x00, 0x32, 0x00, 0xa5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0c, 0xfc, 0xae,
+        0x47, 0x03, 0x00, 0x08, 0x00, 0x5f, 0x74, 0x65, 0x73, 0x74, 0x00, 0x00, 0x00, 0x08, 0x00,
+        0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x04, 0x00, 0xd2, 0x04, 0x00, 0x00,
+    ];
+
+    let result = parse_tbf_header(&invalid_short_buffer, 2);
+    assert!(result.is_err());
+    let error = result.unwrap_err();
+    let debug_string = format!("{:?}", error);
+
+    assert!(debug_string.contains("Checksum verification failed"));
+}
+
+#[test]
+fn shortid_nonexistent() {
+    // We can reuse the `simple.dat` artifact, as it should not have a ShortID TLV.
+    let buffer = include_bytes!("./flashes/simple.dat").to_vec();
+
+    let (_ver, header_len, _) = parse_tbf_header_lengths(&buffer[0..8].try_into().unwrap())
+        .ok()
+        .unwrap();
+
+    let header = parse_tbf_header(&buffer[0..header_len as usize], 2).unwrap();
+    dbg!(&header);
+
+    // The core assertion: check that the ShortID is not present.
+    assert_eq!(header.get_fixed_short_id(), None);
+}
+
+#[test]
+fn ecdsa_nist_p256_smoke_test() {
+    let tlv_type_credentials: u16 = 128; // 2 bytes
+    let credential_format: u32 = TbfFooterV2CredentialsType::EcdsaNistP256 as u32; // 6
+    let signature_r = [0xAA; 32];
+    let signature_s = [0xBB; 32];
+
+    // Length of payload: 4 (format) + 32 (r) + 32 (s) = 68
+    let tlv_length: u16 = 68;
+
+    let mut buffer = Vec::new();
+
+    buffer.extend_from_slice(&tlv_type_credentials.to_le_bytes()); // 2 bytes
+    buffer.extend_from_slice(&tlv_length.to_le_bytes()); // 2 bytes
+    buffer.extend_from_slice(&credential_format.to_le_bytes()); // 4 bytes
+    buffer.extend_from_slice(&signature_r); // 32 bytes
+    buffer.extend_from_slice(&signature_s); // 32 bytes
+
+    assert_eq!(buffer.len(), 4 + tlv_length as usize);
+
+    match parse_tbf_footer(&buffer) {
+        Ok((footer, returned_footer_size)) => {
+            assert_eq!(returned_footer_size, tlv_length as u32);
+            if let TbfFooterV2Credentials::EcdsaNistP256(ecdsa) = footer {
+                assert_eq!(ecdsa.get_signature_r(), &signature_r);
+                assert_eq!(ecdsa.get_signature_s(), &signature_s);
+            } else {
+                panic!("Footer is not of type EcdsaNistP256!");
+            }
+        }
+        Err(e) => {
+            panic!("Failed to parse footer: {:?}", e);
+        }
+    }
+}