Skip to content

Commit 2875939

Browse files
gojimmypigojimmypi
committed
Improve user settings detection
1 parent a559b75 commit 2875939

File tree

9 files changed

+208
-25
lines changed

9 files changed

+208
-25
lines changed

‎include/image.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -133,9 +133,11 @@ int wolfBot_get_dts_size(void *dts_addr);
133133
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_ecc
134134
#endif
135135
#if defined(WOLFBOOT_SIGN_LMS)
136+
#undef wolfBoot_verify_signature_primary
136137
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_lms
137138
#endif
138139
#if defined(WOLFBOOT_SIGN_XMSS )
140+
#undef wolfBoot_verify_signature_primary
139141
#define wolfBoot_verify_signature_primary wolfBoot_verify_signature_xmss
140142
#endif
141143
#ifdef WOLFBOOT_SIGN_ML_DSA
@@ -363,6 +365,12 @@ static void __attribute__((noinline)) wolfBoot_image_clear_signature_ok(
363365
asm volatile("cmp r2, r0":::"cc"); \
364366
asm volatile("bne .-12")
365367

368+
/* Some SHA checks */
369+
#if !defined(WOLFBOOT_SHA_DIGEST_SIZE) || (WOLFBOOT_SHA_DIGEST_SIZE <= 0)
370+
#error "WOLFBOOT_SHA_DIGEST_SIZE must be defined"
371+
#endif
372+
373+
366374
/**
367375
* First part of RSA verification. Ensure that the function is called by
368376
* double checking its return value contains a valid

‎include/user_settings.h‎

Lines changed: 43 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,50 @@
2222
* along with this program; if not, write to the Free Software
2323
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
2424
*/
25-
#ifndef _WOLFBOOT_USER_SETTINGS_H_
26-
#define _WOLFBOOT_USER_SETTINGS_H_
25+
#ifndef WOLFBOOT_USER_SETTINGS_H
26+
#define WOLFBOOT_USER_SETTINGS_H
27+
28+
/* This is the wolfBoot embedded target user settings.
29+
*
30+
* See also settings in [WOLFBOOT_ROOT]/tools/keytools
31+
*
32+
* When in question, define DEBUG_SIGNTOOL and optionally WOLFBOOT_SHOW_INCLUDE
33+
*/
34+
35+
/* During development in new environment, ensure the expected user settings is used: */
36+
#ifdef WOLFBOOT_SHOW_INCLUDE
37+
#ifdef __GNUC__ /* GCC compiler */
38+
#pragma message "===============include/user_settings.h"
39+
#elif defined(_MSC_VER) /* Microsoft Visual C++ compiler */
40+
#pragma message("===============include/user_settings.h")
41+
#else
42+
#warning "===============include/user_settings.h"
43+
#endif
44+
#endif /* WOLFBOOT_SHOW_INCLUDE user_settings message */
45+
46+
#if defined(_MSC_VER)
47+
/* MSVC and clang-cl both define _MSC_VER */
48+
#ifndef WOLFSSL_HAVE_MIN
49+
#define WOLFSSL_HAVE_MIN
50+
#endif
51+
#ifndef WOLFSSL_HAVE_MAX
52+
#define WOLFSSL_HAVE_MAX
53+
#endif
54+
55+
/* Really keep Windows headers from redefining min/max */
56+
#ifndef NOMINMAX
57+
#define NOMINMAX 1
58+
#endif
59+
#endif
2760

2861
#ifdef WOLFBOOT_PKCS11_APP
2962
# include "test-app/wcs/user_settings.h"
3063
#else
3164

65+
/* The target.h is a device-specific, typically a generated file.
66+
* CMake configures from `include/target.h.in` into ${CMAKE_CURRENT_BINARY_DIR}
67+
*
68+
* See also the sample in [WOLFBOOT_ROOT]/tools/unit-tests/target.h */
3269
#include <target.h>
3370

3471
/* System */
@@ -330,7 +367,9 @@ extern int tolower(int c);
330367

331368
/* SP Math needs to understand long long */
332369
# ifndef ULLONG_MAX
333-
# define ULLONG_MAX 18446744073709551615ULL
370+
# ifndef _MSC_VER
371+
# define ULLONG_MAX 18446744073709551615ULL
372+
# endif
334373
# endif
335374
#endif
336375

@@ -586,4 +625,4 @@ extern int tolower(int c);
586625
# define WOLFSSL_PEM_TO_DER
587626
#endif
588627

589-
#endif /* !_WOLFBOOT_USER_SETTINGS_H_ */
628+
#endif /* !WOLFBOOT_USER_SETTINGS_H */

‎include/wolfboot/wolfboot.h‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,18 @@ extern "C" {
163163
#if defined(__WOLFBOOT) || defined(UNIT_TEST_AUTH)
164164

165165
#include "wolfssl/wolfcrypt/settings.h"
166+
167+
/* During development in new environment, ensure the expected user settings is used: */
168+
#ifdef DEBUG_SIGNTOOL
169+
#ifdef WOLFBOOT_KEYTOOLS_USER_SETTINGS_H
170+
/* Encountered the user settings in [WOLFBOOT_ROOT]/tools/keytools/user_settings.h */
171+
#error "wolfBoot expects user settings from [WOLFBOOT_ROOT]/tools/keygen/user_settings.h"
172+
#endif
173+
#ifndef WOLFBOOT_USER_SETTINGS_H
174+
#error "wolfBoot expected user settings from [WOLFBOOT_ROOT]/include/user_settings.h"
175+
#endif
176+
#endif /* DEBUG_SIGNTOOL optional user settings check */
177+
166178
#include "wolfssl/wolfcrypt/visibility.h"
167179
#include "wolfssl/wolfcrypt/wc_port.h"
168180
#include "wolfssl/wolfcrypt/types.h"

‎src/image.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@
3131
#endif
3232
#include <wolfssl/wolfcrypt/settings.h> /* for wolfCrypt hash/sign routines */
3333
#ifdef WOLFBOOT_KEYTOOLS
34-
/* this code needs to use the Use ./include/user_settings.h, not keytools */
34+
/* this code needs to use the local tools/keytools/user_settings.h
35+
* not [WOLFBOOT_ROOT]/include/user_settings.h */
3536
#error "The wrong user_settings.h has been included."
3637
#endif
3738

‎tools/keytools/README.md‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,51 @@
11
# Key Tools for signing and key generation
22

3-
See documentation [here](../../docs/Signing.md).
3+
## Sign
4+
5+
See [code file `./tools/keytools/sign.c`](./sign.c) and documentation in [docs/Signing.md](../../docs/Signing.md).
6+
7+
## KeyGen and KeyStore
8+
9+
See [code file `./tools/keytools/keygen.c`](./keygen.c) and documentation [docs/keystore.md](../../docs/keystore.md).
10+
11+
## Flash OTP Keystore Generation, Primer, Startup
12+
13+
See documentation [docs/flash-OTP.md](../../docs/flash-OTP.md).
14+
15+
### Keystore Generation
16+
17+
Pack public keys into a single binary (`otp.bin`) formatted the way wolfBoot expects for
18+
provisioning the device’s OTP/NVM keystore. No signing, no encryption—just a correctly laid-out image
19+
with a header plus fixed-size "slots" for each key.
20+
21+
See [code file `./tools/keytools/otp/otp-keystore-gen.c`](./otp/otp-keystore-gen.c)
22+
23+
### Flash OTP Primer
24+
25+
See [code file `./tools/keytools/otp/otp-keystore-primer.c`](./otp/otp-keystore-primer.c)
26+
27+
## Flash OTP Startup
28+
29+
See [code file `./tools/keytools/otp/startup.c`](./otp/startup.c)
30+
31+
32+
## Quick Start (Linux)
33+
34+
```
35+
make wolfboot_signing_private_key.der SIGN=ED25519
36+
37+
# or
38+
39+
./tools/keytools/keygen --ed25519 -g wolfboot_signing_private_key.der
40+
```
41+
42+
## Debugging and Development
43+
44+
### `DEBUG_SIGNTOOL`
45+
46+
Enables additional diagnostic messages that may be useful during development and initial bring-up.
47+
48+
### `WOLFBOOT_SHOW_INCLUDE`
49+
50+
Enables compile-time verbosity to indicate which `user_settings.h` file is being used.
51+

‎tools/keytools/keygen.c‎

Lines changed: 30 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,8 @@
2424

2525
/* Option to enable sign tool debugging */
2626
/* Must also define DEBUG_WOLFSSL in user_settings.h */
27-
//#define DEBUG_SIGNTOOL
27+
/* #define DEBUG_SIGNTOOL */
2828

29-
#ifdef _WIN32
30-
#define _CRT_SECURE_NO_WARNINGS
31-
#define _CRT_NONSTDC_NO_DEPRECATE /* unlink */
32-
#endif
3329
#include <stdio.h>
3430
#include <stdint.h>
3531
#include <stdarg.h>
@@ -40,25 +36,45 @@
4036
#include <sys/types.h>
4137
#include <errno.h>
4238
#include <fcntl.h>
43-
#ifndef _WIN32
39+
#ifdef _WIN32
40+
#define _CRT_SECURE_NO_WARNINGS
41+
#define _CRT_NONSTDC_NO_DEPRECATE /* unlink */
42+
#else
4443
#include <unistd.h>
4544
#endif
4645

46+
/* wolfSSL */
47+
/* Always include wolfcrypt/settings.h before any other wolfSSL file. */
48+
/* Reminder: settings.h pulls in user_settings.h; don't include it here. */
4749
#include <wolfssl/wolfcrypt/settings.h>
50+
51+
/* During development in new environment, ensure the expected user settings is used: */
52+
#ifdef DEBUG_SIGNTOOL
53+
#ifdef WOLFBOOT_USER_SETTINGS_H
54+
#error "Keygen encountered unexpected user settings from [WOLFBOOT_ROOT]/include/user_settings.h"
55+
#endif
56+
#ifdef __WOLFBOOT
57+
/* wolfBoot otherwise uses a user_se*/
58+
#error "Keygen unexpectedly encountered __WOLFBOOT. Check your config"
59+
#endif
60+
#ifndef WOLFBOOT_KEYTOOLS_USER_SETTINGS_H
61+
#error "Keygen expects settings from [WOLFBOOT_ROOT]/tools/keygen/user_settings.h"
62+
#endif
63+
#endif /* DEBUG_SIGNTOOL optional user settings check */
64+
4865
#ifndef NO_RSA
49-
#include <wolfssl/wolfcrypt/rsa.h>
66+
#include <wolfssl/wolfcrypt/rsa.h>
5067
#endif
5168
#ifdef HAVE_ECC
52-
#include <wolfssl/wolfcrypt/ecc.h>
53-
#include <wolfssl/wolfcrypt/asn.h>
54-
69+
#include <wolfssl/wolfcrypt/ecc.h>
70+
#include <wolfssl/wolfcrypt/asn.h>
5571
#endif
5672
#ifdef HAVE_ED25519
57-
#include <wolfssl/wolfcrypt/ed25519.h>
73+
#include <wolfssl/wolfcrypt/ed25519.h>
5874
#endif
5975

6076
#ifdef HAVE_ED448
61-
#include <wolfssl/wolfcrypt/ed448.h>
77+
#include <wolfssl/wolfcrypt/ed448.h>
6278
#endif
6379

6480
#if defined(WOLFSSL_HAVE_LMS)
@@ -86,11 +102,11 @@
86102
#include <wolfssl/wolfcrypt/random.h>
87103
#include <wolfssl/wolfcrypt/error-crypt.h>
88104
#ifdef DEBUG_SIGNTOOL
89-
#include <wolfssl/wolfcrypt/logging.h>
105+
#include <wolfssl/wolfcrypt/logging.h>
90106
#endif
91107

92108
#if !defined(PATH_MAX)
93-
#define PATH_MAX 256
109+
#define PATH_MAX 256
94110
#endif
95111

96112
#include "wolfboot/wolfboot.h"

‎tools/keytools/otp/otp-keystore-gen.c‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,26 @@
3636
#endif
3737

3838
#include "wolfboot/wolfboot.h"
39+
40+
/* During development in new environment, ensure the expected user settings is used: */
41+
#ifdef DEBUG_SIGNTOOL
42+
#ifdef __WOLFBOOT
43+
#ifndef WOLFBOOT_USER_SETTINGS_H
44+
#error "otp-keystore-gen encountered unexpected user settings, expected [WOLFBOOT_ROOT]/include/user_settings.h"
45+
#endif
46+
#ifdef WOLFBOOT_KEYTOOLS_USER_SETTINGS_H
47+
#error "Detected keytools user settings, expected [WOLFBOOT_ROOT]/include/user_settings.hh"
48+
#endif
49+
#else
50+
#ifdef WOLFBOOT_KEYTOOLS_USER_SETTINGS_H
51+
#error "Detected keytools user settings, otp-keystore-gen does not expect any user_settings.h"
52+
#endif
53+
#ifdef WOLFBOOT_USER_SETTINGS_H
54+
#error "Detected wolfboot user settings, otp-keystore-gen does not expect any user_settings.h"
55+
#endif
56+
#endif
57+
#endif /* optional user settings check */
58+
3959
#include "keystore.h"
4060
#include "otp_keystore.h"
4161

‎tools/keytools/sign.c‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,11 @@
2222
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
2323
*/
2424

25+
/* Beware of wolfCrypt user settings in [WOLFBOOT_ROOT]/include/user_settings.h */
26+
2527
/* Option to enable sign tool debugging */
26-
/* Must also define DEBUG_WOLFSSL in user_settings.h */
27-
//#define DEBUG_SIGNTOOL
28+
/* Must also define DEBUG_WOLFSSL in /tools/keytools/user_settings.h */
29+
/* #define DEBUG_SIGNTOOL */
2830

2931
#ifdef _WIN32
3032
#define _CRT_SECURE_NO_WARNINGS
@@ -79,11 +81,25 @@ static inline int fp_truncate(FILE *f, size_t len)
7981
#endif
8082

8183
#include <wolfssl/wolfcrypt/settings.h>
84+
/* During development in new environment, ensure the expected user settings is used: */
85+
#ifdef DEBUG_SIGNTOOL
86+
#ifdef WOLFBOOT_USER_SETTINGS_H
87+
#error "signing tool encountered unexpected user settings from [WOLFBOOT_ROOT]/include/user_settings.h"
88+
#endif
89+
#ifdef __WOLFBOOT
90+
/* wolfBoot otherwise uses a different user_settings */
91+
#error "signing tool unexpectedly encountered __WOLFBOOT. Check your config"
92+
#endif
93+
#ifndef WOLFBOOT_KEYTOOLS_USER_SETTINGS_H
94+
#error "signing tool expects settings from [WOLFBOOT_ROOT]/tools/keygen/user_settings.h"
95+
#endif
96+
#endif /* DEBUG_SIGNTOOL optional user settings check */
97+
8298
#include <wolfssl/wolfcrypt/asn.h>
8399
#include <wolfssl/wolfcrypt/aes.h>
84100

85101
#ifdef HAVE_CHACHA
86-
#include <wolfssl/wolfcrypt/chacha.h>
102+
#include <wolfssl/wolfcrypt/chacha.h>
87103
#endif
88104

89105

‎tools/keytools/user_settings.h‎

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,31 @@
2323
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
2424
*/
2525

26-
#ifndef H_USER_SETTINGS_
27-
#define H_USER_SETTINGS_
26+
#ifndef WOLFBOOT_KEYTOOLS_USER_SETTINGS_H
27+
#define WOLFBOOT_KEYTOOLS_USER_SETTINGS_H
28+
29+
/* This is the keytools user settings.
30+
*
31+
* See also settings in [WOLFBOOT_ROOT]/include/user_settings.h
32+
*
33+
* When in question, define DEBUG_SIGNTOOL and optionally WOLFBOOT_SHOW_INCLUDE
34+
*/
35+
36+
/* During development in new environment, ensure the expected user settings is used: */
37+
#ifdef WOLFBOOT_SHOW_INCLUDE
38+
#ifdef __GNUC__ /* GCC compiler */
39+
#pragma message "============= keytools/user_settings.h"
40+
#elif defined(_MSC_VER) /* Microsoft Visual C++ compiler */
41+
#pragma message("============= keytools/user_settings.h")
42+
#else
43+
#warning "============= keytools/user_settings"
44+
#endif
45+
#endif /* optional user settings check */
46+
47+
/* Some debug options. See docs. */
48+
/* #define DEBUG_SIGNTOOL */
49+
/* #define WOLFBOOT_HASH_SHA256 */
50+
/* #define WOLFBOOT_SIGN_ECC256 */
2851

2952
#include <stdint.h>
3053

0 commit comments

Comments
 (0)