Compare commits
10 Commits
400a26d083
...
e3427a742a
| Author | SHA1 | Date |
|---|---|---|
 Mickaël Tansorier
|
e3427a742a | 4 years ago |
|
Mickaël Tansorier
|
c95a78f60d | 4 years ago |
|
Mickaël Tansorier
|
033fd2df54 | 4 years ago |
|
Mickaël Tansorier
|
6ff46a5cbd | 4 years ago |
|
Mickaël Tansorier
|
87e66c220c | 4 years ago |
|
Mickaël Tansorier
|
14d5d119a3 | 4 years ago |
|
Mickaël Tansorier
|
db69da3a17 | 4 years ago |
|
Mickaël Tansorier
|
2d62fd1944 | 6 years ago |
|
Mickaël Tansorier
|
88ae4304a1 | 6 years ago |
|
Mickaël Tansorier
|
64e83a698a | 6 years ago |
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@ -0,0 +1,412 @@
|
||||
% Copyright (C) 2018 TANSORIER.
|
||||
% Permission is granted to copy, distribute and/or modify this document
|
||||
% under the terms of the GNU Free Documentation License, Version 1.3
|
||||
% or any later version published by the Free Software Foundation;
|
||||
% with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
|
||||
% A copy of the license is included in the section entitled "GNU
|
||||
% Free Documentation License".
|
||||
|
||||
% https://www.gnu.org/licenses/fdl-1.3.html
|
||||
|
||||
% compress option to have horyzontal circle
|
||||
\documentclass[compress,aspectratio=169]{beamer}
|
||||
|
||||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||||
|
||||
% Thèmes suppélmentaires
|
||||
\useoutertheme[]{miniframes} % barre menu du haut
|
||||
\setbeamertemplate{frametitle}[default] % replace le titre à la bonne place
|
||||
\useinnertheme[shadow=true]{rounded} % arrondi les angles
|
||||
\usecolortheme{orchid}
|
||||
\usecolortheme{whale}
|
||||
|
||||
%\usepackage{xcolor}
|
||||
%\definecolor{smileOrange}{RGB}{254,128,86}
|
||||
|
||||
\setbeamertemplate{footline}[text line]{
|
||||
\textcolor{gray}{%
|
||||
\parbox{\linewidth}{\vspace*{-8pt}Smile\hfill\insertshortauthor\hfill\insertpagenumber/\inserttotalframenumber}}
|
||||
}
|
||||
\beamertemplatenavigationsymbolsempty
|
||||
|
||||
% Language
|
||||
\usepackage[french]{babel}
|
||||
\usepackage[utf8]{inputenc}
|
||||
\usepackage[T1]{fontenc}
|
||||
%\usepackage[latin1]{inputenc}
|
||||
|
||||
% Display Table Of Content spécific for smilebeamer
|
||||
% Force to get empty
|
||||
\AtBeginSection[]{}
|
||||
\AtBeginSubsection[]{}
|
||||
%{
|
||||
% \begin{frame}<beamer>
|
||||
% \frametitle{Plan}
|
||||
% \tableofcontents[currentsection]
|
||||
% \end{frame}
|
||||
%}
|
||||
|
||||
% Change color of definiton block
|
||||
\AtBeginEnvironment{definition}{%
|
||||
\setbeamercolor{block title}{use=example text,fg=example text.fg,bg=example text.fg!20!bg}
|
||||
\setbeamercolor{block body}{parent=normal text,use=block title,bg=block title.bg!50!bg}
|
||||
}
|
||||
|
||||
|
||||
% code coloration
|
||||
\usepackage{listings}
|
||||
% L'option "[fragile]" doit être rajouté au frame pour pouvoir utiliser correctement
|
||||
% la police verbatim
|
||||
\usepackage{color}
|
||||
\lstset{
|
||||
breaklines=true,
|
||||
tabsize=4,
|
||||
backgroundcolor=\color[RGB]{49,54,59},
|
||||
basicstyle=\footnotesize\ttfamily\color{white},
|
||||
commentstyle=\itshape\color[RGB]{0,136,136},
|
||||
morecomment=[l]{\#},
|
||||
morekeywords={*,\$,\{,\}},
|
||||
stringstyle=\itshape\color[RGB]{218,116,0},
|
||||
showstringspaces=false,
|
||||
frame=LTBR,
|
||||
}
|
||||
\lstdefinestyle{shell}{
|
||||
language=bash,
|
||||
keywords={\$},
|
||||
keywordstyle=\bfseries\color[RGB]{66,198,66}
|
||||
}
|
||||
\lstdefinelanguage{diff}{
|
||||
morecomment=[f][\color{blue}]{@@}, % group identifier
|
||||
morecomment=[f][\color{red}]-, % deleted lines
|
||||
morecomment=[f][\color{green}]+, % added lines
|
||||
morecomment=[f][\color{magenta}]{---}, % Diff header lines (must appear after +,-)
|
||||
morecomment=[f][\color{magenta}]{+++},
|
||||
}
|
||||
|
||||
% Pour utiliser des colonnes
|
||||
\usepackage{multicol}
|
||||
|
||||
% Pour integrer un pdf
|
||||
\usepackage[final]{pdfpages}
|
||||
|
||||
% Pour les hyperliens
|
||||
\usepackage{hyperref}
|
||||
|
||||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||||
\title[U-Boot]{fitImage \& signature de paquets \\ \textbf{Introduction}}
|
||||
|
||||
\author[Mickaël Tansorier]{Mickaël Tansorier}
|
||||
|
||||
\date[Août 2018]{Présentation du fonctionnement des fitImage et \newline du fonctionnement de signature de paquets}
|
||||
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
|
||||
|
||||
\begin{document}
|
||||
%\tableofcontents[subsectionstyle=hide]
|
||||
|
||||
% *******************************
|
||||
% **** PAGE DE GARDE ****
|
||||
% *******************************
|
||||
|
||||
\begin{frame}
|
||||
\titlepage
|
||||
\end{frame}
|
||||
|
||||
|
||||
% *******************************
|
||||
% **** INTRODUCTION ****
|
||||
% *******************************
|
||||
|
||||
|
||||
\begin{frame}{Plan}
|
||||
\tableofcontents[hideallsubsections]
|
||||
\end{frame}
|
||||
|
||||
\section{Introduction}
|
||||
|
||||
\begin{frame}{Images Linux}
|
||||
\begin{itemize}
|
||||
\item \textbf{Image}: image générique binaire
|
||||
\item \textbf{zImage}: image générique binaire compressé
|
||||
\item \textbf{uImage}: image avec une entête d'information utilisé par U-Boot
|
||||
\item \textbf{fitImage}: enveloppe d'image pouvant contenir plusieurs noyaux, devicetree, firmware. Chaque image peut être signé, et d'autres choses
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
{
|
||||
\setbeamercolor{background canvas}{bg=}
|
||||
\includepdf[pages=12-13]{docs/Vasut--secure_and_flexible_boot_with_u-boot_bootloader.pdf}
|
||||
}
|
||||
|
||||
{
|
||||
\setbeamercolor{background canvas}{bg=}
|
||||
\includepdf[pages=22]{docs/Josserand-schulz-secure-boot.pdf}
|
||||
}
|
||||
|
||||
% *******************************
|
||||
% **** PRÉSENTATION ****
|
||||
% *******************************
|
||||
|
||||
\section{Construire fitImage}
|
||||
|
||||
\subsection{Les sources mainline}
|
||||
|
||||
\begin{frame}[fragile]
|
||||
% Prevent first column disapear
|
||||
\begin{columns}\begin{column}{0.2\textwidth}\end{column}\end{columns}
|
||||
\begin{lstlisting}[style=shell,basicstyle=\tiny\ttfamily\color{white}]
|
||||
KERNEL=/path/to/zImage
|
||||
KEYNAME=my_key
|
||||
\end{lstlisting}
|
||||
\begin{columns}
|
||||
\begin{column}{0.5\textwidth}
|
||||
\begin{lstlisting}[style=shell,basicstyle=\tiny\ttfamily\color{white}]
|
||||
/dts-v1/;
|
||||
|
||||
/ {
|
||||
description = "fitImage for sign Kernel image and DTB";
|
||||
#address-cells = <1>;
|
||||
|
||||
images {
|
||||
kernel@1 {
|
||||
description = "Linux Kenel";
|
||||
data = /incbin/("%KERNEL%");
|
||||
type = "kernel";
|
||||
arch = "arm";
|
||||
os = "linux";
|
||||
compression = "none";
|
||||
load = <0x12000000>;
|
||||
entry = <0x12000000>;
|
||||
signature@1 {
|
||||
algo = "sha256,rsa4096";
|
||||
key-name-hint = "%KEYNAME%";
|
||||
};
|
||||
};
|
||||
\end{lstlisting}
|
||||
\end{column}
|
||||
\begin{column}{0.5\textwidth}
|
||||
\begin{lstlisting}[style=shell,basicstyle=\tiny\ttfamily\color{white}]
|
||||
fdt@1 {
|
||||
description = "Devicetree";
|
||||
data = /incbin/("%DTB%");
|
||||
type = "flat_dt";
|
||||
arch = "arm";
|
||||
compression = "none";
|
||||
load = <0x18000000>;
|
||||
entry = <0x18000000>;
|
||||
signature@1 {
|
||||
algo = "sha256,rsa4096";
|
||||
key-name-hint = "%KEYNAME%";
|
||||
};
|
||||
};
|
||||
};
|
||||
configurations {
|
||||
default = "conf@1";
|
||||
conf@1 {
|
||||
kernel = "kernel@1";
|
||||
fdt = "fdt@1";
|
||||
};
|
||||
};
|
||||
};
|
||||
\end{lstlisting}
|
||||
\end{column}
|
||||
\end{columns}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}[fragile]
|
||||
Plusieurs type de signature sont disponible: \texttt{common/image-sig.c}
|
||||
\begin{lstlisting}[style=shell,basicstyle=\tiny\ttfamily\color{white}]
|
||||
struct image_sig_algo image_sig_algos[] = {
|
||||
{
|
||||
"sha1,rsa2048",
|
||||
rsa_sign,
|
||||
rsa_add_verify_data,
|
||||
rsa_verify,
|
||||
&checksum_algos[0],
|
||||
},
|
||||
{
|
||||
"sha256,rsa2048",
|
||||
rsa_sign,
|
||||
rsa_add_verify_data,
|
||||
rsa_verify,
|
||||
&checksum_algos[1],
|
||||
},
|
||||
{
|
||||
"sha256,rsa4096",
|
||||
rsa_sign,
|
||||
rsa_add_verify_data,
|
||||
rsa_verify,
|
||||
&checksum_algos[2],
|
||||
}
|
||||
|
||||
};
|
||||
\end{lstlisting}
|
||||
\end{frame}
|
||||
|
||||
\subsection{Ajouter les clés dans uboot}
|
||||
\begin{frame}[fragile]
|
||||
Crée un devicetree spécifique
|
||||
\begin{lstlisting}
|
||||
/dts-v1/;
|
||||
/ {
|
||||
model = "Keys";
|
||||
compatible ="vendor,board";
|
||||
signature {
|
||||
key-%KEYNAME% {
|
||||
required = "image";
|
||||
algo = "sha256,rsa4096";
|
||||
key-name-hint = "%KEYNAME%";
|
||||
};
|
||||
};
|
||||
};
|
||||
\end{lstlisting}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}[fragile]
|
||||
Pour le générer le dtb
|
||||
\begin{lstlisting}[style=shell]
|
||||
dtc -p 4096 $(@D)/u-boot_pubkey.dts -O dtb -o $(@D)/u-boot_pubkey.dtb
|
||||
\end{lstlisting}
|
||||
Ce qui donne:
|
||||
\begin{lstlisting}[style=shell]
|
||||
$ cat u-boot_pubkey.dtb
|
||||
vendor,board signature key-my_key image sha256,rsa4096 my_key modelcompatiblerequiredalgokey-name-hint
|
||||
\end{lstlisting}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}[fragile]
|
||||
Pour y ajouter la clé public
|
||||
\begin{lstlisting}[style=shell]
|
||||
mkimage -D "-I dts -O dtb -p 4096" -f $(@D)/fitImage.its -K $(@D)/u-boot_pubkey.dtb -k $(@D) -r fitImage
|
||||
\end{lstlisting}
|
||||
Ce qui donne:
|
||||
\begin{lstlisting}[style=shell]
|
||||
$ cat u-boot_pubkey.dtb
|
||||
vendor,board signature key-my_key
|
||||
[...]
|
||||
image sha256,rsa4096 my_key modelcompatiblerequiredalgokey-name-hintrsa,num-bitrsa,n0-inversersa,exponentrsa,modulusra,r-squaredsquared
|
||||
\end{lstlisting}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}[fragile]
|
||||
Pour s'assurer que le device tree contenant la clé public soit dans dans le binaire u-boot, il faut que cette option soit à non:
|
||||
\begin{lstlisting}[style=shell]
|
||||
BR2_TARGET_UBOOT_USE_CUSTOM_CONFIG
|
||||
\end{lstlisting}
|
||||
Pour ajouter dans notre U-boot alors que l'on a pas de dtb, on utiliser l'option EXT\_DTB de make:
|
||||
\begin{lstlisting}[style=shell]
|
||||
make CROSS_COMPILE=arm-linux-gnueabihf- EXT_DTB=u-boot_pubkey.dtb
|
||||
\end{lstlisting}
|
||||
\end{frame}
|
||||
|
||||
|
||||
\subsection{Signer l'image noyau}
|
||||
\begin{frame}[fragile]
|
||||
Ok maintenant il faut siqner le kernel linux.\newline
|
||||
Il faut le signer avant de compiler u-boot puisque pour ajouter la clé public au devicetree il faut executer mkimge avec en entrée l'its et en sortier le fitImage:
|
||||
\begin{lstlisting}[style=shell]
|
||||
mkimage -D "-I dts -O dtb -p 4096" -f $(@D)/fitImage.its -K $(@D)/u-boot_pubkey.dtb -k $(@D) -r fitImage
|
||||
\end{lstlisting}
|
||||
Le noyau Linux est bien construit avant U-boot, donc pas besoin d'ajouter de dépendance.
|
||||
\end{frame}
|
||||
|
||||
% *******************************
|
||||
% **** PRÉSENTATION ****
|
||||
% *******************************
|
||||
\section{Paramétrer buildroot - fitImage}
|
||||
|
||||
\subsection{uboot}
|
||||
\begin{frame}[fragile]
|
||||
J'ai rajouté quelques config dans buildroot.
|
||||
\begin{lstlisting}[style=shell]
|
||||
BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
|
||||
BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
|
||||
BR2_PACKAGE_HOST_UBOOT_TOOLS=y
|
||||
BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
|
||||
BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
|
||||
|
||||
BR2_TARGET_UBOOT_NEEDS_OPENSSL=y
|
||||
|
||||
BR2_TARGET_UBOOT_SIGN_FITIMAGE=y
|
||||
BR2_TARGET_UBOOT_ITS="$(CONFIG_DIR)/board/eolane/modx6/fitImage.its"
|
||||
BR2_TARGET_UBOOT_SIGN_DTS="$(CONFIG_DIR)/board/eolane/modx6/u-boot_pubkey.dts"
|
||||
BR2_TARGET_UBOOT_KEY_NAME="my_key"
|
||||
BR2_TARGET_UBOOT_KEY_SERVER="bep@hgweb:/home/apache/distribution/keys/"
|
||||
\end{lstlisting}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}[fragile]{Vérification de la signature}
|
||||
il est possible de tester la signature d'une image avec:
|
||||
\begin{lstlisting}[style=shell]
|
||||
fit_check_sign -f output/images/fitImage -k u-boot_pubkey.dtb
|
||||
\end{lstlisting}
|
||||
dans \texttt{./output/build/host-uboot-tools-2017.07/tools/fit\_check\_sign}
|
||||
\end{frame}
|
||||
|
||||
\begin{frame}[fragile]
|
||||
Documentation:
|
||||
\begin{itemize}
|
||||
\item \url{https://elinux.org/images/e/e0/Josserand-schulz-secure-boot.pdf}
|
||||
\item \url{https://www.denx.de/wiki/pub/U-Boot/Documentation/multi_image_booting_scenarios.pdf}
|
||||
\item \url{https://elinux.org/images/8/8a/Vasut--secure_and_flexible_boot_with_u-boot_bootloader.pdf}
|
||||
\end{itemize}
|
||||
\end{frame}
|
||||
|
||||
% *******************************
|
||||
% **** PRÉSENTATION ****
|
||||
% *******************************
|
||||
\section{Signature de paquets}
|
||||
|
||||
\subsection{Générer les clés}
|
||||
\begin{frame}[fragile]
|
||||
Il faut une clé paire de clé:
|
||||
\begin{lstlisting}[style=shell]
|
||||
$ openssl genrsa -out my_key.key 4096
|
||||
$ openssl req -batch -new -x509 -key my_key.key -out my_key.crt
|
||||
\end{lstlisting}
|
||||
Pour extraire le clé publique du certificat
|
||||
\begin{lstlisting}[style=shell]
|
||||
openssl x509 -pubkey -noout -in my_key.crt > my_key.pub
|
||||
\end{lstlisting}
|
||||
\end{frame}
|
||||
|
||||
\subsection{Signer}
|
||||
\begin{frame}[fragile]
|
||||
Pour signer:
|
||||
\begin{lstlisting}[style=shell]
|
||||
openssl dgst -sha256 -sign my_key.key -out file_to_sign.sha256 file_to_sign
|
||||
\end{lstlisting}
|
||||
Si la signature est sous forme binaire, on peut la convertir sous forme textuel:
|
||||
\begin{lstlisting}[style=shell]
|
||||
openssl base64 -in file_to_sign.sha256 -out file_to_sign.sign
|
||||
\end{lstlisting}
|
||||
\end{frame}
|
||||
|
||||
\subsection{Vérifier}
|
||||
\begin{frame}[fragile]
|
||||
Pour signer:
|
||||
\begin{lstlisting}[style=shell]
|
||||
openssl dgst -sha256 -verify my_key.pub -signature file_to_sign.sha256 file_to_sign
|
||||
\end{lstlisting}
|
||||
Si la signature est sous forme binaire, on peut la convertir sous forme textuel:
|
||||
\begin{lstlisting}[style=shell]
|
||||
openssl base64 -d -in file_to_sign.sign -out file_to_sign.sha256
|
||||
\end{lstlisting}
|
||||
\end{frame}
|
||||
|
||||
|
||||
% *******************************
|
||||
% **** PRÉSENTATION ****
|
||||
% *******************************
|
||||
\section*{Conclusion}
|
||||
\begin{frame}
|
||||
\begin{center}
|
||||
\begin{huge}
|
||||
Question ?
|
||||
\end{huge}
|
||||
\end{center}
|
||||
\begin{center}
|
||||
\textcolor{gray}{\tiny{Enfin je vais essayer de répondre...}}
|
||||
\end{center}
|
||||
\end{frame}
|
||||
|
||||
\end{document}
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
After Width: | Height: | Size: 184 KiB |
|
After Width: | Height: | Size: 24 KiB |
|
After Width: | Height: | Size: 23 KiB |
Loading…
Reference in new issue