[PATCH 22/41] Drop dependencies between crypto libraries

[Stefano Babic]

This resolves hard dependencies between libraries. Each implementation
has defined the own structure using the common sslapi.h, and due to
differences in the libraries, this has many #ifdef. This forbids to
build multiple implementation of crypto services with different
libraries, because the header matches just one possible configuration.

Instead of a common header, this patch introduces per library header,
each of them with just the structures required. Components calling
crypto services are the freed from symbols that just belong to a
library, see SSL_PURPOSE_*.

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
---
core/swupdate.c | 1 -
crypto/Makefile | 3 +-
crypto/swupdate_HASH_mbedtls.c | 2 +-
crypto/swupdate_HASH_openssl.c | 7 +++-
crypto/swupdate_HASH_wolfssl.c | 25 ++++++++++++
crypto/swupdate_cms_verify_openssl.c | 2 +-
crypto/swupdate_decrypt_mbedtls.c | 3 +-
crypto/swupdate_decrypt_openssl.c | 2 +-
crypto/swupdate_decrypt_pkcs11.c | 2 +-
crypto/swupdate_gpg_verify.c | 12 +-----
crypto/swupdate_mbedtls.h | 24 +++++++++++
crypto/swupdate_openssl.h | 52 ++++++++++++++++++++++++
crypto/swupdate_pkcs7_verify_wolfssl.c | 2 +-
crypto/swupdate_rsa_verify_mbedtls.c | 2 +-
crypto/swupdate_rsa_verify_openssl.c | 2 +-
crypto/swupdate_wolfssl.h | 56 ++++++++++++++++++++++++++
include/swupdate_crypto.h | 19 +++++++--
test/test_crypt.c | 3 +-
test/test_verify.c | 1 -
19 files changed, 190 insertions(+), 30 deletions(-)
create mode 100644 crypto/swupdate_HASH_wolfssl.c
create mode 100644 crypto/swupdate_mbedtls.h
create mode 100644 crypto/swupdate_openssl.h
create mode 100644 crypto/swupdate_wolfssl.h

diff --git a/core/swupdate.c b/core/swupdate.c
index 37a6af39..d8ab1de8 100644
--- a/core/swupdate.c
+++ b/core/swupdate.c
@@ -40,7 +40,6 @@
#include "download_interface.h"
#include "network_ipc.h"
#include "network_utils.h"
-#include "sslapi.h"
#include "suricatta/suricatta.h"
#include "delta_process.h"
#include "progress.h"
diff --git a/crypto/Makefile b/crypto/Makefile
index 1961c3bf..c55af4e4 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -3,7 +3,6 @@
# SPDX-License-Identifier: GPL-2.0-only

ifeq ($(CONFIG_SSL_IMPL_OPENSSL)$(CONFIG_SSL_IMPL_WOLFSSL),y)
-obj-$(CONFIG_HASH_VERIFY) += swupdate_HASH_openssl.o
ifeq ($(CONFIG_PKCS11),y)
obj-$(CONFIG_ENCRYPTED_IMAGES) += swupdate_decrypt_pkcs11.o
else
@@ -13,9 +12,11 @@ obj-$(CONFIG_SIGALG_RAWRSA) += swupdate_rsa_verify_openssl.o
obj-$(CONFIG_SIGALG_RSAPSS) += swupdate_rsa_verify_openssl.o
endif
ifeq ($(CONFIG_SSL_IMPL_OPENSSL),y)
+obj-$(CONFIG_HASH_VERIFY) += swupdate_HASH_openssl.o
obj-$(CONFIG_SIGALG_CMS) += swupdate_cms_verify_openssl.o
endif
ifeq ($(CONFIG_SSL_IMPL_WOLFSSL),y)
+obj-$(CONFIG_HASH_VERIFY) += swupdate_HASH_wolfssl.o
obj-$(CONFIG_SIGALG_CMS) += swupdate_pkcs7_verify_wolfssl.o
endif
ifeq ($(CONFIG_SSL_IMPL_MBEDTLS),y)
diff --git a/crypto/swupdate_HASH_mbedtls.c b/crypto/swupdate_HASH_mbedtls.c
index dda108d8..df04ff8b 100644
--- a/crypto/swupdate_HASH_mbedtls.c
+++ b/crypto/swupdate_HASH_mbedtls.c
@@ -6,9 +6,9 @@
#include <errno.h>
#include <stdlib.h>

-#include "sslapi.h"
#include "util.h"
#include "swupdate_crypto.h"
+#include "swupdate_mbedtls.h"

static swupdate_HASH_lib hash;

diff --git a/crypto/swupdate_HASH_openssl.c b/crypto/swupdate_HASH_openssl.c
index 8da9d1bc..082c9744 100644
--- a/crypto/swupdate_HASH_openssl.c
+++ b/crypto/swupdate_HASH_openssl.c
@@ -12,7 +12,10 @@
#include <string.h>
#include <stdbool.h>
#include "swupdate.h"
-#include "sslapi.h"
+#if !defined(NO_INCLUDE_OPENSSL)
+#define MODNAME "openSSL"
+#include "swupdate_openssl.h"
+#endif
#include "util.h"
#include "compat.h"
#include "swupdate_crypto.h"
@@ -115,5 +118,5 @@ static void openssl_hash(void)
hash.HASH_final = openssl_HASH_final;
hash.HASH_compare = openssl_HASH_compare;
hash.HASH_cleanup = openssl_HASH_cleanup;
- (void)register_hashlib("opensslHASH", &hash);
+ (void)register_hashlib(MODNAME, &hash);
}
diff --git a/crypto/swupdate_HASH_wolfssl.c b/crypto/swupdate_HASH_wolfssl.c
new file mode 100644
index 00000000..3bf55777
--- /dev/null
+++ b/crypto/swupdate_HASH_wolfssl.c
@@ -0,0 +1,25 @@
+/*
+ * (C) Copyright 2024
+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Code mostly taken from openssl examples
+ */
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include "swupdate.h"
+#include "swupdate_wolfssl.h"
+
+/*
+ * Switch to WolfSSL in module
+ */
+#define NO_INCLUDE_OPENSSL
+#define MODNAME "WolfSSL"
+
+#include "swupdate_HASH_openssl.c"
+
diff --git a/crypto/swupdate_cms_verify_openssl.c b/crypto/swupdate_cms_verify_openssl.c
index 83ae7310..a26a3854 100644
--- a/crypto/swupdate_cms_verify_openssl.c
+++ b/crypto/swupdate_cms_verify_openssl.c
@@ -12,7 +12,7 @@
#include <string.h>
#include <stdbool.h>
#include "swupdate.h"
-#include "sslapi.h"
+#include "swupdate_openssl.h"
#include "util.h"
#include "swupdate_crypto.h"

diff --git a/crypto/swupdate_decrypt_mbedtls.c b/crypto/swupdate_decrypt_mbedtls.c
index 7ca8bb55..84894ce0 100644
--- a/crypto/swupdate_decrypt_mbedtls.c
+++ b/crypto/swupdate_decrypt_mbedtls.c
@@ -4,10 +4,9 @@

#include <errno.h>

-#include "sslapi.h"
#include "util.h"
#include "swupdate_crypto.h"
-
+#include "swupdate_mbedtls.h"

static swupdate_decrypt_lib mbedtls;

diff --git a/crypto/swupdate_decrypt_openssl.c b/crypto/swupdate_decrypt_openssl.c
index c9befe1c..13e3c119 100644
--- a/crypto/swupdate_decrypt_openssl.c
+++ b/crypto/swupdate_decrypt_openssl.c
@@ -13,7 +13,7 @@
#include <stdbool.h>
#include <unistd.h>
#include "swupdate.h"
-#include "sslapi.h"
+#include "swupdate_openssl.h"
#include "util.h"
#include "swupdate_crypto.h"

diff --git a/crypto/swupdate_decrypt_pkcs11.c b/crypto/swupdate_decrypt_pkcs11.c
index 7a4fd272..ff4afc51 100644
--- a/crypto/swupdate_decrypt_pkcs11.c
+++ b/crypto/swupdate_decrypt_pkcs11.c
@@ -10,7 +10,7 @@
#include <stdlib.h>
#include <string.h>
#include "swupdate.h"
-#include "sslapi.h"
+#include "swupdate_wolfssl.h"
#include "util.h"
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/wolfcrypt/logging.h>
diff --git a/crypto/swupdate_gpg_verify.c b/crypto/swupdate_gpg_verify.c
index a44735ec..d2b7840c 100644
--- a/crypto/swupdate_gpg_verify.c
+++ b/crypto/swupdate_gpg_verify.c
@@ -9,13 +9,13 @@
#include <string.h>
#include <stdbool.h>
#include "swupdate.h"
-#include "sslapi.h"
#include "util.h"

#include <errno.h>
#include <locale.h>
#include <gpgme.h>
#include "swupdate_crypto.h"
+#include "swupdate_gpg.h"

static swupdate_dgst_lib libs;

@@ -51,16 +51,6 @@ static int gpg_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
dgst->gpgme_protocol = sw->gpgme_protocol;
dgst->verbose = sw->verbose;

- /*
- * Create context
- */
- dgst->ctx = EVP_MD_CTX_create();
- if(dgst->ctx == NULL) {
- ERROR("EVP_MD_CTX_create failed, error 0x%lx", ERR_get_error());
- ret = -ENOMEM;
- goto dgst_init_error;
- }
-
sw->dgst = dgst;

return 0;
diff --git a/crypto/swupdate_mbedtls.h b/crypto/swupdate_mbedtls.h
new file mode 100644
index 00000000..facd0951
--- /dev/null
+++ b/crypto/swupdate_mbedtls.h
@@ -0,0 +1,24 @@
+/*
+ * (C) Copyright 2024
+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include "util.h"
+
+#include <mbedtls/md.h>
+#include <mbedtls/pk.h>
+#include <mbedtls/cipher.h>
+#include <mbedtls/version.h>
+
+#define EVP_MAX_BLOCK_LENGTH (16)
+
+struct swupdate_digest {
+ mbedtls_md_context_t mbedtls_md_context;
+ mbedtls_pk_context mbedtls_pk_context;
+ mbedtls_cipher_context_t mbedtls_cipher_context;
+};
diff --git a/crypto/swupdate_openssl.h b/crypto/swupdate_openssl.h
new file mode 100644
index 00000000..00d1d917
--- /dev/null
+++ b/crypto/swupdate_openssl.h
@@ -0,0 +1,52 @@
+/*
+ * (C) Copyright 2016-2024
+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include "util.h"
+
+#include <openssl/bio.h>
+#include <openssl/objects.h>
+#include <openssl/err.h>
+#include <openssl/x509.h>
+#include <openssl/x509v3.h>
+#include <openssl/pem.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+#include <openssl/aes.h>
+#include <openssl/opensslv.h>
+#include <openssl/cms.h>
+
+#if !defined(X509_PURPOSE_CODE_SIGN)
+#define X509_PURPOSE_CODE_SIGN (X509_PURPOSE_MAX + 1)
+#endif
+
+#define SSL_PURPOSE_EMAIL_PROT X509_PURPOSE_SMIME_SIGN
+
+#define SSL_PURPOSE_CODE_SIGN X509_PURPOSE_CODE_SIGN
+#define SSL_PURPOSE_DEFAULT SSL_PURPOSE_EMAIL_PROT
+
+struct swupdate_digest {
+ EVP_PKEY *pkey; /* this is used for RSA key */
+ EVP_PKEY_CTX *ckey; /* this is used for RSA key */
+ X509_STORE *certs; /* this is used if CMS is set */
+ EVP_MD_CTX *ctx;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ EVP_CIPHER_CTX ctxdec;
+#else
+ EVP_CIPHER_CTX *ctxdec;
+#endif
+};
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+#define SSL_GET_CTXDEC(dgst) &dgst->ctxdec
+#else
+#define SSL_GET_CTXDEC(dgst) dgst->ctxdec
+#endif
+
+
diff --git a/crypto/swupdate_pkcs7_verify_wolfssl.c b/crypto/swupdate_pkcs7_verify_wolfssl.c
index b226c3e2..76407c8e 100644
--- a/crypto/swupdate_pkcs7_verify_wolfssl.c
+++ b/crypto/swupdate_pkcs7_verify_wolfssl.c
@@ -14,7 +14,7 @@
#include <string.h>
#include <stdbool.h>
#include "swupdate.h"
-#include "sslapi.h"
+#include "swupdate_wolfssl.h"
#include "util.h"
#include "swupdate_crypto.h"
#include <wolfssl/openssl/pkcs7.h>
diff --git a/crypto/swupdate_rsa_verify_mbedtls.c b/crypto/swupdate_rsa_verify_mbedtls.c
index 2ddd7d99..a1ca8cfa 100644
--- a/crypto/swupdate_rsa_verify_mbedtls.c
+++ b/crypto/swupdate_rsa_verify_mbedtls.c
@@ -13,10 +13,10 @@
#include <sys/types.h>
#include <unistd.h>

-#include "sslapi.h"
#include "util.h"
#include "swupdate.h"
#include "swupdate_crypto.h"
+#include "swupdate_mbedtls.h"

static swupdate_dgst_lib libs;

diff --git a/crypto/swupdate_rsa_verify_openssl.c b/crypto/swupdate_rsa_verify_openssl.c
index 417921f0..2a0c2302 100644
--- a/crypto/swupdate_rsa_verify_openssl.c
+++ b/crypto/swupdate_rsa_verify_openssl.c
@@ -12,9 +12,9 @@
#include <string.h>
#include <stdbool.h>
#include "swupdate.h"
-#include "sslapi.h"
#include "util.h"
#include "swupdate_crypto.h"
+#include "swupdate_openssl.h"

#define BUFSIZE (1024 * 8)

diff --git a/crypto/swupdate_wolfssl.h b/crypto/swupdate_wolfssl.h
new file mode 100644
index 00000000..feff2775
--- /dev/null
+++ b/crypto/swupdate_wolfssl.h
@@ -0,0 +1,56 @@
+/*
+ * (C) Copyright 2024
+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include "util.h"
+
+#ifdef CONFIG_PKCS11
+#include <wolfssl/options.h>
+#include <wolfssl/ssl.h>
+#include <wolfssl/wolfcrypt/aes.h>
+#include <wolfssl/wolfcrypt/wc_pkcs11.h>
+// Exclude p11-kit's pkcs11.h to prevent conflicting with wolfssl's
+#define PKCS11_H 1
+#include <p11-kit/uri.h>
+#endif
+
+#include <wolfssl/options.h>
+#include <wolfssl/ssl.h>
+#include <wolfssl/openssl/bio.h>
+#include <wolfssl/openssl/objects.h>
+#include <wolfssl/openssl/err.h>
+#include <wolfssl/openssl/x509.h>
+#include <wolfssl/openssl/x509v3.h>
+#include <wolfssl/openssl/pem.h>
+#include <wolfssl/openssl/evp.h>
+#include <wolfssl/openssl/hmac.h>
+#include <wolfssl/openssl/aes.h>
+#include <wolfssl/openssl/opensslv.h>
+#include <wolfssl/openssl/pkcs7.h>
+
+#define EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, len) (1)
+
+#define X509_PURPOSE_CODE_SIGN EXTKEYUSE_CODESIGN
+#define SSL_PURPOSE_EMAIL_PROT EXTKEYUSE_EMAILPROT
+
+//#define SSL_PURPOSE_DEFAULT SSL_PURPOSE_EMAIL_PROT
+
+struct swupdate_digest {
+ EVP_PKEY *pkey; /* this is used for RSA key */
+ EVP_PKEY_CTX *ckey; /* this is used for RSA key */
+ X509_STORE *certs; /* this is used if CMS is set */
+ EVP_MD_CTX *ctx;
+#ifdef CONFIG_PKCS11
+ unsigned char last_decr[AES_BLOCK_SIZE + 1];
+ P11KitUri *p11uri;
+ Aes ctxdec;
+ Pkcs11Dev pkdev;
+ Pkcs11Token pktoken;
+#endif
+};
diff --git a/include/swupdate_crypto.h b/include/swupdate_crypto.h
index fa755297..067c0a2c 100644
--- a/include/swupdate_crypto.h
+++ b/include/swupdate_crypto.h
@@ -11,10 +11,21 @@

#define SHA_DEFAULT "sha256"

-#ifndef SSL_PURPOSE_DEFAULT
-#define SSL_PURPOSE_EMAIL_PROT -1
-#define SSL_PURPOSE_CODE_SIGN -1
-#define SSL_PURPOSE_DEFAULT -1
+/*
+ * This just initialize globally the openSSL
+ * library
+ * It must be called just once
+ */
+#if defined (OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10100000L
+#define swupdate_crypto_init() { \
+ do { \
+ CRYPTO_malloc_init(); \
+ OpenSSL_add_all_algorithms(); \
+ ERR_load_crypto_strings(); \
+ } while (0); \
+}
+#else
+#define swupdate_crypto_init()
#endif

struct swupdate_cfg;
diff --git a/test/test_crypt.c b/test/test_crypt.c
index 1de86802..6c49a8e8 100644
--- a/test/test_crypt.c
+++ b/test/test_crypt.c
@@ -26,7 +26,8 @@
#include <cmocka.h>
#include <util.h>
#include <swupdate_crypto.h>
-#include <sslapi.h>
+
+#define EVP_MAX_BLOCK_LENGTH (16)

struct cryptdata {
unsigned char *key;
diff --git a/test/test_verify.c b/test/test_verify.c
index 337e692e..1ed6793c 100644
--- a/test/test_verify.c
+++ b/test/test_verify.c
@@ -24,7 +24,6 @@
#include <cmocka.h>

#include "swupdate_crypto.h"
-#include "sslapi.h"
#include "swupdate.h"

#define DATADIR "test/data/"
--
2.43.0

[Stefano Babic]

Up now the core knows which is the internal structure used by the crypto
library to verify sw-description. The structure strongly depends on the
selected crypto library and this forbids to build SWUpdate with support
for multiple verification methods, and just one crypto library can be
linked at once. Structures are already allocated by the initialization
function for the crypto service, and it does not need to be known
outside the service, so use opaque pointer in the core.

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
---

core/crypto.c | 18 ++++++-------
crypto/swupdate_HASH_mbedtls.c | 13 +++++----
crypto/swupdate_HASH_openssl.c | 16 ++++++-----
crypto/swupdate_cms_verify_openssl.c | 6 +++--
crypto/swupdate_decrypt_mbedtls.c | 14 ++++++----
crypto/swupdate_decrypt_openssl.c | 15 +++++++----
crypto/swupdate_decrypt_pkcs11.c | 13 +++++----
crypto/swupdate_gpg.h | 17 ++++++++++++
crypto/swupdate_gpg_verify.c | 5 ++--
crypto/swupdate_mbedtls.h | 2 +-
crypto/swupdate_openssl.h | 2 +-
crypto/swupdate_pkcs7_verify_wolfssl.c | 5 ++--
crypto/swupdate_rsa_verify_mbedtls.c | 5 ++--
crypto/swupdate_rsa_verify_openssl.c | 11 ++++----
crypto/swupdate_wolfssl.h | 4 +--
include/channel_curl.h | 2 +-
include/swupdate_crypto.h | 37 +++++++++++++-------------
test/test_hash.c | 2 +-
18 files changed, 113 insertions(+), 74 deletions(-)
create mode 100644 crypto/swupdate_gpg.h

diff --git a/core/crypto.c b/core/crypto.c
index cce6884e..b41c477c 100644
--- a/core/crypto.c
+++ b/core/crypto.c
@@ -139,7 +139,7 @@ void print_registered_cryptolib(void)
}
}

-struct swupdate_digest *swupdate_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
+void *swupdate_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
{
swupdate_decrypt_lib *lib;
if (!get_cryptolib())
@@ -149,7 +149,7 @@ struct swupdate_digest *swupdate_DECRYPT_init(unsigned char *key, char keylen, u
return lib->DECRYPT_init(key, keylen, iv);
}

-int swupdate_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *buf,
+int swupdate_DECRYPT_update(void *dgst, unsigned char *buf,
int *outlen, const unsigned char *cryptbuf, int inlen)
{
swupdate_decrypt_lib *lib;
@@ -160,7 +160,7 @@ int swupdate_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *buf,
return lib->DECRYPT_update(dgst, buf, outlen, cryptbuf, inlen);
}

-int swupdate_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *buf, int *outlen)
+int swupdate_DECRYPT_final(void *dgst, unsigned char *buf, int *outlen)
{
swupdate_decrypt_lib *lib;
if (!get_cryptolib())
@@ -169,7 +169,7 @@ int swupdate_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *buf, int
return lib->DECRYPT_final(dgst, buf, outlen);
}

-void swupdate_DECRYPT_cleanup(struct swupdate_digest *dgst)
+void swupdate_DECRYPT_cleanup(void *dgst)
{
swupdate_decrypt_lib *lib;
if (!get_cryptolib())
@@ -178,7 +178,7 @@ void swupdate_DECRYPT_cleanup(struct swupdate_digest *dgst)
return lib->DECRYPT_cleanup(dgst);
}

-struct swupdate_digest *swupdate_HASH_init(const char *SHAlength)
+void *swupdate_HASH_init(const char *SHAlength)
{
swupdate_HASH_lib *lib;

@@ -189,7 +189,7 @@ struct swupdate_digest *swupdate_HASH_init(const char *SHAlength)
return lib->HASH_init(SHAlength);
}

-int swupdate_HASH_update(struct swupdate_digest *dgst, const unsigned char *buf, size_t len)
+int swupdate_HASH_update(void *dgst, const unsigned char *buf, size_t len)
{
swupdate_HASH_lib *lib;

@@ -200,7 +200,7 @@ int swupdate_HASH_update(struct swupdate_digest *dgst, const unsigned char *buf,
return lib->HASH_update(dgst, buf, len);
}

-int swupdate_HASH_final(struct swupdate_digest *dgst, unsigned char *md_value, unsigned int *md_len)
+int swupdate_HASH_final(void *dgst, unsigned char *md_value, unsigned int *md_len)
{
swupdate_HASH_lib *lib;

@@ -222,7 +222,7 @@ int swupdate_HASH_compare(const unsigned char *hash1, const unsigned char *hash2
return lib->HASH_compare(hash1, hash2);
}

-void swupdate_HASH_cleanup(struct swupdate_digest *dgst)
+void swupdate_HASH_cleanup(void *dgst)
{
swupdate_HASH_lib *lib;

@@ -244,7 +244,7 @@ int swupdate_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
return lib->dgst_init(sw, keyfile);
}

-int swupdate_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+int swupdate_verify_file(void *dgst, const char *sigfile,
const char *file, const char *signer_name)
{
swupdate_dgst_lib *lib;
diff --git a/crypto/swupdate_HASH_mbedtls.c b/crypto/swupdate_HASH_mbedtls.c
index df04ff8b..95060ffc 100644
--- a/crypto/swupdate_HASH_mbedtls.c
+++ b/crypto/swupdate_HASH_mbedtls.c
@@ -24,9 +24,9 @@ static char *algo_upper(const char *algo)
return result;
}

-static struct swupdate_digest *mbedtls_HASH_init(const char *algo)
+static void *mbedtls_HASH_init(const char *algo)
{
- struct swupdate_digest *dgst;
+ struct mbedtls_digest *dgst;
int error;

const mbedtls_md_info_t *info = mbedtls_md_info_from_string(algo_upper(algo));
@@ -61,9 +61,10 @@ fail:
return 0;
}

-static int mbedtls_HASH_update(struct swupdate_digest *dgst, const unsigned char *buf,
+static int mbedtls_HASH_update(void *ctx, const unsigned char *buf,
size_t len)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
if (!dgst) {
return -EFAULT;
}
@@ -77,9 +78,10 @@ static int mbedtls_HASH_update(struct swupdate_digest *dgst, const unsigned char
return 0;
}

-static int mbedtls_HASH_final(struct swupdate_digest *dgst, unsigned char *md_value,
+static int mbedtls_HASH_final(void *ctx, unsigned char *md_value,
unsigned int *md_len)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
if (!dgst) {
return -EFAULT;
}
@@ -99,8 +101,9 @@ static int mbedtls_HASH_final(struct swupdate_digest *dgst, unsigned char *md_va

}

-static void mbedtls_HASH_cleanup(struct swupdate_digest *dgst)
+static void mbedtls_HASH_cleanup(void *ctx)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
if (!dgst) {
return;
}
diff --git a/crypto/swupdate_HASH_openssl.c b/crypto/swupdate_HASH_openssl.c
index 082c9744..0c143797 100644
--- a/crypto/swupdate_HASH_openssl.c
+++ b/crypto/swupdate_HASH_openssl.c
@@ -22,7 +22,7 @@

static swupdate_HASH_lib hash;

-static int dgst_init(struct swupdate_digest *dgst, const EVP_MD *md)
+static int dgst_init(struct openssl_digest *dgst, const EVP_MD *md)
{
int rc;

@@ -36,9 +36,9 @@ static int dgst_init(struct swupdate_digest *dgst, const EVP_MD *md)
return 0;
}

-static struct swupdate_digest *openssl_HASH_init(const char *SHAlength)
+static void *openssl_HASH_init(const char *SHAlength)
{
- struct swupdate_digest *dgst;
+ struct openssl_digest *dgst;
const EVP_MD *md;
int ret;

@@ -68,9 +68,9 @@ static struct swupdate_digest *openssl_HASH_init(const char *SHAlength)
return dgst;
}

-static int openssl_HASH_update(struct swupdate_digest *dgst, const unsigned char *buf,
- size_t len)
+static int openssl_HASH_update(void *ctx, const unsigned char *buf, size_t len)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
if (!dgst)
return -EFAULT;

@@ -80,9 +80,10 @@ static int openssl_HASH_update(struct swupdate_digest *dgst, const unsigned char
return 0;
}

-static int openssl_HASH_final(struct swupdate_digest *dgst, unsigned char *md_value,
+static int openssl_HASH_final(void *ctx, unsigned char *md_value,
unsigned int *md_len)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
if (!dgst)
return -EFAULT;

@@ -90,8 +91,9 @@ static int openssl_HASH_final(struct swupdate_digest *dgst, unsigned char *md_va

}

-static void openssl_HASH_cleanup(struct swupdate_digest *dgst)
+static void openssl_HASH_cleanup(void *ctx)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
if (dgst) {
EVP_MD_CTX_destroy(dgst->ctx);
free(dgst);
diff --git a/crypto/swupdate_cms_verify_openssl.c b/crypto/swupdate_cms_verify_openssl.c
index a26a3854..6e980c39 100644
--- a/crypto/swupdate_cms_verify_openssl.c
+++ b/crypto/swupdate_cms_verify_openssl.c
@@ -264,7 +264,7 @@ static int check_verified_signer(CMS_ContentInfo* cms, X509_STORE* store)

static int openssl_cms_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
{
- struct swupdate_digest *dgst;
+ struct openssl_digest *dgst;
int ret;

/*
@@ -332,13 +332,15 @@ dgst_init_error:
return ret;
}

-static int openssl_cms_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+static int openssl_cms_verify_file(void *ctx, const char *sigfile,
const char *file, const char *signer_name)
{
int status = -EFAULT;
CMS_ContentInfo *cms = NULL;
BIO *content_bio = NULL;

+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
+
/* Open CMS blob that needs to be checked */
BIO *sigfile_bio = BIO_new_file(sigfile, "rb");
if (!sigfile_bio) {
diff --git a/crypto/swupdate_decrypt_mbedtls.c b/crypto/swupdate_decrypt_mbedtls.c
index 84894ce0..794f89d6 100644
--- a/crypto/swupdate_decrypt_mbedtls.c
+++ b/crypto/swupdate_decrypt_mbedtls.c
@@ -10,9 +10,9 @@

static swupdate_decrypt_lib mbedtls;

-static struct swupdate_digest *mbedtls_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
+static void *mbedtls_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
{
- struct swupdate_digest *dgst;
+ struct mbedtls_digest *dgst;
mbedtls_cipher_type_t cipher_type;
const mbedtls_cipher_info_t *cipher_info;
int key_bitlen;
@@ -92,9 +92,10 @@ fail:
return NULL;
}

-static int mbedtls_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *buf,
+static int mbedtls_DECRYPT_update(void *ctx, unsigned char *buf,
int *outlen, const unsigned char *cryptbuf, int inlen)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
int error;
size_t olen = *outlen;

@@ -108,11 +109,12 @@ static int mbedtls_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *b
return 0;
}

-static int mbedtls_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *buf,
+static int mbedtls_DECRYPT_final(void *ctx, unsigned char *buf,
int *outlen)
{
int error;
size_t olen = *outlen;
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;

if (!dgst) {
return -EINVAL;
@@ -131,8 +133,10 @@ static int mbedtls_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *bu

}

-static void mbedtls_DECRYPT_cleanup(struct swupdate_digest *dgst)
+static void mbedtls_DECRYPT_cleanup(void *ctx)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
+
if (!dgst) {
return;
}
diff --git a/crypto/swupdate_decrypt_openssl.c b/crypto/swupdate_decrypt_openssl.c
index 13e3c119..70026eb2 100644
--- a/crypto/swupdate_decrypt_openssl.c
+++ b/crypto/swupdate_decrypt_openssl.c
@@ -20,9 +20,9 @@
static void openssl_probe(void);

static swupdate_decrypt_lib openssl;
-static struct swupdate_digest *openssl_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
+static void *openssl_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
{
- struct swupdate_digest *dgst;
+ struct openssl_digest *dgst;
const EVP_CIPHER *cipher;
int ret;

@@ -82,9 +82,12 @@ static struct swupdate_digest *openssl_DECRYPT_init(unsigned char *key, char key
return dgst;
}

-static int openssl_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *buf,
+static int openssl_DECRYPT_update(void *ctx, unsigned char *buf,
int *outlen, const unsigned char *cryptbuf, int inlen)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
+ if (!dgst)
+ return -EINVAL;
if (EVP_DecryptUpdate(SSL_GET_CTXDEC(dgst), buf, outlen, cryptbuf, inlen) != 1) {
const char *reason = ERR_reason_error_string(ERR_peek_error());
ERROR("Update: Decryption error 0x%lx, reason: %s", ERR_get_error(),
@@ -95,9 +98,10 @@ static int openssl_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *b
return 0;
}

-static int openssl_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *buf,
+static int openssl_DECRYPT_final(void *ctx, unsigned char *buf,
int *outlen)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
if (!dgst)
return -EINVAL;

@@ -114,8 +118,9 @@ static int openssl_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *bu

}

-static void openssl_DECRYPT_cleanup(struct swupdate_digest *dgst)
+static void openssl_DECRYPT_cleanup(void *ctx)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
if (dgst) {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
EVP_CIPHER_CTX_cleanup(SSL_GET_CTXDEC(dgst));
diff --git a/crypto/swupdate_decrypt_pkcs11.c b/crypto/swupdate_decrypt_pkcs11.c
index ff4afc51..7991286d 100644
--- a/crypto/swupdate_decrypt_pkcs11.c
+++ b/crypto/swupdate_decrypt_pkcs11.c
@@ -25,10 +25,10 @@ static void wolfssl_debug(int __attribute__ ((__unused__)) level, const char *co
}
#endif

-static struct swupdate_digest *wolfssl_DECRYPT_init(unsigned char *uri,
+static void *wolfssl_DECRYPT_init(unsigned char *uri,
char __attribute__ ((__unused__)) keylen, unsigned char *iv)
{
- struct swupdate_digest *dgst;
+ struct wolfssl_digest *dgst;
const char *library;
const char *pin;
const char *msg;
@@ -119,9 +119,10 @@ err_free:
return NULL;
}

-static int wolfssl_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *buf,
+static int wolfssl_DECRYPT_update(void *ctx, unsigned char *buf,
int *outlen, const unsigned char *cryptbuf, int inlen)
{
+ struct wolfssl_digest *dgst = (struct wolfssl_digest *)ctx;
// precondition: len(buf) >= inlen + AES_BLK_SIZE
unsigned char *pad_buf = &buf[AES_BLK_SIZE];
const char *msg;
@@ -156,8 +157,9 @@ static int wolfssl_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *b
}

// Gets rid of PKCS#7 padding
-static int wolfssl_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *buf, int *outlen)
+static int wolfssl_DECRYPT_final(void *ctx, unsigned char *buf, int *outlen)
{
+ struct wolfssl_digest *dgst = (struct wolfssl_digest *)ctx;
unsigned char last_oct = dgst->last_decr[AES_BLK_SIZE - 1];
if (last_oct > AES_BLK_SIZE || last_oct == 0) {
#ifndef CONFIG_ENCRYPTED_IMAGES_HARDEN_LOGGING
@@ -181,8 +183,9 @@ static int wolfssl_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *bu
return 0;
}

-static void wolfssl_DECRYPT_cleanup(struct swupdate_digest *dgst)
+static void wolfssl_DECRYPT_cleanup(void *ctx)
{
+ struct wolfssl_digest *dgst = (struct wolfssl_digest *)ctx;
if (dgst) {
if (&dgst->pktoken)
wc_Pkcs11Token_Final(&dgst->pktoken);
diff --git a/crypto/swupdate_gpg.h b/crypto/swupdate_gpg.h
new file mode 100644
index 00000000..c2ea55a7
--- /dev/null
+++ b/crypto/swupdate_gpg.h
@@ -0,0 +1,17 @@

+/*
+ * (C) Copyright 2016-2024
+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include "util.h"
+

+struct gpg_digest {
+ char *gpg_home_directory;
+ bool verbose;
+ char *gpgme_protocol;
+};
diff --git a/crypto/swupdate_gpg_verify.c b/crypto/swupdate_gpg_verify.c
index d2b7840c..b726336f 100644
--- a/crypto/swupdate_gpg_verify.c
+++ b/crypto/swupdate_gpg_verify.c
@@ -31,7 +31,7 @@ status_cb(void *opaque, const char *keyword, const char *value)

static int gpg_dgst_init(struct swupdate_cfg *sw, const char *keyfile)

{
- struct swupdate_digest *dgst;
+ struct gpg_digest *dgst;
int ret;

/*
@@ -62,9 +62,10 @@ dgst_init_error:
return ret;
}

-static int gpg_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+static int gpg_verify_file(void *gpgdgst, const char *sigfile,
const char *file, const char *signer_name)
{
+ struct gpg_digest *dgst = (struct gpg_digest *)gpgdgst;
gpgme_ctx_t ctx;
gpgme_error_t err;
gpgme_data_t image_sig, image;
diff --git a/crypto/swupdate_mbedtls.h b/crypto/swupdate_mbedtls.h
index facd0951..175b70cc 100644
--- a/crypto/swupdate_mbedtls.h
+++ b/crypto/swupdate_mbedtls.h
@@ -17,7 +17,7 @@

#define EVP_MAX_BLOCK_LENGTH (16)

-struct swupdate_digest {
+struct mbedtls_digest {
mbedtls_md_context_t mbedtls_md_context;
mbedtls_pk_context mbedtls_pk_context;
mbedtls_cipher_context_t mbedtls_cipher_context;
diff --git a/crypto/swupdate_openssl.h b/crypto/swupdate_openssl.h
index 00d1d917..4dc79503 100644
--- a/crypto/swupdate_openssl.h
+++ b/crypto/swupdate_openssl.h
@@ -31,7 +31,7 @@
#define SSL_PURPOSE_CODE_SIGN X509_PURPOSE_CODE_SIGN
#define SSL_PURPOSE_DEFAULT SSL_PURPOSE_EMAIL_PROT

-struct swupdate_digest {
+struct openssl_digest {

EVP_PKEY *pkey; /* this is used for RSA key */

EVP_PKEY_CTX *ckey; /* this is used for RSA key */

X509_STORE *certs; /* this is used if CMS is set */

diff --git a/crypto/swupdate_pkcs7_verify_wolfssl.c b/crypto/swupdate_pkcs7_verify_wolfssl.c
index 76407c8e..39a29c89 100644
--- a/crypto/swupdate_pkcs7_verify_wolfssl.c
+++ b/crypto/swupdate_pkcs7_verify_wolfssl.c
@@ -107,7 +107,7 @@ static int check_signer_name(const char *name)

static int wolfssl_pkcs7_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
{
- struct swupdate_digest *dgst;
+ struct wolfssl_digest *dgst;
int ret;

/*
@@ -154,9 +154,10 @@ dgst_init_error:
return ret;
}

-static int wolfssl_pkcs7_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+static int wolfssl_pkcs7_verify_file(void *ctx, const char *sigfile,
const char *file, const char *signer_name)
{
+ struct wolfssl_digest *dgst = (struct wolfssl_digest *)ctx;
int status = -EFAULT;
WOLFSSL_PKCS7* pkcs7 = (WOLFSSL_PKCS7 *)PKCS7_new();
BIO *bio_mem = NULL;
diff --git a/crypto/swupdate_rsa_verify_mbedtls.c b/crypto/swupdate_rsa_verify_mbedtls.c
index a1ca8cfa..207c27ae 100644
--- a/crypto/swupdate_rsa_verify_mbedtls.c
+++ b/crypto/swupdate_rsa_verify_mbedtls.c
@@ -46,9 +46,10 @@ exit:
return result;
}

-static int mbedtls_rsa_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+static int mbedtls_rsa_verify_file(void *ctx, const char *sigfile,
const char *file, const char *signer_name)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
int error;
uint8_t hash_computed[32];
const mbedtls_md_info_t *md_info;
@@ -95,7 +96,7 @@ static int mbedtls_rsa_verify_file(struct swupdate_digest *dgst, const char *sig

static int mbedtls_rsa_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
{
- struct swupdate_digest *dgst;
+ struct mbedtls_digest *dgst;

dgst = calloc(1, sizeof(*dgst));
if (!dgst) {
diff --git a/crypto/swupdate_rsa_verify_openssl.c b/crypto/swupdate_rsa_verify_openssl.c
index 2a0c2302..1382293c 100644
--- a/crypto/swupdate_rsa_verify_openssl.c
+++ b/crypto/swupdate_rsa_verify_openssl.c
@@ -51,7 +51,7 @@ end:
return(pkey);
}

-static int dgst_verify_init(struct swupdate_digest *dgst)
+static int dgst_verify_init(struct openssl_digest *dgst)
{
int rc;

@@ -77,7 +77,7 @@ static int dgst_verify_init(struct swupdate_digest *dgst)
return 0;
}

-static int verify_update(struct swupdate_digest *dgst, char *msg, unsigned int mlen)
+static int verify_update(struct openssl_digest *dgst, char *msg, unsigned int mlen)
{
int rc;

@@ -90,7 +90,7 @@ static int verify_update(struct swupdate_digest *dgst, char *msg, unsigned int m
return 0;
}

-static int verify_final(struct swupdate_digest *dgst, unsigned char *sig, unsigned int slen)
+static int verify_final(struct openssl_digest *dgst, unsigned char *sig, unsigned int slen)
{
unsigned int rc;

@@ -105,9 +105,10 @@ static int verify_final(struct swupdate_digest *dgst, unsigned char *sig, unsign
return rc;
}

-static int openssl_rsa_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+static int openssl_rsa_verify_file(void *ctx, const char *sigfile,
const char *file, const char *signer_name)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
FILE *fp = NULL;
BIO *sigbio;
int siglen = 0;
@@ -201,7 +202,7 @@ out:

static int openssl_rsa_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
{
- struct swupdate_digest *dgst;
+ struct openssl_digest *dgst;
int ret;

/*
diff --git a/crypto/swupdate_wolfssl.h b/crypto/swupdate_wolfssl.h
index feff2775..00f18714 100644
--- a/crypto/swupdate_wolfssl.h
+++ b/crypto/swupdate_wolfssl.h
@@ -39,9 +39,9 @@
#define X509_PURPOSE_CODE_SIGN EXTKEYUSE_CODESIGN
#define SSL_PURPOSE_EMAIL_PROT EXTKEYUSE_EMAILPROT

-//#define SSL_PURPOSE_DEFAULT SSL_PURPOSE_EMAIL_PROT
+#define openssl_digest wolfssl_digest

-struct swupdate_digest {
+struct wolfssl_digest {

EVP_PKEY *pkey; /* this is used for RSA key */

EVP_PKEY_CTX *ckey; /* this is used for RSA key */

X509_STORE *certs; /* this is used if CMS is set */

diff --git a/include/channel_curl.h b/include/channel_curl.h
index ae49b2bc..ccd4158f 100644
--- a/include/channel_curl.h
+++ b/include/channel_curl.h
@@ -86,7 +86,7 @@ typedef struct {
int read_fifo;
size_t (*headers)(char *streamdata, size_t size, size_t nmemb,
void *data);
- struct swupdate_digest *dgst;
+ void *dgst;
char sha1hash[SWUPDATE_SHA_DIGEST_LENGTH * 2 + 1];
sourcetype source;
struct dict *headers_to_send;
diff --git a/include/swupdate_crypto.h b/include/swupdate_crypto.h
index 067c0a2c..243b6068 100644
--- a/include/swupdate_crypto.h
+++ b/include/swupdate_crypto.h
@@ -37,25 +37,25 @@ typedef enum {
} ssl_cert_purpose_t;

typedef struct {
- struct swupdate_digest *(*DECRYPT_init)(unsigned char *key, char keylen, unsigned char *iv);
- int (*DECRYPT_update)(struct swupdate_digest *dgst, unsigned char *buf,
+ void *(*DECRYPT_init)(unsigned char *key, char keylen, unsigned char *iv);
+ int (*DECRYPT_update)(void *ctx, unsigned char *buf,
int *outlen, const unsigned char *cryptbuf, int inlen);

- int (*DECRYPT_final)(struct swupdate_digest *dgst, unsigned char *buf, int *outlen);
- void (*DECRYPT_cleanup)(struct swupdate_digest *dgst);
+ int (*DECRYPT_final)(void *ctx, unsigned char *buf, int *outlen);
+ void (*DECRYPT_cleanup)(void *ctx);
} swupdate_decrypt_lib;

typedef struct {
- struct swupdate_digest *(*HASH_init)(const char *SHAlength);
- int (*HASH_update)(struct swupdate_digest *dgst, const unsigned char *buf, size_t len);
- int (*HASH_final)(struct swupdate_digest *dgst, unsigned char *md_value, unsigned int *md_len);
+ void *(*HASH_init)(const char *SHAlength);
+ int (*HASH_update)(void *ctx, const unsigned char *buf, size_t len);
+ int (*HASH_final)(void *ctx, unsigned char *md_value, unsigned int *md_len);
int (*HASH_compare)(const unsigned char *hash1, const unsigned char *hash2);
- void (*HASH_cleanup)(struct swupdate_digest *dgst);
+ void (*HASH_cleanup)(void *ctx);
} swupdate_HASH_lib;

typedef struct {
int (*dgst_init)(struct swupdate_cfg *sw, const char *keyfile);
- int (*verify_file)(struct swupdate_digest *dgst, const char *sigfile, const char *file, const char *signer_name);
+ int (*verify_file)(void *ctx, const char *sigfile, const char *file, const char *signer_name);
} swupdate_dgst_lib;

/*
@@ -106,20 +106,19 @@ void print_registered_cryptolib(void);
struct swupdate_cfg;

int swupdate_dgst_init(struct swupdate_cfg *sw, const char *keyfile);
-struct swupdate_digest *swupdate_HASH_init(const char *SHALength);
-int swupdate_HASH_update(struct swupdate_digest *dgst, const unsigned char *buf,
+void *swupdate_HASH_init(const char *SHALength);
+int swupdate_HASH_update(void *ctx, const unsigned char *buf,
size_t len);
-int swupdate_HASH_final(struct swupdate_digest *dgst, unsigned char *md_value,
+int swupdate_HASH_final(void *ctx, unsigned char *md_value,
unsigned int *md_len);
-void swupdate_HASH_cleanup(struct swupdate_digest *dgst);
-int swupdate_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+void swupdate_HASH_cleanup(void *ctx);
+int swupdate_verify_file(void *ctx, const char *sigfile,
const char *file, const char *signer_name);
int swupdate_HASH_compare(const unsigned char *hash1, const unsigned char *hash2);

-
-struct swupdate_digest *swupdate_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv);
-int swupdate_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *buf,
+void *swupdate_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv);
+int swupdate_DECRYPT_update(void *ctx, unsigned char *buf,
int *outlen, const unsigned char *cryptbuf, int inlen);
-int swupdate_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *buf,
+int swupdate_DECRYPT_final(void *ctx, unsigned char *buf,
int *outlen);
-void swupdate_DECRYPT_cleanup(struct swupdate_digest *dgst);
+void swupdate_DECRYPT_cleanup(void *ctx);
diff --git a/test/test_hash.c b/test/test_hash.c
index 4d62b03a..895dcf4c 100644
--- a/test/test_hash.c
+++ b/test/test_hash.c
@@ -72,7 +72,7 @@ static void do_concrete_hash(const char* algo, const char* input, const char* ex
uint8_t result[32] = {0};
unsigned len = 0;
uint8_t expected_bin[32] = {0};
- struct swupdate_digest *dgst;
+ void *dgst;

dgst = swupdate_HASH_init(algo);
assert_non_null(dgst);
--
2.43.0

[Stefano Babic]

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
---

crypto/swupdate_pkcs7_verify_wolfssl.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/crypto/swupdate_pkcs7_verify_wolfssl.c b/crypto/swupdate_pkcs7_verify_wolfssl.c
index bffd1a91..b226c3e2 100644
--- a/crypto/swupdate_pkcs7_verify_wolfssl.c
+++ b/crypto/swupdate_pkcs7_verify_wolfssl.c
@@ -19,6 +19,10 @@
#include "swupdate_crypto.h"
#include <wolfssl/openssl/pkcs7.h>

+#ifndef PKCS7_BINARY
+#define PKCS7_BINARY 0x80
+#endif
+
static swupdate_dgst_lib libs;

static int store_verify_callback(int ok, X509_STORE_CTX *ctx) {
--
2.43.0

[Stefano Babic]

File is substituted with per library specific header.

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
---

include/sslapi.h | 155 -----------------------------------------------
1 file changed, 155 deletions(-)
delete mode 100644 include/sslapi.h

diff --git a/include/sslapi.h b/include/sslapi.h
deleted file mode 100644
index 8564373c..00000000
--- a/include/sslapi.h
+++ /dev/null
@@ -1,155 +0,0 @@
-/*
- * (C) Copyright 2016
- * Stefano Babic, stefan...@swupdate.org.
- *
- * SPDX-License-Identifier: GPL-2.0-only
- */
-
-#pragma once
-
-#include <stdint.h>
-#include "util.h"
-
-/*
- * openSSL is not mandatory
- * Let compile when openSSL is not activated
- */
-#if defined(CONFIG_HASH_VERIFY) || defined(CONFIG_ENCRYPTED_IMAGES)
-
-#ifdef CONFIG_PKCS11
-#include <wolfssl/options.h>
-#include <wolfssl/ssl.h>
-#include <wolfssl/wolfcrypt/aes.h>
-#include <wolfssl/wolfcrypt/wc_pkcs11.h>
-// Exclude p11-kit's pkcs11.h to prevent conflicting with wolfssl's
-#define PKCS11_H 1
-#include <p11-kit/uri.h>
-#endif
-
-#ifdef CONFIG_SSL_IMPL_OPENSSL
-#include <openssl/bio.h>
-#include <openssl/objects.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-#include <openssl/pem.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-#include <openssl/aes.h>
-#include <openssl/opensslv.h>
-#include <openssl/cms.h>
-#elif defined(CONFIG_SSL_IMPL_WOLFSSL)
-#include <wolfssl/options.h>
-#include <wolfssl/ssl.h>
-#include <wolfssl/openssl/bio.h>
-#include <wolfssl/openssl/objects.h>
-#include <wolfssl/openssl/err.h>
-#include <wolfssl/openssl/x509.h>
-#include <wolfssl/openssl/x509v3.h>
-#include <wolfssl/openssl/pem.h>
-#include <wolfssl/openssl/evp.h>
-#include <wolfssl/openssl/hmac.h>
-#include <wolfssl/openssl/aes.h>
-#include <wolfssl/openssl/opensslv.h>
-#include <wolfssl/openssl/pkcs7.h>
-#endif
-
-#if defined(CONFIG_SSL_IMPL_OPENSSL) || defined(CONFIG_SSL_IMPL_WOLFSSL)
-
-#ifdef CONFIG_SSL_IMPL_WOLFSSL
-#define EVP_PKEY_CTX_set_rsa_pss_saltlen(ctx, len) (1)
-
-#define X509_PURPOSE_CODE_SIGN EXTKEYUSE_CODESIGN
-#define SSL_PURPOSE_EMAIL_PROT EXTKEYUSE_EMAILPROT
-#else
-#if !defined(X509_PURPOSE_CODE_SIGN)
-#define X509_PURPOSE_CODE_SIGN (X509_PURPOSE_MAX + 1)
-#endif
-#define SSL_PURPOSE_EMAIL_PROT X509_PURPOSE_SMIME_SIGN
-#endif
-#define SSL_PURPOSE_CODE_SIGN X509_PURPOSE_CODE_SIGN
-#define SSL_PURPOSE_DEFAULT SSL_PURPOSE_EMAIL_PROT
-
-struct swupdate_digest {
- EVP_PKEY *pkey; /* this is used for RSA key */
- EVP_PKEY_CTX *ckey; /* this is used for RSA key */
- X509_STORE *certs; /* this is used if CMS is set */
- EVP_MD_CTX *ctx;
-#ifdef CONFIG_PKCS11
- unsigned char last_decr[AES_BLOCK_SIZE + 1];
- P11KitUri *p11uri;
- Aes ctxdec;
- Pkcs11Dev pkdev;
- Pkcs11Token pktoken;
-#elif OPENSSL_VERSION_NUMBER < 0x10100000L
- EVP_CIPHER_CTX ctxdec;
-#else
- EVP_CIPHER_CTX *ctxdec;
-#endif
-#ifdef CONFIG_SIGALG_GPG
- char *gpg_home_directory;
- bool verbose;
- char *gpgme_protocol;
-#endif
-};
-
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#define SSL_GET_CTXDEC(dgst) &dgst->ctxdec
-#else
-#define SSL_GET_CTXDEC(dgst) dgst->ctxdec
-#endif
-
-/*
- * This just initialize globally the openSSL
- * library
- * It must be called just once
- */
-#if OPENSSL_VERSION_NUMBER < 0x10100000L
-#define swupdate_crypto_init() { \
- do { \
- CRYPTO_malloc_init(); \
- OpenSSL_add_all_algorithms(); \
- ERR_load_crypto_strings(); \
- } while (0); \
-}
-#else
-#define swupdate_crypto_init()
-#endif
-
-#elif defined(CONFIG_SSL_IMPL_MBEDTLS)
-#include <mbedtls/md.h>
-#include <mbedtls/pk.h>
-#include <mbedtls/cipher.h>
-
-#define EVP_MAX_BLOCK_LENGTH (16)
-#define swupdate_crypto_init()
-
-struct swupdate_digest {
-#ifdef CONFIG_HASH_VERIFY
- mbedtls_md_context_t mbedtls_md_context;
-#endif /* CONFIG_HASH_VERIFY */
-#ifdef CONFIG_SIGNED_IMAGES
- mbedtls_pk_context mbedtls_pk_context;
-#endif /* CONFIG_SIGNED_IMAGES */
-#ifdef CONFIG_PKCS11
- unsigned char last_decr[AES_BLOCK_SIZE + 1];
- P11KitUri *p11uri;
- Aes ctxdec;
- Pkcs11Dev pkdev;
- Pkcs11Token pktoken;
-#elif defined(CONFIG_ENCRYPTED_IMAGES)
- mbedtls_cipher_context_t mbedtls_cipher_context;
-#endif /* CONFIG_PKCS11 */
-#ifdef CONFIG_SIGALG_GPG
- char *gpg_home_directory;
- int verbose;
- char *gpgme_protocol;
-#endif
-};
-
-#else /* CONFIG_SSL_IMPL */
-#error unknown SSL implementation
-#endif /* CONFIG_SSL_IMPL */
-#else
-#define swupdate_crypto_init()
-#endif
--
2.43.0

[Stefano Babic]

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
---

Kconfig | 114 +---------------------------------------------
crypto/Kconfig | 120 +++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 121 insertions(+), 113 deletions(-)
create mode 100644 crypto/Kconfig

diff --git a/Kconfig b/Kconfig
index 9171a7b2..2cf68eb8 100644
--- a/Kconfig
+++ b/Kconfig
@@ -399,125 +399,13 @@ source "mongoose/Kconfig"

comment "Security"

-menu "Cryoto libraries"
- config SSL_IMPL_OPENSSL
- bool "OpenSSL"
- default y
- depends on HAVE_LIBSSL
-
- config SSL_IMPL_WOLFSSL
- bool "wolfSSL (with OpenSSL compatibility layer)"
- depends on HAVE_WOLFSSL
- select CMS_IGNORE_CERTIFICATE_PURPOSE if SIGALG_CMS
- select CMS_SKIP_UNKNOWN_SIGNERS if SIGALG_CMS
- select PKCS11
-
- config SSL_IMPL_MBEDTLS
- bool "mbedTLS"
- depends on HAVE_MBEDTLS
-
- config SSL_IMPL_GPGME
- bool "gpgme"
- depends on HAVE_GPGME
-endmenu
+source "crypto/Kconfig"

config CHANNEL_CURL_SSL
bool
depends on CHANNEL_CURL
select CURL_SSL

-config HASH_VERIFY
- bool "Allow to add sha256 hash to each image"
- depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL || SSL_IMPL_MBEDTLS
- help
- Allow to add a sha256 hash to an artifact.
- This is automatically set in case of Signed Image
-
-comment "Hash checking needs an SSL implementation"
- depends on !SSL_IMPL_OPENSSL && !SSL_IMPL_WOLFSSL && !SSL_IMPL_MBEDTLS
-
-config SIGNED_IMAGES
- bool "Enable verification of signed images"
- depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL || SSL_IMPL_MBEDTLS
- select HASH_VERIFY
-comment "Image signature verification needs an SSL implementation"
- depends on !SSL_IMPL_OPENSSL && !SSL_IMPL_WOLFSSL && !SSL_IMPL_MBEDTLS
-
-menu "Signature verification algorithm"
- depends on SIGNED_IMAGES
-
- config SIGALG_RAWRSA
- bool "RSA PKCS#1.5"
- default y
- depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL || SSL_IMPL_MBEDTLS
-
- config SIGALG_RSAPSS
- bool "RSA PSS"
- depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL
-
- config SIGALG_CMS
- bool "Cryptographic Message Syntax (CMS) / PKCS#7"
- depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL
-
- config SIGALG_GPG
- bool "GPG signing"
- depends on SSL_IMPL_GPGME
-endmenu
-
-menu "CMS / PKCS#7 signature verification options"
- depends on SIGALG_CMS
-
-config CMS_IGNORE_EXPIRED_CERTIFICATE
- bool "Ignore expired certificates"
- depends on SIGALG_CMS
-
-config CMS_IGNORE_CERTIFICATE_PURPOSE
- bool "Ignore X.509 certificate purpose"
- depends on SIGALG_CMS
-
-config CMS_SKIP_UNKNOWN_SIGNERS
- bool "Ignore unverifiable signatures if known signer verifies"
- depends on SIGALG_CMS
-endmenu
-
-
-config ENCRYPTED_IMAGES
- bool "Images can be encrypted with a symmetric key"
- depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL || SSL_IMPL_MBEDTLS
-comment "Image encryption needs an SSL implementation"
- depends on !SSL_IMPL_OPENSSL && !SSL_IMPL_WOLFSSL && !SSL_IMPL_MBEDTLS
-
-config ENCRYPTED_SW_DESCRIPTION
- bool "Even sw-description is encrypted"
- depends on ENCRYPTED_IMAGES
- help
- sw-description is not encrypted as default, but it is encrypted
- if this is set. It is a compile time option, and mix of plain and
- encrypted sw-descriptions is not possible.
-
-config ENCRYPTED_IMAGES_HARDEN_LOGGING
- bool "Harden logging for encrypted images"
- default n
- depends on ENCRYPTED_IMAGES
- help
- This option addresses a theoretical weakness of the AES-CBC encryption in
- combination with streamed images. An adversary can target each 16-byte
- block of encrypted data within an image and decrypt it, if they can apply a
- huge amount of manipulated firmware updates and observe the logged
- messages. On average, 2048 update attempts are needed for each block.
- Select if this scenario poses a risk. If set, log messages related to a
- hash mismatch and errors in the decryption finalization (padding) of a
- streamed image are suppressed.
-
-config PKCS11
- bool "Enable PKCS#11 cryptographic operations"
- default n
- depends on HAVE_WOLFSSL && HAVE_P11KIT && ENCRYPTED_IMAGES
- help
- Enable using PKCS#11 for AES decryption instead of having the plain
- key available in a file. This is implemented with wolfSSL independent
- from the SSL implementation and replaces the plain key method.
-
comment "Compressors (zlib always on)"

config GUNZIP
diff --git a/crypto/Kconfig b/crypto/Kconfig
new file mode 100644
index 00000000..55ebf0dd
--- /dev/null
+++ b/crypto/Kconfig
@@ -0,0 +1,120 @@
+# SPDX-FileCopyrightText: 2024 Stefano Babic <stefan...@swupdate.org>
+#
+# SPDX-License-Identifier: GPL-2.0-only
+
+menu "Crypto libraries"
+ config SSL_IMPL_OPENSSL
+ bool "OpenSSL"
+ default y
+ depends on HAVE_LIBSSL
+
+ config SSL_IMPL_WOLFSSL
+ bool "wolfSSL (with OpenSSL compatibility layer)"
+ depends on HAVE_WOLFSSL
+ select CMS_IGNORE_CERTIFICATE_PURPOSE if SIGALG_CMS
+ select CMS_SKIP_UNKNOWN_SIGNERS if SIGALG_CMS
+
+ config SSL_IMPL_MBEDTLS
+ bool "mbedTLS"
+ depends on HAVE_MBEDTLS
+
+ config SSL_IMPL_GPGME
+ bool "gpgme"
+ depends on HAVE_GPGME
+endmenu
+
+config HASH_VERIFY
+ bool "Allow to add sha256 hash to each image"
+ depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL || SSL_IMPL_MBEDTLS
+ help
+ Allow to add a sha256 hash to an artifact.
+ This is automatically set in case of Signed Image
+
+comment "Hash checking needs an SSL implementation"
+ depends on !SSL_IMPL_OPENSSL && !SSL_IMPL_WOLFSSL && !SSL_IMPL_MBEDTLS
+
+config SIGNED_IMAGES
+ bool "Enable verification of signed images"
+ depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL || SSL_IMPL_MBEDTLS
+ select HASH_VERIFY
+comment "Image signature verification needs an SSL implementation"
+ depends on !SSL_IMPL_OPENSSL && !SSL_IMPL_WOLFSSL && !SSL_IMPL_MBEDTLS
+
+menu "Signature verification algorithm"
+ depends on SIGNED_IMAGES
+
+ config SIGALG_RAWRSA
+ bool "RSA PKCS#1.5"
+ default n
+ depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL || SSL_IMPL_MBEDTLS
+
+ config SIGALG_RSAPSS
+ bool "RSA PSS"
+ default n
+ depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL
+
+ config SIGALG_CMS
+ bool "Cryptographic Message Syntax (CMS) / PKCS#7"
+ depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL
+
+ config SIGALG_GPG
+ bool "GPG signing"
+ depends on SSL_IMPL_GPGME
+endmenu
+
+menu "CMS / PKCS#7 signature verification options"
+ depends on SIGALG_CMS
+
+config CMS_IGNORE_EXPIRED_CERTIFICATE
+ bool "Ignore expired certificates"
+ depends on SIGALG_CMS
+
+config CMS_IGNORE_CERTIFICATE_PURPOSE
+ bool "Ignore X.509 certificate purpose"
+ depends on SIGALG_CMS
+
+config CMS_SKIP_UNKNOWN_SIGNERS
+ bool "Ignore unverifiable signatures if known signer verifies"
+ depends on SIGALG_CMS
+endmenu
+
+menu "Encryption"
+
+config ENCRYPTED_IMAGES
+ bool "Images can be encrypted with a symmetric key"
+ depends on SSL_IMPL_OPENSSL || SSL_IMPL_WOLFSSL || SSL_IMPL_MBEDTLS
+comment "Image encryption needs an SSL implementation"
+ depends on !SSL_IMPL_OPENSSL && !SSL_IMPL_WOLFSSL && !SSL_IMPL_MBEDTLS
+
+config ENCRYPTED_SW_DESCRIPTION
+ bool "Even sw-description is encrypted"
+ depends on ENCRYPTED_IMAGES
+ help
+ sw-description is not encrypted as default, but it is encrypted
+ if this is set. It is a compile time option, and mix of plain and
+ encrypted sw-descriptions is not possible.
+
+config ENCRYPTED_IMAGES_HARDEN_LOGGING
+ bool "Harden logging for encrypted images"
+ default n
+ depends on ENCRYPTED_IMAGES
+ help
+ This option addresses a theoretical weakness of the AES-CBC encryption in
+ combination with streamed images. An adversary can target each 16-byte
+ block of encrypted data within an image and decrypt it, if they can apply a
+ huge amount of manipulated firmware updates and observe the logged
+ messages. On average, 2048 update attempts are needed for each block.
+ Select if this scenario poses a risk. If set, log messages related to a
+ hash mismatch and errors in the decryption finalization (padding) of a
+ streamed image are suppressed.
+
+config PKCS11
+ bool "Enable PKCS#11 cryptographic operations"
+ default n
+ depends on SSL_IMPL_WOLFSSL && HAVE_P11KIT && ENCRYPTED_IMAGES
+ help
+ Enable using PKCS#11 for AES decryption instead of having the plain
+ key available in a file. This is implemented with wolfSSL independent
+ from the SSL implementation and replaces the plain key method.
+endmenu
+
--
2.43.0

[Stefano Babic]

Add command line parameters to set home directory and protocol to make
it consistent with the other verification options.

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
---

core/swupdate.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/core/swupdate.c b/core/swupdate.c
index d8ab1de8..ac22185c 100644
--- a/core/swupdate.c
+++ b/core/swupdate.c
@@ -101,6 +101,10 @@ static struct option long_options[] = {
#if defined(CONFIG_SIGALG_CMS) && !defined(CONFIG_SSL_IMPL_WOLFSSL)
{"forced-signer-name", required_argument, NULL, '2'},
#endif
+#ifdef CONFIG_SIGALG_GPG
+ {"gpg-home-dir", required_argument, NULL, '4'},
+ {"gpg-protocol", required_argument, NULL, '5'},
+#endif
#endif
#ifdef CONFIG_ENCRYPTED_IMAGES
{"key-aes", required_argument, NULL, 'K'},
@@ -155,7 +159,6 @@ static void usage(char *programname)
" -l, --loglevel <level> : logging level\n"
" -L, --syslog : enable syslog logger\n"
#ifdef CONFIG_SIGNED_IMAGES
-#ifndef CONFIG_SIGALG_GPG
" -k, --key <public key file> : file with public key to verify images\n"
" --cert-purpose <purpose> : set expected certificate purpose\n"
" [emailProtection|codeSigning] (default: emailProtection)\n"
@@ -163,6 +166,10 @@ static void usage(char *programname)
" --forced-signer-name <cn> : set expected common name of signer certificate\n"
#endif
" --ca-path : path to the Certificate Authority (PEM)\n"
+#ifdef CONFIG_SIGALG_GPG
+ " For GnuPG only:\n"
+ " --gpg-home-dir : path where the GPG ring and keys are stored\n"
+ " --gpg-protocol : supported protocol, openpgp or cms\n"
#endif
#endif
#ifdef CONFIG_ENCRYPTED_IMAGES
@@ -593,8 +600,8 @@ int main(int argc, char **argv)
strcat(main_options, "H:");
#endif
#ifdef CONFIG_SIGNED_IMAGES
-#ifndef CONFIG_SIGALG_GPG
strcat(main_options, "k:");
+#ifndef CONFIG_SIGALG_GPG
public_key_mandatory = 1;
#endif
#endif
@@ -786,6 +793,16 @@ int main(int argc, char **argv)
sizeof(swcfg.update_type->maximum_version));
}
break;
+ case '4':
+ strlcpy(swcfg.gpg_home_directory,
+ optarg,
+ sizeof(swcfg.gpg_home_directory));
+ break;
+ case '5':
+ strlcpy(swcfg.gpgme_protocol,
+ optarg,
+ sizeof(swcfg.gpgme_protocol));
+ break;
#ifdef CONFIG_ENCRYPTED_IMAGES
case 'K':
if (optarg) strlcpy(swcfg.aeskeyfname,
--
2.43.0

[Stefano Babic]

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
Tested-by: Michael Glembotzki <Michael.G...@iris-sensing.com>

[Stefano Babic]

This resolves hard dependencies between libraries. Each implementation
has defined the own structure using the common sslapi.h, and due to
differences in the libraries, this has many #ifdef. This forbids to
build multiple implementation of crypto services with different
libraries, because the header matches just one possible configuration.

Instead of a common header, this patch introduces per library header,
each of them with just the structures required. Components calling
crypto services are the freed from symbols that just belong to a
library, see SSL_PURPOSE_*.

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
Tested-by: Michael Glembotzki <Michael.G...@iris-sensing.com>
---

core/swupdate.c | 1 -
crypto/Makefile | 3 +-
crypto/swupdate_HASH_mbedtls.c | 2 +-
crypto/swupdate_HASH_openssl.c | 7 +++-
crypto/swupdate_HASH_wolfssl.c | 25 ++++++++++++
crypto/swupdate_cms_verify_openssl.c | 2 +-
crypto/swupdate_decrypt_mbedtls.c | 3 +-
crypto/swupdate_decrypt_openssl.c | 2 +-
crypto/swupdate_decrypt_pkcs11.c | 2 +-
crypto/swupdate_gpg_verify.c | 12 +-----
crypto/swupdate_mbedtls.h | 24 +++++++++++
crypto/swupdate_openssl.h | 52 ++++++++++++++++++++++++
crypto/swupdate_pkcs7_verify_wolfssl.c | 2 +-
crypto/swupdate_rsa_verify_mbedtls.c | 2 +-
crypto/swupdate_rsa_verify_openssl.c | 2 +-
crypto/swupdate_wolfssl.h | 56 ++++++++++++++++++++++++++
include/swupdate_crypto.h | 19 +++++++--
test/test_crypt.c | 3 +-
test/test_verify.c | 1 -
19 files changed, 190 insertions(+), 30 deletions(-)
create mode 100644 crypto/swupdate_HASH_wolfssl.c
create mode 100644 crypto/swupdate_mbedtls.h
create mode 100644 crypto/swupdate_openssl.h
create mode 100644 crypto/swupdate_wolfssl.h

diff --git a/core/swupdate.c b/core/swupdate.c
index 37a6af39..d8ab1de8 100644
--- a/core/swupdate.c
+++ b/core/swupdate.c

diff --git a/crypto/swupdate_HASH_mbedtls.c b/crypto/swupdate_HASH_mbedtls.c
index 3317eb77..64266ee4 100644
--- a/crypto/swupdate_HASH_mbedtls.c
+++ b/crypto/swupdate_HASH_mbedtls.c

@@ -6,9 +6,9 @@
#include <errno.h>
#include <stdlib.h>

-#include "sslapi.h"
#include "util.h"
#include "swupdate_crypto.h"
+#include "swupdate_mbedtls.h"

#define MODNAME "mbedtlsSHA256"

diff --git a/crypto/swupdate_HASH_openssl.c b/crypto/swupdate_HASH_openssl.c
index 8da9d1bc..5dbd031e 100644
--- a/crypto/swupdate_HASH_openssl.c
+++ b/crypto/swupdate_HASH_openssl.c

@@ -12,7 +12,10 @@
#include <string.h>
#include <stdbool.h>
#include "swupdate.h"
-#include "sslapi.h"
+#if !defined(NO_INCLUDE_OPENSSL)

+#define MODNAME "opensslSHA256"

+#include "swupdate_openssl.h"
+#endif
#include "util.h"
#include "compat.h"
#include "swupdate_crypto.h"
@@ -115,5 +118,5 @@ static void openssl_hash(void)
hash.HASH_final = openssl_HASH_final;
hash.HASH_compare = openssl_HASH_compare;
hash.HASH_cleanup = openssl_HASH_cleanup;
- (void)register_hashlib("opensslHASH", &hash);
+ (void)register_hashlib(MODNAME, &hash);
}
diff --git a/crypto/swupdate_HASH_wolfssl.c b/crypto/swupdate_HASH_wolfssl.c

new file mode 100644

index 00000000..3bf55777
--- /dev/null
+++ b/crypto/swupdate_HASH_wolfssl.c

@@ -0,0 +1,25 @@
+/*
+ * (C) Copyright 2024

+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only

+ *
+ * Code mostly taken from openssl examples
+ */
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdbool.h>
+#include "swupdate.h"
+#include "swupdate_wolfssl.h"
+
+/*
+ * Switch to WolfSSL in module
+ */
+#define NO_INCLUDE_OPENSSL
+#define MODNAME "WolfSSL"
+
+#include "swupdate_HASH_openssl.c"
+

diff --git a/crypto/swupdate_cms_verify_openssl.c b/crypto/swupdate_cms_verify_openssl.c
index e070da68..8cac4d3d 100644
--- a/crypto/swupdate_cms_verify_openssl.c
+++ b/crypto/swupdate_cms_verify_openssl.c

@@ -12,7 +12,7 @@
#include <string.h>
#include <stdbool.h>
#include "swupdate.h"
-#include "sslapi.h"
+#include "swupdate_openssl.h"
#include "util.h"
#include "swupdate_crypto.h"

diff --git a/crypto/swupdate_decrypt_mbedtls.c b/crypto/swupdate_decrypt_mbedtls.c
index 896b702b..130ade76 100644
--- a/crypto/swupdate_decrypt_mbedtls.c
+++ b/crypto/swupdate_decrypt_mbedtls.c

@@ -4,10 +4,9 @@

#include <errno.h>

-#include "sslapi.h"
#include "util.h"
#include "swupdate_crypto.h"
-
+#include "swupdate_mbedtls.h"

#define MODNAME "mbedtlsAES"

diff --git a/crypto/swupdate_decrypt_openssl.c b/crypto/swupdate_decrypt_openssl.c
index edad5f94..b7b129e2 100644
--- a/crypto/swupdate_decrypt_openssl.c
+++ b/crypto/swupdate_decrypt_openssl.c

@@ -13,7 +13,7 @@
#include <stdbool.h>
#include <unistd.h>
#include "swupdate.h"
-#include "sslapi.h"
+#include "swupdate_openssl.h"
#include "util.h"
#include "swupdate_crypto.h"

diff --git a/crypto/swupdate_decrypt_pkcs11.c b/crypto/swupdate_decrypt_pkcs11.c
index 7a4fd272..ff4afc51 100644
--- a/crypto/swupdate_decrypt_pkcs11.c
+++ b/crypto/swupdate_decrypt_pkcs11.c

@@ -10,7 +10,7 @@
#include <stdlib.h>
#include <string.h>
#include "swupdate.h"
-#include "sslapi.h"
+#include "swupdate_wolfssl.h"
#include "util.h"
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/wolfcrypt/logging.h>

diff --git a/crypto/swupdate_gpg_verify.c b/crypto/swupdate_gpg_verify.c
index a44735ec..d2b7840c 100644
--- a/crypto/swupdate_gpg_verify.c
+++ b/crypto/swupdate_gpg_verify.c

new file mode 100644

index 00000000..facd0951
--- /dev/null
+++ b/crypto/swupdate_mbedtls.h

@@ -0,0 +1,24 @@
+/*
+ * (C) Copyright 2024

+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include "util.h"
+

+#include <mbedtls/md.h>
+#include <mbedtls/pk.h>
+#include <mbedtls/cipher.h>
+#include <mbedtls/version.h>
+
+#define EVP_MAX_BLOCK_LENGTH (16)
+
+struct swupdate_digest {
+ mbedtls_md_context_t mbedtls_md_context;
+ mbedtls_pk_context mbedtls_pk_context;
+ mbedtls_cipher_context_t mbedtls_cipher_context;
+};
diff --git a/crypto/swupdate_openssl.h b/crypto/swupdate_openssl.h

new file mode 100644

index 00000000..00d1d917
--- /dev/null
+++ b/crypto/swupdate_openssl.h

@@ -0,0 +1,52 @@

+/*
+ * (C) Copyright 2016-2024
+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include "util.h"
+

diff --git a/crypto/swupdate_pkcs7_verify_wolfssl.c b/crypto/swupdate_pkcs7_verify_wolfssl.c
index b226c3e2..76407c8e 100644
--- a/crypto/swupdate_pkcs7_verify_wolfssl.c
+++ b/crypto/swupdate_pkcs7_verify_wolfssl.c

@@ -14,7 +14,7 @@
#include <string.h>
#include <stdbool.h>
#include "swupdate.h"
-#include "sslapi.h"
+#include "swupdate_wolfssl.h"
#include "util.h"
#include "swupdate_crypto.h"
#include <wolfssl/openssl/pkcs7.h>

diff --git a/crypto/swupdate_rsa_verify_mbedtls.c b/crypto/swupdate_rsa_verify_mbedtls.c
index 58ffef70..f6e29dc4 100644
--- a/crypto/swupdate_rsa_verify_mbedtls.c
+++ b/crypto/swupdate_rsa_verify_mbedtls.c

@@ -13,10 +13,10 @@
#include <sys/types.h>
#include <unistd.h>

-#include "sslapi.h"
#include "util.h"
#include "swupdate.h"
#include "swupdate_crypto.h"
+#include "swupdate_mbedtls.h"

#define MODNAME "mbedtlsRSA"

diff --git a/crypto/swupdate_rsa_verify_openssl.c b/crypto/swupdate_rsa_verify_openssl.c
index f783ac10..6f6a5a67 100644
--- a/crypto/swupdate_rsa_verify_openssl.c
+++ b/crypto/swupdate_rsa_verify_openssl.c

@@ -12,9 +12,9 @@
#include <string.h>
#include <stdbool.h>
#include "swupdate.h"
-#include "sslapi.h"
#include "util.h"
#include "swupdate_crypto.h"
+#include "swupdate_openssl.h"

#define BUFSIZE (1024 * 8)

diff --git a/crypto/swupdate_wolfssl.h b/crypto/swupdate_wolfssl.h

new file mode 100644

index 00000000..feff2775
--- /dev/null
+++ b/crypto/swupdate_wolfssl.h

@@ -0,0 +1,56 @@
+/*
+ * (C) Copyright 2024

+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include "util.h"
+

diff --git a/include/swupdate_crypto.h b/include/swupdate_crypto.h
index fa755297..067c0a2c 100644
--- a/include/swupdate_crypto.h
+++ b/include/swupdate_crypto.h

[Stefano Babic]

File is substituted with per library specific header.

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
Tested-by: Michael Glembotzki <Michael.G...@iris-sensing.com>
---

[Stefano Babic]

Up now the core knows which is the internal structure used by the crypto
library to verify sw-description. The structure strongly depends on the
selected crypto library and this forbids to build SWUpdate with support
for multiple verification methods, and just one crypto library can be
linked at once. Structures are already allocated by the initialization
function for the crypto service, and it does not need to be known
outside the service, so use opaque pointer in the core.

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
Tested-by: Michael Glembotzki <Michael.G...@iris-sensing.com>
---

diff --git a/crypto/swupdate_HASH_mbedtls.c b/crypto/swupdate_HASH_mbedtls.c
index 64266ee4..4165b940 100644
--- a/crypto/swupdate_HASH_mbedtls.c
+++ b/crypto/swupdate_HASH_mbedtls.c
@@ -26,9 +26,9 @@ static char *algo_upper(const char *algo)

return result;
}

-static struct swupdate_digest *mbedtls_HASH_init(const char *algo)
+static void *mbedtls_HASH_init(const char *algo)
{
- struct swupdate_digest *dgst;
+ struct mbedtls_digest *dgst;
int error;

const mbedtls_md_info_t *info = mbedtls_md_info_from_string(algo_upper(algo));

@@ -63,9 +63,10 @@ fail:

return 0;
}

-static int mbedtls_HASH_update(struct swupdate_digest *dgst, const unsigned char *buf,
+static int mbedtls_HASH_update(void *ctx, const unsigned char *buf,
size_t len)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
if (!dgst) {
return -EFAULT;
}

@@ -79,9 +80,10 @@ static int mbedtls_HASH_update(struct swupdate_digest *dgst, const unsigned char

return 0;
}

-static int mbedtls_HASH_final(struct swupdate_digest *dgst, unsigned char *md_value,
+static int mbedtls_HASH_final(void *ctx, unsigned char *md_value,
unsigned int *md_len)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
if (!dgst) {
return -EFAULT;
}

@@ -101,8 +103,9 @@ static int mbedtls_HASH_final(struct swupdate_digest *dgst, unsigned char *md_va

}

-static void mbedtls_HASH_cleanup(struct swupdate_digest *dgst)
+static void mbedtls_HASH_cleanup(void *ctx)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
if (!dgst) {
return;
}

diff --git a/crypto/swupdate_HASH_openssl.c b/crypto/swupdate_HASH_openssl.c
index 5dbd031e..9820b9c5 100644
--- a/crypto/swupdate_HASH_openssl.c
+++ b/crypto/swupdate_HASH_openssl.c

diff --git a/crypto/swupdate_cms_verify_openssl.c b/crypto/swupdate_cms_verify_openssl.c
index 8cac4d3d..849152d1 100644
--- a/crypto/swupdate_cms_verify_openssl.c
+++ b/crypto/swupdate_cms_verify_openssl.c
@@ -266,7 +266,7 @@ static int check_verified_signer(CMS_ContentInfo* cms, X509_STORE* store)

static int openssl_cms_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
{
- struct swupdate_digest *dgst;
+ struct openssl_digest *dgst;
int ret;

/*

@@ -334,13 +334,15 @@ dgst_init_error:

return ret;
}

-static int openssl_cms_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+static int openssl_cms_verify_file(void *ctx, const char *sigfile,
const char *file, const char *signer_name)
{
int status = -EFAULT;
CMS_ContentInfo *cms = NULL;
BIO *content_bio = NULL;

+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
+
/* Open CMS blob that needs to be checked */
BIO *sigfile_bio = BIO_new_file(sigfile, "rb");
if (!sigfile_bio) {

diff --git a/crypto/swupdate_decrypt_mbedtls.c b/crypto/swupdate_decrypt_mbedtls.c
index 130ade76..ce96966d 100644
--- a/crypto/swupdate_decrypt_mbedtls.c
+++ b/crypto/swupdate_decrypt_mbedtls.c
@@ -12,9 +12,9 @@

static swupdate_decrypt_lib mbedtls;

-static struct swupdate_digest *mbedtls_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
+static void *mbedtls_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
{
- struct swupdate_digest *dgst;
+ struct mbedtls_digest *dgst;
mbedtls_cipher_type_t cipher_type;
const mbedtls_cipher_info_t *cipher_info;
int key_bitlen;

@@ -94,9 +94,10 @@ fail:

return NULL;
}

-static int mbedtls_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *buf,
+static int mbedtls_DECRYPT_update(void *ctx, unsigned char *buf,
int *outlen, const unsigned char *cryptbuf, int inlen)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
int error;
size_t olen = *outlen;

@@ -110,11 +111,12 @@ static int mbedtls_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *b

return 0;
}

-static int mbedtls_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *buf,
+static int mbedtls_DECRYPT_final(void *ctx, unsigned char *buf,
int *outlen)
{
int error;
size_t olen = *outlen;
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;

if (!dgst) {
return -EINVAL;

@@ -133,8 +135,10 @@ static int mbedtls_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *bu

}

-static void mbedtls_DECRYPT_cleanup(struct swupdate_digest *dgst)
+static void mbedtls_DECRYPT_cleanup(void *ctx)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
+
if (!dgst) {
return;
}

diff --git a/crypto/swupdate_decrypt_openssl.c b/crypto/swupdate_decrypt_openssl.c
index b7b129e2..6eb933df 100644
--- a/crypto/swupdate_decrypt_openssl.c
+++ b/crypto/swupdate_decrypt_openssl.c
@@ -22,9 +22,9 @@

static void openssl_probe(void);

static swupdate_decrypt_lib openssl;
-static struct swupdate_digest *openssl_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
+static void *openssl_DECRYPT_init(unsigned char *key, char keylen, unsigned char *iv)
{
- struct swupdate_digest *dgst;
+ struct openssl_digest *dgst;
const EVP_CIPHER *cipher;
int ret;

@@ -84,9 +84,12 @@ static struct swupdate_digest *openssl_DECRYPT_init(unsigned char *key, char key

return dgst;
}

-static int openssl_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *buf,
+static int openssl_DECRYPT_update(void *ctx, unsigned char *buf,
int *outlen, const unsigned char *cryptbuf, int inlen)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
+ if (!dgst)
+ return -EINVAL;
if (EVP_DecryptUpdate(SSL_GET_CTXDEC(dgst), buf, outlen, cryptbuf, inlen) != 1) {
const char *reason = ERR_reason_error_string(ERR_peek_error());
ERROR("Update: Decryption error 0x%lx, reason: %s", ERR_get_error(),

@@ -97,9 +100,10 @@ static int openssl_DECRYPT_update(struct swupdate_digest *dgst, unsigned char *b

return 0;
}

-static int openssl_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *buf,
+static int openssl_DECRYPT_final(void *ctx, unsigned char *buf,
int *outlen)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
if (!dgst)
return -EINVAL;

@@ -116,8 +120,9 @@ static int openssl_DECRYPT_final(struct swupdate_digest *dgst, unsigned char *bu

}

-static void openssl_DECRYPT_cleanup(struct swupdate_digest *dgst)
+static void openssl_DECRYPT_cleanup(void *ctx)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
if (dgst) {
#if OPENSSL_VERSION_NUMBER < 0x10100000L
EVP_CIPHER_CTX_cleanup(SSL_GET_CTXDEC(dgst));

diff --git a/crypto/swupdate_decrypt_pkcs11.c b/crypto/swupdate_decrypt_pkcs11.c
index ff4afc51..7991286d 100644
--- a/crypto/swupdate_decrypt_pkcs11.c
+++ b/crypto/swupdate_decrypt_pkcs11.c

new file mode 100644

index 00000000..c2ea55a7
--- /dev/null
+++ b/crypto/swupdate_gpg.h

@@ -0,0 +1,17 @@

+/*
+ * (C) Copyright 2016-2024
+ * Stefano Babic, stefan...@swupdate.org.
+ *
+ * SPDX-License-Identifier: GPL-2.0-only
+ */
+
+#pragma once
+
+#include <stdint.h>
+#include "util.h"
+

+struct gpg_digest {
+ char *gpg_home_directory;
+ bool verbose;
+ char *gpgme_protocol;
+};

diff --git a/crypto/swupdate_gpg_verify.c b/crypto/swupdate_gpg_verify.c
index d2b7840c..b726336f 100644
--- a/crypto/swupdate_gpg_verify.c
+++ b/crypto/swupdate_gpg_verify.c

@@ -31,7 +31,7 @@ status_cb(void *opaque, const char *keyword, const char *value)

static int gpg_dgst_init(struct swupdate_cfg *sw, const char *keyfile)

EVP_PKEY *pkey; /* this is used for RSA key */

EVP_PKEY_CTX *ckey; /* this is used for RSA key */

X509_STORE *certs; /* this is used if CMS is set */

diff --git a/crypto/swupdate_pkcs7_verify_wolfssl.c b/crypto/swupdate_pkcs7_verify_wolfssl.c
index 76407c8e..39a29c89 100644
--- a/crypto/swupdate_pkcs7_verify_wolfssl.c
+++ b/crypto/swupdate_pkcs7_verify_wolfssl.c

@@ -107,7 +107,7 @@ static int check_signer_name(const char *name)

static int wolfssl_pkcs7_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
{
- struct swupdate_digest *dgst;
+ struct wolfssl_digest *dgst;
int ret;

/*
@@ -154,9 +154,10 @@ dgst_init_error:
return ret;
}

-static int wolfssl_pkcs7_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+static int wolfssl_pkcs7_verify_file(void *ctx, const char *sigfile,
const char *file, const char *signer_name)
{
+ struct wolfssl_digest *dgst = (struct wolfssl_digest *)ctx;
int status = -EFAULT;
WOLFSSL_PKCS7* pkcs7 = (WOLFSSL_PKCS7 *)PKCS7_new();
BIO *bio_mem = NULL;

diff --git a/crypto/swupdate_rsa_verify_mbedtls.c b/crypto/swupdate_rsa_verify_mbedtls.c
index f6e29dc4..bf8a2c39 100644
--- a/crypto/swupdate_rsa_verify_mbedtls.c
+++ b/crypto/swupdate_rsa_verify_mbedtls.c
@@ -48,9 +48,10 @@ exit:

return result;
}

-static int mbedtls_rsa_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+static int mbedtls_rsa_verify_file(void *ctx, const char *sigfile,
const char *file, const char *signer_name)
{
+ struct mbedtls_digest *dgst = (struct mbedtls_digest *)ctx;
int error;
uint8_t hash_computed[32];
const mbedtls_md_info_t *md_info;

@@ -97,7 +98,7 @@ static int mbedtls_rsa_verify_file(struct swupdate_digest *dgst, const char *sig

static int mbedtls_rsa_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
{
- struct swupdate_digest *dgst;
+ struct mbedtls_digest *dgst;

dgst = calloc(1, sizeof(*dgst));
if (!dgst) {

diff --git a/crypto/swupdate_rsa_verify_openssl.c b/crypto/swupdate_rsa_verify_openssl.c
index 6f6a5a67..d8ad7804 100644
--- a/crypto/swupdate_rsa_verify_openssl.c
+++ b/crypto/swupdate_rsa_verify_openssl.c
@@ -53,7 +53,7 @@ end:

return(pkey);
}

-static int dgst_verify_init(struct swupdate_digest *dgst)
+static int dgst_verify_init(struct openssl_digest *dgst)
{
int rc;

@@ -79,7 +79,7 @@ static int dgst_verify_init(struct swupdate_digest *dgst)

return 0;
}

-static int verify_update(struct swupdate_digest *dgst, char *msg, unsigned int mlen)
+static int verify_update(struct openssl_digest *dgst, char *msg, unsigned int mlen)
{
int rc;

@@ -92,7 +92,7 @@ static int verify_update(struct swupdate_digest *dgst, char *msg, unsigned int m

return 0;
}

-static int verify_final(struct swupdate_digest *dgst, unsigned char *sig, unsigned int slen)
+static int verify_final(struct openssl_digest *dgst, unsigned char *sig, unsigned int slen)
{
unsigned int rc;

@@ -107,9 +107,10 @@ static int verify_final(struct swupdate_digest *dgst, unsigned char *sig, unsign

return rc;
}

-static int openssl_rsa_verify_file(struct swupdate_digest *dgst, const char *sigfile,
+static int openssl_rsa_verify_file(void *ctx, const char *sigfile,
const char *file, const char *signer_name)
{
+ struct openssl_digest *dgst = (struct openssl_digest *)ctx;
FILE *fp = NULL;
BIO *sigbio;
int siglen = 0;

@@ -203,7 +204,7 @@ out:

static int openssl_rsa_dgst_init(struct swupdate_cfg *sw, const char *keyfile)
{
- struct swupdate_digest *dgst;
+ struct openssl_digest *dgst;
int ret;

/*
diff --git a/crypto/swupdate_wolfssl.h b/crypto/swupdate_wolfssl.h
index feff2775..00f18714 100644
--- a/crypto/swupdate_wolfssl.h
+++ b/crypto/swupdate_wolfssl.h
@@ -39,9 +39,9 @@
#define X509_PURPOSE_CODE_SIGN EXTKEYUSE_CODESIGN
#define SSL_PURPOSE_EMAIL_PROT EXTKEYUSE_EMAILPROT

-//#define SSL_PURPOSE_DEFAULT SSL_PURPOSE_EMAIL_PROT
+#define openssl_digest wolfssl_digest

-struct swupdate_digest {
+struct wolfssl_digest {

EVP_PKEY *pkey; /* this is used for RSA key */

EVP_PKEY_CTX *ckey; /* this is used for RSA key */

X509_STORE *certs; /* this is used if CMS is set */

diff --git a/include/channel_curl.h b/include/channel_curl.h
index ae49b2bc..ccd4158f 100644
--- a/include/channel_curl.h
+++ b/include/channel_curl.h
@@ -86,7 +86,7 @@ typedef struct {
int read_fifo;
size_t (*headers)(char *streamdata, size_t size, size_t nmemb,
void *data);
- struct swupdate_digest *dgst;
+ void *dgst;
char sha1hash[SWUPDATE_SHA_DIGEST_LENGTH * 2 + 1];
sourcetype source;
struct dict *headers_to_send;

diff --git a/include/swupdate_crypto.h b/include/swupdate_crypto.h
index 067c0a2c..243b6068 100644
--- a/include/swupdate_crypto.h
+++ b/include/swupdate_crypto.h

[Stefano Babic]

Add command line parameters to set home directory and protocol to make
it consistent with the other verification options.

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
Tested-by: Michael Glembotzki <Michael.G...@iris-sensing.com>
---

core/swupdate.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/core/swupdate.c b/core/swupdate.c
index d8ab1de8..ac22185c 100644
--- a/core/swupdate.c
+++ b/core/swupdate.c

[Stefano Babic]

Signed-off-by: Stefano Babic <stefan...@swupdate.org>
Tested-by: Michael Glembotzki <Michael.G...@iris-sensing.com>
---

new file mode 100644