tools/firmware-utils/src/buffalo-lib.c

   1 /*
   2  * Copyright (C) 2009-2011 Gabor Juhos <juhosg@openwrt.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify it
   5  * under the terms of the GNU General Public License version 2 as published
   6  * by the Free Software Foundation.
   7  *
   8  */
   9
  10 #include <stdio.h>
  11 #include <stdlib.h>
  12 #include <string.h>
  13 #include <errno.h>
  14 #include <unistd.h>
  15 #include <sys/stat.h>
  16
  17 #include "buffalo-lib.h"
  18
  19 static uint32_t crc32_table[256] =
  20 {
  21         0x00000000, 0x04c11db7, 0x09823b6e, 0x0d4326d9,
  22         0x130476dc, 0x17c56b6b, 0x1a864db2, 0x1e475005,
  23         0x2608edb8, 0x22c9f00f, 0x2f8ad6d6, 0x2b4bcb61,
  24         0x350c9b64, 0x31cd86d3, 0x3c8ea00a, 0x384fbdbd,
  25         0x4c11db70, 0x48d0c6c7, 0x4593e01e, 0x4152fda9,
  26         0x5f15adac, 0x5bd4b01b, 0x569796c2, 0x52568b75,
  27         0x6a1936c8, 0x6ed82b7f, 0x639b0da6, 0x675a1011,
  28         0x791d4014, 0x7ddc5da3, 0x709f7b7a, 0x745e66cd,
  29         0x9823b6e0, 0x9ce2ab57, 0x91a18d8e, 0x95609039,
  30         0x8b27c03c, 0x8fe6dd8b, 0x82a5fb52, 0x8664e6e5,
  31         0xbe2b5b58, 0xbaea46ef, 0xb7a96036, 0xb3687d81,
  32         0xad2f2d84, 0xa9ee3033, 0xa4ad16ea, 0xa06c0b5d,
  33         0xd4326d90, 0xd0f37027, 0xddb056fe, 0xd9714b49,
  34         0xc7361b4c, 0xc3f706fb, 0xceb42022, 0xca753d95,
  35         0xf23a8028, 0xf6fb9d9f, 0xfbb8bb46, 0xff79a6f1,
  36         0xe13ef6f4, 0xe5ffeb43, 0xe8bccd9a, 0xec7dd02d,
  37         0x34867077, 0x30476dc0, 0x3d044b19, 0x39c556ae,
  38         0x278206ab, 0x23431b1c, 0x2e003dc5, 0x2ac12072,
  39         0x128e9dcf, 0x164f8078, 0x1b0ca6a1, 0x1fcdbb16,
  40         0x018aeb13, 0x054bf6a4, 0x0808d07d, 0x0cc9cdca,
  41         0x7897ab07, 0x7c56b6b0, 0x71159069, 0x75d48dde,
  42         0x6b93dddb, 0x6f52c06c, 0x6211e6b5, 0x66d0fb02,
  43         0x5e9f46bf, 0x5a5e5b08, 0x571d7dd1, 0x53dc6066,
  44         0x4d9b3063, 0x495a2dd4, 0x44190b0d, 0x40d816ba,
  45         0xaca5c697, 0xa864db20, 0xa527fdf9, 0xa1e6e04e,
  46         0xbfa1b04b, 0xbb60adfc, 0xb6238b25, 0xb2e29692,
  47         0x8aad2b2f, 0x8e6c3698, 0x832f1041, 0x87ee0df6,
  48         0x99a95df3, 0x9d684044, 0x902b669d, 0x94ea7b2a,
  49         0xe0b41de7, 0xe4750050, 0xe9362689, 0xedf73b3e,
  50         0xf3b06b3b, 0xf771768c, 0xfa325055, 0xfef34de2,
  51         0xc6bcf05f, 0xc27dede8, 0xcf3ecb31, 0xcbffd686,
  52         0xd5b88683, 0xd1799b34, 0xdc3abded, 0xd8fba05a,
  53         0x690ce0ee, 0x6dcdfd59, 0x608edb80, 0x644fc637,
  54         0x7a089632, 0x7ec98b85, 0x738aad5c, 0x774bb0eb,
  55         0x4f040d56, 0x4bc510e1, 0x46863638, 0x42472b8f,
  56         0x5c007b8a, 0x58c1663d, 0x558240e4, 0x51435d53,
  57         0x251d3b9e, 0x21dc2629, 0x2c9f00f0, 0x285e1d47,
  58         0x36194d42, 0x32d850f5, 0x3f9b762c, 0x3b5a6b9b,
  59         0x0315d626, 0x07d4cb91, 0x0a97ed48, 0x0e56f0ff,
  60         0x1011a0fa, 0x14d0bd4d, 0x19939b94, 0x1d528623,
  61         0xf12f560e, 0xf5ee4bb9, 0xf8ad6d60, 0xfc6c70d7,
  62         0xe22b20d2, 0xe6ea3d65, 0xeba91bbc, 0xef68060b,
  63         0xd727bbb6, 0xd3e6a601, 0xdea580d8, 0xda649d6f,
  64         0xc423cd6a, 0xc0e2d0dd, 0xcda1f604, 0xc960ebb3,
  65         0xbd3e8d7e, 0xb9ff90c9, 0xb4bcb610, 0xb07daba7,
  66         0xae3afba2, 0xaafbe615, 0xa7b8c0cc, 0xa379dd7b,
  67         0x9b3660c6, 0x9ff77d71, 0x92b45ba8, 0x9675461f,
  68         0x8832161a, 0x8cf30bad, 0x81b02d74, 0x857130c3,
  69         0x5d8a9099, 0x594b8d2e, 0x5408abf7, 0x50c9b640,
  70         0x4e8ee645, 0x4a4ffbf2, 0x470cdd2b, 0x43cdc09c,
  71         0x7b827d21, 0x7f436096, 0x7200464f, 0x76c15bf8,
  72         0x68860bfd, 0x6c47164a, 0x61043093, 0x65c52d24,
  73         0x119b4be9, 0x155a565e, 0x18197087, 0x1cd86d30,
  74         0x029f3d35, 0x065e2082, 0x0b1d065b, 0x0fdc1bec,
  75         0x3793a651, 0x3352bbe6, 0x3e119d3f, 0x3ad08088,
  76         0x2497d08d, 0x2056cd3a, 0x2d15ebe3, 0x29d4f654,
  77         0xc5a92679, 0xc1683bce, 0xcc2b1d17, 0xc8ea00a0,
  78         0xd6ad50a5, 0xd26c4d12, 0xdf2f6bcb, 0xdbee767c,
  79         0xe3a1cbc1, 0xe760d676, 0xea23f0af, 0xeee2ed18,
  80         0xf0a5bd1d, 0xf464a0aa, 0xf9278673, 0xfde69bc4,
  81         0x89b8fd09, 0x8d79e0be, 0x803ac667, 0x84fbdbd0,
  82         0x9abc8bd5, 0x9e7d9662, 0x933eb0bb, 0x97ffad0c,
  83         0xafb010b1, 0xab710d06, 0xa6322bdf, 0xa2f33668,
  84         0xbcb4666d, 0xb8757bda, 0xb5365d03, 0xb1f740b4
  85 };
  86
  87 int bcrypt_init(struct bcrypt_ctx *ctx, void *key, int keylen,
  88                 unsigned long state_len)
  89 {
  90         unsigned char *state;
  91         unsigned char *p = key;
  92         unsigned long i, j;
  93         unsigned long k = 0;
  94
  95         state = malloc(state_len);
  96         if (state == NULL)
  97                 return -1;
  98
  99         ctx->i = 0;
 100         ctx->j = 0;
 101         ctx->state = state;
 102         ctx->state_len = state_len;
 103
 104         for (i = 0; i < state_len; i++)
 105                 state[i] = i;
 106
 107         for(i = 0, j = 0; i < state_len; i++, j = (j + 1) % keylen) {
 108                 unsigned char t;
 109
 110                 t = state[i];
 111                 k = (k + p[j] + t) % state_len;
 112                 state[i] = state[k];
 113                 state[k] = t;
 114         }
 115
 116         return 0;
 117 }
 118
 119 int bcrypt_process(struct bcrypt_ctx *ctx, unsigned char *src,
 120                    unsigned char *dst, unsigned long len)
 121 {
 122         unsigned char *state = ctx->state;
 123         unsigned long state_len = ctx->state_len;
 124         unsigned char i, j;
 125         unsigned long k;
 126
 127         i = ctx->i;
 128         j = ctx->j;
 129
 130         for (k = 0; k < len; k++) {
 131                 unsigned char t;
 132
 133                 i = (i + 1) % state_len;
 134                 j = (j + state[i]) % state_len;
 135                 t = state[j];
 136                 state[j] = state[i];
 137                 state[i] = t;
 138
 139                 dst[k] = src[k] ^ state[(state[i] + state[j]) % state_len];
 140         }
 141
 142         ctx->i = i;
 143         ctx->j = j;
 144
 145         return len;
 146 }
 147
 148 void bcrypt_finish(struct bcrypt_ctx *ctx)
 149 {
 150         if (ctx->state)
 151                 free(ctx->state);
 152 }
 153
 154 int bcrypt_buf(unsigned char seed, unsigned char *key, unsigned char *src,
 155                unsigned char *dst, unsigned long len, int longstate)
 156 {
 157         unsigned char bckey[BCRYPT_MAX_KEYLEN + 1];
 158         unsigned int keylen;
 159         struct bcrypt_ctx ctx;
 160         int ret;
 161
 162         /* setup decryption key */
 163         keylen = strlen((char *) key);
 164         bckey[0] = seed;
 165         memcpy(&bckey[1], key, keylen);
 166
 167         keylen++;
 168
 169         ret = bcrypt_init(&ctx, bckey, keylen,
 170                           (longstate) ? len : BCRYPT_DEFAULT_STATE_LEN);
 171         if (ret)
 172                 return ret;
 173
 174         bcrypt_process(&ctx, src, dst, len);
 175         bcrypt_finish(&ctx);
 176
 177         return 0;
 178 }
 179
 180 uint32_t buffalo_csum(uint32_t csum, void *buf, unsigned long len)
 181 {
 182         signed char *p = buf;
 183
 184         while (len--) {
 185                 int i;
 186
 187                 csum ^= *p++;
 188                 for (i = 0; i < 8; i++)
 189                         csum = (csum >> 1) ^ ((csum & 1) ? 0xedb88320ul : 0);
 190         }
 191
 192         return csum;
 193 }
 194
 195 uint32_t buffalo_crc(void *buf, unsigned long len)
 196 {
 197         unsigned char *p = buf;
 198         unsigned long t = len;
 199         uint32_t crc = 0;
 200
 201         while (len--)
 202                 crc = (crc << 8) ^ crc32_table[((crc >> 24) ^ *p++) & 0xFF];
 203
 204         while (t) {
 205                 crc = (crc << 8) ^ crc32_table[((crc >> 24) ^ t) & 0xFF];
 206                 t >>= 8;
 207         }
 208
 209         return ~crc;
 210 }
 211
 212 unsigned long enc_compute_header_len(char *product, char *version)
 213 {
 214         return ENC_MAGIC_LEN + 1 + strlen(product) + 1 +
 215                strlen(version) + 1 + 3 * sizeof(uint32_t);
 216 }
 217
 218 unsigned long enc_compute_buf_len(char *product, char *version,
 219                                   unsigned long datalen)
 220 {
 221         unsigned long ret;
 222
 223         ret = enc_compute_header_len(product, version);
 224         ret += datalen + sizeof(uint32_t);
 225         ret += (4 - ret % 4);
 226
 227         return ret;
 228 }
 229
 230 static void put_be32(void *data, uint32_t val)
 231 {
 232         unsigned char *p = data;
 233
 234         p[0] = (val >> 24) & 0xff;
 235         p[1] = (val >> 16) & 0xff;
 236         p[2] = (val >> 8) & 0xff;
 237         p[3] = val & 0xff;
 238 }
 239
 240 static uint32_t get_be32(void *data)
 241 {
 242         unsigned char *p = data;
 243
 244         return (((uint32_t)p[0]) << 24) |
 245                (((uint32_t)p[1]) << 16) |
 246                (((uint32_t)p[2]) << 8) |
 247                ((uint32_t)p[3]);
 248 }
 249
 250 static int check_magic(void *magic)
 251 {
 252         if (!memcmp("start", magic, ENC_MAGIC_LEN))
 253                 return 0;
 254
 255         if (!memcmp("asar1", magic, ENC_MAGIC_LEN))
 256                 return 0;
 257
 258         return -1;
 259 }
 260
 261 int encrypt_buf(struct enc_param *ep, unsigned char *hdr,
 262                 unsigned char *data)
 263 {
 264         unsigned char *p;
 265         uint32_t len;
 266         int err;
 267         int ret = -1;
 268         unsigned char s;
 269
 270         p = (unsigned char *) hdr;
 271
 272         /* setup magic */
 273         len = strlen((char *) ep->magic) + 1;
 274         memcpy(p, ep->magic, len);
 275         p += len;
 276
 277         /* setup seed */
 278         *p++ = ep->seed;
 279
 280         /* put product len */
 281         len = strlen((char *) ep->product) + 1;
 282         put_be32(p, len);
 283         p += sizeof(uint32_t);
 284
 285         /* copy and crypt product name */
 286         memcpy(p, ep->product, len);
 287         err = bcrypt_buf(ep->seed, ep->key, p, p, len, ep->longstate);
 288         if (err)
 289                 goto out;
 290         s = *p;
 291         p += len;
 292
 293         /* put version length */
 294         len = strlen((char *) ep->version) + 1;
 295         put_be32(p, len);
 296         p += sizeof(uint32_t);
 297
 298         /* copy and crypt version */
 299         memcpy(p, ep->version, len);
 300         err = bcrypt_buf(s, ep->key, p, p, len, ep->longstate);
 301         if (err)
 302                 goto out;
 303         s = *p;
 304         p += len;
 305
 306         /* put data length */
 307         put_be32(p, ep->datalen);
 308
 309         /* encrypt data */
 310         err = bcrypt_buf(s, ep->key, data, data, ep->datalen, ep->longstate);
 311         if (err)
 312                 goto out;
 313
 314         /* put checksum */
 315         put_be32(&data[ep->datalen], ep->csum);
 316
 317         ret = 0;
 318
 319 out:
 320         return ret;
 321 }
 322
 323 int decrypt_buf(struct enc_param *ep, unsigned char *data,
 324                 unsigned long datalen)
 325 {
 326         unsigned char *p;
 327         uint32_t prod_len;
 328         uint32_t ver_len;
 329         uint32_t len;
 330         uint32_t csum;
 331         ssize_t remain;
 332         int err;
 333         int ret = -1;
 334
 335 #define CHECKLEN(_l) do {               \
 336         len = (_l);                     \
 337         if (remain < len) {             \
 338                 goto out;               \
 339         }                               \
 340 } while (0)
 341
 342 #define INCP() do {                     \
 343         p += len;                       \
 344         remain -= len;                  \
 345 } while (0)
 346
 347         remain = datalen;
 348         p = data;
 349
 350         CHECKLEN(ENC_MAGIC_LEN);
 351         err = check_magic(p);
 352         if (err)
 353                 goto out;
 354         memcpy(ep->magic, p, ENC_MAGIC_LEN);
 355         INCP();
 356
 357         CHECKLEN(1);
 358         ep->seed = *p;
 359         INCP();
 360
 361         CHECKLEN(sizeof(uint32_t));
 362         prod_len = get_be32(p);
 363         if (prod_len > ENC_PRODUCT_LEN)
 364                 goto out;
 365         INCP();
 366
 367         CHECKLEN(prod_len);
 368         memcpy(ep->product, p, prod_len);
 369         INCP();
 370
 371         CHECKLEN(sizeof(uint32_t));
 372         ver_len = get_be32(p);
 373         if (ver_len > ENC_VERSION_LEN)
 374                 goto out;
 375         INCP();
 376
 377         CHECKLEN(ver_len);
 378         memcpy(ep->version, p, ver_len);
 379         INCP();
 380
 381         CHECKLEN(sizeof(uint32_t));
 382         ep->datalen = get_be32(p);
 383         INCP();
 384
 385         /* decrypt data */
 386         CHECKLEN(ep->datalen);
 387         err = bcrypt_buf(ep->version[0], ep->key, p, data, ep->datalen,
 388                          ep->longstate);
 389         if (err)
 390                 goto out;
 391         INCP();
 392
 393         CHECKLEN(sizeof(uint32_t));
 394         ep->csum = get_be32(p);
 395         INCP();
 396
 397         csum = buffalo_csum(ep->datalen, data, ep->datalen);
 398         if (csum != ep->csum)
 399                 goto out;
 400
 401         /* decrypt product name */
 402         err = bcrypt_buf(ep->product[0], ep->key, ep->version, ep->version,
 403                          ver_len, ep->longstate);
 404         if (err)
 405                 goto out;
 406
 407         /* decrypt version */
 408         err = bcrypt_buf(ep->seed, ep->key, ep->product, ep->product, prod_len,
 409                          ep->longstate);
 410         if (err)
 411                 goto out;
 412
 413         ret = 0;
 414 out:
 415         return ret;
 416
 417 #undef CHECKLEN
 418 #undef INCP
 419 }
 420
 421 ssize_t get_file_size(char *name)
 422 {
 423         struct stat st;
 424         int err;
 425
 426         err = stat(name, &st);
 427         if (err)
 428                 return -1;
 429
 430         return st.st_size;
 431 }
 432
 433 int read_file_to_buf(char *name, void *buf, ssize_t buflen)
 434 {
 435         FILE *f;
 436         size_t done;
 437         int ret = -1;
 438
 439         f = fopen(name, "r");
 440         if (f == NULL)
 441                 goto out;
 442
 443         errno = 0;
 444         done = fread(buf, buflen, 1, f);
 445         if (done != 1)
 446                 goto close;
 447
 448         ret = 0;
 449
 450 close:
 451         fclose(f);
 452 out:
 453         return ret;
 454 }
 455
 456 int write_buf_to_file(char *name, void *buf, ssize_t buflen)
 457 {
 458         FILE *f;
 459         size_t done;
 460         int ret = -1;
 461
 462         f = fopen(name, "w");
 463         if (f == NULL)
 464                 goto out;
 465
 466         errno = 0;
 467         done = fwrite(buf, buflen, 1, f);
 468         if (done != 1)
 469                 goto close;
 470
 471         ret = 0;
 472
 473 close:
 474         fflush(f);
 475         fclose(f);
 476         if (ret)
 477                 unlink(name);
 478 out:
 479         return ret;
 480 }