rasn_cms/
firmware_wrapper.rs

1//! # Firmware Package Wrappers
2//! Implementation of [RFC 4108] also known as "Using Cryptographic Message
3//! Syntax (CMS) to Protect Firmware Packages". This module is used to protect
4//! firmware packages with CMS, as well as use for receipts and error reports
5//! for firmware package loading. The protected firmware package can be
6//! associated with any particular hardware module.
7//!
8//! The firmware package contains object code for one or more programmable
9//! components that make up the hardware module. The firmware package, which is
10//! treated as an opaque binary object, is digitally signed. Optional encryption
11//! and compression are also supported. When all three are used, the firmware
12//! package is compressed, then encrypted, and then signed.
13//!
14//! As with all `rasn` core crate implementations, this module does not provide
15//! the actual functionality for signing, encrypting, or compressing data;
16//! instead provides a shared set of data types that can be used with other
17//! crates to sign, encrypt, and compress your own firmware packages.
18//!
19//! [rfc 4108]: https://datatracker.ietf.org/doc/html/rfc4108
20use rasn::prelude::*;
21
22use super::EnvelopedData;
23
24pub const FIRMWARE_PACKAGE: &Oid = Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_CT_FIRMWARE_PACKAGE;
25pub const FIRMWARE_PACKAGE_ID: &Oid =
26    Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_AA_FIRMWARE_PACKAGE_ID;
27pub const DECRYPT_KEY_ID: &Oid = Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_AA_DECRYPT_KEY_ID;
28pub const CRYPTO_ALGORITHMS: &Oid = Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_AA_CRYPTO_ALGORITHMS;
29pub const COMPRESS_ALGORITHMS: &Oid =
30    Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_AA_COMPRESS_ALGORITHMS;
31pub const COMMUNITY_IDENTIFIERS: &Oid =
32    Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_AA_COMMUNITY_IDENTIFIERS;
33pub const FIRMWARE_PACKAGE_INFO: &Oid =
34    Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_AA_FIRMWARE_PACKAGE_INFO;
35pub const WRAPPED_FIRMWARE_KEY: &Oid =
36    Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_AA_WRAPPED_FIRMWARE_KEY;
37pub const FIRMWARE_LOAD_RECEIPT: &Oid =
38    Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_CT_FIRMWARE_LOAD_RECEIPT;
39pub const FIRMWARE_LOAD_ERROR: &Oid =
40    Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_CT_FIRMWARE_LOAD_ERROR;
41pub const HARDWARE_MODULE_NAME: &Oid =
42    Oid::ISO_IDENTIFIED_ORGANISATION_DOD_INTERNET_SECURITY_MECHANISMS_PKIX_ON_HARDWARE_MODULE_NAME;
43pub const TARGET_HARDWARE_IDS: &Oid =
44    Oid::ISO_MEMBER_BODY_US_RSADSI_PKCS9_SMIME_AA_TARGET_HARDWARE_IDS;
45
46pub type FirmwarePackageData = OctetString;
47pub type TargetHardwareIdentifiers = SequenceOf<ObjectIdentifier>;
48pub type DecryptKeyIdentifier = OctetString;
49pub type ImplementedCryptoAlgorithms = SequenceOf<ObjectIdentifier>;
50pub type ImplementedCompressAlgorithms = SequenceOf<ObjectIdentifier>;
51pub type CommunityIdentifiers = SequenceOf<CommunityIdentifier>;
52pub type WrappedFirmwareKey = EnvelopedData;
53pub type FirmwareReceiptVersion = Integer;
54pub type FirmwareErrorVersion = Integer;
55pub type VendorLoadErrorCode = Integer;
56
57#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
58pub struct FirmwarePackageIdentifier {
59    pub name: PreferredOrLegacyPackageIdentifier,
60    pub stale: Option<PreferredOrLegacyStalePackageIdentifier>,
61}
62
63#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
64#[rasn(choice)]
65pub enum PreferredOrLegacyPackageIdentifier {
66    Preferred(PreferredPackageIdentifier),
67    Legacy(OctetString),
68}
69
70#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
71pub struct PreferredPackageIdentifier {
72    pub firmware_package_id: ObjectIdentifier,
73    pub version_number: Integer,
74}
75
76#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
77#[rasn(choice)]
78pub enum PreferredOrLegacyStalePackageIdentifier {
79    PreferredStaleVersionNumber(Integer),
80    LegacyStaleVersion(OctetString),
81}
82
83#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
84#[rasn(choice)]
85pub enum CommunityIdentifier {
86    CommunityOid(ObjectIdentifier),
87    HardwareModuleList(HardwareModules),
88}
89
90#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
91pub struct HardwareModules {
92    pub hardware_type: ObjectIdentifier,
93    pub hardware_serial_entries: SequenceOf<HardwareSerialEntry>,
94}
95
96#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
97#[rasn(choice)]
98pub enum HardwareSerialEntry {
99    All,
100    Single(OctetString),
101    Block { low: OctetString, high: OctetString },
102}
103
104#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
105pub struct FirmwarePackageInfo {
106    pub firmware_package_type: Option<Integer>,
107    pub dependencies: Option<SequenceOf<PreferredOrLegacyPackageIdentifier>>,
108}
109
110#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
111pub struct FirmwarePackageLoadReceipt {
112    #[rasn(default = "default_firmware_receipt_version")]
113    pub version: FirmwareReceiptVersion,
114    pub hardware_type: ObjectIdentifier,
115    pub hardware_serial_number: OctetString,
116    pub firmware_package_name: PreferredOrLegacyPackageIdentifier,
117    pub trust_anchor_key_id: Option<OctetString>,
118    #[rasn(tag(1))]
119    pub decrypt_key_id: Option<OctetString>,
120}
121
122fn default_firmware_receipt_version() -> FirmwareReceiptVersion {
123    1u8.into()
124}
125
126#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
127pub struct FirmwarePackageLoadError {
128    #[rasn(default = "default_firmware_error_version")]
129    pub version: FirmwareErrorVersion,
130    pub hardware_type: ObjectIdentifier,
131    pub hardware_serial_number: OctetString,
132    pub error_code: FirmwarePackageLoadErrorCode,
133    pub vendor_error_code: Option<VendorLoadErrorCode>,
134    pub firmware_package_name: Option<PreferredOrLegacyPackageIdentifier>,
135    #[rasn(tag(1))]
136    pub config: Option<SequenceOf<CurrentFirmwareConfig>>,
137}
138
139fn default_firmware_error_version() -> FirmwareErrorVersion {
140    1u8.into()
141}
142
143#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
144pub struct CurrentFirmwareConfig {
145    pub firmware_package_type: Option<Integer>,
146    pub firmware_package_name: PreferredOrLegacyPackageIdentifier,
147}
148
149#[derive(AsnType, Debug, Clone, Copy, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
150#[rasn(enumerated)]
151pub enum FirmwarePackageLoadErrorCode {
152    DecodeFailure = 1,
153    BadContentInfo = 2,
154    BadSignedData = 3,
155    BadEncapContent = 4,
156    BadCertificate = 5,
157    BadSignerInfo = 6,
158    BadSignedAttrs = 7,
159    BadUnsignedAttrs = 8,
160    MissingContent = 9,
161    NoTrustAnchor = 10,
162    NotAuthorized = 11,
163    BadDigestAlgorithm = 12,
164    BadSignatureAlgorithm = 13,
165    UnsupportedKeySize = 14,
166    SignatureFailure = 15,
167    ContentTypeMismatch = 16,
168    BadEncryptedData = 17,
169    UnprotectedAttrsPresent = 18,
170    BadEncryptContent = 19,
171    BadEncryptAlgorithm = 20,
172    MissingCiphertext = 21,
173    NoDecryptKey = 22,
174    DecryptFailure = 23,
175    BadCompressAlgorithm = 24,
176    MissingCompressedContent = 25,
177    DecompressFailure = 26,
178    WrongHardware = 27,
179    StalePackage = 28,
180    NotInCommunity = 29,
181    UnsupportedPackageType = 30,
182    MissingDependency = 31,
183    WrongDependencyVersion = 32,
184    InsufficientMemory = 33,
185    BadFirmware = 34,
186    UnsupportedParameters = 35,
187    BreaksDependency = 36,
188    OtherError = 99,
189}
190
191#[derive(AsnType, Debug, Clone, Decode, Encode, PartialEq, PartialOrd, Eq, Ord, Hash)]
192pub struct HardwareModuleName {
193    pub hardware_type: ObjectIdentifier,
194    pub hardware_serial_number: OctetString,
195}
rasn_cms/firmware_wrapper.rs

rasn_cms/
firmware_wrapper.rs
