Firmware image creation Makefile and updater script

The updater script is a simpler alternative to the script used by
D-Link in their firmware updates, supporting only "userdata" updates.

Run "make" to create a new squashfs file system for the "userdata"
partition and pack, encrypt and sign it for use with the original
D-Link firmware update tools fwupdate or firmwareupgrade.cgi.

See the documetation in this repo for usage instructions.

Signed-off-by: Bjørn Mork <bjorn@mork.no>

2 files changed, 171 insertions, 0 deletions

diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..2607982
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,73 @@
+# SPDX-License-Identifier: GPL-2.0
+# Copyright(c) 2019 Bjørn Mork <bjorn@mork.no>
+
+MODEL=DCS-8000LH
+BUILD=9999
+PRIKEY=keys/$(MODEL)-PriKey.pem
+SIGNKEY=keys/$(MODEL)-sign.pem
+
+OPTFILES=version opt.local
+FW_XTRA_FILES=
+
+all: fw
+
+version: dcs8000lh-configure.py
+	sed -ne 's/"//g' -e 's/^VERSION *= *//p' dcs8000lh-configure.py >$@
+
+opt.squashfs: $(OPTFILES)
+	mksquashfs $(OPTFILES) $@ -all-root -comp xz
+
+aes.key:
+	openssl rand 16 > $@
+
+aes.key.rsa: aes.key $(PRIKEY)
+	openssl rsautl -encrypt -in aes.key -inkey $(PRIKEY) -out $@
+
+### FIXME:  This is verified using the pubkey in /etc/db/verify.key, which will fail
+sign.sha1.rsa: sign.sha1 $(SIGNKEY)
+	openssl rsautl -sign -inkey $(SIGNKEY) -out sign.sha1.rsa -in sign.sha1
+
+## FIXME:  It would be nice to have the D-Link signing key instead :-)
+$(SIGNKEY):
+	echo "WARNING: $(SIGNKEY) is missing - using a new abitrary key instead"
+	$(eval SIGNKEY := random-signkey.pem)
+	$(eval FW_XTRA_FILES := $(FW_XTRA_FILES) verify.key)
+	[ -f $(SIGNKEY) ] || openssl genrsa -out $(SIGNKEY)
+
+verify.key: $(SIGNKEY)
+	 openssl rsa -pubout -in $(SIGNKEY) -out $@
+
+sign.sha1: update.bin.aes aes.key.rsa certificate.info update.sha1
+	cat $^ | openssl dgst -sha1 | cut -d' ' -f2 > $@
+
+fw: verify.key fw.tar
+fw.tar: certificate.info aes.key.rsa sign.sha1.rsa update.aes update.bin.aes $(FW_XTRA_FILES)
+	tar cvf $@ $^ $(FW_XTRA_FILES)
+
+update.sha1: update.aes
+	 openssl dgst -sha1 $^ | cut -d' ' -f2 > $@
+
+update.aes: aes.key opt.squashfs
+	openssl aes-128-cbc -md md5 -kfile aes.key -nosalt -e -out $@ -in opt.squashfs
+
+update.bin: aes.key update.aes update.sh
+	$(eval MD5SUM := $(shell openssl aes-128-cbc -md md5 -kfile aes.key -nosalt -d -in update.aes | md5sum - | cut -d' ' -f1 | md5sum - | cut -d' ' -f1))
+	sed  -e "s/@@MODEL@@/\"$(MODEL)\"/" -e "s/@@MD5SUM@@/\"$(MD5SUM)\"/" -e "s/@@VERSION@@/\"1.0.0-$(BUILD)\"/" update.sh >update.bin
+
+certificate.info:
+	echo "Publisher:DMdssdFW1" >$@
+	echo "Supported Models:$(MODEL),$(MODEL)" >>$@
+	echo "Firmware Version:1.0.0" >>$@
+	echo "Target:update.bin" >>$@
+	echo "Build No:$(BUILD)" >>$@
+	echo "Contents:update" >>$@
+
+update.bin.aes: aes.key update.bin
+	openssl aes-128-cbc -md md5 -kfile aes.key -nosalt -e -out $@ -in update.bin
+
+clean:
+	rm -f *.rsa *.aes opt.squashfs sign.sha1 certificate.info update.bin update.sha1 fw.tar verify.key
+
+distclean: clean
+	rm -f aes.key random-signkey.pem
+
diff --git a/update.sh b/update.sh
new file mode 100644
index 0000000..abc6ad0
--- /dev/null
+++ b/update.sh
@@ -0,0 +1,98 @@
+#!/bin/sh
+VENDOR="Alphanetworks"
+HWBOARD="r8000lh"
+HWVERSION="1.0.0"
+OEM="D-Link"
+MODEL=@@MODEL@@
+PRODUCT="Internet Camera"
+VERSION=@@VERSION@@
+PACKAGE=""
+WIRELESS_MODULE="RTL8723BU"
+DESCRIPT="An alternative opt."
+
+showBrief() {
+	echo -n "\
+
+This updates the userdata partition only.
+It will update following, ...
+	1. /opt file system
+"
+}
+
+MD5SUM=@@MD5SUM@@
+
+MECH_SIGN="QPAT"
+MECH_VERSION="1.0"
+MECH_APP="doUpdate"
+
+showUsage() {
+	echo "Usage: $0 [ info | brief | exam | update ]" 1>&2
+}
+
+exam() {
+	rm -f /tmp/update/md5
+	for i in $(cat /tmp/update/certificate.info | grep Contents | cut -d":" -f2); do
+		echo $(tar xOf "$1" $i.aes | openssl aes-128-cbc -kfile /tmp/update/aes.key -nosalt -d | md5sum - | cut -d' ' -f1 ) >> /tmp/update/md5
+	done
+	md5sum=$(md5sum /tmp/update/md5 | cut -d' ' -f1)
+	[ "$MD5SUM" = "$md5sum" ] && return 0
+	
+	echo "md5sum failed" 1>&2
+	return 1
+}
+
+self="$0"
+action=$1
+enc_bin=$2
+end=$3
+
+if [ "$action" = "" ] || [ "$end" != "" ]; then
+	showUsage
+	exit 1
+fi
+
+if [ "$action" = "info" ]; then
+	echo -n "\
+MECH_SIGN=\"$MECH_SIGN\"
+MECH_VERSION=\"$MECH_VERSION\"
+MECH_APP=\"$MECH_APP\"
+HWBOARD=\"$HWBOARD\"
+HWVERSION=\"$HWVERSION\"
+MODEL=\"$MODEL\"
+PRODUCT=\"$PRODUCT\"
+OEM=\"$OEM\"
+VENDOR=\"$VENDOR\"
+VERSION=\"$VERSION\"
+DESCRIPT=\"$DESCRIPT\"
+PACKAGE=\"$PACKAGE\"
+"
+	exit 0
+fi
+
+if [ "$action" = "brief" ]; then
+	showBrief
+	exit 0
+fi
+
+if [ "$action" = "exam" ]; then
+	exam "$enc_bin" || exit 1
+	exit 0
+fi
+
+if [ "$action" = "update" ]; then
+	/etc/rc.d/init.d/services.sh stop > /dev/null 2> /dev/null
+	exam "$enc_bin" || { /etc/rc.d/init.d/services.sh start > /dev/null 2> /dev/null && exit 1; }
+
+	userdata="/dev/$(grep '"userdata"' /proc/mtd |cut -f1 -d:)"
+	size=$(grep '"userdata"' /proc/mtd |cut -f2 -d\ )
+	blocksize=$(grep '"userdata"' /proc/mtd |cut -f3 -d\ )
+	blocks=$(( 0x${size} / 0x${blocksize} ))
+	/usr/bin/flash_erase "$userdata" 0 ${blocks}
+	tar xOf "$enc_bin" update.aes | openssl aes-128-cbc -k `cat /tmp/update/aes.key` -nosalt -d | dd bs=$((0x${blocksize})) of="$userdata" > /dev/null 2> /dev/null || exit 1
+
+	{(sleep 5 && reboot) > /dev/null 2> /dev/null &}
+	exit 0
+fi
+
+# unknown action
+showUsage && exit 1