[nrf fromlist] bootutil: Add MCUBOOT_USE_TLV_ALLOW_LIST

The ALLOW_ROGUE_TLVS is used to turn off TLV filtering in
code, basically to prevent processing TLVs that MCUboot is not
compiled to serve anyway.
The commit replaces identifier ALLOW_ROGUE_TLVS with
MCUBOOT_USE_TLV_ALLOW_LIST and reverse the logic around it, as
it now means opposite to the original.
This gives the feature an identifier in style of the
mcuboot_config.h defined identifiers.

Upstream PR #: 2410

Signed-off-by: Dominik Ermel <[email protected]>

Author: de-nordic

boot/bootutil/src/image_validate.c

@@ -468,7 +468,7 @@ static int bootutil_check_for_pure(const struct image_header *hdr,
 }
 #endif
 
-#ifndef ALLOW_ROGUE_TLVS
+#ifdef MCUBOOT_USE_TLV_ALLOW_LIST
 /*
  * The following list of TLVs are the only entries allowed in the unprotected
  * TLV section.  All other TLV entries must be in the protected section.
@@ -686,7 +686,7 @@ bootutil_img_validate(struct boot_loader_state *state,
             break;
         }
 
-#ifndef ALLOW_ROGUE_TLVS
+#ifdef MCUBOOT_USE_TLV_ALLOW_LIST
         /*
          * Ensure that the non-protected TLV only has entries necessary to hold
          * the signature.  We also allow encryption related keys to be in the

docs/release-notes.d/tlv-allow-list.md

@@ -0,0 +1,2 @@
+ - Control over compilation of unprotected TLV allow list has been exposed
+   using MCUBOOT_USE_TLV_ALLOW_LIST mcuboot configuration identifier.