]> git.proxmox.com Git - mirror_edk2.git/blame_incremental - BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py
BaseTools: Various typo
[mirror_edk2.git] / BaseTools / Source / Python / Rsa2048Sha256Sign / Rsa2048Sha256Sign.py
... / ...
CommitLineData
1## @file\r
2# This tool encodes and decodes GUIDed FFS sections or FMP capsule for a GUID type of\r
3# EFI_CERT_TYPE_RSA2048_SHA256_GUID defined in the UEFI 2.4 Specification as\r
4# {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf}}\r
5# This tool has been tested with OpenSSL 1.0.1e 11 Feb 2013\r
6#\r
7# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>\r
8# This program and the accompanying materials\r
9# are licensed and made available under the terms and conditions of the BSD License\r
10# which accompanies this distribution. The full text of the license may be found at\r
11# http://opensource.org/licenses/bsd-license.php\r
12#\r
13# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
14# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
15#\r
16\r
17'''\r
18Rsa2048Sha256Sign\r
19'''\r
20from __future__ import print_function\r
21\r
22import os\r
23import sys\r
24import argparse\r
25import subprocess\r
26import uuid\r
27import struct\r
28import collections\r
29from Common.BuildVersion import gBUILD_VERSION\r
30\r
31#\r
32# Globals for help information\r
33#\r
34__prog__ = 'Rsa2048Sha256Sign'\r
35__version__ = '%s Version %s' % (__prog__, '0.9 ' + gBUILD_VERSION)\r
36__copyright__ = 'Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.'\r
37__usage__ = '%s -e|-d [options] <input_file>' % (__prog__)\r
38\r
39#\r
40# GUID for SHA 256 Hash Algorithm from UEFI Specification\r
41#\r
42EFI_HASH_ALGORITHM_SHA256_GUID = uuid.UUID('{51aa59de-fdf2-4ea3-bc63-875fb7842ee9}')\r
43\r
44#\r
45# Structure definition to unpack EFI_CERT_BLOCK_RSA_2048_SHA256 from UEFI 2.4 Specification\r
46#\r
47# typedef struct _EFI_CERT_BLOCK_RSA_2048_SHA256 {\r
48# EFI_GUID HashType;\r
49# UINT8 PublicKey[256];\r
50# UINT8 Signature[256];\r
51# } EFI_CERT_BLOCK_RSA_2048_SHA256;\r
52#\r
53EFI_CERT_BLOCK_RSA_2048_SHA256 = collections.namedtuple('EFI_CERT_BLOCK_RSA_2048_SHA256', ['HashType', 'PublicKey', 'Signature'])\r
54EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT = struct.Struct('16s256s256s')\r
55\r
56#\r
57# Filename of test signing private key that is stored in same directory as this tool\r
58#\r
59TEST_SIGNING_PRIVATE_KEY_FILENAME = 'TestSigningPrivateKey.pem'\r
60\r
61if __name__ == '__main__':\r
62 #\r
63 # Create command line argument parser object\r
64 #\r
65 parser = argparse.ArgumentParser(prog=__prog__, usage=__usage__, description=__copyright__, conflict_handler='resolve')\r
66 group = parser.add_mutually_exclusive_group(required=True)\r
67 group.add_argument("-e", action="store_true", dest='Encode', help='encode file')\r
68 group.add_argument("-d", action="store_true", dest='Decode', help='decode file')\r
69 group.add_argument("--version", action='version', version=__version__)\r
70 parser.add_argument("-o", "--output", dest='OutputFile', type=str, metavar='filename', help="specify the output filename", required=True)\r
71 parser.add_argument("--monotonic-count", dest='MonotonicCountStr', type=str, help="specify the MonotonicCount in FMP capsule.")\r
72 parser.add_argument("--private-key", dest='PrivateKeyFile', type=argparse.FileType('rb'), help="specify the private key filename. If not specified, a test signing key is used.")\r
73 parser.add_argument("-v", "--verbose", dest='Verbose', action="store_true", help="increase output messages")\r
74 parser.add_argument("-q", "--quiet", dest='Quiet', action="store_true", help="reduce output messages")\r
75 parser.add_argument("--debug", dest='Debug', type=int, metavar='[0-9]', choices=range(0, 10), default=0, help="set debug level")\r
76 parser.add_argument(metavar="input_file", dest='InputFile', type=argparse.FileType('rb'), help="specify the input filename")\r
77\r
78 #\r
79 # Parse command line arguments\r
80 #\r
81 args = parser.parse_args()\r
82\r
83 #\r
84 # Generate file path to Open SSL command\r
85 #\r
86 OpenSslCommand = 'openssl'\r
87 try:\r
88 OpenSslPath = os.environ['OPENSSL_PATH']\r
89 OpenSslCommand = os.path.join(OpenSslPath, OpenSslCommand)\r
90 if ' ' in OpenSslCommand:\r
91 OpenSslCommand = '"' + OpenSslCommand + '"'\r
92 except:\r
93 pass\r
94\r
95 #\r
96 # Verify that Open SSL command is available\r
97 #\r
98 try:\r
99 Process = subprocess.Popen('%s version' % (OpenSslCommand), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)\r
100 except:\r
101 print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH')\r
102 sys.exit(1)\r
103\r
104 Version = Process.communicate()\r
105 if Process.returncode != 0:\r
106 print('ERROR: Open SSL command not available. Please verify PATH or set OPENSSL_PATH')\r
107 sys.exit(Process.returncode)\r
108 print(Version[0].decode('utf-8'))\r
109\r
110 #\r
111 # Read input file into a buffer and save input filename\r
112 #\r
113 args.InputFileName = args.InputFile.name\r
114 args.InputFileBuffer = args.InputFile.read()\r
115 args.InputFile.close()\r
116\r
117 #\r
118 # Save output filename and check if path exists\r
119 #\r
120 OutputDir = os.path.dirname(args.OutputFile)\r
121 if not os.path.exists(OutputDir):\r
122 print('ERROR: The output path does not exist: %s' % OutputDir)\r
123 sys.exit(1)\r
124 args.OutputFileName = args.OutputFile\r
125\r
126 #\r
127 # Save private key filename and close private key file\r
128 #\r
129 try:\r
130 args.PrivateKeyFileName = args.PrivateKeyFile.name\r
131 args.PrivateKeyFile.close()\r
132 except:\r
133 try:\r
134 #\r
135 # Get path to currently executing script or executable\r
136 #\r
137 if hasattr(sys, 'frozen'):\r
138 RsaToolPath = sys.executable\r
139 else:\r
140 RsaToolPath = sys.argv[0]\r
141 if RsaToolPath.startswith('"'):\r
142 RsaToolPath = RsaToolPath[1:]\r
143 if RsaToolPath.endswith('"'):\r
144 RsaToolPath = RsaToolPath[:-1]\r
145 args.PrivateKeyFileName = os.path.join(os.path.dirname(os.path.realpath(RsaToolPath)), TEST_SIGNING_PRIVATE_KEY_FILENAME)\r
146 args.PrivateKeyFile = open(args.PrivateKeyFileName, 'rb')\r
147 args.PrivateKeyFile.close()\r
148 except:\r
149 print('ERROR: test signing private key file %s missing' % (args.PrivateKeyFileName))\r
150 sys.exit(1)\r
151\r
152 #\r
153 # Extract public key from private key into STDOUT\r
154 #\r
155 Process = subprocess.Popen('%s rsa -in "%s" -modulus -noout' % (OpenSslCommand, args.PrivateKeyFileName), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)\r
156 PublicKeyHexString = Process.communicate()[0].split(b'=')[1].strip()\r
157 PublicKeyHexString = PublicKeyHexString.decode('utf-8')\r
158 PublicKey = ''\r
159 while len(PublicKeyHexString) > 0:\r
160 PublicKey = PublicKey + PublicKeyHexString[0:2]\r
161 PublicKeyHexString=PublicKeyHexString[2:]\r
162 if Process.returncode != 0:\r
163 sys.exit(Process.returncode)\r
164\r
165 if args.MonotonicCountStr:\r
166 try:\r
167 if args.MonotonicCountStr.upper().startswith('0X'):\r
168 args.MonotonicCountValue = int(args.MonotonicCountStr, 16)\r
169 else:\r
170 args.MonotonicCountValue = int(args.MonotonicCountStr)\r
171 except:\r
172 pass\r
173\r
174 if args.Encode:\r
175 FullInputFileBuffer = args.InputFileBuffer\r
176 if args.MonotonicCountStr:\r
177 format = "%dsQ" % len(args.InputFileBuffer)\r
178 FullInputFileBuffer = struct.pack(format, args.InputFileBuffer, args.MonotonicCountValue)\r
179 #\r
180 # Sign the input file using the specified private key and capture signature from STDOUT\r
181 #\r
182 Process = subprocess.Popen('%s dgst -sha256 -sign "%s"' % (OpenSslCommand, args.PrivateKeyFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)\r
183 Signature = Process.communicate(input=FullInputFileBuffer)[0]\r
184 if Process.returncode != 0:\r
185 sys.exit(Process.returncode)\r
186\r
187 #\r
188 # Write output file that contains hash GUID, Public Key, Signature, and Input data\r
189 #\r
190 args.OutputFile = open(args.OutputFileName, 'wb')\r
191 args.OutputFile.write(EFI_HASH_ALGORITHM_SHA256_GUID.bytes_le)\r
192 args.OutputFile.write(bytearray.fromhex(str(PublicKey)))\r
193 args.OutputFile.write(Signature)\r
194 args.OutputFile.write(args.InputFileBuffer)\r
195 args.OutputFile.close()\r
196\r
197 if args.Decode:\r
198 #\r
199 # Parse Hash Type, Public Key, and Signature from the section header\r
200 #\r
201 Header = EFI_CERT_BLOCK_RSA_2048_SHA256._make(EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT.unpack_from(args.InputFileBuffer))\r
202 args.InputFileBuffer = args.InputFileBuffer[EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT.size:]\r
203\r
204 #\r
205 # Verify that the Hash Type matches the expected SHA256 type\r
206 #\r
207 if uuid.UUID(bytes_le = Header.HashType) != EFI_HASH_ALGORITHM_SHA256_GUID:\r
208 print('ERROR: unsupport hash GUID')\r
209 sys.exit(1)\r
210\r
211 #\r
212 # Verify the public key\r
213 #\r
214 if Header.PublicKey != bytearray.fromhex(PublicKey):\r
215 print('ERROR: Public key in input file does not match public key from private key file')\r
216 sys.exit(1)\r
217\r
218 FullInputFileBuffer = args.InputFileBuffer\r
219 if args.MonotonicCountStr:\r
220 format = "%dsQ" % len(args.InputFileBuffer)\r
221 FullInputFileBuffer = struct.pack(format, args.InputFileBuffer, args.MonotonicCountValue)\r
222\r
223 #\r
224 # Write Signature to output file\r
225 #\r
226 open(args.OutputFileName, 'wb').write(Header.Signature)\r
227\r
228 #\r
229 # Verify signature\r
230 #\r
231 Process = subprocess.Popen('%s dgst -sha256 -prverify "%s" -signature %s' % (OpenSslCommand, args.PrivateKeyFileName, args.OutputFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)\r
232 Process.communicate(input=FullInputFileBuffer)\r
233 if Process.returncode != 0:\r
234 print('ERROR: Verification failed')\r
235 os.remove (args.OutputFileName)\r
236 sys.exit(Process.returncode)\r
237\r
238 #\r
239 # Save output file contents from input file\r
240 #\r
241 open(args.OutputFileName, 'wb').write(args.InputFileBuffer)\r