BaseTools/Source/Python/Capsule/GenerateCapsule.py

   1 ## @file
   2 # Generate a capsule.
   3 #
   4 # Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>
   5 # This program and the accompanying materials
   6 # are licensed and made available under the terms and conditions of the BSD License
   7 # which accompanies this distribution.  The full text of the license may be found at
   8 # http://opensource.org/licenses/bsd-license.php
   9 #
  10 # THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 # WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12 #
  13
  14 '''
  15 GenerateCapsule
  16 '''
  17
  18 import sys
  19 import argparse
  20 import uuid
  21 import struct
  22 import subprocess
  23 import os
  24 import tempfile
  25 import shutil
  26 import platform
  27 from Common.Uefi.Capsule.UefiCapsuleHeader import UefiCapsuleHeaderClass
  28 from Common.Uefi.Capsule.FmpCapsuleHeader  import FmpCapsuleHeaderClass
  29 from Common.Uefi.Capsule.FmpAuthHeader     import FmpAuthHeaderClass
  30 from Common.Edk2.Capsule.FmpPayloadHeader  import FmpPayloadHeaderClass
  31
  32 #
  33 # Globals for help information
  34 #
  35 __prog__        = 'GenerateCapsule'
  36 __version__     = '0.9'
  37 __copyright__   = 'Copyright (c) 2018, Intel Corporation. All rights reserved.'
  38 __description__ = 'Generate a capsule.\n'
  39
  40 def SignPayloadSignTool (Payload, ToolPath, PfxFile):
  41     #
  42     # Create a temporary directory
  43     #
  44     TempDirectoryName = tempfile.mkdtemp()
  45
  46     #
  47     # Generate temp file name for the payload contents
  48     #
  49     TempFileName = os.path.join (TempDirectoryName, 'Payload.bin')
  50
  51     #
  52     # Create temporary payload file for signing
  53     #
  54     try:
  55         File = open (TempFileName, mode='wb')
  56         File.write (Payload)
  57         File.close ()
  58     except:
  59         shutil.rmtree (TempDirectoryName)
  60         raise ValueError ('GenerateCapsule: error: can not write temporary payload file.')
  61
  62     #
  63     # Build signtool command
  64     #
  65     if ToolPath is None:
  66         ToolPath = ''
  67     Command = ''
  68     Command = Command + '"{Path}" '.format (Path = os.path.join (ToolPath, 'signtool.exe'))
  69     Command = Command + 'sign /fd sha256 /p7ce DetachedSignedData /p7co 1.2.840.113549.1.7.2 '
  70     Command = Command + '/p7 {TempDir} '.format (TempDir = TempDirectoryName)
  71     Command = Command + '/f {PfxFile} '.format (PfxFile = PfxFile)
  72     Command = Command + TempFileName
  73
  74     #
  75     # Sign the input file using the specified private key
  76     #
  77     try:
  78         Process = subprocess.Popen (Command, stdin = subprocess.PIPE, stdout = subprocess.PIPE, stderr = subprocess.PIPE, shell = True)
  79         Result = Process.communicate('')
  80     except:
  81         shutil.rmtree (TempDirectoryName)
  82         raise ValueError ('GenerateCapsule: error: can not run signtool.')
  83
  84     if Process.returncode != 0:
  85         shutil.rmtree (TempDirectoryName)
  86         print (Result[1].decode())
  87         raise ValueError ('GenerateCapsule: error: signtool failed.')
  88
  89     #
  90     # Read the signature from the generated output file
  91     #
  92     try:
  93         File = open (TempFileName + '.p7', mode='rb')
  94         Signature = File.read ()
  95         File.close ()
  96     except:
  97         shutil.rmtree (TempDirectoryName)
  98         raise ValueError ('GenerateCapsule: error: can not read signature file.')
  99
 100     shutil.rmtree (TempDirectoryName)
 101     return Signature
 102
 103 def VerifyPayloadSignTool (Payload, CertData, ToolPath, PfxFile):
 104     print ('signtool verify is not supported.')
 105     raise ValueError ('GenerateCapsule: error: signtool verify is not supported.')
 106
 107 def SignPayloadOpenSsl (Payload, ToolPath, SignerPrivateCertFile, OtherPublicCertFile, TrustedPublicCertFile):
 108     #
 109     # Build openssl command
 110     #
 111     if ToolPath is None:
 112         ToolPath = ''
 113     Command = ''
 114     Command = Command + '"{Path}" '.format (Path = os.path.join (ToolPath, 'openssl'))
 115     Command = Command + 'smime -sign -binary -outform DER -md sha256 '
 116     Command = Command + '-signer "{Private}" -certfile "{Public}"'.format (Private = SignerPrivateCertFile, Public = OtherPublicCertFile)
 117
 118     #
 119     # Sign the input file using the specified private key and capture signature from STDOUT
 120     #
 121     try:
 122         Process = subprocess.Popen (Command, stdin = subprocess.PIPE, stdout = subprocess.PIPE, stderr = subprocess.PIPE, shell = True)
 123         Result = Process.communicate(input = Payload)
 124         Signature = Result[0]
 125     except:
 126         raise ValueError ('GenerateCapsule: error: can not run openssl.')
 127
 128     if Process.returncode != 0:
 129         print (Result[1].decode())
 130         raise ValueError ('GenerateCapsule: error: openssl failed.')
 131
 132     return Signature
 133
 134 def VerifyPayloadOpenSsl (Payload, CertData, ToolPath, SignerPrivateCertFile, OtherPublicCertFile, TrustedPublicCertFile):
 135     #
 136     # Create a temporary directory
 137     #
 138     TempDirectoryName = tempfile.mkdtemp()
 139
 140     #
 141     # Generate temp file name for the payload contents
 142     #
 143     TempFileName = os.path.join (TempDirectoryName, 'Payload.bin')
 144
 145     #
 146     # Create temporary payload file for verification
 147     #
 148     try:
 149         File = open (TempFileName, mode='wb')
 150         File.write (Payload)
 151         File.close ()
 152     except:
 153         shutil.rmtree (TempDirectoryName)
 154         raise ValueError ('GenerateCapsule: error: can not write temporary payload file.')
 155
 156     #
 157     # Build openssl command
 158     #
 159     if ToolPath is None:
 160         ToolPath = ''
 161     Command = ''
 162     Command = Command + '"{Path}" '.format (Path = os.path.join (ToolPath, 'openssl'))
 163     Command = Command + 'smime -verify -inform DER '
 164     Command = Command + '-content {Content} -CAfile "{Public}"'.format (Content = TempFileName, Public = TrustedPublicCertFile)
 165
 166     #
 167     # Verify signature
 168     #
 169     try:
 170         Process = subprocess.Popen (Command, stdin = subprocess.PIPE, stdout = subprocess.PIPE, stderr = subprocess.PIPE, shell = True)
 171         Result = Process.communicate(input = CertData)
 172     except:
 173         shutil.rmtree (TempDirectoryName)
 174         raise ValueError ('GenerateCapsule: error: can not run openssl.')
 175
 176     if Process.returncode != 0:
 177         shutil.rmtree (TempDirectoryName)
 178         print (Result[1].decode())
 179         raise ValueError ('GenerateCapsule: error: openssl failed.')
 180
 181     shutil.rmtree (TempDirectoryName)
 182     return Payload
 183
 184 if __name__ == '__main__':
 185     def convert_arg_line_to_args(arg_line):
 186         for arg in arg_line.split():
 187             if not arg.strip():
 188                 continue
 189             yield arg
 190
 191     def ValidateUnsignedInteger (Argument):
 192         try:
 193             Value = int (Argument, 0)
 194         except:
 195             Message = '{Argument} is not a valid integer value.'.format (Argument = Argument)
 196             raise argparse.ArgumentTypeError (Message)
 197         if Value < 0:
 198             Message = '{Argument} is a negative value.'.format (Argument = Argument)
 199             raise argparse.ArgumentTypeError (Message)
 200         return Value
 201
 202     def ValidateRegistryFormatGuid (Argument):
 203         try:
 204             Value = uuid.UUID (Argument)
 205         except:
 206             Message = '{Argument} is not a valid registry format GUID value.'.format (Argument = Argument)
 207             raise argparse.ArgumentTypeError (Message)
 208         return Value
 209
 210     #
 211     # Create command line argument parser object
 212     #
 213     parser = argparse.ArgumentParser (
 214                         prog = __prog__,
 215                         description = __description__ + __copyright__,
 216                         conflict_handler = 'resolve',
 217                         fromfile_prefix_chars = '@'
 218                         )
 219     parser.convert_arg_line_to_args = convert_arg_line_to_args
 220
 221     #
 222     # Add input and output file arguments
 223     #
 224     parser.add_argument("InputFile",  type = argparse.FileType('rb'),
 225                         help = "Input binary payload filename.")
 226     parser.add_argument("-o", "--output", dest = 'OutputFile', type = argparse.FileType('wb'),
 227                         help = "Output filename.")
 228     #
 229     # Add group for -e and -d flags that are mutually exclusive and required
 230     #
 231     group = parser.add_mutually_exclusive_group (required = True)
 232     group.add_argument ("-e", "--encode", dest = 'Encode', action = "store_true",
 233                         help = "Encode file")
 234     group.add_argument ("-d", "--decode", dest = 'Decode', action = "store_true",
 235                         help = "Decode file")
 236     group.add_argument ("--dump-info", dest = 'DumpInfo', action = "store_true",
 237                         help = "Display FMP Payload Header information")
 238     #
 239     # Add optional arguments for this command
 240     #
 241     parser.add_argument ("--capflag", dest = 'CapsuleFlag', action='append', default = [],
 242                          choices=['PersistAcrossReset', 'InitiateReset'],
 243                          help = "Capsule flag can be PersistAcrossReset or InitiateReset or not set")
 244     parser.add_argument ("--capoemflag", dest = 'CapsuleOemFlag', type = ValidateUnsignedInteger, default = 0x0000,
 245                          help = "Capsule OEM Flag is an integer between 0x0000 and 0xffff.")
 246
 247     parser.add_argument ("--guid", dest = 'Guid', type = ValidateRegistryFormatGuid,
 248                          help = "The FMP/ESRT GUID in registry format.  Required for encode operations.")
 249     parser.add_argument ("--hardware-instance", dest = 'HardwareInstance', type = ValidateUnsignedInteger, default = 0x0000000000000000,
 250                          help = "The 64-bit hardware instance.  The default is 0x0000000000000000")
 251
 252
 253     parser.add_argument ("--monotonic-count", dest = 'MonotonicCount', type = ValidateUnsignedInteger, default = 0x0000000000000000,
 254                          help = "64-bit monotonic count value in header.  Default is 0x0000000000000000.")
 255
 256     parser.add_argument ("--fw-version", dest = 'FwVersion', type = ValidateUnsignedInteger,
 257                          help = "The 32-bit version of the binary payload (e.g. 0x11223344 or 5678).  Required for encode operations that sign a payload.")
 258     parser.add_argument ("--lsv", dest = 'LowestSupportedVersion', type = ValidateUnsignedInteger,
 259                          help = "The 32-bit lowest supported version of the binary payload (e.g. 0x11223344 or 5678).  Required for encode operations that sign a payload.")
 260
 261     parser.add_argument ("--pfx-file", dest='SignToolPfxFile', type=argparse.FileType('rb'),
 262                          help="signtool PFX certificate filename.")
 263
 264     parser.add_argument ("--signer-private-cert", dest='OpenSslSignerPrivateCertFile', type=argparse.FileType('rb'),
 265                          help="OpenSSL signer private certificate filename.")
 266     parser.add_argument ("--other-public-cert", dest='OpenSslOtherPublicCertFile', type=argparse.FileType('rb'),
 267                          help="OpenSSL other public certificate filename.")
 268     parser.add_argument ("--trusted-public-cert", dest='OpenSslTrustedPublicCertFile', type=argparse.FileType('rb'),
 269                          help="OpenSSL trusted public certificate filename.")
 270
 271     parser.add_argument ("--signing-tool-path", dest = 'SigningToolPath',
 272                          help = "Path to signtool or OpenSSL tool.  Optional if path to tools are already in PATH.")
 273
 274     #
 275     # Add optional arguments common to all operations
 276     #
 277     parser.add_argument ('--version', action='version', version='%(prog)s ' + __version__)
 278     parser.add_argument ("-v", "--verbose", dest = 'Verbose', action = "store_true",
 279                          help = "Turn on verbose output with informational messages printed, including capsule headers and warning messages.")
 280     parser.add_argument ("-q", "--quiet", dest = 'Quiet', action = "store_true",
 281                          help = "Disable all messages except fatal errors.")
 282     parser.add_argument ("--debug", dest = 'Debug', type = int, metavar = '[0-9]', choices = range (0, 10), default = 0,
 283                          help = "Set debug level")
 284
 285     #
 286     # Parse command line arguments
 287     #
 288     args = parser.parse_args()
 289
 290     #
 291     # Perform additional argument verification
 292     #
 293     if args.Encode:
 294         if args.Guid is None:
 295             parser.error ('the following option is required: --guid')
 296         if 'PersistAcrossReset' not in args.CapsuleFlag:
 297             if 'InitiateReset' in args.CapsuleFlag:
 298                 parser.error ('--capflag InitiateReset also requires --capflag PersistAcrossReset')
 299         if args.CapsuleOemFlag > 0xFFFF:
 300             parser.error ('--capoemflag must be an integer between 0x0000 and 0xffff')
 301         if args.HardwareInstance > 0xFFFFFFFFFFFFFFFF:
 302             parser.error ('--hardware-instance must be an integer in range 0x0..0xffffffffffffffff')
 303         if args.MonotonicCount > 0xFFFFFFFFFFFFFFFF:
 304             parser.error ('--monotonic-count must be an integer in range 0x0..0xffffffffffffffff')
 305
 306     UseSignTool = args.SignToolPfxFile is not None
 307     UseOpenSsl  = (args.OpenSslSignerPrivateCertFile is not None and
 308                    args.OpenSslOtherPublicCertFile is not None and
 309                    args.OpenSslTrustedPublicCertFile is not None)
 310     AnyOpenSsl  = (args.OpenSslSignerPrivateCertFile is not None or
 311                    args.OpenSslOtherPublicCertFile is not None or
 312                    args.OpenSslTrustedPublicCertFile is not None)
 313     if args.Encode or args.Decode:
 314         if args.OutputFile is None:
 315             parser.error ('the following option is required for all encode and decode operations: --output')
 316
 317         if UseSignTool and AnyOpenSsl:
 318             parser.error ('Providing both signtool and OpenSSL options is not supported')
 319         if not UseSignTool and not UseOpenSsl and AnyOpenSsl:
 320             parser.error ('all the following options are required for OpenSSL: --signer-private-cert, --other-public-cert, --trusted-public-cert')
 321         if UseSignTool and platform.system() != 'Windows':
 322             parser.error ('Use of signtool is not supported on this operating system.')
 323         if args.Encode and (UseSignTool or UseOpenSsl):
 324             if args.FwVersion is None or args.LowestSupportedVersion is None:
 325                 parser.error ('the following options are required: --fw-version, --lsv')
 326             if args.FwVersion > 0xFFFFFFFF:
 327                 parser.error ('--fw-version must be an integer in range 0x0..0xffffffff')
 328             if args.LowestSupportedVersion > 0xFFFFFFFF:
 329                 parser.error ('--lsv must be an integer in range 0x0..0xffffffff')
 330
 331         if UseSignTool:
 332             args.SignToolPfxFile.close()
 333             args.SignToolPfxFile = args.SignToolPfxFile.name
 334         if UseOpenSsl:
 335             args.OpenSslSignerPrivateCertFile.close()
 336             args.OpenSslOtherPublicCertFile.close()
 337             args.OpenSslTrustedPublicCertFile.close()
 338             args.OpenSslSignerPrivateCertFile = args.OpenSslSignerPrivateCertFile.name
 339             args.OpenSslOtherPublicCertFile   = args.OpenSslOtherPublicCertFile.name
 340             args.OpenSslTrustedPublicCertFile = args.OpenSslTrustedPublicCertFile.name
 341
 342     if args.DumpInfo:
 343         if args.OutputFile is not None:
 344             parser.error ('the following option is not supported for dumpinfo operations: --output')
 345
 346     #
 347     # Read binary input file
 348     #
 349     try:
 350         if args.Verbose:
 351             print ('Read binary input file {File}'.format (File = args.InputFile.name))
 352         Buffer = args.InputFile.read ()
 353         args.InputFile.close ()
 354     except:
 355         print ('GenerateCapsule: error: can not read binary input file {File}'.format (File = args.InputFile.name))
 356         sys.exit (1)
 357
 358     #
 359     # Create objects
 360     #
 361     UefiCapsuleHeader = UefiCapsuleHeaderClass ()
 362     FmpCapsuleHeader  = FmpCapsuleHeaderClass ()
 363     FmpAuthHeader     = FmpAuthHeaderClass ()
 364     FmpPayloadHeader  = FmpPayloadHeaderClass ()
 365
 366     if args.Encode:
 367         Result = Buffer
 368         if UseSignTool or UseOpenSsl:
 369             try:
 370                 FmpPayloadHeader.FwVersion              = args.FwVersion
 371                 FmpPayloadHeader.LowestSupportedVersion = args.LowestSupportedVersion
 372                 FmpPayloadHeader.Payload                = Result
 373                 Result = FmpPayloadHeader.Encode ()
 374                 if args.Verbose:
 375                     FmpPayloadHeader.DumpInfo ()
 376             except:
 377                 print ('GenerateCapsule: error: can not encode FMP Payload Header')
 378                 sys.exit (1)
 379
 380             #
 381             # Sign image with 64-bit MonotonicCount appended to end of image
 382             #
 383             try:
 384                 if UseSignTool:
 385                     CertData = SignPayloadSignTool (
 386                                  Result + struct.pack ('<Q', args.MonotonicCount),
 387                                  args.SigningToolPath,
 388                                  args.SignToolPfxFile
 389                                  )
 390                 else:
 391                     CertData = SignPayloadOpenSsl (
 392                                  Result + struct.pack ('<Q', args.MonotonicCount),
 393                                  args.SigningToolPath,
 394                                  args.OpenSslSignerPrivateCertFile,
 395                                  args.OpenSslOtherPublicCertFile,
 396                                  args.OpenSslTrustedPublicCertFile
 397                                  )
 398             except:
 399                 print ('GenerateCapsule: error: can not sign payload')
 400                 raise
 401                 sys.exit (1)
 402
 403             try:
 404                 FmpAuthHeader.MonotonicCount = args.MonotonicCount
 405                 FmpAuthHeader.CertData       = CertData
 406                 FmpAuthHeader.Payload        = Result
 407                 Result = FmpAuthHeader.Encode ()
 408                 if args.Verbose:
 409                     FmpAuthHeader.DumpInfo ()
 410             except:
 411                 print ('GenerateCapsule: error: can not encode FMP Auth Header')
 412                 sys.exit (1)
 413
 414         try:
 415             FmpCapsuleHeader.AddPayload (args.Guid, Result, HardwareInstance = args.HardwareInstance)
 416             Result = FmpCapsuleHeader.Encode ()
 417             if args.Verbose:
 418                 FmpCapsuleHeader.DumpInfo ()
 419         except:
 420             print ('GenerateCapsule: error: can not encode FMP Capsule Header')
 421             sys.exit (1)
 422
 423         try:
 424             UefiCapsuleHeader.OemFlags            = args.CapsuleOemFlag
 425             UefiCapsuleHeader.PersistAcrossReset  = 'PersistAcrossReset'  in args.CapsuleFlag
 426             UefiCapsuleHeader.PopulateSystemTable = False
 427             UefiCapsuleHeader.InitiateReset       = 'InitiateReset'       in args.CapsuleFlag
 428             UefiCapsuleHeader.Payload             = Result
 429             Result = UefiCapsuleHeader.Encode ()
 430             if args.Verbose:
 431                 UefiCapsuleHeader.DumpInfo ()
 432         except:
 433             print ('GenerateCapsule: error: can not encode UEFI Capsule Header')
 434             sys.exit (1)
 435
 436     elif args.Decode:
 437         try:
 438             Result = UefiCapsuleHeader.Decode (Buffer)
 439             FmpCapsuleHeader.Decode (Result)
 440             Result = FmpCapsuleHeader.GetFmpCapsuleImageHeader (0).Payload
 441             if args.Verbose:
 442                 print ('========')
 443                 UefiCapsuleHeader.DumpInfo ()
 444                 print ('--------')
 445                 FmpCapsuleHeader.DumpInfo ()
 446             if UseSignTool or UseOpenSsl:
 447                 Result = FmpAuthHeader.Decode (Result)
 448
 449                 #
 450                 # Verify Image with 64-bit MonotonicCount appended to end of image
 451                 #
 452                 try:
 453                   if UseSignTool:
 454                       CertData = VerifyPayloadSignTool (
 455                                    FmpAuthHeader.Payload + struct.pack ('<Q', FmpAuthHeader.MonotonicCount),
 456                                    FmpAuthHeader.CertData,
 457                                    args.SigningToolPath,
 458                                    args.SignToolPfxFile
 459                                    )
 460                   else:
 461                       CertData = VerifyPayloadOpenSsl (
 462                                    FmpAuthHeader.Payload + struct.pack ('<Q', FmpAuthHeader.MonotonicCount),
 463                                    FmpAuthHeader.CertData,
 464                                    args.SigningToolPath,
 465                                    args.OpenSslSignerPrivateCertFile,
 466                                    args.OpenSslOtherPublicCertFile,
 467                                    args.OpenSslTrustedPublicCertFile
 468                                    )
 469                 except ValueError:
 470                     print ('GenerateCapsule: warning: can not verify payload.')
 471
 472                 Result = FmpPayloadHeader.Decode (Result)
 473                 if args.Verbose:
 474                     print ('--------')
 475                     FmpAuthHeader.DumpInfo ()
 476                     print ('--------')
 477                     FmpPayloadHeader.DumpInfo ()
 478             else:
 479                 if args.Verbose:
 480                     print ('--------')
 481                     print ('No EFI_FIRMWARE_IMAGE_AUTHENTICATION')
 482                     print ('--------')
 483                     print ('No FMP_PAYLOAD_HEADER')
 484             if args.Verbose:
 485                 print ('========')
 486         except:
 487             print ('GenerateCapsule: error: can not decode capsule')
 488             raise
 489             sys.exit (1)
 490
 491     elif args.DumpInfo:
 492         try:
 493             Result = UefiCapsuleHeader.Decode (Buffer)
 494             FmpCapsuleHeader.Decode (Result)
 495             Result = FmpCapsuleHeader.GetFmpCapsuleImageHeader (0).Payload
 496             print ('========')
 497             UefiCapsuleHeader.DumpInfo ()
 498             print ('--------')
 499             FmpCapsuleHeader.DumpInfo ()
 500             try:
 501                 Result = FmpAuthHeader.Decode (Result)
 502                 Result = FmpPayloadHeader.Decode (Result)
 503                 print ('--------')
 504                 FmpAuthHeader.DumpInfo ()
 505                 print ('--------')
 506                 FmpPayloadHeader.DumpInfo ()
 507             except:
 508                 print ('--------')
 509                 print ('No EFI_FIRMWARE_IMAGE_AUTHENTICATION')
 510                 print ('--------')
 511                 print ('No FMP_PAYLOAD_HEADER')
 512             print ('========')
 513         except:
 514             print ('GenerateCapsule: error: can not decode capsule')
 515             sys.exit (1)
 516     else:
 517         print('GenerateCapsule: error: invalid options')
 518         sys.exit (1)
 519
 520     #
 521     # Write binary output file
 522     #
 523     if args.OutputFile is not None:
 524         try:
 525             if args.Verbose:
 526                 print ('Write binary output file {File}'.format (File = args.OutputFile.name))
 527             args.OutputFile.write (Result)
 528             args.OutputFile.close ()
 529         except:
 530             print ('GenerateCapsule: error: can not write binary output file {File}'.format (File = args.OutputFile.name))
 531             sys.exit (1)
 532
 533     if args.Verbose:
 534         print('Success')