X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=blobdiff_plain;f=BaseTools%2FSource%2FPython%2FRsa2048Sha256Sign%2FRsa2048Sha256Sign.py;h=df05826282ebb685f14f4dd00a686944780f759c;hp=4367194c23b191ce25330160a0abfa3ad28367af;hb=HEAD;hpb=a5f26fefca2edb7f3b2772966b79351b7edbcc3f

diff --git a/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py b/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py
index 4367194c23..df05826282 100644
--- a/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py
+++ b/BaseTools/Source/Python/Rsa2048Sha256Sign/Rsa2048Sha256Sign.py
@@ -4,23 +4,18 @@
 #   {0xa7717414, 0xc616, 0x4977, {0x94, 0x20, 0x84, 0x47, 0x12, 0xa7, 0x35, 0xbf}}
 # This tool has been tested with OpenSSL 1.0.1e 11 Feb 2013
 #
-# Copyright (c) 2013 - 2017, Intel Corporation. All rights reserved.<BR>
-# This program and the accompanying materials
-# are licensed and made available under the terms and conditions of the BSD License
-# which accompanies this distribution.  The full text of the license may be found at
-# http://opensource.org/licenses/bsd-license.php
-#
-# THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
-# WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+# Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>
+# SPDX-License-Identifier: BSD-2-Clause-Patent
 #
 
 '''
 Rsa2048Sha256Sign
 '''
+from __future__ import print_function
 
 import os
 import sys
-import argparse 
+import argparse
 import subprocess
 import uuid
 import struct
@@ -32,7 +27,7 @@ from Common.BuildVersion import gBUILD_VERSION
 #
 __prog__      = 'Rsa2048Sha256Sign'
 __version__   = '%s Version %s' % (__prog__, '0.9 ' + gBUILD_VERSION)
-__copyright__ = 'Copyright (c) 2013 - 2016, Intel Corporation. All rights reserved.'
+__copyright__ = 'Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.'
 __usage__     = '%s -e|-d [options] <input_file>' % (__prog__)
 
 #
@@ -41,7 +36,7 @@ __usage__     = '%s -e|-d [options] <input_file>' % (__prog__)
 EFI_HASH_ALGORITHM_SHA256_GUID = uuid.UUID('{51aa59de-fdf2-4ea3-bc63-875fb7842ee9}')
 
 #
-# Structure defintion to unpack EFI_CERT_BLOCK_RSA_2048_SHA256 from UEFI 2.4 Specification
+# Structure definition to unpack EFI_CERT_BLOCK_RSA_2048_SHA256 from UEFI 2.4 Specification
 #
 #   typedef struct _EFI_CERT_BLOCK_RSA_2048_SHA256 {
 #     EFI_GUID HashType;
@@ -49,7 +44,7 @@ EFI_HASH_ALGORITHM_SHA256_GUID = uuid.UUID('{51aa59de-fdf2-4ea3-bc63-875fb7842ee
 #     UINT8 Signature[256];
 #   } EFI_CERT_BLOCK_RSA_2048_SHA256;
 #
-EFI_CERT_BLOCK_RSA_2048_SHA256        = collections.namedtuple('EFI_CERT_BLOCK_RSA_2048_SHA256', ['HashType','PublicKey','Signature'])
+EFI_CERT_BLOCK_RSA_2048_SHA256        = collections.namedtuple('EFI_CERT_BLOCK_RSA_2048_SHA256', ['HashType', 'PublicKey', 'Signature'])
 EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT = struct.Struct('16s256s256s')
 
 #
@@ -60,22 +55,23 @@ TEST_SIGNING_PRIVATE_KEY_FILENAME = 'TestSigningPrivateKey.pem'
 if __name__ == '__main__':
   #
   # Create command line argument parser object
-  #  
-  parser = argparse.ArgumentParser(prog=__prog__, version=__version__, usage=__usage__, description=__copyright__, conflict_handler='resolve')
+  #
+  parser = argparse.ArgumentParser(prog=__prog__, usage=__usage__, description=__copyright__, conflict_handler='resolve')
   group = parser.add_mutually_exclusive_group(required=True)
   group.add_argument("-e", action="store_true", dest='Encode', help='encode file')
   group.add_argument("-d", action="store_true", dest='Decode', help='decode file')
+  group.add_argument("--version", action='version', version=__version__)
   parser.add_argument("-o", "--output", dest='OutputFile', type=str, metavar='filename', help="specify the output filename", required=True)
   parser.add_argument("--monotonic-count", dest='MonotonicCountStr', type=str, help="specify the MonotonicCount in FMP capsule.")
   parser.add_argument("--private-key", dest='PrivateKeyFile', type=argparse.FileType('rb'), help="specify the private key filename.  If not specified, a test signing key is used.")
   parser.add_argument("-v", "--verbose", dest='Verbose', action="store_true", help="increase output messages")
   parser.add_argument("-q", "--quiet", dest='Quiet', action="store_true", help="reduce output messages")
-  parser.add_argument("--debug", dest='Debug', type=int, metavar='[0-9]', choices=range(0,10), default=0, help="set debug level")
+  parser.add_argument("--debug", dest='Debug', type=int, metavar='[0-9]', choices=range(0, 10), default=0, help="set debug level")
   parser.add_argument(metavar="input_file", dest='InputFile', type=argparse.FileType('rb'), help="specify the input filename")
 
   #
   # Parse command line arguments
-  #  
+  #
   args = parser.parse_args()
 
   #
@@ -85,6 +81,8 @@ if __name__ == '__main__':
   try:
     OpenSslPath = os.environ['OPENSSL_PATH']
     OpenSslCommand = os.path.join(OpenSslPath, OpenSslCommand)
+    if ' ' in OpenSslCommand:
+      OpenSslCommand = '"' + OpenSslCommand + '"'
   except:
     pass
 
@@ -93,19 +91,19 @@ if __name__ == '__main__':
   #
   try:
     Process = subprocess.Popen('%s version' % (OpenSslCommand), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
-  except:  
-    print 'ERROR: Open SSL command not available.  Please verify PATH or set OPENSSL_PATH'
+  except:
+    print('ERROR: Open SSL command not available.  Please verify PATH or set OPENSSL_PATH')
     sys.exit(1)
-    
+
   Version = Process.communicate()
-  if Process.returncode <> 0:
-    print 'ERROR: Open SSL command not available.  Please verify PATH or set OPENSSL_PATH'
+  if Process.returncode != 0:
+    print('ERROR: Open SSL command not available.  Please verify PATH or set OPENSSL_PATH')
     sys.exit(Process.returncode)
-  print Version[0]
-  
+  print(Version[0].decode('utf-8'))
+
   #
   # Read input file into a buffer and save input filename
-  #  
+  #
   args.InputFileName   = args.InputFile.name
   args.InputFileBuffer = args.InputFile.read()
   args.InputFile.close()
@@ -115,7 +113,7 @@ if __name__ == '__main__':
   #
   OutputDir = os.path.dirname(args.OutputFile)
   if not os.path.exists(OutputDir):
-    print 'ERROR: The output path does not exist: %s' % OutputDir
+    print('ERROR: The output path does not exist: %s' % OutputDir)
     sys.exit(1)
   args.OutputFileName = args.OutputFile
 
@@ -142,27 +140,28 @@ if __name__ == '__main__':
       args.PrivateKeyFile = open(args.PrivateKeyFileName, 'rb')
       args.PrivateKeyFile.close()
     except:
-      print 'ERROR: test signing private key file %s missing' % (args.PrivateKeyFileName)
+      print('ERROR: test signing private key file %s missing' % (args.PrivateKeyFileName))
       sys.exit(1)
 
   #
   # Extract public key from private key into STDOUT
   #
   Process = subprocess.Popen('%s rsa -in "%s" -modulus -noout' % (OpenSslCommand, args.PrivateKeyFileName), stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
-  PublicKeyHexString = Process.communicate()[0].split('=')[1].strip()
+  PublicKeyHexString = Process.communicate()[0].split(b'=')[1].strip()
+  PublicKeyHexString = PublicKeyHexString.decode('utf-8')
   PublicKey = ''
   while len(PublicKeyHexString) > 0:
-    PublicKey = PublicKey + chr(int(PublicKeyHexString[0:2],16))
+    PublicKey = PublicKey + PublicKeyHexString[0:2]
     PublicKeyHexString=PublicKeyHexString[2:]
-  if Process.returncode <> 0:
+  if Process.returncode != 0:
     sys.exit(Process.returncode)
 
   if args.MonotonicCountStr:
     try:
       if args.MonotonicCountStr.upper().startswith('0X'):
-        args.MonotonicCountValue = (long)(args.MonotonicCountStr, 16)
+        args.MonotonicCountValue = int(args.MonotonicCountStr, 16)
       else:
-        args.MonotonicCountValue = (long)(args.MonotonicCountStr)
+        args.MonotonicCountValue = int(args.MonotonicCountStr)
     except:
         pass
 
@@ -171,20 +170,20 @@ if __name__ == '__main__':
     if args.MonotonicCountStr:
       format = "%dsQ" % len(args.InputFileBuffer)
       FullInputFileBuffer = struct.pack(format, args.InputFileBuffer, args.MonotonicCountValue)
-    # 
+    #
     # Sign the input file using the specified private key and capture signature from STDOUT
     #
-    Process = subprocess.Popen('%s sha256 -sign "%s"' % (OpenSslCommand, args.PrivateKeyFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
+    Process = subprocess.Popen('%s dgst -sha256 -sign "%s"' % (OpenSslCommand, args.PrivateKeyFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
     Signature = Process.communicate(input=FullInputFileBuffer)[0]
-    if Process.returncode <> 0:
+    if Process.returncode != 0:
       sys.exit(Process.returncode)
-      
+
     #
     # Write output file that contains hash GUID, Public Key, Signature, and Input data
-    #    
+    #
     args.OutputFile = open(args.OutputFileName, 'wb')
-    args.OutputFile.write(EFI_HASH_ALGORITHM_SHA256_GUID.get_bytes_le())
-    args.OutputFile.write(PublicKey)
+    args.OutputFile.write(EFI_HASH_ALGORITHM_SHA256_GUID.bytes_le)
+    args.OutputFile.write(bytearray.fromhex(str(PublicKey)))
     args.OutputFile.write(Signature)
     args.OutputFile.write(args.InputFileBuffer)
     args.OutputFile.close()
@@ -195,19 +194,19 @@ if __name__ == '__main__':
     #
     Header = EFI_CERT_BLOCK_RSA_2048_SHA256._make(EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT.unpack_from(args.InputFileBuffer))
     args.InputFileBuffer = args.InputFileBuffer[EFI_CERT_BLOCK_RSA_2048_SHA256_STRUCT.size:]
-    
+
     #
     # Verify that the Hash Type matches the expected SHA256 type
     #
-    if uuid.UUID(bytes_le = Header.HashType) <> EFI_HASH_ALGORITHM_SHA256_GUID:
-      print 'ERROR: unsupport hash GUID'
+    if uuid.UUID(bytes_le = Header.HashType) != EFI_HASH_ALGORITHM_SHA256_GUID:
+      print('ERROR: unsupport hash GUID')
       sys.exit(1)
 
     #
     # Verify the public key
     #
-    if Header.PublicKey <> PublicKey:
-      print 'ERROR: Public key in input file does not match public key from private key file'
+    if Header.PublicKey != bytearray.fromhex(PublicKey):
+      print('ERROR: Public key in input file does not match public key from private key file')
       sys.exit(1)
 
     FullInputFileBuffer = args.InputFileBuffer
@@ -219,18 +218,18 @@ if __name__ == '__main__':
     # Write Signature to output file
     #
     open(args.OutputFileName, 'wb').write(Header.Signature)
-      
+
     #
     # Verify signature
-    #    
-    Process = subprocess.Popen('%s sha256 -prverify "%s" -signature %s' % (OpenSslCommand, args.PrivateKeyFileName, args.OutputFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
+    #
+    Process = subprocess.Popen('%s dgst -sha256 -prverify "%s" -signature %s' % (OpenSslCommand, args.PrivateKeyFileName, args.OutputFileName), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True)
     Process.communicate(input=FullInputFileBuffer)
-    if Process.returncode <> 0:
-      print 'ERROR: Verification failed'
+    if Process.returncode != 0:
+      print('ERROR: Verification failed')
       os.remove (args.OutputFileName)
       sys.exit(Process.returncode)
 
     #
-    # Save output file contents from input file 
-    #    
+    # Save output file contents from input file
+    #
     open(args.OutputFileName, 'wb').write(args.InputFileBuffer)