generate_bios_oemvars

#!/usr/bin/env python
#
# Copyright (C) 2014 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
"""
Produces a text file suitable for flashing with "fastboot flash oemvars"
which sets the device's authenticated PK/KEK/DB keys.

Key pairs supplied in the command line are expected to be in .pk8 and .x509.pem
format.

generate_bios_oemvars [options] <output filename>

  -D  (--db-pair)  <key pair)

  -K  (--kek-pair)  <key pair)

  -P  (--pk-pair)  <key pair)

  -U  (--unlock) <filename>
      Generate an additional "unlock" file which clears PK, placing the device in
      Setup Mode.

  -T  (--timestamp) <UNIX timestamp>
      Timestamp (seconds since the Epoch) to use for autheticated UEFI Variables.
      If --unlock is in use, the unlock file will use this value +1. Defaults
      to UNIX system time.

"""
import sys
import tempfile
import os
import time

# Android Release Tools
sys.path.append("build/tools/releasetools")
import common

sys.path.append("device/intel/build/releasetools")
import intel_common

OPTIONS = common.OPTIONS
OPTIONS.db_pair = None
OPTIONS.kek_pair = None
OPTIONS.pk_pair = None
OPTIONS.unlock = None
OPTIONS.all_keys = set()
OPTIONS.ts = 0
# XXX what is this for? This is the default in the Efitools Makefile
OPTIONS.guid = "11111111-2222-3333-4444-123456789abc"

guid_map = {
        "global" : "8be4df61-93ca-11d2-aa0d-00e098032b8c",
        "image-security" : "d719b2cb-3d3a-4596-a3bc-dad00e67656f"
        }

def escaped_value(value):
    result = ''
    for char in value:
        result += "%%%02x" % ord(char)
    return result

def get_efi_sig_list(pem_cert, guid_str, name):
    tf = tempfile.NamedTemporaryFile(prefix="pem_cert_to_esl-"+name+"-")
    if pem_cert:
        cmd = ["cert-to-efi-sig-list", "-g", guid_str, pem_cert, tf.name]
        p = common.Run(cmd)
        p.communicate()
        assert p.returncode == 0, "cert-to-efi-sig-list failed"
    tf.seek(os.SEEK_SET, 0)
    return tf

def get_auth_data(timestamp, sign_pair, password, pem_cert, guid_str, name):
    esl = get_efi_sig_list(pem_cert, guid_str, name)

    pem_key = intel_common.pk8_to_pem(sign_pair + OPTIONS.private_key_suffix, password)

    tf = tempfile.NamedTemporaryFile(prefix="auth_file-"+name+"-")
    cmd = ["sign-efi-sig-list", "-t", time.ctime(timestamp), "-c", sign_pair + OPTIONS.public_key_suffix,
            "-k", pem_key.name, name, esl.name, tf.name]
    p = common.Run(cmd)
    p.communicate()
    assert p.returncode == 0, "sign-efi-sig-list failed"
    tf.seek(os.SEEK_SET, 0)
    pem_key.close()
    esl.close()
    data = tf.read()
    tf.close()
    return data


def main(argv):
    def option_handler(o, a):
        if o in ("-D", "--db-pair"):
            OPTIONS.db_pair = a
            OPTIONS.all_keys.add(a)
        elif o in ("-K", "--kek-pair"):
            OPTIONS.kek_pair = a
            OPTIONS.all_keys.add(a)
        elif o in ("-P", "--pk-pair"):
            OPTIONS.pk_pair = a
            OPTIONS.all_keys.add(a)
        elif o in ("-G", "--guid"):
            OPTIONS.guid = a
        elif o in ("-U", "--unlock"):
            OPTIONS.unlock = a
        elif o in ("-T", "--timestamp"):
            OPTIONS.ts = int(a)
        else:
            return False
        return True

    args = common.ParseOptions(argv, __doc__,
            extra_opts = "D:K:P:U:T:",
            extra_long_opts = ["db-pair=", "kek-pair=",
                "pk-pair=", "unlock=", "timestamp="],
            extra_option_handler = option_handler)

    if len(args) != 1:
        common.Usage(__doc__)
        sys.exit(1)

    if not OPTIONS.db_pair or not OPTIONS.kek_pair or not OPTIONS.pk_pair:
        raise common.ExternalError("use of -D, -K, and -P is mandatory");

    if not OPTIONS.ts:
        OPTIONS.ts = int(time.time())

    passwords = common.GetKeyPasswords(OPTIONS.all_keys)

    pk_auth = get_auth_data(OPTIONS.ts, OPTIONS.pk_pair, passwords[OPTIONS.pk_pair],
            OPTIONS.pk_pair + OPTIONS.public_key_suffix, OPTIONS.guid, "PK")
    kek_auth = get_auth_data(OPTIONS.ts, OPTIONS.pk_pair, passwords[OPTIONS.pk_pair],
            OPTIONS.kek_pair + OPTIONS.public_key_suffix, OPTIONS.guid, "KEK")
    db_auth = get_auth_data(OPTIONS.ts, OPTIONS.kek_pair, passwords[OPTIONS.kek_pair],
            OPTIONS.db_pair + OPTIONS.public_key_suffix, OPTIONS.guid, "db")

    output = open(args[0], "wb")

    output.write("# This file generated by generate_bios_oemvar to enroll UEFI Secure Boot keys\n");
    output.write("GUID = %s\n\n" % (guid_map["image-security"]))
    output.write("[ad] db %s\n\n" % escaped_value(db_auth))
    output.write("GUID = %s\n\n" % (guid_map["global"]))
    output.write("[ad] KEK %s\n\n" % escaped_value(kek_auth))
    output.write("[ad] PK %s\n\n" % escaped_value(pk_auth))

    output.close()

    if OPTIONS.unlock:
        # Add 1 to the timestamp so it can always be unlocked; auth variables only apply
        # for monotonically increasing values
        no_pk_auth = get_auth_data(OPTIONS.ts + 1, OPTIONS.pk_pair, passwords[OPTIONS.pk_pair],
                None,  OPTIONS.guid, "PK")
        output = open(OPTIONS.unlock, "wb")
        output.write("# This file generated by generate_bios_oemvars to put device in Setup Mode\n");
        output.write("GUID = %s\n\n" % (guid_map["global"]))
        output.write("[ad] PK %s\n\n" % escaped_value(no_pk_auth))
        output.close()

if __name__ == '__main__':
    try:
        main(sys.argv[1:])
    except common.ExternalError, e:
        print
        print "   ERROR: %s" % (e,)
        print
        sys.exit(1)