def __init__(self, config_dir=defines.DEFAULT_CONFIG_DIR, debug=False): # Initialize the internal properties self._config_dir_obj = ConfigDir(config_dir) self._img_config_parser = None self._stager = None # Initialize the public properties self.debug = debug
def __init__(self, config_dir=defines.DEFAULT_CONFIG_DIR, debug=False): # Initialize the internal properties self._config_dir_obj = ConfigDir(config_dir) self._img_config_parser = None self._parsegen_config = None self._stager = None # Generate Parsegen_config from parsegen_config.xml from sectools.features.isc.parsegen.config.parser import ParsegenCfgParser self._parsegen_config = ParsegenCfgParser(PARSEGEN_PATH) # Initialize the public properties self.debug = debug
def __init__(self, config_dir=defines.DEFAULT_CONFIG_DIR, debug=False): # Initialize the internal properties self._config_dir_obj = ConfigDir(config_dir) self._img_config_parser = None self._stager = None # Initialize the public properties self.debug = debug
class SecImageCore(object): """Provides interface for user to set up parameters (including input files, output directory, etc) and perform various operations (signing, encryption). User can select the config file using: - :meth:`chipset` - :meth:`config_path` User can specify images for processing using: - :meth:`set_image_path` - :meth:`set_meta_build_path` User can specify output using: - :meth:`output_dir` - :meth:`mini_build_path` User can finally perform the following operations: - :meth:`verify_inputs` - :meth:`sign` - :meth:`encrypt` - :meth:`validate` User can also perform multiple operations using :meth:`process` :param str config_dir: Path to the directory containing the config files for the supported chipsets. :param bool debug: If all the underlying modules should work in debug mode (save debug logs, etc). .. data:: debug (bool) Is debug mode enabled. The debug logs will be stored in :meth:`output_dir` """ def __init__(self, config_dir=defines.DEFAULT_CONFIG_DIR, debug=False): # Initialize the internal properties self._config_dir_obj = ConfigDir(config_dir) self._img_config_parser = None self._parsegen_config = None self._stager = None # Generate Parsegen_config from parsegen_config.xml from sectools.features.isc.parsegen.config.parser import ParsegenCfgParser self._parsegen_config = ParsegenCfgParser(PARSEGEN_PATH) # Initialize the public properties self.debug = debug @property def config_dir(self): """(str) Path to the config directory provided in params. The config_dir path cannot be set directly. """ return self._config_dir_obj.config_dir @config_dir.setter def config_dir(self, config_dir): raise RuntimeError('Config dir cannot be set.') @property def available_chipsets(self): """(list[str]) A list of chipsets for which config files are available in the :meth:`config_dir`. The list of available chipsets cannot be set directly. """ return self._config_dir_obj.chipsets @available_chipsets.setter def available_chipsets(self, chipset_list): raise RuntimeError('Available chipsets cannot be set.') @property def chipset(self): """(str) Chipset that is selected for the current run. The chipset selection will update the :meth:`config_path` """ if self._img_config_parser is not None: return self._img_config_parser.chipset else: raise RuntimeError('Chipset Path is not set.') @chipset.setter def chipset(self, chipset): self.set_chipset(chipset) def set_chipset(self, chipset, overrides=None): # Log if the chipset is changed try: selected_chipset = self.chipset if selected_chipset: logger.note('Switching chipset from "' + selected_chipset + '" to "' + chipset + '"') except Exception: pass # Update the config path based on the given chipset config_path = self._config_dir_obj.get_chipset_config_path(chipset) if config_path is None: raise RuntimeError('Config file is not found for chipset: ' + str(chipset)) self.set_config_path(config_path, overrides) logger.info('Chipset is set to: ' + chipset) @property def config_path(self): """(str) Config path that is selected for the current run. The config_path selection will update the :meth:`chipset` """ if self._img_config_parser is not None: return self._img_config_parser.config_path else: raise RuntimeError('Config Path is not set.') @config_path.setter def config_path(self, config_path): self.set_config_path(config_path) def set_config_path(self, config_path, overrides=None): # Log if the config_path is changed try: selected_config_path = self.config_path if selected_config_path: logger.note('Switching config_path: ' + '\n' ' ' + 'from: ' + selected_config_path + '\n' ' ' + ' to: ' + config_path) except Exception: pass # Update the config_path self._img_config_parser = ConfigParser(config_path, overrides) logger.info('Config path is set to: ' + config_path) # Reset the stager at this point if self._stager is not None: logger.note('Resetting image list due to config path change.') self._stager = None @property def available_sign_ids(self): """(list[str]) A list of sign_ids available from the selected :meth:`config_path`/:meth:`chipset`. """ if self._img_config_parser is not None: return self._img_config_parser.sign_id_list else: raise RuntimeError( 'Set chipset or config Path before querying the available sign ids.' ) @available_sign_ids.setter def available_sign_ids(self, chipset_list): raise RuntimeError('Available sign ids cannot be set.') def set_image_path(self, image_path, sign_id): """Sets the image that will be processed. :param str image_path: Path to the image to be processed :param str sign_id: sign_id corresponding to the image_path. This must be one of the :meth:`available_sign_ids` """ if self._img_config_parser is not None and self._parsegen_config is not None: self._stager = stager.ImagePathsStager(image_path, self._img_config_parser, self._parsegen_config, sign_id) else: raise RuntimeError( 'Set chipset or config Path before setting the image path.') def set_meta_build_path(self, meta_build_path, sign_id_list=[]): """Sets the meta build path from which the images to be processed will be queried. :param str meta_build_path: Path to the meta build. """ if self.meta_supports_sign_id(meta_build_path): self._stager = stager.MetaBuildStager(meta_build_path, self._config_dir_obj, self._parsegen_config, sign_id_list) else: self._stager = stager.MetaBuildTmpStager(meta_build_path, self._config_dir_obj, self._img_config_parser, self._parsegen_config, sign_id_list) @property def image_path_list(self): """(list[str]) List of source image paths that are being operated on. This is updated once one of :meth:`set_image_path`, :meth:`set_meta_build_path` is used to specify the images to be processed. """ if self._stager is not None: return self._stager.image_path_list else: raise RuntimeError('Image list is not set. ' 'Set one of image_path or meta_build_path.') @image_path_list.setter def image_path_list(self, image_path_list): raise RuntimeError( 'Image path list cannot be set directly. ' 'Use set_image_path or set_meta_build to set the image paths.') @property def image_info_list(self): """(list[ImageInfo]) A list of :class:`imageinfo.ImageInfo` objects that are being operated on. """ if self._stager is not None: return self._stager.image_info_list else: raise RuntimeError('Image Info list is not set. ' 'Set one of image_path or meta_build_path.') @image_info_list.setter def image_info_list(self, image_info_list): raise RuntimeError('Image Info list cannot be set directly.') @property def output_dir(self): """(str) Path to the output directory to use for saving the logs, output files. """ if self._stager is not None: return self._stager.output_dir else: raise RuntimeError('Image list is not set. ' 'Set one of image_path or meta_build_path. ' 'Then retry setting output directory.') @output_dir.setter def output_dir(self, output_dir): # Log if the output_dir is changed try: selected_output_dir = self.output_dir if selected_output_dir: logger.note('Switching output_dir: ' + '\n' ' ' + 'from: ' + selected_output_dir + '\n' ' ' + ' to: ' + output_dir) except Exception: pass # Update the output_dir self._stager.output_dir = output_dir logger.info('Output dir is set to: ' + output_dir) # Clear the minimized build setting try: self._stager.mini_build_path = '' except Exception: pass @property def mini_build_path(self): """(str) Path to the minimized build directory to use for saving the logs, output files. """ if self._stager is not None: return self._stager.mini_build_path else: raise RuntimeError('Image list is not set. ' 'Set one of image_path or meta_build_path. ' 'Then retry querying/setting minimized build.') @mini_build_path.setter def mini_build_path(self, mini_build_path): # Log if the mini_build_path is changed selected_mini_build_path = self.mini_build_path if selected_mini_build_path: logger.note('Switching mini_build_path: ' + '\n' ' ' + 'from: ' + selected_mini_build_path + '\n' ' ' + ' to: ' + mini_build_path) # Update the mini_build_path self._stager.mini_build_path = mini_build_path logger.info('Minimized Build is set to: ' + mini_build_path) # Clear the output dir setting try: self._stager.output_dir = '' except Exception: pass @classmethod def meta_supports_sign_id(self, meta_build_path): return stager.meta_build_stager.MetaBuildStager.meta_supports_sign_id( meta_build_path) def process(self, verify_setup=False, integrity_check=False, sign=False, encrypt=False, decrypt=False, val_image=False, val_integrity_check=False, val_sign=False, val_encrypt=False, progress_cb=PROGRESS_CB_PYPASS): """Performs the secure-image related operations specified from the params. :param bool verify_setup: Verify that the configuration of the object is correct and return. This will ignore any other params. :param bool integrity_check: Add integrity check to the image. :param bool sign: Sign the images. (Re-sign if image is already signed) :param bool encrypt: Encrypt the images. (Re-encrypt if image is already encrypted) :param bool val_image: Validate the integrity of the image against the config file. :param bool val_integrity_check: Validate the integrity check in the image. :param bool val_sign: Validate that the image is signed and validate the integrity of the signing related data. :param bool val_encrypt: Validate that the image is encrypted and validate the integrity of the encryption related data. :param cb progress_cb: Callback method to get a status update during processing. Callback method should have this format: :: def progress_cb(status_string, progress_percent): \""" :param str status_string: the current status. :param int progress_percent: the progress (in percent) \""" ... """ from imageinfo import ImageInfo, StatusInfo # Ensure that one or more image files is provided for processing if self._stager is None or not self.image_path_list: raise RuntimeError( 'Please specify one or more images for processing') # Ensure the correct set of operations is provided if not (verify_setup or integrity_check or sign or encrypt or decrypt or val_image or val_integrity_check or val_sign or val_encrypt): raise RuntimeError( 'Please specify one or more operations to perform.') if verify_setup: logger.note('The inputs provided (config, cmd args) are valid.') return # Print the openssl path version = '' path_info = 'is unavailable. Please run "which openssl" and "openssl version" to check openssl version info, and upgrade to required version' try: from sectools.common import crypto from sectools.common.crypto import crypto_functions version = 'v' + crypto.discovery.openssl.OPENSSL_VERSION_MIN + ' or greater ' crypto_functions.are_available([crypto_functions.MOD_OPENSSL]) path_info = 'is available at: "' + crypto.openssl_binary_implementation.openssl_binary_path + '"' except Exception as e: pass logger.info('Openssl ' + version + path_info) # Start processing images total_images = len(self.image_info_list) progress = ProgressNotifier(total_images, progress_cb, PROGRESS_TOTAL_STAGES) for idx, image in enumerate(self.image_info_list): assert isinstance(image, ImageInfo) logger.info( '------------------------------------------------------') status_string = ('Processing ' + str(idx + 1) + '/' + str(total_images) + ': ' + image.image_under_operation) logger.info(status_string + '\n') # Send a progress notification to the toplevel progress.status = status_string progress.cur = idx progress.cur_stage = 0 file_logger_id = None try: # Create the required directory structure for this image image_output_dir = image.dest_image.image_dir try: c_path.create_dir(image_output_dir) except Exception as e: raise RuntimeError('Could not create output directory: ' + image_output_dir + '\n' ' ' + 'Error: ' + str(e)) # Enable/Disable debug image.dest_image.debug_enable = self.debug c_path.create_debug_dir(image.dest_image.debug_dir) # Enable file logging to the directory file_logger_id = logger.add_file_logger( c_path.join(image_output_dir, 'SecImage_log.txt'), logger.verbosity) # Create the security policies list for this image security_policy_list = create_security_policy_list(image) # Parsegen object parsegen = None # For secure operations if integrity_check or sign or encrypt or decrypt: parsegen = self._process_secure_operation( image, progress, security_policy_list, integrity_check, sign, encrypt, decrypt) # For validation if val_image or val_integrity_check or val_sign or val_encrypt: parsegen = self._process_validation( image, progress, security_policy_list, val_image, val_integrity_check, val_sign, val_encrypt) # Print the image data if parsegen is not None: logger.info('\n' + str(parsegen)) # Set overall processing to true if not ((val_image and image.status.validate_parsegen.state == StatusInfo.ERROR) or (val_integrity_check and image.status.validate_integrity_check.state == StatusInfo.ERROR) or (val_sign and image.status.validate_sign.state == StatusInfo.ERROR) or (val_encrypt and image.status.validate_encrypt.state == StatusInfo.ERROR)): image.status.overall.state = StatusInfo.SUCCESS except Exception: logger.error(traceback.format_exc()) logger.error(sys.exc_info()[1]) if file_logger_id is not None: logger.removeFileLogger(file_logger_id) logger.info( '------------------------------------------------------\n') progress.complete() def _process_secure_operation(self, image, progress, security_policy_list, i_integrity_check, i_sign, i_encrypt, i_decrypt, idx=0): from imageinfo import ImageInfo, StatusInfo # Check bounds if len(security_policy_list) == 0: raise RuntimeError('Security policy list must not be empty.') elif len(security_policy_list) <= idx: raise RuntimeError( 'Security policy list length must be more than index.') # Get the current security policy file_type = security_policy_list[idx].file_type integrity_check = security_policy_list[ idx].integrity_check and i_integrity_check sign = security_policy_list[idx].sign and i_sign encrypt = security_policy_list[idx].encrypt and i_encrypt decrypt = security_policy_list[idx].encrypt and i_decrypt # Create the encryptor object encdec = None if encrypt or decrypt: c_path.create_debug_dir(image.dest_image.debug_dir_encdec) encdec = get_encdec(image) # Create the parsegen object file_type_backup = image.image_type.file_type encdec_backup = image.encdec image.image_type.file_type = file_type image.encdec = encdec try: parsegen = self._status_updater(self._create_parsegen_obj, image.status.parsegen, progress, True, image) finally: image.image_type.file_type = file_type_backup image.encdec = encdec_backup # Do not allow signed unencrypted elf images to be encrypted as the # Sign will not longer match the encrypted image's tosign if parsegen.file_type() == 'elf' and parsegen.is_signed( ) and not sign and not parsegen.is_encrypted() and encrypt: raise RuntimeError( 'Cannot encrypt a signed unencrypted image without resigning ' 'as the sign no longer matches the format change.') # Set the security mechanisms parsegen.integrity_check = security_policy_list[ idx].integrity_check and (parsegen.contains_integrity_check() or integrity_check) parsegen.sign = security_policy_list[idx].sign and ( parsegen.is_signed() or sign) parsegen.encrypt = security_policy_list[idx].encrypt and ( False if decrypt else (parsegen.is_encrypted() or encrypt)) # If encrypt: if encrypt: parsegen.encryption_params = encdec.get_encryption_parameters_blob( ) # Dump any debug data self.dump_parsegen_debug_data(image, parsegen) # If the security policy list contains more formats, call them if idx < len(security_policy_list) - 1: data = parsegen.get_wrapped_data() import tempfile tmp_fd = tempfile.NamedTemporaryFile(delete=False) tmp_fd.close() store_data_to_file(tmp_fd.name, data) # Backup the source path here src_image_dir_base = image.src_image.image_dir_base src_image_dir_ext = image.src_image.image_dir_ext src_image_name = image.src_image.image_name image.src_image.image_dir_base = os.path.dirname(tmp_fd.name) image.src_image.image_dir_ext = '' image.src_image.image_name = os.path.basename(tmp_fd.name) try: data = self._process_secure_operation(image, progress, security_policy_list, i_integrity_check, i_sign, i_encrypt, i_decrypt, idx + 1) finally: image.src_image.image_dir_base = src_image_dir_base image.src_image.image_dir_ext = src_image_dir_ext image.src_image.image_name = src_image_name os.remove(tmp_fd.name) parsegen.set_wrapped_data(data) # Sign the image if sign: self._status_updater(self._sign_image, image.status.sign, progress, True, image, parsegen) # Package and generate the output image file data = parsegen.get_data() if integrity_check: image.status.integrity_check.state = StatusInfo.SUCCESS if encrypt: image.status.encrypt.state = StatusInfo.SUCCESS if idx != 0: return data if decrypt: ecryption_params_backup = parsegen.encryption_params parsegen.encryption_params = '' try: store_data_to_file(image.dest_image.decrypted_file, parsegen.get_data()) finally: parsegen.encryption_params = ecryption_params_backup else: store_data_to_file(image.dest_image.image_path, data) logger.info(('Signed ' if sign else '') + ('& ' if sign and encrypt else '') + ('Encrypted ' if encrypt else '') + 'image is stored at ' + image.dest_image.image_path) image.image_under_operation = image.dest_image.image_path # Do any post processing self._status_updater(self._post_process, image.status.postprocess, progress, True, image, image.config.post_process.pil_splitter, getattr(self._stager, '_meta_build_path', None)) return parsegen def _process_validation(self, image, progress, security_policy_list, i_val_image, i_val_integrity_check, i_val_sign, i_val_encrypt, idx=0): # TODO: Need to figure how to do this #image.dest_image._mid = 'validation' # Check bounds if len(security_policy_list) == 0: raise RuntimeError('Security policy list must not be empty.') elif len(security_policy_list) <= idx: raise RuntimeError( 'Security policy list length must be more than index.') # Get the current security policy file_type = security_policy_list[idx].file_type val_image = i_val_image val_integrity_check = security_policy_list[ idx].integrity_check and i_val_integrity_check val_sign = security_policy_list[idx].sign and i_val_sign val_encrypt = security_policy_list[idx].encrypt and i_val_encrypt # Backup the source path here src_image_dir_base = image.src_image.image_dir_base src_image_dir_ext = image.src_image.image_dir_ext src_image_name = image.src_image.image_name # Update the souce image path image.src_image.image_dir_base = os.path.dirname( image.image_under_operation) image.src_image.image_dir_ext = '' image.src_image.image_name = os.path.basename( image.image_under_operation) try: # Create the encryptor object encdec = None if val_encrypt and image.general_properties.selected_encryptor: c_path.create_debug_dir(image.dest_image.debug_dir_encdec) encdec = get_encdec(image) # Create the parsegen object file_type_backup = image.image_type.file_type encdec_backup = image.encdec image.image_type.file_type = file_type image.encdec = encdec try: parsegen = self._status_updater(self._create_parsegen_obj, image.status.validate_parsegen, progress, True, image) finally: image.image_type.file_type = file_type_backup image.encdec = encdec_backup # Set the security mechanisms parsegen.integrity_check = parsegen.contains_integrity_check() parsegen.sign = parsegen.is_signed() parsegen.encrypt = parsegen.is_encrypted() # Dump any debug data self.dump_parsegen_debug_data(image, parsegen) # Validate parsegen if val_image: self._status_updater(self._validate_parsegen, image.status.validate_parsegen, progress, False, image, parsegen) # Validate integrity check if val_integrity_check: self._status_updater(self._validate_integrity_check, image.status.validate_integrity_check, progress, False, image, parsegen) # Validate sign if val_sign: self._status_updater(self._validate_sign, image.status.validate_sign, progress, False, image, parsegen) # Validate encrypt if val_encrypt: self._status_updater(self._validate_encrypt, image.status.validate_encrypt, progress, False, image, parsegen) # If the security policy list contains more formats, call them if idx < len(security_policy_list) - 1: data = parsegen.get_wrapped_data() import tempfile tmp_fd = tempfile.NamedTemporaryFile(delete=False) tmp_fd.close() store_data_to_file(tmp_fd.name, data) # Backup the image_under_operation here image_under_operation_int = image.image_under_operation image.image_under_operation = tmp_fd.name try: self._process_validation(image, progress, security_policy_list, i_val_image, i_val_integrity_check, i_val_sign, i_val_encrypt, idx + 1) finally: image.image_under_operation = image_under_operation_int os.remove(tmp_fd.name) finally: image.src_image.image_dir_base = src_image_dir_base image.src_image.image_dir_ext = src_image_dir_ext image.src_image.image_name = src_image_name return parsegen def _create_parsegen_obj(self, image): c_path.create_debug_dir(image.dest_image.debug_dir_parsegen) from sectools.features.isc.parsegen import get_parser parsegen = get_parser(image) return parsegen def _sign_image(self, image, parsegen): logger.info('Resigning signed' if parsegen.is_signed() else 'Signing' ' image: ' + image.image_under_operation) c_path.create_debug_dir(image.dest_image.debug_dir_signer) signer = Signer(image.config) # TODO: a sanity check here # data_to_sign = parsegen.data_to_sign # if data_to_sign != parsegen.data_to_sign: # raise RuntimeError('Data to sign is changing') sign_assets = signer.sign(parsegen.data_to_sign, image, image.dest_image.debug_dir_signer) # Dump any debug information self.dump_signer_debug_data(image, sign_assets) parsegen.data_signature = sign_assets.signature parsegen.cert_chain = sign_assets.cert_chain def _pil_split(self, src, prefix): from sectools.common.parsegen.elf.format import ParseGenElf, pack_phdrs, PF_OS_SEGMENT_HASH # Load the data p_obj = ParseGenElf(load_data_from_file(src)) # File names elfhdr = prefix + '.mdt' # Cleanup for eachpattern in [elfhdr, (prefix + '.b*')]: import glob for eachfile in glob.glob(eachpattern): try: os.remove(eachfile) except Exception: pass # Create the mdt data elfdata = p_obj.ehdr.pack() + pack_phdrs(p_obj.phdrs) # Dump the segments for idx, phdr in enumerate(p_obj.phdrs): path = prefix + ('.b%02d' % idx) store_data_to_file(path, p_obj.segments[phdr]) if phdr.f_os_segment_type == PF_OS_SEGMENT_HASH: elfdata += p_obj.segments[phdr] # Dump the final elfhdr mdt store_data_to_file(elfhdr, elfdata) def _post_process(self, image, pil_splitter_path, meta_build_path): ''' Replacement tags in postsign commands for images. ''' TAG_OUTPUT_DIR = '$(OUTPUT_DIR)' TAG_PIL_SPLITTER = '$(PIL_SPLITTER)' TAG_IMAGE_FILE = '$(IMAGE_FILE)' REPL_META_PATH = '$(META_BUILD)' if image.pil_split: image_file = image.image_under_operation self._pil_split(image_file, os.path.splitext(image_file)[0]) if image.post_process_commands: # Ensure pil splitter is available if pil_splitter_path.find(REPL_META_PATH) != -1: if not meta_build_path: raise RuntimeError( 'Metabuild path is not available for pil splitter') pil_splitter_path = pil_splitter_path.replace( REPL_META_PATH, meta_build_path) if not c_path.validate_file(pil_splitter_path): raise RuntimeError('Cannot access pil splitter at: ' + pil_splitter_path) # Run all the commands for cmd in [ c.strip() for c in image.post_process_commands.split() ]: # Perform any needed replacements cmd = cmd.replace(TAG_OUTPUT_DIR, os.path.dirname(image.image_under_operation)) cmd = cmd.replace(TAG_PIL_SPLITTER, pil_splitter_path) cmd = cmd.replace(TAG_IMAGE_FILE, image.image_under_operation) logger.info('Running postsign command: ' + cmd) err = os.system(cmd) logger.info('Result: ' + str(err)) def _validate_parsegen(self, image, parsegen): pass def _validate_integrity_check(self, image, parsegen): pass def _validate_sign(self, image, parsegen): if parsegen.is_signed(): signer = Signer(image.config) if signer.validate(parsegen): logger.info('Image ' + image.image_under_operation + ' signature is valid') else: raise RuntimeError('Image ' + image.image_under_operation + ' signature is not valid') else: raise CustomError('Image ' + image.image_under_operation + ' is not signed') def _validate_encrypt(self, image, parsegen): if parsegen.is_encrypted(): logger.info('Image ' + image.image_under_operation + ' is encrypted') else: raise CustomError('Image ' + image.image_under_operation + ' is not encrypted') def _status_updater(self, method, status, progress, raise_err, *args, **kwargs): from imageinfo import ImageInfo, StatusInfo try: retval = method(*args, **kwargs) status.state = StatusInfo.SUCCESS progress.push() return retval except Exception as e: status.state = StatusInfo.ERROR status.error = str(e) progress.push() if raise_err: raise else: if isinstance(e, CustomError): logger.info(status.error) else: logger.error(status.error) def dump_parsegen_debug_data(self, image, parsegen): if image.dest_image.debug_dir_parsegen is None: return so = parsegen fp = image.dest_image from imageinfo import DestImagePath assert isinstance(fp, DestImagePath) debug_logs = [] try: debug_logs.append( (so.get_data(False, False, False), fp.debug_file_parsegen_unsigned)) except Exception: pass try: debug_logs.append((so.data_to_sign, fp.debug_file_parsegen_tosign)) except Exception: pass try: debug_logs.append( (so.cert_chain, fp.debug_file_parsegen_cert_chain)) except Exception: pass try: debug_logs.append( (so.data_signature, fp.debug_file_parsegen_signature)) except Exception: pass try: debug_logs.append( (so.get_data(True, False, False), fp.debug_file_parsegen_integrity_check)) except Exception: pass try: debug_logs.append( (so.get_data(True, True, False), fp.debug_file_parsegen_signed)) except Exception: pass try: debug_logs.append( (so.get_data(True, True, True), fp.debug_file_parsegen_encrypted)) except Exception: pass for data, debug_file in debug_logs: try: store_data_to_file(debug_file, data) except Exception: logger.debug2('Failed to save debug file ' + debug_file + '\n' ' ' + str(sys.exc_info()[1])) def dump_signer_debug_data(self, image, sign_assets): if image.dest_image.debug_dir_signer is None: return sa = sign_assets fp = image.dest_image from imageinfo import DestImagePath assert isinstance(fp, DestImagePath) debug_logs = [ (sa.root_cert, fp.debug_file_signer_root_cert), (sa.attestation_ca_cert, fp.debug_file_signer_attestation_ca_cert), (sa.attestation_cert, fp.debug_file_signer_attestation_cert), (sa.root_key, fp.debug_file_signer_root_key), (sa.attestation_ca_key, fp.debug_file_signer_attestation_ca_key), (sa.attestation_key, fp.debug_file_signer_attestation_key), (sa.signature, fp.debug_file_signer_signature), (sa.cert_chain, fp.debug_file_signer_cert_chain) ] for data, debug_file in debug_logs: try: store_data_to_file(debug_file, data) except Exception: logger.debug2('Failed to save debug file ' + debug_file + '\n' ' ' + str(sys.exc_info()[1]))
class SecImageCore(object): """Provides interface for user to set up parameters (including input files, output directory, etc) and perform various operations (signing, encryption). User can select the config file using: - :meth:`chipset` - :meth:`config_path` User can specify images for processing using: - :meth:`set_image_path` - :meth:`set_meta_build_path` User can specify output using: - :meth:`output_dir` - :meth:`mini_build_path` User can finally perform the following operations: - :meth:`verify_inputs` - :meth:`sign` - :meth:`encrypt` - :meth:`validate` User can also perform multiple operations using :meth:`process` :param str config_dir: Path to the directory containing the config files for the supported chipsets. :param bool debug: If all the underlying modules should work in debug mode (save debug logs, etc). .. data:: debug (bool) Is debug mode enabled. The debug logs will be stored in :meth:`output_dir` """ def __init__(self, config_dir=defines.DEFAULT_CONFIG_DIR, debug=False): # Initialize the internal properties self._config_dir_obj = ConfigDir(config_dir) self._img_config_parser = None self._stager = None # Initialize the public properties self.debug = debug @property def config_dir(self): """(str) Path to the config directory provided in params. The config_dir path cannot be set directly. """ return self._config_dir_obj.config_dir @config_dir.setter def config_dir(self, config_dir): raise RuntimeError('Config dir cannot be set.') @property def available_chipsets(self): """(list[str]) A list of chipsets for which config files are available in the :meth:`config_dir`. The list of available chipsets cannot be set directly. """ return self._config_dir_obj.chipsets @available_chipsets.setter def available_chipsets(self, chipset_list): raise RuntimeError('Available chipsets cannot be set.') @property def chipset(self): """(str) Chipset that is selected for the current run. The chipset selection will update the :meth:`config_path` """ if self._img_config_parser is not None: return self._img_config_parser.chipset else: raise RuntimeError('Chipset/Config Path is not set.') @chipset.setter def chipset(self, chipset): # Log if the chipset is changed try: selected_chipset = self.chipset if selected_chipset: logger.note('Switching chipset from "' + selected_chipset + '" to "' + chipset + '"') except Exception: pass # Update the config path based on the given chipset config_path = self._config_dir_obj.get_chipset_config_path(chipset) if config_path is None: raise RuntimeError('Config file is not found for chipset: ' + str(chipset)) self.config_path = config_path logger.info('Chipset is set to: ' + chipset) @property def config_path(self): """(str) Config path that is selected for the current run. The config_path selection will update the :meth:`chipset` """ if self._img_config_parser is not None: return self._img_config_parser.config_path else: raise RuntimeError('Chipset/Config Path is not set.') @config_path.setter def config_path(self, config_path): # Log if the config_path is changed try: selected_config_path = self.config_path if selected_config_path: logger.note('Switching config_path: ' + '\n' ' ' + 'from: ' + selected_config_path + '\n' ' ' + ' to: ' + config_path) except Exception: pass # Update the config_path self._img_config_parser = ConfigParser(config_path) logger.info('Config path is set to: ' + config_path) # Reset the stager at this point if self._stager is not None: logger.note('Resetting image list due to config path change.') self._stager = None @property def available_sign_ids(self): """(list[str]) A list of sign_ids available from the selected :meth:`config_path`/:meth:`chipset`. """ if self._img_config_parser is not None: return self._img_config_parser.sign_id_list else: raise RuntimeError('Set chipset or config Path before querying the available sign ids.') @available_sign_ids.setter def available_sign_ids(self, chipset_list): raise RuntimeError('Available sign ids cannot be set.') def set_image_path(self, image_path, sign_id): """Sets the image that will be processed. :param str image_path: Path to the image to be processed :param str sign_id: sign_id corresponding to the image_path. This must be one of the :meth:`available_sign_ids` """ if self._img_config_parser is not None: self._stager = stager.ImagePathsStager(image_path, self._img_config_parser, sign_id) else: raise RuntimeError('Set chipset or config Path before setting the image path.') def set_meta_build_path(self, meta_build_path, sign_id_list=[]): """Sets the meta build path from which the images to be processed will be queried. :param str meta_build_path: Path to the meta build. """ if self.meta_supports_sign_id(meta_build_path): self._stager = stager.MetaBuildStager(meta_build_path, self._config_dir_obj, sign_id_list) else: self._stager = stager.MetaBuildTmpStager(meta_build_path, self._config_dir_obj, self._img_config_parser, sign_id_list) @property def image_path_list(self): """(list[str]) List of source image paths that are being operated on. This is updated once one of :meth:`set_image_path`, :meth:`set_meta_build_path` is used to specify the images to be processed. """ if self._stager is not None: return self._stager.image_path_list else: raise RuntimeError('Image list is not set. ' 'Set one of image_path or meta_build_path.') @image_path_list.setter def image_path_list(self, image_path_list): raise RuntimeError('Image path list cannot be set directly. ' 'Use set_image_path or set_meta_build to set the image paths.') @property def image_info_list(self): """(list[ImageInfo]) A list of :class:`imageinfo.ImageInfo` objects that are being operated on. """ if self._stager is not None: return self._stager.image_info_list else: raise RuntimeError('Image Info list is not set. ' 'Set one of image_path or meta_build_path.') @image_info_list.setter def image_info_list(self, image_info_list): raise RuntimeError('Image Info list cannot be set directly.') @property def output_dir(self): """(str) Path to the output directory to use for saving the logs, output files. """ if self._stager is not None: return self._stager.output_dir else: raise RuntimeError('Image list is not set. ' 'Set one of image_path or meta_build_path. ' 'Then retry setting output directory.') @output_dir.setter def output_dir(self, output_dir): # Log if the output_dir is changed try: selected_output_dir = self.output_dir if selected_output_dir: logger.note('Switching output_dir: ' + '\n' ' ' + 'from: ' + selected_output_dir + '\n' ' ' + ' to: ' + output_dir) except Exception: pass # Update the output_dir self._stager.output_dir = output_dir logger.info('Output dir is set to: ' + output_dir) # Clear the minimized build setting try: self._stager.mini_build_path = '' except Exception: pass @property def mini_build_path(self): """(str) Path to the minimized build directory to use for saving the logs, output files. """ if self._stager is not None: return self._stager.mini_build_path else: raise RuntimeError('Image list is not set. ' 'Set one of image_path or meta_build_path. ' 'Then retry querying/setting minimized build.') @mini_build_path.setter def mini_build_path(self, mini_build_path): # Log if the mini_build_path is changed selected_mini_build_path = self.mini_build_path if selected_mini_build_path: logger.note('Switching mini_build_path: ' + '\n' ' ' + 'from: ' + selected_mini_build_path + '\n' ' ' + ' to: ' + mini_build_path) # Update the mini_build_path self._stager.mini_build_path = mini_build_path logger.info('Minimized Build is set to: ' + mini_build_path) # Clear the output dir setting try: self._stager.output_dir = '' except Exception: pass @classmethod def meta_supports_sign_id(self, meta_build_path): return stager.meta_build_stager.MetaBuildStager.meta_supports_sign_id(meta_build_path) def process(self, verify_setup=False, integrity_check=False, sign=False, encrypt=False, decrypt=False, val_image=False, val_integrity_check=False, val_sign=False, val_encrypt=False, progress_cb=PROGRESS_CB_PYPASS): """Performs the secure-image related operations specified from the params. :param bool verify_setup: Verify that the configuration of the object is correct and return. This will ignore any other params. :param bool integrity_check: Add integrity check to the image. :param bool sign: Sign the images. (Re-sign if image is already signed) :param bool encrypt: Encrypt the images. (Re-encrypt if image is already encrypted) :param bool val_image: Validate the integrity of the image against the config file. :param bool val_integrity_check: Validate the integrity check in the image. :param bool val_sign: Validate that the image is signed and validate the integrity of the signing related data. :param bool val_encrypt: Validate that the image is encrypted and validate the integrity of the encryption related data. :param cb progress_cb: Callback method to get a status update during processing. Callback method should have this format: :: def progress_cb(status_string, progress_percent): \""" :param str status_string: the current status. :param int progress_percent: the progress (in percent) \""" ... """ # Ensure that one or more image files is provided for processing if self._stager is None or not self.image_path_list: raise RuntimeError('Please specify one or more images for processing') # Ensure the correct set of operations is provided if not (verify_setup or integrity_check or sign or encrypt or decrypt or val_image or val_integrity_check or val_sign or val_encrypt): raise RuntimeError('Please specify one or more operations to perform.') if verify_setup: logger.note('The inputs provided (config, cmd args) are valid.') return # Start processing images total_images = len(self.image_info_list) progress = ProgressNotifier(total_images, progress_cb, PROGRESS_TOTAL_STAGES) for idx, image in enumerate(self.image_info_list): assert isinstance(image, ImageInfo) logger.info('------------------------------------------------------') status_string = ('Processing ' + str(idx + 1) + '/' + str(total_images) + ': ' + image.image_under_operation) logger.info(status_string + '\n') # Send a progress notification to the toplevel progress.status = status_string progress.cur = idx progress.cur_stage = 0 file_logger_id = None try: # Create the required directory structure for this image image_output_dir = image.dest_image.image_dir try: c_path.create_dir(image_output_dir) except Exception as e: raise RuntimeError('Could not create output directory: ' + image_output_dir + '\n' ' ' + 'Error: ' + str(e)) # Enable/Disable debug image.dest_image.debug_enable = self.debug c_path.create_debug_dir(image.dest_image.debug_dir) # Enable file logging to the directory file_logger_id = logger.add_file_logger(c_path.join(image_output_dir, 'SecImage_log.txt'), logger.verbosity) # For secure operations if integrity_check or sign or encrypt or decrypt: self._process_secure_operation(image, progress, integrity_check, sign, encrypt, decrypt) # For validation if val_image or val_integrity_check or val_sign or val_encrypt: self._process_validation(image, progress, val_image, val_integrity_check, val_sign, val_encrypt) # Set overall processing to true if not ((val_image and image.status.validate_parsegen.state == StatusInfo.ERROR) or (val_integrity_check and image.status.validate_integrity_check.state == StatusInfo.ERROR) or (val_sign and image.status.validate_sign.state == StatusInfo.ERROR) or (val_encrypt and image.status.validate_encrypt.state == StatusInfo.ERROR)): image.status.overall.state = StatusInfo.SUCCESS except Exception: logger.debug(traceback.format_exc()) logger.error(sys.exc_info()[1]) if file_logger_id is not None: logger.removeFileLogger(file_logger_id) logger.info('------------------------------------------------------\n') progress.complete() def _process_secure_operation(self, image, progress, integrity_check, sign, encrypt, decrypt): # Create the encryptor object encdec = None if encrypt or decrypt: c_path.create_debug_dir(image.dest_image.debug_dir_encdec) encdec = get_encdec(image) # Create the parsegen object image.encdec = encdec parsegen = self._status_updater(self._create_parsegen_obj, image.status.parsegen, progress, True, image) # Set the security mechanisms parsegen.integrity_check = parsegen.contains_integrity_check() or integrity_check parsegen.sign = parsegen.is_signed() or sign parsegen.encrypt = parsegen.is_encrypted() or encrypt # If encrypt: if encrypt: parsegen.encryption_params = encdec.get_encryption_parameters_blob() # Dump any debug data self.dump_parsegen_debug_data(image, parsegen) # Sign the image if sign: self._status_updater(self._sign_image, image.status.sign, progress, True, image, parsegen) # Package and generate the output image file if integrity_check or sign or encrypt: store_data_to_file(image.dest_image.image_path, parsegen.get_data()) if integrity_check: image.status.integrity_check.state = StatusInfo.SUCCESS if encrypt: image.status.encrypt.state = StatusInfo.SUCCESS logger.info(('Signed ' if sign else '') + ('& ' if sign and encrypt else '') + ('Encrypted ' if encrypt else '') + 'image is stored at ' + image.dest_image.image_path) image.image_under_operation = image.dest_image.image_path # Do any post processing self._status_updater(self._post_process, image.status.postprocess, progress, True, image, image.config.post_process.pil_splitter, getattr(self._stager, '_meta_build_path', None)) # Print the image data logger.info('\n' + str(parsegen)) # Decrypt the image if decrypt: store_data_to_file(image.dest_image.decrypted_file, parsegen.get_data(encrypt=False)) def _process_validation(self, image, progress, val_image, val_integrity_check, val_sign, val_encrypt): # TODO: Need to figure how to do this #image.dest_image._mid = 'validation' # Backup the source path here src_image_dir_base = image.src_image.image_dir_base src_image_dir_ext = image.src_image.image_dir_ext src_image_name = image.src_image.image_name image.src_image.image_dir_base = os.path.dirname(image.image_under_operation) image.src_image.image_dir_ext = '' image.src_image.image_name = os.path.basename(image.image_under_operation) try: # Create the encryptor object encdec = None if val_encrypt: try: c_path.create_debug_dir(image.dest_image.debug_dir_encdec) encdec = get_encdec(image) except Exception: pass # Create the parsegen object image.encdec = encdec parsegen = self._status_updater(self._create_parsegen_obj, image.status.validate_parsegen, progress, True, image) # Set the security mechanisms parsegen.integrity_check = parsegen.contains_integrity_check() parsegen.sign = parsegen.is_signed() parsegen.encrypt = parsegen.is_encrypted() # Dump any debug data self.dump_parsegen_debug_data(image, parsegen) # Validate parsegen if val_image: self._status_updater(self._validate_parsegen, image.status.validate_parsegen, progress, False, image, parsegen) # Validate integrity check if val_integrity_check: self._status_updater(self._validate_integrity_check, image.status.validate_integrity_check, progress, False, image, parsegen) # Validate sign if val_sign: self._status_updater(self._validate_sign, image.status.validate_sign, progress, False, image, parsegen) # Validate encrypt if val_encrypt: self._status_updater(self._validate_encrypt, image.status.validate_encrypt, progress, False, image, parsegen) except Exception: image.src_image.image_dir_base = src_image_dir_base image.src_image.image_dir_ext = src_image_dir_ext image.src_image.image_name = src_image_name raise else: image.src_image.image_dir_base = src_image_dir_base image.src_image.image_dir_ext = src_image_dir_ext image.src_image.image_name = src_image_name def _create_parsegen_obj(self, image): c_path.create_debug_dir(image.dest_image.debug_dir_parsegen) from sectools.features.isc.parsegen import get_parser parsegen = get_parser(image) return parsegen def _sign_image(self, image, parsegen): logger.info('Resigning signed' if parsegen.is_signed() else 'Signing' ' image: ' + image.image_under_operation) c_path.create_debug_dir(image.dest_image.debug_dir_signer) signer = Signer(image.config) sign_assets = signer.sign(parsegen.data_to_sign, image) # Dump any debug information self.dump_signer_debug_data(image, sign_assets) parsegen.data_signature = sign_assets.signature parsegen.cert_chain = sign_assets.cert_chain def _post_process(self, image, pil_splitter_path, meta_build_path): ''' Replacement tags in postsign commands for images. ''' TAG_OUTPUT_DIR = '$(OUTPUT_DIR)' TAG_PIL_SPLITTER = '$(PIL_SPLITTER)' TAG_IMAGE_FILE = '$(IMAGE_FILE)' REPL_META_PATH = '$(META_BUILD)' if image.post_process_commands: # Ensure pil splitter is available if pil_splitter_path.find(REPL_META_PATH) != -1: if not meta_build_path: raise RuntimeError('Metabuild path is not available for pil splitter') pil_splitter_path = pil_splitter_path.replace(REPL_META_PATH, meta_build_path) if not c_path.validate_file(pil_splitter_path): raise RuntimeError('Cannot access pil splitter at: ' + pil_splitter_path) # Run all the commands for cmd in [c.strip() for c in image.post_process_commands.split()]: # Perform any needed replacements cmd = cmd.replace(TAG_OUTPUT_DIR, os.path.dirname(image.image_under_operation)) cmd = cmd.replace(TAG_PIL_SPLITTER, pil_splitter_path) cmd = cmd.replace(TAG_IMAGE_FILE, image.image_under_operation) logger.info('Running postsign command: ' + cmd) err = os.system(cmd) logger.info('Result: ' + str(err)) def _validate_parsegen(self, image, parsegen): pass def _validate_integrity_check(self, image, parsegen): pass def _validate_sign(self, image, parsegen): if parsegen.is_signed(): signer = Signer(image.config) if signer.validate(parsegen): logger.info('Image ' + image.image_under_operation + ' signature is valid') else: raise RuntimeError('Image ' + image.image_under_operation + ' signature is not valid') else: raise RuntimeError('Image ' + image.image_under_operation + ' is not signed') def _validate_encrypt(self, image, parsegen): if parsegen.is_encrypted(): logger.info('Image ' + image.image_under_operation + ' is encrypted') else: raise RuntimeError('Image ' + image.image_under_operation + ' is not encrypted') def _status_updater(self, method, status, progress, raise_err, *args, **kwargs): try: retval = method(*args, **kwargs) status.state = StatusInfo.SUCCESS progress.push() return retval except Exception as e: status.state = StatusInfo.ERROR status.error = str(e) progress.push() if raise_err: raise else: logger.error(status.error) def dump_parsegen_debug_data(self, image, parsegen): if image.dest_image.debug_dir_parsegen is None: return so = parsegen fp = image.dest_image from imageinfo import DestImagePath assert isinstance(fp, DestImagePath) debug_logs = [] try: debug_logs.append((so.get_data(False, False, False), fp.debug_file_parsegen_unsigned)) except Exception: pass try: debug_logs.append((so.data_to_sign, fp.debug_file_parsegen_tosign)) except Exception: pass try: debug_logs.append((so.cert_chain, fp.debug_file_parsegen_cert_chain)) except Exception: pass try: debug_logs.append((so.data_signature, fp.debug_file_parsegen_signature)) except Exception: pass try: debug_logs.append((so.get_data(True, False, False), fp.debug_file_parsegen_integrity_check)) except Exception: pass try: debug_logs.append((so.get_data(True, True, False), fp.debug_file_parsegen_signed)) except Exception: pass try: debug_logs.append((so.get_data(True, True, True), fp.debug_file_parsegen_encrypted)) except Exception: pass for data, debug_file in debug_logs: try: store_data_to_file(debug_file, data) except Exception: logger.debug2('Failed to save debug file ' + debug_file + '\n' ' ' + str(sys.exc_info()[1])) def dump_signer_debug_data(self, image, sign_assets): if image.dest_image.debug_dir_signer is None: return sa = sign_assets fp = image.dest_image from imageinfo import DestImagePath assert isinstance(fp, DestImagePath) debug_logs = [(sa.root_cert, fp.debug_file_signer_root_cert), (sa.attestation_ca_cert, fp.debug_file_signer_attestation_ca_cert), (sa.attestation_cert, fp.debug_file_signer_attestation_cert), (sa.attestation_key, fp.debug_file_signer_attestation_key), (sa.signature, fp.debug_file_signer_signature), (sa.cert_chain, fp.debug_file_signer_cert_chain)] for data, debug_file in debug_logs: try: store_data_to_file(debug_file, data) except Exception: logger.debug2('Failed to save debug file ' + debug_file + '\n' ' ' + str(sys.exc_info()[1]))
class SecImageCore(object): """Provides interface for user to set up parameters (including input files, output directory, etc) and perform various operations (signing, encryption). User can select the config file using: - :meth:`chipset` - :meth:`config_path` User can specify images for processing using: - :meth:`set_image_path` - :meth:`set_meta_build_path` User can specify output using: - :meth:`output_dir` - :meth:`mini_build_path` User can finally perform the following operations: - :meth:`verify_inputs` - :meth:`sign` - :meth:`encrypt` - :meth:`validate` User can also perform multiple operations using :meth:`process` :param str config_dir: Path to the directory containing the config files for the supported chipsets. :param bool debug: If all the underlying modules should work in debug mode (save debug logs, etc). .. data:: debug (bool) Is debug mode enabled. The debug logs will be stored in :meth:`output_dir` """ def __init__(self, config_dir=defines.DEFAULT_CONFIG_DIR, debug=False): # Initialize the internal properties self._config_dir_obj = ConfigDir(config_dir) self._img_config_parser = None self._stager = None # Initialize the public properties self.debug = debug @property def config_dir(self): """(str) Path to the config directory provided in params. The config_dir path cannot be set directly. """ return self._config_dir_obj.config_dir @config_dir.setter def config_dir(self, config_dir): raise RuntimeError('Config dir cannot be set.') @property def available_chipsets(self): """(list[str]) A list of chipsets for which config files are available in the :meth:`config_dir`. The list of available chipsets cannot be set directly. """ return self._config_dir_obj.chipsets @available_chipsets.setter def available_chipsets(self, chipset_list): raise RuntimeError('Available chipsets cannot be set.') @property def chipset(self): """(str) Chipset that is selected for the current run. The chipset selection will update the :meth:`config_path` """ if self._img_config_parser is not None: return self._img_config_parser.chipset else: raise RuntimeError('Chipset/Config Path is not set.') @chipset.setter def chipset(self, chipset): # Log if the chipset is changed try: selected_chipset = self.chipset if selected_chipset: logger.note('Switching chipset from "' + selected_chipset + '" to "' + chipset + '"') except Exception: pass # Update the config path based on the given chipset config_path = self._config_dir_obj.get_chipset_config_path(chipset) if config_path is None: raise RuntimeError('Config file is not found for chipset: ' + str(chipset)) self.config_path = config_path logger.info('Chipset is set to: ' + chipset) @property def config_path(self): """(str) Config path that is selected for the current run. The config_path selection will update the :meth:`chipset` """ if self._img_config_parser is not None: return self._img_config_parser.config_path else: raise RuntimeError('Chipset/Config Path is not set.') @config_path.setter def config_path(self, config_path): # Log if the config_path is changed try: selected_config_path = self.config_path if selected_config_path: logger.note('Switching config_path: ' + '\n' ' ' + 'from: ' + selected_config_path + '\n' ' ' + ' to: ' + config_path) except Exception: pass # Update the config_path self._img_config_parser = ConfigParser(config_path) logger.info('Config path is set to: ' + config_path) # Reset the stager at this point if self._stager is not None: logger.note('Resetting image list due to config path change.') self._stager = None @property def available_sign_ids(self): """(list[str]) A list of sign_ids available from the selected :meth:`config_path`/:meth:`chipset`. """ if self._img_config_parser is not None: return self._img_config_parser.sign_id_list else: raise RuntimeError('Set chipset or config Path before querying the available sign ids.') @available_sign_ids.setter def available_sign_ids(self, chipset_list): raise RuntimeError('Available sign ids cannot be set.') def set_image_path(self, image_path, sign_id): """Sets the image that will be processed. :param str image_path: Path to the image to be processed :param str sign_id: sign_id corresponding to the image_path. This must be one of the :meth:`available_sign_ids` """ if self._img_config_parser is not None: self._stager = stager.ImagePathsStager(image_path, self._img_config_parser, sign_id) else: raise RuntimeError('Set chipset or config Path before setting the image path.') def set_meta_build_path(self, meta_build_path, sign_id_list=[]): """Sets the meta build path from which the images to be processed will be queried. :param str meta_build_path: Path to the meta build. """ if self.meta_supports_sign_id(meta_build_path): self._stager = stager.MetaBuildStager(meta_build_path, self._config_dir_obj, sign_id_list) else: self._stager = stager.MetaBuildTmpStager(meta_build_path, self._config_dir_obj, self._img_config_parser, sign_id_list) @property def image_path_list(self): """(list[str]) List of source image paths that are being operated on. This is updated once one of :meth:`set_image_path`, :meth:`set_meta_build_path` is used to specify the images to be processed. """ if self._stager is not None: return self._stager.image_path_list else: raise RuntimeError('Image list is not set. ' 'Set one of image_path or meta_build_path.') @image_path_list.setter def image_path_list(self, image_path_list): raise RuntimeError('Image path list cannot be set directly. ' 'Use set_image_path or set_meta_build to set the image paths.') @property def image_info_list(self): """(list[ImageInfo]) A list of :class:`imageinfo.ImageInfo` objects that are being operated on. """ if self._stager is not None: return self._stager.image_info_list else: raise RuntimeError('Image Info list is not set. ' 'Set one of image_path or meta_build_path.') @image_info_list.setter def image_info_list(self, image_info_list): raise RuntimeError('Image Info list cannot be set directly.') @property def output_dir(self): """(str) Path to the output directory to use for saving the logs, output files. """ if self._stager is not None: return self._stager.output_dir else: raise RuntimeError('Image list is not set. ' 'Set one of image_path or meta_build_path. ' 'Then retry setting output directory.') @output_dir.setter def output_dir(self, output_dir): # Log if the output_dir is changed try: selected_output_dir = self.output_dir if selected_output_dir: logger.note('Switching output_dir: ' + '\n' ' ' + 'from: ' + selected_output_dir + '\n' ' ' + ' to: ' + output_dir) except Exception: pass # Update the output_dir self._stager.output_dir = output_dir logger.info('Output dir is set to: ' + output_dir) # Clear the minimized build setting try: self._stager.mini_build_path = '' except Exception: pass @property def mini_build_path(self): """(str) Path to the minimized build directory to use for saving the logs, output files. """ if self._stager is not None: return self._stager.mini_build_path else: raise RuntimeError('Image list is not set. ' 'Set one of image_path or meta_build_path. ' 'Then retry querying/setting minimized build.') @mini_build_path.setter def mini_build_path(self, mini_build_path): # Log if the mini_build_path is changed selected_mini_build_path = self.mini_build_path if selected_mini_build_path: logger.note('Switching mini_build_path: ' + '\n' ' ' + 'from: ' + selected_mini_build_path + '\n' ' ' + ' to: ' + mini_build_path) # Update the mini_build_path self._stager.mini_build_path = mini_build_path logger.info('Minimized Build is set to: ' + mini_build_path) # Clear the output dir setting try: self._stager.output_dir = '' except Exception: pass @classmethod def meta_supports_sign_id(self, meta_build_path): return stager.meta_build_stager.MetaBuildStager.meta_supports_sign_id(meta_build_path) def process(self, verify_setup=False, integrity_check=False, sign=False, encrypt=False, decrypt=False, val_image=False, val_integrity_check=False, val_sign=False, val_encrypt=False, progress_cb=PROGRESS_CB_PYPASS): """Performs the secure-image related operations specified from the params. :param bool verify_setup: Verify that the configuration of the object is correct and return. This will ignore any other params. :param bool integrity_check: Add integrity check to the image. :param bool sign: Sign the images. (Re-sign if image is already signed) :param bool encrypt: Encrypt the images. (Re-encrypt if image is already encrypted) :param bool val_image: Validate the integrity of the image against the config file. :param bool val_integrity_check: Validate the integrity check in the image. :param bool val_sign: Validate that the image is signed and validate the integrity of the signing related data. :param bool val_encrypt: Validate that the image is encrypted and validate the integrity of the encryption related data. :param cb progress_cb: Callback method to get a status update during processing. Callback method should have this format: :: def progress_cb(status_string, progress_percent): \""" :param str status_string: the current status. :param int progress_percent: the progress (in percent) \""" ... """ # Ensure that one or more image files is provided for processing if self._stager is None or not self.image_path_list: raise RuntimeError('Please specify one or more images for processing') # Ensure the correct set of operations is provided if not (verify_setup or integrity_check or sign or encrypt or decrypt or val_image or val_integrity_check or val_sign or val_encrypt): raise RuntimeError('Please specify one or more operations to perform.') if verify_setup: logger.note('The inputs provided (config, cmd args) are valid.') return # Start processing images total_images = len(self.image_info_list) progress = ProgressNotifier(total_images, progress_cb, PROGRESS_TOTAL_STAGES) for idx, image in enumerate(self.image_info_list): assert isinstance(image, ImageInfo) logger.info('------------------------------------------------------') status_string = ('Processing ' + str(idx + 1) + '/' + str(total_images) + ': ' + image.image_under_operation) logger.info(status_string + '\n') # Send a progress notification to the toplevel progress.status = status_string progress.cur = idx progress.cur_stage = 0 file_logger_id = None try: # Create the required directory structure for this image image_output_dir = image.dest_image.image_dir try: c_path.create_dir(image_output_dir) except Exception as e: raise RuntimeError('Could not create output directory: ' + image_output_dir + '\n' ' ' + 'Error: ' + str(e)) # Enable/Disable debug image.dest_image.debug_enable = self.debug c_path.create_debug_dir(image.dest_image.debug_dir) # Enable file logging to the directory file_logger_id = logger.add_file_logger(c_path.join(image_output_dir, 'SecImage_log.txt'), logger.verbosity) # Create the security policies list for this image security_policy_list = create_security_policy_list(image) # Parsegen object parsegen = None # For secure operations if integrity_check or sign or encrypt or decrypt: parsegen = self._process_secure_operation(image, progress, security_policy_list, integrity_check, sign, encrypt, decrypt) # For validation if val_image or val_integrity_check or val_sign or val_encrypt: parsegen = self._process_validation(image, progress, security_policy_list, val_image, val_integrity_check, val_sign, val_encrypt) # Print the image data if parsegen is not None: logger.info('\n' + str(parsegen)) # Set overall processing to true if not ((val_image and image.status.validate_parsegen.state == StatusInfo.ERROR) or (val_integrity_check and image.status.validate_integrity_check.state == StatusInfo.ERROR) or (val_sign and image.status.validate_sign.state == StatusInfo.ERROR) or (val_encrypt and image.status.validate_encrypt.state == StatusInfo.ERROR)): image.status.overall.state = StatusInfo.SUCCESS except Exception: logger.debug(traceback.format_exc()) logger.error(sys.exc_info()[1]) if file_logger_id is not None: logger.removeFileLogger(file_logger_id) logger.info('------------------------------------------------------\n') progress.complete() def _process_secure_operation(self, image, progress, security_policy_list, i_integrity_check, i_sign, i_encrypt, i_decrypt, idx=0): # Check bounds if len(security_policy_list) == 0: raise RuntimeError('Security policy list must not be empty.') elif len(security_policy_list) <= idx: raise RuntimeError('Security policy list length must be more than index.') # Get the current security policy file_type = security_policy_list[idx].file_type integrity_check = security_policy_list[idx].integrity_check and i_integrity_check sign = security_policy_list[idx].sign and i_sign encrypt = security_policy_list[idx].encrypt and i_encrypt decrypt = security_policy_list[idx].encrypt and i_decrypt # Create the encryptor object encdec = None if encrypt or decrypt: c_path.create_debug_dir(image.dest_image.debug_dir_encdec) encdec = get_encdec(image) # Create the parsegen object file_type_backup = image.image_type.file_type encdec_backup = image.encdec image.image_type.file_type = file_type image.encdec = encdec try: parsegen = self._status_updater(self._create_parsegen_obj, image.status.parsegen, progress, True, image) finally: image.image_type.file_type = file_type_backup image.encdec = encdec_backup # Do not allow signed unencrypted elf images to be encrypted as the # Sign will not longer match the encrypted image's tosign if parsegen.file_type() == 'elf' and parsegen.is_signed() and not sign and not parsegen.is_encrypted() and encrypt: raise RuntimeError('Cannot encrypt a signed unencrypted image without resigning ' 'as the sign no longer matches the format change.') # Set the security mechanisms parsegen.integrity_check = security_policy_list[idx].integrity_check and (parsegen.contains_integrity_check() or integrity_check) parsegen.sign = security_policy_list[idx].sign and (parsegen.is_signed() or sign) parsegen.encrypt = security_policy_list[idx].encrypt and (False if decrypt else (parsegen.is_encrypted() or encrypt)) # If encrypt: if encrypt: parsegen.encryption_params = encdec.get_encryption_parameters_blob() # Dump any debug data self.dump_parsegen_debug_data(image, parsegen) # If the security policy list contains more formats, call them if idx < len(security_policy_list) - 1: data = parsegen.get_wrapped_data() import tempfile tmp_fd = tempfile.NamedTemporaryFile(delete=False) tmp_fd.close() store_data_to_file(tmp_fd.name, data) # Backup the source path here src_image_dir_base = image.src_image.image_dir_base src_image_dir_ext = image.src_image.image_dir_ext src_image_name = image.src_image.image_name image.src_image.image_dir_base = os.path.dirname(tmp_fd.name) image.src_image.image_dir_ext = '' image.src_image.image_name = os.path.basename(tmp_fd.name) try: data = self._process_secure_operation(image, progress, security_policy_list, i_integrity_check, i_sign, i_encrypt, i_decrypt, idx + 1) finally: image.src_image.image_dir_base = src_image_dir_base image.src_image.image_dir_ext = src_image_dir_ext image.src_image.image_name = src_image_name os.remove(tmp_fd.name) parsegen.set_wrapped_data(data) # Sign the image if sign: self._status_updater(self._sign_image, image.status.sign, progress, True, image, parsegen) # Package and generate the output image file data = parsegen.get_data() if integrity_check: image.status.integrity_check.state = StatusInfo.SUCCESS if encrypt: image.status.encrypt.state = StatusInfo.SUCCESS if idx != 0: return data if decrypt: store_data_to_file(image.dest_image.decrypted_file, data) else: store_data_to_file(image.dest_image.image_path, data) logger.info(('Signed ' if sign else '') + ('& ' if sign and encrypt else '') + ('Encrypted ' if encrypt else '') + 'image is stored at ' + image.dest_image.image_path) image.image_under_operation = image.dest_image.image_path # Do any post processing self._status_updater(self._post_process, image.status.postprocess, progress, True, image, image.config.post_process.pil_splitter, getattr(self._stager, '_meta_build_path', None)) return parsegen def _process_validation(self, image, progress, security_policy_list, i_val_image, i_val_integrity_check, i_val_sign, i_val_encrypt, idx=0): # TODO: Need to figure how to do this #image.dest_image._mid = 'validation' # Check bounds if len(security_policy_list) == 0: raise RuntimeError('Security policy list must not be empty.') elif len(security_policy_list) <= idx: raise RuntimeError('Security policy list length must be more than index.') # Get the current security policy file_type = security_policy_list[idx].file_type val_image = i_val_image val_integrity_check = security_policy_list[idx].integrity_check and i_val_integrity_check val_sign = security_policy_list[idx].sign and i_val_sign val_encrypt = security_policy_list[idx].encrypt and i_val_encrypt # Backup the source path here src_image_dir_base = image.src_image.image_dir_base src_image_dir_ext = image.src_image.image_dir_ext src_image_name = image.src_image.image_name # Update the souce image path image.src_image.image_dir_base = os.path.dirname(image.image_under_operation) image.src_image.image_dir_ext = '' image.src_image.image_name = os.path.basename(image.image_under_operation) try: # Create the encryptor object encdec = None if val_encrypt: c_path.create_debug_dir(image.dest_image.debug_dir_encdec) encdec = get_encdec(image) # Create the parsegen object file_type_backup = image.image_type.file_type encdec_backup = image.encdec image.image_type.file_type = file_type image.encdec = encdec try: parsegen = self._status_updater(self._create_parsegen_obj, image.status.validate_parsegen, progress, True, image) finally: image.image_type.file_type = file_type_backup image.encdec = encdec_backup # Set the security mechanisms parsegen.integrity_check = parsegen.contains_integrity_check() parsegen.sign = parsegen.is_signed() parsegen.encrypt = parsegen.is_encrypted() # Dump any debug data self.dump_parsegen_debug_data(image, parsegen) # Validate parsegen if val_image: self._status_updater(self._validate_parsegen, image.status.validate_parsegen, progress, False, image, parsegen) # Validate integrity check if val_integrity_check: self._status_updater(self._validate_integrity_check, image.status.validate_integrity_check, progress, False, image, parsegen) # Validate sign if val_sign: self._status_updater(self._validate_sign, image.status.validate_sign, progress, False, image, parsegen) # Validate encrypt if val_encrypt: self._status_updater(self._validate_encrypt, image.status.validate_encrypt, progress, False, image, parsegen) # If the security policy list contains more formats, call them if idx < len(security_policy_list) - 1: data = parsegen.get_wrapped_data() import tempfile tmp_fd = tempfile.NamedTemporaryFile(delete=False) tmp_fd.close() store_data_to_file(tmp_fd.name, data) # Backup the image_under_operation here image_under_operation_int = image.image_under_operation image.image_under_operation = tmp_fd.name try: self._process_validation(image, progress, security_policy_list, i_val_image, i_val_integrity_check, i_val_sign, i_val_encrypt, idx + 1) finally: image.image_under_operation = image_under_operation_int os.remove(tmp_fd.name) finally: image.src_image.image_dir_base = src_image_dir_base image.src_image.image_dir_ext = src_image_dir_ext image.src_image.image_name = src_image_name return parsegen def _create_parsegen_obj(self, image): c_path.create_debug_dir(image.dest_image.debug_dir_parsegen) from sectools.features.isc.parsegen import get_parser parsegen = get_parser(image) return parsegen def _sign_image(self, image, parsegen): logger.info('Resigning signed' if parsegen.is_signed() else 'Signing' ' image: ' + image.image_under_operation) c_path.create_debug_dir(image.dest_image.debug_dir_signer) signer = Signer(image.config) # TODO: a sanity check here # data_to_sign = parsegen.data_to_sign # if data_to_sign != parsegen.data_to_sign: # raise RuntimeError('Data to sign is changing') sign_assets = signer.sign(parsegen.data_to_sign, image, image.dest_image.debug_dir_signer) # Dump any debug information self.dump_signer_debug_data(image, sign_assets) parsegen.data_signature = sign_assets.signature parsegen.cert_chain = sign_assets.cert_chain def _pil_split(self, src, prefix): from sectools.common.parsegen.elf.format import ParseGenElf, pack_phdrs, PF_OS_SEGMENT_HASH # Load the data p_obj = ParseGenElf(load_data_from_file(src)) # File names elfhdr = prefix + '.mdt' # Cleanup for eachpattern in [elfhdr, (prefix + '.b*')]: import glob for eachfile in glob.glob(eachpattern): try: os.remove(eachfile) except Exception: pass # Create the mdt data elfdata = p_obj.ehdr.pack() + pack_phdrs(p_obj.phdrs) # Dump the segments for idx, phdr in enumerate(p_obj.phdrs): path = prefix + ('.b%02d' % idx) store_data_to_file(path, p_obj.segments[phdr]) if phdr.f_os_segment_type == PF_OS_SEGMENT_HASH: elfdata += p_obj.segments[phdr] # Dump the final elfhdr mdt store_data_to_file(elfhdr, elfdata) def _post_process(self, image, pil_splitter_path, meta_build_path): ''' Replacement tags in postsign commands for images. ''' TAG_OUTPUT_DIR = '$(OUTPUT_DIR)' TAG_PIL_SPLITTER = '$(PIL_SPLITTER)' TAG_IMAGE_FILE = '$(IMAGE_FILE)' REPL_META_PATH = '$(META_BUILD)' if image.pil_split: image_file = image.image_under_operation self._pil_split(image_file, os.path.splitext(image_file)[0]) if image.post_process_commands: # Ensure pil splitter is available if pil_splitter_path.find(REPL_META_PATH) != -1: if not meta_build_path: raise RuntimeError('Metabuild path is not available for pil splitter') pil_splitter_path = pil_splitter_path.replace(REPL_META_PATH, meta_build_path) if not c_path.validate_file(pil_splitter_path): raise RuntimeError('Cannot access pil splitter at: ' + pil_splitter_path) # Run all the commands for cmd in [c.strip() for c in image.post_process_commands.split()]: # Perform any needed replacements cmd = cmd.replace(TAG_OUTPUT_DIR, os.path.dirname(image.image_under_operation)) cmd = cmd.replace(TAG_PIL_SPLITTER, pil_splitter_path) cmd = cmd.replace(TAG_IMAGE_FILE, image.image_under_operation) logger.info('Running postsign command: ' + cmd) err = os.system(cmd) logger.info('Result: ' + str(err)) def _validate_parsegen(self, image, parsegen): pass def _validate_integrity_check(self, image, parsegen): pass def _validate_sign(self, image, parsegen): if parsegen.is_signed(): signer = Signer(image.config) if signer.validate(parsegen): logger.info('Image ' + image.image_under_operation + ' signature is valid') else: raise RuntimeError('Image ' + image.image_under_operation + ' signature is not valid') else: raise RuntimeError('Image ' + image.image_under_operation + ' is not signed') def _validate_encrypt(self, image, parsegen): if parsegen.is_encrypted(): logger.info('Image ' + image.image_under_operation + ' is encrypted') else: raise RuntimeError('Image ' + image.image_under_operation + ' is not encrypted') def _status_updater(self, method, status, progress, raise_err, *args, **kwargs): try: retval = method(*args, **kwargs) status.state = StatusInfo.SUCCESS progress.push() return retval except Exception as e: status.state = StatusInfo.ERROR status.error = str(e) progress.push() if raise_err: raise else: logger.error(status.error) def dump_parsegen_debug_data(self, image, parsegen): if image.dest_image.debug_dir_parsegen is None: return so = parsegen fp = image.dest_image from imageinfo import DestImagePath assert isinstance(fp, DestImagePath) debug_logs = [] try: debug_logs.append((so.get_data(False, False, False), fp.debug_file_parsegen_unsigned)) except Exception: pass try: debug_logs.append((so.data_to_sign, fp.debug_file_parsegen_tosign)) except Exception: pass try: debug_logs.append((so.cert_chain, fp.debug_file_parsegen_cert_chain)) except Exception: pass try: debug_logs.append((so.data_signature, fp.debug_file_parsegen_signature)) except Exception: pass try: debug_logs.append((so.get_data(True, False, False), fp.debug_file_parsegen_integrity_check)) except Exception: pass try: debug_logs.append((so.get_data(True, True, False), fp.debug_file_parsegen_signed)) except Exception: pass try: debug_logs.append((so.get_data(True, True, True), fp.debug_file_parsegen_encrypted)) except Exception: pass for data, debug_file in debug_logs: try: store_data_to_file(debug_file, data) except Exception: logger.debug2('Failed to save debug file ' + debug_file + '\n' ' ' + str(sys.exc_info()[1])) def dump_signer_debug_data(self, image, sign_assets): if image.dest_image.debug_dir_signer is None: return sa = sign_assets fp = image.dest_image from imageinfo import DestImagePath assert isinstance(fp, DestImagePath) debug_logs = [(sa.root_cert, fp.debug_file_signer_root_cert), (sa.attestation_ca_cert, fp.debug_file_signer_attestation_ca_cert), (sa.attestation_cert, fp.debug_file_signer_attestation_cert), (sa.attestation_key, fp.debug_file_signer_attestation_key), (sa.signature, fp.debug_file_signer_signature), (sa.cert_chain, fp.debug_file_signer_cert_chain)] for data, debug_file in debug_logs: try: store_data_to_file(debug_file, data) except Exception: logger.debug2('Failed to save debug file ' + debug_file + '\n' ' ' + str(sys.exc_info()[1]))