kmwebnet/OpenSK
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' into fix-openssl

Browse Source
This commit is contained in:
Jean-Michel Picod
2020-02-20 16:32:46 +01:00
committed by GitHub
parent 6c363981c4 dfc0663324
commit 5d9383376b
3 changed files with 334 additions and 341 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.vscode/extensions.json vendored
View File

@@ -1,6 +1,7 @@
{ {
"recommendations": [ "recommendations": [
"davidanson.vscode-markdownlint", "davidanson.vscode-markdownlint",
"rust-lang.rust" "rust-lang.rust",
"ms-python.python"
] ]
} }

15
.vscode/settings.json vendored
View File

@@ -1,7 +1,20 @@
{ {
"editor.detectIndentation": true,
"editor.formatOnPaste": false,
"editor.formatOnSave": true, "editor.formatOnSave": true,
"editor.formatOnType": true,
"editor.insertSpaces": true,
"editor.tabSize": 4,
"rust-client.channel": "nightly", "rust-client.channel": "nightly",
// The toolchain is updated from time to time so let's make sure that RLS is updated too // The toolchain is updated from time to time so let's make sure that RLS is updated too
"rust-client.updateOnStartup": true, "rust-client.updateOnStartup": true,
"rust.clippy_preference": "on" "rust.clippy_preference": "on",
// Try to make VSCode formating as close as possible to the Google style.
"python.formatting.provider": "yapf",
"python.formatting.yapfArgs": [
"--style=chromium"
],
"[python]": {
"editor.tabSize": 2
},
} }

657
deploy.py
View File

@@ -27,7 +27,6 @@ import subprocess
import sys import sys
from tockloader import tab, tbfh, tockloader from tockloader import tab, tbfh, tockloader
# This structure allows us in the future to also support out-of-tree boards. # This structure allows us in the future to also support out-of-tree boards.
SUPPORTED_BOARDS = { SUPPORTED_BOARDS = {
"nrf52840_dk": "third_party/tock/boards/nordic/nrf52840dk", "nrf52840_dk": "third_party/tock/boards/nordic/nrf52840dk",
@@ -45,386 +44,366 @@ APP_HEAP_SIZE = 90000
def get_supported_boards(): def get_supported_boards():
boards = [] boards = []
for name, root in SUPPORTED_BOARDS.items(): for name, root in SUPPORTED_BOARDS.items():
if all((os.path.exists(os.path.join(root, "Cargo.toml")), if all((os.path.exists(os.path.join(root, "Cargo.toml")),
os.path.exists(os.path.join(root, "Makefile")))): os.path.exists(os.path.join(root, "Makefile")))):
boards.append(name) boards.append(name)
return tuple(set(boards)) return tuple(set(boards))
def fatal(msg): def fatal(msg):
print("{style_begin}fatal:{style_end} {message}".format( print("{style_begin}fatal:{style_end} {message}".format(
style_begin=colorama.Fore.RED + colorama.Style.BRIGHT, style_begin=colorama.Fore.RED + colorama.Style.BRIGHT,
style_end=colorama.Style.RESET_ALL, style_end=colorama.Style.RESET_ALL,
message=msg)) message=msg))
sys.exit(1) sys.exit(1)
def error(msg): def error(msg):
print("{style_begin}error:{style_end} {message}".format( print("{style_begin}error:{style_end} {message}".format(
style_begin=colorama.Fore.RED, style_begin=colorama.Fore.RED,
style_end=colorama.Style.RESET_ALL, style_end=colorama.Style.RESET_ALL,
message=msg)) message=msg))
def info(msg): def info(msg):
print("{style_begin}info:{style_end} {message}".format( print("{style_begin}info:{style_end} {message}".format(
style_begin=colorama.Fore.GREEN + colorama.Style.BRIGHT, style_begin=colorama.Fore.GREEN + colorama.Style.BRIGHT,
style_end=colorama.Style.RESET_ALL, style_end=colorama.Style.RESET_ALL,
message=msg)) message=msg))
class RemoveConstAction(argparse.Action): class RemoveConstAction(argparse.Action):
def __init__(self,
option_strings,
dest,
const,
default=None,
required=False,
help=None,
metavar=None):
super(RemoveConstAction, self).__init__(
option_strings=option_strings,
dest=dest,
nargs=0,
const=const,
default=default,
required=required,
help=help,
metavar=metavar)
def __call__(self, parser, namespace, values, option_string=None): def __init__(self,
# Code is simply a modified version of the AppendConstAction from argparse option_strings,
# https://github.com/python/cpython/blob/master/Lib/argparse.py#L138-L147 dest,
# https://github.com/python/cpython/blob/master/Lib/argparse.py#L1028-L1052 const,
items = getattr(namespace, self.dest, []) default=None,
if type(items) is list: required=False,
items = items[:] help=None,
else: metavar=None):
items = copy.copy(items) super(RemoveConstAction, self).__init__(
if self.const in items: option_strings=option_strings,
self.remove(self.const) dest=dest,
setattr(namespace, self.dest, items) nargs=0,
const=const,
default=default,
required=required,
help=help,
metavar=metavar)
def __call__(self, parser, namespace, values, option_string=None):
# Code is simply a modified version of the AppendConstAction from argparse
# https://github.com/python/cpython/blob/master/Lib/argparse.py#L138-L147
# https://github.com/python/cpython/blob/master/Lib/argparse.py#L1028-L1052
items = getattr(namespace, self.dest, [])
if type(items) is list:
items = items[:]
else:
items = copy.copy(items)
if self.const in items:
self.remove(self.const)
setattr(namespace, self.dest, items)
class OpenSKInstaller(object): class OpenSKInstaller(object):
def __init__(self, args):
colorama.init()
self.args = args
# Where all the TAB files should go
self.tab_folder = os.path.join("target", "tab")
# This is the filename that elf2tab command expects in order
# to create a working TAB file.
self.target_elf_filename = os.path.join(
self.tab_folder, "cortex-m4.elf")
self.tockloader_default_args = argparse.Namespace(
arch="cortex-m4",
board=getattr(self.args, "board", "nrf52840"),
debug=False,
force=False,
jlink=True,
jlink_device="nrf52840_xxaa",
jlink_if="swd",
jlink_speed=1200,
jtag=False,
no_bootloader_entry=False,
page_size=4096,
port=None,
)
def checked_command_output(self, cmd): def __init__(self, args):
cmd_output = "" colorama.init()
try: self.args = args
cmd_output = subprocess.check_output(cmd) # Where all the TAB files should go
except subprocess.CalledProcessError as e: self.tab_folder = os.path.join("target", "tab")
fatal("Failed to execute {}: {}".format(cmd[0], str(e))) # This is the filename that elf2tab command expects in order
# Unreachable because fatal() will exit # to create a working TAB file.
return cmd_output.decode() self.target_elf_filename = os.path.join(self.tab_folder, "cortex-m4.elf")
self.tockloader_default_args = argparse.Namespace(
arch="cortex-m4",
board=getattr(self.args, "board", "nrf52840"),
debug=False,
force=False,
jlink=True,
jlink_device="nrf52840_xxaa",
jlink_if="swd",
jlink_speed=1200,
jtag=False,
no_bootloader_entry=False,
page_size=4096,
port=None,
)
def update_rustc_if_needed(self): def checked_command_output(self, cmd):
target_toolchain_fullstring = "stable" cmd_output = ""
with open("rust-toolchain", "r") as f: try:
target_toolchain_fullstring = f.readline().strip() cmd_output = subprocess.check_output(cmd)
target_toolchain = target_toolchain_fullstring.split("-", maxsplit=1) except subprocess.CalledProcessError as e:
if len(target_toolchain) == 1: fatal("Failed to execute {}: {}".format(cmd[0], str(e)))
# If we target the stable version of rust, we won't have a date # Unreachable because fatal() will exit
# associated to the version and split will only return 1 item. return cmd_output.decode()
# To avoid failing later when accessing the date, we insert an
# empty value.
target_toolchain.append('')
current_version = self.checked_command_output(["rustc", "--version"])
if not all(
(target_toolchain[0] in current_version,
target_toolchain[1] in current_version)):
info("Updating rust toolchain to {}".format(
"-".join(target_toolchain)))
# Need to update
self.checked_command_output(
["rustup", "install", target_toolchain_fullstring])
self.checked_command_output(
["rustup", "target", "add", "thumbv7em-none-eabi"])
info("Rust toolchain up-to-date")
def build_and_install_tockos(self): def update_rustc_if_needed(self):
self.checked_command_output( target_toolchain_fullstring = "stable"
["make", "-C", SUPPORTED_BOARDS[self.args.board], "flash"] with open("rust-toolchain", "r") as f:
) target_toolchain_fullstring = f.readline().strip()
target_toolchain = target_toolchain_fullstring.split("-", maxsplit=1)
if len(target_toolchain) == 1:
# If we target the stable version of rust, we won't have a date
# associated to the version and split will only return 1 item.
# To avoid failing later when accessing the date, we insert an
# empty value.
target_toolchain.append('')
current_version = self.checked_command_output(["rustc", "--version"])
if not all((target_toolchain[0] in current_version,
target_toolchain[1] in current_version)):
info("Updating rust toolchain to {}".format("-".join(target_toolchain)))
# Need to update
self.checked_command_output(
["rustup", "install", target_toolchain_fullstring])
self.checked_command_output(
["rustup", "target", "add", "thumbv7em-none-eabi"])
info("Rust toolchain up-to-date")
def build_and_install_example(self): def build_and_install_tockos(self):
assert(self.args.application) self.checked_command_output(
self.checked_command_output([ ["make", "-C", SUPPORTED_BOARDS[self.args.board], "flash"])
"cargo",
"build",
"--release",
"--target=thumbv7em-none-eabi",
"--features={}".format(",".join(self.args.features)),
"--example",
self.args.application
])
self.install_elf_file(os.path.join(
"target/thumbv7em-none-eabi/release/examples",
self.args.application))
def build_and_install_opensk(self): def build_and_install_example(self):
assert(self.args.application) assert (self.args.application)
info("Building OpenSK application") self.checked_command_output([
self.checked_command_output([ "cargo", "build", "--release", "--target=thumbv7em-none-eabi",
"cargo", "--features={}".format(",".join(self.args.features)), "--example",
"build", self.args.application
"--release", ])
"--target=thumbv7em-none-eabi", self.install_elf_file(
"--features={}".format(",".join(self.args.features)), os.path.join("target/thumbv7em-none-eabi/release/examples",
]) self.args.application))
self.install_elf_file(os.path.join(
"target/thumbv7em-none-eabi/release", self.args.application))
def generate_crypto_materials(self, force_regenerate): def build_and_install_opensk(self):
has_error = subprocess.call([ assert (self.args.application)
os.path.join("tools", "gen_key_materials.sh"), info("Building OpenSK application")
"Y" if force_regenerate else "N", self.checked_command_output([
]) "cargo",
if has_error: "build",
error(( "--release",
"Something went wrong while trying to generate ECC " "--target=thumbv7em-none-eabi",
"key and/or certificate for OpenSK")) "--features={}".format(",".join(self.args.features)),
])
self.install_elf_file(
os.path.join("target/thumbv7em-none-eabi/release",
self.args.application))
def install_elf_file(self, elf_path): def generate_crypto_materials(self, force_regenerate):
assert(self.args.application) has_error = subprocess.call([
package_parameter = "-n" os.path.join("tools", "gen_key_materials.sh"),
elf2tab_ver = self.checked_command_output( "Y" if force_regenerate else "N",
["elf2tab", "--version"]).split(' ', maxsplit=1)[1] ])
# Starting from v0.5.0-dev the parameter changed. if has_error:
# Current pyblished crate is 0.4.0 but we don't want developers error(("Something went wrong while trying to generate ECC "
# running the HEAD from github to be stuck "key and/or certificate for OpenSK"))
if "0.5.0-dev" in elf2tab_ver:
package_parameter = "--package-name"
os.makedirs(self.tab_folder, exist_ok=True)
tab_filename = os.path.join(
self.tab_folder,
"{}.tab".format(self.args.application))
shutil.copyfile(elf_path, self.target_elf_filename)
self.checked_command_output([
"elf2tab",
package_parameter,
self.args.application,
"-o",
tab_filename,
self.target_elf_filename,
"--stack={}".format(STACK_SIZE),
"--app-heap={}".format(APP_HEAP_SIZE),
"--kernel-heap=1024",
"--protected-region-size=64"
])
self.install_padding()
info("Installing Tock application {}".format(self.args.application))
args = copy.copy(self.tockloader_default_args)
setattr(args, "app_address", 0x40000)
setattr(args, "erase", self.args.clear_apps)
setattr(args, "make", False)
setattr(args, "no_replace", False)
setattr(args, "sticky", False)
tock = tockloader.TockLoader(args)
tock.open(args)
tabs = [tab.TAB(tab_filename)]
try:
tock.install(tabs, replace="yes",
erase=args.erase, sticky=args.sticky)
except tockloader.exceptions.TockLoaderException as e:
fatal("Couldn't install Tock application {}: {}".format(
self.args.application, str(e)))
def install_padding(self): def install_elf_file(self, elf_path):
fake_header = tbfh.TBFHeader("") assert (self.args.application)
fake_header.version = 2 package_parameter = "-n"
fake_header.fields["header_size"] = 0x10 elf2tab_ver = self.checked_command_output(["elf2tab", "--version"]).split(
fake_header.fields["total_size"] = 0x10000 ' ', maxsplit=1)[1]
fake_header.fields["flags"] = 0 # Starting from v0.5.0-dev the parameter changed.
padding = fake_header.get_binary() # Current pyblished crate is 0.4.0 but we don't want developers
info("Flashing padding application") # running the HEAD from github to be stuck
args = copy.copy(self.tockloader_default_args) if "0.5.0-dev" in elf2tab_ver:
setattr(args, "address", 0x30000) package_parameter = "--package-name"
tock = tockloader.TockLoader(args) os.makedirs(self.tab_folder, exist_ok=True)
tock.open(args) tab_filename = os.path.join(self.tab_folder,
try: "{}.tab".format(self.args.application))
tock.flash_binary(padding, args.address) shutil.copyfile(elf_path, self.target_elf_filename)
except tockloader.exceptions.TockLoaderException as e: self.checked_command_output([
fatal("Couldn't install padding: {}".format(str(e))) "elf2tab", package_parameter, self.args.application, "-o", tab_filename,
self.target_elf_filename, "--stack={}".format(STACK_SIZE),
"--app-heap={}".format(APP_HEAP_SIZE), "--kernel-heap=1024",
"--protected-region-size=64"
])
self.install_padding()
info("Installing Tock application {}".format(self.args.application))
args = copy.copy(self.tockloader_default_args)
setattr(args, "app_address", 0x40000)
setattr(args, "erase", self.args.clear_apps)
setattr(args, "make", False)
setattr(args, "no_replace", False)
tock = tockloader.TockLoader(args)
tock.open(args)
tabs = [tab.TAB(tab_filename)]
try:
tock.install(tabs, replace="yes", erase=args.erase)
except tockloader.exceptions.TockLoaderException as e:
fatal("Couldn't install Tock application {}: {}".format(
self.args.application, str(e)))
def clear_apps(self): def install_padding(self):
args = copy.copy(self.tockloader_default_args) fake_header = tbfh.TBFHeader("")
setattr(args, "app_address", 0x40000) fake_header.version = 2
info("Erasing all installed applications") fake_header.fields["header_size"] = 0x10
tock = tockloader.TockLoader(args) fake_header.fields["total_size"] = 0x10000
tock.open(args) fake_header.fields["flags"] = 0
try: padding = fake_header.get_binary()
tock.erase_apps(False) info("Flashing padding application")
except tockloader.exceptions.TockLoaderException as e: args = copy.copy(self.tockloader_default_args)
# Erasing apps is not critical setattr(args, "address", 0x30000)
info(("A non-critical error occured while erasing " tock = tockloader.TockLoader(args)
"apps: {}".format(str(e)))) tock.open(args)
try:
tock.flash_binary(padding, args.address)
except tockloader.exceptions.TockLoaderException as e:
fatal("Couldn't install padding: {}".format(str(e)))
def run(self): def clear_apps(self):
if self.args.action is None: args = copy.copy(self.tockloader_default_args)
# Nothing to do setattr(args, "app_address", 0x40000)
return info("Erasing all installed applications")
tock = tockloader.TockLoader(args)
tock.open(args)
try:
tock.erase_apps(False)
except tockloader.exceptions.TockLoaderException as e:
# Erasing apps is not critical
info(("A non-critical error occured while erasing "
"apps: {}".format(str(e))))
self.update_rustc_if_needed() def verify_flashed_app(self, expected_app):
args = copy.copy(self.tockloader_default_args)
tock = tockloader.TockLoader(args)
app_found = False
with tock._start_communication_with_board():
apps = [app.name for app in tock._extract_all_app_headers()]
app_found = expected_app in apps
return app_found
if self.args.action == "os": def run(self):
info("Installing Tock on board {}".format(self.args.board)) if self.args.action is None:
self.build_and_install_tockos() # Nothing to do
return 0
if self.args.action == "app": self.update_rustc_if_needed()
if self.args.application is None:
fatal("Unspecified application") if self.args.action == "os":
if self.args.clear_apps: info("Installing Tock on board {}".format(self.args.board))
self.clear_apps() self.build_and_install_tockos()
if self.args.application == "ctap2": return 0
self.generate_crypto_materials(self.args.regenerate_keys)
self.build_and_install_opensk() if self.args.action == "app":
else: if self.args.application is None:
self.build_and_install_example() fatal("Unspecified application")
if self.args.clear_apps:
self.clear_apps()
if self.args.application == "ctap2":
self.generate_crypto_materials(self.args.regenerate_keys)
self.build_and_install_opensk()
else:
self.build_and_install_example()
if self.verify_flashed_app(self.args.application):
info("You're all set!")
return 0
error(("It seems that something went wrong. "
"App/example not found on your board."))
return 1
def main(args): def main(args):
# Make sure the current working directory is the right one before running # Make sure the current working directory is the right one before running
os.chdir(os.path.realpath(os.path.dirname(__file__))) os.chdir(os.path.realpath(os.path.dirname(__file__)))
# Check for pre-requisite executable files. # Check for pre-requisite executable files.
if not shutil.which("JLinkExe"): if not shutil.which("JLinkExe"):
fatal(("Couldn't find JLinkExe binary. Make sure Segger JLink tools " fatal(("Couldn't find JLinkExe binary. Make sure Segger JLink tools "
"are installed and correctly set up.")) "are installed and correctly set up."))
OpenSKInstaller(args).run() OpenSKInstaller(args).run()
if __name__ == '__main__': if __name__ == '__main__':
shared_parser = argparse.ArgumentParser(add_help=False) shared_parser = argparse.ArgumentParser(add_help=False)
shared_parser.add_argument( shared_parser.add_argument(
"--dont-clear-apps", "--dont-clear-apps",
action="store_false", action="store_false",
default=True, default=True,
dest="clear_apps", dest="clear_apps",
help=( help=("When installing an application, previously installed "
"When installing an application, previously installed " "applications won't be erased from the board."),
"applications won't be erased from the board." )
),
)
parser = argparse.ArgumentParser() parser = argparse.ArgumentParser()
commands = parser.add_subparsers( commands = parser.add_subparsers(
dest="action", dest="action",
help=( help=("Indicates which part of the firmware should be compiled and "
"Indicates which part of the firmware should be compiled and " "flashed to the connected board."))
"flashed to the connected board."
)
)
os_commands = commands.add_parser( os_commands = commands.add_parser(
"os", "os",
parents=[shared_parser], parents=[shared_parser],
help=( help=("Compiles and installs Tock OS. The target board must be "
"Compiles and installs Tock OS. The target board must be " "specified by setting the --board argument."),
"specified by setting the --board argument." )
), os_commands.add_argument(
) "--board",
os_commands.add_argument( metavar="BOARD_NAME",
"--board", dest="board",
metavar="BOARD_NAME", choices=get_supported_boards(),
dest="board", help="Indicates which board Tock OS will be compiled for.",
choices=get_supported_boards(), required=True)
help="Indicates which board Tock OS will be compiled for.",
required=True
)
app_commands = commands.add_parser( app_commands = commands.add_parser(
"app", "app",
parents=[shared_parser], parents=[shared_parser],
help="compiles and installs an application." help="compiles and installs an application.")
) app_commands.add_argument(
app_commands.add_argument( "--panic-console",
"--panic-console", action="append_const",
action="append_const", const="panic_console",
const="panic_console", dest="features",
dest="features", help=("In case of application panic, the console will be used to "
help=(
"In case of application panic, the console will be used to "
"output messages before starting blinking the LEDs on the " "output messages before starting blinking the LEDs on the "
"board." "board."),
), )
) app_commands.add_argument(
app_commands.add_argument( "--no-u2f",
"--no-u2f", action=RemoveConstAction,
action=RemoveConstAction, const="with_ctap1",
const="with_ctap1", dest="features",
dest="features", help=("Compiles the OpenSK application without backward compatible "
help=( "support for U2F/CTAP1 protocol."),
"Compiles the OpenSK application without backward compatible " )
"support for U2F/CTAP1 protocol." app_commands.add_argument(
), "--regen-keys",
) action="store_true",
app_commands.add_argument( default=False,
"--regen-keys", dest="regenerate_keys",
action="store_true", help=("Forces the generation of files (certificates and private keys) "
default=False,
dest="regenerate_keys",
help=(
"Forces the generation of files (certificates and private keys) "
"under the crypto_data/ directory. " "under the crypto_data/ directory. "
"This is useful to allow flashing multiple OpenSK authenticators " "This is useful to allow flashing multiple OpenSK authenticators "
"in a row without them being considered clones." "in a row without them being considered clones."),
), )
) app_commands.add_argument(
app_commands.add_argument( "--debug",
"--debug", action="append_const",
action="append_const", const="debug_ctap",
const="debug_ctap", dest="features",
dest="features", help=("Compiles and installs the OpenSK application in debug mode "
help=(
"Compiles and installs the OpenSK application in debug mode "
"(i.e. more debug messages will be sent over the console port " "(i.e. more debug messages will be sent over the console port "
"such as hexdumps of packets)." "such as hexdumps of packets)."),
), )
) apps = app_commands.add_mutually_exclusive_group()
apps = app_commands.add_mutually_exclusive_group() apps.add_argument(
apps.add_argument( "--opensk",
"--opensk", dest="application",
dest="application", action="store_const",
action="store_const", const="ctap2",
const="ctap2", help="Compiles and installs the OpenSK application.")
help="Compiles and installs the OpenSK application." apps.add_argument(
) "--crypto_bench",
apps.add_argument( dest="application",
"--crypto_bench", action="store_const",
dest="application", const="crypto_bench",
action="store_const", help=("Compiles and installs the crypto_bench example that tests "
const="crypto_bench", "the performance of the cryptographic algorithms on the board."))
help=(
"Compiles and installs the crypto_bench example that tests "
"the performance of the cryptographic algorithms on the board."
)
)
app_commands.set_defaults(features=["with_ctap1"]) app_commands.set_defaults(features=["with_ctap1"])
main(parser.parse_args()) main(parser.parse_args())