|
| 1 | +#!/usr/bin/python |
| 2 | + |
| 3 | +# |
| 4 | +# Copyright (c) 2022 Project CHIP Authors |
| 5 | +# |
| 6 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 7 | +# you may not use this file except in compliance with the License. |
| 8 | +# You may obtain a copy of the License at |
| 9 | +# |
| 10 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 11 | +# |
| 12 | +# Unless required by applicable law or agreed to in writing, software |
| 13 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 14 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 15 | +# See the License for the specific language governing permissions and |
| 16 | +# limitations under the License. |
| 17 | +# |
| 18 | + |
| 19 | +# Script that was used to fetch CHIP Development Product Attestation Authority (PAA) |
| 20 | +# certificates from DCL. |
| 21 | +# The script expects the path to the dcld tool binary as an input argument. |
| 22 | +# |
| 23 | +# Usage example when the script is run from the CHIP SDK root directory: |
| 24 | +# python ./credentials/development/fetch-development-paa-certs-from-dcl.py /path/to/dcld |
| 25 | +# |
| 26 | +# The result will be stored in: |
| 27 | +# credentials/development/paa-root-certs |
| 28 | +# |
| 29 | + |
| 30 | +import os |
| 31 | +import sys |
| 32 | +import subprocess |
| 33 | +import copy |
| 34 | +import re |
| 35 | +from cryptography.hazmat.primitives import serialization |
| 36 | +from cryptography import x509 |
| 37 | + |
| 38 | + |
| 39 | +def parse_paa_root_certs(cmdpipe, paa_list): |
| 40 | + """ |
| 41 | + example output of a query to all x509 root certs in DCL: |
| 42 | +
|
| 43 | + certs: |
| 44 | + - subject: CN=Non Production ONLY - XFN PAA Class 3 |
| 45 | + subject_key_id: F8:99:A9:D5:AD:71:71:E4:C3:81:7F:14:10:7F:78:F0:D9:F7:62:E9 |
| 46 | + - subject: CN=Matter Development PAA |
| 47 | + subject_key_id: FA:92:CF:9:5E:FA:42:E1:14:30:65:16:32:FE:FE:1B:2C:77:A7:C8 |
| 48 | + - subject: CN=Matter PAA 1,O=Google,C=US,1.3.6.1.4.1.37244.2.1=#130436303036 |
| 49 | + subject_key_id: B0:0:56:81:B8:88:62:89:62:80:E1:21:18:A1:A8:BE:9:DE:93:21 |
| 50 | + - subject: CN=Matter Test PAA,1.3.6.1.4.1.37244.2.1=#130431323544 |
| 51 | + subject_key_id: E2:90:8D:36:9C:3C:A3:C1:13:BB:9:E2:4D:C1:CC:C5:A6:66:91:D4 |
| 52 | +
|
| 53 | + Brief: |
| 54 | + This method will search for the first line that contains ': ' char sequence. |
| 55 | + From there, it assumes every 2 lines contain subject and subject key id info of |
| 56 | + a valid PAA root certificate. |
| 57 | + The paa_list parameter will contain a list of all valid PAA Root certificates |
| 58 | + from DCL. |
| 59 | + """ |
| 60 | + |
| 61 | + result = {} |
| 62 | + |
| 63 | + while True: |
| 64 | + line = cmdpipe.stdout.readline() |
| 65 | + if not line: |
| 66 | + break |
| 67 | + else: |
| 68 | + if b': ' in line: |
| 69 | + key, value = line.split(b': ') |
| 70 | + result[key.strip(b' -')] = value.strip() |
| 71 | + parse_paa_root_certs.counter += 1 |
| 72 | + if parse_paa_root_certs.counter % 2 == 0: |
| 73 | + paa_list.append(copy.deepcopy(result)) |
| 74 | + |
| 75 | + |
| 76 | +def write_paa_root_cert(cmdpipe, subject): |
| 77 | + filename = 'paa-root-certs/dcld_mirror_' + \ |
| 78 | + re.sub('[^a-zA-Z0-9_-]', '', re.sub('[=, ]', '_', subject)) |
| 79 | + with open(filename + '.pem', 'wb+') as outfile: |
| 80 | + while True: |
| 81 | + line = cmdpipe.stdout.readline() |
| 82 | + if not line: |
| 83 | + break |
| 84 | + else: |
| 85 | + if b'pem_cert: |' in line: |
| 86 | + while True: |
| 87 | + line = cmdpipe.stdout.readline() |
| 88 | + outfile.write(line.strip(b' \t')) |
| 89 | + if b'-----END CERTIFICATE-----' in line: |
| 90 | + break |
| 91 | + # convert pem file to der |
| 92 | + with open(filename + '.pem', 'rb') as infile: |
| 93 | + pem_certificate = x509.load_pem_x509_certificate(infile.read()) |
| 94 | + with open(filename + '.der', 'wb+') as outfile: |
| 95 | + der_certificate = pem_certificate.public_bytes( |
| 96 | + serialization.Encoding.DER) |
| 97 | + outfile.write(der_certificate) |
| 98 | + |
| 99 | + |
| 100 | +def main(): |
| 101 | + if len(sys.argv) == 2: |
| 102 | + dcld = sys.argv[1] |
| 103 | + else: |
| 104 | + sys.exit( |
| 105 | + "Error: Please specify exactly one input argument; the path to the dcld tool binary") |
| 106 | + |
| 107 | + previous_dir = os.getcwd() |
| 108 | + abspath = os.path.dirname(sys.argv[0]) |
| 109 | + os.chdir(abspath) |
| 110 | + |
| 111 | + os.makedirs('paa-root-certs', exist_ok=True) |
| 112 | + |
| 113 | + cmdpipe = subprocess.Popen([dcld, 'query', 'pki', 'all-x509-root-certs'], |
| 114 | + stdout=subprocess.PIPE, stderr=subprocess.PIPE) |
| 115 | + |
| 116 | + paa_list = [] |
| 117 | + parse_paa_root_certs.counter = 0 |
| 118 | + parse_paa_root_certs(cmdpipe, paa_list) |
| 119 | + |
| 120 | + for paa in paa_list: |
| 121 | + cmdpipe = subprocess.Popen( |
| 122 | + [dcld, 'query', 'pki', 'x509-cert', '-u', |
| 123 | + paa[b'subject'].decode("utf-8"), '-k', paa[b'subject_key_id'].decode("utf-8")], |
| 124 | + stdout=subprocess.PIPE, stderr=subprocess.PIPE) |
| 125 | + write_paa_root_cert(cmdpipe, paa[b'subject'].decode("utf-8")) |
| 126 | + |
| 127 | + os.chdir(previous_dir) |
| 128 | + |
| 129 | + |
| 130 | +if __name__ == "__main__": |
| 131 | + main() |
![pull[bot]](https://avatars.githubusercontent.com/in/12910?v=4&size=40){kind=avatar}
0 commit comments