| # |
| # Copyright 2019 NXP |
| # SPDX-License-Identifier: Apache-2.0 |
| # |
| # |
| |
| import sys |
| import click |
| from .cli import policy, pass_context |
| import sss.sss_api as apis |
| from sss.policy import Policy, policy_type |
| |
| |
| @policy.command('asymkey', short_help='Create Asymmetric Key Object Policy') |
| @pass_context |
| @click.argument('policy_name', type=str, metavar='policy_name') |
| @click.argument('auth_obj_id', type=str, metavar='auth_obj_id') |
| @click.option('--sign', type=bool, default=True, help="Object policy Allow Sign. Enabled by Default") |
| @click.option('--verify', type=bool, default=True, help="Object policy Allow Verify. Enabled by Default") |
| @click.option('--encrypt', type=bool, default=True, help="Object policy Allow Encryption. Enabled by Default") |
| @click.option('--decrypt', type=bool, default=True, help="Object policy Allow Decryption. Enabled by Default") |
| @click.option('--key_derive', type=bool, default=True, help="Object policy Allow Key Derivation. Enabled by Default") |
| @click.option('--wrap', type=bool, default=True, help="Object policy Allow Wrap. Enabled by Default") |
| @click.option('--generate', type=bool, default=True, help="Object policy Allow Generate. Enabled by Default") |
| @click.option('--write', type=bool, default=True, help="Object policy Allow Write. Enabled by Default") |
| @click.option('--read', type=bool, default=True, help="Object policy Allow Read. Enabled by Default") |
| @click.option('--import_export', type=bool, default=True, |
| help="Object policy Allow Import Export. Enabled by Default") |
| @click.option('--key_agreement', type=bool, default=True, help="Object policy Allow Key Agreement. Enabled by Default") |
| @click.option('--attest', type=bool, default=True, help="Object policy Allow attestation. Enabled by Default") |
| @click.option('--forbid_derived_output', type=bool, default=False, |
| help="Object policy Forbid Derived Output. Disabled by Default") |
| def asymkey(cli_ctx, policy_name, auth_obj_id, sign, verify, encrypt, decrypt, key_derive, wrap, generate, |
| write, read, import_export, key_agreement, attest, forbid_derived_output): |
| """ Create Asymmetric key object policy. \n |
| |
| policy_name = File name of the policy to be created. |
| This policy name should be given as input while provisioning.\n |
| |
| auth_obj_id = Auth object id for each Object Policy. \n |
| |
| """ |
| auth_obj_id = int(auth_obj_id, 16) |
| policy_obj = Policy() |
| policy_obj.sign = sign |
| policy_obj.verify = verify |
| policy_obj.encrypt = encrypt |
| policy_obj.decrypt = decrypt |
| policy_obj.key_derive = key_derive |
| policy_obj.wrap = wrap |
| policy_obj.generate = generate |
| policy_obj.write = write |
| policy_obj.read = read |
| policy_obj.import_export = import_export |
| policy_obj.key_agreement = key_agreement |
| policy_obj.attest = attest |
| policy_obj.forbid_derived_output = forbid_derived_output |
| |
| status = policy_obj.create_obj_policy(policy_type["Asymmetric_Key"], policy_name, auth_obj_id) |
| if status == apis.kStatus_SSS_Success: |
| cli_ctx.log("Object Policy created successfully") |
| ret_value = 0 |
| else: |
| cli_ctx.log("Error: Could not create object Policy") |
| ret_value = 1 |
| sys.exit(ret_value) |
| |
| |
| @policy.command('symkey', short_help='Create Symmetric Key Object Policy') |
| @pass_context |
| @click.argument('policy_name', type=str, metavar='policy_name') |
| @click.argument('auth_obj_id', type=str, metavar='auth_obj_id') |
| @click.option('--sign', type=bool, default=True, help="Object policy Allow Sign. Enabled by Default") |
| @click.option('--verify', type=bool, default=True, help="Object policy Allow Verify. Enabled by Default") |
| @click.option('--encrypt', type=bool, default=True, help="Object policy Allow Encryption. Enabled by Default") |
| @click.option('--decrypt', type=bool, default=True, help="Object policy Allow Decryption. Enabled by Default") |
| @click.option('--key_derive', type=bool, default=True, help="Object policy Allow Key Derivation. Enabled by Default") |
| @click.option('--wrap', type=bool, default=True, help="Object policy Allow Wrap. Enabled by Default") |
| @click.option('--generate', type=bool, default=True, help="Object policy Allow Generate. Enabled by Default") |
| @click.option('--write', type=bool, default=True, help="Object policy Allow Write. Enabled by Default") |
| @click.option('--import_export', type=bool, default=True, |
| help="Object policy Allow Import Export. Enabled by Default") |
| @click.option('--desfire_auth', type=bool, default=True, |
| help="Object policy Allow to perform DESFire authentication. Enabled by Default") |
| @click.option('--desfire_dump', type=bool, default=True, |
| help="Object policy Allow to dump DESFire session keys. Enabled by Default") |
| @click.option('--forbid_derived_output', type=bool, default=False, |
| help="Object policy Forbid Derived Output. Disabled by Default") |
| @click.option('--kdf_ext_random', type=bool, default=True, |
| help="Object policy Allow key derivation ext random. Enbaled by Default") |
| def symkey(cli_ctx, policy_name, auth_obj_id, sign, verify, encrypt, decrypt, key_derive, wrap, generate, |
| write, import_export, desfire_auth, desfire_dump, forbid_derived_output, kdf_ext_random): |
| """ Create Symmetric key object policy. \n |
| |
| policy_name = File name of the policy to be created. |
| This policy name should be given as input while provisioning.\n |
| |
| auth_obj_id = Auth object id for each Object Policy. \n |
| |
| """ |
| auth_obj_id = int(auth_obj_id, 16) |
| policy_obj = Policy() |
| policy_obj.sign = sign |
| policy_obj.verify = verify |
| policy_obj.encrypt = encrypt |
| policy_obj.decrypt = decrypt |
| policy_obj.key_derive = key_derive |
| policy_obj.wrap = wrap |
| policy_obj.generate = generate |
| policy_obj.write = write |
| policy_obj.import_export = import_export |
| policy_obj.desfire_auth = desfire_auth |
| policy_obj.desfire_dump = desfire_dump |
| policy_obj.forbid_derived_output = forbid_derived_output |
| policy_obj.kdf_ext_random = kdf_ext_random |
| status = policy_obj.create_obj_policy(policy_type["Symmetric_Key"], policy_name, auth_obj_id) |
| if status == apis.kStatus_SSS_Success: |
| cli_ctx.log("Object Policy created successfully") |
| ret_value = 0 |
| else: |
| cli_ctx.log("Error: Could not create object Policy") |
| ret_value = 1 |
| sys.exit(ret_value) |
| |
| |
| @policy.command('userid', short_help='Create User ID Object Policy') |
| @pass_context |
| @click.argument('policy_name', type=str, metavar='policy_name') |
| @click.argument('auth_obj_id', type=str, metavar='auth_obj_id') |
| @click.option('--write', type=bool, default=True, help="Object policy Allow Write. Enabled by Default") |
| def userid(cli_ctx, policy_name, auth_obj_id, write): |
| """ Create user id object policy. \n |
| |
| policy_name = File name of the policy to be created. |
| This policy name should be given as input while provisioning.\n |
| |
| auth_obj_id = Auth object id for each Object Policy. \n |
| |
| """ |
| auth_obj_id = int(auth_obj_id, 16) |
| policy_obj = Policy() |
| policy_obj.write = write |
| status = policy_obj.create_obj_policy(policy_type["user_id"], policy_name, auth_obj_id) |
| if status == apis.kStatus_SSS_Success: |
| cli_ctx.log("Object Policy created successfully") |
| ret_value = 0 |
| else: |
| cli_ctx.log("Error: Could not create object Policy") |
| ret_value = 1 |
| sys.exit(ret_value) |
| |
| |
| @policy.command('file', short_help='Create Binary file Object Policy') |
| @pass_context |
| @click.argument('policy_name', type=str, metavar='policy_name') |
| @click.argument('auth_obj_id', type=str, metavar='auth_obj_id') |
| @click.option('--write', type=bool, default=True, help="Object policy Allow Write. Enabled by Default") |
| @click.option('--read', type=bool, default=True, help="Object policy Allow Read. Enabled by Default") |
| def file(cli_ctx, policy_name, auth_obj_id, write, read): |
| """ Create Binary file object policy. \n |
| |
| policy_name = File name of the policy to be created. |
| This policy name should be given as input while provisioning.\n |
| |
| auth_obj_id = Auth object id for each Object Policy. \n |
| |
| """ |
| auth_obj_id = int(auth_obj_id, 16) |
| policy_obj = Policy() |
| policy_obj.write = write |
| policy_obj.read = read |
| status = policy_obj.create_obj_policy(policy_type["file"], policy_name, auth_obj_id) |
| if status == apis.kStatus_SSS_Success: |
| cli_ctx.log("Object Policy created successfully") |
| ret_value = 0 |
| else: |
| cli_ctx.log("Error: Could not create object Policy") |
| ret_value = 1 |
| sys.exit(ret_value) |
| |
| |
| @policy.command('counter', short_help='Create Counter Object Policy') |
| @pass_context |
| @click.argument('policy_name', type=str, metavar='policy_name') |
| @click.argument('auth_obj_id', type=str, metavar='auth_obj_id') |
| @click.option('--write', type=bool, default=True, help="Object policy Allow Write. Enabled by Default") |
| @click.option('--read', type=bool, default=True, help="Object policy Allow Read. Enabled by Default") |
| def counter(cli_ctx, policy_name, auth_obj_id, write, read): |
| """ Create Counter object policy. \n |
| |
| policy_name = File name of the policy to be created. |
| This policy name should be given as input while provisioning.\n |
| |
| auth_obj_id = Auth object id for each Object Policy. \n |
| |
| """ |
| auth_obj_id = int(auth_obj_id, 16) |
| policy_obj = Policy() |
| status = policy_obj.create_obj_policy(policy_type["counter"], policy_name, auth_obj_id, 1, 1, |
| 1, 1, 1, 1, 1, write, read, 1, 1, 1, 1, 1, 0, 1, 0, 0, 0) |
| if status == apis.kStatus_SSS_Success: |
| cli_ctx.log("Object Policy created successfully") |
| ret_value = 0 |
| else: |
| cli_ctx.log("Error: Could not create object Policy") |
| ret_value = 1 |
| sys.exit(ret_value) |
| |
| |
| @policy.command('pcr', short_help='Create PCR Object Policy') |
| @pass_context |
| @click.argument('policy_name', type=str, metavar='policy_name') |
| @click.argument('auth_obj_id', type=str, metavar='auth_obj_id') |
| @click.option('--write', type=bool, default=True, help="Object policy Allow Write. Enabled by Default") |
| @click.option('--read', type=bool, default=True, help="Object policy Allow Read. Enabled by Default") |
| def counter(cli_ctx, policy_name, auth_obj_id, write, read): |
| """ Create PCR object policy. \n |
| |
| policy_name = File name of the policy to be created. |
| This policy name should be given as input while provisioning.\n |
| |
| auth_obj_id = Auth object id for each Object Policy. \n |
| |
| """ |
| auth_obj_id = int(auth_obj_id, 16) |
| policy_obj = Policy() |
| policy_obj.write = write |
| policy_obj.read = read |
| status = policy_obj.create_obj_policy(policy_type["counter"], policy_name, auth_obj_id) |
| if status == apis.kStatus_SSS_Success: |
| cli_ctx.log("Object Policy created successfully") |
| ret_value = 0 |
| else: |
| cli_ctx.log("Error: Could not create object Policy") |
| ret_value = 1 |
| sys.exit(ret_value) |
| |
| |
| @policy.command('common', short_help='Create Common Object Policy') |
| @pass_context |
| @click.argument('policy_name', type=str, metavar='policy_name') |
| @click.argument('auth_obj_id', type=str, metavar='auth_obj_id') |
| @click.option('--forbid_all', type=bool, default=False, help="Object policy forbid all. Disabled by Default") |
| @click.option('--delete', type=bool, default=True, help="Object policy Allow Delete. Enabled by Default") |
| @click.option('--req_sm', type=bool, default=False, help="Object policy Allow req_sm. Disabled by Default") |
| def common(cli_ctx, policy_name, auth_obj_id, forbid_all, delete, req_sm): |
| """ Create common object policy. \n |
| |
| policy_name = File name of the policy to be created. |
| This policy name should be given as input while provisioning.\n |
| |
| auth_obj_id = Auth object id for each Object Policy. \n |
| |
| """ |
| auth_obj_id = int(auth_obj_id, 16) |
| policy_obj = Policy() |
| policy_obj.forbid_all = forbid_all |
| policy_obj.delete = delete |
| policy_obj.req_sm = req_sm |
| status = policy_obj.create_obj_policy(policy_type["common"], policy_name, auth_obj_id) |
| if status == apis.kStatus_SSS_Success: |
| cli_ctx.log("Object Policy created successfully") |
| ret_value = 0 |
| else: |
| cli_ctx.log("Error: Could not create object Policy") |
| ret_value = 1 |
| sys.exit(ret_value) |
| |
| |
| @policy.command('commonpcrvalue', short_help='Create Common PCR Value Object Policy') |
| @pass_context |
| @click.argument('policy_name', type=str, metavar='policy_name') |
| @click.argument('auth_obj_id', type=str, metavar='auth_obj_id') |
| @click.option('--pcr_obj_id', type=str, default='0', help="Object policy PCR object ID. Zero by Default") |
| @click.option('--pcr_expected_value', type=str, default='', help="Object policy PCR Expected Value. Zero by Default") |
| def commonpcrvalue(cli_ctx, policy_name, auth_obj_id, pcr_obj_id, pcr_expected_value): |
| """ Create Common PCR Value object policy. \n |
| |
| policy_name = File name of the policy to be created. |
| This policy name should be given as input while provisioning.\n |
| |
| auth_obj_id = Auth object id for each Object Policy. \n |
| |
| """ |
| auth_obj_id = int(auth_obj_id, 16) |
| policy_obj = Policy() |
| policy_obj.pcr_obj_id = pcr_obj_id |
| policy_obj.pcr_expected_value = pcr_expected_value |
| status = policy_obj.create_obj_policy(policy_type["common_pcr_value"], policy_name, auth_obj_id) |
| if status == apis.kStatus_SSS_Success: |
| cli_ctx.log("Object Policy created successfully") |
| ret_value = 0 |
| else: |
| cli_ctx.log("Error: Could not create object Policy") |
| ret_value = 1 |
| sys.exit(ret_value) |
| |
| |
| @policy.command('dump', short_help='Display Created Object Policy') |
| @pass_context |
| @click.argument('policy_name', type=str, metavar='policy_name') |
| def dump(cli_ctx, policy_name): |
| """ Display Created object policy. \n |
| |
| policy_name = File name of the policy to be displayed.\n |
| |
| """ |
| policy_obj = Policy() |
| pol_obj_params = policy_obj.get_object_policy(policy_name) |
| if pol_obj_params is not None: |
| policy_obj.display_policy(pol_obj_params) |
| policy_obj.display_policy_in_hex(pol_obj_params) |
| ret_value = 0 |
| else: |
| cli_ctx.log("Policy file not found. Try creating policy first") |
| ret_value = 1 |
| sys.exit(ret_value) |
| |
| |
