mirror of
https://github.com/u-boot/u-boot.git
synced 2025-04-17 10:24:49 +00:00
752c376987
This fixture name is quite long and results in lots of verbose code. We know this is U-Boot so the 'u_boot_' part is not necessary. But it is also a bit of a misnomer, since it provides access to all the information available to tests. It is not just the console. It would be too confusing to use con as it would be confused with config and it is probably too short. So shorten it to 'ubman'. Signed-off-by: Simon Glass <sjg@chromium.org> Link: https://lore.kernel.org/u-boot/CAFLszTgPa4aT_J9h9pqeTtLCVn4x2JvLWRcWRD8NaN3uoSAtyA@mail.gmail.com/
135 lines
6 KiB
Python
135 lines
6 KiB
Python
# SPDX-License-Identifier: GPL-2.0+
|
|
# Copyright (c) 2020, Linaro Limited
|
|
# Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
|
|
#
|
|
# U-Boot UEFI: Image Authentication Test (signature with certificates chain)
|
|
|
|
"""
|
|
This test verifies image authentication for a signed image which is signed
|
|
by user certificate and contains additional intermediate certificates in its
|
|
signature.
|
|
"""
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.mark.boardspec('sandbox')
|
|
@pytest.mark.buildconfigspec('efi_secure_boot')
|
|
@pytest.mark.buildconfigspec('cmd_efidebug')
|
|
@pytest.mark.buildconfigspec('cmd_fat')
|
|
@pytest.mark.buildconfigspec('cmd_nvedit_efi')
|
|
@pytest.mark.slow
|
|
class TestEfiSignedImageIntca(object):
|
|
def test_efi_signed_image_intca1(self, ubman, efi_boot_env_intca):
|
|
"""
|
|
Test Case 1 - authenticated by root CA in db
|
|
"""
|
|
ubman.restart_uboot()
|
|
disk_img = efi_boot_env_intca
|
|
with ubman.log.section('Test Case 1a'):
|
|
# Test Case 1a, with no Int CA and not authenticated by root CA
|
|
output = ubman.run_command_list([
|
|
'host bind 0 %s' % disk_img,
|
|
'fatload host 0:1 4000000 db_c.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
|
|
'fatload host 0:1 4000000 KEK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
|
|
'fatload host 0:1 4000000 PK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
|
|
assert 'Failed to set EFI variable' not in ''.join(output)
|
|
|
|
output = ubman.run_command_list([
|
|
'efidebug boot add -b 1 HELLO_a host 0:1 /helloworld.efi.signed_a -s ""',
|
|
'efidebug boot order 1',
|
|
'efidebug test bootmgr'])
|
|
assert '\'HELLO_a\' failed' in ''.join(output)
|
|
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
|
|
|
|
with ubman.log.section('Test Case 1b'):
|
|
# Test Case 1b, signed and authenticated by root CA
|
|
output = ubman.run_command_list([
|
|
'efidebug boot add -b 2 HELLO_ab host 0:1 /helloworld.efi.signed_ab -s ""',
|
|
'efidebug boot order 2',
|
|
'bootefi bootmgr'])
|
|
assert 'Hello, world!' in ''.join(output)
|
|
|
|
def test_efi_signed_image_intca2(self, ubman, efi_boot_env_intca):
|
|
"""
|
|
Test Case 2 - authenticated by root CA in db
|
|
"""
|
|
ubman.restart_uboot()
|
|
disk_img = efi_boot_env_intca
|
|
with ubman.log.section('Test Case 2a'):
|
|
# Test Case 2a, unsigned and not authenticated by root CA
|
|
output = ubman.run_command_list([
|
|
'host bind 0 %s' % disk_img,
|
|
'fatload host 0:1 4000000 KEK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
|
|
'fatload host 0:1 4000000 PK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
|
|
assert 'Failed to set EFI variable' not in ''.join(output)
|
|
|
|
output = ubman.run_command_list([
|
|
'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc -s ""',
|
|
'efidebug boot order 1',
|
|
'efidebug test bootmgr'])
|
|
assert '\'HELLO_abc\' failed' in ''.join(output)
|
|
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
|
|
|
|
with ubman.log.section('Test Case 2b'):
|
|
# Test Case 2b, signed and authenticated by root CA
|
|
output = ubman.run_command_list([
|
|
'fatload host 0:1 4000000 db_b.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
|
|
'efidebug boot order 1',
|
|
'efidebug test bootmgr'])
|
|
assert '\'HELLO_abc\' failed' in ''.join(output)
|
|
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
|
|
|
|
with ubman.log.section('Test Case 2c'):
|
|
# Test Case 2c, signed and authenticated by root CA
|
|
output = ubman.run_command_list([
|
|
'fatload host 0:1 4000000 db_c.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
|
|
'efidebug boot order 1',
|
|
'efidebug test bootmgr'])
|
|
assert 'Hello, world!' in ''.join(output)
|
|
|
|
def test_efi_signed_image_intca3(self, ubman, efi_boot_env_intca):
|
|
"""
|
|
Test Case 3 - revoked by dbx
|
|
"""
|
|
ubman.restart_uboot()
|
|
disk_img = efi_boot_env_intca
|
|
with ubman.log.section('Test Case 3a'):
|
|
# Test Case 3a, revoked by int CA in dbx
|
|
output = ubman.run_command_list([
|
|
'host bind 0 %s' % disk_img,
|
|
'fatload host 0:1 4000000 dbx_b.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
|
|
'fatload host 0:1 4000000 db_c.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
|
|
'fatload host 0:1 4000000 KEK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
|
|
'fatload host 0:1 4000000 PK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
|
|
assert 'Failed to set EFI variable' not in ''.join(output)
|
|
|
|
output = ubman.run_command_list([
|
|
'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc -s ""',
|
|
'efidebug boot order 1',
|
|
'efidebug test bootmgr'])
|
|
assert 'Hello, world!' in ''.join(output)
|
|
# Or,
|
|
# assert '\'HELLO_abc\' failed' in ''.join(output)
|
|
# assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
|
|
|
|
with ubman.log.section('Test Case 3b'):
|
|
# Test Case 3b, revoked by root CA in dbx
|
|
output = ubman.run_command_list([
|
|
'fatload host 0:1 4000000 dbx_c.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
|
|
'efidebug boot order 1',
|
|
'efidebug test bootmgr'])
|
|
assert '\'HELLO_abc\' failed' in ''.join(output)
|
|
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
|