mirror of
https://github.com/u-boot/u-boot.git
synced 2025-04-22 20:58:22 +00:00
cbea241e93
The UEFI spec allows a packed array of UEFI device paths in the FilePathList[] of an EFI_LOAD_OPTION. The first file path must describe the loaded image but the rest are OS specific. Previous patches parse the device path and try to use the second member of the array as an initrd. So let's modify efidebug slightly and install the second file described in the command line as the initrd device path. Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
135 lines
6.2 KiB
Python
135 lines
6.2 KiB
Python
# SPDX-License-Identifier: GPL-2.0+
|
|
# Copyright (c) 2020, Linaro Limited
|
|
# Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
|
|
#
|
|
# U-Boot UEFI: Image Authentication Test (signature with certificates chain)
|
|
|
|
"""
|
|
This test verifies image authentication for a signed image which is signed
|
|
by user certificate and contains additional intermediate certificates in its
|
|
signature.
|
|
"""
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.mark.boardspec('sandbox')
|
|
@pytest.mark.buildconfigspec('efi_secure_boot')
|
|
@pytest.mark.buildconfigspec('cmd_efidebug')
|
|
@pytest.mark.buildconfigspec('cmd_fat')
|
|
@pytest.mark.buildconfigspec('cmd_nvedit_efi')
|
|
@pytest.mark.slow
|
|
class TestEfiSignedImageIntca(object):
|
|
def test_efi_signed_image_intca1(self, u_boot_console, efi_boot_env_intca):
|
|
"""
|
|
Test Case 1 - authenticated by root CA in db
|
|
"""
|
|
u_boot_console.restart_uboot()
|
|
disk_img = efi_boot_env_intca
|
|
with u_boot_console.log.section('Test Case 1a'):
|
|
# Test Case 1a, with no Int CA and not authenticated by root CA
|
|
output = u_boot_console.run_command_list([
|
|
'host bind 0 %s' % disk_img,
|
|
'fatload host 0:1 4000000 db_c.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
|
|
'fatload host 0:1 4000000 KEK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
|
|
'fatload host 0:1 4000000 PK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
|
|
assert 'Failed to set EFI variable' not in ''.join(output)
|
|
|
|
output = u_boot_console.run_command_list([
|
|
'efidebug boot add -b 1 HELLO_a host 0:1 /helloworld.efi.signed_a ""',
|
|
'efidebug boot next 1',
|
|
'efidebug test bootmgr'])
|
|
assert '\'HELLO_a\' failed' in ''.join(output)
|
|
assert 'efi_start_image() returned: 26' in ''.join(output)
|
|
|
|
with u_boot_console.log.section('Test Case 1b'):
|
|
# Test Case 1b, signed and authenticated by root CA
|
|
output = u_boot_console.run_command_list([
|
|
'efidebug boot add -b 2 HELLO_ab host 0:1 /helloworld.efi.signed_ab ""',
|
|
'efidebug boot next 2',
|
|
'bootefi bootmgr'])
|
|
assert 'Hello, world!' in ''.join(output)
|
|
|
|
def test_efi_signed_image_intca2(self, u_boot_console, efi_boot_env_intca):
|
|
"""
|
|
Test Case 2 - authenticated by root CA in db
|
|
"""
|
|
u_boot_console.restart_uboot()
|
|
disk_img = efi_boot_env_intca
|
|
with u_boot_console.log.section('Test Case 2a'):
|
|
# Test Case 2a, unsigned and not authenticated by root CA
|
|
output = u_boot_console.run_command_list([
|
|
'host bind 0 %s' % disk_img,
|
|
'fatload host 0:1 4000000 KEK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
|
|
'fatload host 0:1 4000000 PK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
|
|
assert 'Failed to set EFI variable' not in ''.join(output)
|
|
|
|
output = u_boot_console.run_command_list([
|
|
'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc ""',
|
|
'efidebug boot next 1',
|
|
'efidebug test bootmgr'])
|
|
assert '\'HELLO_abc\' failed' in ''.join(output)
|
|
assert 'efi_start_image() returned: 26' in ''.join(output)
|
|
|
|
with u_boot_console.log.section('Test Case 2b'):
|
|
# Test Case 2b, signed and authenticated by root CA
|
|
output = u_boot_console.run_command_list([
|
|
'fatload host 0:1 4000000 db_b.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
|
|
'efidebug boot next 1',
|
|
'efidebug test bootmgr'])
|
|
assert '\'HELLO_abc\' failed' in ''.join(output)
|
|
assert 'efi_start_image() returned: 26' in ''.join(output)
|
|
|
|
with u_boot_console.log.section('Test Case 2c'):
|
|
# Test Case 2c, signed and authenticated by root CA
|
|
output = u_boot_console.run_command_list([
|
|
'fatload host 0:1 4000000 db_c.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
|
|
'efidebug boot next 1',
|
|
'efidebug test bootmgr'])
|
|
assert 'Hello, world!' in ''.join(output)
|
|
|
|
def test_efi_signed_image_intca3(self, u_boot_console, efi_boot_env_intca):
|
|
"""
|
|
Test Case 3 - revoked by dbx
|
|
"""
|
|
u_boot_console.restart_uboot()
|
|
disk_img = efi_boot_env_intca
|
|
with u_boot_console.log.section('Test Case 3a'):
|
|
# Test Case 3a, revoked by int CA in dbx
|
|
output = u_boot_console.run_command_list([
|
|
'host bind 0 %s' % disk_img,
|
|
'fatload host 0:1 4000000 dbx_b.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
|
|
'fatload host 0:1 4000000 db_c.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
|
|
'fatload host 0:1 4000000 KEK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
|
|
'fatload host 0:1 4000000 PK.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
|
|
assert 'Failed to set EFI variable' not in ''.join(output)
|
|
|
|
output = u_boot_console.run_command_list([
|
|
'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc ""',
|
|
'efidebug boot next 1',
|
|
'efidebug test bootmgr'])
|
|
assert 'Hello, world!' in ''.join(output)
|
|
# Or,
|
|
# assert '\'HELLO_abc\' failed' in ''.join(output)
|
|
# assert 'efi_start_image() returned: 26' in ''.join(output)
|
|
|
|
with u_boot_console.log.section('Test Case 3b'):
|
|
# Test Case 3b, revoked by root CA in dbx
|
|
output = u_boot_console.run_command_list([
|
|
'fatload host 0:1 4000000 dbx_c.auth',
|
|
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
|
|
'efidebug boot next 1',
|
|
'efidebug test bootmgr'])
|
|
assert '\'HELLO_abc\' failed' in ''.join(output)
|
|
assert 'efi_start_image() returned: 26' in ''.join(output)
|