123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135 |
- # SPDX-License-Identifier: GPL-2.0+
- # Copyright (c) 2020, Linaro Limited
- # Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
- #
- # U-Boot UEFI: Image Authentication Test (signature with certificates chain)
- """
- This test verifies image authentication for a signed image which is signed
- by user certificate and contains additional intermediate certificates in its
- signature.
- """
- import pytest
- @pytest.mark.boardspec('sandbox')
- @pytest.mark.buildconfigspec('efi_secure_boot')
- @pytest.mark.buildconfigspec('cmd_efidebug')
- @pytest.mark.buildconfigspec('cmd_fat')
- @pytest.mark.buildconfigspec('cmd_nvedit_efi')
- @pytest.mark.slow
- class TestEfiSignedImageIntca(object):
- def test_efi_signed_image_intca1(self, u_boot_console, efi_boot_env_intca):
- """
- Test Case 1 - authenticated by root CA in db
- """
- u_boot_console.restart_uboot()
- disk_img = efi_boot_env_intca
- with u_boot_console.log.section('Test Case 1a'):
- # Test Case 1a, with no Int CA and not authenticated by root CA
- output = u_boot_console.run_command_list([
- 'host bind 0 %s' % disk_img,
- 'fatload host 0:1 4000000 db_c.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
- 'fatload host 0:1 4000000 KEK.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
- 'fatload host 0:1 4000000 PK.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
- assert 'Failed to set EFI variable' not in ''.join(output)
- output = u_boot_console.run_command_list([
- 'efidebug boot add 1 HELLO_a host 0:1 /helloworld.efi.signed_a ""',
- 'efidebug boot next 1',
- 'efidebug test bootmgr'])
- assert '\'HELLO_a\' failed' in ''.join(output)
- assert 'efi_start_image() returned: 26' in ''.join(output)
- with u_boot_console.log.section('Test Case 1b'):
- # Test Case 1b, signed and authenticated by root CA
- output = u_boot_console.run_command_list([
- 'efidebug boot add 2 HELLO_ab host 0:1 /helloworld.efi.signed_ab ""',
- 'efidebug boot next 2',
- 'bootefi bootmgr'])
- assert 'Hello, world!' in ''.join(output)
- def test_efi_signed_image_intca2(self, u_boot_console, efi_boot_env_intca):
- """
- Test Case 2 - authenticated by root CA in db
- """
- u_boot_console.restart_uboot()
- disk_img = efi_boot_env_intca
- with u_boot_console.log.section('Test Case 2a'):
- # Test Case 2a, unsigned and not authenticated by root CA
- output = u_boot_console.run_command_list([
- 'host bind 0 %s' % disk_img,
- 'fatload host 0:1 4000000 KEK.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
- 'fatload host 0:1 4000000 PK.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
- assert 'Failed to set EFI variable' not in ''.join(output)
- output = u_boot_console.run_command_list([
- 'efidebug boot add 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc ""',
- 'efidebug boot next 1',
- 'efidebug test bootmgr'])
- assert '\'HELLO_abc\' failed' in ''.join(output)
- assert 'efi_start_image() returned: 26' in ''.join(output)
- with u_boot_console.log.section('Test Case 2b'):
- # Test Case 2b, signed and authenticated by root CA
- output = u_boot_console.run_command_list([
- 'fatload host 0:1 4000000 db_b.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
- 'efidebug boot next 1',
- 'efidebug test bootmgr'])
- assert '\'HELLO_abc\' failed' in ''.join(output)
- assert 'efi_start_image() returned: 26' in ''.join(output)
- with u_boot_console.log.section('Test Case 2c'):
- # Test Case 2c, signed and authenticated by root CA
- output = u_boot_console.run_command_list([
- 'fatload host 0:1 4000000 db_c.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
- 'efidebug boot next 1',
- 'efidebug test bootmgr'])
- assert 'Hello, world!' in ''.join(output)
- def test_efi_signed_image_intca3(self, u_boot_console, efi_boot_env_intca):
- """
- Test Case 3 - revoked by dbx
- """
- u_boot_console.restart_uboot()
- disk_img = efi_boot_env_intca
- with u_boot_console.log.section('Test Case 3a'):
- # Test Case 3a, revoked by int CA in dbx
- output = u_boot_console.run_command_list([
- 'host bind 0 %s' % disk_img,
- 'fatload host 0:1 4000000 dbx_b.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
- 'fatload host 0:1 4000000 db_c.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
- 'fatload host 0:1 4000000 KEK.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
- 'fatload host 0:1 4000000 PK.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
- assert 'Failed to set EFI variable' not in ''.join(output)
- output = u_boot_console.run_command_list([
- 'efidebug boot add 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc ""',
- 'efidebug boot next 1',
- 'efidebug test bootmgr'])
- assert 'Hello, world!' in ''.join(output)
- # Or,
- # assert '\'HELLO_abc\' failed' in ''.join(output)
- # assert 'efi_start_image() returned: 26' in ''.join(output)
- with u_boot_console.log.section('Test Case 3b'):
- # Test Case 3b, revoked by root CA in dbx
- output = u_boot_console.run_command_list([
- 'fatload host 0:1 4000000 dbx_c.auth',
- 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
- 'efidebug boot next 1',
- 'efidebug test bootmgr'])
- assert '\'HELLO_abc\' failed' in ''.join(output)
- assert 'efi_start_image() returned: 26' in ''.join(output)
|