test_signed_intca.py 6.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135
  1. # SPDX-License-Identifier: GPL-2.0+
  2. # Copyright (c) 2020, Linaro Limited
  3. # Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
  4. #
  5. # U-Boot UEFI: Image Authentication Test (signature with certificates chain)
  6. """
  7. This test verifies image authentication for a signed image which is signed
  8. by user certificate and contains additional intermediate certificates in its
  9. signature.
  10. """
  11. import pytest
  12. @pytest.mark.boardspec('sandbox')
  13. @pytest.mark.buildconfigspec('efi_secure_boot')
  14. @pytest.mark.buildconfigspec('cmd_efidebug')
  15. @pytest.mark.buildconfigspec('cmd_fat')
  16. @pytest.mark.buildconfigspec('cmd_nvedit_efi')
  17. @pytest.mark.slow
  18. class TestEfiSignedImageIntca(object):
  19. def test_efi_signed_image_intca1(self, u_boot_console, efi_boot_env_intca):
  20. """
  21. Test Case 1 - authenticated by root CA in db
  22. """
  23. u_boot_console.restart_uboot()
  24. disk_img = efi_boot_env_intca
  25. with u_boot_console.log.section('Test Case 1a'):
  26. # Test Case 1a, with no Int CA and not authenticated by root CA
  27. output = u_boot_console.run_command_list([
  28. 'host bind 0 %s' % disk_img,
  29. 'fatload host 0:1 4000000 db_c.auth',
  30. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
  31. 'fatload host 0:1 4000000 KEK.auth',
  32. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
  33. 'fatload host 0:1 4000000 PK.auth',
  34. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
  35. assert 'Failed to set EFI variable' not in ''.join(output)
  36. output = u_boot_console.run_command_list([
  37. 'efidebug boot add 1 HELLO_a host 0:1 /helloworld.efi.signed_a ""',
  38. 'efidebug boot next 1',
  39. 'efidebug test bootmgr'])
  40. assert '\'HELLO_a\' failed' in ''.join(output)
  41. assert 'efi_start_image() returned: 26' in ''.join(output)
  42. with u_boot_console.log.section('Test Case 1b'):
  43. # Test Case 1b, signed and authenticated by root CA
  44. output = u_boot_console.run_command_list([
  45. 'efidebug boot add 2 HELLO_ab host 0:1 /helloworld.efi.signed_ab ""',
  46. 'efidebug boot next 2',
  47. 'bootefi bootmgr'])
  48. assert 'Hello, world!' in ''.join(output)
  49. def test_efi_signed_image_intca2(self, u_boot_console, efi_boot_env_intca):
  50. """
  51. Test Case 2 - authenticated by root CA in db
  52. """
  53. u_boot_console.restart_uboot()
  54. disk_img = efi_boot_env_intca
  55. with u_boot_console.log.section('Test Case 2a'):
  56. # Test Case 2a, unsigned and not authenticated by root CA
  57. output = u_boot_console.run_command_list([
  58. 'host bind 0 %s' % disk_img,
  59. 'fatload host 0:1 4000000 KEK.auth',
  60. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
  61. 'fatload host 0:1 4000000 PK.auth',
  62. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
  63. assert 'Failed to set EFI variable' not in ''.join(output)
  64. output = u_boot_console.run_command_list([
  65. 'efidebug boot add 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc ""',
  66. 'efidebug boot next 1',
  67. 'efidebug test bootmgr'])
  68. assert '\'HELLO_abc\' failed' in ''.join(output)
  69. assert 'efi_start_image() returned: 26' in ''.join(output)
  70. with u_boot_console.log.section('Test Case 2b'):
  71. # Test Case 2b, signed and authenticated by root CA
  72. output = u_boot_console.run_command_list([
  73. 'fatload host 0:1 4000000 db_b.auth',
  74. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
  75. 'efidebug boot next 1',
  76. 'efidebug test bootmgr'])
  77. assert '\'HELLO_abc\' failed' in ''.join(output)
  78. assert 'efi_start_image() returned: 26' in ''.join(output)
  79. with u_boot_console.log.section('Test Case 2c'):
  80. # Test Case 2c, signed and authenticated by root CA
  81. output = u_boot_console.run_command_list([
  82. 'fatload host 0:1 4000000 db_c.auth',
  83. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
  84. 'efidebug boot next 1',
  85. 'efidebug test bootmgr'])
  86. assert 'Hello, world!' in ''.join(output)
  87. def test_efi_signed_image_intca3(self, u_boot_console, efi_boot_env_intca):
  88. """
  89. Test Case 3 - revoked by dbx
  90. """
  91. u_boot_console.restart_uboot()
  92. disk_img = efi_boot_env_intca
  93. with u_boot_console.log.section('Test Case 3a'):
  94. # Test Case 3a, revoked by int CA in dbx
  95. output = u_boot_console.run_command_list([
  96. 'host bind 0 %s' % disk_img,
  97. 'fatload host 0:1 4000000 dbx_b.auth',
  98. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
  99. 'fatload host 0:1 4000000 db_c.auth',
  100. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
  101. 'fatload host 0:1 4000000 KEK.auth',
  102. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
  103. 'fatload host 0:1 4000000 PK.auth',
  104. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
  105. assert 'Failed to set EFI variable' not in ''.join(output)
  106. output = u_boot_console.run_command_list([
  107. 'efidebug boot add 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc ""',
  108. 'efidebug boot next 1',
  109. 'efidebug test bootmgr'])
  110. assert 'Hello, world!' in ''.join(output)
  111. # Or,
  112. # assert '\'HELLO_abc\' failed' in ''.join(output)
  113. # assert 'efi_start_image() returned: 26' in ''.join(output)
  114. with u_boot_console.log.section('Test Case 3b'):
  115. # Test Case 3b, revoked by root CA in dbx
  116. output = u_boot_console.run_command_list([
  117. 'fatload host 0:1 4000000 dbx_c.auth',
  118. 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
  119. 'efidebug boot next 1',
  120. 'efidebug test bootmgr'])
  121. assert '\'HELLO_abc\' failed' in ''.join(output)
  122. assert 'efi_start_image() returned: 26' in ''.join(output)