test_signed.py 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113
  1. # SPDX-License-Identifier: GPL-2.0+
  2. # Copyright (c) 2019, Linaro Limited
  3. # Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
  4. #
  5. # U-Boot UEFI: Signed Image Authentication Test
  6. """
  7. This test verifies image authentication for signed images.
  8. """
  9. import pytest
  10. from defs import *
  11. @pytest.mark.boardspec('sandbox')
  12. @pytest.mark.buildconfigspec('efi_secure_boot')
  13. @pytest.mark.buildconfigspec('cmd_efidebug')
  14. @pytest.mark.buildconfigspec('cmd_fat')
  15. @pytest.mark.buildconfigspec('cmd_nvedit_efi')
  16. @pytest.mark.slow
  17. class TestEfiSignedImage(object):
  18. def test_efi_signed_image_auth1(self, u_boot_console, efi_boot_env):
  19. """
  20. Test Case 1 - authenticated by db
  21. """
  22. u_boot_console.restart_uboot()
  23. disk_img = efi_boot_env
  24. with u_boot_console.log.section('Test Case 1a'):
  25. # Test Case 1a, run signed image if no db/dbx
  26. output = u_boot_console.run_command_list([
  27. 'host bind 0 %s' % disk_img,
  28. 'efidebug boot add 1 HELLO1 host 0:1 /helloworld.efi.signed ""',
  29. 'efidebug boot next 1',
  30. 'bootefi bootmgr'])
  31. assert('Hello, world!' in ''.join(output))
  32. with u_boot_console.log.section('Test Case 1b'):
  33. # Test Case 1b, run unsigned image if no db/dbx
  34. output = u_boot_console.run_command_list([
  35. 'efidebug boot add 2 HELLO2 host 0:1 /helloworld.efi ""',
  36. 'efidebug boot next 2',
  37. 'bootefi bootmgr'])
  38. assert('Hello, world!' in ''.join(output))
  39. with u_boot_console.log.section('Test Case 1c'):
  40. # Test Case 1c, not authenticated by db
  41. output = u_boot_console.run_command_list([
  42. 'fatload host 0:1 4000000 db.auth',
  43. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db',
  44. 'fatload host 0:1 4000000 KEK.auth',
  45. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
  46. 'fatload host 0:1 4000000 PK.auth',
  47. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK'])
  48. assert(not 'Failed to set EFI variable' in ''.join(output))
  49. output = u_boot_console.run_command_list([
  50. 'efidebug boot next 2',
  51. 'bootefi bootmgr'])
  52. assert('\'HELLO2\' failed' in ''.join(output))
  53. output = u_boot_console.run_command_list([
  54. 'efidebug boot next 2',
  55. 'efidebug test bootmgr'])
  56. assert('efi_start_image() returned: 26' in ''.join(output))
  57. assert(not 'Hello, world!' in ''.join(output))
  58. with u_boot_console.log.section('Test Case 1d'):
  59. # Test Case 1d, authenticated by db
  60. output = u_boot_console.run_command_list([
  61. 'efidebug boot next 1',
  62. 'bootefi bootmgr'])
  63. assert('Hello, world!' in ''.join(output))
  64. def test_efi_signed_image_auth2(self, u_boot_console, efi_boot_env):
  65. """
  66. Test Case 2 - rejected by dbx
  67. """
  68. u_boot_console.restart_uboot()
  69. disk_img = efi_boot_env
  70. with u_boot_console.log.section('Test Case 2a'):
  71. # Test Case 2a, rejected by dbx
  72. output = u_boot_console.run_command_list([
  73. 'host bind 0 %s' % disk_img,
  74. 'fatload host 0:1 4000000 db.auth',
  75. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize dbx',
  76. 'fatload host 0:1 4000000 KEK.auth',
  77. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
  78. 'fatload host 0:1 4000000 PK.auth',
  79. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK'])
  80. assert(not 'Failed to set EFI variable' in ''.join(output))
  81. output = u_boot_console.run_command_list([
  82. 'efidebug boot add 1 HELLO host 0:1 /helloworld.efi.signed ""',
  83. 'efidebug boot next 1',
  84. 'bootefi bootmgr'])
  85. assert('\'HELLO\' failed' in ''.join(output))
  86. output = u_boot_console.run_command_list([
  87. 'efidebug boot next 1',
  88. 'efidebug test bootmgr'])
  89. assert('efi_start_image() returned: 26' in ''.join(output))
  90. assert(not 'Hello, world!' in ''.join(output))
  91. with u_boot_console.log.section('Test Case 2b'):
  92. # Test Case 2b, rejected by dbx even if db allows
  93. output = u_boot_console.run_command_list([
  94. 'fatload host 0:1 4000000 db.auth',
  95. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db'])
  96. assert(not 'Failed to set EFI variable' in ''.join(output))
  97. output = u_boot_console.run_command_list([
  98. 'efidebug boot next 1',
  99. 'bootefi bootmgr'])
  100. assert('\'HELLO\' failed' in ''.join(output))
  101. output = u_boot_console.run_command_list([
  102. 'efidebug boot next 1',
  103. 'efidebug test bootmgr'])
  104. assert('efi_start_image() returned: 26' in ''.join(output))
  105. assert(not 'Hello, world!' in ''.join(output))