test_unsigned.py 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117
  1. # SPDX-License-Identifier: GPL-2.0+
  2. # Copyright (c) 2019, Linaro Limited
  3. # Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
  4. #
  5. # U-Boot UEFI: Signed Image Authentication Test
  6. """
  7. This test verifies image authentication for unsigned images.
  8. """
  9. import pytest
  10. @pytest.mark.boardspec('sandbox')
  11. @pytest.mark.buildconfigspec('efi_secure_boot')
  12. @pytest.mark.buildconfigspec('cmd_efidebug')
  13. @pytest.mark.buildconfigspec('cmd_fat')
  14. @pytest.mark.buildconfigspec('cmd_nvedit_efi')
  15. @pytest.mark.slow
  16. class TestEfiUnsignedImage(object):
  17. def test_efi_unsigned_image_auth1(self, u_boot_console, efi_boot_env):
  18. """
  19. Test Case 1 - rejected when not digest in db or dbx
  20. """
  21. u_boot_console.restart_uboot()
  22. disk_img = efi_boot_env
  23. with u_boot_console.log.section('Test Case 1'):
  24. # Test Case 1
  25. output = u_boot_console.run_command_list([
  26. 'host bind 0 %s' % disk_img,
  27. 'fatload host 0:1 4000000 KEK.auth',
  28. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
  29. 'fatload host 0:1 4000000 PK.auth',
  30. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK'])
  31. assert 'Failed to set EFI variable' not in ''.join(output)
  32. output = u_boot_console.run_command_list([
  33. 'efidebug boot add 1 HELLO host 0:1 /helloworld.efi ""',
  34. 'efidebug boot next 1',
  35. 'bootefi bootmgr'])
  36. assert '\'HELLO\' failed' in ''.join(output)
  37. output = u_boot_console.run_command_list([
  38. 'efidebug boot next 1',
  39. 'efidebug test bootmgr'])
  40. assert 'efi_start_image() returned: 26' in ''.join(output)
  41. assert 'Hello, world!' not in ''.join(output)
  42. def test_efi_unsigned_image_auth2(self, u_boot_console, efi_boot_env):
  43. """
  44. Test Case 2 - authenticated by digest in db
  45. """
  46. u_boot_console.restart_uboot()
  47. disk_img = efi_boot_env
  48. with u_boot_console.log.section('Test Case 2'):
  49. # Test Case 2
  50. output = u_boot_console.run_command_list([
  51. 'host bind 0 %s' % disk_img,
  52. 'fatload host 0:1 4000000 db_hello.auth',
  53. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db',
  54. 'fatload host 0:1 4000000 KEK.auth',
  55. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
  56. 'fatload host 0:1 4000000 PK.auth',
  57. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK'])
  58. assert 'Failed to set EFI variable' not in ''.join(output)
  59. output = u_boot_console.run_command_list([
  60. 'efidebug boot add 1 HELLO host 0:1 /helloworld.efi ""',
  61. 'efidebug boot next 1',
  62. 'bootefi bootmgr'])
  63. assert 'Hello, world!' in ''.join(output)
  64. def test_efi_unsigned_image_auth3(self, u_boot_console, efi_boot_env):
  65. """
  66. Test Case 3 - rejected by digest in dbx
  67. """
  68. u_boot_console.restart_uboot()
  69. disk_img = efi_boot_env
  70. with u_boot_console.log.section('Test Case 3a'):
  71. # Test Case 3a, rejected by dbx
  72. output = u_boot_console.run_command_list([
  73. 'host bind 0 %s' % disk_img,
  74. 'fatload host 0:1 4000000 db_hello.auth',
  75. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize dbx',
  76. 'fatload host 0:1 4000000 KEK.auth',
  77. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
  78. 'fatload host 0:1 4000000 PK.auth',
  79. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK'])
  80. assert 'Failed to set EFI variable' not in ''.join(output)
  81. output = u_boot_console.run_command_list([
  82. 'efidebug boot add 1 HELLO host 0:1 /helloworld.efi ""',
  83. 'efidebug boot next 1',
  84. 'bootefi bootmgr'])
  85. assert '\'HELLO\' failed' in ''.join(output)
  86. output = u_boot_console.run_command_list([
  87. 'efidebug boot next 1',
  88. 'efidebug test bootmgr'])
  89. assert 'efi_start_image() returned: 26' in ''.join(output)
  90. assert 'Hello, world!' not in ''.join(output)
  91. with u_boot_console.log.section('Test Case 3b'):
  92. # Test Case 3b, rejected by dbx even if db allows
  93. output = u_boot_console.run_command_list([
  94. 'fatload host 0:1 4000000 db_hello.auth',
  95. 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db'])
  96. assert 'Failed to set EFI variable' not in ''.join(output)
  97. output = u_boot_console.run_command_list([
  98. 'efidebug boot add 1 HELLO host 0:1 /helloworld.efi ""',
  99. 'efidebug boot next 1',
  100. 'bootefi bootmgr'])
  101. assert '\'HELLO\' failed' in ''.join(output)
  102. output = u_boot_console.run_command_list([
  103. 'efidebug boot next 1',
  104. 'efidebug test bootmgr'])
  105. assert 'efi_start_image() returned: 26' in ''.join(output)
  106. assert 'Hello, world!' not in ''.join(output)