Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 | # SPDX-License-Identifier: GPL-2.0+ # Copyright (c) 2020, Linaro Limited # Author: AKASHI Takahiro <takahiro.akashi@linaro.org> # # U-Boot UEFI: Image Authentication Test (signature with certificates chain) """ This test verifies image authentication for a signed image which is signed by user certificate and contains additional intermediate certificates in its signature. """ import pytest @pytest.mark.boardspec('sandbox') @pytest.mark.buildconfigspec('efi_secure_boot') @pytest.mark.buildconfigspec('cmd_efidebug') @pytest.mark.buildconfigspec('cmd_fat') @pytest.mark.buildconfigspec('cmd_nvedit_efi') @pytest.mark.slow @pytest.mark.restart class TestEfiSignedImageIntca(object): def test_efi_signed_image_intca1(self, ubman, efi_boot_env_intca): """ Test Case 1 - authenticated by root CA in db """ ubman.restart_uboot() disk_img = efi_boot_env_intca with ubman.log.section('Test Case 1a'): # Test Case 1a, with no Int CA and not authenticated by root CA output = ubman.run_command_list([ 'host bind 0 %s' % disk_img, 'fatload host 0:1 4000000 db_c.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db', 'fatload host 0:1 4000000 KEK.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK', 'fatload host 0:1 4000000 PK.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK']) assert 'Failed to set EFI variable' not in ''.join(output) output = ubman.run_command_list([ 'efidebug boot add -b 1 HELLO_a host 0:1 /helloworld.efi.signed_a -s ""', 'efidebug boot order 1', 'efidebug test bootmgr']) assert '\'HELLO_a\' failed' in ''.join(output) assert 'efi_bootmgr_load() returned: 26' in ''.join(output) with ubman.log.section('Test Case 1b'): # Test Case 1b, signed and authenticated by root CA output = ubman.run_command_list([ 'efidebug boot add -b 2 HELLO_ab host 0:1 /helloworld.efi.signed_ab -s ""', 'efidebug boot order 2', 'bootefi bootmgr']) assert 'Hello, world!' in ''.join(output) def test_efi_signed_image_intca2(self, ubman, efi_boot_env_intca): """ Test Case 2 - authenticated by root CA in db """ ubman.restart_uboot() disk_img = efi_boot_env_intca with ubman.log.section('Test Case 2a'): # Test Case 2a, unsigned and not authenticated by root CA output = ubman.run_command_list([ 'host bind 0 %s' % disk_img, 'fatload host 0:1 4000000 KEK.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK', 'fatload host 0:1 4000000 PK.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK']) assert 'Failed to set EFI variable' not in ''.join(output) output = ubman.run_command_list([ 'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc -s ""', 'efidebug boot order 1', 'efidebug test bootmgr']) assert '\'HELLO_abc\' failed' in ''.join(output) assert 'efi_bootmgr_load() returned: 26' in ''.join(output) with ubman.log.section('Test Case 2b'): # Test Case 2b, signed and authenticated by root CA output = ubman.run_command_list([ 'fatload host 0:1 4000000 db_b.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db', 'efidebug boot order 1', 'efidebug test bootmgr']) assert '\'HELLO_abc\' failed' in ''.join(output) assert 'efi_bootmgr_load() returned: 26' in ''.join(output) with ubman.log.section('Test Case 2c'): # Test Case 2c, signed and authenticated by root CA output = ubman.run_command_list([ 'fatload host 0:1 4000000 db_c.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db', 'efidebug boot order 1', 'efidebug test bootmgr']) assert 'Hello, world!' in ''.join(output) def test_efi_signed_image_intca3(self, ubman, efi_boot_env_intca): """ Test Case 3 - revoked by dbx """ ubman.restart_uboot() disk_img = efi_boot_env_intca with ubman.log.section('Test Case 3a'): # Test Case 3a, revoked by int CA in dbx output = ubman.run_command_list([ 'host bind 0 %s' % disk_img, 'fatload host 0:1 4000000 dbx_b.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx', 'fatload host 0:1 4000000 db_c.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db', 'fatload host 0:1 4000000 KEK.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK', 'fatload host 0:1 4000000 PK.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK']) assert 'Failed to set EFI variable' not in ''.join(output) output = ubman.run_command_list([ 'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc -s ""', 'efidebug boot order 1', 'efidebug test bootmgr']) assert 'Hello, world!' in ''.join(output) # Or, # assert '\'HELLO_abc\' failed' in ''.join(output) # assert 'efi_bootmgr_load() returned: 26' in ''.join(output) with ubman.log.section('Test Case 3b'): # Test Case 3b, revoked by root CA in dbx output = ubman.run_command_list([ 'fatload host 0:1 4000000 dbx_c.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx', 'efidebug boot order 1', 'efidebug test bootmgr']) assert '\'HELLO_abc\' failed' in ''.join(output) assert 'efi_bootmgr_load() returned: 26' in ''.join(output) with ubman.log.section('Test Case 3c'): # Test Case 3c, Uninstall PK output = ubman.run_command_list([ 'fatload host 0:1 4000000 PK_null.auth', 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK', 'printenv -e -n PK']) assert 'Failed to set EFI variable' not in ''.join(output) assert '\"PK\" not defined' in ''.join(output) |