From patchwork Fri May 29 06:41:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: AKASHI Takahiro X-Patchwork-Id: 1300450 X-Patchwork-Delegate: xypron.glpk@gmx.de Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256 header.s=google header.b=JoouyUBC; dkim-atps=neutral Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49YFQr1FNnz9sSn for ; Fri, 29 May 2020 16:44:04 +1000 (AEST) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 68E3281CE9; Fri, 29 May 2020 08:43:07 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="JoouyUBC"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id BD9D981CE5; Fri, 29 May 2020 08:42:46 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pf1-x441.google.com (mail-pf1-x441.google.com [IPv6:2607:f8b0:4864:20::441]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id DFAD281CA2 for ; Fri, 29 May 2020 08:42:42 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=takahiro.akashi@linaro.org Received: by mail-pf1-x441.google.com with SMTP id y198so816851pfb.4 for ; Thu, 28 May 2020 23:42:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=A9JCm3kKnelFRwxC65dJQQg0lHImpbfe39sp1tihZXY=; b=JoouyUBCgOrFds+kVvp6xwW+tMSLGIw8a51jLH71202ICqCx6/Sgfvm/EEh0yaGhm0 Lhlk6JEtQpJE/iTaECBvSq5HHtTKiTixw51TdbUHP1MCPfdCDP+uLo3zDeLtkQOrOFPD 6sEIMa884Ptr8NX3ecH+yQirU0AXILQmEKCXOKKRVO1/WmqvP3eWmWlfPlOl94xjFvHr aSL6YclvAVE99fEt0MCfQfUyfEeXUNrHpTSViJJTOUnoYEsmaoANk+TVFiX/AKfrX6Uq SGw03TErZ/xJEC1lXxqKFb28pIUwVf8JjjMw703CZ8KpbopLaRvFMzfxj4HM53WE/D3L Yiyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=A9JCm3kKnelFRwxC65dJQQg0lHImpbfe39sp1tihZXY=; b=rd5VlLhUyuyVvrcpX40Fqd92VqIKbXVwGnIxVkAGlHLlPzWbwespWD+7SooRNnRu9d 28Hle3y0HPVMovvbI8q/gGi1QzH61/jVVewLQSryiqwEhBp6YZIJKfpnBtCKuGmhvlAp Tl9id1GkORhs6WqOKqlMgZqaJo2Wbl/Dfu7N1SF0TbNvpsxcWB/mcvYsdw5J4D+bVj/d wMerrPwPVA6i4wZeF6Wb3j+qoM9miVcvUjz81Wd2R8JQtH+/ASiSNKIsq/oQHbkKOQL7 gliiHQcHXrxQbYsaofcfusG//UCAxk6XHLzf5OuyWf9yyEW60QpOKe+bnpv7Qqze7Z1+ okjw== X-Gm-Message-State: AOAM530Lxiwufu4N5odLyXRwhW7w1lkzjM5GwrWeLSyTtuZ2+M/6Te+H SxOrVjPbZX5DrxQdcGsgaQOLZA== X-Google-Smtp-Source: ABdhPJxtVLp7BubZfHfttNwhzgilN31A3Ro0JrQ8s5wRCZSEDQZvNHhvzj+ai1JN8LiA8bHk/1CCOg== X-Received: by 2002:a63:9347:: with SMTP id w7mr6647134pgm.409.1590734561369; Thu, 28 May 2020 23:42:41 -0700 (PDT) Received: from localhost.localdomain (pdb6272d5.tkyea130.ap.so-net.ne.jp. [219.98.114.213]) by smtp.gmail.com with ESMTPSA id q5sm6483128pfl.199.2020.05.28.23.42.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 May 2020 23:42:40 -0700 (PDT) From: AKASHI Takahiro To: xypron.glpk@gmx.de, agraf@csgraf.de Cc: sughosh.ganu@linaro.org, mail@patrick-wildt.de, u-boot@lists.denx.de, AKASHI Takahiro Subject: [PATCH 10/13] test/py: efi_secboot: split "signed image" test case-1 into two cases Date: Fri, 29 May 2020 15:41:27 +0900 Message-Id: <20200529064130.28332-11-takahiro.akashi@linaro.org> X-Mailer: git-send-email 2.25.2 In-Reply-To: <20200529064130.28332-1-takahiro.akashi@linaro.org> References: <20200529064130.28332-1-takahiro.akashi@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.30rc1 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.2 at phobos.denx.de X-Virus-Status: Clean Split the existing test case-1 into case1 and a new case-2: case-1 for non-SecureBoot mode; case-2 for SecureBoot mode. In addition, one corner case is added to case-2; a image is signed but a corresponding certificate is not yet installed in "db." Signed-off-by: AKASHI Takahiro --- test/py/tests/test_efi_secboot/test_signed.py | 98 ++++++++++--------- 1 file changed, 54 insertions(+), 44 deletions(-) diff --git a/test/py/tests/test_efi_secboot/test_signed.py b/test/py/tests/test_efi_secboot/test_signed.py index 19d78b1b64e0..5267b7ab4e86 100644 --- a/test/py/tests/test_efi_secboot/test_signed.py +++ b/test/py/tests/test_efi_secboot/test_signed.py @@ -20,12 +20,12 @@ from defs import * class TestEfiSignedImage(object): def test_efi_signed_image_auth1(self, u_boot_console, efi_boot_env): """ - Test Case 1 - authenticated by db + Test Case 1 - Secure boot is not in force """ u_boot_console.restart_uboot() disk_img = efi_boot_env with u_boot_console.log.section('Test Case 1a'): - # Test Case 1a, run signed image if no db/dbx + # Test Case 1a, run signed image if no PK output = u_boot_console.run_command_list([ 'host bind 0 %s' % disk_img, 'efidebug boot add 1 HELLO1 host 0:1 /helloworld.efi.signed ""', @@ -34,48 +34,66 @@ class TestEfiSignedImage(object): assert('Hello, world!' in ''.join(output)) with u_boot_console.log.section('Test Case 1b'): - # Test Case 1b, run unsigned image if no db/dbx + # Test Case 1b, run unsigned image if no PK output = u_boot_console.run_command_list([ 'efidebug boot add 2 HELLO2 host 0:1 /helloworld.efi ""', 'efidebug boot next 2', 'bootefi bootmgr']) assert('Hello, world!' in ''.join(output)) - with u_boot_console.log.section('Test Case 1c'): - # Test Case 1c, not authenticated by db - output = u_boot_console.run_command_list([ - 'fatload host 0:1 4000000 db.auth', - 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db', - 'fatload host 0:1 4000000 KEK.auth', - 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', - 'fatload host 0:1 4000000 PK.auth', - 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK']) - assert(not 'Failed to set EFI variable' in ''.join(output)) - output = u_boot_console.run_command_list([ - 'efidebug boot next 2', - 'bootefi bootmgr']) - assert('\'HELLO2\' failed' in ''.join(output)) - output = u_boot_console.run_command_list([ - 'efidebug boot next 2', - 'efidebug test bootmgr']) - assert('efi_start_image() returned: 26' in ''.join(output)) - assert(not 'Hello, world!' in ''.join(output)) - - with u_boot_console.log.section('Test Case 1d'): - # Test Case 1d, authenticated by db - output = u_boot_console.run_command_list([ - 'efidebug boot next 1', - 'bootefi bootmgr']) - assert('Hello, world!' in ''.join(output)) - def test_efi_signed_image_auth2(self, u_boot_console, efi_boot_env): """ - Test Case 2 - rejected by dbx + Test Case 2 - Secure boot is in force, + authenticated by db (TEST_db certificate in db) """ u_boot_console.restart_uboot() disk_img = efi_boot_env with u_boot_console.log.section('Test Case 2a'): - # Test Case 2a, rejected by dbx + # Test Case 2a, db is not yet installed + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'fatload host 0:1 4000000 KEK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', + 'fatload host 0:1 4000000 PK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK']) + assert(not 'Failed to set EFI variable' in ''.join(output)) + output = u_boot_console.run_command_list([ + 'efidebug boot add 1 HELLO1 host 0:1 /helloworld.efi.signed ""', + 'efidebug boot next 1', + 'efidebug test bootmgr']) + assert('\'HELLO1\' failed' in ''.join(output)) + assert('efi_start_image() returned: 26' in ''.join(output)) + output = u_boot_console.run_command_list([ + 'efidebug boot add 2 HELLO2 host 0:1 /helloworld.efi ""', + 'efidebug boot next 2', + 'efidebug test bootmgr']) + assert('\'HELLO2\' failed' in ''.join(output)) + assert('efi_start_image() returned: 26' in ''.join(output)) + + with u_boot_console.log.section('Test Case 2b'): + # Test Case 2b, authenticated by db + output = u_boot_console.run_command_list([ + 'fatload host 0:1 4000000 db.auth', + 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db']) + assert(not 'Failed to set EFI variable' in ''.join(output)) + output = u_boot_console.run_command_list([ + 'efidebug boot next 2', + 'efidebug test bootmgr']) + assert('\'HELLO2\' failed' in ''.join(output)) + assert('efi_start_image() returned: 26' in ''.join(output)) + output = u_boot_console.run_command_list([ + 'efidebug boot next 1', + 'bootefi bootmgr']) + assert('Hello, world!' in ''.join(output)) + + def test_efi_signed_image_auth3(self, u_boot_console, efi_boot_env): + """ + Test Case 3 - rejected by dbx (TEST_db certificate in dbx) + """ + u_boot_console.restart_uboot() + disk_img = efi_boot_env + with u_boot_console.log.section('Test Case 3a'): + # Test Case 3a, rejected by dbx output = u_boot_console.run_command_list([ 'host bind 0 %s' % disk_img, 'fatload host 0:1 4000000 db.auth', @@ -87,27 +105,19 @@ class TestEfiSignedImage(object): assert(not 'Failed to set EFI variable' in ''.join(output)) output = u_boot_console.run_command_list([ 'efidebug boot add 1 HELLO host 0:1 /helloworld.efi.signed ""', - 'efidebug boot next 1', - 'bootefi bootmgr']) - assert('\'HELLO\' failed' in ''.join(output)) - output = u_boot_console.run_command_list([ 'efidebug boot next 1', 'efidebug test bootmgr']) + assert('\'HELLO\' failed' in ''.join(output)) assert('efi_start_image() returned: 26' in ''.join(output)) - assert(not 'Hello, world!' in ''.join(output)) - with u_boot_console.log.section('Test Case 2b'): - # Test Case 2b, rejected by dbx even if db allows + with u_boot_console.log.section('Test Case 3b'): + # Test Case 3b, rejected by dbx even if db allows output = u_boot_console.run_command_list([ 'fatload host 0:1 4000000 db.auth', 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db']) assert(not 'Failed to set EFI variable' in ''.join(output)) - output = u_boot_console.run_command_list([ - 'efidebug boot next 1', - 'bootefi bootmgr']) - assert('\'HELLO\' failed' in ''.join(output)) output = u_boot_console.run_command_list([ 'efidebug boot next 1', 'efidebug test bootmgr']) + assert('\'HELLO\' failed' in ''.join(output)) assert('efi_start_image() returned: 26' in ''.join(output)) - assert(not 'Hello, world!' in ''.join(output))