From patchwork Tue Jun 9 05:09:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: AKASHI Takahiro X-Patchwork-Id: 1305571 X-Patchwork-Delegate: xypron.glpk@gmx.de Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256 header.s=google header.b=BeoRZot6; dkim-atps=neutral Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 49gyv10Wd3z9sRK for ; Tue, 9 Jun 2020 15:13:17 +1000 (AEST) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 6AB1A81CCE; Tue, 9 Jun 2020 07:11:18 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="BeoRZot6"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 01D1D81CC7; Tue, 9 Jun 2020 07:11:13 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,SPF_HELO_NONE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pg1-x52b.google.com (mail-pg1-x52b.google.com [IPv6:2607:f8b0:4864:20::52b]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 7B2C381969 for ; Tue, 9 Jun 2020 07:11:09 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=takahiro.akashi@linaro.org Received: by mail-pg1-x52b.google.com with SMTP id o8so9779384pgm.7 for ; Mon, 08 Jun 2020 22:11:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dt0r+rzS6D40KUGh9LPujqS+VYPT+4XC/5O/OdJkzEA=; b=BeoRZot6rKxkcZO673BKS6lvZMN5o+F1LdZ/AlfL3GpZ5gjrN3XHouAiw/QoaDAvGQ ZL78MatM4cZOlGFRgrxJHF1K18DDDqs6j9OGhg5cwnbSiwOpKedveIYNh0NuCOTLKyiF qeKXgwSBM4CKLr7VzBY+f+Tj4fWjn6tvuCnf204a5rqCRGb2XTFIgQIIdSVBLQQslKjw GCZAMv8qsQFzLF4cdIFsEVpmrc/68I9ruvMW/1UBB41iRauD8v18AcS5AqXdvK+bPq2b rc4Ow60szLKZD1rjDsqK8vP19zKKqgaMxWZZDh5Wrc7WmsQi5SoGfTzcJH/XWEx8Alwq XaAg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dt0r+rzS6D40KUGh9LPujqS+VYPT+4XC/5O/OdJkzEA=; b=DOchPZni3GHkUDUFiV/P5Y974l3jAKX/fBxzDUVCWOKIamVpGOZDOcX90zfGkHHAtX OSZRUpJ4JMyN3nOZ2m/1Y7By9VQo+hOJecv1ETBhi4mDfQuR7MBGMeLxjcPL5zgVq/7d Atd1Bv7r2NS/FVMkaWKbpkyeY/1t2nfAw8vTMwjWXZnqdrSpDjSCdTOTVeZX4feFbwxB zGbjDnMqarbSQBrjERv5E2+UEV2FIUkn19uLMH1nKCMTM7kXKBF2Jn+ovAdnSK6hJ1on 1878oiEWR39dV3lhNLVAH2e7rV00OzXWuHYVLsgkH9U5LA1/JwhAn4YrpKj98UYywGXR xlFg== X-Gm-Message-State: AOAM531K+Q9jsajyCCVp/NV4yTi7kauPiKhz0qlpr+KQN4w4pVh97FtE ksK0sprwa2Q+EIGRS+ZOFCeYjw== X-Google-Smtp-Source: ABdhPJzt9mEsDP5LQzSgy75udJZE2720CyXy0q9NsIuFxZh8fGARQb4AZsMFj+xF2Komo+Iz3HN92A== X-Received: by 2002:a63:cc12:: with SMTP id x18mr22603476pgf.140.1591679467793; Mon, 08 Jun 2020 22:11:07 -0700 (PDT) Received: from localhost.localdomain (p6e421564.tkyea130.ap.so-net.ne.jp. [110.66.21.100]) by smtp.gmail.com with ESMTPSA id p11sm8958611pfq.10.2020.06.08.22.11.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 Jun 2020 22:11:07 -0700 (PDT) From: AKASHI Takahiro To: xypron.glpk@gmx.de, agraf@csgraf.de Cc: sughosh.ganu@linaro.org, mail@patrick-wildt.de, u-boot@lists.denx.de, AKASHI Takahiro Subject: [PATCH v2 15/17] test/py: efi_secboot: add a test against certificate revocation Date: Tue, 9 Jun 2020 14:09:45 +0900 Message-Id: <20200609050947.17861-16-takahiro.akashi@linaro.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609050947.17861-1-takahiro.akashi@linaro.org> References: <20200609050947.17861-1-takahiro.akashi@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.30rc1 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.102.2 at phobos.denx.de X-Virus-Status: Clean Revocation database (dbx) may have not only certificates, but also message digests of certificates with revocation time (EFI_CERT_X509_SHA256_GUILD). In this test case, if the database has such a digest and if the value matches to a certificate that created a given image's signature, authentication should fail. Signed-off-by: AKASHI Takahiro --- test/py/tests/test_efi_secboot/conftest.py | 6 ++++- test/py/tests/test_efi_secboot/test_signed.py | 26 +++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/test/py/tests/test_efi_secboot/conftest.py b/test/py/tests/test_efi_secboot/conftest.py index 5d99b8b7189e..13687a2da1a6 100644 --- a/test/py/tests/test_efi_secboot/conftest.py +++ b/test/py/tests/test_efi_secboot/conftest.py @@ -103,12 +103,16 @@ def efi_boot_env(request, u_boot_config): ## db1-update check_call('cd %s; %ssign-efi-sig-list -a -c KEK.crt -k KEK.key db db1.esl db1-update.auth' % (mnt_point, EFITOOLS_PATH), shell=True) - ## dbx + ## dbx (TEST_dbx certificate) check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_dbx/ -keyout dbx.key -out dbx.crt -nodes -days 365' % mnt_point, shell=True) check_call('cd %s; %scert-to-efi-sig-list -g %s dbx.crt dbx.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key dbx dbx.esl dbx.auth' % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), shell=True) + ## dbx_hash (digest of TEST_db certificate) + check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 256 db.crt dbx_hash.crl; %ssign-efi-sig-list -c KEK.crt -k KEK.key dbx dbx_hash.crl dbx_hash.auth' + % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH), + shell=True) # Copy image check_call('cp %s %s' % (HELLO_PATH, mnt_point), shell=True) diff --git a/test/py/tests/test_efi_secboot/test_signed.py b/test/py/tests/test_efi_secboot/test_signed.py index 5267b7ab4e86..21ae2bc5ed48 100644 --- a/test/py/tests/test_efi_secboot/test_signed.py +++ b/test/py/tests/test_efi_secboot/test_signed.py @@ -121,3 +121,29 @@ class TestEfiSignedImage(object): 'efidebug test bootmgr']) assert('\'HELLO\' failed' in ''.join(output)) assert('efi_start_image() returned: 26' in ''.join(output)) + + def test_efi_signed_image_auth4(self, u_boot_console, efi_boot_env): + """ + Test Case 4 - revoked by dbx (digest of TEST_db certificate in dbx) + """ + u_boot_console.restart_uboot() + disk_img = efi_boot_env + with u_boot_console.log.section('Test Case 4'): + # Test Case 4, rejected by dbx + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'fatload host 0:1 4000000 dbx_hash.auth', + 'setenv -e -nv -bs -rt -at -i 4000000,$filesize dbx', + 'fatload host 0:1 4000000 db.auth', + 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db', + 'fatload host 0:1 4000000 KEK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK', + 'fatload host 0:1 4000000 PK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK']) + assert(not 'Failed to set EFI variable' in ''.join(output)) + output = u_boot_console.run_command_list([ + 'efidebug boot add 1 HELLO host 0:1 /helloworld.efi.signed ""', + 'efidebug boot next 1', + 'efidebug test bootmgr']) + assert('\'HELLO\' failed' in ''.join(output)) + assert('efi_start_image() returned: 26' in ''.join(output))