@@ -102,7 +102,7 @@ def test_fit_ecdsa(ubman):
with open(key_file, 'w') as f:
f.write(key.export_key(format='PEM'))
- assemble_fit_image(fit_file, f'{datadir}/sign-images-sha256.its', tempdir)
+ assemble_fit_image(fit_file, f'{datadir}/sign-images-sha256-rsa2048.its', tempdir)
fit = SignableFitImage(ubman, fit_file)
nodes = fit.find_signable_image_nodes()
@@ -84,21 +84,21 @@ def make_fit(its, ubman, mkimage, dtc_args, datadir, fit):
# Only run the full suite on a few combinations, since it doesn't add any more
# test coverage.
TESTDATA_IN = [
- ['sha1-basic', 'sha1', '', None, False, True, False, False],
- ['sha1-pad', 'sha1', '', '-E -p 0x10000', False, False, False, False],
- ['sha1-pss', 'sha1', '-pss', None, False, False, False, False],
- ['sha1-pss-pad', 'sha1', '-pss', '-E -p 0x10000', False, False, False, False],
- ['sha256-basic', 'sha256', '', None, False, False, False, False],
- ['sha256-pad', 'sha256', '', '-E -p 0x10000', False, False, False, False],
- ['sha256-pss', 'sha256', '-pss', None, False, False, False, False],
- ['sha256-pss-pad', 'sha256', '-pss', '-E -p 0x10000', False, False, False, False],
- ['sha256-pss-required', 'sha256', '-pss', None, True, False, False, False],
- ['sha256-pss-pad-required', 'sha256', '-pss', '-E -p 0x10000', True, True, False, False],
- ['sha384-basic', 'sha384', '', None, False, False, False, False],
- ['sha384-pad', 'sha384', '', '-E -p 0x10000', False, False, False, False],
- ['algo-arg', 'algo-arg', '', '-o sha256,rsa2048', False, False, True, False],
- ['sha256-global-sign', 'sha256', '', '', False, False, False, True],
- ['sha256-global-sign-pss', 'sha256', '-pss', '', False, False, False, True],
+ ['sha1-basic', 'sha1', '-rsa2048', '', None, False, True, False, False],
+ ['sha1-pad', 'sha1', '-rsa2048', '', '-E -p 0x10000', False, False, False, False],
+ ['sha1-pss', 'sha1', '-rsa2048', '-pss', None, False, False, False, False],
+ ['sha1-pss-pad', 'sha1', '-rsa2048', '-pss', '-E -p 0x10000', False, False, False, False],
+ ['sha256-basic', 'sha256', '-rsa2048', '', None, False, False, False, False],
+ ['sha256-pad', 'sha256', '-rsa2048', '', '-E -p 0x10000', False, False, False, False],
+ ['sha256-pss', 'sha256', '-rsa2048', '-pss', None, False, False, False, False],
+ ['sha256-pss-pad', 'sha256', '-rsa2048', '-pss', '-E -p 0x10000', False, False, False, False],
+ ['sha256-pss-required', 'sha256', '-rsa2048', '-pss', None, True, False, False, False],
+ ['sha256-pss-pad-required', 'sha256', '-rsa2048', '-pss', '-E -p 0x10000', True, True, False, False],
+ ['sha384-basic', 'sha384', '-rsa3072', '', None, False, False, False, False],
+ ['sha384-pad', 'sha384', '-rsa3072', '', '-E -p 0x10000', False, False, False, False],
+ ['algo-arg', 'algo-arg', '', '', '-o sha256,rsa2048', False, False, True, False],
+ ['sha256-global-sign', 'sha256', '-rsa2048', '', '', False, False, False, True],
+ ['sha256-global-sign-pss', 'sha256', '-rsa2048', '-pss', '', False, False, False, True],
]
# Mark all but the first test as slow, so they are not run with '-k not slow'
@@ -111,9 +111,9 @@ TESTDATA += [pytest.param(*v, marks=pytest.mark.slow) for v in TESTDATA_IN[1:]]
@pytest.mark.requiredtool('fdtget')
@pytest.mark.requiredtool('fdtput')
@pytest.mark.requiredtool('openssl')
-@pytest.mark.parametrize("name,sha_algo,padding,sign_options,required,full_test,algo_arg,global_sign",
+@pytest.mark.parametrize("name,sha_algo,sig_algo,padding,sign_options,required,full_test,algo_arg,global_sign",
TESTDATA)
-def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
+def test_vboot(ubman, name, sha_algo, sig_algo, padding, sign_options, required,
full_test, algo_arg, global_sign):
"""Test verified boot signing with mkimage and verification with 'bootm'.
@@ -287,7 +287,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
utils.run_and_log(ubman, 'openssl req -batch -new -x509 -key %s%s.key '
'-out %s%s.crt' % (tmpdir, name, tmpdir, name))
- def test_with_algo(sha_algo, padding, sign_options):
+ def test_with_algo(sha_algo, sig_algo, padding, sign_options):
"""Test verified boot with the given hash algorithm.
This is the main part of the test code. The same procedure is followed
@@ -308,7 +308,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
# Build the FIT, but don't sign anything yet
ubman.log.action('%s: Test FIT with signed images' % sha_algo)
- make_fit('sign-images-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
+ make_fit('sign-images-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
run_bootm(sha_algo, 'unsigned images', ' - OK' if algo_arg else 'dev-', True)
# Sign images with our dev keys
@@ -319,7 +319,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
dtc('sandbox-u-boot.dts', ubman, dtc_args, datadir, tmpdir, dtb)
ubman.log.action('%s: Test FIT with signed configuration' % sha_algo)
- make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
+ make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
run_bootm(sha_algo, 'unsigned config', '%s+ OK' % ('sha256' if algo_arg else sha_algo), True)
# Sign images with our dev keys
@@ -390,7 +390,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
run_bootm(sha_algo, 'evil clone', 'Bad Data Hash', False, efit)
# Create a new properly signed fit and replace header bytes
- make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
+ make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
sign_fit(sha_algo, sign_options)
bcfg = ubman.config.buildconfig
max_size = int(bcfg.get('config_fit_signature_max_size', 0x10000000), 0)
@@ -424,7 +424,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
# Create a new properly signed fit and replace hashed-strings
# size property
- make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
+ make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
sign_fit(sha_algo, sign_options)
utils.run_and_log(ubman, 'fdtput -t x %s %s hashed-strings 0' %
(fit, sig_node))
@@ -448,7 +448,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
'Bad Data Hash', False)
ubman.log.action('%s: Check in-bounds hashed-strings size' % sha_algo)
- def test_required_key(sha_algo, padding, sign_options):
+ def test_required_key(sha_algo, sig_algo, padding, sign_options):
"""Test verified boot with the given hash algorithm.
This function tests if U-Boot rejects an image when a required key isn't
@@ -470,12 +470,12 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
# Build the FIT with prod key (keys required) and sign it. This puts the
# signature into sandbox-u-boot.dtb, marked 'required'
- make_fit('sign-configs-%s%s-prod.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
+ make_fit('sign-configs-%s%s%s-prod.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
sign_fit(sha_algo, sign_options)
# Build the FIT with dev key (keys NOT required). This adds the
# signature into sandbox-u-boot.dtb, NOT marked 'required'.
- make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
+ make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
sign_fit_norequire(sha_algo, sign_options)
# So now sandbox-u-boot.dtb two signatures, for the prod and dev keys.
@@ -487,7 +487,7 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
# Build the FIT with dev key (keys required) and sign it. This puts the
# signature into sandbox-u-boot.dtb, marked 'required'.
- make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
+ make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
sign_fit(sha_algo, sign_options)
# Set the required-mode policy to "any".
@@ -567,8 +567,9 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
dtb = '%ssandbox-u-boot.dtb' % tmpdir
sig_node = '/configurations/conf-1/signature'
- create_rsa_pair('dev')
- create_rsa_pair('prod')
+ if sig_algo == "-rsa2048" or sig_algo == "-rsa3072" or sig_algo == "":
+ create_rsa_pair('dev')
+ create_rsa_pair('prod')
# Create a number kernel image with zeroes
with open('%stest-kernel.bin' % tmpdir, 'wb') as fd:
@@ -587,9 +588,9 @@ def test_vboot(ubman, name, sha_algo, padding, sign_options, required,
if global_sign:
test_global_sign(sha_algo, padding, sign_options)
elif required:
- test_required_key(sha_algo, padding, sign_options)
+ test_required_key(sha_algo, sig_algo, padding, sign_options)
else:
- test_with_algo(sha_algo, padding, sign_options)
+ test_with_algo(sha_algo, sig_algo, padding, sign_options)
finally:
# Go back to the original U-Boot with the correct dtb.
ubman.config.dtb = old_dtb
@@ -616,6 +617,7 @@ def test_vboot_ext_data_bounds(ubman):
by U-Boot to hold public keys from the signing process.
"""
sha_algo = 'sha256'
+ sig_algo = '-rsa2048'
def run_bootm(test_type, expect_string):
"""Run a 'bootm' command in U-Boot and expect it to fail.
@@ -684,7 +686,7 @@ def test_vboot_ext_data_bounds(ubman):
sign_fit() overwrites the FIT, so a new one is built before each test
case mutates its external-data properties.
"""
- make_fit('sign-configs-%s.its' % sha_algo, ubman, mkimage, dtc_args,
+ make_fit('sign-configs-%s%s.its' % (sha_algo, sig_algo), ubman, mkimage, dtc_args,
datadir, fit)
sign_fit('-E')
@@ -762,21 +764,21 @@ def test_vboot_ext_data_bounds(ubman):
TESTDATA_IN = [
- ['sha1-basic', 'sha1', '', None, False],
- ['sha1-pad', 'sha1', '', '-E -p 0x10000', False],
- ['sha1-pss', 'sha1', '-pss', None, False],
- ['sha1-pss-pad', 'sha1', '-pss', '-E -p 0x10000', False],
- ['sha256-basic', 'sha256', '', None, False],
- ['sha256-pad', 'sha256', '', '-E -p 0x10000', False],
- ['sha256-pss', 'sha256', '-pss', None, False],
- ['sha256-pss-pad', 'sha256', '-pss', '-E -p 0x10000', False],
- ['sha256-pss-required', 'sha256', '-pss', None, False],
- ['sha256-pss-pad-required', 'sha256', '-pss', '-E -p 0x10000', False],
- ['sha384-basic', 'sha384', '', None, False],
- ['sha384-pad', 'sha384', '', '-E -p 0x10000', False],
- ['algo-arg', 'algo-arg', '', '-o sha256,rsa2048', True],
- ['sha256-global-sign', 'sha256', '', '', False],
- ['sha256-global-sign-pss', 'sha256', '-pss', '', False],
+ ['sha1-basic', 'sha1', '-rsa2048', '', None, False],
+ ['sha1-pad', 'sha1', '-rsa2048', '', '-E -p 0x10000', False],
+ ['sha1-pss', 'sha1', '-rsa2048', '-pss', None, False],
+ ['sha1-pss-pad', 'sha1', '-rsa2048', '-pss', '-E -p 0x10000', False],
+ ['sha256-basic', 'sha256', '-rsa2048', '', None, False],
+ ['sha256-pad', 'sha256', '-rsa2048', '', '-E -p 0x10000', False],
+ ['sha256-pss', 'sha256', '-rsa2048', '-pss', None, False],
+ ['sha256-pss-pad', 'sha256', '-rsa2048', '-pss', '-E -p 0x10000', False],
+ ['sha256-pss-required', 'sha256', '-rsa2048', '-pss', None, False],
+ ['sha256-pss-pad-required', 'sha256', '-rsa2048' , '-pss', '-E -p 0x10000', False],
+ ['sha384-basic', 'sha384', '-rsa3072', '', None, False],
+ ['sha384-pad', 'sha384', '-rsa3072', '', '-E -p 0x10000', False],
+ ['algo-arg', 'algo-arg', '', '', '-o sha256,rsa2048', True],
+ ['sha256-global-sign', 'sha256', '-rsa2048', '', '', False],
+ ['sha256-global-sign-pss', 'sha256', '-rsa2048', '-pss', '', False],
]
# Mark all but the first test as slow, so they are not run with '-k not slow'
@@ -787,8 +789,8 @@ TESTDATA += [pytest.param(*v, marks=pytest.mark.slow) for v in TESTDATA_IN[1:]]
@pytest.mark.buildconfigspec('fit_signature')
@pytest.mark.requiredtool('dtc')
@pytest.mark.requiredtool('openssl')
-@pytest.mark.parametrize("name,sha_algo,padding,sign_options,algo_arg", TESTDATA)
-def test_fdt_add_pubkey(ubman, name, sha_algo, padding, sign_options, algo_arg):
+@pytest.mark.parametrize("name,sha_algo,sig_algo,padding,sign_options,algo_arg", TESTDATA)
+def test_fdt_add_pubkey(ubman, name, sha_algo, sig_algo, padding, sign_options, algo_arg):
"""Test fdt_add_pubkey utility with bunch of different algo options."""
def sign_fit(sha_algo, options):
@@ -807,7 +809,7 @@ def test_fdt_add_pubkey(ubman, name, sha_algo, padding, sign_options, algo_arg):
ubman.log.action('%s: Sign images' % sha_algo)
utils.run_and_log(ubman, args)
- def test_add_pubkey(sha_algo, padding, sign_options):
+ def test_add_pubkey(sha_algo, sig_algo, padding, sign_options):
"""Test fdt_add_pubkey utility with given hash algorithm and padding.
This function tests if fdt_add_pubkey utility may add public keys into dtb.
@@ -830,7 +832,7 @@ def test_fdt_add_pubkey(ubman, name, sha_algo, padding, sign_options, algo_arg):
'rsa3072' if sha_algo == 'sha384' else 'rsa2048'),
'-k', tmpdir, '-n', 'dev', '-r', 'conf', dtb])
- make_fit('sign-configs-%s%s.its' % (sha_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
+ make_fit('sign-configs-%s%s%s.its' % (sha_algo, sig_algo, padding), ubman, mkimage, dtc_args, datadir, fit)
# Sign images with our dev keys
sign_fit(sha_algo, sign_options)
@@ -852,4 +854,4 @@ def test_fdt_add_pubkey(ubman, name, sha_algo, padding, sign_options, algo_arg):
# keys created in test_vboot test
- test_add_pubkey(sha_algo, padding, sign_options)
+ test_add_pubkey(sha_algo, sig_algo, padding, sign_options)
similarity index 100%
rename from test/py/tests/vboot/sign-configs-sha1-pss.its
rename to test/py/tests/vboot/sign-configs-sha1-rsa2048-pss.its
similarity index 100%
rename from test/py/tests/vboot/sign-configs-sha1.its
rename to test/py/tests/vboot/sign-configs-sha1-rsa2048.its
similarity index 100%
rename from test/py/tests/vboot/sign-configs-sha256-pss-prod.its
rename to test/py/tests/vboot/sign-configs-sha256-rsa2048-pss-prod.its
similarity index 100%
rename from test/py/tests/vboot/sign-configs-sha256-pss.its
rename to test/py/tests/vboot/sign-configs-sha256-rsa2048-pss.its
similarity index 100%
rename from test/py/tests/vboot/sign-configs-sha256.its
rename to test/py/tests/vboot/sign-configs-sha256-rsa2048.its
similarity index 100%
rename from test/py/tests/vboot/sign-configs-sha384.its
rename to test/py/tests/vboot/sign-configs-sha384-rsa3072.its
similarity index 100%
rename from test/py/tests/vboot/sign-images-sha1-pss.its
rename to test/py/tests/vboot/sign-images-sha1-rsa2048-pss.its
similarity index 100%
rename from test/py/tests/vboot/sign-images-sha1.its
rename to test/py/tests/vboot/sign-images-sha1-rsa2048.its
similarity index 100%
rename from test/py/tests/vboot/sign-images-sha256-pss.its
rename to test/py/tests/vboot/sign-images-sha256-rsa2048-pss.its
similarity index 100%
rename from test/py/tests/vboot/sign-images-sha256.its
rename to test/py/tests/vboot/sign-images-sha256-rsa2048.its
similarity index 100%
rename from test/py/tests/vboot/sign-images-sha384.its
rename to test/py/tests/vboot/sign-images-sha384-rsa3072.its