Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-12-28 05:53:54 +00:00
Code Issues Projects Releases Packages Wiki Activity
u-boot/test/py/tests/test_efi_secboot/conftest.py

245 lines
14 KiB
Python
Raw Normal View History

efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
# SPDX-License-Identifier: GPL-2.0+
# Copyright (c) 2019, Linaro Limited
# Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
test: fix pydoc issues for EFI tests Fix issues reported by pydocstyle. Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-05-03 05:08:05 +00:00
"""Fixture for UEFI secure boot test."""
test: fix some pylint errors in test_efi_secboot * Remove unused import * Provide module docstring Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2022-10-01 18:55:14 +00:00
from subprocess import call, check_call, CalledProcessError
test/py: efi_secboot: more fixes against pylint More fixes against pylint warnings that autopep8 didn't handle in the previous commit. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:59 +00:00
import pytest
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
from defs import *
@pytest.fixture(scope='session')
def efi_boot_env(request, u_boot_config):
"""Set up a file system to be used in UEFI secure boot test.
Args:
request: Pytest request object.
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
u_boot_config: U-boot configuration.
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
Return:
A path to disk image to be used for testing
"""
image_path = u_boot_config.persistent_data_dir
test/py: efi_secboot: small rework for adding a new test It won't be very useful to customize HELLO_PATH and EFI_SECBOOT_IMAGE_NAME under the current code base. So just remove them. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-21 10:35:23 +00:00
image_path = image_path + '/test_efi_secboot.img'
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
try:
test: use virt-make-fs to build image Avoid sudo for test/py/tests/test_efi_secboot by using virt-make-fs. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 21:05:18 +00:00
mnt_point = u_boot_config.build_dir + '/mnt_efisecure'
check_call('rm -rf {}'.format(mnt_point), shell=True)
test/py: fix test_efi_secboot/conftest.py If udisksctl is present test/py/tests/test_efi_secboot/conftest.py fails because the disk image is never mounted. Normal users can only mount fuse file systems. Unfortunately fusefat is still in an experimental state and seems not to work here correctly. So as we have to be root or use the sudo command anyway delete all coding referring to udisksctl. -- We should not use mount point /mnt as this directory or one of its sub-directories might already be in use as active mount points. Instead create a new directory in the build root as mount point. -- Remove debug print statements that have been commented out. print without parentheses is anyway invalid in Python 3. And pytest anyway filters out the output if there is no exception reported. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-04-21 16:44:39 +00:00
check_call('mkdir -p {}'.format(mnt_point), shell=True)
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
# suffix
# *.key: RSA private key in PEM
# *.crt: X509 certificate (self-signed) in PEM
# *.esl: signature list
# *.hash: message digest of image as signature list
# *.auth: signed signature list in signature database format
# *.efi: UEFI image
# *.efi.signed: signed UEFI image
# Create signature database
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
# PK
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ -keyout PK.key -out PK.crt -nodes -days 365'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% mnt_point, shell=True)
test: correct time stamps for UEFI authentication A time authenticated variable cannot be overwritten with another value with the same time stamp. So we must ensure the correct sequence of time stamps when generating out test data. Using parameter -t for sign-efi-sig-list gives reproducible results and avoids sleep statements. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-02 06:25:46 +00:00
check_call('cd %s; %scert-to-efi-sig-list -g %s PK.crt PK.esl; %ssign-efi-sig-list -t "2020-04-01" -c PK.crt -k PK.key PK PK.esl PK.auth'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# PK_null for deletion
test: correct time stamps for UEFI authentication A time authenticated variable cannot be overwritten with another value with the same time stamp. So we must ensure the correct sequence of time stamps when generating out test data. Using parameter -t for sign-efi-sig-list gives reproducible results and avoids sleep statements. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-02 06:25:46 +00:00
check_call('cd %s; touch PK_null.esl; %ssign-efi-sig-list -t "2020-04-02" -c PK.crt -k PK.key PK PK_null.esl PK_null.auth'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% (mnt_point, EFITOOLS_PATH), shell=True)
# KEK
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ -keyout KEK.key -out KEK.crt -nodes -days 365'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% mnt_point, shell=True)
test: correct time stamps for UEFI authentication A time authenticated variable cannot be overwritten with another value with the same time stamp. So we must ensure the correct sequence of time stamps when generating out test data. Using parameter -t for sign-efi-sig-list gives reproducible results and avoids sleep statements. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-02 06:25:46 +00:00
check_call('cd %s; %scert-to-efi-sig-list -g %s KEK.crt KEK.esl; %ssign-efi-sig-list -t "2020-04-03" -c PK.crt -k PK.key KEK KEK.esl KEK.auth'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# db
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ -keyout db.key -out db.crt -nodes -days 365'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% mnt_point, shell=True)
test: correct time stamps for UEFI authentication A time authenticated variable cannot be overwritten with another value with the same time stamp. So we must ensure the correct sequence of time stamps when generating out test data. Using parameter -t for sign-efi-sig-list gives reproducible results and avoids sleep statements. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-02 06:25:46 +00:00
check_call('cd %s; %scert-to-efi-sig-list -g %s db.crt db.esl; %ssign-efi-sig-list -t "2020-04-04" -c KEK.crt -k KEK.key db db.esl db.auth'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# db1
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db1/ -keyout db1.key -out db1.crt -nodes -days 365'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% mnt_point, shell=True)
test: correct time stamps for UEFI authentication A time authenticated variable cannot be overwritten with another value with the same time stamp. So we must ensure the correct sequence of time stamps when generating out test data. Using parameter -t for sign-efi-sig-list gives reproducible results and avoids sleep statements. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-02 06:25:46 +00:00
check_call('cd %s; %scert-to-efi-sig-list -g %s db1.crt db1.esl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key db db1.esl db1.auth'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
test/py: efi_secboot: fix additional pylint errors This is a fixup by autopep8 after the commit ("test/py: efi_secboot: apply autopep8"). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-20 06:33:39 +00:00
# dbx (TEST_dbx certificate)
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_dbx/ -keyout dbx.key -out dbx.crt -nodes -days 365'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% mnt_point, shell=True)
test: correct time stamps for UEFI authentication A time authenticated variable cannot be overwritten with another value with the same time stamp. So we must ensure the correct sequence of time stamps when generating out test data. Using parameter -t for sign-efi-sig-list gives reproducible results and avoids sleep statements. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-02 06:25:46 +00:00
check_call('cd %s; %scert-to-efi-sig-list -g %s dbx.crt dbx.esl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx.esl dbx.auth'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
test/py: efi_secboot: fix additional pylint errors This is a fixup by autopep8 after the commit ("test/py: efi_secboot: apply autopep8"). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-20 06:33:39 +00:00
# dbx_hash (digest of TEST_db certificate)
test/py: efi_secboot: Remove unnecessary cert-to-efi-hash-list option 'cert-to-efi-hash-list -t 0' does not work as expected, it produces indeterminate timestamp. $ cert-to-efi-hash-list -t 0 -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-113-0 00:00:255 If we need the CRL revoked for all the time, just don't specify '-t' option. $ cert-to-efi-hash-list -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-0-0 00:00:00 Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2022-10-03 07:12:15 +00:00
check_call('cd %s; %scert-to-efi-hash-list -g %s -s 256 db.crt dbx_hash.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash.crl dbx_hash.auth'
test/py: efi_secboot: add a test against certificate revocation Revocation database (dbx) may have not only certificates, but also message digests of certificates with revocation time (EFI_CERT_X509_SHA256_GUILD). In this test case, if the database has such a digest and if the value matches to a certificate that created a given image's signature, authentication should fail. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Set defined time stamp for dbx_hash.auth. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-08 05:02:01 +00:00
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
test/py: efi_secboot: Remove unnecessary cert-to-efi-hash-list option 'cert-to-efi-hash-list -t 0' does not work as expected, it produces indeterminate timestamp. $ cert-to-efi-hash-list -t 0 -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-113-0 00:00:255 If we need the CRL revoked for all the time, just don't specify '-t' option. $ cert-to-efi-hash-list -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-0-0 00:00:00 Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2022-10-03 07:12:15 +00:00
check_call('cd %s; %scert-to-efi-hash-list -g %s -s 384 db.crt dbx_hash384.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash384.crl dbx_hash384.auth'
test/py: Add more test cases for rejecting an EFI image The previous patch adds support for rejecting images when the sha384/512 of an x.509 certificate is present in dbx. Update the sandbox selftests Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2022-05-06 12:36:01 +00:00
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
test/py: efi_secboot: Remove unnecessary cert-to-efi-hash-list option 'cert-to-efi-hash-list -t 0' does not work as expected, it produces indeterminate timestamp. $ cert-to-efi-hash-list -t 0 -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-113-0 00:00:255 If we need the CRL revoked for all the time, just don't specify '-t' option. $ cert-to-efi-hash-list -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-0-0 00:00:00 Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2022-10-03 07:12:15 +00:00
check_call('cd %s; %scert-to-efi-hash-list -g %s -s 512 db.crt dbx_hash512.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash512.crl dbx_hash512.auth'
test/py: Add more test cases for rejecting an EFI image The previous patch adds support for rejecting images when the sha384/512 of an x.509 certificate is present in dbx. Update the sandbox selftests Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2022-05-06 12:36:01 +00:00
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
test/py: efi_secboot: fix additional pylint errors This is a fixup by autopep8 after the commit ("test/py: efi_secboot: apply autopep8"). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-20 06:33:39 +00:00
# dbx_hash1 (digest of TEST_db1 certificate)
test/py: efi_secboot: Remove unnecessary cert-to-efi-hash-list option 'cert-to-efi-hash-list -t 0' does not work as expected, it produces indeterminate timestamp. $ cert-to-efi-hash-list -t 0 -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-113-0 00:00:255 If we need the CRL revoked for all the time, just don't specify '-t' option. $ cert-to-efi-hash-list -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-0-0 00:00:00 Signed-off-by: Masahisa Kojima <masahisa.kojima@linaro.org> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2022-10-03 07:12:15 +00:00
check_call('cd %s; %scert-to-efi-hash-list -g %s -s 256 db1.crt dbx_hash1.crl; %ssign-efi-sig-list -t "2020-04-06" -c KEK.crt -k KEK.key dbx dbx_hash1.crl dbx_hash1.auth'
test/py: efi_secboot: add a test for multiple signatures In this test case, an image is signed multiple times with different keys. If any of signatures contained is not verified, the whole authentication check should fail. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Provide a defined time stamp for dbx_hash1.auth. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-08 05:02:02 +00:00
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
test/py: efi_secboot: fix additional pylint errors This is a fixup by autopep8 after the commit ("test/py: efi_secboot: apply autopep8"). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-20 06:33:39 +00:00
# dbx_db (with TEST_db certificate)
test/py: efi_secboot: add a test for verifying with digest of signed image Signature database (db or dbx) may have not only certificates that contain a public key for RSA decryption, but also digests of signed images. In this test case, if database has an image's digest (EFI_CERT_SHA256_GUID) and if the value matches to a hash value calculated from image's binary, authentication should pass in case of db, and fail in case of dbx. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Use defined time stamps for sign-efi-sig-list. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-08 05:02:03 +00:00
check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx db.esl dbx_db.auth'
% (mnt_point, EFITOOLS_PATH),
shell=True)
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
# Copy image
test/py: efi_secboot: small rework for adding a new test It won't be very useful to customize HELLO_PATH and EFI_SECBOOT_IMAGE_NAME under the current code base. So just remove them. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-21 10:35:23 +00:00
check_call('cp %s/lib/efi_loader/helloworld.efi %s' %
(u_boot_config.build_dir, mnt_point), shell=True)
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
# Sign image
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
check_call('cd %s; sbsign --key db.key --cert db.crt helloworld.efi'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% mnt_point, shell=True)
test/py: efi_secboot: fix additional pylint errors This is a fixup by autopep8 after the commit ("test/py: efi_secboot: apply autopep8"). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-20 06:33:39 +00:00
# Sign already-signed image with another key
test/py: efi_secboot: add a test for multiple signatures In this test case, an image is signed multiple times with different keys. If any of signatures contained is not verified, the whole authentication check should fail. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Provide a defined time stamp for dbx_hash1.auth. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-08 05:02:02 +00:00
check_call('cd %s; sbsign --key db1.key --cert db1.crt --output helloworld.efi.signed_2sigs helloworld.efi.signed'
% mnt_point, shell=True)
test/py: efi_secboot: add a test for a forged signed image In this test case, a image binary, helloworld.efi.signed, is willfully modified to print a corrupted message while the signature itself is unchanged. This binary must be rejected under secure boot mode. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2022-07-05 05:48:15 +00:00
# Create a corrupted signed image
check_call('cd %s; sh %s/test/py/tests/test_efi_secboot/forge_image.sh helloworld.efi.signed helloworld_forged.efi.signed'
% (mnt_point, u_boot_config.source_dir), shell=True)
test/py: efi_secboot: fix additional pylint errors This is a fixup by autopep8 after the commit ("test/py: efi_secboot: apply autopep8"). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-20 06:33:39 +00:00
# Digest image
test: correct time stamps for UEFI authentication A time authenticated variable cannot be overwritten with another value with the same time stamp. So we must ensure the correct sequence of time stamps when generating out test data. Using parameter -t for sign-efi-sig-list gives reproducible results and avoids sleep statements. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-02 06:25:46 +00:00
check_call('cd %s; %shash-to-efi-sig-list helloworld.efi db_hello.hash; %ssign-efi-sig-list -t "2020-04-07" -c KEK.crt -k KEK.key db db_hello.hash db_hello.auth'
test/py: efi_secboot: apply autopep8 Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:58 +00:00
% (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH),
shell=True)
test/py: efi_secboot: add a test for verifying with digest of signed image Signature database (db or dbx) may have not only certificates that contain a public key for RSA decryption, but also digests of signed images. In this test case, if database has an image's digest (EFI_CERT_SHA256_GUID) and if the value matches to a hash value calculated from image's binary, authentication should pass in case of db, and fail in case of dbx. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Use defined time stamps for sign-efi-sig-list. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-08 05:02:03 +00:00
check_call('cd %s; %shash-to-efi-sig-list helloworld.efi.signed db_hello_signed.hash; %ssign-efi-sig-list -t "2020-04-03" -c KEK.crt -k KEK.key db db_hello_signed.hash db_hello_signed.auth'
% (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH),
shell=True)
check_call('cd %s; %ssign-efi-sig-list -t "2020-04-07" -c KEK.crt -k KEK.key dbx db_hello_signed.hash dbx_hello_signed.auth'
% (mnt_point, EFITOOLS_PATH),
shell=True)
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
test/py: efi_secboot: fix additional pylint errors This is a fixup by autopep8 after the commit ("test/py: efi_secboot: apply autopep8"). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-20 06:33:39 +00:00
check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat {} {}'.format(
mnt_point, image_path), shell=True)
test: use virt-make-fs to build image Avoid sudo for test/py/tests/test_efi_secboot by using virt-make-fs. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 21:05:18 +00:00
check_call('rm -rf {}'.format(mnt_point), shell=True)
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
test/py: efi_secboot: more fixes against pylint More fixes against pylint warnings that autopep8 didn't handle in the previous commit. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-08 05:01:59 +00:00
except CalledProcessError as exception:
pytest.skip('Setup failed: %s' % exception.cmd)
efi_loader, pytest: set up secure boot environment A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-14 02:51:49 +00:00
return
else:
yield image_path
finally:
call('rm -f %s' % image_path, shell=True)
test/py: efi_secboot: add test for intermediate certificates In this test case, an image may have a signature with additional intermediate certificates. A chain of trust will be followed and all the certificates in the middle of chain must be verified before loading. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-21 10:35:24 +00:00
#
# Fixture for UEFI secure boot test of intermediate certificates
#
@pytest.fixture(scope='session')
def efi_boot_env_intca(request, u_boot_config):
test: fix pydoc issues for EFI tests Fix issues reported by pydocstyle. Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2023-05-03 05:08:05 +00:00
"""Set up file system for secure boot test.
Set up a file system to be used in UEFI secure boot test
test/py: efi_secboot: add test for intermediate certificates In this test case, an image may have a signature with additional intermediate certificates. A chain of trust will be followed and all the certificates in the middle of chain must be verified before loading. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-21 10:35:24 +00:00
of intermediate certificates.
Args:
request: Pytest request object.
u_boot_config: U-boot configuration.
Return:
A path to disk image to be used for testing
"""
image_path = u_boot_config.persistent_data_dir
image_path = image_path + '/test_efi_secboot_intca.img'
try:
mnt_point = u_boot_config.persistent_data_dir + '/mnt_efi_secboot_intca'
check_call('rm -rf {}'.format(mnt_point), shell=True)
check_call('mkdir -p {}'.format(mnt_point), shell=True)
# Create signature database
# PK
check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ -keyout PK.key -out PK.crt -nodes -days 365'
% mnt_point, shell=True)
check_call('cd %s; %scert-to-efi-sig-list -g %s PK.crt PK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# KEK
check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ -keyout KEK.key -out KEK.crt -nodes -days 365'
% mnt_point, shell=True)
check_call('cd %s; %scert-to-efi-sig-list -g %s KEK.crt KEK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# We will have three-tier hierarchy of certificates:
# TestRoot: Root CA (self-signed)
# TestSub: Intermediate CA (signed by Root CA)
# TestCert: User certificate (signed by Intermediate CA, and used
# for signing an image)
#
# NOTE:
# I consulted the following EDK2 document for certificate options:
# BaseTools/Source/Python/Pkcs7Sign/Readme.md
# Please not use them as they are in product system. They are
# for test purpose only.
# TestRoot
check_call('cp %s/test/py/tests/test_efi_secboot/openssl.cnf %s'
% (u_boot_config.source_dir, mnt_point), shell=True)
check_call('cd %s; export OPENSSL_CONF=./openssl.cnf; openssl genrsa -out TestRoot.key 2048; openssl req -extensions v3_ca -new -x509 -days 365 -key TestRoot.key -out TestRoot.crt -subj "/CN=TEST_root/"; touch index.txt; touch index.txt.attr'
% mnt_point, shell=True)
# TestSub
check_call('cd %s; touch serial.new; export OPENSSL_CONF=./openssl.cnf; openssl genrsa -out TestSub.key 2048; openssl req -new -key TestSub.key -out TestSub.csr -subj "/CN=TEST_sub/"; openssl ca -in TestSub.csr -out TestSub.crt -extensions v3_int_ca -days 365 -batch -rand_serial -cert TestRoot.crt -keyfile TestRoot.key'
% mnt_point, shell=True)
# TestCert
check_call('cd %s; touch serial.new; export OPENSSL_CONF=./openssl.cnf; openssl genrsa -out TestCert.key 2048; openssl req -new -key TestCert.key -out TestCert.csr -subj "/CN=TEST_cert/"; openssl ca -in TestCert.csr -out TestCert.crt -extensions usr_cert -days 365 -batch -rand_serial -cert TestSub.crt -keyfile TestSub.key'
% mnt_point, shell=True)
# db
# for TestCert
check_call('cd %s; %scert-to-efi-sig-list -g %s TestCert.crt TestCert.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key db TestCert.esl db_a.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# for TestSub
check_call('cd %s; %scert-to-efi-sig-list -g %s TestSub.crt TestSub.esl; %ssign-efi-sig-list -t "2020-07-16" -c KEK.crt -k KEK.key db TestSub.esl db_b.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# for TestRoot
check_call('cd %s; %scert-to-efi-sig-list -g %s TestRoot.crt TestRoot.esl; %ssign-efi-sig-list -t "2020-07-17" -c KEK.crt -k KEK.key db TestRoot.esl db_c.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
## dbx (hash of certificate with revocation time)
# for TestCert
check_call('cd %s; %scert-to-efi-hash-list -g %s -t "2020-07-20" -s 256 TestCert.crt TestCert.crl; %ssign-efi-sig-list -c KEK.crt -k KEK.key dbx TestCert.crl dbx_a.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# for TestSub
check_call('cd %s; %scert-to-efi-hash-list -g %s -t "2020-07-21" -s 256 TestSub.crt TestSub.crl; %ssign-efi-sig-list -t "2020-07-18" -c KEK.crt -k KEK.key dbx TestSub.crl dbx_b.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# for TestRoot
check_call('cd %s; %scert-to-efi-hash-list -g %s -t "2020-07-22" -s 256 TestRoot.crt TestRoot.crl; %ssign-efi-sig-list -t "2020-07-19" -c KEK.crt -k KEK.key dbx TestRoot.crl dbx_c.auth'
% (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
shell=True)
# Sign image
# additional intermediate certificates may be included
# in SignedData
check_call('cp %s/lib/efi_loader/helloworld.efi %s' %
(u_boot_config.build_dir, mnt_point), shell=True)
# signed by TestCert
check_call('cd %s; %ssbsign --key TestCert.key --cert TestCert.crt --out helloworld.efi.signed_a helloworld.efi'
% (mnt_point, SBSIGN_PATH), shell=True)
# signed by TestCert with TestSub in signature
check_call('cd %s; %ssbsign --key TestCert.key --cert TestCert.crt --addcert TestSub.crt --out helloworld.efi.signed_ab helloworld.efi'
% (mnt_point, SBSIGN_PATH), shell=True)
# signed by TestCert with TestSub and TestRoot in signature
check_call('cd %s; cat TestSub.crt TestRoot.crt > TestSubRoot.crt; %ssbsign --key TestCert.key --cert TestCert.crt --addcert TestSubRoot.crt --out helloworld.efi.signed_abc helloworld.efi'
% (mnt_point, SBSIGN_PATH), shell=True)
check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat {} {}'.format(mnt_point, image_path), shell=True)
check_call('rm -rf {}'.format(mnt_point), shell=True)
except CalledProcessError as e:
pytest.skip('Setup failed: %s' % e.cmd)
return
else:
yield image_path
finally:
call('rm -f %s' % image_path, shell=True)
Reference in a new issue Copy permalink