Commit graph

17 commits

Author SHA1 Message Date
AKASHI Takahiro
d09745b196 test/py: efi_secboot: remove unused function
'tool_is_in_path' function is no longer used anywhere after Heinrich
has removed 'sudo' version of fixture setup.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-22 12:32:42 +02:00
Heinrich Schuchardt
53ce9a6ed9 test: use virt-make-fs to build image
Avoid sudo for test/py/tests/test_efi_secboot by using virt-make-fs.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:16 +02:00
AKASHI Takahiro
7fdc02b3d7 test/py: efi_secboot: add a test for verifying with digest of signed image
Signature database (db or dbx) may have not only certificates that contain
a public key for RSA decryption, but also digests of signed images.

In this test case, if database has an image's digest (EFI_CERT_SHA256_GUID)
and if the value matches to a hash value calculated from image's binary,
authentication should pass in case of db, and fail in case of dbx.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>

Use defined time stamps for sign-efi-sig-list.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:16 +02:00
AKASHI Takahiro
0c7772d40f test/py: efi_secboot: add a test for multiple signatures
In this test case, an image is signed multiple times with different
keys. If any of signatures contained is not verified, the whole
authentication check should fail.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>

Provide a defined time stamp for dbx_hash1.auth.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:16 +02:00
AKASHI Takahiro
c6361e73b5 test/py: efi_secboot: add a test against certificate revocation
Revocation database (dbx) may have not only certificates, but also
message digests of certificates with revocation time
(EFI_CERT_X509_SHA256_GUILD).

In this test case, if the database has such a digest and if the value
matches to a certificate that created a given image's signature,
authentication should fail.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>

Set defined time stamp for dbx_hash.auth.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-11 23:14:16 +02:00
AKASHI Takahiro
48ead6097b test/py: efi_secboot: split "signed image" test case-1 into two cases
Split the existing test case-1 into case1 and a new case-2:
case-1 for non-SecureBoot mode; case-2 for SecureBoot mode.

In addition, one corner case is added to case-2; a image is signed
but a corresponding certificate is not yet installed in "db."

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-11 23:14:16 +02:00
AKASHI Takahiro
d863b307e8 test/py: efi_secboot: more fixes against pylint
More fixes against pylint warnings that autopep8 didn't handle
in the previous commit.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-11 23:14:16 +02:00
AKASHI Takahiro
91d2b6216b test/py: efi_secboot: apply autopep8
Python's autopep8 can automatically correct some of warnings from pylint
and rewrite the code in a pretty print format. So just do it.

Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-07-11 23:14:16 +02:00
Heinrich Schuchardt
bc246c69ae test: correct time stamps for UEFI authentication
A time authenticated variable cannot be overwritten with another value
with the same time stamp. So we must ensure the correct sequence of time
stamps when generating out test data.

Using parameter -t for sign-efi-sig-list gives reproducible results and
avoids sleep statements.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-03 18:00:27 +02:00
AKASHI Takahiro
4edd9ccd94 test/py: efi_secboot: fix test case 1g of test_authvar
In the test case (1g) of test_authvar, "db" is mistakenly used,
and it ends up being the exact same as (1f).
So correct it as "dbx" test case.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-03 18:00:27 +02:00
AKASHI Takahiro
bed118fb10 test/py: efi_secboot: remove all "re.search"
Currently, we don't use any regular expression in matching outputs from
U-Boot. Since its use is just redundant, we can remove all.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-03 18:00:27 +02:00
AKASHI Takahiro
dc2b473447 Revert "test: stabilize test_efi_secboot"
This reverts commit 5827c25458.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-07-03 18:00:27 +02:00
Heinrich Schuchardt
5827c25458 test: stabilize test_efi_secboot
When setting up the console via function efi_console_register() we call
query_console_serial(). This functions sends an escape sequence to the
terminal to query the display size. The response is another escape
sequence.

console.run_command_list() is looking for a regular expression '^==>'.
If the escape sequence for the screen size precedes the prompt without a
line break, no match is found.

When efi_disk_register() is called before efi_console_register() this leads
to a test failuere of the UEFI secure boot tests.

We can avoid the problem if the first UEFI command passed to
u_boot_console.run_command_list() produces output. This patch achieves this
by appending '; echo' to the first UEFI related command of the problematic
tests.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-05-04 12:26:11 +02:00
Heinrich Schuchardt
b32ac16f9a test/py: fix test_efi_secboot/conftest.py
If udisksctl is present
test/py/tests/test_efi_secboot/conftest.py
fails because the disk image is never mounted.

Normal users can only mount fuse file systems. Unfortunately fusefat is
still in an experimental state and seems not to work here correctly.

So as we have to be root or use the sudo command anyway delete all coding
referring to udisksctl.

--

We should not use mount point /mnt as this directory or one of its
sub-directories might already be in use as active mount points. Instead
create a new directory in the build root as mount point.

--

Remove debug print statements that have been commented out. print without
parentheses is anyway invalid in Python 3. And pytest anyway filters out
the output if there is no exception reported.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2020-04-30 10:25:06 +02:00
AKASHI Takahiro
7254ebed0f efi_loader, pytest: add UEFI secure boot tests (image)
Provide test cases for
 * image authentication for signed images
   (test_efi_secboot/test_signed.py)
 * image authentication for unsigned images
   (test_efi_secboot/test_unsigned.py)

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-16 08:12:47 +02:00
AKASHI Takahiro
a9d5666d0a efi_loader, pytest: add UEFI secure boot tests (authenticated variables)
Provide a couple of test cases for variable authentication.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-16 08:12:47 +02:00
AKASHI Takahiro
fe6ca4d5d2 efi_loader, pytest: set up secure boot environment
A fixture for UEFI secure boot tests (image authentication and variable
authentication) is defined. A small file system with test data in a single
partition formatted in fat is created.

This test requires efitools v1.5.2 or later. If the system's efitools
is older, you have to build it on your own and define EFITOOLS_PATH.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
2020-04-16 08:12:47 +02:00