1 # SPDX-License-Identifier: GPL-2.0+
2 # Copyright (c) 2020, Linaro Limited
3 # Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
5 # U-Boot UEFI: Image Authentication Test (signature with certificates chain)
8 This test verifies image authentication for a signed image which is signed
9 by user certificate and contains additional intermediate certificates in its
16 @pytest.mark.boardspec('sandbox')
17 @pytest.mark.buildconfigspec('efi_secure_boot')
18 @pytest.mark.buildconfigspec('cmd_efidebug')
19 @pytest.mark.buildconfigspec('cmd_fat')
20 @pytest.mark.buildconfigspec('cmd_nvedit_efi')
22 class TestEfiSignedImageIntca(object):
23 def test_efi_signed_image_intca1(self, u_boot_console, efi_boot_env_intca):
25 Test Case 1 - authenticated by root CA in db
27 u_boot_console.restart_uboot()
28 disk_img = efi_boot_env_intca
29 with u_boot_console.log.section('Test Case 1a'):
30 # Test Case 1a, with no Int CA and not authenticated by root CA
31 output = u_boot_console.run_command_list([
32 'host bind 0 %s' % disk_img,
33 'fatload host 0:1 4000000 db_c.auth',
34 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db',
35 'fatload host 0:1 4000000 KEK.auth',
36 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
37 'fatload host 0:1 4000000 PK.auth',
38 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK'])
39 assert 'Failed to set EFI variable' not in ''.join(output)
41 output = u_boot_console.run_command_list([
42 'efidebug boot add 1 HELLO_a host 0:1 /helloworld.efi.signed_a ""',
43 'efidebug boot next 1',
44 'efidebug test bootmgr'])
45 assert '\'HELLO_a\' failed' in ''.join(output)
46 assert 'efi_start_image() returned: 26' in ''.join(output)
48 with u_boot_console.log.section('Test Case 1b'):
49 # Test Case 1b, signed and authenticated by root CA
50 output = u_boot_console.run_command_list([
51 'efidebug boot add 2 HELLO_ab host 0:1 /helloworld.efi.signed_ab ""',
52 'efidebug boot next 2',
54 assert 'Hello, world!' in ''.join(output)
56 def test_efi_signed_image_intca2(self, u_boot_console, efi_boot_env_intca):
58 Test Case 2 - authenticated by root CA in db
60 u_boot_console.restart_uboot()
61 disk_img = efi_boot_env_intca
62 with u_boot_console.log.section('Test Case 2a'):
63 # Test Case 2a, unsigned and not authenticated by root CA
64 output = u_boot_console.run_command_list([
65 'host bind 0 %s' % disk_img,
66 'fatload host 0:1 4000000 KEK.auth',
67 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
68 'fatload host 0:1 4000000 PK.auth',
69 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK'])
70 assert 'Failed to set EFI variable' not in ''.join(output)
72 output = u_boot_console.run_command_list([
73 'efidebug boot add 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc ""',
74 'efidebug boot next 1',
75 'efidebug test bootmgr'])
76 assert '\'HELLO_abc\' failed' in ''.join(output)
77 assert 'efi_start_image() returned: 26' in ''.join(output)
79 with u_boot_console.log.section('Test Case 2b'):
80 # Test Case 2b, signed and authenticated by root CA
81 output = u_boot_console.run_command_list([
82 'fatload host 0:1 4000000 db_b.auth',
83 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db',
84 'efidebug boot next 1',
85 'efidebug test bootmgr'])
86 assert '\'HELLO_abc\' failed' in ''.join(output)
87 assert 'efi_start_image() returned: 26' in ''.join(output)
89 with u_boot_console.log.section('Test Case 2c'):
90 # Test Case 2c, signed and authenticated by root CA
91 output = u_boot_console.run_command_list([
92 'fatload host 0:1 4000000 db_c.auth',
93 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db',
94 'efidebug boot next 1',
95 'efidebug test bootmgr'])
96 assert 'Hello, world!' in ''.join(output)
98 def test_efi_signed_image_intca3(self, u_boot_console, efi_boot_env_intca):
100 Test Case 3 - revoked by dbx
102 u_boot_console.restart_uboot()
103 disk_img = efi_boot_env_intca
104 with u_boot_console.log.section('Test Case 3a'):
105 # Test Case 3a, revoked by int CA in dbx
106 output = u_boot_console.run_command_list([
107 'host bind 0 %s' % disk_img,
108 'fatload host 0:1 4000000 dbx_b.auth',
109 'setenv -e -nv -bs -rt -at -i 4000000,$filesize dbx',
110 'fatload host 0:1 4000000 db_c.auth',
111 'setenv -e -nv -bs -rt -at -i 4000000,$filesize db',
112 'fatload host 0:1 4000000 KEK.auth',
113 'setenv -e -nv -bs -rt -at -i 4000000,$filesize KEK',
114 'fatload host 0:1 4000000 PK.auth',
115 'setenv -e -nv -bs -rt -at -i 4000000,$filesize PK'])
116 assert 'Failed to set EFI variable' not in ''.join(output)
118 output = u_boot_console.run_command_list([
119 'efidebug boot add 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc ""',
120 'efidebug boot next 1',
121 'efidebug test bootmgr'])
122 assert 'Hello, world!' in ''.join(output)
124 # assert '\'HELLO_abc\' failed' in ''.join(output)
125 # assert 'efi_start_image() returned: 26' in ''.join(output)
127 with u_boot_console.log.section('Test Case 3b'):
128 # Test Case 3b, revoked by root CA in dbx
129 output = u_boot_console.run_command_list([
130 'fatload host 0:1 4000000 dbx_c.auth',
131 'setenv -e -nv -bs -rt -at -i 4000000,$filesize dbx',
132 'efidebug boot next 1',
133 'efidebug test bootmgr'])
134 assert '\'HELLO_abc\' failed' in ''.join(output)
135 assert 'efi_start_image() returned: 26' in ''.join(output)