| Message ID | 20210727091054.512050-6-takahiro.akashi@linaro.org |
|---|---|
| State | New |
| Headers | show |
| Series | efi_loader: capsule: improve capsule authentication support | expand |
On 7/27/21 11:10 AM, AKASHI Takahiro wrote: > Add a couple of test cases against capsule image authentication > for capsule-on-disk, where only a signed capsule file with the verified > signature will be applied to the system. > > Due to the difficulty of embedding a public key (esl file) in U-Boot > binary during pytest setup time, all the keys/certificates are pre-created. > > Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Please, check the pylint warnings: $ pylint test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py ************* Module test_capsule_firmware_signed test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:44:0: C0301: Line too long (113/100) (line-too-long) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:73:0: C0301: Line too long (117/100) (line-too-long) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:110:0: C0301: Line too long (113/100) (line-too-long) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:139:0: C0301: Line too long (117/100) (line-too-long) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:178:0: C0301: Line too long (113/100) (line-too-long) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:207:0: C0301: Line too long (117/100) (line-too-long) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:154:2: W0511: TODO: check CapsuleStatus in CapsuleXXXX (fixme) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:222:2: W0511: TODO: check CapsuleStatus in CapsuleXXXX (fixme) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:14:0: W0401: Wildcard import capsule_defs (wildcard-import) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:27:0: C0115: Missing class docstring (missing-class-docstring) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:27:0: R0205: Class 'TestEfiCapsuleFirmwareSigned' inherits from object, can be safely removed from bases in python3 (useless-object-inheritance) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:28:4: R0201: Method could be a function (no-self-use) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:93:4: R0201: Method could be a function (no-self-use) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:162:4: R0201: Method could be a function (no-self-use) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:12:0: W0611: Unused check_call imported from subprocess (unused-import) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:12:0: W0611: Unused check_output imported from subprocess (unused-import) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:12:0: W0611: Unused CalledProcessError imported from subprocess (unused-import) test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:14:0: W0614: Unused import EFITOOLS_PATH from wildcard import (unused-wildcard-import) Best regards Heinrich > --- > test/py/tests/test_efi_capsule/SIGNER.crt | 19 ++ > test/py/tests/test_efi_capsule/SIGNER.esl | Bin 0 -> 829 bytes > test/py/tests/test_efi_capsule/SIGNER.key | 28 +++ > test/py/tests/test_efi_capsule/SIGNER2.crt | 19 ++ > test/py/tests/test_efi_capsule/SIGNER2.key | 28 +++ > .../py/tests/test_efi_capsule/capsule_defs.py | 5 + > test/py/tests/test_efi_capsule/conftest.py | 35 ++- > .../test_capsule_firmware_signed.py | 228 ++++++++++++++++++ > 8 files changed, 359 insertions(+), 3 deletions(-) > create mode 100644 test/py/tests/test_efi_capsule/SIGNER.crt > create mode 100644 test/py/tests/test_efi_capsule/SIGNER.esl > create mode 100644 test/py/tests/test_efi_capsule/SIGNER.key > create mode 100644 test/py/tests/test_efi_capsule/SIGNER2.crt > create mode 100644 test/py/tests/test_efi_capsule/SIGNER2.key > create mode 100644 test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py > > diff --git a/test/py/tests/test_efi_capsule/SIGNER.crt b/test/py/tests/test_efi_capsule/SIGNER.crt > new file mode 100644 > index 000000000000..f63ec01d9996 > --- /dev/null > +++ b/test/py/tests/test_efi_capsule/SIGNER.crt > @@ -0,0 +1,19 @@ > +-----BEGIN CERTIFICATE----- > +MIIDDTCCAfWgAwIBAgIUD96z+lSbhDFN76YoIY2LnDBt1yQwDQYJKoZIhvcNAQEL > +BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw > +NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN > +AQEBBQADggEPADCCAQoCggEBAMBuazX28i0y4L0loJYJOtlvF5eWb4tbx7zwei5c > +KoSzQYixinS10OrVy7y8mELyXOlGOOsM509vzvoia0nffwEPsvTBeS3le2JBz9iN > +/+AIo+gUmzgEPQN+jp+s4fi0yzRvq3BgWu1ego2gExxQ7AePQHoSkX8UeC3Kb7SF > +a8Kt/TopOupZfEuZ+EtoxPA4JUStFgEUEcRJEfpQqECXV+lKqcyqHc2ZUzMisu+i > +5omkneX8sEZdIPFsSGanCyY3F9VjWzIxo60PU2xUBOIcEUg5luR+VXT4090g/yCw > +8PSf9rIKgGIQSQKAlUSc7zuXQIdgIMTS1xUpc/Nx+SqWNZECAwEAAaNTMFEwHQYD > +VR0OBBYEFHndZVpPrAjc3OD3UZ3xkXQqDOlZMB8GA1UdIwQYMBaAFHndZVpPrAjc > +3OD3UZ3xkXQqDOlZMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB > +AG88t6w0qTXE50ltps62f6wtuuZsiX1zj+AluO4E8E3Wi0QsNtT24JdY2P4mAg8y > +abYLdgJIldzzsfjWWok9Dfqnx29tqgesKWkgUo16v70i4EVZ9YWGe+CfOK639OxL > +4D0XPcU5CUpDrEcnt59wCxQ7IArZzrDxrqigEw5nReejtgQV/mEzvVOzWjLjmngy > +SpvrydxYpfSvOJ3KGV9xw3Oa/qO3pS0ZNX9QqZdcC94M0SI6OF635oxJkz6JToYq > ++qtv9PZtZnEU/cwzL0nTXMj7yRsP5+2Wre26yT62nKRy9P/3UFwmsJ0OuEmnol5I > +141ZGfBYmSQ6EReOwNeK7A0= > +-----END CERTIFICATE----- > diff --git a/test/py/tests/test_efi_capsule/SIGNER.esl b/test/py/tests/test_efi_capsule/SIGNER.esl > new file mode 100644 > index 0000000000000000000000000000000000000000..a54536e243d274b74985abbecfe234d14013ef33 > GIT binary patch > literal 829 > zcmZ1&d0^?2Da*aux2_hA(f&|m%gg`<iclKDgOCPI%)ACoj9(WpGchtTiSXas{3~R3 > zi=prPWg3dT-E$0bud5jFvT<s)d9;1!Wn|=LWiSvk6fqEDV-96u=HU);4GxJ9_H_4i > z4Kk1u=QT1kFgG$YurM_?G>rmsjgYuF^))dnAzQ)7%D~*j$j<<D6&F(zBO}9sylm5N > zpLC5L>{VSbjnnF8zWDTM`Q6dS_k5_*i_vP??AWoft7PkiS65H(*)zlGQ_M>@i`P8Q > z{qxWLQp)zcU(d+D>C3@N-KW(_j^}Um{(r!+_=U)93l>}Ey1w~q9{$*J+9ZE<K|<8q > zxTf9(!ZHDG*!vx-geKODROp_{-_n|WXzgDsO{-UtHQqCScxN2>V4>==R*X?Z@QA12 > zuYeT})5BkStvs_z_Uz1HW2H^+7d`7-GWY494Q{atA9Fm?mUF9_i(gHSHZokimOnTr > zgyoTppoitOCv~AEKQ7-@_^+_x!<YHrHgPp133xI!Om&&_-g>%2dxFA|OV>p;i$53s > z)S6~Gk%^g+fpKxLL7;&wFw|xFSj1RFD(|L7`LE%)bLYYLz_}kMmT2+3j5Lr3Nh`BR > z7>G4sSHKTaAk4`4pM}+c8Au@qJ1}N}!OqB#Z?k=k$x72B&pmUOo!eHwMt9e<oX*<f > z{s*c%-m!e}z1HobV|L}+gXs}B{;4tX8)a_eE@SeTdgt@TAJ?KfZFzq!Kc1hvihYe{ > zrb19})&9Lo4_qU^wzgG2m~XLe`<FM~4{XJ4k6LniIj?b7-#)*9Tf|y{>*l!)AJ?r| > zAk3HU`h4*=7SVr+#(RS|M;SeyRbk{c`}N5?5lg?Ux0riMGQRL|@vMJ~w=dO|G_4O< > zIX#B^9?wN3D~q`8&w4y3+jaW2Y5iKA|K(e5TA|3_GsgO!mt#)+J}J%r{Oz>0Z+D%v > r+csxO(U<?<17g%R%;nqRxqMNa$MxPw$qx}TRjdTX`wm?1dcz9<2x(B# > > literal 0 > HcmV?d00001 > > diff --git a/test/py/tests/test_efi_capsule/SIGNER.key b/test/py/tests/test_efi_capsule/SIGNER.key > new file mode 100644 > index 000000000000..9952647ed74a > --- /dev/null > +++ b/test/py/tests/test_efi_capsule/SIGNER.key > @@ -0,0 +1,28 @@ > +-----BEGIN PRIVATE KEY----- > +MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQDAbms19vItMuC9 > +JaCWCTrZbxeXlm+LW8e88HouXCqEs0GIsYp0tdDq1cu8vJhC8lzpRjjrDOdPb876 > +ImtJ338BD7L0wXkt5XtiQc/Yjf/gCKPoFJs4BD0Dfo6frOH4tMs0b6twYFrtXoKN > +oBMcUOwHj0B6EpF/FHgtym+0hWvCrf06KTrqWXxLmfhLaMTwOCVErRYBFBHESRH6 > +UKhAl1fpSqnMqh3NmVMzIrLvouaJpJ3l/LBGXSDxbEhmpwsmNxfVY1syMaOtD1Ns > +VATiHBFIOZbkflV0+NPdIP8gsPD0n/ayCoBiEEkCgJVEnO87l0CHYCDE0tcVKXPz > +cfkqljWRAgMBAAECggEAItLYrAdohC105kXs7bn14GtuRYx/2yRc3SBXvBQJzcHy > +1h3rBHvytszB9gHbPCJIFh8TJdZL9eAyAKpB6Dh9718773cjyt6AmaN3TaVE7PIj > +V1iDTnvV3tAEV3kd27g8Hd0nlUqaqeI0lhSl4LX0QNn3vR+nHOxDY2YDGRQcEDrD > +4hlCIGzAfbCW9gINdadQnC6p9NEBbfJ18doCagdn1Q1UYs8YlWwhBK98wXKGsG6T > +TUywOWIe6+VJqzSwZn5YkDVD3qD4tToar7T0jrCvZjbTbOsjtinD70c3uBcrK/XN > +gpwJfTiDLo1d0tNoWCRUH0myMs1fq3H3SkdfqB1GwQKBgQDrw8FwUc3Q+j8YhR7i > +73H/osk3VOZhCPsqbrQThUo5ZV4EXqp9E3PLN5E3suWgfaXVCEI3lHARUyR+J+E/ > +evIrUUnkIryLdVOwwEWRonW4cLANjLSzT0eA85CFLXKUaij7Jfon2YNs9CmUARnC > +M96T3a89XOezX/SbRVz6X8KslQKBgQDQ8onkHcscHMANIjgxycIgYF+MvxwHRICA > +nt3ZSQiGSXJbWK7/sM5yd16ulvsXL7aF9G+q5osOzDWJ0w4SOhqNDfItrFH34Px6 > +qEPjq/sAigqqrQls7uu7MHfkE+eEy181CoT9argxo8ifAQDn4YtXBW6L7p6AgaAx > +83FAbBcqDQKBgQClHk185534zTqhZqIyF7bEbfL0sJ5EuXCG0E+IGGLafdbxwocu > +4A/J9Jnc44sU8srQv1745Bn02EEHpdCIkAfJNL5Ga9mW5k39zTsr+xbtXObAJppr > +touCkZLW4vSLYypecsOXYyw7g2kXQgoTTBaHgsv3cvjHVN3QXSz4IVcLXQJ/LBL9 > +AyFFtqhZ2mtdbyMfz7SEcyvcvau1b2wTX8IICktz09DhGQ4yffKwBiPS0xE9bwQg > +iewXaQeqQ2hBj5ayAw7uBrRSlfbfSwAzUdL1Hyf/GAFn+5JqJxISOAn6zAgaDRYq > +90mLkOz7ZI7RohfxTGnY56ttw62UHPU87lneiQKBgHcVituUDJgmbaHXx2IVzKsm > +5uDyXUf4S+tY5CZj6WTsb70+q4PYfh1D02nZgxuLNwpwNI0uhLIkLYHcL3poOapC > +LCXS8tsexNosmrTmjHFh/uNdKb7bKbMxyzYrr+ADKMclF3CJzKDzLfiIe9Na+bWa > +q5/HYNIw5zJyapPksgr4 > +-----END PRIVATE KEY----- > diff --git a/test/py/tests/test_efi_capsule/SIGNER2.crt b/test/py/tests/test_efi_capsule/SIGNER2.crt > new file mode 100644 > index 000000000000..8889a3ed930a > --- /dev/null > +++ b/test/py/tests/test_efi_capsule/SIGNER2.crt > @@ -0,0 +1,19 @@ > +-----BEGIN CERTIFICATE----- > +MIIDDTCCAfWgAwIBAgIUfmZcui7VkJEe9jx25Epo6jJ6l+owDQYJKoZIhvcNAQEL > +BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw > +NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN > +AQEBBQADggEPADCCAQoCggEBANozXTFKGVx0121MIBoSgxfI8IHcfY32T/LQusse > +PaXsm0GaJNwOgEP34u1k0cz466swfBCqTcZRjKuDpcH1sgrF1XaKjxuwYuiJrbsf > +ykVesN1z1bIamkFdVR/CBJEwN/epsyCBQCSbcxUwEX+ayq2zp+kSweew1B4i3u8f > +nbqFB15Rt+KAzFaBlvOJhmoZP7uYtb8zHa58eteaxQmPFt3v6eEbgOt92oVB8fPQ > +JJBuxUAHdimMDQ9mBGUosXR8PFyma5jOiOyY+0oTfig4bRHbGxCGMYyABJDH+j4e > +7Zl7lVMsq2fTm/lGONRX2QPLfMO298pz/wundJmYhseibvUCAwEAAaNTMFEwHQYD > +VR0OBBYEFDPYxE3oBmU1pWrZpY62JuXgcK5aMB8GA1UdIwQYMBaAFDPYxE3oBmU1 > +pWrZpY62JuXgcK5aMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB > +AEtY9QnvTvgmXmep7AMv/T6+GpERvsRdi+Lc+16L7uSCQhouDkeu5/sUHax6icX1 > +NyDb3u6tyQhMnm7CD+7Mo74wrZ4vK2SzBoZSBLi+Tyz2ScyysdRIo7O42nxVyWm7 > +ifZVfQKvanUjDSxPO89yJDYp0znvVpuZOzYXFHdprHoR5Atkth11HFHzWDzqblKS > +sx145wgPZ9bYohuOn1weyORsG9bJcHznPyJ1ceAOFk40bKWWLQtruWIhY4aZIlJN > +cDKv92rtgVApaamu+WRC4pzgQMQYKOcnMz4ZKeOKgEajfo6nOUVrvc0IYO6wixvi > +V+Msrg5o7ag2SN2AHg5/1/4= > +-----END CERTIFICATE----- > diff --git a/test/py/tests/test_efi_capsule/SIGNER2.key b/test/py/tests/test_efi_capsule/SIGNER2.key > new file mode 100644 > index 000000000000..ee467fd9f7a6 > --- /dev/null > +++ b/test/py/tests/test_efi_capsule/SIGNER2.key > @@ -0,0 +1,28 @@ > +-----BEGIN PRIVATE KEY----- > +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDaM10xShlcdNdt > +TCAaEoMXyPCB3H2N9k/y0LrLHj2l7JtBmiTcDoBD9+LtZNHM+OurMHwQqk3GUYyr > +g6XB9bIKxdV2io8bsGLoia27H8pFXrDdc9WyGppBXVUfwgSRMDf3qbMggUAkm3MV > +MBF/msqts6fpEsHnsNQeIt7vH526hQdeUbfigMxWgZbziYZqGT+7mLW/Mx2ufHrX > +msUJjxbd7+nhG4DrfdqFQfHz0CSQbsVAB3YpjA0PZgRlKLF0fDxcpmuYzojsmPtK > +E34oOG0R2xsQhjGMgASQx/o+Hu2Ze5VTLKtn05v5RjjUV9kDy3zDtvfKc/8Lp3SZ > +mIbHom71AgMBAAECggEBAJXskO3bAg364kJg+fWwHo7rLAWuYD54rXojXRVPFAC7 > +z/mFVio1dIA/BJcknNr/db5MNBKnUYUgZ005yVy52rl4MTGgBrB5w5wPbWWTdEGx > +zEh83KnhiXe8D08g2k6AGRR8b224IUCF5s76FivdScGMHaURlFYDs9t5DkCzMocC > +ty0ewHv9aeMSzJl4y+DrRw+NkkAntlAkerCI5PInFtxyOQ6lFIRkMKlBA//VL0QF > +B9yGbmfoxlErWCqnj70DTcVO7O2AaijU+FTMRbb/V7r34GPU0Cfeum6gGNOtDkaX > +3UnWGR2esiHViMqz8vvEYtVIxHhLTD7INqDlK/yiNEECgYEA+ua1JcHXI2qS3cV/ > +BuVvBrd3MzIpZvddCcTdo/B7WT3EoTupEG1gcajrCuNQDtRoizSbMuhCXYoMsktF > +wXFoTWoGr8yO7uVU5r2nCXZneprV3kuQmR0qYipN2GTCGSE1rKQI+YXeALPF1qIp > +12vUVdzWVDJvlQRMvSTlzpRZQkkCgYEA3qKI1ZsBszKPbnzLX91+ZAZeAwwN/HvS > +nrIveJAci/9U2yV2mw3l/Dulc8EkGABs/cMp47toje8DmsSfdu1yIYqpi3MHvefX > ++ijc3ry5v28Hia3WP3WPczqhbkT7cco0t8Vwm9w1B+kkreuRCtyoCOLsRauB0CH1 > +QJjMtPAth00CgYAKUUhruA/nxe8qLX/uwaqSJSNCuLJZKJzr1OukXTRFVDPsyW5H > +XagUpHSd6wEUywlNiClFq6VnAVFKV6wTq101qcGCoy/RhR67qlrfGb5hnVJkJMla > +coeWp9SxrFsK+4GgitJPqICbmMju7ZY45JdDvKQXrEdIYnfhY04L86/D+QKBgBxx > +nZPU0vnHCuYt0Xn0/XHgEmDHSH4qf7VAxKndl5gXTgsVlTqoIur/39qTIX5jh4lA > +RvjOd8Qydj5uwoTaP0ujwJeNYb7UgRZ35AgdCoo3sDnZ2NaQuXwaUIebDpjyIZwd > +AI8ZKjlRgxspToWZvWotO8yG5fXmcMQJAZZYXSi9AoGBALfXX/C5ojwms1l+XP+p > +FKzOFZ/uEKPfQid+2Sm1BknXXGVbs3zJ4OdonTvhjq+VQvXTW4IvjgY8TpumQZvE > +8nb7I8E1B6ajkSvgfetN9jlKM5hzIfJ3Vxx6hMGMab1ySKy3rZGPL706CW2BeMI2 > +v2k9P0qWItuE4S7I4hEsovwS > +-----END PRIVATE KEY----- > diff --git a/test/py/tests/test_efi_capsule/capsule_defs.py b/test/py/tests/test_efi_capsule/capsule_defs.py > index 4fd6353c2040..aa9bf5eee3aa 100644 > --- a/test/py/tests/test_efi_capsule/capsule_defs.py > +++ b/test/py/tests/test_efi_capsule/capsule_defs.py > @@ -3,3 +3,8 @@ > # Directories > CAPSULE_DATA_DIR = '/EFI/CapsuleTestData' > CAPSULE_INSTALL_DIR = '/EFI/UpdateCapsule' > + > +# v1.5.1 or earlier of efitools has a bug in sha256 calculation, and > +# you need build a newer version on your own. > +# The path must terminate with '/'. > +EFITOOLS_PATH = '' > diff --git a/test/py/tests/test_efi_capsule/conftest.py b/test/py/tests/test_efi_capsule/conftest.py > index 6ad5608cd71c..35cfa5513703 100644 > --- a/test/py/tests/test_efi_capsule/conftest.py > +++ b/test/py/tests/test_efi_capsule/conftest.py > @@ -10,13 +10,13 @@ import pytest > from capsule_defs import * > > # > -# Fixture for UEFI secure boot test > +# Fixture for UEFI capsule test > # > > - > @pytest.fixture(scope='session') > def efi_capsule_data(request, u_boot_config): > - """Set up a file system to be used in UEFI capsule test. > + """Set up a file system to be used in UEFI capsule and > + authentication test. > > Args: > request: Pytest request object. > @@ -40,6 +40,22 @@ def efi_capsule_data(request, u_boot_config): > check_call('mkdir -p %s' % data_dir, shell=True) > check_call('mkdir -p %s' % install_dir, shell=True) > > + capsule_auth_enabled = u_boot_config.buildconfig.get( > + 'config_efi_capsule_authenticate') > + # NOTE: > + # private keys (SIGNER?.key) dn certificates (SIGNER?.crt) > + # in this pytest directory are created this way: > + # Create private key (SIGNER.key) and certificate (SIGNER.crt) > + # check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER.key -out SIGNER.crt -nodes -days 365' > + # % data_dir, shell=True) > + # check_call('cd %s; %scert-to-efi-sig-list SIGNER.crt SIGNER.esl' > + # % (data_dir, EFITOOLS_PATH), shell=True) > + > + # Create *malicious* private key (SIGNER2.key) and certificate > + # (SIGNER2.crt) > + # check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER2.key -out SIGNER2.crt -nodes -days 365' > + # % data_dir, shell=True) > + > # Create capsule files > # two regions: one for u-boot.bin and the other for u-boot.env > check_call('cd %s; echo -n u-boot:Old > u-boot.bin.old; echo -n u-boot:New > u-boot.bin.new; echo -n u-boot-env:Old -> u-boot.env.old; echo -n u-boot-env:New > u-boot.env.new' % data_dir, > @@ -56,6 +72,19 @@ def efi_capsule_data(request, u_boot_config): > check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 Test02' % > (data_dir, u_boot_config.build_dir), > shell=True) > + if capsule_auth_enabled: > + # copy keys/certificates > + check_call('cp %s/test/py/tests/test_efi_capsule/SIGNER*.* %s' % > + (u_boot_config.source_dir, data_dir), > + shell=True) > + # firmware signed with proper key > + check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER.key --certificate SIGNER.crt Test03' % > + (data_dir, u_boot_config.build_dir), > + shell=True) > + # firmware signed with *mal* key > + check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER2.key --certificate SIGNER2.crt Test04' % > + (data_dir, u_boot_config.build_dir), > + shell=True) > > # Create a disk image with EFI system partition > check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat %s %s' % > diff --git a/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py > new file mode 100644 > index 000000000000..8fe93ef424ac > --- /dev/null > +++ b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py > @@ -0,0 +1,228 @@ > +# SPDX-License-Identifier: GPL-2.0+ > +# Copyright (c) 2021, Linaro Limited > +# Author: AKASHI Takahiro <takahiro.akashi@linaro.org> > +# > +# U-Boot UEFI: Firmware Update (Signed capsule) Test > + > +""" > +This test verifies capsule-on-disk firmware update > +with signed capsule files > +""" > + > +from subprocess import check_call, check_output, CalledProcessError > +import pytest > +from capsule_defs import * > + > +@pytest.mark.boardspec('sandbox') > +@pytest.mark.buildconfigspec('efi_capsule_firmware_raw') > +@pytest.mark.buildconfigspec('efi_capsule_authenticate') > +@pytest.mark.buildconfigspec('dfu') > +@pytest.mark.buildconfigspec('dfu_sf') > +@pytest.mark.buildconfigspec('cmd_efidebug') > +@pytest.mark.buildconfigspec('cmd_fat') > +@pytest.mark.buildconfigspec('cmd_memory') > +@pytest.mark.buildconfigspec('cmd_nvedit_efi') > +@pytest.mark.buildconfigspec('cmd_sf') > +@pytest.mark.slow > +class TestEfiCapsuleFirmwareSigned(object): > + def test_efi_capsule_auth1( > + self, u_boot_config, u_boot_console, efi_capsule_data): > + """ > + Test Case 1 - Update U-Boot on SPI Flash, raw image format > + 0x100000-0x150000: U-Boot binary (but dummy) > + > + If the capsule is properly signed, the authentication > + should pass and the firmware be updated. > + """ > + disk_img = efi_capsule_data > + with u_boot_console.log.section('Test Case 1-a, before reboot'): > + output = u_boot_console.run_command_list([ > + 'host bind 0 %s' % disk_img, > + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi', > + 'efidebug boot order 1', > + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004', > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > + 'env save']) > + > + # initialize content > + output = u_boot_console.run_command_list([ > + 'sf probe 0:0', > + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR, > + 'sf write 4000000 100000 10', > + 'sf read 5000000 100000 10', > + 'md.b 5000000 10']) > + assert 'Old' in ''.join(output) > + > + # place a capsule file > + output = u_boot_console.run_command_list([ > + 'fatload host 0:1 4000000 %s/Test03' % CAPSULE_DATA_DIR, > + 'fatwrite host 0:1 4000000 %s/Test03 $filesize' % CAPSULE_INSTALL_DIR, > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > + assert 'Test03' in ''.join(output) > + > + # reboot > + u_boot_console.restart_uboot() > + > + capsule_early = u_boot_config.buildconfig.get( > + 'config_efi_capsule_on_disk_early') > + with u_boot_console.log.section('Test Case 1-b, after reboot'): > + if not capsule_early: > + # make sure that dfu_alt_info exists even persistent variables > + # are not available. > + output = u_boot_console.run_command_list([ > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > + 'host bind 0 %s' % disk_img, > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > + assert 'Test03' in ''.join(output) > + > + # need to run uefi command to initiate capsule handling > + output = u_boot_console.run_command( > + 'env print -e Capsule0000') > + > + output = u_boot_console.run_command_list([ > + 'host bind 0 %s' % disk_img, > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > + assert 'Test03' not in ''.join(output) > + > + output = u_boot_console.run_command_list([ > + 'sf probe 0:0', > + 'sf read 4000000 100000 10', > + 'md.b 4000000 10']) > + assert 'u-boot:New' in ''.join(output) > + > + def test_efi_capsule_auth2( > + self, u_boot_config, u_boot_console, efi_capsule_data): > + """ > + Test Case 2 - Update U-Boot on SPI Flash, raw image format > + 0x100000-0x150000: U-Boot binary (but dummy) > + > + If the capsule is signed but with an invalid key, > + the authentication should fail and the firmware > + not be updated. > + """ > + disk_img = efi_capsule_data > + with u_boot_console.log.section('Test Case 2-a, before reboot'): > + output = u_boot_console.run_command_list([ > + 'host bind 0 %s' % disk_img, > + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi', > + 'efidebug boot order 1', > + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004', > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > + 'env save']) > + > + # initialize content > + output = u_boot_console.run_command_list([ > + 'sf probe 0:0', > + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR, > + 'sf write 4000000 100000 10', > + 'sf read 5000000 100000 10', > + 'md.b 5000000 10']) > + assert 'Old' in ''.join(output) > + > + # place a capsule file > + output = u_boot_console.run_command_list([ > + 'fatload host 0:1 4000000 %s/Test04' % CAPSULE_DATA_DIR, > + 'fatwrite host 0:1 4000000 %s/Test04 $filesize' % CAPSULE_INSTALL_DIR, > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > + assert 'Test04' in ''.join(output) > + > + # reboot > + u_boot_console.restart_uboot() > + > + capsule_early = u_boot_config.buildconfig.get( > + 'config_efi_capsule_on_disk_early') > + with u_boot_console.log.section('Test Case 2-b, after reboot'): > + if not capsule_early: > + # make sure that dfu_alt_info exists even persistent variables > + # are not available. > + output = u_boot_console.run_command_list([ > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > + 'host bind 0 %s' % disk_img, > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > + assert 'Test04' in ''.join(output) > + > + # need to run uefi command to initiate capsule handling > + output = u_boot_console.run_command( > + 'env print -e Capsule0000') > + > + # deleted any way > + output = u_boot_console.run_command_list([ > + 'host bind 0 %s' % disk_img, > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > + assert 'Test04' not in ''.join(output) > + > + # TODO: check CapsuleStatus in CapsuleXXXX > + > + output = u_boot_console.run_command_list([ > + 'sf probe 0:0', > + 'sf read 4000000 100000 10', > + 'md.b 4000000 10']) > + assert 'u-boot:Old' in ''.join(output) > + > + def test_efi_capsule_auth3( > + self, u_boot_config, u_boot_console, efi_capsule_data): > + """ > + Test Case 3 - Update U-Boot on SPI Flash, raw image format > + 0x100000-0x150000: U-Boot binary (but dummy) > + > + If the capsule is not signed, the authentication > + should fail and the firmware not be updated. > + """ > + disk_img = efi_capsule_data > + with u_boot_console.log.section('Test Case 3-a, before reboot'): > + output = u_boot_console.run_command_list([ > + 'host bind 0 %s' % disk_img, > + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi', > + 'efidebug boot order 1', > + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004', > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > + 'env save']) > + > + # initialize content > + output = u_boot_console.run_command_list([ > + 'sf probe 0:0', > + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR, > + 'sf write 4000000 100000 10', > + 'sf read 5000000 100000 10', > + 'md.b 5000000 10']) > + assert 'Old' in ''.join(output) > + > + # place a capsule file > + output = u_boot_console.run_command_list([ > + 'fatload host 0:1 4000000 %s/Test02' % CAPSULE_DATA_DIR, > + 'fatwrite host 0:1 4000000 %s/Test02 $filesize' % CAPSULE_INSTALL_DIR, > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > + assert 'Test02' in ''.join(output) > + > + # reboot > + u_boot_console.restart_uboot() > + > + capsule_early = u_boot_config.buildconfig.get( > + 'config_efi_capsule_on_disk_early') > + with u_boot_console.log.section('Test Case 3-b, after reboot'): > + if not capsule_early: > + # make sure that dfu_alt_info exists even persistent variables > + # are not available. > + output = u_boot_console.run_command_list([ > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > + 'host bind 0 %s' % disk_img, > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > + assert 'Test02' in ''.join(output) > + > + # need to run uefi command to initiate capsule handling > + output = u_boot_console.run_command( > + 'env print -e Capsule0000') > + > + # deleted any way > + output = u_boot_console.run_command_list([ > + 'host bind 0 %s' % disk_img, > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > + assert 'Test02' not in ''.join(output) > + > + # TODO: check CapsuleStatus in CapsuleXXXX > + > + output = u_boot_console.run_command_list([ > + 'sf probe 0:0', > + 'sf read 4000000 100000 10', > + 'md.b 4000000 10']) > + assert 'u-boot:Old' in ''.join(output) >
On Sun, Aug 01, 2021 at 11:38:16AM +0200, Heinrich Schuchardt wrote: > On 7/27/21 11:10 AM, AKASHI Takahiro wrote: > > Add a couple of test cases against capsule image authentication > > for capsule-on-disk, where only a signed capsule file with the verified > > signature will be applied to the system. > > > > Due to the difficulty of embedding a public key (esl file) in U-Boot > > binary during pytest setup time, all the keys/certificates are pre-created. > > > > Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> > > Please, check the pylint warnings: > > $ pylint test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py > ************* Module test_capsule_firmware_signed > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:44:0: > C0301: Line too long (113/100) (line-too-long) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:73:0: > C0301: Line too long (117/100) (line-too-long) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:110:0: > C0301: Line too long (113/100) (line-too-long) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:139:0: > C0301: Line too long (117/100) (line-too-long) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:178:0: > C0301: Line too long (113/100) (line-too-long) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:207:0: > C0301: Line too long (117/100) (line-too-long) As you can see, the line is given as a single "command line" string. Breaking the line into meaningless pieces of strings won't make sense here. > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:154:2: > W0511: TODO: check CapsuleStatus in CapsuleXXXX (fixme) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:222:2: > W0511: TODO: check CapsuleStatus in CapsuleXXXX (fixme) I don't intend to fix those TODOs soon. > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:14:0: > W0401: Wildcard import capsule_defs (wildcard-import) Will fix. > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:27:0: > C0115: Missing class docstring (missing-class-docstring) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:27:0: > R0205: Class 'TestEfiCapsuleFirmwareSigned' inherits from object, can be > safely removed from bases in python3 (useless-object-inheritance) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:28:4: > R0201: Method could be a function (no-self-use) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:93:4: > R0201: Method could be a function (no-self-use) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:162:4: > R0201: Method could be a function (no-self-use) I would like to maintain the syntax that I use in this file: class TestXXX(): def test_yyy(): ... even though pylint suggests that those changes be safely made. "class/def" combination will allow us to add more tests cases for different test conditions in the future without modifying the structure of the file. > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:12:0: > W0611: Unused check_call imported from subprocess (unused-import) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:12:0: > W0611: Unused check_output imported from subprocess (unused-import) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:12:0: > W0611: Unused CalledProcessError imported from subprocess (unused-import) > test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:14:0: > W0614: Unused import EFITOOLS_PATH from wildcard import > (unused-wildcard-import) Will fix. -Takahiro Akashi > Best regards > > Heinrich > > > --- > > test/py/tests/test_efi_capsule/SIGNER.crt | 19 ++ > > test/py/tests/test_efi_capsule/SIGNER.esl | Bin 0 -> 829 bytes > > test/py/tests/test_efi_capsule/SIGNER.key | 28 +++ > > test/py/tests/test_efi_capsule/SIGNER2.crt | 19 ++ > > test/py/tests/test_efi_capsule/SIGNER2.key | 28 +++ > > .../py/tests/test_efi_capsule/capsule_defs.py | 5 + > > test/py/tests/test_efi_capsule/conftest.py | 35 ++- > > .../test_capsule_firmware_signed.py | 228 ++++++++++++++++++ > > 8 files changed, 359 insertions(+), 3 deletions(-) > > create mode 100644 test/py/tests/test_efi_capsule/SIGNER.crt > > create mode 100644 test/py/tests/test_efi_capsule/SIGNER.esl > > create mode 100644 test/py/tests/test_efi_capsule/SIGNER.key > > create mode 100644 test/py/tests/test_efi_capsule/SIGNER2.crt > > create mode 100644 test/py/tests/test_efi_capsule/SIGNER2.key > > create mode 100644 test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py > > > > diff --git a/test/py/tests/test_efi_capsule/SIGNER.crt b/test/py/tests/test_efi_capsule/SIGNER.crt > > new file mode 100644 > > index 000000000000..f63ec01d9996 > > --- /dev/null > > +++ b/test/py/tests/test_efi_capsule/SIGNER.crt > > @@ -0,0 +1,19 @@ > > +-----BEGIN CERTIFICATE----- > > +MIIDDTCCAfWgAwIBAgIUD96z+lSbhDFN76YoIY2LnDBt1yQwDQYJKoZIhvcNAQEL > > +BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw > > +NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN > > +AQEBBQADggEPADCCAQoCggEBAMBuazX28i0y4L0loJYJOtlvF5eWb4tbx7zwei5c > > +KoSzQYixinS10OrVy7y8mELyXOlGOOsM509vzvoia0nffwEPsvTBeS3le2JBz9iN > > +/+AIo+gUmzgEPQN+jp+s4fi0yzRvq3BgWu1ego2gExxQ7AePQHoSkX8UeC3Kb7SF > > +a8Kt/TopOupZfEuZ+EtoxPA4JUStFgEUEcRJEfpQqECXV+lKqcyqHc2ZUzMisu+i > > +5omkneX8sEZdIPFsSGanCyY3F9VjWzIxo60PU2xUBOIcEUg5luR+VXT4090g/yCw > > +8PSf9rIKgGIQSQKAlUSc7zuXQIdgIMTS1xUpc/Nx+SqWNZECAwEAAaNTMFEwHQYD > > +VR0OBBYEFHndZVpPrAjc3OD3UZ3xkXQqDOlZMB8GA1UdIwQYMBaAFHndZVpPrAjc > > +3OD3UZ3xkXQqDOlZMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB > > +AG88t6w0qTXE50ltps62f6wtuuZsiX1zj+AluO4E8E3Wi0QsNtT24JdY2P4mAg8y > > +abYLdgJIldzzsfjWWok9Dfqnx29tqgesKWkgUo16v70i4EVZ9YWGe+CfOK639OxL > > +4D0XPcU5CUpDrEcnt59wCxQ7IArZzrDxrqigEw5nReejtgQV/mEzvVOzWjLjmngy > > +SpvrydxYpfSvOJ3KGV9xw3Oa/qO3pS0ZNX9QqZdcC94M0SI6OF635oxJkz6JToYq > > ++qtv9PZtZnEU/cwzL0nTXMj7yRsP5+2Wre26yT62nKRy9P/3UFwmsJ0OuEmnol5I > > +141ZGfBYmSQ6EReOwNeK7A0= > > +-----END CERTIFICATE----- > > diff --git a/test/py/tests/test_efi_capsule/SIGNER.esl b/test/py/tests/test_efi_capsule/SIGNER.esl > > new file mode 100644 > > index 0000000000000000000000000000000000000000..a54536e243d274b74985abbecfe234d14013ef33 > > GIT binary patch > > literal 829 > > zcmZ1&d0^?2Da*aux2_hA(f&|m%gg`<iclKDgOCPI%)ACoj9(WpGchtTiSXas{3~R3 > > zi=prPWg3dT-E$0bud5jFvT<s)d9;1!Wn|=LWiSvk6fqEDV-96u=HU);4GxJ9_H_4i > > z4Kk1u=QT1kFgG$YurM_?G>rmsjgYuF^))dnAzQ)7%D~*j$j<<D6&F(zBO}9sylm5N > > zpLC5L>{VSbjnnF8zWDTM`Q6dS_k5_*i_vP??AWoft7PkiS65H(*)zlGQ_M>@i`P8Q > > z{qxWLQp)zcU(d+D>C3@N-KW(_j^}Um{(r!+_=U)93l>}Ey1w~q9{$*J+9ZE<K|<8q > > zxTf9(!ZHDG*!vx-geKODROp_{-_n|WXzgDsO{-UtHQqCScxN2>V4>==R*X?Z@QA12 > > zuYeT})5BkStvs_z_Uz1HW2H^+7d`7-GWY494Q{atA9Fm?mUF9_i(gHSHZokimOnTr > > zgyoTppoitOCv~AEKQ7-@_^+_x!<YHrHgPp133xI!Om&&_-g>%2dxFA|OV>p;i$53s > > z)S6~Gk%^g+fpKxLL7;&wFw|xFSj1RFD(|L7`LE%)bLYYLz_}kMmT2+3j5Lr3Nh`BR > > z7>G4sSHKTaAk4`4pM}+c8Au@qJ1}N}!OqB#Z?k=k$x72B&pmUOo!eHwMt9e<oX*<f > > z{s*c%-m!e}z1HobV|L}+gXs}B{;4tX8)a_eE@SeTdgt@TAJ?KfZFzq!Kc1hvihYe{ > > zrb19})&9Lo4_qU^wzgG2m~XLe`<FM~4{XJ4k6LniIj?b7-#)*9Tf|y{>*l!)AJ?r| > > zAk3HU`h4*=7SVr+#(RS|M;SeyRbk{c`}N5?5lg?Ux0riMGQRL|@vMJ~w=dO|G_4O< > > zIX#B^9?wN3D~q`8&w4y3+jaW2Y5iKA|K(e5TA|3_GsgO!mt#)+J}J%r{Oz>0Z+D%v > > r+csxO(U<?<17g%R%;nqRxqMNa$MxPw$qx}TRjdTX`wm?1dcz9<2x(B# > > > > literal 0 > > HcmV?d00001 > > > > diff --git a/test/py/tests/test_efi_capsule/SIGNER.key b/test/py/tests/test_efi_capsule/SIGNER.key > > new file mode 100644 > > index 000000000000..9952647ed74a > > --- /dev/null > > +++ b/test/py/tests/test_efi_capsule/SIGNER.key > > @@ -0,0 +1,28 @@ > > +-----BEGIN PRIVATE KEY----- > > +MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQDAbms19vItMuC9 > > +JaCWCTrZbxeXlm+LW8e88HouXCqEs0GIsYp0tdDq1cu8vJhC8lzpRjjrDOdPb876 > > +ImtJ338BD7L0wXkt5XtiQc/Yjf/gCKPoFJs4BD0Dfo6frOH4tMs0b6twYFrtXoKN > > +oBMcUOwHj0B6EpF/FHgtym+0hWvCrf06KTrqWXxLmfhLaMTwOCVErRYBFBHESRH6 > > +UKhAl1fpSqnMqh3NmVMzIrLvouaJpJ3l/LBGXSDxbEhmpwsmNxfVY1syMaOtD1Ns > > +VATiHBFIOZbkflV0+NPdIP8gsPD0n/ayCoBiEEkCgJVEnO87l0CHYCDE0tcVKXPz > > +cfkqljWRAgMBAAECggEAItLYrAdohC105kXs7bn14GtuRYx/2yRc3SBXvBQJzcHy > > +1h3rBHvytszB9gHbPCJIFh8TJdZL9eAyAKpB6Dh9718773cjyt6AmaN3TaVE7PIj > > +V1iDTnvV3tAEV3kd27g8Hd0nlUqaqeI0lhSl4LX0QNn3vR+nHOxDY2YDGRQcEDrD > > +4hlCIGzAfbCW9gINdadQnC6p9NEBbfJ18doCagdn1Q1UYs8YlWwhBK98wXKGsG6T > > +TUywOWIe6+VJqzSwZn5YkDVD3qD4tToar7T0jrCvZjbTbOsjtinD70c3uBcrK/XN > > +gpwJfTiDLo1d0tNoWCRUH0myMs1fq3H3SkdfqB1GwQKBgQDrw8FwUc3Q+j8YhR7i > > +73H/osk3VOZhCPsqbrQThUo5ZV4EXqp9E3PLN5E3suWgfaXVCEI3lHARUyR+J+E/ > > +evIrUUnkIryLdVOwwEWRonW4cLANjLSzT0eA85CFLXKUaij7Jfon2YNs9CmUARnC > > +M96T3a89XOezX/SbRVz6X8KslQKBgQDQ8onkHcscHMANIjgxycIgYF+MvxwHRICA > > +nt3ZSQiGSXJbWK7/sM5yd16ulvsXL7aF9G+q5osOzDWJ0w4SOhqNDfItrFH34Px6 > > +qEPjq/sAigqqrQls7uu7MHfkE+eEy181CoT9argxo8ifAQDn4YtXBW6L7p6AgaAx > > +83FAbBcqDQKBgQClHk185534zTqhZqIyF7bEbfL0sJ5EuXCG0E+IGGLafdbxwocu > > +4A/J9Jnc44sU8srQv1745Bn02EEHpdCIkAfJNL5Ga9mW5k39zTsr+xbtXObAJppr > > +touCkZLW4vSLYypecsOXYyw7g2kXQgoTTBaHgsv3cvjHVN3QXSz4IVcLXQJ/LBL9 > > +AyFFtqhZ2mtdbyMfz7SEcyvcvau1b2wTX8IICktz09DhGQ4yffKwBiPS0xE9bwQg > > +iewXaQeqQ2hBj5ayAw7uBrRSlfbfSwAzUdL1Hyf/GAFn+5JqJxISOAn6zAgaDRYq > > +90mLkOz7ZI7RohfxTGnY56ttw62UHPU87lneiQKBgHcVituUDJgmbaHXx2IVzKsm > > +5uDyXUf4S+tY5CZj6WTsb70+q4PYfh1D02nZgxuLNwpwNI0uhLIkLYHcL3poOapC > > +LCXS8tsexNosmrTmjHFh/uNdKb7bKbMxyzYrr+ADKMclF3CJzKDzLfiIe9Na+bWa > > +q5/HYNIw5zJyapPksgr4 > > +-----END PRIVATE KEY----- > > diff --git a/test/py/tests/test_efi_capsule/SIGNER2.crt b/test/py/tests/test_efi_capsule/SIGNER2.crt > > new file mode 100644 > > index 000000000000..8889a3ed930a > > --- /dev/null > > +++ b/test/py/tests/test_efi_capsule/SIGNER2.crt > > @@ -0,0 +1,19 @@ > > +-----BEGIN CERTIFICATE----- > > +MIIDDTCCAfWgAwIBAgIUfmZcui7VkJEe9jx25Epo6jJ6l+owDQYJKoZIhvcNAQEL > > +BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw > > +NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN > > +AQEBBQADggEPADCCAQoCggEBANozXTFKGVx0121MIBoSgxfI8IHcfY32T/LQusse > > +PaXsm0GaJNwOgEP34u1k0cz466swfBCqTcZRjKuDpcH1sgrF1XaKjxuwYuiJrbsf > > +ykVesN1z1bIamkFdVR/CBJEwN/epsyCBQCSbcxUwEX+ayq2zp+kSweew1B4i3u8f > > +nbqFB15Rt+KAzFaBlvOJhmoZP7uYtb8zHa58eteaxQmPFt3v6eEbgOt92oVB8fPQ > > +JJBuxUAHdimMDQ9mBGUosXR8PFyma5jOiOyY+0oTfig4bRHbGxCGMYyABJDH+j4e > > +7Zl7lVMsq2fTm/lGONRX2QPLfMO298pz/wundJmYhseibvUCAwEAAaNTMFEwHQYD > > +VR0OBBYEFDPYxE3oBmU1pWrZpY62JuXgcK5aMB8GA1UdIwQYMBaAFDPYxE3oBmU1 > > +pWrZpY62JuXgcK5aMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB > > +AEtY9QnvTvgmXmep7AMv/T6+GpERvsRdi+Lc+16L7uSCQhouDkeu5/sUHax6icX1 > > +NyDb3u6tyQhMnm7CD+7Mo74wrZ4vK2SzBoZSBLi+Tyz2ScyysdRIo7O42nxVyWm7 > > +ifZVfQKvanUjDSxPO89yJDYp0znvVpuZOzYXFHdprHoR5Atkth11HFHzWDzqblKS > > +sx145wgPZ9bYohuOn1weyORsG9bJcHznPyJ1ceAOFk40bKWWLQtruWIhY4aZIlJN > > +cDKv92rtgVApaamu+WRC4pzgQMQYKOcnMz4ZKeOKgEajfo6nOUVrvc0IYO6wixvi > > +V+Msrg5o7ag2SN2AHg5/1/4= > > +-----END CERTIFICATE----- > > diff --git a/test/py/tests/test_efi_capsule/SIGNER2.key b/test/py/tests/test_efi_capsule/SIGNER2.key > > new file mode 100644 > > index 000000000000..ee467fd9f7a6 > > --- /dev/null > > +++ b/test/py/tests/test_efi_capsule/SIGNER2.key > > @@ -0,0 +1,28 @@ > > +-----BEGIN PRIVATE KEY----- > > +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDaM10xShlcdNdt > > +TCAaEoMXyPCB3H2N9k/y0LrLHj2l7JtBmiTcDoBD9+LtZNHM+OurMHwQqk3GUYyr > > +g6XB9bIKxdV2io8bsGLoia27H8pFXrDdc9WyGppBXVUfwgSRMDf3qbMggUAkm3MV > > +MBF/msqts6fpEsHnsNQeIt7vH526hQdeUbfigMxWgZbziYZqGT+7mLW/Mx2ufHrX > > +msUJjxbd7+nhG4DrfdqFQfHz0CSQbsVAB3YpjA0PZgRlKLF0fDxcpmuYzojsmPtK > > +E34oOG0R2xsQhjGMgASQx/o+Hu2Ze5VTLKtn05v5RjjUV9kDy3zDtvfKc/8Lp3SZ > > +mIbHom71AgMBAAECggEBAJXskO3bAg364kJg+fWwHo7rLAWuYD54rXojXRVPFAC7 > > +z/mFVio1dIA/BJcknNr/db5MNBKnUYUgZ005yVy52rl4MTGgBrB5w5wPbWWTdEGx > > +zEh83KnhiXe8D08g2k6AGRR8b224IUCF5s76FivdScGMHaURlFYDs9t5DkCzMocC > > +ty0ewHv9aeMSzJl4y+DrRw+NkkAntlAkerCI5PInFtxyOQ6lFIRkMKlBA//VL0QF > > +B9yGbmfoxlErWCqnj70DTcVO7O2AaijU+FTMRbb/V7r34GPU0Cfeum6gGNOtDkaX > > +3UnWGR2esiHViMqz8vvEYtVIxHhLTD7INqDlK/yiNEECgYEA+ua1JcHXI2qS3cV/ > > +BuVvBrd3MzIpZvddCcTdo/B7WT3EoTupEG1gcajrCuNQDtRoizSbMuhCXYoMsktF > > +wXFoTWoGr8yO7uVU5r2nCXZneprV3kuQmR0qYipN2GTCGSE1rKQI+YXeALPF1qIp > > +12vUVdzWVDJvlQRMvSTlzpRZQkkCgYEA3qKI1ZsBszKPbnzLX91+ZAZeAwwN/HvS > > +nrIveJAci/9U2yV2mw3l/Dulc8EkGABs/cMp47toje8DmsSfdu1yIYqpi3MHvefX > > ++ijc3ry5v28Hia3WP3WPczqhbkT7cco0t8Vwm9w1B+kkreuRCtyoCOLsRauB0CH1 > > +QJjMtPAth00CgYAKUUhruA/nxe8qLX/uwaqSJSNCuLJZKJzr1OukXTRFVDPsyW5H > > +XagUpHSd6wEUywlNiClFq6VnAVFKV6wTq101qcGCoy/RhR67qlrfGb5hnVJkJMla > > +coeWp9SxrFsK+4GgitJPqICbmMju7ZY45JdDvKQXrEdIYnfhY04L86/D+QKBgBxx > > +nZPU0vnHCuYt0Xn0/XHgEmDHSH4qf7VAxKndl5gXTgsVlTqoIur/39qTIX5jh4lA > > +RvjOd8Qydj5uwoTaP0ujwJeNYb7UgRZ35AgdCoo3sDnZ2NaQuXwaUIebDpjyIZwd > > +AI8ZKjlRgxspToWZvWotO8yG5fXmcMQJAZZYXSi9AoGBALfXX/C5ojwms1l+XP+p > > +FKzOFZ/uEKPfQid+2Sm1BknXXGVbs3zJ4OdonTvhjq+VQvXTW4IvjgY8TpumQZvE > > +8nb7I8E1B6ajkSvgfetN9jlKM5hzIfJ3Vxx6hMGMab1ySKy3rZGPL706CW2BeMI2 > > +v2k9P0qWItuE4S7I4hEsovwS > > +-----END PRIVATE KEY----- > > diff --git a/test/py/tests/test_efi_capsule/capsule_defs.py b/test/py/tests/test_efi_capsule/capsule_defs.py > > index 4fd6353c2040..aa9bf5eee3aa 100644 > > --- a/test/py/tests/test_efi_capsule/capsule_defs.py > > +++ b/test/py/tests/test_efi_capsule/capsule_defs.py > > @@ -3,3 +3,8 @@ > > # Directories > > CAPSULE_DATA_DIR = '/EFI/CapsuleTestData' > > CAPSULE_INSTALL_DIR = '/EFI/UpdateCapsule' > > + > > +# v1.5.1 or earlier of efitools has a bug in sha256 calculation, and > > +# you need build a newer version on your own. > > +# The path must terminate with '/'. > > +EFITOOLS_PATH = '' > > diff --git a/test/py/tests/test_efi_capsule/conftest.py b/test/py/tests/test_efi_capsule/conftest.py > > index 6ad5608cd71c..35cfa5513703 100644 > > --- a/test/py/tests/test_efi_capsule/conftest.py > > +++ b/test/py/tests/test_efi_capsule/conftest.py > > @@ -10,13 +10,13 @@ import pytest > > from capsule_defs import * > > > > # > > -# Fixture for UEFI secure boot test > > +# Fixture for UEFI capsule test > > # > > > > - > > @pytest.fixture(scope='session') > > def efi_capsule_data(request, u_boot_config): > > - """Set up a file system to be used in UEFI capsule test. > > + """Set up a file system to be used in UEFI capsule and > > + authentication test. > > > > Args: > > request: Pytest request object. > > @@ -40,6 +40,22 @@ def efi_capsule_data(request, u_boot_config): > > check_call('mkdir -p %s' % data_dir, shell=True) > > check_call('mkdir -p %s' % install_dir, shell=True) > > > > + capsule_auth_enabled = u_boot_config.buildconfig.get( > > + 'config_efi_capsule_authenticate') > > + # NOTE: > > + # private keys (SIGNER?.key) dn certificates (SIGNER?.crt) > > + # in this pytest directory are created this way: > > + # Create private key (SIGNER.key) and certificate (SIGNER.crt) > > + # check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER.key -out SIGNER.crt -nodes -days 365' > > + # % data_dir, shell=True) > > + # check_call('cd %s; %scert-to-efi-sig-list SIGNER.crt SIGNER.esl' > > + # % (data_dir, EFITOOLS_PATH), shell=True) > > + > > + # Create *malicious* private key (SIGNER2.key) and certificate > > + # (SIGNER2.crt) > > + # check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER2.key -out SIGNER2.crt -nodes -days 365' > > + # % data_dir, shell=True) > > + > > # Create capsule files > > # two regions: one for u-boot.bin and the other for u-boot.env > > check_call('cd %s; echo -n u-boot:Old > u-boot.bin.old; echo -n u-boot:New > u-boot.bin.new; echo -n u-boot-env:Old -> u-boot.env.old; echo -n u-boot-env:New > u-boot.env.new' % data_dir, > > @@ -56,6 +72,19 @@ def efi_capsule_data(request, u_boot_config): > > check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 Test02' % > > (data_dir, u_boot_config.build_dir), > > shell=True) > > + if capsule_auth_enabled: > > + # copy keys/certificates > > + check_call('cp %s/test/py/tests/test_efi_capsule/SIGNER*.* %s' % > > + (u_boot_config.source_dir, data_dir), > > + shell=True) > > + # firmware signed with proper key > > + check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER.key --certificate SIGNER.crt Test03' % > > + (data_dir, u_boot_config.build_dir), > > + shell=True) > > + # firmware signed with *mal* key > > + check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER2.key --certificate SIGNER2.crt Test04' % > > + (data_dir, u_boot_config.build_dir), > > + shell=True) > > > > # Create a disk image with EFI system partition > > check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat %s %s' % > > diff --git a/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py > > new file mode 100644 > > index 000000000000..8fe93ef424ac > > --- /dev/null > > +++ b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py > > @@ -0,0 +1,228 @@ > > +# SPDX-License-Identifier: GPL-2.0+ > > +# Copyright (c) 2021, Linaro Limited > > +# Author: AKASHI Takahiro <takahiro.akashi@linaro.org> > > +# > > +# U-Boot UEFI: Firmware Update (Signed capsule) Test > > + > > +""" > > +This test verifies capsule-on-disk firmware update > > +with signed capsule files > > +""" > > + > > +from subprocess import check_call, check_output, CalledProcessError > > +import pytest > > +from capsule_defs import * > > + > > +@pytest.mark.boardspec('sandbox') > > +@pytest.mark.buildconfigspec('efi_capsule_firmware_raw') > > +@pytest.mark.buildconfigspec('efi_capsule_authenticate') > > +@pytest.mark.buildconfigspec('dfu') > > +@pytest.mark.buildconfigspec('dfu_sf') > > +@pytest.mark.buildconfigspec('cmd_efidebug') > > +@pytest.mark.buildconfigspec('cmd_fat') > > +@pytest.mark.buildconfigspec('cmd_memory') > > +@pytest.mark.buildconfigspec('cmd_nvedit_efi') > > +@pytest.mark.buildconfigspec('cmd_sf') > > +@pytest.mark.slow > > +class TestEfiCapsuleFirmwareSigned(object): > > + def test_efi_capsule_auth1( > > + self, u_boot_config, u_boot_console, efi_capsule_data): > > + """ > > + Test Case 1 - Update U-Boot on SPI Flash, raw image format > > + 0x100000-0x150000: U-Boot binary (but dummy) > > + > > + If the capsule is properly signed, the authentication > > + should pass and the firmware be updated. > > + """ > > + disk_img = efi_capsule_data > > + with u_boot_console.log.section('Test Case 1-a, before reboot'): > > + output = u_boot_console.run_command_list([ > > + 'host bind 0 %s' % disk_img, > > + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi', > > + 'efidebug boot order 1', > > + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004', > > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > > + 'env save']) > > + > > + # initialize content > > + output = u_boot_console.run_command_list([ > > + 'sf probe 0:0', > > + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR, > > + 'sf write 4000000 100000 10', > > + 'sf read 5000000 100000 10', > > + 'md.b 5000000 10']) > > + assert 'Old' in ''.join(output) > > + > > + # place a capsule file > > + output = u_boot_console.run_command_list([ > > + 'fatload host 0:1 4000000 %s/Test03' % CAPSULE_DATA_DIR, > > + 'fatwrite host 0:1 4000000 %s/Test03 $filesize' % CAPSULE_INSTALL_DIR, > > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > > + assert 'Test03' in ''.join(output) > > + > > + # reboot > > + u_boot_console.restart_uboot() > > + > > + capsule_early = u_boot_config.buildconfig.get( > > + 'config_efi_capsule_on_disk_early') > > + with u_boot_console.log.section('Test Case 1-b, after reboot'): > > + if not capsule_early: > > + # make sure that dfu_alt_info exists even persistent variables > > + # are not available. > > + output = u_boot_console.run_command_list([ > > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > > + 'host bind 0 %s' % disk_img, > > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > > + assert 'Test03' in ''.join(output) > > + > > + # need to run uefi command to initiate capsule handling > > + output = u_boot_console.run_command( > > + 'env print -e Capsule0000') > > + > > + output = u_boot_console.run_command_list([ > > + 'host bind 0 %s' % disk_img, > > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > > + assert 'Test03' not in ''.join(output) > > + > > + output = u_boot_console.run_command_list([ > > + 'sf probe 0:0', > > + 'sf read 4000000 100000 10', > > + 'md.b 4000000 10']) > > + assert 'u-boot:New' in ''.join(output) > > + > > + def test_efi_capsule_auth2( > > + self, u_boot_config, u_boot_console, efi_capsule_data): > > + """ > > + Test Case 2 - Update U-Boot on SPI Flash, raw image format > > + 0x100000-0x150000: U-Boot binary (but dummy) > > + > > + If the capsule is signed but with an invalid key, > > + the authentication should fail and the firmware > > + not be updated. > > + """ > > + disk_img = efi_capsule_data > > + with u_boot_console.log.section('Test Case 2-a, before reboot'): > > + output = u_boot_console.run_command_list([ > > + 'host bind 0 %s' % disk_img, > > + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi', > > + 'efidebug boot order 1', > > + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004', > > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > > + 'env save']) > > + > > + # initialize content > > + output = u_boot_console.run_command_list([ > > + 'sf probe 0:0', > > + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR, > > + 'sf write 4000000 100000 10', > > + 'sf read 5000000 100000 10', > > + 'md.b 5000000 10']) > > + assert 'Old' in ''.join(output) > > + > > + # place a capsule file > > + output = u_boot_console.run_command_list([ > > + 'fatload host 0:1 4000000 %s/Test04' % CAPSULE_DATA_DIR, > > + 'fatwrite host 0:1 4000000 %s/Test04 $filesize' % CAPSULE_INSTALL_DIR, > > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > > + assert 'Test04' in ''.join(output) > > + > > + # reboot > > + u_boot_console.restart_uboot() > > + > > + capsule_early = u_boot_config.buildconfig.get( > > + 'config_efi_capsule_on_disk_early') > > + with u_boot_console.log.section('Test Case 2-b, after reboot'): > > + if not capsule_early: > > + # make sure that dfu_alt_info exists even persistent variables > > + # are not available. > > + output = u_boot_console.run_command_list([ > > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > > + 'host bind 0 %s' % disk_img, > > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > > + assert 'Test04' in ''.join(output) > > + > > + # need to run uefi command to initiate capsule handling > > + output = u_boot_console.run_command( > > + 'env print -e Capsule0000') > > + > > + # deleted any way > > + output = u_boot_console.run_command_list([ > > + 'host bind 0 %s' % disk_img, > > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > > + assert 'Test04' not in ''.join(output) > > + > > + # TODO: check CapsuleStatus in CapsuleXXXX > > + > > + output = u_boot_console.run_command_list([ > > + 'sf probe 0:0', > > + 'sf read 4000000 100000 10', > > + 'md.b 4000000 10']) > > + assert 'u-boot:Old' in ''.join(output) > > + > > + def test_efi_capsule_auth3( > > + self, u_boot_config, u_boot_console, efi_capsule_data): > > + """ > > + Test Case 3 - Update U-Boot on SPI Flash, raw image format > > + 0x100000-0x150000: U-Boot binary (but dummy) > > + > > + If the capsule is not signed, the authentication > > + should fail and the firmware not be updated. > > + """ > > + disk_img = efi_capsule_data > > + with u_boot_console.log.section('Test Case 3-a, before reboot'): > > + output = u_boot_console.run_command_list([ > > + 'host bind 0 %s' % disk_img, > > + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi', > > + 'efidebug boot order 1', > > + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004', > > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > > + 'env save']) > > + > > + # initialize content > > + output = u_boot_console.run_command_list([ > > + 'sf probe 0:0', > > + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR, > > + 'sf write 4000000 100000 10', > > + 'sf read 5000000 100000 10', > > + 'md.b 5000000 10']) > > + assert 'Old' in ''.join(output) > > + > > + # place a capsule file > > + output = u_boot_console.run_command_list([ > > + 'fatload host 0:1 4000000 %s/Test02' % CAPSULE_DATA_DIR, > > + 'fatwrite host 0:1 4000000 %s/Test02 $filesize' % CAPSULE_INSTALL_DIR, > > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > > + assert 'Test02' in ''.join(output) > > + > > + # reboot > > + u_boot_console.restart_uboot() > > + > > + capsule_early = u_boot_config.buildconfig.get( > > + 'config_efi_capsule_on_disk_early') > > + with u_boot_console.log.section('Test Case 3-b, after reboot'): > > + if not capsule_early: > > + # make sure that dfu_alt_info exists even persistent variables > > + # are not available. > > + output = u_boot_console.run_command_list([ > > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', > > + 'host bind 0 %s' % disk_img, > > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > > + assert 'Test02' in ''.join(output) > > + > > + # need to run uefi command to initiate capsule handling > > + output = u_boot_console.run_command( > > + 'env print -e Capsule0000') > > + > > + # deleted any way > > + output = u_boot_console.run_command_list([ > > + 'host bind 0 %s' % disk_img, > > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) > > + assert 'Test02' not in ''.join(output) > > + > > + # TODO: check CapsuleStatus in CapsuleXXXX > > + > > + output = u_boot_console.run_command_list([ > > + 'sf probe 0:0', > > + 'sf read 4000000 100000 10', > > + 'md.b 4000000 10']) > > + assert 'u-boot:Old' in ''.join(output) > > >
diff --git a/test/py/tests/test_efi_capsule/SIGNER.crt b/test/py/tests/test_efi_capsule/SIGNER.crt new file mode 100644 index 000000000000..f63ec01d9996 --- /dev/null +++ b/test/py/tests/test_efi_capsule/SIGNER.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDDTCCAfWgAwIBAgIUD96z+lSbhDFN76YoIY2LnDBt1yQwDQYJKoZIhvcNAQEL +BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw +NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBAMBuazX28i0y4L0loJYJOtlvF5eWb4tbx7zwei5c +KoSzQYixinS10OrVy7y8mELyXOlGOOsM509vzvoia0nffwEPsvTBeS3le2JBz9iN +/+AIo+gUmzgEPQN+jp+s4fi0yzRvq3BgWu1ego2gExxQ7AePQHoSkX8UeC3Kb7SF +a8Kt/TopOupZfEuZ+EtoxPA4JUStFgEUEcRJEfpQqECXV+lKqcyqHc2ZUzMisu+i +5omkneX8sEZdIPFsSGanCyY3F9VjWzIxo60PU2xUBOIcEUg5luR+VXT4090g/yCw +8PSf9rIKgGIQSQKAlUSc7zuXQIdgIMTS1xUpc/Nx+SqWNZECAwEAAaNTMFEwHQYD +VR0OBBYEFHndZVpPrAjc3OD3UZ3xkXQqDOlZMB8GA1UdIwQYMBaAFHndZVpPrAjc +3OD3UZ3xkXQqDOlZMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB +AG88t6w0qTXE50ltps62f6wtuuZsiX1zj+AluO4E8E3Wi0QsNtT24JdY2P4mAg8y +abYLdgJIldzzsfjWWok9Dfqnx29tqgesKWkgUo16v70i4EVZ9YWGe+CfOK639OxL +4D0XPcU5CUpDrEcnt59wCxQ7IArZzrDxrqigEw5nReejtgQV/mEzvVOzWjLjmngy +SpvrydxYpfSvOJ3KGV9xw3Oa/qO3pS0ZNX9QqZdcC94M0SI6OF635oxJkz6JToYq ++qtv9PZtZnEU/cwzL0nTXMj7yRsP5+2Wre26yT62nKRy9P/3UFwmsJ0OuEmnol5I +141ZGfBYmSQ6EReOwNeK7A0= +-----END CERTIFICATE----- diff --git a/test/py/tests/test_efi_capsule/SIGNER.esl b/test/py/tests/test_efi_capsule/SIGNER.esl new file mode 100644 index 0000000000000000000000000000000000000000..a54536e243d274b74985abbecfe234d14013ef33 GIT binary patch literal 829 zcmZ1&d0^?2Da*aux2_hA(f&|m%gg`<iclKDgOCPI%)ACoj9(WpGchtTiSXas{3~R3 zi=prPWg3dT-E$0bud5jFvT<s)d9;1!Wn|=LWiSvk6fqEDV-96u=HU);4GxJ9_H_4i z4Kk1u=QT1kFgG$YurM_?G>rmsjgYuF^))dnAzQ)7%D~*j$j<<D6&F(zBO}9sylm5N zpLC5L>{VSbjnnF8zWDTM`Q6dS_k5_*i_vP??AWoft7PkiS65H(*)zlGQ_M>@i`P8Q z{qxWLQp)zcU(d+D>C3@N-KW(_j^}Um{(r!+_=U)93l>}Ey1w~q9{$*J+9ZE<K|<8q zxTf9(!ZHDG*!vx-geKODROp_{-_n|WXzgDsO{-UtHQqCScxN2>V4>==R*X?Z@QA12 zuYeT})5BkStvs_z_Uz1HW2H^+7d`7-GWY494Q{atA9Fm?mUF9_i(gHSHZokimOnTr zgyoTppoitOCv~AEKQ7-@_^+_x!<YHrHgPp133xI!Om&&_-g>%2dxFA|OV>p;i$53s z)S6~Gk%^g+fpKxLL7;&wFw|xFSj1RFD(|L7`LE%)bLYYLz_}kMmT2+3j5Lr3Nh`BR z7>G4sSHKTaAk4`4pM}+c8Au@qJ1}N}!OqB#Z?k=k$x72B&pmUOo!eHwMt9e<oX*<f z{s*c%-m!e}z1HobV|L}+gXs}B{;4tX8)a_eE@SeTdgt@TAJ?KfZFzq!Kc1hvihYe{ zrb19})&9Lo4_qU^wzgG2m~XLe`<FM~4{XJ4k6LniIj?b7-#)*9Tf|y{>*l!)AJ?r| zAk3HU`h4*=7SVr+#(RS|M;SeyRbk{c`}N5?5lg?Ux0riMGQRL|@vMJ~w=dO|G_4O< zIX#B^9?wN3D~q`8&w4y3+jaW2Y5iKA|K(e5TA|3_GsgO!mt#)+J}J%r{Oz>0Z+D%v r+csxO(U<?<17g%R%;nqRxqMNa$MxPw$qx}TRjdTX`wm?1dcz9<2x(B# literal 0 HcmV?d00001 diff --git a/test/py/tests/test_efi_capsule/SIGNER.key b/test/py/tests/test_efi_capsule/SIGNER.key new file mode 100644 index 000000000000..9952647ed74a --- /dev/null +++ b/test/py/tests/test_efi_capsule/SIGNER.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQDAbms19vItMuC9 +JaCWCTrZbxeXlm+LW8e88HouXCqEs0GIsYp0tdDq1cu8vJhC8lzpRjjrDOdPb876 +ImtJ338BD7L0wXkt5XtiQc/Yjf/gCKPoFJs4BD0Dfo6frOH4tMs0b6twYFrtXoKN +oBMcUOwHj0B6EpF/FHgtym+0hWvCrf06KTrqWXxLmfhLaMTwOCVErRYBFBHESRH6 +UKhAl1fpSqnMqh3NmVMzIrLvouaJpJ3l/LBGXSDxbEhmpwsmNxfVY1syMaOtD1Ns +VATiHBFIOZbkflV0+NPdIP8gsPD0n/ayCoBiEEkCgJVEnO87l0CHYCDE0tcVKXPz +cfkqljWRAgMBAAECggEAItLYrAdohC105kXs7bn14GtuRYx/2yRc3SBXvBQJzcHy +1h3rBHvytszB9gHbPCJIFh8TJdZL9eAyAKpB6Dh9718773cjyt6AmaN3TaVE7PIj +V1iDTnvV3tAEV3kd27g8Hd0nlUqaqeI0lhSl4LX0QNn3vR+nHOxDY2YDGRQcEDrD +4hlCIGzAfbCW9gINdadQnC6p9NEBbfJ18doCagdn1Q1UYs8YlWwhBK98wXKGsG6T +TUywOWIe6+VJqzSwZn5YkDVD3qD4tToar7T0jrCvZjbTbOsjtinD70c3uBcrK/XN +gpwJfTiDLo1d0tNoWCRUH0myMs1fq3H3SkdfqB1GwQKBgQDrw8FwUc3Q+j8YhR7i +73H/osk3VOZhCPsqbrQThUo5ZV4EXqp9E3PLN5E3suWgfaXVCEI3lHARUyR+J+E/ +evIrUUnkIryLdVOwwEWRonW4cLANjLSzT0eA85CFLXKUaij7Jfon2YNs9CmUARnC +M96T3a89XOezX/SbRVz6X8KslQKBgQDQ8onkHcscHMANIjgxycIgYF+MvxwHRICA +nt3ZSQiGSXJbWK7/sM5yd16ulvsXL7aF9G+q5osOzDWJ0w4SOhqNDfItrFH34Px6 +qEPjq/sAigqqrQls7uu7MHfkE+eEy181CoT9argxo8ifAQDn4YtXBW6L7p6AgaAx +83FAbBcqDQKBgQClHk185534zTqhZqIyF7bEbfL0sJ5EuXCG0E+IGGLafdbxwocu +4A/J9Jnc44sU8srQv1745Bn02EEHpdCIkAfJNL5Ga9mW5k39zTsr+xbtXObAJppr +touCkZLW4vSLYypecsOXYyw7g2kXQgoTTBaHgsv3cvjHVN3QXSz4IVcLXQJ/LBL9 +AyFFtqhZ2mtdbyMfz7SEcyvcvau1b2wTX8IICktz09DhGQ4yffKwBiPS0xE9bwQg +iewXaQeqQ2hBj5ayAw7uBrRSlfbfSwAzUdL1Hyf/GAFn+5JqJxISOAn6zAgaDRYq +90mLkOz7ZI7RohfxTGnY56ttw62UHPU87lneiQKBgHcVituUDJgmbaHXx2IVzKsm +5uDyXUf4S+tY5CZj6WTsb70+q4PYfh1D02nZgxuLNwpwNI0uhLIkLYHcL3poOapC +LCXS8tsexNosmrTmjHFh/uNdKb7bKbMxyzYrr+ADKMclF3CJzKDzLfiIe9Na+bWa +q5/HYNIw5zJyapPksgr4 +-----END PRIVATE KEY----- diff --git a/test/py/tests/test_efi_capsule/SIGNER2.crt b/test/py/tests/test_efi_capsule/SIGNER2.crt new file mode 100644 index 000000000000..8889a3ed930a --- /dev/null +++ b/test/py/tests/test_efi_capsule/SIGNER2.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDDTCCAfWgAwIBAgIUfmZcui7VkJEe9jx25Epo6jJ6l+owDQYJKoZIhvcNAQEL +BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw +NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBANozXTFKGVx0121MIBoSgxfI8IHcfY32T/LQusse +PaXsm0GaJNwOgEP34u1k0cz466swfBCqTcZRjKuDpcH1sgrF1XaKjxuwYuiJrbsf +ykVesN1z1bIamkFdVR/CBJEwN/epsyCBQCSbcxUwEX+ayq2zp+kSweew1B4i3u8f +nbqFB15Rt+KAzFaBlvOJhmoZP7uYtb8zHa58eteaxQmPFt3v6eEbgOt92oVB8fPQ +JJBuxUAHdimMDQ9mBGUosXR8PFyma5jOiOyY+0oTfig4bRHbGxCGMYyABJDH+j4e +7Zl7lVMsq2fTm/lGONRX2QPLfMO298pz/wundJmYhseibvUCAwEAAaNTMFEwHQYD +VR0OBBYEFDPYxE3oBmU1pWrZpY62JuXgcK5aMB8GA1UdIwQYMBaAFDPYxE3oBmU1 +pWrZpY62JuXgcK5aMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB +AEtY9QnvTvgmXmep7AMv/T6+GpERvsRdi+Lc+16L7uSCQhouDkeu5/sUHax6icX1 +NyDb3u6tyQhMnm7CD+7Mo74wrZ4vK2SzBoZSBLi+Tyz2ScyysdRIo7O42nxVyWm7 +ifZVfQKvanUjDSxPO89yJDYp0znvVpuZOzYXFHdprHoR5Atkth11HFHzWDzqblKS +sx145wgPZ9bYohuOn1weyORsG9bJcHznPyJ1ceAOFk40bKWWLQtruWIhY4aZIlJN +cDKv92rtgVApaamu+WRC4pzgQMQYKOcnMz4ZKeOKgEajfo6nOUVrvc0IYO6wixvi +V+Msrg5o7ag2SN2AHg5/1/4= +-----END CERTIFICATE----- diff --git a/test/py/tests/test_efi_capsule/SIGNER2.key b/test/py/tests/test_efi_capsule/SIGNER2.key new file mode 100644 index 000000000000..ee467fd9f7a6 --- /dev/null +++ b/test/py/tests/test_efi_capsule/SIGNER2.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDaM10xShlcdNdt +TCAaEoMXyPCB3H2N9k/y0LrLHj2l7JtBmiTcDoBD9+LtZNHM+OurMHwQqk3GUYyr +g6XB9bIKxdV2io8bsGLoia27H8pFXrDdc9WyGppBXVUfwgSRMDf3qbMggUAkm3MV +MBF/msqts6fpEsHnsNQeIt7vH526hQdeUbfigMxWgZbziYZqGT+7mLW/Mx2ufHrX +msUJjxbd7+nhG4DrfdqFQfHz0CSQbsVAB3YpjA0PZgRlKLF0fDxcpmuYzojsmPtK +E34oOG0R2xsQhjGMgASQx/o+Hu2Ze5VTLKtn05v5RjjUV9kDy3zDtvfKc/8Lp3SZ +mIbHom71AgMBAAECggEBAJXskO3bAg364kJg+fWwHo7rLAWuYD54rXojXRVPFAC7 +z/mFVio1dIA/BJcknNr/db5MNBKnUYUgZ005yVy52rl4MTGgBrB5w5wPbWWTdEGx +zEh83KnhiXe8D08g2k6AGRR8b224IUCF5s76FivdScGMHaURlFYDs9t5DkCzMocC +ty0ewHv9aeMSzJl4y+DrRw+NkkAntlAkerCI5PInFtxyOQ6lFIRkMKlBA//VL0QF +B9yGbmfoxlErWCqnj70DTcVO7O2AaijU+FTMRbb/V7r34GPU0Cfeum6gGNOtDkaX +3UnWGR2esiHViMqz8vvEYtVIxHhLTD7INqDlK/yiNEECgYEA+ua1JcHXI2qS3cV/ +BuVvBrd3MzIpZvddCcTdo/B7WT3EoTupEG1gcajrCuNQDtRoizSbMuhCXYoMsktF +wXFoTWoGr8yO7uVU5r2nCXZneprV3kuQmR0qYipN2GTCGSE1rKQI+YXeALPF1qIp +12vUVdzWVDJvlQRMvSTlzpRZQkkCgYEA3qKI1ZsBszKPbnzLX91+ZAZeAwwN/HvS +nrIveJAci/9U2yV2mw3l/Dulc8EkGABs/cMp47toje8DmsSfdu1yIYqpi3MHvefX ++ijc3ry5v28Hia3WP3WPczqhbkT7cco0t8Vwm9w1B+kkreuRCtyoCOLsRauB0CH1 +QJjMtPAth00CgYAKUUhruA/nxe8qLX/uwaqSJSNCuLJZKJzr1OukXTRFVDPsyW5H +XagUpHSd6wEUywlNiClFq6VnAVFKV6wTq101qcGCoy/RhR67qlrfGb5hnVJkJMla +coeWp9SxrFsK+4GgitJPqICbmMju7ZY45JdDvKQXrEdIYnfhY04L86/D+QKBgBxx +nZPU0vnHCuYt0Xn0/XHgEmDHSH4qf7VAxKndl5gXTgsVlTqoIur/39qTIX5jh4lA +RvjOd8Qydj5uwoTaP0ujwJeNYb7UgRZ35AgdCoo3sDnZ2NaQuXwaUIebDpjyIZwd +AI8ZKjlRgxspToWZvWotO8yG5fXmcMQJAZZYXSi9AoGBALfXX/C5ojwms1l+XP+p +FKzOFZ/uEKPfQid+2Sm1BknXXGVbs3zJ4OdonTvhjq+VQvXTW4IvjgY8TpumQZvE +8nb7I8E1B6ajkSvgfetN9jlKM5hzIfJ3Vxx6hMGMab1ySKy3rZGPL706CW2BeMI2 +v2k9P0qWItuE4S7I4hEsovwS +-----END PRIVATE KEY----- diff --git a/test/py/tests/test_efi_capsule/capsule_defs.py b/test/py/tests/test_efi_capsule/capsule_defs.py index 4fd6353c2040..aa9bf5eee3aa 100644 --- a/test/py/tests/test_efi_capsule/capsule_defs.py +++ b/test/py/tests/test_efi_capsule/capsule_defs.py @@ -3,3 +3,8 @@ # Directories CAPSULE_DATA_DIR = '/EFI/CapsuleTestData' CAPSULE_INSTALL_DIR = '/EFI/UpdateCapsule' + +# v1.5.1 or earlier of efitools has a bug in sha256 calculation, and +# you need build a newer version on your own. +# The path must terminate with '/'. +EFITOOLS_PATH = '' diff --git a/test/py/tests/test_efi_capsule/conftest.py b/test/py/tests/test_efi_capsule/conftest.py index 6ad5608cd71c..35cfa5513703 100644 --- a/test/py/tests/test_efi_capsule/conftest.py +++ b/test/py/tests/test_efi_capsule/conftest.py @@ -10,13 +10,13 @@ import pytest from capsule_defs import * # -# Fixture for UEFI secure boot test +# Fixture for UEFI capsule test # - @pytest.fixture(scope='session') def efi_capsule_data(request, u_boot_config): - """Set up a file system to be used in UEFI capsule test. + """Set up a file system to be used in UEFI capsule and + authentication test. Args: request: Pytest request object. @@ -40,6 +40,22 @@ def efi_capsule_data(request, u_boot_config): check_call('mkdir -p %s' % data_dir, shell=True) check_call('mkdir -p %s' % install_dir, shell=True) + capsule_auth_enabled = u_boot_config.buildconfig.get( + 'config_efi_capsule_authenticate') + # NOTE: + # private keys (SIGNER?.key) dn certificates (SIGNER?.crt) + # in this pytest directory are created this way: + # Create private key (SIGNER.key) and certificate (SIGNER.crt) + # check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER.key -out SIGNER.crt -nodes -days 365' + # % data_dir, shell=True) + # check_call('cd %s; %scert-to-efi-sig-list SIGNER.crt SIGNER.esl' + # % (data_dir, EFITOOLS_PATH), shell=True) + + # Create *malicious* private key (SIGNER2.key) and certificate + # (SIGNER2.crt) + # check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER2.key -out SIGNER2.crt -nodes -days 365' + # % data_dir, shell=True) + # Create capsule files # two regions: one for u-boot.bin and the other for u-boot.env check_call('cd %s; echo -n u-boot:Old > u-boot.bin.old; echo -n u-boot:New > u-boot.bin.new; echo -n u-boot-env:Old -> u-boot.env.old; echo -n u-boot-env:New > u-boot.env.new' % data_dir, @@ -56,6 +72,19 @@ def efi_capsule_data(request, u_boot_config): check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 Test02' % (data_dir, u_boot_config.build_dir), shell=True) + if capsule_auth_enabled: + # copy keys/certificates + check_call('cp %s/test/py/tests/test_efi_capsule/SIGNER*.* %s' % + (u_boot_config.source_dir, data_dir), + shell=True) + # firmware signed with proper key + check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER.key --certificate SIGNER.crt Test03' % + (data_dir, u_boot_config.build_dir), + shell=True) + # firmware signed with *mal* key + check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER2.key --certificate SIGNER2.crt Test04' % + (data_dir, u_boot_config.build_dir), + shell=True) # Create a disk image with EFI system partition check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat %s %s' % diff --git a/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py new file mode 100644 index 000000000000..8fe93ef424ac --- /dev/null +++ b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py @@ -0,0 +1,228 @@ +# SPDX-License-Identifier: GPL-2.0+ +# Copyright (c) 2021, Linaro Limited +# Author: AKASHI Takahiro <takahiro.akashi@linaro.org> +# +# U-Boot UEFI: Firmware Update (Signed capsule) Test + +""" +This test verifies capsule-on-disk firmware update +with signed capsule files +""" + +from subprocess import check_call, check_output, CalledProcessError +import pytest +from capsule_defs import * + +@pytest.mark.boardspec('sandbox') +@pytest.mark.buildconfigspec('efi_capsule_firmware_raw') +@pytest.mark.buildconfigspec('efi_capsule_authenticate') +@pytest.mark.buildconfigspec('dfu') +@pytest.mark.buildconfigspec('dfu_sf') +@pytest.mark.buildconfigspec('cmd_efidebug') +@pytest.mark.buildconfigspec('cmd_fat') +@pytest.mark.buildconfigspec('cmd_memory') +@pytest.mark.buildconfigspec('cmd_nvedit_efi') +@pytest.mark.buildconfigspec('cmd_sf') +@pytest.mark.slow +class TestEfiCapsuleFirmwareSigned(object): + def test_efi_capsule_auth1( + self, u_boot_config, u_boot_console, efi_capsule_data): + """ + Test Case 1 - Update U-Boot on SPI Flash, raw image format + 0x100000-0x150000: U-Boot binary (but dummy) + + If the capsule is properly signed, the authentication + should pass and the firmware be updated. + """ + disk_img = efi_capsule_data + with u_boot_console.log.section('Test Case 1-a, before reboot'): + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi', + 'efidebug boot order 1', + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004', + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', + 'env save']) + + # initialize content + output = u_boot_console.run_command_list([ + 'sf probe 0:0', + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR, + 'sf write 4000000 100000 10', + 'sf read 5000000 100000 10', + 'md.b 5000000 10']) + assert 'Old' in ''.join(output) + + # place a capsule file + output = u_boot_console.run_command_list([ + 'fatload host 0:1 4000000 %s/Test03' % CAPSULE_DATA_DIR, + 'fatwrite host 0:1 4000000 %s/Test03 $filesize' % CAPSULE_INSTALL_DIR, + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) + assert 'Test03' in ''.join(output) + + # reboot + u_boot_console.restart_uboot() + + capsule_early = u_boot_config.buildconfig.get( + 'config_efi_capsule_on_disk_early') + with u_boot_console.log.section('Test Case 1-b, after reboot'): + if not capsule_early: + # make sure that dfu_alt_info exists even persistent variables + # are not available. + output = u_boot_console.run_command_list([ + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', + 'host bind 0 %s' % disk_img, + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) + assert 'Test03' in ''.join(output) + + # need to run uefi command to initiate capsule handling + output = u_boot_console.run_command( + 'env print -e Capsule0000') + + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) + assert 'Test03' not in ''.join(output) + + output = u_boot_console.run_command_list([ + 'sf probe 0:0', + 'sf read 4000000 100000 10', + 'md.b 4000000 10']) + assert 'u-boot:New' in ''.join(output) + + def test_efi_capsule_auth2( + self, u_boot_config, u_boot_console, efi_capsule_data): + """ + Test Case 2 - Update U-Boot on SPI Flash, raw image format + 0x100000-0x150000: U-Boot binary (but dummy) + + If the capsule is signed but with an invalid key, + the authentication should fail and the firmware + not be updated. + """ + disk_img = efi_capsule_data + with u_boot_console.log.section('Test Case 2-a, before reboot'): + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi', + 'efidebug boot order 1', + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004', + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', + 'env save']) + + # initialize content + output = u_boot_console.run_command_list([ + 'sf probe 0:0', + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR, + 'sf write 4000000 100000 10', + 'sf read 5000000 100000 10', + 'md.b 5000000 10']) + assert 'Old' in ''.join(output) + + # place a capsule file + output = u_boot_console.run_command_list([ + 'fatload host 0:1 4000000 %s/Test04' % CAPSULE_DATA_DIR, + 'fatwrite host 0:1 4000000 %s/Test04 $filesize' % CAPSULE_INSTALL_DIR, + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) + assert 'Test04' in ''.join(output) + + # reboot + u_boot_console.restart_uboot() + + capsule_early = u_boot_config.buildconfig.get( + 'config_efi_capsule_on_disk_early') + with u_boot_console.log.section('Test Case 2-b, after reboot'): + if not capsule_early: + # make sure that dfu_alt_info exists even persistent variables + # are not available. + output = u_boot_console.run_command_list([ + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', + 'host bind 0 %s' % disk_img, + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) + assert 'Test04' in ''.join(output) + + # need to run uefi command to initiate capsule handling + output = u_boot_console.run_command( + 'env print -e Capsule0000') + + # deleted any way + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) + assert 'Test04' not in ''.join(output) + + # TODO: check CapsuleStatus in CapsuleXXXX + + output = u_boot_console.run_command_list([ + 'sf probe 0:0', + 'sf read 4000000 100000 10', + 'md.b 4000000 10']) + assert 'u-boot:Old' in ''.join(output) + + def test_efi_capsule_auth3( + self, u_boot_config, u_boot_console, efi_capsule_data): + """ + Test Case 3 - Update U-Boot on SPI Flash, raw image format + 0x100000-0x150000: U-Boot binary (but dummy) + + If the capsule is not signed, the authentication + should fail and the firmware not be updated. + """ + disk_img = efi_capsule_data + with u_boot_console.log.section('Test Case 3-a, before reboot'): + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi', + 'efidebug boot order 1', + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004', + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', + 'env save']) + + # initialize content + output = u_boot_console.run_command_list([ + 'sf probe 0:0', + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR, + 'sf write 4000000 100000 10', + 'sf read 5000000 100000 10', + 'md.b 5000000 10']) + assert 'Old' in ''.join(output) + + # place a capsule file + output = u_boot_console.run_command_list([ + 'fatload host 0:1 4000000 %s/Test02' % CAPSULE_DATA_DIR, + 'fatwrite host 0:1 4000000 %s/Test02 $filesize' % CAPSULE_INSTALL_DIR, + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) + assert 'Test02' in ''.join(output) + + # reboot + u_boot_console.restart_uboot() + + capsule_early = u_boot_config.buildconfig.get( + 'config_efi_capsule_on_disk_early') + with u_boot_console.log.section('Test Case 3-b, after reboot'): + if not capsule_early: + # make sure that dfu_alt_info exists even persistent variables + # are not available. + output = u_boot_console.run_command_list([ + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"', + 'host bind 0 %s' % disk_img, + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) + assert 'Test02' in ''.join(output) + + # need to run uefi command to initiate capsule handling + output = u_boot_console.run_command( + 'env print -e Capsule0000') + + # deleted any way + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR]) + assert 'Test02' not in ''.join(output) + + # TODO: check CapsuleStatus in CapsuleXXXX + + output = u_boot_console.run_command_list([ + 'sf probe 0:0', + 'sf read 4000000 100000 10', + 'md.b 4000000 10']) + assert 'u-boot:Old' in ''.join(output)
Add a couple of test cases against capsule image authentication for capsule-on-disk, where only a signed capsule file with the verified signature will be applied to the system. Due to the difficulty of embedding a public key (esl file) in U-Boot binary during pytest setup time, all the keys/certificates are pre-created. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> --- test/py/tests/test_efi_capsule/SIGNER.crt | 19 ++ test/py/tests/test_efi_capsule/SIGNER.esl | Bin 0 -> 829 bytes test/py/tests/test_efi_capsule/SIGNER.key | 28 +++ test/py/tests/test_efi_capsule/SIGNER2.crt | 19 ++ test/py/tests/test_efi_capsule/SIGNER2.key | 28 +++ .../py/tests/test_efi_capsule/capsule_defs.py | 5 + test/py/tests/test_efi_capsule/conftest.py | 35 ++- .../test_capsule_firmware_signed.py | 228 ++++++++++++++++++ 8 files changed, 359 insertions(+), 3 deletions(-) create mode 100644 test/py/tests/test_efi_capsule/SIGNER.crt create mode 100644 test/py/tests/test_efi_capsule/SIGNER.esl create mode 100644 test/py/tests/test_efi_capsule/SIGNER.key create mode 100644 test/py/tests/test_efi_capsule/SIGNER2.crt create mode 100644 test/py/tests/test_efi_capsule/SIGNER2.key create mode 100644 test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py -- 2.31.0