From patchwork Tue Jul 5 05:48:15 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: AKASHI Takahiro X-Patchwork-Id: 587435 Delivered-To: patch@linaro.org Received: by 2002:a05:7000:1ec:0:0:0:0 with SMTP id 12csp1446934map; Mon, 4 Jul 2022 22:50:00 -0700 (PDT) X-Google-Smtp-Source: AGRyM1tg6HHH8xZ5KMjSCA3H5yht0nVODolQ4WBviloFJ9ui4T5mGr67ZodQb0sJwfQlUbeebiDp X-Received: by 2002:a2e:b94e:0:b0:25b:b99f:4f58 with SMTP id 14-20020a2eb94e000000b0025bb99f4f58mr17960379ljs.263.1657000199818; Mon, 04 Jul 2022 22:49:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1657000199; cv=none; d=google.com; s=arc-20160816; b=xltgk3ZiO5sNoSD3dAGRFlHRKElDjsjS4wFKy1tfWNer7ou5RUB79NBw1KwAZJWVmT XFiFnrEKRU0AiAhcsjbivwNCNPWN2Z8v3WJt21loaR6Jf3IIZoAr7gP4yonEM6cKmEcQ yXo3Z6kwnjw1EX7qgjwN6KQoTj8kX7sx8fIcF1rkdxQtmD10ZvgxH9ye1wdWtabCQ9Xr NDhB1ZeaAhmB0ol/+e6P3Qd1gSqPM5D2xhJaBF13envcek35O74pEtq4MgCDDcQmaCZF aoOLdKch7bjCHosUhC1p+keri7RXzQUfgm5LHD2bKrtfpOGKMy++y4StSmJusQwpawsy 0ONg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=NCg1AMihsM2R/Y+Kq21gIqbZp1SpZmfFCFb+hOya/k0=; b=kpC5FsQ/xW2nhItqSMLCSoBbDel38vr6Kn+awWe4M7Fr7XsbLlhFu/AWMfvxRLLcyb FucQodRGBrUQjGQCSckzJXQAyQnqPPHhwcw3GNaLyQa27aeDprzX8mNQJ3CBIm/1fLhV DnOeGHUPcCFO41vgmL/81gP9n6JEXYUajH0cwCc0iuPMdnpOhfxHmwvMdoJq83ob/qav 2GAY1BfOMAJwhVzmnX+DjxjnEwfEQyXNh9ZGcYkR9M812eZM4E33V/3HPvzLNzD9l7qW vxZ4MyZzLJH3+4fMC6JdUbFfccG3efcLw233Wayb6FkRm895uygVhojYGuUla+UXdTGa a48w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rs0FwX6X; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id j6-20020a2e3c06000000b0025bdea31706si9865245lja.608.2022.07.04.22.49.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Jul 2022 22:49:59 -0700 (PDT) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=rs0FwX6X; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id AE68E8452B; Tue, 5 Jul 2022 07:49:19 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="rs0FwX6X"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 57B1F84525; Tue, 5 Jul 2022 07:49:17 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-pg1-x536.google.com (mail-pg1-x536.google.com [IPv6:2607:f8b0:4864:20::536]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 359E984517 for ; Tue, 5 Jul 2022 07:49:14 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=takahiro.akashi@linaro.org Received: by mail-pg1-x536.google.com with SMTP id 68so10490708pgb.10 for ; Mon, 04 Jul 2022 22:49:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=NCg1AMihsM2R/Y+Kq21gIqbZp1SpZmfFCFb+hOya/k0=; b=rs0FwX6XrR5+at04Yuv05f7mStt8bJfGwRpGGofTXGcr6KQUplbpi8Vyaa4/tQYhU/ 51RhKiGIr0ei1rZTcnVcG6Jd/KM/6jNsSWr27RJeEP+18liUmSahPLU+lLHQ1WGPzPgX e5o97e8Tt13Ah0WUo+6yz6piuyHRljLA199GI0CSLFq1iW553EQn0bCA7CVeEaZmx1V8 +qKuX72P0vD35oFPlI3aE60DdgLsGVPNTx19+IqW8N/Pzcb7TYJgX0F1HRUeS5QHn47U VhJQQ059y1DBSsHEkWRb0mgh20xCEp79bgcmEM3r9vohlcdy6Sc/HJG+IDnViJz0NumD aCGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=NCg1AMihsM2R/Y+Kq21gIqbZp1SpZmfFCFb+hOya/k0=; b=1cYc60KWPspsp1Gs6IMQamg+AAE/S/rrI/KOYTxCy8FA2V/ogy1Xhmh0WPtA03Uw9b 58WWQ+pFccznj+GObFi+XiUYgZW01GCNuQKeHYSeQa9KvEbmI/UxIH30hblVnmtV9CNc pSQ/xJbp6eqbwMmk0sWx9CDsXQe2G1Qyx0YI3rBEhyk+bH6yCbfj1Ojm7QNW7lYbe6+w 9aCfh0d65Y3kTvd6w1iBmCqXPl5Tps71fFqwL2RuAwB7JOnUF52wHCm1efkfeX969F75 d5UOpSSQbtErMNP5NRSz1Ok2LrVewTF5nlat2ekw7cNx9Os+C93Y+PjCzYNYbwlsoGY6 cPug== X-Gm-Message-State: AJIora94WuEXKY89DnzLMdwZwoLAtLIRM0VdB76Z26bee7Fac5iq8G4I ZIqv7CxyLBunlDrefaicH1OX9g== X-Received: by 2002:a05:6a00:114f:b0:528:2c7a:634c with SMTP id b15-20020a056a00114f00b005282c7a634cmr23181683pfm.41.1657000152493; Mon, 04 Jul 2022 22:49:12 -0700 (PDT) Received: from localhost.localdomain ([2400:4050:c3e1:100:8c42:b67b:3e2f:7653]) by smtp.gmail.com with ESMTPSA id a5-20020a1709027e4500b0016784c93f23sm22149390pln.197.2022.07.04.22.49.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Jul 2022 22:49:11 -0700 (PDT) From: AKASHI Takahiro To: xypron.glpk@gmx.de Cc: ilias.apalodimas@linaro.org, baocheng.su@siemens.com, jan.kiszka@siemens.com, u-boot@lists.denx.de, AKASHI Takahiro Subject: [PATCH 5/5] test/py: efi_secboot: add a test for a forged signed image Date: Tue, 5 Jul 2022 14:48:15 +0900 Message-Id: <20220705054815.30318-6-takahiro.akashi@linaro.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220705054815.30318-1-takahiro.akashi@linaro.org> References: <20220705054815.30318-1-takahiro.akashi@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean In this test case, a image binary, helloworld.efi.signed, is willfully modified to print a corrupted message while the signature itself is unchanged. This binary must be rejected under secure boot mode. Signed-off-by: AKASHI Takahiro --- test/py/tests/test_efi_secboot/conftest.py | 3 ++ test/py/tests/test_efi_secboot/forge_image.sh | 5 +++ test/py/tests/test_efi_secboot/test_signed.py | 35 +++++++++++++++++++ 3 files changed, 43 insertions(+) create mode 100644 test/py/tests/test_efi_secboot/forge_image.sh diff --git a/test/py/tests/test_efi_secboot/conftest.py b/test/py/tests/test_efi_secboot/conftest.py index 8a53dabe5414..db6b8d301f85 100644 --- a/test/py/tests/test_efi_secboot/conftest.py +++ b/test/py/tests/test_efi_secboot/conftest.py @@ -105,6 +105,9 @@ def efi_boot_env(request, u_boot_config): # Sign already-signed image with another key check_call('cd %s; sbsign --key db1.key --cert db1.crt --output helloworld.efi.signed_2sigs helloworld.efi.signed' % mnt_point, shell=True) + # Create a corrupted signed image + check_call('cd %s; sh %s/test/py/tests/test_efi_secboot/forge_image.sh helloworld.efi.signed helloworld_forged.efi.signed' + % (mnt_point, u_boot_config.source_dir), shell=True) # Digest image check_call('cd %s; %shash-to-efi-sig-list helloworld.efi db_hello.hash; %ssign-efi-sig-list -t "2020-04-07" -c KEK.crt -k KEK.key db db_hello.hash db_hello.auth' % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH), diff --git a/test/py/tests/test_efi_secboot/forge_image.sh b/test/py/tests/test_efi_secboot/forge_image.sh new file mode 100644 index 000000000000..2465d10fa7b8 --- /dev/null +++ b/test/py/tests/test_efi_secboot/forge_image.sh @@ -0,0 +1,5 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +#!/bin/sh + +replace_exp="s/H\0e\0l\0l\0o\0/h\0E\0L\0L\0O\0/g" +perl -p -e ${replace_exp} < $1 > $2 diff --git a/test/py/tests/test_efi_secboot/test_signed.py b/test/py/tests/test_efi_secboot/test_signed.py index 30b3fa4e701e..ca52e853d8f8 100644 --- a/test/py/tests/test_efi_secboot/test_signed.py +++ b/test/py/tests/test_efi_secboot/test_signed.py @@ -334,3 +334,38 @@ class TestEfiSignedImage(object): 'efidebug test bootmgr']) assert '\'HELLO\' failed' in ''.join(output) assert 'efi_start_image() returned: 26' in ''.join(output) + + def test_efi_signed_image_auth8(self, u_boot_console, efi_boot_env): + """ + Test Case 8 - Secure boot is in force, + Same as Test Case 2 but the image binary to be loaded + was willfully modified (forged) + Must be rejected. + """ + u_boot_console.restart_uboot() + disk_img = efi_boot_env + with u_boot_console.log.section('Test Case 8a'): + # Test Case 8a, Secure boot is not yet forced + output = u_boot_console.run_command_list([ + 'host bind 0 %s' % disk_img, + 'efidebug boot add -b 1 HELLO1 host 0:1 /helloworld_forged.efi.signed -s ""', + 'efidebug boot next 1', + 'efidebug test bootmgr']) + assert('hELLO, world!' in ''.join(output)) + + with u_boot_console.log.section('Test Case 8b'): + # Test Case 8b, Install signature database and verify the image + output = u_boot_console.run_command_list([ + 'fatload host 0:1 4000000 db.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize db', + 'fatload host 0:1 4000000 KEK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK', + 'fatload host 0:1 4000000 PK.auth', + 'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK']) + assert 'Failed to set EFI variable' not in ''.join(output) + output = u_boot_console.run_command_list([ + 'efidebug boot next 1', + 'efidebug test bootmgr']) + assert(not 'hELLO, world!' in ''.join(output)) + assert('\'HELLO1\' failed' in ''.join(output)) + assert('efi_start_image() returned: 26' in ''.join(output))