u-boot.git/test/py/tests/test_efi_secboot/conftest.py, branch v2024.07

efi_loader: Fix EFI_VARIABLE_APPEND_WRITE hash check

2024-06-10T13:01:44Z

According to UEFI v2.10 spec section 8.2.6, if a caller invokes the SetVariables() service, it will produce a digest from hash(VariableName, VendorGuid, Attributes, TimeStamp, DataNew_variable_content), then the firmware that implements the SetVariable() service will compare the digest with the result of applying the signer’s public key to the signature. For EFI variable append write, efitools sign-efi-sig-list has an option "-a" to add EFI_VARIABLE_APPEND_WRITE attr, and u-boot will drop this attribute in efi_set_variable_int(). So if a caller uses "sign-efi-sig-list -a" to create the authenticated variable, this append write will fail in the u-boot due to "hash check failed". This patch resumes writing the EFI_VARIABLE_APPEND_WRITE attr to ensure that the hash check is correct. And also update the "test_efi_secboot" test case to compliance with the change. Signed-off-by: Weizhao Ouyang

global: Use proper project name U-Boot

2023-06-12T11:24:31Z

Use proper project name in comments, Kconfig, readmes. Reviewed-by: Neil Armstrong Acked-by: Ilias Apalodimas Reviewed-by: Stefan Roese Reviewed-by: Qu Wenruo Signed-off-by: Michal Simek Link: https://lore.kernel.org/r/0dbdf0432405c1c38ffca55703b6737a48219e79.1684307818.git.michal.simek@amd.com

test: fix pydoc issues for EFI tests

2023-05-04T07:57:43Z

Fix issues reported by pydocstyle. Signed-off-by: Heinrich Schuchardt Acked-by: Ilias Apalodimas

test/py: efi_secboot: Remove unnecessary cert-to-efi-hash-list option

2022-11-06T09:50:04Z

'cert-to-efi-hash-list -t 0' does not work as expected, it produces indeterminate timestamp. $ cert-to-efi-hash-list -t 0 -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-113-0 00:00:255 If we need the CRL revoked for all the time, just don't specify '-t' option. $ cert-to-efi-hash-list -s 256 db.crt dbx_hash.crl TimeOfRevocation is 0-0-0 00:00:00 Signed-off-by: Masahisa Kojima Acked-by: Ilias Apalodimas

test: fix some pylint errors in test_efi_secboot

2022-10-06T20:54:57Z

* Remove unused import * Provide module docstring Signed-off-by: Heinrich Schuchardt Acked-by: Ilias Apalodimas

test/py: efi_secboot: add a test for a forged signed image

2022-07-05T12:37:16Z

In this test case, a image binary, helloworld.efi.signed, is willfully modified to print a corrupted message while the signature itself is unchanged. This binary must be rejected under secure boot mode. Signed-off-by: AKASHI Takahiro

test/py: Add more test cases for rejecting an EFI image

2022-05-07T21:17:26Z

The previous patch adds support for rejecting images when the sha384/512 of an x.509 certificate is present in dbx. Update the sandbox selftests Signed-off-by: Ilias Apalodimas

test/py: efi_secboot: modify 'multiple signatures' test case

2020-08-14T10:34:33Z

The test case 5 in test_signed (multiple signatures) must be modified and aligned with the change introduced in the previous commit ("efi_loader: signature: correct a behavior against multiple signatures"). Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: add test for intermediate certificates

2020-08-13T20:37:36Z

In this test case, an image may have a signature with additional intermediate certificates. A chain of trust will be followed and all the certificates in the middle of chain must be verified before loading. Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: small rework for adding a new test

2020-08-13T20:37:36Z

It won't be very useful to customize HELLO_PATH and EFI_SECBOOT_IMAGE_NAME under the current code base. So just remove them. Signed-off-by: AKASHI Takahiro