u-boot.git/test/py/tests/test_efi_secboot/test_signed.py, branch v2024.04

efi_loader: Boot var automatic management

2023-11-18T08:08:08+00:00

Changes for complying to EFI spec §3.5.1.1
'Removable Media Boot Behavior'.
Boot variables can be automatically generated during a removable
media is probed. At the same time, unused boot variables will be
detected and removed.

Please note that currently the function 'efi_disk_remove' has no
ability to distinguish below two scenarios
a) Unplugging of a removable media under U-Boot
b) U-Boot exiting and booting an OS
Thus currently the boot variables management is not added into
'efi_disk_remove' to avoid boot options being added/erased
repeatedly under scenario b) during power cycles
See TODO comments under function 'efi_disk_remove' for more details

The original efi_secboot tests expect that BootOrder EFI variable
is not defined. With this commit, the BootOrder EFI variable is
automatically added when the disk is detected. The original
efi_secboot tests end up with unexpected failure.
The efi_secboot tests need to be modified to explicitly set
the BootOrder EFI variable.

squashfs and erofs ls tests are also affected by this modification,
need to clear the previous state before squashfs ls test starts.

Co-developed-by: Masahisa Kojima 
Signed-off-by: Masahisa Kojima 
Signed-off-by: Raymond Mao 
Reviewed-by: Heinrich Schuchardt 
Reviewed-by: Ilias Apalodimas 
Reviewed-by: Joao Marcos Costa 
Signed-off-by: Ilias Apalodimas

test/py: efi_secboot: add a test for a forged signed image

2022-07-05T12:37:16+00:00

In this test case, a image binary, helloworld.efi.signed, is willfully
modified to print a corrupted message while the signature itself is
unchanged.

This binary must be rejected under secure boot mode.

Signed-off-by: AKASHI Takahiro

test/py: Add more test cases for rejecting an EFI image

2022-05-07T21:17:26+00:00

The previous patch adds support for rejecting images when the sha384/512
of an x.509 certificate is present in dbx.  Update the sandbox selftests

Signed-off-by: Ilias Apalodimas

test/py: efi_secboot: adjust secure boot tests to code changes

2022-02-11T19:07:55+00:00

The previous patch is changing U-Boot's behavior wrt certificate based
binary authentication.  Specifically an image who's digest of a
certificate is found in dbx is now rejected.  Fix the test accordingly
and add another one testing signatures in reverse order

Signed-off-by: Ilias Apalodimas

test/py: Fix efidebug related tests

2021-04-24T04:53:40+00:00

commit cbea241e935e("efidebug: add multiple device path instances on Boot####")
slightly tweaked the efidebug syntax adding -b, -i and -s for the boot
image, initrd and optional data.
The pytests using this command were adapted as well. However I completely
missed the last "" argument, which at the time indicated the optional data
and needed conversion as well.  This patch is adding the missing -s flag
and the tests are back to normal.

Fixes: cbea241e935e("efidebug: add multiple device path instances on Boot####")
Signed-off-by: Ilias Apalodimas 
Reviwed-by: Heinrich Schuchardt

efidebug: add multiple device path instances on Boot####

2021-03-25T19:14:26+00:00

The UEFI spec allows a packed array of UEFI device paths in the
FilePathList[] of an EFI_LOAD_OPTION. The first file path must
describe the loaded image but the rest are OS specific.

Previous patches parse the device path and try to use the second
member of the array as an initrd. So let's modify efidebug slightly
and install the second file described in the command line as the
initrd device path.

Signed-off-by: Ilias Apalodimas

efi_loader: use ':' as separator for setenv -i

2020-08-24T14:37:53+00:00

setenv -e -i , can be used to set a UEFI variable
from memory.

For separating an address and a size we use ':' in most commands.
Let's do the same for setenv -e -i.

Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: modify 'multiple signatures' test case

2020-08-14T10:34:33+00:00

The test case 5 in test_signed (multiple signatures) must be modified
and aligned with the change introduced in the previous commit
("efi_loader: signature: correct a behavior against multiple signatures").

Signed-off-by: AKASHI Takahiro

test/py: efi_secboot: add a test for verifying with digest of signed image

2020-07-11T21:14:16+00:00

Signature database (db or dbx) may have not only certificates that contain
a public key for RSA decryption, but also digests of signed images.

In this test case, if database has an image's digest (EFI_CERT_SHA256_GUID)
and if the value matches to a hash value calculated from image's binary,
authentication should pass in case of db, and fail in case of dbx.

Signed-off-by: AKASHI Takahiro 

Use defined time stamps for sign-efi-sig-list.
Signed-off-by: Heinrich Schuchardt

test/py: efi_secboot: add a test for multiple signatures

2020-07-11T21:14:16+00:00

In this test case, an image is signed multiple times with different
keys. If any of signatures contained is not verified, the whole
authentication check should fail.

Signed-off-by: AKASHI Takahiro 

Provide a defined time stamp for dbx_hash1.auth.
Signed-off-by: Heinrich Schuchardt