u-boot.git/test/py/tests/test_vboot.py, branch v2021.10

image: Check for unit addresses in FITs

2021-02-16T03:31:54+00:00

Using unit addresses in a FIT is a security risk. Add a check for this
and disallow it.

CVE-2021-27138

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

libfdt: Check for multiple/invalid root nodes

2021-02-16T03:31:53+00:00

It is possible to construct a devicetree blob with multiple root nodes.
Update fdt_check_full() to check for this, along with a root node with an
invalid name.

CVE-2021-27097

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

test: Add tests for the 'evil' vboot attacks

2021-02-16T00:17:33+00:00

Add tests to check that these two attacks are mitigated by recent patches.

Signed-off-by: Simon Glass 
Reported-by: Bruce Monroe 
Reported-by: Arie Haenel 
Reported-by: Julien Lenoir

test: vboot: add tests for multiple required keys

2020-10-13T01:30:37+00:00

This patch adds vboot tests to verify the support for multiple
required keys using new required-mode DTB policy.

This patch also fixes existing test where dev
key is assumed to be marked as not required, although
it is marked as required.

Note that this patch re-added sign_fit_norequire().
sign_fit_norequire() was removed as part of the following:
commit b008677daf2a ("test: vboot: Fix pylint errors").
This patch leverages sign_fit_norequire() to fix the
existing bug.

Signed-off-by: Thirupathaiah Annapureddy 
Reviewed-by: Simon Glass

test/py: vboot: add a test to check fit signature on fit with padding

2020-05-01T15:34:01+00:00

The pytest vboot does all his tests on fit without padding.
We add the same tests on fit with padding.

Reviewed-by: Simon Glass 
Signed-off-by: Philippe Reynes

test: vboot: Reduce fake kernel size to 500 bytes

2020-04-01T13:45:09+00:00

We don't need 5KB to test things out. A smaller size makes it easier to
look at the FIT with fdtdump.

Signed-off-by: Simon Glass

test: vboot: Move key creation into a function

2020-04-01T13:45:09+00:00

This code is repeated so move it into a function with a parameter.

Signed-off-by: Simon Glass

test: vboot: Fix pylint errors

2020-04-01T13:45:09+00:00

Fix various minor things noticed by pylint.

Signed-off-by: Simon Glass

test: vboot: Tidy up the code a little

2020-04-01T13:45:09+00:00

Fix some long lines and comments. Use a distinct name for the
'required key' test.

Signed-off-by: Simon Glass

test: vboot: Parameterise the test

2020-04-01T13:45:09+00:00

This test is actually made up of five separate tests. Split them out so
that they appear as separate tests.

Unfortunately this restarts U-Boot multiple times which adds about a
second to the already-long vboot test, about 8 seconds total on my
machine. We could add a special 'teardown' test afterwards but if the
tests are executed out of order that would not work.

Changing test_vboot into a class causes it not to be discovered and makes
it different from all other tests.

Signed-off-by: Simon Glass