ChuanN-sudo/u-boot
1
0
Fork 0
forked from OERV-BSP/u-boot
Code Pull Requests Activity

test/py: Shorten u_boot_console

Browse Source 
This fixture name is quite long and results in lots of verbose code.
We know this is U-Boot so the 'u_boot_' part is not necessary.

But it is also a bit of a misnomer, since it provides access to all the
information available to tests. It is not just the console.

It would be too confusing to use con as it would be confused with
config and it is probably too short.

So shorten it to 'ubman'.

Signed-off-by: Simon Glass <sjg@chromium.org>
Link: https://lore.kernel.org/u-boot/CAFLszTgPa4aT_J9h9pqeTtLCVn4x2JvLWRcWRD8NaN3uoSAtyA@mail.gmail.com/
This commit is contained in:
Simon Glass
2025-02-09 09:07:14 -07:00
parent 00dfb7038e
commit 752c376987
105 changed files with 2676 additions and 2676 deletions
Download Patch File Download Diff File Expand all files Collapse all files

120
test/py/tests/test_efi_secboot/test_authvar.py
View File

@@ -17,119 +17,119 @@ import pytest
@pytest.mark.buildconfigspec('cmd_nvedit_efi')
@pytest.mark.slow
class TestEfiAuthVar(object):
def test_efi_var_auth1(self, u_boot_console, efi_boot_env):
def test_efi_var_auth1(self, ubman, efi_boot_env):
"""
Test Case 1 - Install signature database
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 1a'):
with ubman.log.section('Test Case 1a'):
# Test Case 1a, Initial secure state
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'printenv -e SecureBoot'])
assert '00000000: 00' in ''.join(output)
output = u_boot_console.run_command(
output = ubman.run_command(
'printenv -e SetupMode')
assert '00000000: 01' in output
with u_boot_console.log.section('Test Case 1b'):
with ubman.log.section('Test Case 1b'):
# Test Case 1b, PK without AUTHENTICATED_WRITE_ACCESS
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' in ''.join(output)
with u_boot_console.log.section('Test Case 1c'):
with ubman.log.section('Test Case 1c'):
# Test Case 1c, install PK
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK',
'printenv -e -n PK'])
assert 'PK:' in ''.join(output)
output = u_boot_console.run_command(
output = ubman.run_command(
'printenv -e SecureBoot')
assert '00000000: 01' in output
output = u_boot_console.run_command(
output = ubman.run_command(
'printenv -e SetupMode')
assert '00000000: 00' in output
with u_boot_console.log.section('Test Case 1d'):
with ubman.log.section('Test Case 1d'):
# Test Case 1d, db/dbx without KEK
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' in ''.join(output)
with u_boot_console.log.section('Test Case 1e'):
with ubman.log.section('Test Case 1e'):
# Test Case 1e, install KEK
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -i 4000000:$filesize KEK'])
assert 'Failed to set EFI variable' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
'printenv -e -n KEK'])
assert 'KEK:' in ''.join(output)
output = u_boot_console.run_command(
output = ubman.run_command(
'printenv -e SecureBoot')
assert '00000000: 01' in output
with u_boot_console.log.section('Test Case 1f'):
with ubman.log.section('Test Case 1f'):
# Test Case 1f, install db
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
'printenv -e -n -guid d719b2cb-3d3a-4596-a3bc-dad00e67656f db'])
assert 'Failed to set EFI variable' not in ''.join(output)
assert 'db:' in ''.join(output)
output = u_boot_console.run_command(
output = ubman.run_command(
'printenv -e SecureBoot')
assert '00000000: 01' in output
with u_boot_console.log.section('Test Case 1g'):
with ubman.log.section('Test Case 1g'):
# Test Case 1g, install dbx
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 dbx.auth',
'setenv -e -nv -bs -rt -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 dbx.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
'printenv -e -n -guid d719b2cb-3d3a-4596-a3bc-dad00e67656f dbx'])
assert 'Failed to set EFI variable' not in ''.join(output)
assert 'dbx:' in ''.join(output)
output = u_boot_console.run_command(
output = ubman.run_command(
'printenv -e SecureBoot')
assert '00000000: 01' in output
def test_efi_var_auth2(self, u_boot_console, efi_boot_env):
def test_efi_var_auth2(self, ubman, efi_boot_env):
"""
Test Case 2 - Update database by overwriting
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 2a'):
with ubman.log.section('Test Case 2a'):
# Test Case 2a, update without AUTHENTICATED_WRITE_ACCESS
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK',
@@ -141,36 +141,36 @@ class TestEfiAuthVar(object):
assert 'Failed to set EFI variable' not in ''.join(output)
assert 'db:' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db1.auth',
'setenv -e -nv -bs -rt -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' in ''.join(output)
with u_boot_console.log.section('Test Case 2b'):
with ubman.log.section('Test Case 2b'):
# Test Case 2b, update without correct signature
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.esl',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' in ''.join(output)
with u_boot_console.log.section('Test Case 2c'):
with ubman.log.section('Test Case 2c'):
# Test Case 2c, update with correct signature
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db1.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
'printenv -e -n -guid d719b2cb-3d3a-4596-a3bc-dad00e67656f db'])
assert 'Failed to set EFI variable' not in ''.join(output)
assert 'db:' in ''.join(output)
def test_efi_var_auth3(self, u_boot_console, efi_boot_env):
def test_efi_var_auth3(self, ubman, efi_boot_env):
"""
Test Case 3 - Append database
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 3a'):
with ubman.log.section('Test Case 3a'):
# Test Case 3a, update without AUTHENTICATED_WRITE_ACCESS
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK',
@@ -182,36 +182,36 @@ class TestEfiAuthVar(object):
assert 'Failed to set EFI variable' not in ''.join(output)
assert 'db:' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db2.auth',
'setenv -e -nv -bs -rt -a -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' in ''.join(output)
with u_boot_console.log.section('Test Case 3b'):
with ubman.log.section('Test Case 3b'):
# Test Case 3b, update without correct signature
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.esl',
'setenv -e -nv -bs -rt -at -a -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' in ''.join(output)
with u_boot_console.log.section('Test Case 3c'):
with ubman.log.section('Test Case 3c'):
# Test Case 3c, update with correct signature
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db2.auth',
'setenv -e -nv -bs -rt -at -a -i 4000000:$filesize db',
'printenv -e -n -guid d719b2cb-3d3a-4596-a3bc-dad00e67656f db'])
assert 'Failed to set EFI variable' not in ''.join(output)
assert 'db:' in ''.join(output)
def test_efi_var_auth4(self, u_boot_console, efi_boot_env):
def test_efi_var_auth4(self, ubman, efi_boot_env):
"""
Test Case 4 - Delete database without authentication
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 4a'):
with ubman.log.section('Test Case 4a'):
# Test Case 4a, update without AUTHENTICATED_WRITE_ACCESS
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK',
@@ -223,29 +223,29 @@ class TestEfiAuthVar(object):
assert 'Failed to set EFI variable' not in ''.join(output)
assert 'db:' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'setenv -e -nv -bs -rt db',
'printenv -e -n -guid d719b2cb-3d3a-4596-a3bc-dad00e67656f db'])
assert 'Failed to set EFI variable' in ''.join(output)
assert 'db:' in ''.join(output)
with u_boot_console.log.section('Test Case 4b'):
with ubman.log.section('Test Case 4b'):
# Test Case 4b, update without correct signature/data
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'setenv -e -nv -bs -rt -at db',
'printenv -e -n -guid d719b2cb-3d3a-4596-a3bc-dad00e67656f db'])
assert 'Failed to set EFI variable' in ''.join(output)
assert 'db:' in ''.join(output)
def test_efi_var_auth5(self, u_boot_console, efi_boot_env):
def test_efi_var_auth5(self, ubman, efi_boot_env):
"""
Test Case 5 - Uninstall(delete) PK
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 5a'):
with ubman.log.section('Test Case 5a'):
# Test Case 5a, Uninstall PK without correct signature
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK',
@@ -257,25 +257,25 @@ class TestEfiAuthVar(object):
assert 'Failed to set EFI variable' not in ''.join(output)
assert 'PK:' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 PK_null.esl',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK',
'printenv -e -n PK'])
assert 'Failed to set EFI variable' in ''.join(output)
assert 'PK:' in ''.join(output)
with u_boot_console.log.section('Test Case 5b'):
with ubman.log.section('Test Case 5b'):
# Test Case 5b, Uninstall PK with correct signature
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 PK_null.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK',
'printenv -e -n PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
assert '\"PK\" not defined' in ''.join(output)
output = u_boot_console.run_command(
output = ubman.run_command(
'printenv -e SecureBoot')
assert '00000000: 00' in output
output = u_boot_console.run_command(
output = ubman.run_command(
'printenv -e SetupMode')
assert '00000000: 01' in output

148
test/py/tests/test_efi_secboot/test_signed.py
View File

@@ -18,83 +18,83 @@ import pytest
@pytest.mark.buildconfigspec('cmd_nvedit_efi')
@pytest.mark.slow
class TestEfiSignedImage(object):
def test_efi_signed_image_auth1(self, u_boot_console, efi_boot_env):
def test_efi_signed_image_auth1(self, ubman, efi_boot_env):
"""
Test Case 1 - Secure boot is not in force
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 1a'):
with ubman.log.section('Test Case 1a'):
# Test Case 1a, run signed image if no PK
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'efidebug boot add -b 1 HELLO1 host 0:1 /helloworld.efi.signed -s ""',
'efidebug boot order 1',
'bootefi bootmgr'])
assert 'Hello, world!' in ''.join(output)
with u_boot_console.log.section('Test Case 1b'):
with ubman.log.section('Test Case 1b'):
# Test Case 1b, run unsigned image if no PK
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 2 HELLO2 host 0:1 /helloworld.efi -s ""',
'efidebug boot order 2',
'bootefi bootmgr'])
assert 'Hello, world!' in ''.join(output)
def test_efi_signed_image_auth2(self, u_boot_console, efi_boot_env):
def test_efi_signed_image_auth2(self, ubman, efi_boot_env):
"""
Test Case 2 - Secure boot is in force,
authenticated by db (TEST_db certificate in db)
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 2a'):
with ubman.log.section('Test Case 2a'):
# Test Case 2a, db is not yet installed
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO1 host 0:1 /helloworld.efi.signed -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert('\'HELLO1\' failed' in ''.join(output))
assert('efi_bootmgr_load() returned: 26' in ''.join(output))
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 2 HELLO2 host 0:1 /helloworld.efi -s ""',
'efidebug boot order 2',
'efidebug test bootmgr'])
assert '\'HELLO2\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
with u_boot_console.log.section('Test Case 2b'):
with ubman.log.section('Test Case 2b'):
# Test Case 2b, authenticated by db
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 2',
'efidebug test bootmgr'])
assert '\'HELLO2\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'bootefi bootmgr'])
assert 'Hello, world!' in ''.join(output)
def test_efi_signed_image_auth3(self, u_boot_console, efi_boot_env):
def test_efi_signed_image_auth3(self, ubman, efi_boot_env):
"""
Test Case 3 - rejected by dbx (TEST_db certificate in dbx)
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 3a'):
with ubman.log.section('Test Case 3a'):
# Test Case 3a, rejected by dbx
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
@@ -103,34 +103,34 @@ class TestEfiSignedImage(object):
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
with u_boot_console.log.section('Test Case 3b'):
with ubman.log.section('Test Case 3b'):
# Test Case 3b, rejected by dbx even if db allows
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
def test_efi_signed_image_auth4(self, u_boot_console, efi_boot_env):
def test_efi_signed_image_auth4(self, ubman, efi_boot_env):
"""
Test Case 4 - revoked by dbx (digest of TEST_db certificate in dbx)
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 4'):
with ubman.log.section('Test Case 4'):
# Test Case 4, rejected by dbx
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 dbx_hash.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
@@ -141,25 +141,25 @@ class TestEfiSignedImage(object):
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
def test_efi_signed_image_auth5(self, u_boot_console, efi_boot_env):
def test_efi_signed_image_auth5(self, ubman, efi_boot_env):
"""
Test Case 5 - multiple signatures
one signed with TEST_db, and
one signed with TEST_db1
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 5a'):
with ubman.log.section('Test Case 5a'):
# Test Case 5a, authenticated even if only one of signatures
# is verified
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
@@ -168,54 +168,54 @@ class TestEfiSignedImage(object):
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert 'Hello, world!' in ''.join(output)
with u_boot_console.log.section('Test Case 5b'):
with ubman.log.section('Test Case 5b'):
# Test Case 5b, authenticated if both signatures are verified
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db2.auth',
'setenv -e -nv -bs -rt -at -a -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert 'Hello, world!' in ''.join(output)
with u_boot_console.log.section('Test Case 5c'):
with ubman.log.section('Test Case 5c'):
# Test Case 5c, rejected if one of signatures (digest of
# certificate) is revoked
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 dbx_hash.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
with u_boot_console.log.section('Test Case 5d'):
with ubman.log.section('Test Case 5d'):
# Test Case 5d, rejected if both of signatures are revoked
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 dbx_hash2.auth',
'setenv -e -nv -bs -rt -at -a -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
# Try rejection in reverse order.
u_boot_console.restart_uboot()
with u_boot_console.log.section('Test Case 5e'):
ubman.restart_uboot()
with ubman.log.section('Test Case 5e'):
# Test Case 5e, authenticated even if only one of signatures
# is verified. Same as before but reject dbx_hash1.auth only
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
@@ -228,22 +228,22 @@ class TestEfiSignedImage(object):
'fatload host 0:1 4000000 dbx_hash1.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
def test_efi_signed_image_auth6(self, u_boot_console, efi_boot_env):
def test_efi_signed_image_auth6(self, ubman, efi_boot_env):
"""
Test Case 6 - using digest of signed image in database
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 6a'):
with ubman.log.section('Test Case 6a'):
# Test Case 6a, verified by image's digest in db
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db_hello_signed.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
@@ -252,47 +252,47 @@ class TestEfiSignedImage(object):
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed -s ""',
'efidebug boot order 1',
'bootefi bootmgr'])
assert 'Hello, world!' in ''.join(output)
with u_boot_console.log.section('Test Case 6b'):
with ubman.log.section('Test Case 6b'):
# Test Case 6b, rejected by TEST_db certificate in dbx
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 dbx_db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
with u_boot_console.log.section('Test Case 6c'):
with ubman.log.section('Test Case 6c'):
# Test Case 6c, rejected by image's digest in dbx
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
'fatload host 0:1 4000000 dbx_hello_signed.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
def test_efi_signed_image_auth7(self, u_boot_console, efi_boot_env):
def test_efi_signed_image_auth7(self, ubman, efi_boot_env):
"""
Test Case 7 - Reject images based on the sha384/512 of their x509 cert
"""
# sha384 of an x509 cert in dbx
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 7a'):
output = u_boot_console.run_command_list([
with ubman.log.section('Test Case 7a'):
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
@@ -305,7 +305,7 @@ class TestEfiSignedImage(object):
'fatload host 0:1 4000000 dbx_hash384.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
@@ -313,9 +313,9 @@ class TestEfiSignedImage(object):
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
# sha512 of an x509 cert in dbx
u_boot_console.restart_uboot()
with u_boot_console.log.section('Test Case 7b'):
output = u_boot_console.run_command_list([
ubman.restart_uboot()
with ubman.log.section('Test Case 7b'):
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
@@ -328,34 +328,34 @@ class TestEfiSignedImage(object):
'fatload host 0:1 4000000 dbx_hash512.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi.signed_2sigs -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
def test_efi_signed_image_auth8(self, u_boot_console, efi_boot_env):
def test_efi_signed_image_auth8(self, ubman, efi_boot_env):
"""
Test Case 8 - Secure boot is in force,
Same as Test Case 2 but the image binary to be loaded
was willfully modified (forged)
Must be rejected.
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 8a'):
with ubman.log.section('Test Case 8a'):
# Test Case 8a, Secure boot is not yet forced
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'efidebug boot add -b 1 HELLO1 host 0:1 /helloworld_forged.efi.signed -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert('hELLO, world!' in ''.join(output))
with u_boot_console.log.section('Test Case 8b'):
with ubman.log.section('Test Case 8b'):
# Test Case 8b, Install signature database and verify the image
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
'fatload host 0:1 4000000 KEK.auth',
@@ -363,7 +363,7 @@ class TestEfiSignedImage(object):
'fatload host 0:1 4000000 PK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert(not 'hELLO, world!' in ''.join(output))

46
test/py/tests/test_efi_secboot/test_signed_intca.py
View File

@@ -20,15 +20,15 @@ import pytest
@pytest.mark.buildconfigspec('cmd_nvedit_efi')
@pytest.mark.slow
class TestEfiSignedImageIntca(object):
def test_efi_signed_image_intca1(self, u_boot_console, efi_boot_env_intca):
def test_efi_signed_image_intca1(self, ubman, efi_boot_env_intca):
"""
Test Case 1 - authenticated by root CA in db
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env_intca
with u_boot_console.log.section('Test Case 1a'):
with ubman.log.section('Test Case 1a'):
# Test Case 1a, with no Int CA and not authenticated by root CA
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db_c.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
@@ -38,30 +38,30 @@ class TestEfiSignedImageIntca(object):
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO_a host 0:1 /helloworld.efi.signed_a -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO_a\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
with u_boot_console.log.section('Test Case 1b'):
with ubman.log.section('Test Case 1b'):
# Test Case 1b, signed and authenticated by root CA
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 2 HELLO_ab host 0:1 /helloworld.efi.signed_ab -s ""',
'efidebug boot order 2',
'bootefi bootmgr'])
assert 'Hello, world!' in ''.join(output)
def test_efi_signed_image_intca2(self, u_boot_console, efi_boot_env_intca):
def test_efi_signed_image_intca2(self, ubman, efi_boot_env_intca):
"""
Test Case 2 - authenticated by root CA in db
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env_intca
with u_boot_console.log.section('Test Case 2a'):
with ubman.log.section('Test Case 2a'):
# Test Case 2a, unsigned and not authenticated by root CA
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
@@ -69,16 +69,16 @@ class TestEfiSignedImageIntca(object):
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert '\'HELLO_abc\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
with u_boot_console.log.section('Test Case 2b'):
with ubman.log.section('Test Case 2b'):
# Test Case 2b, signed and authenticated by root CA
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db_b.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
'efidebug boot order 1',
@@ -86,24 +86,24 @@ class TestEfiSignedImageIntca(object):
assert '\'HELLO_abc\' failed' in ''.join(output)
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
with u_boot_console.log.section('Test Case 2c'):
with ubman.log.section('Test Case 2c'):
# Test Case 2c, signed and authenticated by root CA
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db_c.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
'efidebug boot order 1',
'efidebug test bootmgr'])
assert 'Hello, world!' in ''.join(output)
def test_efi_signed_image_intca3(self, u_boot_console, efi_boot_env_intca):
def test_efi_signed_image_intca3(self, ubman, efi_boot_env_intca):
"""
Test Case 3 - revoked by dbx
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env_intca
with u_boot_console.log.section('Test Case 3a'):
with ubman.log.section('Test Case 3a'):
# Test Case 3a, revoked by int CA in dbx
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 dbx_b.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
@@ -115,7 +115,7 @@ class TestEfiSignedImageIntca(object):
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO_abc host 0:1 /helloworld.efi.signed_abc -s ""',
'efidebug boot order 1',
'efidebug test bootmgr'])
@@ -124,9 +124,9 @@ class TestEfiSignedImageIntca(object):
# assert '\'HELLO_abc\' failed' in ''.join(output)
# assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
with u_boot_console.log.section('Test Case 3b'):
with ubman.log.section('Test Case 3b'):
# Test Case 3b, revoked by root CA in dbx
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 dbx_c.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
'efidebug boot order 1',

42
test/py/tests/test_efi_secboot/test_unsigned.py
View File

@@ -18,15 +18,15 @@ import pytest
@pytest.mark.buildconfigspec('cmd_nvedit_efi')
@pytest.mark.slow
class TestEfiUnsignedImage(object):
def test_efi_unsigned_image_auth1(self, u_boot_console, efi_boot_env):
def test_efi_unsigned_image_auth1(self, ubman, efi_boot_env):
"""
Test Case 1 - rejected when not digest in db or dbx
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 1'):
with ubman.log.section('Test Case 1'):
# Test Case 1
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 KEK.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize KEK',
@@ -34,26 +34,26 @@ class TestEfiUnsignedImage(object):
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi -s ""',
'efidebug boot order 1',
'bootefi bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
assert 'Hello, world!' not in ''.join(output)
def test_efi_unsigned_image_auth2(self, u_boot_console, efi_boot_env):
def test_efi_unsigned_image_auth2(self, ubman, efi_boot_env):
"""
Test Case 2 - authenticated by digest in db
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 2'):
with ubman.log.section('Test Case 2'):
# Test Case 2
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db_hello.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db',
@@ -63,21 +63,21 @@ class TestEfiUnsignedImage(object):
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi -s ""',
'efidebug boot order 1',
'bootefi bootmgr'])
assert 'Hello, world!' in ''.join(output)
def test_efi_unsigned_image_auth3(self, u_boot_console, efi_boot_env):
def test_efi_unsigned_image_auth3(self, ubman, efi_boot_env):
"""
Test Case 3 - rejected by digest in dbx
"""
u_boot_console.restart_uboot()
ubman.restart_uboot()
disk_img = efi_boot_env
with u_boot_console.log.section('Test Case 3a'):
with ubman.log.section('Test Case 3a'):
# Test Case 3a, rejected by dbx
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'host bind 0 %s' % disk_img,
'fatload host 0:1 4000000 db_hello.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize dbx',
@@ -87,30 +87,30 @@ class TestEfiUnsignedImage(object):
'setenv -e -nv -bs -rt -at -i 4000000:$filesize PK'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi -s ""',
'efidebug boot order 1',
'bootefi bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)
assert 'Hello, world!' not in ''.join(output)
with u_boot_console.log.section('Test Case 3b'):
with ubman.log.section('Test Case 3b'):
# Test Case 3b, rejected by dbx even if db allows
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'fatload host 0:1 4000000 db_hello.auth',
'setenv -e -nv -bs -rt -at -i 4000000:$filesize db'])
assert 'Failed to set EFI variable' not in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot add -b 1 HELLO host 0:1 /helloworld.efi -s ""',
'efidebug boot order 1',
'bootefi bootmgr'])
assert '\'HELLO\' failed' in ''.join(output)
output = u_boot_console.run_command_list([
output = ubman.run_command_list([
'efidebug boot order 1',
'efidebug test bootmgr'])
assert 'efi_bootmgr_load() returned: 26' in ''.join(output)