summaryrefslogtreecommitdiffstats
path: root/test/py/tests/test_efi_secboot
Commit message (Collapse)AuthorAgeFilesLines
* test/py: Fix efidebug related testsIlias Apalodimas2021-04-243-16/+16
| | | | | | | | | | | | | | commit cbea241e935e("efidebug: add multiple device path instances on Boot####") slightly tweaked the efidebug syntax adding -b, -i and -s for the boot image, initrd and optional data. The pytests using this command were adapted as well. However I completely missed the last "" argument, which at the time indicated the optional data and needed conversion as well. This patch is adding the missing -s flag and the tests are back to normal. Fixes: cbea241e935e("efidebug: add multiple device path instances on Boot####") Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Reviwed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* efidebug: add multiple device path instances on Boot####Ilias Apalodimas2021-03-253-16/+16
| | | | | | | | | | | | | The UEFI spec allows a packed array of UEFI device paths in the FilePathList[] of an EFI_LOAD_OPTION. The first file path must describe the loaded image but the rest are OS specific. Previous patches parse the device path and try to use the second member of the array as an initrd. So let's modify efidebug slightly and install the second file described in the command line as the initrd device path. Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
* efi_loader: use ':' as separator for setenv -iHeinrich Schuchardt2020-08-244-74/+74
| | | | | | | | | | setenv -e -i <address>,<filesize> can be used to set a UEFI variable from memory. For separating an address and a size we use ':' in most commands. Let's do the same for setenv -e -i. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test/py: efi_secboot: modify 'multiple signatures' test caseAKASHI Takahiro2020-08-142-12/+19
| | | | | | | | The test case 5 in test_signed (multiple signatures) must be modified and aligned with the change introduced in the previous commit ("efi_loader: signature: correct a behavior against multiple signatures"). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
* test/py: efi_secboot: add test for intermediate certificatesAKASHI Takahiro2020-08-134-0/+305
| | | | | | | | In this test case, an image may have a signature with additional intermediate certificates. A chain of trust will be followed and all the certificates in the middle of chain must be verified before loading. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
* test/py: efi_secboot: small rework for adding a new testAKASHI Takahiro2020-08-132-13/+3
| | | | | | | It won't be very useful to customize HELLO_PATH and EFI_SECBOOT_IMAGE_NAME under the current code base. So just remove them. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
* test/py: efi_secboot: fix additional pylint errorsAKASHI Takahiro2020-07-221-7/+8
| | | | | | | | This is a fixup by autopep8 after the commit ("test/py: efi_secboot: apply autopep8"). Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test/py: efi_secboot: remove unused functionAKASHI Takahiro2020-07-221-9/+0
| | | | | | | | 'tool_is_in_path' function is no longer used anywhere after Heinrich has removed 'sudo' version of fixture setup. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test: use virt-make-fs to build imageHeinrich Schuchardt2020-07-112-30/+4
| | | | | | Avoid sudo for test/py/tests/test_efi_secboot by using virt-make-fs. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test/py: efi_secboot: add a test for verifying with digest of signed imageAKASHI Takahiro2020-07-112-0/+59
| | | | | | | | | | | | | | Signature database (db or dbx) may have not only certificates that contain a public key for RSA decryption, but also digests of signed images. In this test case, if database has an image's digest (EFI_CERT_SHA256_GUID) and if the value matches to a hash value calculated from image's binary, authentication should pass in case of db, and fail in case of dbx. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Use defined time stamps for sign-efi-sig-list. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test/py: efi_secboot: add a test for multiple signaturesAKASHI Takahiro2020-07-112-1/+59
| | | | | | | | | | | In this test case, an image is signed multiple times with different keys. If any of signatures contained is not verified, the whole authentication check should fail. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Provide a defined time stamp for dbx_hash1.auth. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test/py: efi_secboot: add a test against certificate revocationAKASHI Takahiro2020-07-112-1/+31
| | | | | | | | | | | | | | | Revocation database (dbx) may have not only certificates, but also message digests of certificates with revocation time (EFI_CERT_X509_SHA256_GUILD). In this test case, if the database has such a digest and if the value matches to a certificate that created a given image's signature, authentication should fail. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Set defined time stamp for dbx_hash.auth. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test/py: efi_secboot: split "signed image" test case-1 into two casesAKASHI Takahiro2020-07-111-28/+38
| | | | | | | | | | Split the existing test case-1 into case1 and a new case-2: case-1 for non-SecureBoot mode; case-2 for SecureBoot mode. In addition, one corner case is added to case-2; a image is signed but a corresponding certificate is not yet installed in "db." Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
* test/py: efi_secboot: more fixes against pylintAKASHI Takahiro2020-07-114-83/+79
| | | | | | | More fixes against pylint warnings that autopep8 didn't handle in the previous commit. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
* test/py: efi_secboot: apply autopep8AKASHI Takahiro2020-07-115-60/+67
| | | | | | | | Python's autopep8 can automatically correct some of warnings from pylint and rewrite the code in a pretty print format. So just do it. Suggested-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
* test: correct time stamps for UEFI authenticationHeinrich Schuchardt2020-07-031-8/+8
| | | | | | | | | | | A time authenticated variable cannot be overwritten with another value with the same time stamp. So we must ensure the correct sequence of time stamps when generating out test data. Using parameter -t for sign-efi-sig-list gives reproducible results and avoids sleep statements. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test/py: efi_secboot: fix test case 1g of test_authvarAKASHI Takahiro2020-07-031-6/+6
| | | | | | | | | In the test case (1g) of test_authvar, "db" is mistakenly used, and it ends up being the exact same as (1f). So correct it as "dbx" test case. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test/py: efi_secboot: remove all "re.search"AKASHI Takahiro2020-07-033-74/+65
| | | | | | | | Currently, we don't use any regular expression in matching outputs from U-Boot. Since its use is just redundant, we can remove all. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* Revert "test: stabilize test_efi_secboot"AKASHI Takahiro2020-07-033-9/+9
| | | | | | | This reverts commit 5827c2545849441dd60467565aac11964259972f. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test: stabilize test_efi_secbootHeinrich Schuchardt2020-05-043-9/+9
| | | | | | | | | | | | | | | | | | | | | When setting up the console via function efi_console_register() we call query_console_serial(). This functions sends an escape sequence to the terminal to query the display size. The response is another escape sequence. console.run_command_list() is looking for a regular expression '^==>'. If the escape sequence for the screen size precedes the prompt without a line break, no match is found. When efi_disk_register() is called before efi_console_register() this leads to a test failuere of the UEFI secure boot tests. We can avoid the problem if the first UEFI command passed to u_boot_console.run_command_list() produces output. This patch achieves this by appending '; echo' to the first UEFI related command of the problematic tests. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* test/py: fix test_efi_secboot/conftest.pyHeinrich Schuchardt2020-04-301-24/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | If udisksctl is present test/py/tests/test_efi_secboot/conftest.py fails because the disk image is never mounted. Normal users can only mount fuse file systems. Unfortunately fusefat is still in an experimental state and seems not to work here correctly. So as we have to be root or use the sudo command anyway delete all coding referring to udisksctl. -- We should not use mount point /mnt as this directory or one of its sub-directories might already be in use as active mount points. Instead create a new directory in the build root as mount point. -- Remove debug print statements that have been commented out. print without parentheses is anyway invalid in Python 3. And pytest anyway filters out the output if there is no exception reported. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
* efi_loader, pytest: add UEFI secure boot tests (image)AKASHI Takahiro2020-04-162-0/+238
| | | | | | | | | | Provide test cases for * image authentication for signed images (test_efi_secboot/test_signed.py) * image authentication for unsigned images (test_efi_secboot/test_unsigned.py) Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
* efi_loader, pytest: add UEFI secure boot tests (authenticated variables)AKASHI Takahiro2020-04-161-0/+282
| | | | | | Provide a couple of test cases for variable authentication. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
* efi_loader, pytest: set up secure boot environmentAKASHI Takahiro2020-04-162-0/+172
A fixture for UEFI secure boot tests (image authentication and variable authentication) is defined. A small file system with test data in a single partition formatted in fat is created. This test requires efitools v1.5.2 or later. If the system's efitools is older, you have to build it on your own and define EFITOOLS_PATH. Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
generated by cgit (git 2.34.1) at 2026-01-18 09:22:40 +0000