From: AKASHI Takahiro <takahiro.akashi@linaro.org>
To: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: agraf@csgraf.de, trini@konsulko.com, sjg@chromium.org,
ilias.apalodimas@linaro.org, sughosh.ganu@linaro.org,
masami.hiramatsu@linaro.org, u-boot@lists.denx.de
Subject: Re: [PATCH v2 5/9] test/py: efi_capsule: add image authentication test
Date: Mon, 2 Aug 2021 13:02:36 +0900 [thread overview]
Message-ID: <20210802040236.GC7965@laputa> (raw)
In-Reply-To: <0ddda80e-ebfd-219c-3652-c6ee5d3b8a37@gmx.de>
On Sun, Aug 01, 2021 at 11:38:16AM +0200, Heinrich Schuchardt wrote:
> On 7/27/21 11:10 AM, AKASHI Takahiro wrote:
> > Add a couple of test cases against capsule image authentication
> > for capsule-on-disk, where only a signed capsule file with the verified
> > signature will be applied to the system.
> >
> > Due to the difficulty of embedding a public key (esl file) in U-Boot
> > binary during pytest setup time, all the keys/certificates are pre-created.
> >
> > Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
>
> Please, check the pylint warnings:
>
> $ pylint test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py
> ************* Module test_capsule_firmware_signed
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:44:0:
> C0301: Line too long (113/100) (line-too-long)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:73:0:
> C0301: Line too long (117/100) (line-too-long)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:110:0:
> C0301: Line too long (113/100) (line-too-long)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:139:0:
> C0301: Line too long (117/100) (line-too-long)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:178:0:
> C0301: Line too long (113/100) (line-too-long)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:207:0:
> C0301: Line too long (117/100) (line-too-long)
As you can see, the line is given as a single "command line" string.
Breaking the line into meaningless pieces of strings won't make sense here.
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:154:2:
> W0511: TODO: check CapsuleStatus in CapsuleXXXX (fixme)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:222:2:
> W0511: TODO: check CapsuleStatus in CapsuleXXXX (fixme)
I don't intend to fix those TODOs soon.
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:14:0:
> W0401: Wildcard import capsule_defs (wildcard-import)
Will fix.
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:27:0:
> C0115: Missing class docstring (missing-class-docstring)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:27:0:
> R0205: Class 'TestEfiCapsuleFirmwareSigned' inherits from object, can be
> safely removed from bases in python3 (useless-object-inheritance)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:28:4:
> R0201: Method could be a function (no-self-use)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:93:4:
> R0201: Method could be a function (no-self-use)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:162:4:
> R0201: Method could be a function (no-self-use)
I would like to maintain the syntax that I use in this file:
class TestXXX():
def test_yyy():
...
even though pylint suggests that those changes be safely made.
"class/def" combination will allow us to add more tests cases for
different test conditions in the future without modifying
the structure of the file.
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:12:0:
> W0611: Unused check_call imported from subprocess (unused-import)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:12:0:
> W0611: Unused check_output imported from subprocess (unused-import)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:12:0:
> W0611: Unused CalledProcessError imported from subprocess (unused-import)
> test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py:14:0:
> W0614: Unused import EFITOOLS_PATH from wildcard import
> (unused-wildcard-import)
Will fix.
-Takahiro Akashi
> Best regards
>
> Heinrich
>
> > ---
> > test/py/tests/test_efi_capsule/SIGNER.crt | 19 ++
> > test/py/tests/test_efi_capsule/SIGNER.esl | Bin 0 -> 829 bytes
> > test/py/tests/test_efi_capsule/SIGNER.key | 28 +++
> > test/py/tests/test_efi_capsule/SIGNER2.crt | 19 ++
> > test/py/tests/test_efi_capsule/SIGNER2.key | 28 +++
> > .../py/tests/test_efi_capsule/capsule_defs.py | 5 +
> > test/py/tests/test_efi_capsule/conftest.py | 35 ++-
> > .../test_capsule_firmware_signed.py | 228 ++++++++++++++++++
> > 8 files changed, 359 insertions(+), 3 deletions(-)
> > create mode 100644 test/py/tests/test_efi_capsule/SIGNER.crt
> > create mode 100644 test/py/tests/test_efi_capsule/SIGNER.esl
> > create mode 100644 test/py/tests/test_efi_capsule/SIGNER.key
> > create mode 100644 test/py/tests/test_efi_capsule/SIGNER2.crt
> > create mode 100644 test/py/tests/test_efi_capsule/SIGNER2.key
> > create mode 100644 test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py
> >
> > diff --git a/test/py/tests/test_efi_capsule/SIGNER.crt b/test/py/tests/test_efi_capsule/SIGNER.crt
> > new file mode 100644
> > index 000000000000..f63ec01d9996
> > --- /dev/null
> > +++ b/test/py/tests/test_efi_capsule/SIGNER.crt
> > @@ -0,0 +1,19 @@
> > +-----BEGIN CERTIFICATE-----
> > +MIIDDTCCAfWgAwIBAgIUD96z+lSbhDFN76YoIY2LnDBt1yQwDQYJKoZIhvcNAQEL
> > +BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw
> > +NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN
> > +AQEBBQADggEPADCCAQoCggEBAMBuazX28i0y4L0loJYJOtlvF5eWb4tbx7zwei5c
> > +KoSzQYixinS10OrVy7y8mELyXOlGOOsM509vzvoia0nffwEPsvTBeS3le2JBz9iN
> > +/+AIo+gUmzgEPQN+jp+s4fi0yzRvq3BgWu1ego2gExxQ7AePQHoSkX8UeC3Kb7SF
> > +a8Kt/TopOupZfEuZ+EtoxPA4JUStFgEUEcRJEfpQqECXV+lKqcyqHc2ZUzMisu+i
> > +5omkneX8sEZdIPFsSGanCyY3F9VjWzIxo60PU2xUBOIcEUg5luR+VXT4090g/yCw
> > +8PSf9rIKgGIQSQKAlUSc7zuXQIdgIMTS1xUpc/Nx+SqWNZECAwEAAaNTMFEwHQYD
> > +VR0OBBYEFHndZVpPrAjc3OD3UZ3xkXQqDOlZMB8GA1UdIwQYMBaAFHndZVpPrAjc
> > +3OD3UZ3xkXQqDOlZMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
> > +AG88t6w0qTXE50ltps62f6wtuuZsiX1zj+AluO4E8E3Wi0QsNtT24JdY2P4mAg8y
> > +abYLdgJIldzzsfjWWok9Dfqnx29tqgesKWkgUo16v70i4EVZ9YWGe+CfOK639OxL
> > +4D0XPcU5CUpDrEcnt59wCxQ7IArZzrDxrqigEw5nReejtgQV/mEzvVOzWjLjmngy
> > +SpvrydxYpfSvOJ3KGV9xw3Oa/qO3pS0ZNX9QqZdcC94M0SI6OF635oxJkz6JToYq
> > ++qtv9PZtZnEU/cwzL0nTXMj7yRsP5+2Wre26yT62nKRy9P/3UFwmsJ0OuEmnol5I
> > +141ZGfBYmSQ6EReOwNeK7A0=
> > +-----END CERTIFICATE-----
> > diff --git a/test/py/tests/test_efi_capsule/SIGNER.esl b/test/py/tests/test_efi_capsule/SIGNER.esl
> > new file mode 100644
> > index 0000000000000000000000000000000000000000..a54536e243d274b74985abbecfe234d14013ef33
> > GIT binary patch
> > literal 829
> > zcmZ1&d0^?2Da*aux2_hA(f&|m%gg`<iclKDgOCPI%)ACoj9(WpGchtTiSXas{3~R3
> > zi=prPWg3dT-E$0bud5jFvT<s)d9;1!Wn|=LWiSvk6fqEDV-96u=HU);4GxJ9_H_4i
> > z4Kk1u=QT1kFgG$YurM_?G>rmsjgYuF^))dnAzQ)7%D~*j$j<<D6&F(zBO}9sylm5N
> > zpLC5L>{VSbjnnF8zWDTM`Q6dS_k5_*i_vP??AWoft7PkiS65H(*)zlGQ_M>@i`P8Q
> > z{qxWLQp)zcU(d+D>C3@N-KW(_j^}Um{(r!+_=U)93l>}Ey1w~q9{$*J+9ZE<K|<8q
> > zxTf9(!ZHDG*!vx-geKODROp_{-_n|WXzgDsO{-UtHQqCScxN2>V4>==R*X?Z@QA12
> > zuYeT})5BkStvs_z_Uz1HW2H^+7d`7-GWY494Q{atA9Fm?mUF9_i(gHSHZokimOnTr
> > zgyoTppoitOCv~AEKQ7-@_^+_x!<YHrHgPp133xI!Om&&_-g>%2dxFA|OV>p;i$53s
> > z)S6~Gk%^g+fpKxLL7;&wFw|xFSj1RFD(|L7`LE%)bLYYLz_}kMmT2+3j5Lr3Nh`BR
> > z7>G4sSHKTaAk4`4pM}+c8Au@qJ1}N}!OqB#Z?k=k$x72B&pmUOo!eHwMt9e<oX*<f
> > z{s*c%-m!e}z1HobV|L}+gXs}B{;4tX8)a_eE@SeTdgt@TAJ?KfZFzq!Kc1hvihYe{
> > zrb19})&9Lo4_qU^wzgG2m~XLe`<FM~4{XJ4k6LniIj?b7-#)*9Tf|y{>*l!)AJ?r|
> > zAk3HU`h4*=7SVr+#(RS|M;SeyRbk{c`}N5?5lg?Ux0riMGQRL|@vMJ~w=dO|G_4O<
> > zIX#B^9?wN3D~q`8&w4y3+jaW2Y5iKA|K(e5TA|3_GsgO!mt#)+J}J%r{Oz>0Z+D%v
> > r+csxO(U<?<17g%R%;nqRxqMNa$MxPw$qx}TRjdTX`wm?1dcz9<2x(B#
> >
> > literal 0
> > HcmV?d00001
> >
> > diff --git a/test/py/tests/test_efi_capsule/SIGNER.key b/test/py/tests/test_efi_capsule/SIGNER.key
> > new file mode 100644
> > index 000000000000..9952647ed74a
> > --- /dev/null
> > +++ b/test/py/tests/test_efi_capsule/SIGNER.key
> > @@ -0,0 +1,28 @@
> > +-----BEGIN PRIVATE KEY-----
> > +MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQDAbms19vItMuC9
> > +JaCWCTrZbxeXlm+LW8e88HouXCqEs0GIsYp0tdDq1cu8vJhC8lzpRjjrDOdPb876
> > +ImtJ338BD7L0wXkt5XtiQc/Yjf/gCKPoFJs4BD0Dfo6frOH4tMs0b6twYFrtXoKN
> > +oBMcUOwHj0B6EpF/FHgtym+0hWvCrf06KTrqWXxLmfhLaMTwOCVErRYBFBHESRH6
> > +UKhAl1fpSqnMqh3NmVMzIrLvouaJpJ3l/LBGXSDxbEhmpwsmNxfVY1syMaOtD1Ns
> > +VATiHBFIOZbkflV0+NPdIP8gsPD0n/ayCoBiEEkCgJVEnO87l0CHYCDE0tcVKXPz
> > +cfkqljWRAgMBAAECggEAItLYrAdohC105kXs7bn14GtuRYx/2yRc3SBXvBQJzcHy
> > +1h3rBHvytszB9gHbPCJIFh8TJdZL9eAyAKpB6Dh9718773cjyt6AmaN3TaVE7PIj
> > +V1iDTnvV3tAEV3kd27g8Hd0nlUqaqeI0lhSl4LX0QNn3vR+nHOxDY2YDGRQcEDrD
> > +4hlCIGzAfbCW9gINdadQnC6p9NEBbfJ18doCagdn1Q1UYs8YlWwhBK98wXKGsG6T
> > +TUywOWIe6+VJqzSwZn5YkDVD3qD4tToar7T0jrCvZjbTbOsjtinD70c3uBcrK/XN
> > +gpwJfTiDLo1d0tNoWCRUH0myMs1fq3H3SkdfqB1GwQKBgQDrw8FwUc3Q+j8YhR7i
> > +73H/osk3VOZhCPsqbrQThUo5ZV4EXqp9E3PLN5E3suWgfaXVCEI3lHARUyR+J+E/
> > +evIrUUnkIryLdVOwwEWRonW4cLANjLSzT0eA85CFLXKUaij7Jfon2YNs9CmUARnC
> > +M96T3a89XOezX/SbRVz6X8KslQKBgQDQ8onkHcscHMANIjgxycIgYF+MvxwHRICA
> > +nt3ZSQiGSXJbWK7/sM5yd16ulvsXL7aF9G+q5osOzDWJ0w4SOhqNDfItrFH34Px6
> > +qEPjq/sAigqqrQls7uu7MHfkE+eEy181CoT9argxo8ifAQDn4YtXBW6L7p6AgaAx
> > +83FAbBcqDQKBgQClHk185534zTqhZqIyF7bEbfL0sJ5EuXCG0E+IGGLafdbxwocu
> > +4A/J9Jnc44sU8srQv1745Bn02EEHpdCIkAfJNL5Ga9mW5k39zTsr+xbtXObAJppr
> > +touCkZLW4vSLYypecsOXYyw7g2kXQgoTTBaHgsv3cvjHVN3QXSz4IVcLXQJ/LBL9
> > +AyFFtqhZ2mtdbyMfz7SEcyvcvau1b2wTX8IICktz09DhGQ4yffKwBiPS0xE9bwQg
> > +iewXaQeqQ2hBj5ayAw7uBrRSlfbfSwAzUdL1Hyf/GAFn+5JqJxISOAn6zAgaDRYq
> > +90mLkOz7ZI7RohfxTGnY56ttw62UHPU87lneiQKBgHcVituUDJgmbaHXx2IVzKsm
> > +5uDyXUf4S+tY5CZj6WTsb70+q4PYfh1D02nZgxuLNwpwNI0uhLIkLYHcL3poOapC
> > +LCXS8tsexNosmrTmjHFh/uNdKb7bKbMxyzYrr+ADKMclF3CJzKDzLfiIe9Na+bWa
> > +q5/HYNIw5zJyapPksgr4
> > +-----END PRIVATE KEY-----
> > diff --git a/test/py/tests/test_efi_capsule/SIGNER2.crt b/test/py/tests/test_efi_capsule/SIGNER2.crt
> > new file mode 100644
> > index 000000000000..8889a3ed930a
> > --- /dev/null
> > +++ b/test/py/tests/test_efi_capsule/SIGNER2.crt
> > @@ -0,0 +1,19 @@
> > +-----BEGIN CERTIFICATE-----
> > +MIIDDTCCAfWgAwIBAgIUfmZcui7VkJEe9jx25Epo6jJ6l+owDQYJKoZIhvcNAQEL
> > +BQAwFjEUMBIGA1UEAwwLVEVTVF9TSUdORVIwHhcNMjEwNzI2MDg1MzE1WhcNMjIw
> > +NzI2MDg1MzE1WjAWMRQwEgYDVQQDDAtURVNUX1NJR05FUjCCASIwDQYJKoZIhvcN
> > +AQEBBQADggEPADCCAQoCggEBANozXTFKGVx0121MIBoSgxfI8IHcfY32T/LQusse
> > +PaXsm0GaJNwOgEP34u1k0cz466swfBCqTcZRjKuDpcH1sgrF1XaKjxuwYuiJrbsf
> > +ykVesN1z1bIamkFdVR/CBJEwN/epsyCBQCSbcxUwEX+ayq2zp+kSweew1B4i3u8f
> > +nbqFB15Rt+KAzFaBlvOJhmoZP7uYtb8zHa58eteaxQmPFt3v6eEbgOt92oVB8fPQ
> > +JJBuxUAHdimMDQ9mBGUosXR8PFyma5jOiOyY+0oTfig4bRHbGxCGMYyABJDH+j4e
> > +7Zl7lVMsq2fTm/lGONRX2QPLfMO298pz/wundJmYhseibvUCAwEAAaNTMFEwHQYD
> > +VR0OBBYEFDPYxE3oBmU1pWrZpY62JuXgcK5aMB8GA1UdIwQYMBaAFDPYxE3oBmU1
> > +pWrZpY62JuXgcK5aMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
> > +AEtY9QnvTvgmXmep7AMv/T6+GpERvsRdi+Lc+16L7uSCQhouDkeu5/sUHax6icX1
> > +NyDb3u6tyQhMnm7CD+7Mo74wrZ4vK2SzBoZSBLi+Tyz2ScyysdRIo7O42nxVyWm7
> > +ifZVfQKvanUjDSxPO89yJDYp0znvVpuZOzYXFHdprHoR5Atkth11HFHzWDzqblKS
> > +sx145wgPZ9bYohuOn1weyORsG9bJcHznPyJ1ceAOFk40bKWWLQtruWIhY4aZIlJN
> > +cDKv92rtgVApaamu+WRC4pzgQMQYKOcnMz4ZKeOKgEajfo6nOUVrvc0IYO6wixvi
> > +V+Msrg5o7ag2SN2AHg5/1/4=
> > +-----END CERTIFICATE-----
> > diff --git a/test/py/tests/test_efi_capsule/SIGNER2.key b/test/py/tests/test_efi_capsule/SIGNER2.key
> > new file mode 100644
> > index 000000000000..ee467fd9f7a6
> > --- /dev/null
> > +++ b/test/py/tests/test_efi_capsule/SIGNER2.key
> > @@ -0,0 +1,28 @@
> > +-----BEGIN PRIVATE KEY-----
> > +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDaM10xShlcdNdt
> > +TCAaEoMXyPCB3H2N9k/y0LrLHj2l7JtBmiTcDoBD9+LtZNHM+OurMHwQqk3GUYyr
> > +g6XB9bIKxdV2io8bsGLoia27H8pFXrDdc9WyGppBXVUfwgSRMDf3qbMggUAkm3MV
> > +MBF/msqts6fpEsHnsNQeIt7vH526hQdeUbfigMxWgZbziYZqGT+7mLW/Mx2ufHrX
> > +msUJjxbd7+nhG4DrfdqFQfHz0CSQbsVAB3YpjA0PZgRlKLF0fDxcpmuYzojsmPtK
> > +E34oOG0R2xsQhjGMgASQx/o+Hu2Ze5VTLKtn05v5RjjUV9kDy3zDtvfKc/8Lp3SZ
> > +mIbHom71AgMBAAECggEBAJXskO3bAg364kJg+fWwHo7rLAWuYD54rXojXRVPFAC7
> > +z/mFVio1dIA/BJcknNr/db5MNBKnUYUgZ005yVy52rl4MTGgBrB5w5wPbWWTdEGx
> > +zEh83KnhiXe8D08g2k6AGRR8b224IUCF5s76FivdScGMHaURlFYDs9t5DkCzMocC
> > +ty0ewHv9aeMSzJl4y+DrRw+NkkAntlAkerCI5PInFtxyOQ6lFIRkMKlBA//VL0QF
> > +B9yGbmfoxlErWCqnj70DTcVO7O2AaijU+FTMRbb/V7r34GPU0Cfeum6gGNOtDkaX
> > +3UnWGR2esiHViMqz8vvEYtVIxHhLTD7INqDlK/yiNEECgYEA+ua1JcHXI2qS3cV/
> > +BuVvBrd3MzIpZvddCcTdo/B7WT3EoTupEG1gcajrCuNQDtRoizSbMuhCXYoMsktF
> > +wXFoTWoGr8yO7uVU5r2nCXZneprV3kuQmR0qYipN2GTCGSE1rKQI+YXeALPF1qIp
> > +12vUVdzWVDJvlQRMvSTlzpRZQkkCgYEA3qKI1ZsBszKPbnzLX91+ZAZeAwwN/HvS
> > +nrIveJAci/9U2yV2mw3l/Dulc8EkGABs/cMp47toje8DmsSfdu1yIYqpi3MHvefX
> > ++ijc3ry5v28Hia3WP3WPczqhbkT7cco0t8Vwm9w1B+kkreuRCtyoCOLsRauB0CH1
> > +QJjMtPAth00CgYAKUUhruA/nxe8qLX/uwaqSJSNCuLJZKJzr1OukXTRFVDPsyW5H
> > +XagUpHSd6wEUywlNiClFq6VnAVFKV6wTq101qcGCoy/RhR67qlrfGb5hnVJkJMla
> > +coeWp9SxrFsK+4GgitJPqICbmMju7ZY45JdDvKQXrEdIYnfhY04L86/D+QKBgBxx
> > +nZPU0vnHCuYt0Xn0/XHgEmDHSH4qf7VAxKndl5gXTgsVlTqoIur/39qTIX5jh4lA
> > +RvjOd8Qydj5uwoTaP0ujwJeNYb7UgRZ35AgdCoo3sDnZ2NaQuXwaUIebDpjyIZwd
> > +AI8ZKjlRgxspToWZvWotO8yG5fXmcMQJAZZYXSi9AoGBALfXX/C5ojwms1l+XP+p
> > +FKzOFZ/uEKPfQid+2Sm1BknXXGVbs3zJ4OdonTvhjq+VQvXTW4IvjgY8TpumQZvE
> > +8nb7I8E1B6ajkSvgfetN9jlKM5hzIfJ3Vxx6hMGMab1ySKy3rZGPL706CW2BeMI2
> > +v2k9P0qWItuE4S7I4hEsovwS
> > +-----END PRIVATE KEY-----
> > diff --git a/test/py/tests/test_efi_capsule/capsule_defs.py b/test/py/tests/test_efi_capsule/capsule_defs.py
> > index 4fd6353c2040..aa9bf5eee3aa 100644
> > --- a/test/py/tests/test_efi_capsule/capsule_defs.py
> > +++ b/test/py/tests/test_efi_capsule/capsule_defs.py
> > @@ -3,3 +3,8 @@
> > # Directories
> > CAPSULE_DATA_DIR = '/EFI/CapsuleTestData'
> > CAPSULE_INSTALL_DIR = '/EFI/UpdateCapsule'
> > +
> > +# v1.5.1 or earlier of efitools has a bug in sha256 calculation, and
> > +# you need build a newer version on your own.
> > +# The path must terminate with '/'.
> > +EFITOOLS_PATH = ''
> > diff --git a/test/py/tests/test_efi_capsule/conftest.py b/test/py/tests/test_efi_capsule/conftest.py
> > index 6ad5608cd71c..35cfa5513703 100644
> > --- a/test/py/tests/test_efi_capsule/conftest.py
> > +++ b/test/py/tests/test_efi_capsule/conftest.py
> > @@ -10,13 +10,13 @@ import pytest
> > from capsule_defs import *
> >
> > #
> > -# Fixture for UEFI secure boot test
> > +# Fixture for UEFI capsule test
> > #
> >
> > -
> > @pytest.fixture(scope='session')
> > def efi_capsule_data(request, u_boot_config):
> > - """Set up a file system to be used in UEFI capsule test.
> > + """Set up a file system to be used in UEFI capsule and
> > + authentication test.
> >
> > Args:
> > request: Pytest request object.
> > @@ -40,6 +40,22 @@ def efi_capsule_data(request, u_boot_config):
> > check_call('mkdir -p %s' % data_dir, shell=True)
> > check_call('mkdir -p %s' % install_dir, shell=True)
> >
> > + capsule_auth_enabled = u_boot_config.buildconfig.get(
> > + 'config_efi_capsule_authenticate')
> > + # NOTE:
> > + # private keys (SIGNER?.key) dn certificates (SIGNER?.crt)
> > + # in this pytest directory are created this way:
> > + # Create private key (SIGNER.key) and certificate (SIGNER.crt)
> > + # check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER.key -out SIGNER.crt -nodes -days 365'
> > + # % data_dir, shell=True)
> > + # check_call('cd %s; %scert-to-efi-sig-list SIGNER.crt SIGNER.esl'
> > + # % (data_dir, EFITOOLS_PATH), shell=True)
> > +
> > + # Create *malicious* private key (SIGNER2.key) and certificate
> > + # (SIGNER2.crt)
> > + # check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_SIGNER/ -keyout SIGNER2.key -out SIGNER2.crt -nodes -days 365'
> > + # % data_dir, shell=True)
> > +
> > # Create capsule files
> > # two regions: one for u-boot.bin and the other for u-boot.env
> > check_call('cd %s; echo -n u-boot:Old > u-boot.bin.old; echo -n u-boot:New > u-boot.bin.new; echo -n u-boot-env:Old -> u-boot.env.old; echo -n u-boot-env:New > u-boot.env.new' % data_dir,
> > @@ -56,6 +72,19 @@ def efi_capsule_data(request, u_boot_config):
> > check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 Test02' %
> > (data_dir, u_boot_config.build_dir),
> > shell=True)
> > + if capsule_auth_enabled:
> > + # copy keys/certificates
> > + check_call('cp %s/test/py/tests/test_efi_capsule/SIGNER*.* %s' %
> > + (u_boot_config.source_dir, data_dir),
> > + shell=True)
> > + # firmware signed with proper key
> > + check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER.key --certificate SIGNER.crt Test03' %
> > + (data_dir, u_boot_config.build_dir),
> > + shell=True)
> > + # firmware signed with *mal* key
> > + check_call('cd %s; %s/tools/mkeficapsule --raw u-boot.bin.new --index 1 --monotonic-count 1 --private-key SIGNER2.key --certificate SIGNER2.crt Test04' %
> > + (data_dir, u_boot_config.build_dir),
> > + shell=True)
> >
> > # Create a disk image with EFI system partition
> > check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat %s %s' %
> > diff --git a/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py
> > new file mode 100644
> > index 000000000000..8fe93ef424ac
> > --- /dev/null
> > +++ b/test/py/tests/test_efi_capsule/test_capsule_firmware_signed.py
> > @@ -0,0 +1,228 @@
> > +# SPDX-License-Identifier: GPL-2.0+
> > +# Copyright (c) 2021, Linaro Limited
> > +# Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
> > +#
> > +# U-Boot UEFI: Firmware Update (Signed capsule) Test
> > +
> > +"""
> > +This test verifies capsule-on-disk firmware update
> > +with signed capsule files
> > +"""
> > +
> > +from subprocess import check_call, check_output, CalledProcessError
> > +import pytest
> > +from capsule_defs import *
> > +
> > +@pytest.mark.boardspec('sandbox')
> > +@pytest.mark.buildconfigspec('efi_capsule_firmware_raw')
> > +@pytest.mark.buildconfigspec('efi_capsule_authenticate')
> > +@pytest.mark.buildconfigspec('dfu')
> > +@pytest.mark.buildconfigspec('dfu_sf')
> > +@pytest.mark.buildconfigspec('cmd_efidebug')
> > +@pytest.mark.buildconfigspec('cmd_fat')
> > +@pytest.mark.buildconfigspec('cmd_memory')
> > +@pytest.mark.buildconfigspec('cmd_nvedit_efi')
> > +@pytest.mark.buildconfigspec('cmd_sf')
> > +@pytest.mark.slow
> > +class TestEfiCapsuleFirmwareSigned(object):
> > + def test_efi_capsule_auth1(
> > + self, u_boot_config, u_boot_console, efi_capsule_data):
> > + """
> > + Test Case 1 - Update U-Boot on SPI Flash, raw image format
> > + 0x100000-0x150000: U-Boot binary (but dummy)
> > +
> > + If the capsule is properly signed, the authentication
> > + should pass and the firmware be updated.
> > + """
> > + disk_img = efi_capsule_data
> > + with u_boot_console.log.section('Test Case 1-a, before reboot'):
> > + output = u_boot_console.run_command_list([
> > + 'host bind 0 %s' % disk_img,
> > + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi',
> > + 'efidebug boot order 1',
> > + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
> > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
> > + 'env save'])
> > +
> > + # initialize content
> > + output = u_boot_console.run_command_list([
> > + 'sf probe 0:0',
> > + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR,
> > + 'sf write 4000000 100000 10',
> > + 'sf read 5000000 100000 10',
> > + 'md.b 5000000 10'])
> > + assert 'Old' in ''.join(output)
> > +
> > + # place a capsule file
> > + output = u_boot_console.run_command_list([
> > + 'fatload host 0:1 4000000 %s/Test03' % CAPSULE_DATA_DIR,
> > + 'fatwrite host 0:1 4000000 %s/Test03 $filesize' % CAPSULE_INSTALL_DIR,
> > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
> > + assert 'Test03' in ''.join(output)
> > +
> > + # reboot
> > + u_boot_console.restart_uboot()
> > +
> > + capsule_early = u_boot_config.buildconfig.get(
> > + 'config_efi_capsule_on_disk_early')
> > + with u_boot_console.log.section('Test Case 1-b, after reboot'):
> > + if not capsule_early:
> > + # make sure that dfu_alt_info exists even persistent variables
> > + # are not available.
> > + output = u_boot_console.run_command_list([
> > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
> > + 'host bind 0 %s' % disk_img,
> > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
> > + assert 'Test03' in ''.join(output)
> > +
> > + # need to run uefi command to initiate capsule handling
> > + output = u_boot_console.run_command(
> > + 'env print -e Capsule0000')
> > +
> > + output = u_boot_console.run_command_list([
> > + 'host bind 0 %s' % disk_img,
> > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
> > + assert 'Test03' not in ''.join(output)
> > +
> > + output = u_boot_console.run_command_list([
> > + 'sf probe 0:0',
> > + 'sf read 4000000 100000 10',
> > + 'md.b 4000000 10'])
> > + assert 'u-boot:New' in ''.join(output)
> > +
> > + def test_efi_capsule_auth2(
> > + self, u_boot_config, u_boot_console, efi_capsule_data):
> > + """
> > + Test Case 2 - Update U-Boot on SPI Flash, raw image format
> > + 0x100000-0x150000: U-Boot binary (but dummy)
> > +
> > + If the capsule is signed but with an invalid key,
> > + the authentication should fail and the firmware
> > + not be updated.
> > + """
> > + disk_img = efi_capsule_data
> > + with u_boot_console.log.section('Test Case 2-a, before reboot'):
> > + output = u_boot_console.run_command_list([
> > + 'host bind 0 %s' % disk_img,
> > + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi',
> > + 'efidebug boot order 1',
> > + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
> > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
> > + 'env save'])
> > +
> > + # initialize content
> > + output = u_boot_console.run_command_list([
> > + 'sf probe 0:0',
> > + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR,
> > + 'sf write 4000000 100000 10',
> > + 'sf read 5000000 100000 10',
> > + 'md.b 5000000 10'])
> > + assert 'Old' in ''.join(output)
> > +
> > + # place a capsule file
> > + output = u_boot_console.run_command_list([
> > + 'fatload host 0:1 4000000 %s/Test04' % CAPSULE_DATA_DIR,
> > + 'fatwrite host 0:1 4000000 %s/Test04 $filesize' % CAPSULE_INSTALL_DIR,
> > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
> > + assert 'Test04' in ''.join(output)
> > +
> > + # reboot
> > + u_boot_console.restart_uboot()
> > +
> > + capsule_early = u_boot_config.buildconfig.get(
> > + 'config_efi_capsule_on_disk_early')
> > + with u_boot_console.log.section('Test Case 2-b, after reboot'):
> > + if not capsule_early:
> > + # make sure that dfu_alt_info exists even persistent variables
> > + # are not available.
> > + output = u_boot_console.run_command_list([
> > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
> > + 'host bind 0 %s' % disk_img,
> > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
> > + assert 'Test04' in ''.join(output)
> > +
> > + # need to run uefi command to initiate capsule handling
> > + output = u_boot_console.run_command(
> > + 'env print -e Capsule0000')
> > +
> > + # deleted any way
> > + output = u_boot_console.run_command_list([
> > + 'host bind 0 %s' % disk_img,
> > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
> > + assert 'Test04' not in ''.join(output)
> > +
> > + # TODO: check CapsuleStatus in CapsuleXXXX
> > +
> > + output = u_boot_console.run_command_list([
> > + 'sf probe 0:0',
> > + 'sf read 4000000 100000 10',
> > + 'md.b 4000000 10'])
> > + assert 'u-boot:Old' in ''.join(output)
> > +
> > + def test_efi_capsule_auth3(
> > + self, u_boot_config, u_boot_console, efi_capsule_data):
> > + """
> > + Test Case 3 - Update U-Boot on SPI Flash, raw image format
> > + 0x100000-0x150000: U-Boot binary (but dummy)
> > +
> > + If the capsule is not signed, the authentication
> > + should fail and the firmware not be updated.
> > + """
> > + disk_img = efi_capsule_data
> > + with u_boot_console.log.section('Test Case 3-a, before reboot'):
> > + output = u_boot_console.run_command_list([
> > + 'host bind 0 %s' % disk_img,
> > + 'efidebug boot add -b 1 TEST host 0:1 /helloworld.efi',
> > + 'efidebug boot order 1',
> > + 'env set -e -nv -bs -rt OsIndications =0x0000000000000004',
> > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
> > + 'env save'])
> > +
> > + # initialize content
> > + output = u_boot_console.run_command_list([
> > + 'sf probe 0:0',
> > + 'fatload host 0:1 4000000 %s/u-boot.bin.old' % CAPSULE_DATA_DIR,
> > + 'sf write 4000000 100000 10',
> > + 'sf read 5000000 100000 10',
> > + 'md.b 5000000 10'])
> > + assert 'Old' in ''.join(output)
> > +
> > + # place a capsule file
> > + output = u_boot_console.run_command_list([
> > + 'fatload host 0:1 4000000 %s/Test02' % CAPSULE_DATA_DIR,
> > + 'fatwrite host 0:1 4000000 %s/Test02 $filesize' % CAPSULE_INSTALL_DIR,
> > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
> > + assert 'Test02' in ''.join(output)
> > +
> > + # reboot
> > + u_boot_console.restart_uboot()
> > +
> > + capsule_early = u_boot_config.buildconfig.get(
> > + 'config_efi_capsule_on_disk_early')
> > + with u_boot_console.log.section('Test Case 3-b, after reboot'):
> > + if not capsule_early:
> > + # make sure that dfu_alt_info exists even persistent variables
> > + # are not available.
> > + output = u_boot_console.run_command_list([
> > + 'env set dfu_alt_info "sf 0:0=u-boot-bin raw 0x100000 0x50000;u-boot-env raw 0x150000 0x200000"',
> > + 'host bind 0 %s' % disk_img,
> > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
> > + assert 'Test02' in ''.join(output)
> > +
> > + # need to run uefi command to initiate capsule handling
> > + output = u_boot_console.run_command(
> > + 'env print -e Capsule0000')
> > +
> > + # deleted any way
> > + output = u_boot_console.run_command_list([
> > + 'host bind 0 %s' % disk_img,
> > + 'fatls host 0:1 %s' % CAPSULE_INSTALL_DIR])
> > + assert 'Test02' not in ''.join(output)
> > +
> > + # TODO: check CapsuleStatus in CapsuleXXXX
> > +
> > + output = u_boot_console.run_command_list([
> > + 'sf probe 0:0',
> > + 'sf read 4000000 100000 10',
> > + 'md.b 4000000 10'])
> > + assert 'u-boot:Old' in ''.join(output)
> >
>
next prev parent reply other threads:[~2021-08-02 4:02 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-27 9:10 [PATCH v2 0/9] efi_loader: capsule: improve capsule authentication support AKASHI Takahiro
2021-07-27 9:10 ` [PATCH v2 1/9] tools: mkeficapsule: add firmwware image signing AKASHI Takahiro
2021-07-28 8:12 ` Masami Hiramatsu
2021-08-01 9:21 ` Heinrich Schuchardt
2021-08-02 3:30 ` AKASHI Takahiro
2021-08-02 6:18 ` Heinrich Schuchardt
2021-08-02 6:55 ` AKASHI Takahiro
2021-07-27 9:10 ` [PATCH v2 2/9] tools: mkeficapsule: add man page AKASHI Takahiro
2021-08-01 9:28 ` Heinrich Schuchardt
2021-07-27 9:10 ` [PATCH v2 3/9] doc: update UEFI document for usage of mkeficapsule AKASHI Takahiro
2021-08-01 9:31 ` Heinrich Schuchardt
2021-07-27 9:10 ` [PATCH v2 4/9] efi_loader: ease the file path check for public key AKASHI Takahiro
2021-08-01 9:35 ` Heinrich Schuchardt
2021-08-02 4:50 ` AKASHI Takahiro
2021-07-27 9:10 ` [PATCH v2 5/9] test/py: efi_capsule: add image authentication test AKASHI Takahiro
2021-08-01 9:38 ` Heinrich Schuchardt
2021-08-02 4:02 ` AKASHI Takahiro [this message]
2021-07-27 9:10 ` [PATCH v2 6/9] sandbox: add config for efi capsule " AKASHI Takahiro
2021-07-28 20:21 ` Heinrich Schuchardt
2021-07-29 0:39 ` AKASHI Takahiro
2021-07-31 16:59 ` Simon Glass
2021-08-01 4:29 ` AKASHI Takahiro
2021-08-01 19:00 ` Simon Glass
2021-08-01 22:57 ` AKASHI Takahiro
2021-08-02 19:19 ` Simon Glass
2021-07-27 9:10 ` [PATCH v2 7/9] GitLab: add a test rule " AKASHI Takahiro
2021-07-27 9:10 ` [PATCH v2 8/9] tools: mkeficapsule: allow for specifying GUID explicitly AKASHI Takahiro
2021-07-27 9:10 ` [PATCH v2 9/9] test/py: efi_capsule: align with the syntax change of mkeficapsule AKASHI Takahiro
2021-08-01 9:40 ` [PATCH v2 0/9] efi_loader: capsule: improve capsule authentication support Heinrich Schuchardt
2021-08-02 5:00 ` AKASHI Takahiro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210802040236.GC7965@laputa \
--to=takahiro.akashi@linaro.org \
--cc=agraf@csgraf.de \
--cc=ilias.apalodimas@linaro.org \
--cc=masami.hiramatsu@linaro.org \
--cc=sjg@chromium.org \
--cc=sughosh.ganu@linaro.org \
--cc=trini@konsulko.com \
--cc=u-boot@lists.denx.de \
--cc=xypron.glpk@gmx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.