Re: [RFC PATCH 2/2] test/py: efi_secboot: adjust secure boot tests to code changes

Ilias Apalodimas
2022-02-10T07:15:10Z

Akashi-san

On Thu, 10 Feb 2022 at 07:22, AKASHI Takahiro
<takahiro.akashi@linaro.org> wrote:
>
> On Fri, Feb 04, 2022 at 09:32:02AM +0200, Ilias Apalodimas wrote:
> > The previous patch is changing U-Boot's behavior wrt certificate based
> > binary authentication. Specifically an image who's digest of a
> > certificate is found in dbx is now rejected. Fix the test accordingly
>
> Please not only fix the given test case, but also add more cases
> if needed or appropriate for wider coverage of corner cases.
> You mentioned in the previous commit that the order of certificates
> should not affect the verification result.
> If so, we need, at least, one more test case where the order of certificates
> in db is different.
>
> I think that trying to maintain the test scenario that way will help improve
> the robustness of verification logic.

And we agree, but my concern right now is fix the existing use cases.
There are some SCT tests wrt certification of binaries, so I intend
to port more cases for those in the future.

Cheers
/Ilias
>
> -Takahiro Akashi
>
>
> > Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
> > ---
> > test/py/tests/test_efi_secboot/test_signed.py | 5 +++--
> > 1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/test/py/tests/test_efi_secboot/test_signed.py b/test/py/tests/test_efi_secboot/test_signed.py
> > index 0aee34479f55..7f5ec78261da 100644
> > --- a/test/py/tests/test_efi_secboot/test_signed.py
> > +++ b/test/py/tests/test_efi_secboot/test_signed.py
> > @@ -186,7 +186,7 @@ class TestEfiSignedImage(object):
> > assert 'Hello, world!' in ''.join(output)
> >
> > with u_boot_console.log.section('Test Case 5c'):
> > - # Test Case 5c, not rejected if one of signatures (digest of
> > + # Test Case 5c, rejected if one of signatures (digest of
> > # certificate) is revoked
> > output = u_boot_console.run_command_list([
> > 'fatload host 0:1 4000000 dbx_hash.auth',
> > @@ -195,7 +195,8 @@ class TestEfiSignedImage(object):
> > output = u_boot_console.run_command_list([
> > 'efidebug boot next 1',
> > 'efidebug test bootmgr'])
> > - assert 'Hello, world!' in ''.join(output)
> > + assert '\'HELLO\' failed' in ''.join(output)
> > + assert 'efi_start_image() returned: 26' in ''.join(output)
> >
> > with u_boot_console.log.section('Test Case 5d'):
> > # Test Case 5d, rejected if both of signatures are revoked
> > --
> > 2.32.0
> >