From patchwork Fri Feb 4 07:32:01 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 539860 Delivered-To: patch@linaro.org Received: by 2002:ac0:f7d2:0:0:0:0:0 with SMTP id i18csp3035721imr; Thu, 3 Feb 2022 23:32:17 -0800 (PST) X-Google-Smtp-Source: ABdhPJy3Y1N2egrebNOwwaRE3oCniPWTzJotr7JJQfbRUHwwjaTfg0ci/KAez0vN3vcG22XARd85 X-Received: by 2002:a17:907:a422:: with SMTP id sg34mr1396288ejc.221.1643959937782; Thu, 03 Feb 2022 23:32:17 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1643959937; cv=none; d=google.com; s=arc-20160816; b=0TTh2Ne4Kb4bclqvYQDXPTTJLuH0eTZZSoQ9SnfrzQrDBWaoL9tE4CJx7HyfsL8x6k P+EZalz86DUMYkQ4Whc97ioT4usf+ae3zQ6tQJKuELAPiZSdbRjyBuA6wFj+KR3A3U04 yzuBpJrTxBE4sZ83AmHmL+hOpFhb7oXnfi/b40huek2emgRjyADhumdqH+Q868WSBL1w oitw2lz0541Ixn8p5xdAU/L6JRO3GhGDNHZrf0m6vhsDHaEkrMcqCeb6ze9K2gn5JidR ZbqAk6mNsE+U/w1wTmcEnAobyjA0V92JJ4knlXUHz09oZh7e6jgGd9qOibapWJgajZmG MAfQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:message-id:date:subject:cc:to:from:dkim-signature; bh=v2dwXLOTo49w8L/BtXHABdAAuLkyD8bI6NjAYzZA1u0=; b=vrpmJN+DJJ85zrBL9V5AdmMQ1UGmjJIEr8+zGCauJliEgtnIkNxdwAP0gf0a/Mb2CO OLXc1C+UhKZPF10x1XKtMd4sBoE2Y8I91lG6ljCmc2HVRnPQ71QAcJed2+gPE/QKakOF WgrSaRWShxLCGEyS2RbbUUMNU9WsBCoe7W5k3RDaYsQxwlbf4EvYT4piWHaCvVMGceoT yVXXpRjZLXbw/jMncKf0D9eWsDmk7uEPs5es96xXkaQA7EYjp6mJowR7fLRXlewzKRKy ysCSAdGsJVpUSzRalbw04k4zSMXJehX60D7GahnhkLc6lOX7tFj2npg0F1WqbnHBGXuo 4zfw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=cbWkngCB; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id dd7si817635ejc.993.2022.02.03.23.32.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Feb 2022 23:32:17 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=cbWkngCB; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 7830483A49; Fri, 4 Feb 2022 08:32:15 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="cbWkngCB"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id B8E1783A51; Fri, 4 Feb 2022 08:32:09 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ed1-x535.google.com (mail-ed1-x535.google.com [IPv6:2a00:1450:4864:20::535]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 4122882A6C for ; Fri, 4 Feb 2022 08:32:06 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ed1-x535.google.com with SMTP id p12so11335348edq.9 for ; Thu, 03 Feb 2022 23:32:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=v2dwXLOTo49w8L/BtXHABdAAuLkyD8bI6NjAYzZA1u0=; b=cbWkngCBFKxwYMSZNgrF/6ng1UlgV7uhTwUAenoCX6NLDMteq86aOBwdsNOkUb1PCU lL7KW1i6p+WXkqxdsFGBzR7Fp+SIANVOpwCZ5gL2r0pcy3RslnBxIEh7838z20hMa5M2 hWWvjJvbgKN91oZLpNcorzbX5q4BlNYgfsRI4VoIe/bjR1l808X42+qJld373yJb3h4v U1idsBfH7ntBG6xbDDAL5dCMKGGJhio/nY0D3DvHr9BfvG7YA5NFop15bHiOB8N7oEvq IsBcpW1V7ipdhT9lgrK6dvD0e70iP3Z1bvBFc0ENgzNZFV0lXbR24qaaCNk6KwK9g6Rn +pxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=v2dwXLOTo49w8L/BtXHABdAAuLkyD8bI6NjAYzZA1u0=; b=Rjv3u6eE0UOnZeR4vz7sVjYy/qlmiix8cUrG1L7Fevf2BLtEQ/OCgAX04aFU9SzBSi wBd/RSMASOn6J6PKMBJ6mCQf5VMPICDO3MjTJ0iAArbY+gLpxR2VagVPbF/7M3WwIEBJ L6kvoa0//MyK/1Nli6WsMEhFKWyrd5ACjO2XAX0Nd0nsAFKwjjJ4S53zoo8W9ZzkiqR1 0hdFtrfIY1sIg8RjkC+v9CjG9ez9WPyGWHoJQ/lDoCWh887er9YBIH3xLe94uhlShcsE 3FVZhQ3U4kv3JXbugsAzsUA9wnxfkKHvvQJMleIfopvM7L+s1DmTDBvlA49EVQyqNz7Y hV3A== X-Gm-Message-State: AOAM531PvF0jjUu8Ae386mqKVLiUm8wsQgP1BVDTK4SbdRi7dcxLcrTy lyy+NJL8Yfs3PX13Vm2vVnNRcg== X-Received: by 2002:a05:6402:d0d:: with SMTP id eb13mr1789851edb.186.1643959925415; Thu, 03 Feb 2022 23:32:05 -0800 (PST) Received: from hades.. ([2a02:587:46a6:e776:3efd:feff:fe6b:c5cb]) by smtp.gmail.com with ESMTPSA id lt12sm359904ejb.166.2022.02.03.23.32.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Feb 2022 23:32:04 -0800 (PST) From: Ilias Apalodimas To: xypron.glpk@gmx.de, takahiro.akashi@linaro.org Cc: Ilias Apalodimas , u-boot@lists.denx.de Subject: [RFC PATCH 1/2] efi_loader: fix dual signed image certification Date: Fri, 4 Feb 2022 09:32:01 +0200 Message-Id: <20220204073202.4141198-1-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean The EFI spec allows for images to carry multiple signatures. Currently we don't adhere to the verification process for such images. The spec says: "Multiple signatures are allowed to exist in the binary's certificate table (as per PE/COFF Section "Attribute Certificate Table"). Only one hash or signature is required to be present in db in order to pass validation, so long as neither the SHA-256 hash of the binary nor any present signature is reflected in dbx." With our current implementation signing the image with two certificates and inserting both of them in db and one of them dbx doesn't always reject the image. The rejection depends on the order that the image was signed and the order the certificates are read (and checked) in db. While at it move the sha256 hash verification outside the signature checking loop, since it only needs to run once per image and get simplify the logic for authenticating an unsigned imahe using sha256 hashes. Signed-off-by: Ilias Apalodimas --- lib/efi_loader/efi_image_loader.c | 88 +++++++------------------------ 1 file changed, 18 insertions(+), 70 deletions(-) diff --git a/lib/efi_loader/efi_image_loader.c b/lib/efi_loader/efi_image_loader.c index f41cfa4fccd5..5df35939f702 100644 --- a/lib/efi_loader/efi_image_loader.c +++ b/lib/efi_loader/efi_image_loader.c @@ -516,53 +516,6 @@ err: } #ifdef CONFIG_EFI_SECURE_BOOT -/** - * efi_image_unsigned_authenticate() - authenticate unsigned image with - * SHA256 hash - * @regs: List of regions to be verified - * - * If an image is not signed, it doesn't have a signature. In this case, - * its message digest is calculated and it will be compared with one of - * hash values stored in signature databases. - * - * Return: true if authenticated, false if not - */ -static bool efi_image_unsigned_authenticate(struct efi_image_regions *regs) -{ - struct efi_signature_store *db = NULL, *dbx = NULL; - bool ret = false; - - dbx = efi_sigstore_parse_sigdb(u"dbx"); - if (!dbx) { - EFI_PRINT("Getting signature database(dbx) failed\n"); - goto out; - } - - db = efi_sigstore_parse_sigdb(u"db"); - if (!db) { - EFI_PRINT("Getting signature database(db) failed\n"); - goto out; - } - - /* try black-list first */ - if (efi_signature_lookup_digest(regs, dbx, true)) { - EFI_PRINT("Image is not signed and its digest found in \"dbx\"\n"); - goto out; - } - - /* try white-list */ - if (efi_signature_lookup_digest(regs, db, false)) - ret = true; - else - EFI_PRINT("Image is not signed and its digest not found in \"db\" or \"dbx\"\n"); - -out: - efi_sigstore_free(db); - efi_sigstore_free(dbx); - - return ret; -} - /** * efi_image_authenticate() - verify a signature of signed image * @efi: Pointer to image @@ -608,14 +561,7 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) if (!efi_image_parse(new_efi, efi_size, ®s, &wincerts, &wincerts_len)) { EFI_PRINT("Parsing PE executable image failed\n"); - goto err; - } - - if (!wincerts) { - /* The image is not signed */ - ret = efi_image_unsigned_authenticate(regs); - - goto err; + goto out; } /* @@ -624,18 +570,18 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) db = efi_sigstore_parse_sigdb(u"db"); if (!db) { EFI_PRINT("Getting signature database(db) failed\n"); - goto err; + goto out; } dbx = efi_sigstore_parse_sigdb(u"dbx"); if (!dbx) { EFI_PRINT("Getting signature database(dbx) failed\n"); - goto err; + goto out; } if (efi_signature_lookup_digest(regs, dbx, true)) { EFI_PRINT("Image's digest was found in \"dbx\"\n"); - goto err; + goto out; } /* @@ -678,7 +624,8 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) if (guidcmp(auth, &efi_guid_cert_type_pkcs7)) { EFI_PRINT("Certificate type not supported: %pUs\n", auth); - continue; + ret = false; + goto out; } auth += sizeof(efi_guid_t); @@ -686,7 +633,8 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) } else if (wincert->wCertificateType != WIN_CERT_TYPE_PKCS_SIGNED_DATA) { EFI_PRINT("Certificate type not supported\n"); - continue; + ret = false; + goto out; } msg = pkcs7_parse_message(auth, auth_size); @@ -717,32 +665,32 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) */ /* try black-list first */ if (efi_signature_verify_one(regs, msg, dbx)) { + ret = false; EFI_PRINT("Signature was rejected by \"dbx\"\n"); - continue; + goto out; } if (!efi_signature_check_signers(msg, dbx)) { + ret = false; EFI_PRINT("Signer(s) in \"dbx\"\n"); - continue; + goto out; } /* try white-list */ if (efi_signature_verify(regs, msg, db, dbx)) { ret = true; - break; + continue; } EFI_PRINT("Signature was not verified by \"db\"\n"); + } - if (efi_signature_lookup_digest(regs, db, false)) { - ret = true; - break; - } - EFI_PRINT("Image's digest was not found in \"db\" or \"dbx\"\n"); - } + /* last resort try the image sha256 hash in db */ + if (!ret && efi_signature_lookup_digest(regs, db, false)) + ret = true; -err: +out: efi_sigstore_free(db); efi_sigstore_free(dbx); pkcs7_free_message(msg); From patchwork Fri Feb 4 07:32:02 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ilias Apalodimas X-Patchwork-Id: 539861 Delivered-To: patch@linaro.org Received: by 2002:ac0:f7d2:0:0:0:0:0 with SMTP id i18csp3035789imr; Thu, 3 Feb 2022 23:32:27 -0800 (PST) X-Google-Smtp-Source: ABdhPJz7cmr8McuhVmc3/TYm+DFG7Spyrkao7r7V0AesoYEs8XkfoxVr0mg/I0diuJ7NKbIwff6z X-Received: by 2002:a05:6402:2789:: with SMTP id b9mr1801847ede.358.1643959946809; Thu, 03 Feb 2022 23:32:26 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1643959946; cv=none; d=google.com; s=arc-20160816; b=kkQv7z6wn4Vl+G0dTOXZY8OW9QV94INST9O9sN/dIKT5738JX2BkE1tYAez/4u9wgT Yib4r3cL3k1sIcDOskuwUaVz8Saef+N+fbygfUhhRa/k7QC8OpmiwDThLgu1hA9ahRSY VJ7sgR/t24y+YF2bgf2MdnU8P2K+104B1ZiprcLrWvTgfz/GIVXNM43hcAov9JoQ8AX+ BuWWcA5ffw4HrbKUiYPXcCBf1UPBIKHiF8mNw/YBqVrWVzVy8XnP3lvv/q4qqayQZKf9 HyI2Aj8qqLbvF88Y+RLKOMnWt2WrZLnRU5QSzfdzoYuICIOfDrUzavhKkKSlDiIpatv5 FkvQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=Ht2txRRK5HvvdxLCVT6wWH1FRx2edw1snICbcNKXlME=; b=IJMXjCc4nmtsWo95kmmVW7zhiJ+ZK1LI11bQdnWfa6JXrpLtrYIrCMqU440lTcSql1 7kfp0jyvPBln2qAH44iWk5nsOiGPmAVRx+/Gtlrc3NLW4x67+9KDyqHbKdIEecXNKkYv q6hVs/xho92pzbl2bUWqiogEB55rgQDk0STxwbRY6Y3YQUpDbNkxNVDXnBGNerJLMknX YMS078CfvCuPTDJWOsSk7/Q5OIWrSghmh/HN2UnP07NprBM3mNpn4hygGPz+7ixOZOz/ T2D0bEq40IGhzd32Ya/d+yi1NkSS3EVjy8dTISNjjSIKzOvXbEpdA+qQ2Jvfs1NSBP4e a3HQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=eG7np0MF; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from phobos.denx.de (phobos.denx.de. [2a01:238:438b:c500:173d:9f52:ddab:ee01]) by mx.google.com with ESMTPS id z27si650879ejl.466.2022.02.03.23.32.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Feb 2022 23:32:26 -0800 (PST) Received-SPF: pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=eG7np0MF; spf=pass (google.com: domain of u-boot-bounces@lists.denx.de designates 2a01:238:438b:c500:173d:9f52:ddab:ee01 as permitted sender) smtp.mailfrom=u-boot-bounces@lists.denx.de; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id C342F83A56; Fri, 4 Feb 2022 08:32:16 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (2048-bit key; unprotected) header.d=linaro.org header.i=@linaro.org header.b="eG7np0MF"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id EFA2E83A49; Fri, 4 Feb 2022 08:32:10 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.2 Received: from mail-ej1-x62b.google.com (mail-ej1-x62b.google.com [IPv6:2a00:1450:4864:20::62b]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 330AA83A4F for ; Fri, 4 Feb 2022 08:32:07 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=ilias.apalodimas@linaro.org Received: by mail-ej1-x62b.google.com with SMTP id o12so16588499eju.13 for ; Thu, 03 Feb 2022 23:32:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Ht2txRRK5HvvdxLCVT6wWH1FRx2edw1snICbcNKXlME=; b=eG7np0MFOof+/3kaQ3ei/e17scULgTArrsU8hC2A+86+YBfR131KFFK4Xx6G1Z4JeZ utsQdbUkAQaYIxMlbmuTQxHs/kP9YInFsvvNX7IPmlD1JKioE9WF2WSaXPtt6IPBqqj1 HD+/wcxlDBx4fWD3aVsJQhRJ08y5fBNsyc/aDdqbsaBvCKEDcs40z4hRZfXzxGal+PXL sY8qk+0d38RoOkOeziAi/F7prw44O8efC9+EXrh3T3oNFG2nIQ3hH220X5s4OutNeZXD +9EGdgLAsrhzQPdmdQKPfawEaxF/k4DUE3i0JXRTXmW99VocD6eMoTa4W4sIXisKb2gA yPqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Ht2txRRK5HvvdxLCVT6wWH1FRx2edw1snICbcNKXlME=; b=ZlkO5X4nVdI9FYvTFD9Fua7QExrSmHso07D8ohdGzRmEoCeTgF1GKLuIBbr1l9NDaK PeQ2lmZCUMkYUDDs8k4hDxSymOwgU4iLbIVgJQ1Y/HL5HHkHIXAPbz52r36r2AGikRYC xyfGMoWS/+f5ce1j0IuOcvdMZ6d3D+kaYclhUF6QdmpT8/qy2DUAzrewY4eLNojXCosL amuzHa6OCgMad/V1I8aDMO6VcZmqI7suQ/1ST53CpTd9Z8sLX6+/7p3gduc+campI/nt PyiX9BjlDfdAn9xUv2p/yAyPNeD/BiA77fQwc/OfsfawCz9W/5R/QrMT6ax3dHxxO4tb GIXA== X-Gm-Message-State: AOAM5327V6jOyDqQ7BbgzHy2byl02D8TD3Mt0kaS7FvglIS9rnMZGI+Q 8gsLnSSGRMZt83f4zWXTLmdkUQ== X-Received: by 2002:a17:906:4fd2:: with SMTP id i18mr1414525ejw.206.1643959926792; Thu, 03 Feb 2022 23:32:06 -0800 (PST) Received: from hades.. ([2a02:587:46a6:e776:3efd:feff:fe6b:c5cb]) by smtp.gmail.com with ESMTPSA id lt12sm359904ejb.166.2022.02.03.23.32.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 03 Feb 2022 23:32:06 -0800 (PST) From: Ilias Apalodimas To: xypron.glpk@gmx.de, takahiro.akashi@linaro.org Cc: Ilias Apalodimas , u-boot@lists.denx.de Subject: [RFC PATCH 2/2] test/py: efi_secboot: adjust secure boot tests to code changes Date: Fri, 4 Feb 2022 09:32:02 +0200 Message-Id: <20220204073202.4141198-2-ilias.apalodimas@linaro.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20220204073202.4141198-1-ilias.apalodimas@linaro.org> References: <20220204073202.4141198-1-ilias.apalodimas@linaro.org> MIME-Version: 1.0 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.5 at phobos.denx.de X-Virus-Status: Clean The previous patch is changing U-Boot's behavior wrt certificate based binary authentication. Specifically an image who's digest of a certificate is found in dbx is now rejected. Fix the test accordingly Signed-off-by: Ilias Apalodimas --- test/py/tests/test_efi_secboot/test_signed.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/test/py/tests/test_efi_secboot/test_signed.py b/test/py/tests/test_efi_secboot/test_signed.py index 0aee34479f55..7f5ec78261da 100644 --- a/test/py/tests/test_efi_secboot/test_signed.py +++ b/test/py/tests/test_efi_secboot/test_signed.py @@ -186,7 +186,7 @@ class TestEfiSignedImage(object): assert 'Hello, world!' in ''.join(output) with u_boot_console.log.section('Test Case 5c'): - # Test Case 5c, not rejected if one of signatures (digest of + # Test Case 5c, rejected if one of signatures (digest of # certificate) is revoked output = u_boot_console.run_command_list([ 'fatload host 0:1 4000000 dbx_hash.auth', @@ -195,7 +195,8 @@ class TestEfiSignedImage(object): output = u_boot_console.run_command_list([ 'efidebug boot next 1', 'efidebug test bootmgr']) - assert 'Hello, world!' in ''.join(output) + assert '\'HELLO\' failed' in ''.join(output) + assert 'efi_start_image() returned: 26' in ''.join(output) with u_boot_console.log.section('Test Case 5d'): # Test Case 5d, rejected if both of signatures are revoked