1# SPDX-License-Identifier:      GPL-2.0+
2# Copyright (c) 2019, Linaro Limited
3# Author: AKASHI Takahiro <takahiro.akashi@linaro.org>
4
5"""Fixture for UEFI secure boot test."""
6
7from subprocess import call, check_call, CalledProcessError
8from tests import fs_helper
9import pytest
10from defs import *
11
12@pytest.fixture(scope='function')
13def efi_boot_env(request, ubman):
14    """Set up a file system to be used in UEFI secure boot test.
15
16    Args:
17        request: Pytest request object.
18        ubman: U-Boot configuration.
19
20    Return:
21        A path to disk image to be used for testing
22    """
23
24    try:
25        image_path, mnt_point = fs_helper.setup_image(ubman, 0, 0xc,
26                                                      basename='test_efi_secboot')
27
28        # suffix
29        # *.key: RSA private key in PEM
30        # *.crt: X509 certificate (self-signed) in PEM
31        # *.esl: signature list
32        # *.hash: message digest of image as signature list
33        # *.auth: signed signature list in signature database format
34        # *.efi: UEFI image
35        # *.efi.signed: signed UEFI image
36
37        # Create signature database
38        # PK
39        check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ -keyout PK.key -out PK.crt -nodes -days 365'
40                   % mnt_point, shell=True)
41        check_call('cd %s; %scert-to-efi-sig-list -g %s PK.crt PK.esl; %ssign-efi-sig-list -t "2020-04-01" -c PK.crt -k PK.key PK PK.esl PK.auth'
42                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
43                   shell=True)
44        # PK_null for deletion
45        check_call('cd %s; touch PK_null.esl; %ssign-efi-sig-list -t "2020-04-02" -c PK.crt -k PK.key PK PK_null.esl PK_null.auth'
46                   % (mnt_point, EFITOOLS_PATH), shell=True)
47        # KEK
48        check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ -keyout KEK.key -out KEK.crt -nodes -days 365'
49                   % mnt_point, shell=True)
50        check_call('cd %s; %scert-to-efi-sig-list -g %s KEK.crt KEK.esl; %ssign-efi-sig-list -t "2020-04-03" -c PK.crt -k PK.key KEK KEK.esl KEK.auth'
51                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
52                   shell=True)
53        # db
54        check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ -keyout db.key -out db.crt -nodes -days 365'
55                   % mnt_point, shell=True)
56        check_call('cd %s; %scert-to-efi-sig-list -g %s db.crt db.esl; %ssign-efi-sig-list -t "2020-04-04" -c KEK.crt -k KEK.key db db.esl db.auth'
57                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
58                   shell=True)
59        # db1
60        check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db1/ -keyout db1.key -out db1.crt -nodes -days 365'
61                   % mnt_point, shell=True)
62        check_call('cd %s; %scert-to-efi-sig-list -g %s db1.crt db1.esl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key db db1.esl db1.auth'
63                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
64                   shell=True)
65        # db2 (APPEND_WRITE)
66        check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db2/ -keyout db2.key -out db2.crt -nodes -days 365'
67                   % mnt_point, shell=True)
68        check_call('cd %s; %scert-to-efi-sig-list -g %s db2.crt db2.esl; %ssign-efi-sig-list -a -c KEK.crt -k KEK.key db db2.esl db2.auth'
69                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
70                   shell=True)
71        # dbx (TEST_dbx certificate)
72        check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_dbx/ -keyout dbx.key -out dbx.crt -nodes -days 365'
73                   % mnt_point, shell=True)
74        check_call('cd %s; %scert-to-efi-sig-list -g %s dbx.crt dbx.esl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx.esl dbx.auth'
75                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
76                   shell=True)
77        # dbx_hash (digest of TEST_db certificate)
78        check_call('cd %s; %scert-to-efi-hash-list -g %s -s 256 db.crt dbx_hash.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash.crl dbx_hash.auth'
79                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
80                   shell=True)
81        check_call('cd %s; %scert-to-efi-hash-list -g %s -s 384 db.crt dbx_hash384.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash384.crl dbx_hash384.auth'
82                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
83                   shell=True)
84        check_call('cd %s; %scert-to-efi-hash-list -g %s -s 512 db.crt dbx_hash512.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash512.crl dbx_hash512.auth'
85                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
86                   shell=True)
87        # dbx_hash1 (digest of TEST_db1 certificate)
88        check_call('cd %s; %scert-to-efi-hash-list -g %s -s 256 db1.crt dbx_hash1.crl; %ssign-efi-sig-list -t "2020-04-06" -c KEK.crt -k KEK.key dbx dbx_hash1.crl dbx_hash1.auth'
89                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
90                   shell=True)
91        # dbx_hash2 (digest of TEST_db2 certificate, with APPEND_WRITE)
92        check_call('cd %s; %scert-to-efi-hash-list -g %s -s 256 db2.crt dbx_hash2.crl; %ssign-efi-sig-list -a -c KEK.crt -k KEK.key dbx dbx_hash2.crl dbx_hash2.auth'
93                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
94                   shell=True)
95        # dbx_db (with TEST_db certificate)
96        check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx db.esl dbx_db.auth'
97                   % (mnt_point, EFITOOLS_PATH),
98                   shell=True)
99
100        # Copy image
101        check_call('cp %s/lib/efi_loader/helloworld.efi %s' %
102                   (ubman.config.build_dir, mnt_point), shell=True)
103
104        # Sign image
105        check_call('cd %s; sbsign --key db.key --cert db.crt helloworld.efi'
106                   % mnt_point, shell=True)
107        # Sign already-signed image with another key
108        check_call('cd %s; sbsign --key db1.key --cert db1.crt --output helloworld.efi.signed_2sigs helloworld.efi.signed'
109                   % mnt_point, shell=True)
110        # Create a corrupted signed image
111        check_call('cd %s; sh %s/test/py/tests/test_efi_secboot/forge_image.sh helloworld.efi.signed helloworld_forged.efi.signed'
112                   % (mnt_point, ubman.config.source_dir), shell=True)
113        # Digest image
114        check_call('cd %s; %shash-to-efi-sig-list helloworld.efi db_hello.hash; %ssign-efi-sig-list -t "2020-04-07" -c KEK.crt -k KEK.key db db_hello.hash db_hello.auth'
115                   % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH),
116                   shell=True)
117        check_call('cd %s; %shash-to-efi-sig-list helloworld.efi.signed db_hello_signed.hash; %ssign-efi-sig-list -t "2020-04-03" -c KEK.crt -k KEK.key db db_hello_signed.hash db_hello_signed.auth'
118                   % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH),
119                   shell=True)
120        check_call('cd %s; %ssign-efi-sig-list -t "2020-04-07" -c KEK.crt -k KEK.key dbx db_hello_signed.hash dbx_hello_signed.auth'
121                   % (mnt_point, EFITOOLS_PATH),
122                   shell=True)
123
124        fsfile = fs_helper.mk_fs(ubman.config, 'vfat', 0x1000000,
125                                 'test_efi_secboot', mnt_point)
126        check_call(f'dd if={fsfile} of={image_path} bs=1M seek=1', shell=True)
127
128    except CalledProcessError as exception:
129        pytest.skip('Setup failed: %s' % exception.cmd)
130        return
131    else:
132        yield image_path
133    finally:
134        call('rm -rf %s' % mnt_point, shell=True)
135        call('rm -f %s %s' % (image_path, fsfile), shell=True)
136
137#
138# Fixture for UEFI secure boot test of intermediate certificates
139#
140
141
142@pytest.fixture(scope='function')
143def efi_boot_env_intca(request, ubman):
144    """Set up file system for secure boot test.
145
146    Set up a file system to be used in UEFI secure boot test
147    of intermediate certificates.
148
149    Args:
150        request: Pytest request object.
151        ubman: U-Boot configuration.
152
153    Return:
154        A path to disk image to be used for testing
155    """
156
157    try:
158        image_path, mnt_point = fs_helper.setup_image(ubman, 0, 0xc,
159                                                      basename='test_efi_secboot_intca')
160
161        # Create signature database
162        # PK
163        check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ -keyout PK.key -out PK.crt -nodes -days 365'
164                   % mnt_point, shell=True)
165        check_call('cd %s; %scert-to-efi-sig-list -g %s PK.crt PK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth'
166                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
167                   shell=True)
168        # KEK
169        check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ -keyout KEK.key -out KEK.crt -nodes -days 365'
170                   % mnt_point, shell=True)
171        check_call('cd %s; %scert-to-efi-sig-list -g %s KEK.crt KEK.esl; %ssign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth'
172                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
173                   shell=True)
174
175        # We will have three-tier hierarchy of certificates:
176        #   TestRoot: Root CA (self-signed)
177        #   TestSub: Intermediate CA (signed by Root CA)
178        #   TestCert: User certificate (signed by Intermediate CA, and used
179        #             for signing an image)
180        #
181        # NOTE:
182        # I consulted the following EDK2 document for certificate options:
183        #     BaseTools/Source/Python/Pkcs7Sign/Readme.md
184        # Please not use them as they are in product system. They are
185        # for test purpose only.
186
187        # TestRoot
188        check_call('cp %s/test/py/tests/test_efi_secboot/openssl.cnf %s'
189                   % (ubman.config.source_dir, mnt_point), shell=True)
190        check_call('cd %s; export OPENSSL_CONF=./openssl.cnf; openssl genrsa -out TestRoot.key 2048; openssl req -extensions v3_ca -new -x509 -days 365 -key TestRoot.key -out TestRoot.crt -subj "/CN=TEST_root/"; touch index.txt; touch index.txt.attr'
191                   % mnt_point, shell=True)
192        # TestSub
193        check_call('cd %s; touch serial.new; export OPENSSL_CONF=./openssl.cnf; openssl genrsa -out TestSub.key 2048; openssl req -new -key TestSub.key -out TestSub.csr -subj "/CN=TEST_sub/"; openssl ca -in TestSub.csr -out TestSub.crt -extensions v3_int_ca -days 365 -batch -rand_serial -cert TestRoot.crt -keyfile TestRoot.key'
194                   % mnt_point, shell=True)
195        # TestCert
196        check_call('cd %s; touch serial.new; export OPENSSL_CONF=./openssl.cnf; openssl genrsa -out TestCert.key 2048; openssl req -new -key TestCert.key -out TestCert.csr -subj "/CN=TEST_cert/"; openssl ca -in TestCert.csr -out TestCert.crt -extensions usr_cert -days 365 -batch -rand_serial -cert TestSub.crt -keyfile TestSub.key'
197                   % mnt_point, shell=True)
198        # db
199        #  for TestCert
200        check_call('cd %s; %scert-to-efi-sig-list -g %s TestCert.crt TestCert.esl; %ssign-efi-sig-list -c KEK.crt -k KEK.key db TestCert.esl db_a.auth'
201                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
202                   shell=True)
203        #  for TestSub
204        check_call('cd %s; %scert-to-efi-sig-list -g %s TestSub.crt TestSub.esl; %ssign-efi-sig-list -t "2020-07-16" -c KEK.crt -k KEK.key db TestSub.esl db_b.auth'
205                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
206                   shell=True)
207        #  for TestRoot
208        check_call('cd %s; %scert-to-efi-sig-list -g %s TestRoot.crt TestRoot.esl; %ssign-efi-sig-list -t "2020-07-17" -c KEK.crt -k KEK.key db TestRoot.esl db_c.auth'
209                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
210                   shell=True)
211        ## dbx (hash of certificate with revocation time)
212        #  for TestCert
213        check_call('cd %s; %scert-to-efi-hash-list -g %s -t "2020-07-20" -s 256 TestCert.crt TestCert.crl; %ssign-efi-sig-list -c KEK.crt -k KEK.key dbx TestCert.crl dbx_a.auth'
214                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
215                   shell=True)
216        #  for TestSub
217        check_call('cd %s; %scert-to-efi-hash-list -g %s -t "2020-07-21" -s 256 TestSub.crt TestSub.crl; %ssign-efi-sig-list -t "2020-07-18" -c KEK.crt -k KEK.key dbx TestSub.crl dbx_b.auth'
218                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
219                   shell=True)
220        #  for TestRoot
221        check_call('cd %s; %scert-to-efi-hash-list -g %s -t "2020-07-22" -s 256 TestRoot.crt TestRoot.crl; %ssign-efi-sig-list -t "2020-07-19" -c KEK.crt -k KEK.key dbx TestRoot.crl dbx_c.auth'
222                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
223                   shell=True)
224
225        # Sign image
226        # additional intermediate certificates may be included
227        # in SignedData
228
229        check_call('cp %s/lib/efi_loader/helloworld.efi %s' %
230                   (ubman.config.build_dir, mnt_point), shell=True)
231        # signed by TestCert
232        check_call('cd %s; %ssbsign --key TestCert.key --cert TestCert.crt --out helloworld.efi.signed_a helloworld.efi'
233                   % (mnt_point, SBSIGN_PATH), shell=True)
234        # signed by TestCert with TestSub in signature
235        check_call('cd %s; %ssbsign --key TestCert.key --cert TestCert.crt --addcert TestSub.crt --out helloworld.efi.signed_ab helloworld.efi'
236                   % (mnt_point, SBSIGN_PATH), shell=True)
237        # signed by TestCert with TestSub and TestRoot in signature
238        check_call('cd %s; cat TestSub.crt TestRoot.crt > TestSubRoot.crt; %ssbsign --key TestCert.key --cert TestCert.crt --addcert TestSubRoot.crt --out helloworld.efi.signed_abc helloworld.efi'
239                   % (mnt_point, SBSIGN_PATH), shell=True)
240
241        fsfile = fs_helper.mk_fs(ubman.config, 'vfat', 0x1000000,
242                                 'test_efi_secboot_intca', mnt_point)
243        check_call(f'dd if={fsfile} of={image_path} bs=1M seek=1', shell=True)
244
245    except CalledProcessError as e:
246        pytest.skip('Setup failed: %s' % e.cmd)
247        return
248    else:
249        yield image_path
250    finally:
251        call('rm -rf %s' % mnt_point, shell=True)
252        call('rm -f %s %s' % (image_path, fsfile), shell=True)
253