Merge tag 'efi-2020-10-rc1-3' of https://gitlab.denx.de/u-boot/custodians/u-boot-efi

Pull request for UEFI sub-system for efi-2020-10-rc1 (3)

Up to now UEFI variables where stored in U-Boot environment variables.
Saving UEFI variables was not possible without saving the U-Boot
environment variables. With this patch series file ubootefi.var in the
EFI system partition is used for saving UEFI variables. Furthermore the
UEFI variables are exposed for reading at runtime.

Code corrections for UEFI secure boot are provided.

A buffer overrun in the RSA library is fixed.

1 files changed, 63 insertions, 58 deletions

diff --git a/test/py/tests/test_efi_secboot/conftest.py b/test/py/tests/test_efi_secboot/conftest.py
index ac5a780fdb..c6709700a8 100644
--- a/test/py/tests/test_efi_secboot/conftest.py
+++ b/test/py/tests/test_efi_secboot/conftest.py
@@ -4,29 +4,32 @@
 
 import os
 import os.path
-import pytest
-import re
 from subprocess import call, check_call, check_output, CalledProcessError
+import pytest
 from defs import *
 
 # from test/py/conftest.py
+
+
 def tool_is_in_path(tool):
     for path in os.environ["PATH"].split(os.pathsep):
-        fn = os.path.join(path, tool)
-        if os.path.isfile(fn) and os.access(fn, os.X_OK):
+        full_path = os.path.join(path, tool)
+        if os.path.isfile(full_path) and os.access(full_path, os.X_OK):
             return True
     return False
 
 #
 # Fixture for UEFI secure boot test
 #
+
+
 @pytest.fixture(scope='session')
 def efi_boot_env(request, u_boot_config):
     """Set up a file system to be used in UEFI secure boot test.
 
     Args:
         request: Pytest request object.
-	u_boot_config: U-boot configuration.
+        u_boot_config: U-boot configuration.
 
     Return:
         A path to disk image to be used for testing
@@ -35,34 +38,15 @@ def efi_boot_env(request, u_boot_config):
 
     image_path = u_boot_config.persistent_data_dir
     image_path = image_path + '/' + EFI_SECBOOT_IMAGE_NAME
-    image_size = EFI_SECBOOT_IMAGE_SIZE
-    part_size = EFI_SECBOOT_PART_SIZE
-    fs_type = EFI_SECBOOT_FS_TYPE
 
     if HELLO_PATH == '':
         HELLO_PATH = u_boot_config.build_dir + '/lib/efi_loader/helloworld.efi'
 
     try:
-        mnt_point = u_boot_config.persistent_data_dir + '/mnt_efisecure'
+        mnt_point = u_boot_config.build_dir + '/mnt_efisecure'
+        check_call('rm -rf {}'.format(mnt_point), shell=True)
         check_call('mkdir -p {}'.format(mnt_point), shell=True)
 
-        # create a disk/partition
-        check_call('dd if=/dev/zero of=%s bs=1MiB count=%d'
-                            % (image_path, image_size), shell=True)
-        check_call('sgdisk %s -n 1:0:+%dMiB'
-                            % (image_path, part_size), shell=True)
-        # create a file system
-        check_call('dd if=/dev/zero of=%s.tmp bs=1MiB count=%d'
-                            % (image_path, part_size), shell=True)
-        check_call('mkfs -t %s %s.tmp' % (fs_type, image_path), shell=True)
-        check_call('dd if=%s.tmp of=%s bs=1MiB seek=1 count=%d conv=notrunc'
-                            % (image_path, image_path, 1), shell=True)
-        check_call('rm %s.tmp' % image_path, shell=True)
-        loop_dev = check_output('sudo losetup -o 1MiB --sizelimit %dMiB --show -f %s | tr -d "\n"'
-                                % (part_size, image_path), shell=True).decode()
-        check_output('sudo mount -t %s -o umask=000 %s %s'
-                                % (fs_type, loop_dev, mnt_point), shell=True)
-
         # suffix
         # *.key: RSA private key in PEM
         # *.crt: X509 certificate (self-signed) in PEM
@@ -73,59 +57,80 @@ def efi_boot_env(request, u_boot_config):
         # *.efi.signed: signed UEFI image
 
         # Create signature database
-        ## PK
+        # PK
         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_PK/ -keyout PK.key -out PK.crt -nodes -days 365'
-                            % mnt_point, shell=True)
+                   % mnt_point, shell=True)
         check_call('cd %s; %scert-to-efi-sig-list -g %s PK.crt PK.esl; %ssign-efi-sig-list -t "2020-04-01" -c PK.crt -k PK.key PK PK.esl PK.auth'
-                            % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
-                            shell=True)
-        ## PK_null for deletion
+                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
+                   shell=True)
+        # PK_null for deletion
         check_call('cd %s; touch PK_null.esl; %ssign-efi-sig-list -t "2020-04-02" -c PK.crt -k PK.key PK PK_null.esl PK_null.auth'
-                            % (mnt_point, EFITOOLS_PATH), shell=True)
-        ## KEK
+                   % (mnt_point, EFITOOLS_PATH), shell=True)
+        # KEK
         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_KEK/ -keyout KEK.key -out KEK.crt -nodes -days 365'
-                            % mnt_point, shell=True)
+                   % mnt_point, shell=True)
         check_call('cd %s; %scert-to-efi-sig-list -g %s KEK.crt KEK.esl; %ssign-efi-sig-list -t "2020-04-03" -c PK.crt -k PK.key KEK KEK.esl KEK.auth'
-                            % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
-                            shell=True)
-        ## db
+                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
+                   shell=True)
+        # db
         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db/ -keyout db.key -out db.crt -nodes -days 365'
-                            % mnt_point, shell=True)
+                   % mnt_point, shell=True)
         check_call('cd %s; %scert-to-efi-sig-list -g %s db.crt db.esl; %ssign-efi-sig-list -t "2020-04-04" -c KEK.crt -k KEK.key db db.esl db.auth'
-                            % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
-                            shell=True)
-        ## db1
+                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
+                   shell=True)
+        # db1
         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_db1/ -keyout db1.key -out db1.crt -nodes -days 365'
-                            % mnt_point, shell=True)
+                   % mnt_point, shell=True)
         check_call('cd %s; %scert-to-efi-sig-list -g %s db1.crt db1.esl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key db db1.esl db1.auth'
-                            % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
-                            shell=True)
-        ## db1-update
+                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
+                   shell=True)
+        # db1-update
         check_call('cd %s; %ssign-efi-sig-list -t "2020-04-06" -a -c KEK.crt -k KEK.key db db1.esl db1-update.auth'
-                            % (mnt_point, EFITOOLS_PATH), shell=True)
-        ## dbx
+                   % (mnt_point, EFITOOLS_PATH), shell=True)
+        ## dbx (TEST_dbx certificate)
         check_call('cd %s; openssl req -x509 -sha256 -newkey rsa:2048 -subj /CN=TEST_dbx/ -keyout dbx.key -out dbx.crt -nodes -days 365'
-                            % mnt_point, shell=True)
+                   % mnt_point, shell=True)
         check_call('cd %s; %scert-to-efi-sig-list -g %s dbx.crt dbx.esl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx.esl dbx.auth'
-                            % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
-                            shell=True)
+                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
+                   shell=True)
+        ## dbx_hash (digest of TEST_db certificate)
+        check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 256 db.crt dbx_hash.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash.crl dbx_hash.auth'
+                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
+                   shell=True)
+        ## dbx_hash1 (digest of TEST_db1 certificate)
+        check_call('cd %s; %scert-to-efi-hash-list -g %s -t 0 -s 256 db1.crt dbx_hash1.crl; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx dbx_hash1.crl dbx_hash1.auth'
+                   % (mnt_point, EFITOOLS_PATH, GUID, EFITOOLS_PATH),
+                   shell=True)
+        ## dbx_db (with TEST_db certificate)
+        check_call('cd %s; %ssign-efi-sig-list -t "2020-04-05" -c KEK.crt -k KEK.key dbx db.esl dbx_db.auth'
+                   % (mnt_point, EFITOOLS_PATH),
+                   shell=True)
 
         # Copy image
         check_call('cp %s %s' % (HELLO_PATH, mnt_point), shell=True)
 
-        ## Sign image
+        # Sign image
         check_call('cd %s; sbsign --key db.key --cert db.crt helloworld.efi'
-                            % mnt_point, shell=True)
+                   % mnt_point, shell=True)
+        ## Sign already-signed image with another key
+        check_call('cd %s; sbsign --key db1.key --cert db1.crt --output helloworld.efi.signed_2sigs helloworld.efi.signed'
+                   % mnt_point, shell=True)
         ## Digest image
         check_call('cd %s; %shash-to-efi-sig-list helloworld.efi db_hello.hash; %ssign-efi-sig-list -t "2020-04-07" -c KEK.crt -k KEK.key db db_hello.hash db_hello.auth'
-                            % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH),
-                            shell=True)
+                   % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH),
+                   shell=True)
+        check_call('cd %s; %shash-to-efi-sig-list helloworld.efi.signed db_hello_signed.hash; %ssign-efi-sig-list -t "2020-04-03" -c KEK.crt -k KEK.key db db_hello_signed.hash db_hello_signed.auth'
+                   % (mnt_point, EFITOOLS_PATH, EFITOOLS_PATH),
+                   shell=True)
+        check_call('cd %s; %ssign-efi-sig-list -t "2020-04-07" -c KEK.crt -k KEK.key dbx db_hello_signed.hash dbx_hello_signed.auth'
+                   % (mnt_point, EFITOOLS_PATH),
+                   shell=True)
 
-        check_call('sudo umount %s' % loop_dev, shell=True)
-        check_call('sudo losetup -d %s' % loop_dev, shell=True)
+        check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat {} {}'.format(mnt_point, image_path), shell=True)
+        check_call('rm -rf {}'.format(mnt_point), shell=True)
 
-    except CalledProcessError as e:
-        pytest.skip('Setup failed: %s' % e.cmd)
+    except CalledProcessError as exception:
+        pytest.skip('Setup failed: %s' % exception.cmd)
         return
     else:
         yield image_path