1# SPDX-License-Identifier: GPL-2.0+ 2# Copyright (c) 2022 Massimo Pegorer 3 4""" 5Test that mkimage generates auto-FIT with signatures and/or hashes as expected. 6 7The mkimage tool can create auto generated (i.e. without an ITS file 8provided as input) FIT in three different flavours: with crc32 checksums 9of 'images' subnodes; with signatures of 'images' subnodes; with sha1 10hashes of 'images' subnodes and signatures of 'configurations' subnodes. 11This test verifies that auto-FIT are generated as expected, in all of 12the three flavours, including check of hashes and signatures (except for 13configurations ones). 14 15The test does not run the sandbox. It only checks the host tool mkimage. 16""" 17 18import os 19import pytest 20import u_boot_utils as util 21import binascii 22from Cryptodome.Hash import SHA1 23from Cryptodome.Hash import SHA256 24from Cryptodome.PublicKey import RSA 25from Cryptodome.Signature import pkcs1_15 26 27class SignedFitHelper(object): 28 """Helper to manipulate a FIT with signed/hashed images/configs.""" 29 def __init__(self, cons, file_name): 30 self.fit = file_name 31 self.cons = cons 32 self.images_nodes = set() 33 self.confgs_nodes = set() 34 35 def __fdt_list(self, path): 36 return util.run_and_log(self.cons, 37 f'fdtget -l {self.fit} {path}') 38 39 def __fdt_get_string(self, node, prop): 40 return util.run_and_log(self.cons, 41 f'fdtget -ts {self.fit} {node} {prop}') 42 43 def __fdt_get_binary(self, node, prop): 44 numbers = util.run_and_log(self.cons, 45 f'fdtget -tbi {self.fit} {node} {prop}') 46 47 bignum = bytearray() 48 for little_num in numbers.split(): 49 bignum.append(int(little_num)) 50 51 return bignum 52 53 def build_nodes_sets(self): 54 """Fill sets with FIT images and configurations subnodes.""" 55 for node in self.__fdt_list('/images').split(): 56 subnode = f'/images/{node}' 57 self.images_nodes.add(subnode) 58 59 for node in self.__fdt_list('/configurations').split(): 60 subnode = f'/configurations/{node}' 61 self.confgs_nodes.add(subnode) 62 63 return len(self.images_nodes) + len(self.confgs_nodes) 64 65 def check_fit_crc32_images(self): 66 """Test that all images in the set are hashed as expected. 67 68 Each image must have an hash with algo=crc32 and hash value must match 69 the one calculated over image data. 70 """ 71 for node in self.images_nodes: 72 algo = self.__fdt_get_string(f'{node}/hash', 'algo') 73 assert algo == "crc32\n", "Missing expected crc32 image hash!" 74 75 raw_crc32 = self.__fdt_get_binary(f'{node}/hash', 'value') 76 raw_bin = self.__fdt_get_binary(node, 'data') 77 assert raw_crc32 == (binascii.crc32(raw_bin) & 78 0xffffffff).to_bytes(4, 'big'), "Wrong crc32 hash!" 79 80 def check_fit_signed_images(self, key_name, sign_algo, verifier): 81 """Test that all images in the set are signed as expected. 82 83 Each image must have a signature with: key-name-hint matching key_name 84 argument; algo matching sign_algo argument; value matching the one 85 calculated over image data using verifier argument. 86 """ 87 for node in self.images_nodes: 88 hint = self.__fdt_get_string(f'{node}/signature', 'key-name-hint') 89 assert hint == key_name + "\n", "Missing expected key name hint!" 90 algo = self.__fdt_get_string(f'{node}/signature', 'algo') 91 assert algo == sign_algo + "\n", "Missing expected signature algo!" 92 93 raw_sig = self.__fdt_get_binary(f'{node}/signature', 'value') 94 raw_bin = self.__fdt_get_binary(node, 'data') 95 verifier.verify(SHA256.new(raw_bin), bytes(raw_sig)) 96 97 def check_fit_signed_confgs(self, key_name, sign_algo): 98 """Test that all configs are signed, and images hashed, as expected. 99 100 Each image must have an hash with algo=sha1 and hash value must match 101 the one calculated over image data. Each configuration must have a 102 signature with key-name-hint matching key_name argument and algo 103 matching sign_algo argument. 104 TODO: configurations signature checking. 105 """ 106 for node in self.images_nodes: 107 algo = self.__fdt_get_string(f'{node}/hash', 'algo') 108 assert algo == "sha1\n", "Missing expected sha1 image hash!" 109 110 raw_hash = self.__fdt_get_binary(f'{node}/hash', 'value') 111 raw_bin = self.__fdt_get_binary(node, 'data') 112 assert raw_hash == SHA1.new(raw_bin).digest(), "Wrong sha1 hash!" 113 114 for node in self.confgs_nodes: 115 hint = self.__fdt_get_string(f'{node}/signature', 'key-name-hint') 116 assert hint == key_name + "\n", "Missing expected key name hint!" 117 algo = self.__fdt_get_string(f'{node}/signature', 'algo') 118 assert algo == sign_algo + "\n", "Missing expected signature algo!" 119 120 121@pytest.mark.buildconfigspec('fit_signature') 122@pytest.mark.requiredtool('fdtget') 123def test_fit_auto_signed(u_boot_console): 124 """Test that mkimage generates auto-FIT with signatures/hashes as expected. 125 126 The mkimage tool can create auto generated (i.e. without an ITS file 127 provided as input) FIT in three different flavours: with crc32 checksums 128 of 'images' subnodes; with signatures of 'images' subnodes; with sha1 129 hashes of 'images' subnodes and signatures of 'configurations' subnodes. 130 This test verifies that auto-FIT are generated as expected, in all of 131 the three flavours, including check of hashes and signatures (except for 132 configurations ones). 133 134 The test does not run the sandbox. It only checks the host tool mkimage. 135 """ 136 cons = u_boot_console 137 mkimage = cons.config.build_dir + '/tools/mkimage' 138 tempdir = os.path.join(cons.config.result_dir, 'auto_fit') 139 os.makedirs(tempdir, exist_ok=True) 140 kernel_file = f'{tempdir}/vmlinuz' 141 dt1_file = f'{tempdir}/dt-1.dtb' 142 dt2_file = f'{tempdir}/dt-2.dtb' 143 key_name = 'sign-key' 144 sign_algo = 'sha256,rsa4096' 145 key_file = f'{tempdir}/{key_name}.key' 146 fit_file = f'{tempdir}/test.fit' 147 148 # Create a fake kernel image and two dtb files with random data 149 with open(kernel_file, 'wb') as fd: 150 fd.write(os.urandom(512)) 151 152 with open(dt1_file, 'wb') as fd: 153 fd.write(os.urandom(256)) 154 155 with open(dt2_file, 'wb') as fd: 156 fd.write(os.urandom(256)) 157 158 # Create 4096 RSA key and write to file to be read by mkimage 159 key = RSA.generate(bits=4096) 160 verifier = pkcs1_15.new(key) 161 162 with open(key_file, 'w') as fd: 163 fd.write(str(key.export_key(format='PEM').decode('ascii'))) 164 165 b_args = " -d" + kernel_file + " -b" + dt1_file + " -b" + dt2_file 166 s_args = " -k" + tempdir + " -g" + key_name + " -o" + sign_algo 167 168 # 1 - Create auto FIT with images crc32 checksum, and verify it 169 util.run_and_log(cons, mkimage + ' -fauto' + b_args + " " + fit_file) 170 171 fit = SignedFitHelper(cons, fit_file) 172 if fit.build_nodes_sets() == 0: 173 raise ValueError('FIT-1 has no "/image" nor "/configuration" nodes') 174 175 fit.check_fit_crc32_images() 176 177 # 2 - Create auto FIT with signed images, and verify it 178 util.run_and_log(cons, mkimage + ' -fauto' + b_args + s_args + " " + 179 fit_file) 180 181 fit = SignedFitHelper(cons, fit_file) 182 if fit.build_nodes_sets() == 0: 183 raise ValueError('FIT-2 has no "/image" nor "/configuration" nodes') 184 185 fit.check_fit_signed_images(key_name, sign_algo, verifier) 186 187 # 3 - Create auto FIT with signed configs and hashed images, and verify it 188 util.run_and_log(cons, mkimage + ' -fauto-conf' + b_args + s_args + " " + 189 fit_file) 190 191 fit = SignedFitHelper(cons, fit_file) 192 if fit.build_nodes_sets() == 0: 193 raise ValueError('FIT-3 has no "/image" nor "/configuration" nodes') 194 195 fit.check_fit_signed_confgs(key_name, sign_algo) 196