Pkcs7EkuTests.c

 
#include "TestBaseCryptLib.h"
 
#include "Pkcs7EkuTestSignatures.h"
 
EFI_STATUS
EFIAPI
VerifyEKUsInPkcs7Signature (
  IN CONST UINT8   *Pkcs7Signature,
  IN CONST UINT32  SignatureSize,
  IN CONST CHAR8   *RequiredEKUs[],
  IN CONST UINT32  RequiredEKUsSize,
  IN BOOLEAN       RequireAllPresent
  );
 
 
CONST CHAR8  FIRMWARE_SIGNER_EKU[] = "1.3.6.1.4.1.311.76.9.21.1";
 
static
UNIT_TEST_STATUS
EFIAPI
TestVerifyEKUsInSignature (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  CONST CHAR8  *RequiredEKUs[] = { FIRMWARE_SIGNER_EKU };
 
  Status = VerifyEKUsInPkcs7Signature (
             ProductionECCSignature,
             ARRAY_SIZE (ProductionECCSignature),
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             TRUE
             );
  UT_ASSERT_STATUS_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestVerifyEKUsInSignature()
 
static
UNIT_TEST_STATUS
EFIAPI
TestVerifyEKUsWith3CertsInSignature (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  CONST CHAR8  *RequiredEKUs[] = { FIRMWARE_SIGNER_EKU };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignEKUsWith3CertsInSignature,
             ARRAY_SIZE (TestSignEKUsWith3CertsInSignature),
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             TRUE
             );
  UT_ASSERT_STATUS_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestVerifyEKUsWith3CertsInSignature()
 
static
UNIT_TEST_STATUS
EFIAPI
TestVerifyEKUsWith2CertsInSignature (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  CONST CHAR8  *RequiredEKUs[] = { FIRMWARE_SIGNER_EKU };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignEKUsWith2CertsInSignature,
             ARRAY_SIZE (TestSignEKUsWith2CertsInSignature),
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             TRUE
             );
  UT_ASSERT_STATUS_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestVerifyEKUsWith2CertsInSignature()
 
static
UNIT_TEST_STATUS
EFIAPI
TestVerifyEKUsWith1CertInSignature (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  CONST CHAR8  *RequiredEKUs[] = { FIRMWARE_SIGNER_EKU };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignEKUsWith1CertInSignature,
             ARRAY_SIZE (TestSignEKUsWith1CertInSignature),
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             TRUE
             );
  UT_ASSERT_STATUS_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestVerifyEKUsWith1CertInSignature()
 
static
UNIT_TEST_STATUS
EFIAPI
TestVerifyEKUsWithMultipleEKUsInCert (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  CONST CHAR8  *RequiredEKUs[] = {
    "1.3.6.1.4.1.311.76.9.21.1",
    "1.3.6.1.4.1.311.76.9.21.1.2"
  };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignedWithMultipleEKUsInCert,
             ARRAY_SIZE (TestSignedWithMultipleEKUsInCert),
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             TRUE
             );
  UT_ASSERT_STATUS_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestVerifyEKUsWithMultipleEKUsInCert()
 
static
UNIT_TEST_STATUS
EFIAPI
TestEkusNotPresentInSignature (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  //
  // This EKU is not in the signature.
  //
  CONST CHAR8  *RequiredEKUs[] = { "1.3.6.1.4.1.311.76.9.21.3" };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignedWithMultipleEKUsInCert,
             ARRAY_SIZE (TestSignedWithMultipleEKUsInCert),
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             TRUE
             );
  UT_ASSERT_NOT_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestEkusNotPresentInSignature()
 
static
UNIT_TEST_STATUS
EFIAPI
TestProductId10001PresentInSignature (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  //
  // These EKU's are present in the leaf signer certificate.
  //
  CONST CHAR8  *RequiredEKUs[] = {
    "1.3.6.1.4.1.311.76.9.21.1",
    "1.3.6.1.4.1.311.76.9.21.1.10001"
  };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignedWithProductId10001,
             ARRAY_SIZE (TestSignedWithProductId10001),
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             TRUE
             );
  UT_ASSERT_STATUS_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestProductId10001PresentInSignature()
 
static
UNIT_TEST_STATUS
EFIAPI
TestOnlyOneEkuInListRequired (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  //
  // This will test the flag that specifies it is OK to succeed if
  // any one of the EKU's passed in is found.
  //
  CONST CHAR8  *RequiredEKUs[] = { "1.3.6.1.4.1.311.76.9.21.1.10001" };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignedWithProductId10001,
             ARRAY_SIZE (TestSignedWithProductId10001),
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             FALSE
             );
  UT_ASSERT_STATUS_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestOnlyOneEkuInListRequired()
 
static
UNIT_TEST_STATUS
EFIAPI
TestNoEKUsInSignature (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  //
  // This EKU is not in the certificate, so it should fail.
  //
  CONST CHAR8  *RequiredEKUs[] = { "1.3.6.1.4.1.311.76.9.21.1" };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignatureWithNoEKUsPresent,
             ARRAY_SIZE (TestSignatureWithNoEKUsPresent),
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             TRUE
             );
  UT_ASSERT_NOT_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestNoEKUsInSignature()
 
static
UNIT_TEST_STATUS
EFIAPI
TestInvalidParameters (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  CONST CHAR8  *RequiredEKUs[] = { "1.3.6.1.4.1.311.76.9.21.1" };
 
  //
  // Check bad signature.
  //
  Status = VerifyEKUsInPkcs7Signature (
             NULL,
             0,
             (CONST CHAR8 **)RequiredEKUs,
             ARRAY_SIZE (RequiredEKUs),
             TRUE
             );
  UT_ASSERT_STATUS_EQUAL (Status, EFI_INVALID_PARAMETER);
 
  //
  // Check invalid EKU's
  //
  Status = VerifyEKUsInPkcs7Signature (
             TestSignatureWithNoEKUsPresent,
             ARRAY_SIZE (TestSignatureWithNoEKUsPresent),
             (CONST CHAR8 **)NULL,
             0,
             TRUE
             );
  UT_ASSERT_STATUS_EQUAL (Status, EFI_INVALID_PARAMETER);
 
  return UNIT_TEST_PASSED;
}// TestInvalidParameters()
 
static
UNIT_TEST_STATUS
EFIAPI
TestEKUSubsetSupersetFails (
  IN UNIT_TEST_CONTEXT  Context
  )
{
  EFI_STATUS  Status = EFI_SUCCESS;
 
  //
  // This signature has an EKU of:
  // "1.3.6.1.4.1.311.76.9.21.1.10001"
  // so ensure that
  // "1.3.6.1.4.1.311.76.9.21"
  // does not pass.
  //
  CONST CHAR8  *RequiredEKUs1[] = { "1.3.6.1.4.1.311.76.9.21" };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignedWithProductId10001,
             ARRAY_SIZE (TestSignedWithProductId10001),
             (CONST CHAR8 **)RequiredEKUs1,
             ARRAY_SIZE (RequiredEKUs1),
             TRUE
             );
  UT_ASSERT_NOT_EQUAL (Status, EFI_SUCCESS);
 
  //
  // This signature has an EKU of:
  // "1.3.6.1.4.1.311.76.9.21.1.10001"
  // so ensure that a super set
  // "1.3.6.1.4.1.311.76.9.21.1.10001.1"
  // does not pass.
  //
  CONST CHAR8  *RequiredEKUs2[] = { "1.3.6.1.4.1.311.76.9.21.1.10001.1" };
 
  Status = VerifyEKUsInPkcs7Signature (
             TestSignedWithProductId10001,
             ARRAY_SIZE (TestSignedWithProductId10001),
             (CONST CHAR8 **)RequiredEKUs2,
             ARRAY_SIZE (RequiredEKUs2),
             TRUE
             );
  UT_ASSERT_NOT_EQUAL (Status, EFI_SUCCESS);
 
  return UNIT_TEST_PASSED;
}// TestEKUSubsetSupersetFails()
 
TEST_DESC  mPkcs7EkuTest[] = {
  //
  // -----Description--------------------------------Class----------------------------Function------------------------------Pre---Post--Context
  //
  { "TestVerifyEKUsInSignature()",            "CryptoPkg.BaseCryptLib.Eku", TestVerifyEKUsInSignature,            NULL, NULL, NULL },
  { "TestVerifyEKUsWith3CertsInSignature()",  "CryptoPkg.BaseCryptLib.Eku", TestVerifyEKUsWith3CertsInSignature,  NULL, NULL, NULL },
  { "TestVerifyEKUsWith2CertsInSignature()",  "CryptoPkg.BaseCryptLib.Eku", TestVerifyEKUsWith2CertsInSignature,  NULL, NULL, NULL },
  { "TestVerifyEKUsWith1CertInSignature()",   "CryptoPkg.BaseCryptLib.Eku", TestVerifyEKUsWith1CertInSignature,   NULL, NULL, NULL },
  { "TestVerifyEKUsWithMultipleEKUsInCert()", "CryptoPkg.BaseCryptLib.Eku", TestVerifyEKUsWithMultipleEKUsInCert, NULL, NULL, NULL },
  { "TestEkusNotPresentInSignature()",        "CryptoPkg.BaseCryptLib.Eku", TestEkusNotPresentInSignature,        NULL, NULL, NULL },
  { "TestProductId10001PresentInSignature()", "CryptoPkg.BaseCryptLib.Eku", TestProductId10001PresentInSignature, NULL, NULL, NULL },
  { "TestOnlyOneEkuInListRequired()",         "CryptoPkg.BaseCryptLib.Eku", TestOnlyOneEkuInListRequired,         NULL, NULL, NULL },
  { "TestNoEKUsInSignature()",                "CryptoPkg.BaseCryptLib.Eku", TestNoEKUsInSignature,                NULL, NULL, NULL },
  { "TestInvalidParameters()",                "CryptoPkg.BaseCryptLib.Eku", TestInvalidParameters,                NULL, NULL, NULL },
  { "TestEKUSubsetSupersetFails()",           "CryptoPkg.BaseCryptLib.Eku", TestEKUSubsetSupersetFails,           NULL, NULL, NULL },
};
 
UINTN  mPkcs7EkuTestNum = ARRAY_SIZE (mPkcs7EkuTest);