tools: binman: Test signing an encrypted FIT with a preload header

Add a test to verify the preload header correctly signs an encrypted
FIT. This test exercises the case where encryption uses random IVs that
would change between mkimage calls.

Signed-off-by: Paul HENRYS <paul.henrys_ext@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>

diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py
index ca5149ee654a7f54bef3f9faf673a7219cdd522a..da8325f820afd2a9956606078869b0fd6603c72c 100644 (file)
--- a/tools/binman/ftest.py
+++ b/tools/binman/ftest.py
@@ -5895,6 +5895,27 @@ fdt         fdtmap                Extract the devicetree blob from the fdtmap
             data = self._DoReadFileDtb('security/pre_load_invalid_key.dts',
                                        entry_args=entry_args)
 
+    def testPreLoadEncryptedFit(self):
+        """Test an encrypted FIT image with a pre-load header"""
+        entry_args = {
+            'pre-load-key-path': os.path.join(self._binman_dir, 'test'),
+        }
+        data = tools.read_file(self.TestFile("fit/aes256.bin"))
+        self._MakeInputFile("keys/aes256.bin", data)
+
+        keys_subdir = os.path.join(self._indir, "keys")
+        data = self._DoReadFileDtb(
+            'security/pre_load_fit_encrypted.dts', entry_args=entry_args,
+            extra_indirs=[keys_subdir])[0]
+
+        image_fname = tools.get_output_filename('image.bin')
+        is_signed = self._CheckPreload(image_fname, self.TestFile("dev.key"))
+
+        self.assertEqual(PRE_LOAD_MAGIC, data[:len(PRE_LOAD_MAGIC)])
+        self.assertEqual(PRE_LOAD_VERSION, data[4:4 + len(PRE_LOAD_VERSION)])
+        self.assertEqual(PRE_LOAD_HDR_SIZE, data[8:8 + len(PRE_LOAD_HDR_SIZE)])
+        self.assertEqual(is_signed, True)
+
     def _CheckSafeUniqueNames(self, *images):
         """Check all entries of given images for unsafe unique names"""
         for image in images:

diff --git a/tools/binman/test/security/pre_load_fit_encrypted.dts b/tools/binman/test/security/pre_load_fit_encrypted.dts
new file mode 100644 (file)
index 0000000..f5e9bf9
--- /dev/null
+++ b/tools/binman/test/security/pre_load_fit_encrypted.dts
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-2.0+
+
+/dts-v1/;
+
+/ {
+       #address-cells = <1>;
+       #size-cells = <1>;
+
+       binman {
+               pre-load {
+                       content = <&image>;
+                       algo-name = "sha256,rsa2048";
+                       key-name = "dev.key";
+                       header-size = <4096>;
+                       version = <0x11223344>;
+               };
+
+               image: fit {
+                       fit,encrypt;
+                       description = "Test a FIT with encrypted data and signed with a preload";
+                       #address-cells = <1>;
+
+                       images {
+                               u-boot {
+                                       description = "U-Boot";
+                                       type = "firmware";
+                                       arch = "arm64";
+                                       os = "U-Boot";
+                                       compression = "none";
+                                       load = <00000000>;
+                                       entry = <00000000>;
+                                       cipher {
+                                               algo = "aes256";
+                                               key-name-hint = "aes256";
+                                       };
+                                       u-boot-nodtb {
+                                       };
+                               };
+                               fdt-1 {
+                                       description = "Flattened Device Tree blob";
+                                       type = "flat_dt";
+                                       arch = "arm64";
+                                       compression = "none";
+                                       cipher {
+                                               algo = "aes256";
+                                               key-name-hint = "aes256";
+                                       };
+                                       u-boot-dtb {
+                                       };
+                               };
+                       };
+
+                       configurations {
+                               default = "conf-1";
+                               conf-1 {
+                                       description = "Boot U-Boot with FDT blob";
+                                       firmware = "u-boot";
+                                       fdt = "fdt-1";
+                               };
+                       };
+               };
+       };
+};