| # Copyright 2018 The ChromiumOS Authors |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| import logging |
| import time |
| |
| from autotest_lib.client.common_lib import error |
| from autotest_lib.client.common_lib.cros import cr50_utils |
| from autotest_lib.server.cros.faft.cr50_test import Cr50Test |
| |
| |
| class firmware_Cr50Password(Cr50Test): |
| """Verify cr50 set password.""" |
| version = 1 |
| NEW_PASSWORD = 'robot' |
| |
| def usb_set_password(self, password): |
| """Try sending the password command from the console and ccd usb. |
| |
| Verify the console command and usb vendor command fail to set the |
| password. |
| """ |
| start_pw_state = self.gsc.password_is_reset() |
| start_level = self.gsc.get_ccd_level() |
| logging.info('Password is %s', 'cleared' if start_pw_state else 'set') |
| time.sleep(self.gsc.CCD_PASSWORD_RATE_LIMIT) |
| # CCD password from the console should always be inaccessible. |
| self.gsc.set_password(password) |
| time.sleep(self.gsc.CCD_PASSWORD_RATE_LIMIT) |
| if start_pw_state != self.gsc.password_is_reset(): |
| raise error.TestFail('changed password from console') |
| if start_level != self.gsc.get_ccd_level(): |
| raise error.TestFail( |
| 'changed ccd level with set password console command') |
| if self.ccd_programmer_connected_to_servo_host(): |
| time.sleep(self.gsc.CCD_PASSWORD_RATE_LIMIT) |
| cmd = self._ccd_programmer.get_ccd_gsctool_cmd('-P') |
| full_cmd = "echo -e '%s\n%s\n' | %s" % (password, password, cmd) |
| logging.info('ccd password command: %r', full_cmd) |
| result = self._ccd_programmer.run(full_cmd, ignore_status=True) |
| logging.info('CCD password result: %r', result) |
| time.sleep(self.gsc.CCD_PASSWORD_RATE_LIMIT) |
| if start_pw_state != self.gsc.password_is_reset(): |
| raise error.TestFail('changed password with ccd') |
| if start_level != self.gsc.get_ccd_level(): |
| raise error.TestFail('changed ccd level with ccd') |
| |
| logging.info('After ccd commands, password is %s', |
| 'cleared' if self.gsc.password_is_reset() else 'set') |
| |
| def try_wrong_password(self, wrong_password): |
| """Try to open ccd with the wrong password. |
| |
| Raise an error if it works. |
| """ |
| time.sleep(self.gsc.CCD_PASSWORD_RATE_LIMIT) |
| try: |
| self.gsc.set_ccd_level('open', wrong_password) |
| raise error.TestFail( |
| 'Opened ccd with incorrect password: used %r actual %r', |
| wrong_password, self.test_password) |
| except error.TestFail as e: |
| logging.info('successfully rejected ccd open using %r', |
| wrong_password) |
| |
| def run_once(self): |
| """Check we can set the cr50 password.""" |
| self.test_password = self.CCD_PASSWORD |
| # Make sure the case is enforced. If the password is lower case, try |
| # upper. If it's uppercase, try lower. |
| wrong_case = (self.test_password.upper() |
| if self.test_password.islower() else |
| self.test_password.lower()) |
| |
| # Make sure to enable testlab mode, so we can guarantee the password |
| # can be cleared. |
| self.fast_ccd_open(enable_testlab=True) |
| self.gsc.ccd_reset() |
| |
| # CCD password from the console should always be inaccessible. |
| self.usb_set_password(self.test_password) |
| # Set the password. |
| self.set_ccd_password(self.test_password) |
| if self.gsc.password_is_reset(): |
| raise error.TestFail('Failed to set password') |
| |
| # Test 'ccd reset' clears the password. |
| self.gsc.ccd_reset() |
| if not self.gsc.password_is_reset(): |
| raise error.TestFail('ccd reset did not clear the password') |
| # Set OpenFromUSB to IfOpened, so the test will only be able to open |
| # ccd with a console command if the password is set. This is cleared |
| # in Cr50Test cleanup. |
| self.gsc.set_cap('OpenFromUSB', 'IfOpened') |
| |
| # Set the password again while cr50 is open. |
| self.set_ccd_password(self.test_password) |
| if self.gsc.password_is_reset(): |
| raise error.TestFail('Failed to set password') |
| |
| # The password can't be changed once it's set. |
| # It needs to be cleared first. |
| self.set_ccd_password(self.NEW_PASSWORD, expect_error=True) |
| |
| self.gsc.reboot() |
| if self.gsc.password_is_reset(): |
| raise error.TestFail('Password cleared after reboot') |
| |
| # Verify ccd can't be opened with the wrong password. Verify case is |
| # enforced |
| self.try_wrong_password(wrong_case) |
| self.try_wrong_password(self.NEW_PASSWORD) |
| |
| # Verify ccd can be opened with the correct password. |
| self.gsc.set_ccd_level('open', self.test_password) |
| |
| self.gsc.set_ccd_level('lock') |
| # The password can't be cleared while the console is locked from the |
| # AP or ccd. |
| self.usb_set_password('clear:' + self.test_password) |
| self.set_ccd_password('clear:' + self.test_password, expect_error=True) |
| if self.gsc.password_is_reset(): |
| raise error.TestFail('Cleared password while locked') |
| |
| if self.gsc.unlock_is_supported(): |
| self.gsc.send_command('ccd unlock ' + self.test_password) |
| # The password can be cleared while the console is unlocked. |
| self.set_ccd_password('clear:' + self.test_password) |
| |
| # Open the console, set the password again. |
| self.gsc.send_command('ccd testlab open') |
| self.set_ccd_password(self.test_password) |
| else: |
| # Open the console. |
| self.gsc.send_command('ccd testlab open') |
| |
| # The password can't be cleared using the wrong password. |
| self.set_ccd_password('clear:' + wrong_case, expect_error=True) |
| self.set_ccd_password('clear:' + self.NEW_PASSWORD, expect_error=True) |
| # The right password can't be used to clear the password from |
| # the console. |
| self.usb_set_password('clear:' + self.test_password) |
| # The password can be cleared using the correct password. |
| self.set_ccd_password('clear:' + self.test_password) |
| if not self.gsc.password_is_reset(): |
| raise error.TestFail('Failed to clear password') |
| |
| # The password can be set to anything when there isn't one set. |
| self.set_ccd_password(self.NEW_PASSWORD) |
| if self.gsc.password_is_reset(): |
| raise error.TestFail('Failed to set password') |
| |
| self.gsc.send_command('ccd testlab open') |
| self.gsc.ccd_reset() |
| |
| if not self.gsc.unlock_is_supported(): |
| return |
| |
| # Run through the same steps when the password was set with the console |
| # unlocked. |
| |
| self.host.run('gsctool -a -U') |
| |
| # Set the password when the console is unlocked. |
| self.set_ccd_password(self.test_password) |
| |
| self.gsc.set_ccd_level('lock') |
| # The password can't be cleared while the console is locked. |
| self.set_ccd_password('clear:' + self.test_password, expect_error=True) |
| |
| # Unlock the console. |
| self.ccd_unlock_from_ap(self.test_password) |
| # The password can be cleared while the console is unlocked. |
| self.set_ccd_password('clear:' + self.test_password) |
| # Set the password again when the console is unlocked. |
| self.set_ccd_password(self.test_password) |
| |
| self.gsc.send_command('ccd testlab open') |
| # The password can be cleared when the console is open. |
| self.set_ccd_password('clear:' + self.test_password) |
