maple/prplos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: tests: cram: USP authentication tests

Browse Source 
Modify script_functions to add new parameters for install_ctr function
Add cram test for USP authentication
Add cram test to check USP restrictions
Modify 030-lcm-general CRAM test to check Cthulhu datamodel
Fill obuspa datamodel with new expected parameters and objects

References: PCF-2442, FEAT-28, FEAT-120
Signed-off-by: Mykola Hlukhenkyi <m.hlukhenkyi@inango-systems.com>
Co-Authored-by: Artem Trokhymchuk <a.trokhymchuk@inango-systems.com>
Signed-off-by: Artem Trokhymchuk <a.trokhymchuk@inango-systems.com>
This commit is contained in:
Mykola Hlukhenkyi 2025-11-11 11:12:25 +02:00 committed by Hela Saadani
parent cba2732964
commit 1517167df4
10 changed files with 348 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.gitlab/tests/cram/generic/acceleration-plan-components/110-data-model-mapper.t
View File

@ -51,10 +51,12 @@ Check command tree is available:
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.ModuleVersion=""
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.OptionalRoles=""
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.Password=""
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.RegisterTrustPaths=""
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.RequiredRoles=""
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.RetainData=0
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.URL=""
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.Username=""
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.X_PRPLWARE-COM_AutoMountIPC=""
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.NetworkConfig.
Device.X_PRPLWARE-COM_SoftwareModules.DeploymentUnitUpdateCmd.Input.NetworkConfig.AccessInterfaces=""
Device.X_PRPLWARE-COM_SoftwareModules.ExecEnvDeleteCmd.
@ -83,11 +85,13 @@ Check command tree is available:
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.OptionalRoles=""
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.Password=""
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.Privileged=1
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.RegisterTrustPaths=""
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.RequiredRoles=""
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.Signature=""
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.URL=""
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.UUID=""
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.Username=""
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.X_PRPLWARE-COM_AutoMountIPC=""
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.NetworkConfig.
Device.X_PRPLWARE-COM_SoftwareModules.InstallDUCmd.Input.NetworkConfig.AccessInterfaces=""
Device.X_PRPLWARE-COM_SoftwareModules.ModifyAvailableRolesCmd.

6
.gitlab/tests/cram/generic/fixtures/obuspa.expected
View File

@ -3080,11 +3080,13 @@ Device.SoftwareModules.DeploymentUnit.{i}.Update() input:NumRequiredUIDs
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:OptionalRoles
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:Password
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:Privileged
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:RegisterTrustPaths
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:RequiredRoles
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:RequiredUserRoles
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:RetainData
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:URL
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:Username
Device.SoftwareModules.DeploymentUnit.{i}.Update() input:X_PRPLWARE-COM_AutoMountIPC
Device.SoftwareModules.DeploymentUnit.{i}.Vendor proto::timingila
Device.SoftwareModules.DeploymentUnit.{i}.VendorConfigList proto::timingila
Device.SoftwareModules.DeploymentUnit.{i}.VendorLogList proto::timingila
@ -3193,6 +3195,7 @@ Device.SoftwareModules.ExecutionUnit.{i}.NetworkConfig.PortForwarding.{i}.Intern
Device.SoftwareModules.ExecutionUnit.{i}.NetworkConfig.PortForwarding.{i}.Protocol proto::timingila
Device.SoftwareModules.ExecutionUnit.{i}.NetworkConfig.X_PRPLWARE-COM_DNSSDRefList proto::timingila
Device.SoftwareModules.ExecutionUnit.{i}.References proto::timingila
Device.SoftwareModules.ExecutionUnit.{i}.RegisterTrustPaths proto::timingila
Device.SoftwareModules.ExecutionUnit.{i}.RequiredUserRoles proto::timingila
Device.SoftwareModules.ExecutionUnit.{i}.RunLevel proto::timingila
Device.SoftwareModules.ExecutionUnit.{i}.SetRequestedState() proto::timingila
@ -3203,6 +3206,7 @@ Device.SoftwareModules.ExecutionUnit.{i}.Vendor
Device.SoftwareModules.ExecutionUnit.{i}.VendorConfigList proto::timingila
Device.SoftwareModules.ExecutionUnit.{i}.VendorLogList proto::timingila
Device.SoftwareModules.ExecutionUnit.{i}.Version proto::timingila
Device.SoftwareModules.ExecutionUnit.{i}.X_PRPLWARE-COM_AutoMountIPC proto::timingila
Device.SoftwareModules.ExecutionUnitNumberOfEntries proto::timingila
Device.SoftwareModules.InstallDU() proto::timingila
Device.SoftwareModules.InstallDU() input:AllocatedCPUPercent
@ -3221,12 +3225,14 @@ Device.SoftwareModules.InstallDU() input:NumRequiredUIDs
Device.SoftwareModules.InstallDU() input:OptionalRoles
Device.SoftwareModules.InstallDU() input:Password
Device.SoftwareModules.InstallDU() input:Privileged
Device.SoftwareModules.InstallDU() input:RegisterTrustPaths
Device.SoftwareModules.InstallDU() input:RequiredRoles
Device.SoftwareModules.InstallDU() input:RequiredUserRoles
Device.SoftwareModules.InstallDU() input:Signature
Device.SoftwareModules.InstallDU() input:URL
Device.SoftwareModules.InstallDU() input:UUID
Device.SoftwareModules.InstallDU() input:Username
Device.SoftwareModules.InstallDU() input:X_PRPLWARE-COM_AutoMountIPC
Device.SoftwareModules.LocalManagement. proto::timingila
Device.SoftwareModules.LocalManagement.Action.{i}. proto::timingila
Device.SoftwareModules.LocalManagement.Action.{i}.Action proto::timingila

2
.gitlab/tests/cram/generic/lcm/035-lcm-usp.t
View File

@ -37,6 +37,7 @@ Check that UDS sockets and the random USP_ENDPOINT_ID are shared with the contai
$ R "${S} && execute_in_container --uuid --cmd \"ls /run/usp/\""
broker_agent_path
broker_controller_path
sockets
## TODO:
## add test to check connection to USP broker: This is requiring support of USP in the test container
@ -89,6 +90,7 @@ Check that UDS sockets and the random USP_ENDPOINT_ID are shared with the contai
$ R "${S} && execute_in_container --uuid --cmd \"ls /run/usp/\""
broker_agent_path
broker_controller_path
sockets
## TODO: add test to check connection to USP broker: This is requiring support of USP in the test container

199
.gitlab/tests/cram/generic/lcm/036-lcm-usp-auth.t Normal file
View File

@ -0,0 +1,199 @@
## Setup test configuration
Setup the test configuration:
$ alias R="${CRAM_REMOTE_COMMAND:-}"
$ alias C="${CRAM_REMOTE_COPY:-}"
$ S=". /tmp/script_functions.sh"
$ C ${TESTDIR}/script_functions.sh root@${TARGET_LAN_IP}:/tmp/script_functions.sh 2>/dev/null
## FIXME: `get_arch_name` function returns wrong arch name for freedom board
$ BOARD_ARCH=$(R "${S} && get_true_arch_name")
$ SERVICE_URL="docker://registry.gitlab.com/prpl-foundation/prplos/prplos/${BOARD_ARCH}/image-lcmsampleapp-auth-supported:latest"
Set-up ExecEnv configuration
$ R "${S} && set_ee_roles --roles \"Full Access\"" > /dev/null
$ R "${S} && check_available_roles --ee"
Device.LocalAgent.ControllerTrust.Role.1.
### TRUSTED SERVICE SECTION ###
Install the container and check its status and type:
$ R "${S} && install_ctr --url ${SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\"" > /dev/null
$ R "${S} && get_container_info --uuid"
Active
latest
prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob)
$ R "${S} && get_ctr_type --uuid"
Privileged container
Check that the container has the expected EndpointID, AutoMountIPC value:
$ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID")
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"$CTR_ID\"].AutoMountIPC?' | sed '/^$/d'"
USP_UDS_Unauthenticated
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"$CTR_ID\"].EndpointID?' | sed '/^$/d'"
uuid::* (glob)
$ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].X_PRPLWARE-COM_AutoMountIPC?' | sed '/^$/d'"
USP_UDS_Unauthenticated
$ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].RegisterTrustPaths?' | sed '/^$/d'"
Check that trusted UDS sockets are mounted in the container:
$ R "${S} && execute_in_container --uuid --cmd 'mount | grep usp'"
tmpfs on /run/usp type tmpfs* (glob)
Check that service model is accessible on USP bus:
$ R "usp-cli -lj Device.LCMSampleApp.? | sed '/^$/d'"
[{"Device.LCMSampleApp.":{"NumberOfDummyMultiInstances":0,"DummyGlobalString":"","DummyGlobalInt":0}}]
Stop the container and check its status:
$ R "${S} && stop_ctr --uuid" > /dev/null
$ R "${S} && get_container_info --uuid"
Idle
latest
prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob)
Uninstall the container and check everything is cleaned:
$ R "${S} && uninstall_ctr_and_check --uuid"
[1]
### UNTRUSTED SERVICE SECTION ###
Install the container as untrusted and check its status and type:
$ R "${S} && install_ctr --url ${SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspregisterpaths \"Device.LCMSampleApp.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null
$ R "${S} && get_container_info --uuid"
Active
latest
prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob)
$ R "${S} && get_ctr_type --uuid"
Privileged container
Check that the container has the expected EndpointID, AutoMountIPC and RegisterTrustPaths values:
$ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID")
$ CTR_ENDPOINTID=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'")
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'"
uuid::* (glob)
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].AutoMountIPC?' | sed '/^$/d'"
USP_UDS_Authenticated
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].RegisterTrustPaths?' | sed '/^$/d'"
Device.LCMSampleApp.
$ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].X_PRPLWARE-COM_AutoMountIPC?' | sed '/^$/d'"
USP_UDS_Authenticated
$ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].RegisterTrustPaths?' | sed '/^$/d'"
Device.LCMSampleApp.
Check that untrusted UDS sockets are mounted in the container:
$ R "${S} && execute_in_container --uuid --cmd 'mount | grep usp'"
tmpfs on /run/usp/sockets/authenticated/broker_controller* (glob)
tmpfs on /run/usp/sockets/authenticated/broker_agent* (glob)
Check that Device.USPServices.Trust model is filled on USP bus:
$ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.LCMSampleApp.","EndpointID":"*"}}] (glob)
Check that Device.UnixDomainSockets.Authentication model is filled on USP bus:
$ R "usp-cli -lj 'Device.UnixDomainSockets.Authentication.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{"Device.UnixDomainSockets.Authentication.*.":{"Enable":true,"Password":"*","EndpointID":"*"}}] (glob)
Check that service model is accessible on USP bus:
$ R "usp-cli -lj Device.LCMSampleApp.? | sed '/^$/d'"
[{"Device.LCMSampleApp.":{"NumberOfDummyMultiInstances":0,"DummyGlobalString":"","DummyGlobalInt":0}}]
Stop the container and check its status:
$ R "${S} && stop_ctr --uuid" > /dev/null
$ R "${S} && get_container_info --uuid"
Idle
latest
prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob)
Check that Device.USPServices.Trust instance still exists on USP bus:
$ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.LCMSampleApp.","EndpointID":"*"}}] (glob)
Check that Device.UnixDomainSockets.Authentication instance is removed from USP bus:
$ R "usp-cli -lj 'Device.UnixDomainSockets.Authentication.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{}]
Uninstall the container and check everything is cleaned:
$ R "${S} && uninstall_ctr_and_check --uuid"
[1]
$ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{}]
Check that trusted service can be updated to untrusted:
$ R "${S} && install_ctr --url ${SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\"" > /dev/null
$ R "${S} && get_container_info --uuid"
Active
latest
prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob)
$ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID")
$ CTR_ENDPOINTID=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'")
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'"
uuid::* (glob)
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].AutoMountIPC?' | sed '/^$/d'"
USP_UDS_Unauthenticated
$ R "${S} && update_ctr --url ${SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspregisterpaths \"Device.LCMSampleApp.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null
$ R "${S} && get_container_info --uuid"
Active
latest
prpl-foundation/prplos/prplos/*/image-lcmsampleapp* (glob)
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'"
uuid::* (glob)
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].AutoMountIPC?' | sed '/^$/d'"
USP_UDS_Authenticated
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].RegisterTrustPaths?' | sed '/^$/d'"
Device.LCMSampleApp.
$ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].X_PRPLWARE-COM_AutoMountIPC?' | sed '/^$/d'"
USP_UDS_Authenticated
$ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].RegisterTrustPaths?' | sed '/^$/d'"
Device.LCMSampleApp.
Check that EndpointID remains the same after update:
$ CTR_ENDPOINTID_UPDATED=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'")
$ [ ${CTR_ENDPOINTID} = ${CTR_ENDPOINTID_UPDATED} ] && echo 'OK' || echo 'FAIL'
OK
Check that untrusted UDS sockets are mounted in the container after update:
$ R "${S} && execute_in_container --uuid --cmd 'mount | grep usp'"
tmpfs on /run/usp/sockets/authenticated/broker_controller* (glob)
tmpfs on /run/usp/sockets/authenticated/broker_agent* (glob)
Check that Device.USPServices.Trust model is filled on USP bus after update:
$ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.LCMSampleApp.","EndpointID":"*"}}] (glob)
Check that Device.UnixDomainSockets.Authentication model is filled on USP bus after update:
$ R "usp-cli -lj 'Device.UnixDomainSockets.Authentication.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{"Device.UnixDomainSockets.Authentication.*.":{"Enable":true,"Password":"*","EndpointID":"*"}}] (glob)
Check that service model is accessible on USP bus after update:
$ R "usp-cli -lj Device.LCMSampleApp.? | sed '/^$/d'"
[{"Device.LCMSampleApp.":{"NumberOfDummyMultiInstances":0,"DummyGlobalString":"","DummyGlobalInt":0}}]
Uninstall the container and check everything is cleaned:
$ R "${S} && uninstall_ctr_and_check --uuid"
[1]
$ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{}]

70
.gitlab/tests/cram/generic/lcm/036-lcm-usp-restrictions.t Normal file
View File

@ -0,0 +1,70 @@
## Setup test configuration
Setup the test configuration:
$ alias R="${CRAM_REMOTE_COMMAND:-}"
$ alias C="${CRAM_REMOTE_COPY:-}"
$ S=". /tmp/script_functions.sh"
$ C ${TESTDIR}/script_functions.sh root@${TARGET_LAN_IP}:/tmp/script_functions.sh 2>/dev/null
## FIXME: `get_arch_name` function returns wrong arch name for freedom board
$ BOARD_ARCH=$(R "${S} && get_true_arch_name")
$ READER_SERVICE_URL="docker://registry.gitlab.com/prpl-foundation/prplos/prplos/${BOARD_ARCH}/image-trusted-reader:latest"
$ PROVIDER_SERVICE_URL="docker://registry.gitlab.com/prpl-foundation/prplos/prplos/${BOARD_ARCH}/image-trusted-provider:latest"
Set-up ExecEnv configuration
$ R "${S} && set_ee_roles --roles \"Full Access\",\"Untrusted\"" > /dev/null
$ R "${S} && check_available_roles --ee"
Device.LocalAgent.ControllerTrust.Role.1.,Device.LocalAgent.ControllerTrust.Role.2.
### RESTRICTIONS CHECK ###
Check that untrusted service cannot read the data from USP bus when RequiredRoles is "Untrusted":
$ R "${S} && install_ctr --url ${READER_SERVICE_URL} --ee --uuid --privileged true --usprequired \"Untrusted\" --uspregisterpaths \"Device.TrustedReader.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null
$ R "${S} && get_container_info --uuid"
Active
latest
prpl-foundation/prplos/prplos/*/image-trusted-reader (glob)
$ R "usp-cli -lj 'Device.TrustedReader.?' | sed '/^$/d'"
[{"Device.TrustedReader.":{"ParamPath":"Device.DeviceInfo.SerialNumber","ParamValue":"","ErrorCode":1}}]
Uninstall the reader service:
$ R "${S} && uninstall_ctr_and_check --uuid"
[1]
Check that untrusted service cannot register model on USP bus when RegisterTrustPaths is empty:
$ R "${S} && install_ctr --url ${PROVIDER_SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null
$ R "${S} && get_container_info --uuid"
Active
latest
prpl-foundation/prplos/prplos/*/image-trusted-provider (glob)
$ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID")
$ CTR_ENDPOINTID=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'")
$ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{}]
$ R "usp-cli 'gsdm Device.' | grep TrustedProvider | sed '/^$/d'"
Update the RegisterTrustPaths parameter for service and check that untrusted service can register only allowed paths on USP bus:
$ R "${S} && update_ctr --url ${PROVIDER_SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspregisterpaths \"Device.TrustedProvider1.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null
$ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.TrustedProvider1.","EndpointID":"*"}}] (glob)
$ R "usp-cli 'gsdm Device.' | grep TrustedProvider | sed '/^$/d'"
... (Object ) Device.TrustedProvider1.
Update the RegisterTrustPaths parameter with several paths and check that untrusted service can register only allowed paths on USP bus:
$ R "${S} && update_ctr --url ${PROVIDER_SERVICE_URL} --ee --uuid --privileged true --usprequired \"Full Access\" --uspregisterpaths \"Device.TrustedProvider1.,Device.TrustedProvider2.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null
$ R "usp-cli -lj 'Device.USPServices.Trust.[EndpointID==\"${CTR_ENDPOINTID}\"].?' | sed '/^$/d'"
[{"Device.USPServices.Trust.*.":{"TargetPaths":"Device.TrustedProvider1.,Device.TrustedProvider2.","EndpointID":"*"}}] (glob)
$ R "usp-cli 'gsdm Device.' | grep TrustedProvider | sed '/^$/d'"
... (Object ) Device.TrustedProvider1.
... (Object ) Device.TrustedProvider2.
Uninstall the provider service:
$ R "${S} && uninstall_ctr_and_check --uuid"
[1]

27
.gitlab/tests/cram/generic/lcm/038-lcm-pcm.t
View File

@ -28,7 +28,7 @@ Create a user role with capabilities:
Install the container in privileged mode with extra LCM features and check its status and type:
$ R "${S} && install_ctr --version prplos-v1 --ee --uuid --privileged true --network --hostobject --envvar --appdata --usprequired \"Full Access\" --userroles full_caps" > /dev/null
$ R "${S} && install_ctr --version prplos-v1 --ee --uuid --privileged true --network --hostobject --envvar --appdata --usprequired \"Full Access\" --userroles full_caps --uspregisterpaths \"Device.LCMSampleApp.\" --uspautomountipc \"USP_UDS_Authenticated\"" > /dev/null
$ R "${S} && get_container_info --uuid"
Active
prplos-v1
@ -100,13 +100,15 @@ Verify that the EnvVariables were properly restored:
$ R "${S} && execute_in_container --uuid --cmd \"env\" | grep ENVVAR_KEY2"
ENVVAR_KEY2=ENVVAR_VALUE2
Check that UDS sockets and the random USP_ENDPOINT_ID are shared with the container:
Check that UDS sockets and the random USP_ENDPOINT_ID with USP_PASSWORD are shared with the container:
$ R "${S} && execute_in_container --uuid --cmd \"env\" | grep USP_ENDPOINT_ID"
USP_ENDPOINT_ID=uuid::* (glob)
$ R "${S} && execute_in_container --uuid --cmd \"ls /run/usp/\""
broker_agent_path
broker_controller_path
$ R "${S} && execute_in_container --uuid --cmd \"env\" | grep USP_PASSWORD"
USP_PASSWORD=* (glob)
$ R "${S} && execute_in_container --uuid --cmd 'mount | grep usp'"
tmpfs on /run/usp/sockets/authenticated/broker_controller* (glob)
tmpfs on /run/usp/sockets/authenticated/broker_agent* (glob)
Check that the container has the required capabilities:
$ R "${S} && execute_in_container --uuid --cmd 'grep CapEff /proc/1/status'"
@ -124,6 +126,21 @@ Check NetworkConfig correctly applied:
1
default via 192.168.*.1 dev lcm0* (glob)
Check that the container has the expected EndpointID, AutoMountIPC and RegisterTrustPaths values:
$ CTR_ID=$(R "${S} && get_container_parameter --uuid --param EUID")
$ CTR_ENDPOINTID=$(R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'")
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].EndpointID?' | sed '/^$/d'"
uuid::* (glob)
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].AutoMountIPC?' | sed '/^$/d'"
USP_UDS_Authenticated
$ R "ba-cli -l 'Cthulhu.Container.Instances.[ContainerId==\"${CTR_ID}\"].RegisterTrustPaths?' | sed '/^$/d'"
Device.LCMSampleApp.
$ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].X_PRPLWARE-COM_AutoMountIPC?' | sed '/^$/d'"
USP_UDS_Authenticated
$ R "ba-cli -l 'Device.SoftwareModules.ExecutionUnit.[EUID==\"$CTR_ID\"].RegisterTrustPaths?' | sed '/^$/d'"
Device.LCMSampleApp.
Update to prplOS container to v2:
$ R "${S} && update_ctr --version prplos-v2 --ee --uuid --privileged true" > /dev/null

38
.gitlab/tests/cram/generic/lcm/script_functions.sh
View File

@ -11,6 +11,10 @@ DEFAULT_URL="docker://registry.gitlab.com/prpl-foundation/prplos/prplos"
DEFAULT_USPROLES="Full Access"
DEFAULT_USPREQUIRED="Full Access"
DEFAULT_USPOPTIONAL=""
DEFAULT_USPREGISTERPATHS=""
DEFAULT_USPAUTOMOUNTIPC="USP_UDS_Unauthenticated"
DEFAULT_USERNAME=""
DEFAULT_PASSWORD=""
DEFAULT_RETAINDATA="false"
DEFAULT_ENVVAR='[{Key="ENVVAR_KEY1", Value="ENVVAR_VALUE1"}, {Key="ENVVAR_KEY2", Value="ENVVAR_VALUE2"}]'
@ -91,6 +95,28 @@ get_arch_name() {
esac
}
## FIXME: `get_arch_name` function returns wrong arch name for freedom board
## Return the architecture name for the board, used for selecting the correct container image from registry
get_true_arch_name() {
board_name=$(cut -d',' -f2 </tmp/sysinfo/board_name)
case "${board_name}" in
"haze" | \
"freedom")
echo arm64v8
;;
"lgm" | \
"qemu-standard-pc-"*)
echo amd64
;;
"turris-omnia")
echo cortexa9
;;
*)
echo arm32v7
;;
esac
}
## Return architecture name for the board
get_board_arch() {
board_name=$(cut -d',' -f2 </tmp/sysinfo/board_name)
@ -293,6 +319,18 @@ install_update_ctr_with_params() {
elif [ "${key}" = "uspeoptional" ]; then
value=$(value_or_default "${value_missing}" "${DEFAULT_USPOPTIONAL}" "${value}")
str_params=$(concat_comma_string "${str_params}" "OptionalRoles = \"${value}\"")
elif [ "${key}" = "uspregisterpaths" ]; then
value=$(value_or_default "${value_missing}" "${DEFAULT_USPREGISTERPATHS}" "${value}")
str_params=$(concat_comma_string "${str_params}" "RegisterTrustPaths = \"${value}\"")
elif [ "${key}" = "uspautomountipc" ]; then
value=$(value_or_default "${value_missing}" "${DEFAULT_USPAUTOMOUNTIPC}" "${value}")
str_params=$(concat_comma_string "${str_params}" "X_PRPLWARE-COM_AutoMountIPC = \"${value}\"")
elif [ "${key}" = "username" ]; then
value=$(value_or_default "${value_missing}" "${DEFAULT_USERNAME}" "${value}")
str_params=$(concat_comma_string "${str_params}" "Username = \"${value}\"")
elif [ "${key}" = "password" ]; then
value=$(value_or_default "${value_missing}" "${DEFAULT_PASSWORD}" "${value}")
str_params=$(concat_comma_string "${str_params}" "Password = \"${value}\"")
elif [ "${key}" = "privileged" ]; then
value=$(value_or_default "${value_missing}" "${DEFAULT_PRIVILEGED}" "${value}")
str_params=$(concat_comma_string "${str_params}" "Privileged = ${value}")

1
.gitlab/tests/cram/generic/verify-config-restore/020-verify-backup-restore-flags.t
View File

@ -13,6 +13,7 @@ PPW-1729, PPW-1731 and PPW-1786:
/etc/amx/cthulhu/extensions/plugin-capabilities/plugin-capabilities-definition.odl
/etc/amx/cthulhu/extensions/plugin-networking/plugin-networking-definition.odl
/etc/amx/cthulhu/extensions/plugin-pcm/plugin-pcm-definition.odl
/etc/amx/cthulhu/extensions/plugin-usp/plugin-usp-definition.odl
/etc/amx/ethernet-manager/ethernet-manager_interface.odl
/etc/amx/gmap-server/mibs/dhcp.odl
/etc/amx/prplmesh-process-manager/prplmesh-process-manager_definition.odl

3
.gitlab/tests/cram/mxl25641-hdk-6/005-build-config.t
View File

@ -514,6 +514,7 @@ Assure expected build configuration (PCF-1413):
CONFIG_PACKAGE_libopenssl-conf=y
CONFIG_PACKAGE_libp11=y
CONFIG_PACKAGE_libpacket-interception=y
CONFIG_PACKAGE_libpass=y
CONFIG_PACKAGE_libpci=y
CONFIG_PACKAGE_libpcp=y
CONFIG_PACKAGE_libpcre2=y
@ -848,6 +849,7 @@ Assure expected build configuration (PCF-1413):
CONFIG_PKG_CC_STACKPROTECTOR_STRONG=y
# CONFIG_PKG_FORTIFY_SOURCE_1 is not set
CONFIG_PKG_FORTIFY_SOURCE_2=y
CONFIG_PLUGIN_USP_PASSWORD_LENGTH=32
CONFIG_PON_SDK_VERSION="2.1.0"
CONFIG_PRPLMESH_DM_MAPPER_START_ORDER=99
CONFIG_PRPLMESH_DM_MAPPER_STOP_ORDER=0
@ -1129,6 +1131,7 @@ Assure expected build configuration (PCF-1413):
CONFIG_SAH_MOD_SAHTRACE_DEFAULT_LOG_LEVEL=200
CONFIG_SAH_MOD_SAHTRACE_DEFAULT_TRACE_ZONE_LEVEL=200
CONFIG_SAH_ODLGEN=y
CONFIG_SAH_PLUGIN_CTHULHU_USP=y
CONFIG_SAH_REBOOT_SERVICE=y
CONFIG_SAH_REBOOT_SERVICE_RUN_AS_GROUP="tr181_app"
CONFIG_SAH_REBOOT_SERVICE_RUN_AS_USER="tr181_app"

3
.gitlab/tests/cram/wnc-freedom/005-build-config.t
View File

@ -329,6 +329,7 @@ Assure expected build configuration (PCF-1413):
CONFIG_PACKAGE_libopensc=y
CONFIG_PACKAGE_libp11=y
CONFIG_PACKAGE_libpacket-interception=y
CONFIG_PACKAGE_libpass=y
CONFIG_PACKAGE_libpci=y
CONFIG_PACKAGE_libpcp=y
CONFIG_PACKAGE_libpcre2=y
@ -621,6 +622,7 @@ Assure expected build configuration (PCF-1413):
CONFIG_PKG_CC_STACKPROTECTOR_STRONG=y
# CONFIG_PKG_FORTIFY_SOURCE_1 is not set
CONFIG_PKG_FORTIFY_SOURCE_2=y
CONFIG_PLUGIN_USP_PASSWORD_LENGTH=32
CONFIG_PRPLMESH_DM_MAPPER_START_ORDER=99
CONFIG_PRPLMESH_DM_MAPPER_STOP_ORDER=0
CONFIG_PRPLMESH_ENABLE_UNIT_TESTS=y
@ -901,6 +903,7 @@ Assure expected build configuration (PCF-1413):
CONFIG_SAH_MOD_SAHTRACE_DEFAULT_LOG_LEVEL=200
CONFIG_SAH_MOD_SAHTRACE_DEFAULT_TRACE_ZONE_LEVEL=200
CONFIG_SAH_ODLGEN=y
CONFIG_SAH_PLUGIN_CTHULHU_USP=y
CONFIG_SAH_REBOOT_SERVICE=y
CONFIG_SAH_REBOOT_SERVICE_RUN_AS_GROUP="tr181_app"
CONFIG_SAH_REBOOT_SERVICE_RUN_AS_USER="tr181_app"