From 6c72ca35befc789e4e13460f632d15bb4c7b43df Mon Sep 17 00:00:00 2001 From: Sam Maes Date: Thu, 28 Aug 2025 18:28:18 +0200 Subject: [PATCH] ci: cram: add test for USB filtering + update existing usb test Add initial test for USB filtering This test checks: - Whether the SanDisk USB flash disk is present and authorized, - Authorization and unauthorization works by checking the authorized file and DM - Simulates unplugging and plugging back in the device to see if new devices are authorized correctly References: PCF-1247 Signed-off-by: Sam Maes (cherry picked from commit 2e25c9cb1157b27f34106bea38856ae9a92123d1) --- .../040-usb-filter.t | 153 ++++++++++++++++++ .../acceleration-plan-components/025-usb.t | 55 ++++--- .../acceleration-plan-components/025-usb.t | 55 ++++--- 3 files changed, 211 insertions(+), 52 deletions(-) create mode 100644 .gitlab/tests/cram/generic/acceleration-plan-components/040-usb-filter.t diff --git a/.gitlab/tests/cram/generic/acceleration-plan-components/040-usb-filter.t b/.gitlab/tests/cram/generic/acceleration-plan-components/040-usb-filter.t new file mode 100644 index 0000000000..53c6585c5c --- /dev/null +++ b/.gitlab/tests/cram/generic/acceleration-plan-components/040-usb-filter.t @@ -0,0 +1,153 @@ +Create R alias: + + $ alias R="${CRAM_REMOTE_COMMAND:-}" + +If test is running on a Mozart, Turris, OSPv1 or Haze, lets skip the test as there is no USB storage device attached: + + $ if echo "$CI_JOB_NAME" | grep -q -E "(Mozart|Turris|Haze|HDK-3)"; then exit 80; fi + +Create alias for finding SysfsId: + + $ export ID=$(if echo "$CI_JOB_NAME" | grep -q -E "Freedom"; then echo "2-1.2"; else echo "2-1"; fi) + +Make sure the USB device is plugged in: + + $ R "test -d /sys/bus/usb/devices/$(echo $ID) && echo OK" + OK + +Simulate unplugging USB flash disk: + + $ R "echo \"$(echo $ID)\" | tee /sys/bus/usb/drivers/usb/unbind" + [0-9]+\-[0-9]+(\.[0-9]+)? (re) + +Simulate plugging USB flash disk in to be sure it is recognized: + + $ R "echo \"$(echo $ID)\" | tee /sys/bus/usb/drivers/usb/bind" + [0-9]+\-[0-9]+(\.[0-9]+)? (re) + +Wait for DM to update: + + $ sleep 5 + +Assure SanDisk USB flash disk is plugged in and allowed: + + $ R 'ba-cli -lj "ubus-protected;USB.USBHosts.Host.2.Device.[ProductClass==\"SanDisk 3.2Gen1\"].?" 2>&1 | grep -v "^>" | sed -n "4p"' | jq . + [ + { + "USB.USBHosts.Host.2.Device.[0-9]+.": { (re) + "Port": 1, + "DeviceClass": "00", + "VendorID": 1921, + "ProductID": 21905, + "IsSelfPowered": 0, + "SysfsId": "2-1(\.2)?", (re) + "Rate": "Super", + "Parent": "", + "SysDevName": "/dev/(2-1(\.2)?|sda)", (re) + "USBVersion": "3.20", + "IsSuspended": 0, + "USBPort": "Device.USB.Port.1.", + "ProductClass": "SanDisk 3.2Gen1", + "SerialNumber": "*", (glob) + "DeviceProtocol": "00", + "ConfigurationNumberOfEntries": 1, + "Manufacturer": "USB", + "DeviceSubClass": "00", + "DeviceVersion": 100, + "IsAllowed": 1, + "DeviceNumber": 2, + "MaxChildren": 0 + }, + "USB.USBHosts.Host.2.Device.[0-9]+.Configuration.": {}, (re) + "USB.USBHosts.Host.2.Device.[0-9]+.Configuration.1.Interface.1.": { (re) + "InterfaceClass": "08", + "InterfaceProtocol": "50", + "InterfaceSubClass": "06", + "InterfaceNumber": 0 + }, + "USB.USBHosts.Host.2.Device.[0-9]+.Configuration.1.": { (re) + "ConfigurationNumber": 1, + "InterfaceNumberOfEntries": 1 + }, + "USB.USBHosts.Host.2.Device.[0-9]+.Configuration.1.Interface.": {} (re) + } + ] + +Disallow all USB devices: + + $ R "ba-cli -ajl 'USB.USBHosts.AllowAllDevices=0' | awk NF" + [{"USB.USBHosts.":{"AllowAllDevices":0}}] + +Check USB flash disk is no longer allowed: + + $ R 'ba-cli -al "ubus-protected;USB.USBHosts.Host.2.Device.[ProductClass==\"SanDisk 3.2Gen1\"].IsAllowed?" 2>&1 ' | grep -v "^>" | sed -n "4p" | awk NF + 0 + + $ R "cat /sys/bus/usb/devices/$(echo $ID)/authorized" + 0 + +Simulate unplugging USB flash disk: + + $ R "echo \"$(echo $ID)\" | tee /sys/bus/usb/drivers/usb/unbind" + [0-9]+\-[0-9]+(\.[0-9]+)? (re) + +Simulate plugging USB flash disk in again: + + $ R "echo \"$(echo $ID)\" | tee /sys/bus/usb/drivers/usb/bind" + [0-9]+\-[0-9]+(\.[0-9]+)? (re) + +Check USB flash disk is no longer allowed: + + $ R 'ba-cli -al "ubus-protected;USB.USBHosts.Host.2.Device.[ProductClass==\"SanDisk 3.2Gen1\"].IsAllowed?" 2>&1 ' | grep -v "^>" | sed -n "4p" | awk NF + 0 + + $ R "cat /sys/bus/usb/devices/$(echo $ID)/authorized" + 0 + +Add whitelist instance to allow USB flash disk: + + $ R "ba-cli -ajl 'USB.USBHosts.AllowedDevice.+{Alias=\"usb-flash\", Enable=true, DeviceClass=\"00\",DeviceProtocol=\"00\", DeviceSubClass=\"00\", ProductID=\"5591\",VendorID=\"781\", Interfaces=\"08:06:50\"}' | awk NF" + {"USB\.USBHosts\.AllowedDevice\.[0-9]+\.":{"Alias":"usb-flash"}} (re) + +Check USB flash disk is allowed: + + $ R 'ba-cli -al "ubus-protected;USB.USBHosts.Host.2.Device.[ProductClass==\"SanDisk 3.2Gen1\"].IsAllowed?" 2>&1 ' | grep -v "^>" | sed -n "4p" | awk NF + 1 + + $ R "cat /sys/bus/usb/devices/$(echo $ID)/authorized" + 1 + +Allow all USB devices again: + + $ R "ba-cli -ajl 'USB.USBHosts.AllowAllDevices=1' | awk NF" + [{"USB.USBHosts.":{"AllowAllDevices":1}}] + +Check USB flash disk is allowed: + + $ R 'ba-cli -al "ubus-protected;USB.USBHosts.Host.2.Device.[ProductClass==\"SanDisk 3.2Gen1\"].IsAllowed?" 2>&1 ' | grep -v "^>" | sed -n "4p" | awk NF + 1 + + $ R "cat /sys/bus/usb/devices/$(echo $ID)/authorized" + 1 + +Remove whitelist entry: + + $ R "ba-cli -ajl 'USB.USBHosts.AllowedDevice.usb-flash.-' | awk NF" + ["USB\.USBHosts\.AllowedDevice\.[0-9]+\."] (re) + +Check USB flash disk is allowed: + + $ R 'ba-cli -al "ubus-protected;USB.USBHosts.Host.2.Device.[ProductClass==\"SanDisk 3.2Gen1\"].IsAllowed?" 2>&1 ' | grep -v "^>" | sed -n "4p" | awk NF + 1 + + $ R "cat /sys/bus/usb/devices/$(echo $ID)/authorized" + 1 + +Cleanup: Unplug and replug to have a clean USB DM after the test: + + $ R "echo \"$(echo $ID)\" | tee /sys/bus/usb/drivers/usb/unbind" + [0-9]+\-[0-9]+(\.[0-9]+)? (re) + + $ R "echo \"$(echo $ID)\" | tee /sys/bus/usb/drivers/usb/bind" + [0-9]+\-[0-9]+(\.[0-9]+)? (re) + diff --git a/.gitlab/tests/cram/mxl25641-hdk-6/acceleration-plan-components/025-usb.t b/.gitlab/tests/cram/mxl25641-hdk-6/acceleration-plan-components/025-usb.t index ae404cae4f..3f8c45b04f 100644 --- a/.gitlab/tests/cram/mxl25641-hdk-6/acceleration-plan-components/025-usb.t +++ b/.gitlab/tests/cram/mxl25641-hdk-6/acceleration-plan-components/025-usb.t @@ -16,28 +16,9 @@ Assure USB. datamodel content with single SanDisk USB flash disk plugged in: "Type": "Host", "Receptacle": "Standard-A" }, - "USB.USBHosts.Host.2.Device.1.": { - "Port": 1, - "DeviceClass": "00", - "VendorID": 1921, - "ProductID": 21905, - "IsSelfPowered": 0, - "Rate": "Super", - "Parent": "", - "USBVersion": "3.20", - "IsSuspended": 0, - "USBPort": "Device.USB.Port.1.", - "ProductClass": "SanDisk 3.2Gen1", - "SerialNumber": "*", (glob) - "ConfigurationNumberOfEntries": 1, - "DeviceProtocol": "00", - "Manufacturer": "USB", - "DeviceSubClass": "00", - "DeviceVersion": 100, - "DeviceNumber": 2, - "MaxChildren": 0 - }, "USB.USBHosts.": { + "AllowAllDevices": 1, + "AllowedDeviceNumberOfEntries": 0, "HostNumberOfEntries": 2 }, "USB.USBHosts.Host.1.": { @@ -79,20 +60,38 @@ Assure USB. datamodel content with single SanDisk USB flash disk plugged in: "DiscardPacketsSent": 0, "BroadcastPacketsReceived": 0 }, - "USB.USBHosts.Host.2.Device.1.Configuration.1.": { - "ConfigurationNumber": 1, - "InterfaceNumberOfEntries": 1 - }, "USB.": { "InterfaceNumberOfEntries": 1, "PortNumberOfEntries": 1 }, - "USB.USBHosts.Host.2.Device.1.Configuration.1.Interface.1.": { + "USB.USBHosts.Host.2.Device.[0-9]+.Configuration.1.Interface.1.": { (re) "InterfaceClass": "08", "InterfaceProtocol": "50", "InterfaceSubClass": "06", "InterfaceNumber": 0 }, + "USB.USBHosts.Host.2.Device.[0-9]+.": { (re) + "Port": 1, + "DeviceClass": "00", + "VendorID": 1921, + "ProductID": 21905, + "IsSelfPowered": 0, + "Rate": "Super", + "Parent": "", + "USBVersion": "3.20", + "IsSuspended": 0, + "USBPort": "Device.USB.Port.1.", + "ProductClass": "SanDisk 3.2Gen1", + "SerialNumber": "*", (glob) + "ConfigurationNumberOfEntries": 1, + "DeviceProtocol": "00", + "Manufacturer": "USB", + "DeviceSubClass": "00", + "DeviceVersion": 100, + "IsAllowed": 1, + "DeviceNumber": 2, + "MaxChildren": 0 + }, "USB.USBHosts.Host.2.": { "USBVersion": "3.20", "DeviceNumberOfEntries": 1, @@ -103,5 +102,9 @@ Assure USB. datamodel content with single SanDisk USB flash disk plugged in: "Alias": "usb-Host-2", "Type": "xHCI" } + "USB.USBHosts.Host.2.Device.[0-9]+.Configuration.1.": { (re) + "ConfigurationNumber": 1, + "InterfaceNumberOfEntries": 1 + }, } ] diff --git a/.gitlab/tests/cram/wnc-freedom/acceleration-plan-components/025-usb.t b/.gitlab/tests/cram/wnc-freedom/acceleration-plan-components/025-usb.t index 5980f4919b..724847d659 100644 --- a/.gitlab/tests/cram/wnc-freedom/acceleration-plan-components/025-usb.t +++ b/.gitlab/tests/cram/wnc-freedom/acceleration-plan-components/025-usb.t @@ -16,28 +16,9 @@ Assure USB. datamodel content with single SanDisk USB flash disk plugged in: "Type": "Host", "Receptacle": "Standard-A" }, - "USB.USBHosts.Host.2.Device.1.": { - "Port": 1, - "DeviceClass": "00", - "VendorID": 1921, - "ProductID": 21905, - "IsSelfPowered": 0, - "Rate": "Super", - "Parent": "", - "USBVersion": "3.20", - "IsSuspended": 0, - "USBPort": "Device.USB.Port.1.", - "ProductClass": "SanDisk 3.2Gen1", - "SerialNumber": "*", (glob) - "ConfigurationNumberOfEntries": 1, - "DeviceProtocol": "00", - "Manufacturer": "USB", - "DeviceSubClass": "00", - "DeviceVersion": 100, - "DeviceNumber": 2, - "MaxChildren": 0 - }, "USB.USBHosts.": { + "AllowAllDevices": 1, + "AllowedDeviceNumberOfEntries": 0, "HostNumberOfEntries": 2 }, "USB.USBHosts.Host.1.": { @@ -79,20 +60,38 @@ Assure USB. datamodel content with single SanDisk USB flash disk plugged in: "DiscardPacketsSent": 0, "BroadcastPacketsReceived": 0 }, - "USB.USBHosts.Host.2.Device.1.Configuration.1.": { - "ConfigurationNumber": 1, - "InterfaceNumberOfEntries": 1 - }, "USB.": { "InterfaceNumberOfEntries": 1, "PortNumberOfEntries": 1 }, - "USB.USBHosts.Host.2.Device.1.Configuration.1.Interface.1.": { + "USB.USBHosts.Host.2.Device.[0-9]+.Configuration.1.Interface.1.": { (re) "InterfaceClass": "08", "InterfaceProtocol": "50", "InterfaceSubClass": "06", "InterfaceNumber": 0 }, + "USB.USBHosts.Host.2.Device.[0-9]+.": { (re) + "Port": 1, + "DeviceClass": "00", + "VendorID": 1921, + "ProductID": 21905, + "IsSelfPowered": 0, + "Rate": "Super", + "Parent": "", + "USBVersion": "3.20", + "IsSuspended": 0, + "USBPort": "Device.USB.Port.1.", + "ProductClass": "SanDisk 3.2Gen1", + "SerialNumber": "*", (glob) + "ConfigurationNumberOfEntries": 1, + "DeviceProtocol": "00", + "Manufacturer": "USB", + "DeviceSubClass": "00", + "DeviceVersion": 100, + "IsAllowed": 1, + "DeviceNumber": 2, + "MaxChildren": 0 + }, "USB.USBHosts.Host.2.": { "USBVersion": "3.20", "DeviceNumberOfEntries": 1, @@ -103,5 +102,9 @@ Assure USB. datamodel content with single SanDisk USB flash disk plugged in: "Alias": "usb-Host-2", "Type": "xHCI" } + "USB.USBHosts.Host.2.Device.[0-9]+.Configuration.1.": { (re) + "ConfigurationNumber": 1, + "InterfaceNumberOfEntries": 1 + }, } ]