Checksec is a bash script to check the properties of executables (like
PIE, RELRO, Canaries, ASLR, Fortify Source).
Add an optional build feature, which when enabled is going to create a
JSON report about the state of mitigations in the produced binaries.
Upstream-Status: Submitted [https://github.com/openwrt/openwrt/pull/14569]
Signed-off-by: Cedric DOURLENT <cedric.dourlent@softathome.com>
Checksec is a bash script to check the properties of executables (like
PIE, RELRO, Canaries, ASLR, Fortify Source). We're going to use it for
reports later.
Upstream-Status: Submitted [https://github.com/openwrt/openwrt/pull/14569]
Signed-off-by: Cedric DOURLENT <cedric.dourlent@softathome.com>
Every time we make a build, the cram tests are executed automatically.
Because of this, tests are often excecuted while not needed and test
capacity is occupied for nothing.
Let's adapt this so that we manually need to trigger the test jobs if we
would like to excecute cram tests.
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
When running the changes done in commit 140ad37e2ab0 ("cdrouter:
wireless: make wifiBeaconPhy configurable"), we can see:
Traceback (most recent call last):
File ".gitlab/scripts/testbed-cdrouter.py", line 441, in <module>
main()
File ".gitlab/scripts/testbed-cdrouter.py", line 437, in main
args.func(cdr)
File ".gitlab/scripts/testbed-cdrouter.py", line 345, in config_import
content = self.replace_env_config_variables(content)
File ".gitlab/scripts/testbed-cdrouter.py", line 330, in replace_env_config_variables
text = re.sub(pattern, value, text)
File "/usr/lib/python3.7/re.py", line 192, in sub
return _compile(pattern, flags).sub(repl, string, count)
TypeError: cannot use a string pattern on a bytes-like object
The re.sub() command fails because a non utf-8 encoded string is
passed. Let's therefore adapt the method that is called for opening a
file to always return a utf-8 decoded string.
Fixes: 140ad37e2ab0 ("cdrouter: wireless: make wifiBeaconPhy configurable")
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
With the new wnc-freedom wifi7 box, the wifiBeaconPhy testvar of CDRouter needs to include "be" as well. Let's make this configurable in the CI by introducing a CDROUTER_CONFIG_WIFI_BEACON_PHY variable that can be set uniquely for every box.
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
The mod-xpon-prpl package was moved to feed_net_core, so let's use the
mock package coming from this feed as well.
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
amx-faultmonitor and reboot-service are new components that have been
introduced for prplos 3.1 release. Recently a Device. mapping was added
to the components:
a92bd2ca60d29c365762
Let's update the test for the newly added Device. mappings.
Signed-off-by: Yüce Kürüm <yuce.kurum@mind.be>
Signed-off-by: Yüce Kürüm <yuce.kurum_ext@softathome.com>
The default timeout of one hour is not sufficient anymore. We regularly
see timeouts because build times are exceeding this one hour time limit.
So lets workaround it by increasing the build timeout to 2 hours.
References: PCF-1342
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
The mcastd features were added, so let's update the datamodel tests to
include mcastd related entries.
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
Sets CONFIG_SAH_MOD_AMXB_USP_REQUIRES_DEVICE_PREFIX=y to ensure all
requests contain a Device prefix before they are sent to avoid
communication overhead.
Signed-off-by: Johan Jacobs <johan.jacobs_ext@softathome.com>
Because of the changed output of ba-cli, outputs are not correctly
selected.
Update the test with the new format.
Signed-off-by: Yüce Kürüm <yuce.kurum@mind.be>
Signed-off-by: Yüce Kürüm <yuce.kurum_ext@softathome.com>
There are no tests for checking the DNS Service Discovery functionality.
In order to properly test tr181-dnssd we need to extract the services
from the responses.
`nmap -sU --script=dns-service-discovery -p5353 192.168.1.1` is supposed
to that, but advertised services don't show up in the command output.
We can still see them in the packet capture:
14:40:31.631478 IP 192.168.1.2.53064 > 192.168.1.1.5353: 0 PTR (QM)? _services._dns-sd._udp.local. (46)
14:40:31.634862 IP 192.168.1.1.5353 > 224.0.0.251.5353: 0*- [0q] 1/0/0 A 192.168.1.1 (44)
14:40:31.634862 IP 192.168.1.1.5353 > 224.0.0.251.5353: 0*- [0q] 1/0/0 PTR _mqtt._tcp.local. (70)
14:40:31.634862 IP 192.168.1.1.5353 > 224.0.0.251.5353: 0*- [0q] 1/0/0 PTR prplOS.lan._mqtt._tcp.local. (69)
14:40:31.634862 IP 192.168.1.1.5353 > 224.0.0.251.5353: 0*- [0q] 2/0/0 SRV prplOS.lan.local.:0 1648 29296, TXT "From=sah" (123)
Until we can find a way to properly check the advertised services, let's
at least make sure that the basic functionality is there.
For this purpose:
- Check DM entry.
- Check firewall rules
- Check if service responds
Signed-off-by: Yüce Kürüm <yuce.kurum@mind.be>
Signed-off-by: Yüce Kürüm <yuce.kurum_ext@softathome.com>
also remove pgrep to hostapd process as that returns the actual process that can't be predicted
Signed-off-by: Mohammed SI ALI <mohammed.siali@softathome.com>
* remove wlan2.2 interface as there's no endpoint deployed here
PS: this will be discussed in PPW-18 and from there we will adapt test configuration to whatever will be the right way of doing things.
Signed-off-by: Mohammed SI ALI <mohammed.siali@softathome.com>
CurrentTestInterval was being overwritten during the test blindly.
Save the CurrentTestInterval value so it can be restored at the end of
the test.
Also process check time can vary depending on the test count. This might
become a problem if test counts increase. Instead of waiting for a fixed
timeout, let's calculate reactivation_timeout with current test count
and use that as a timeout for process restart.
Signed-off-by: Yüce Kürüm <yuce.kurum@mind.be>
Signed-off-by: Yüce Kürüm <yuce.kurum_ext@softathome.com>
New CRAM tests are for following packages:
- amx-faultmonitor
- reboot-service
- tr181-mqttbroker
Here are short descriptions of what the new tests are doing
amx-faultmonitor:
- Get a list of current fault entries.
- Start a dummy process and cause it to crash with kill -SEGV
- Get a new list of fault entries and remove previous entries.
- Check new entries ProcessName to make sure it was the process that was
being tested.
- Check new entries ProcessID to make sure it was the process that was
being tested.
- Check if a core dump has been generated.
- If the dummy process was the only entry in Fault Monitor, test
ProcessFaults.RemoveAllProcessFaults() functionality by calling the
function and checking if the core dump is removed.
reboot-service:
Because it is problematic to reboot the device during the tests, only
the DM entries are checked.
- Check Reboot. DM entry.
- Test Reboot.flush() functionality by calling the function and making
sure the reboot entry is removed from the DM.
tr181-mqttbroker:
- Check if default brokers are running and ports are configured in
firewall.
- Subscribe to a topic in background with a 5s time limit.
- Publish a message and check if message has been received.
Signed-off-by: Yüce Kürüm <yuce.kurum@mind.be>
Signed-off-by: Yüce Kürüm <yuce.kurum_ext@softathome.com>
tr181-qos default configurations have been disabled by default.
Enable required configurations before each test and cleanup at the end.
References: PCF-1250
Signed-off-by: Yüce Kürüm <yuce.kurum@mind.be>
Signed-off-by: Yüce Kürüm <yuce.kurum_ext@softathome.com>
Configure TR-069 agent cwmpd to use the amxb_get_supported() method
instead of amxb_describe(). The amxb_describe() method is deprecated
and should be fully replaced by amxb_get_supported().
Signed-off-by: Mouna ALOUI <mouna.aloui_ext@softathome.com>
syslog-ng was backported to feed-prpl and the following patch/change was
done in b1033c327b
This change has no effect anymore, since the complete syslog-ng.conf
file is now controlled/generated by tr181-syslog, so lets use upstream
syslog-ng package again.
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
Since the user is not enabled, it cannot access the box over ssh. This
makes the usermanagement test fail, since we test the user by trying to
ssh into the box.
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
To be compliant with TR181 spec, the interface parameter should only take device parameters
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
New entries were added in newer version of the component
Output changed when switching to OpenWRT 23
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
* The DM of DNS.Diagnostics.NSLookupDiagnostics. is added to the tr181-dns component, test should be updated as well
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
Issue: Ping to wan no longer works
Cause: Firewall config was changed to no longer allow ping to wan by default
Fix: Remove wan ping test
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
* The default changed to now have a time server instance for every bridge defined in the network layout
* Adds the missing output for br-lcm
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
* Add a new test that will test toggling the instance instead of removing/adding it
* Replace the aliassed instance with a search expression to make it more robust
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
The default behavior is changed. We don't want to respond to ping6 WAN requests anymore.
This reverts commit 0dd60b27ebf0a61e330dc574eaa435b6a6461dec.
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
Instead of reducing unbound negative cache ttl try to flush it just before the tests start.
Signed-off-by: Yüce Kürüm <yuce.kurum@mind.be>
Signed-off-by: Yüce Kürüm <yuce.kurum_ext@softathome.com>
'uci_dyndns.org' server index has changed in OpenWRT 23.05. Adapt the initialization script accordingly.
Signed-off-by: Yüce Kürüm <yuce.kurum@mind.be>
Signed-off-by: Yüce Kürüm <yuce.kurum_ext@softathome.com>
Modifications to some opensource packages were made. These packages are available under a different name (suffixed with -prpl).
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
Netifd is not longer responsible for configuring the gateway. The TR181 components took over this task.
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
Since we're running DUT specific tests after generic tests, its
possible, that some of them trigger crashes in the components, so we
really need to make sure, that check-for-crashes.t test is being run as
last one, thus move it under generic/post folder and make it run after
all tests via new `CRAM_TEST_SUITE_POST` environment variable.
Fixes: 7a5c6289e6be ("ci: cram: check-for-crashes.t: make it execute as the last test")
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
There is now dedicated LCM data partition mounted under /lcm which is
not cleared up after each test, thus containers used in previous tests
persist during the DUT reboot and flashing procedure, violating test
imdepotence and making consecutive test fail.
So lets fix it by clearing up the LCM data partition during DUT firmware
flashing procedure, clearing just ext4 filesystem metadata, not erasing
complete 3 GiB and saving some time.
20 0x000f6800 0x006f67ff "lcm_data"
attrs: 0x0000000000000000
type: ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
guid: c5cde408-0b88-48ba-8701-eed060c51309
The 0xf6800 is the starting eMMC block of that partition and 0x400 is
eMMC erase group size, thus minimal size we can erase.
References: PCF-1101, PCF-1267
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
