Skip to content

RDKEMW-15146: Fix isSecureDbgSrvUnlocked for non-PROD builds; add PROD gating test coverage #215

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 2 commits into
base: topic/RDKEMW-13335
Choose a base branch
from
+167 −14
Draft

RDKEMW-15146: Fix isSecureDbgSrvUnlocked for non-PROD builds; add PROD gating test coverage #215

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2ce031f
Initial plan
Copilot Mar 17, 2026
3509ca7
Fix isSecureDbgSrvUnlocked for non-PROD builds and add unit tests
Copilot Mar 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions src/deviceutils/device_api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,12 +43,12 @@
/* function isSecureDbgSrvUnlocked - determines whether secure debug services may be enabled for the given build type.
* Usage: bool isSecureDbgSrvUnlocked(BUILDTYPE eBuildType)
*
* For eDEV builds, debug services are always unlocked.
* For non-PROD builds (eDEV, eVBN, eQA, etc.), debug services are always unlocked.
*
* For ePROD builds, debug services are unlocked only when all of the following are true:
* - debug services are enabled via isDebugServicesEnabled() (RFC-controlled),
* - the LABSIGNED_ENABLED device property indicates a labsigned image, and
* - the deviceType value from RFC allows test devices (for example "test").
* - the deviceType value from RFC is "test".
*
* RETURN - true if secure debug services are allowed to run for the given build type; false otherwise.
*/
Expand All @@ -59,10 +59,10 @@ bool isSecureDbgSrvUnlocked(BUILDTYPE eBuildType)
char labsigned[8] = {0};
int ret = -1;

if (eBuildType == eDEV) {
if (eBuildType != ePROD) {
isDebugServicesUnlocked = true;
}
else if (eBuildType == ePROD)
else /* eBuildType == ePROD */
{
bool dbgServices = isDebugServicesEnabled();
getDeviceTypeRFC(deviceType, sizeof(deviceType));
Expand Down
8 changes: 4 additions & 4 deletions src/deviceutils/device_api.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -305,16 +305,16 @@ size_t GetServURL(char *pServURL, size_t szBufSize);
*
* The decision is based on:
* - DbgServices RFC
* - DeviceType RFC
* - build type (Dev or Prod)
* - DeviceType RFC (lowercase "test" or "prod")
* - build type (non-PROD vs Prod)
* - LABSIGNED_ENABLED property value from /etc/device.properties
*
* Usage: bool isSecureDbgSrvUnlocked(BUILDTYPE eBuildType)
*
* RETURN - true if:
* - the build type is Dev; or
* - the build type is non-PROD (Dev, VBN, QA, etc.); or
* - the build type is Prod, DbgServices RFC is enabled,
* DeviceType is "test", and LABSIGNED_ENABLED is set to true;
* DeviceType RFC is "test", and LABSIGNED_ENABLED is set to "true";
* false otherwise.
*/
bool isSecureDbgSrvUnlocked(BUILDTYPE eBuildType);
Expand Down
165 changes: 159 additions & 6 deletions unittest/deviceutils/device_api_gtest.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -509,7 +509,6 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessStatered_DebugServices_E
//EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
ret = system("echo \"BUILD_TYPE=vbn\" > /tmp/device_gtest.prop");
//EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(1));
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
ret = system("echo \"https://www.statered.com\" > /tmp/stateredrecovry.conf");
ret = GetServURL(output, sizeof(output));
EXPECT_EQ(strncmp(output,servUrl,strlen(servUrl)),0);
Expand All @@ -528,7 +527,6 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessStatered_DebugServices_D
//EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
ret = system("echo \"BUILD_TYPE=vbn\" > /tmp/device_gtest.prop");
//EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(1));
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
ret = system("echo \"https://www.statered.com\" > /tmp/stateredrecovry.conf");
ret = GetServURL(output, sizeof(output));
EXPECT_EQ(strncmp(output,servUrl,strlen(servUrl)),0);
Expand All @@ -544,10 +542,21 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessStatered_Prod_DebugServi
int ret;
char servUrl[]="https://www.statered.com";
EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(true));
//EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
//EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(1));
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
.Times(1)
.WillOnce(Invoke([](char *deviceType, size_t size) {
strncpy(deviceType, "test", size - 1);
deviceType[size - 1] = '\0';
}));
EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
.Times(1)
.WillOnce(Invoke([](const char *model, char *data, int size) {
strncpy(data, "true", size - 1);
data[size - 1] = '\0';
return 0; /* UTILS_SUCCESS */
}));
ret = system("echo \"https://www.statered.com\" > /tmp/stateredrecovry.conf");
ret = GetServURL(output, sizeof(output));
EXPECT_EQ(strncmp(output,servUrl,strlen(servUrl)),0);
Expand Down Expand Up @@ -594,7 +603,6 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessSwupdate_DebugServices_E
EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(0));
//EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
ret = system("echo \"BUILD_TYPE=vbn\" > /tmp/device_gtest.prop");
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
ret=GetServURL(output , sizeof(output));
EXPECT_EQ(strncmp(output , servUrl , strlen(servUrl)),0);
Expand All @@ -614,7 +622,6 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessSwupdate_DebugServices_D
EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(0));
//EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
ret = system("echo \"BUILD_TYPE=vbn\" > /tmp/device_gtest.prop");
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
ret=GetServURL(output , sizeof(output));
EXPECT_EQ(strncmp(output , servUrl , strlen(servUrl)),0);
Expand All @@ -634,6 +641,19 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessSwupdate_Prod_DebugServi
EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(0));
ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
.Times(1)
.WillOnce(Invoke([](char *deviceType, size_t size) {
strncpy(deviceType, "test", size - 1);
deviceType[size - 1] = '\0';
}));
EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
.Times(1)
.WillOnce(Invoke([](const char *model, char *data, int size) {
strncpy(data, "true", size - 1);
data[size - 1] = '\0';
return 0; /* UTILS_SUCCESS */
}));
ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
ret=GetServURL(output , sizeof(output));
EXPECT_EQ(strncmp(output , servUrl , strlen(servUrl)),0);
Expand Down Expand Up @@ -670,6 +690,139 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessSwupdate_Prod_DebugServi
printf("Server URL = %s\n", output);
}

/* Tests for isSecureDbgSrvUnlocked PROD gating: labsigned + deviceType + dbgServices */

/* PROD + dbgServices=false → locked (should not use state-red or swupdate override) */
TEST_F(DeviceApiTestFixture, TestName_GetServURL_Prod_DbgDisabled_Locked)
{
char output[64];
int ret;
char servUrl[]="https://www.tr181Rfc.com";
EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
.Times(1)
.WillOnce(Invoke([&servUrl](char *type, const char *key, char *out_value, size_t datasize) {
strncpy(out_value, servUrl, datasize - 1);
out_value[datasize - 1] = '\0';
return (int)strlen(out_value);
}));
ret = GetServURL(output, sizeof(output));
EXPECT_EQ(strncmp(output, "https://www.tr181Rfc.com/xconf/swu/stb", strlen("https://www.tr181Rfc.com/xconf/swu/stb")), 0);
printf("Output ========================= %s\n ", output);
ret = system("rm -f /tmp/swupdate.conf");
ret = system("rm -f /tmp/device_gtest.prop");
}

/* PROD + dbgServices=true + deviceType=prod (not "test") → locked */
TEST_F(DeviceApiTestFixture, TestName_GetServURL_Prod_DeviceTypeProd_Locked)
{
char output[64];
int ret;
char servUrl[]="https://www.tr181Rfc.com";
EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
.Times(1)
.WillOnce(Invoke([](char *deviceType, size_t size) {
strncpy(deviceType, "prod", size - 1);
deviceType[size - 1] = '\0';
}));
EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
.Times(1)
.WillOnce(Invoke([](const char *model, char *data, int size) {
strncpy(data, "true", size - 1);
data[size - 1] = '\0';
return 0; /* UTILS_SUCCESS */
}));
ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
.Times(1)
.WillOnce(Invoke([&servUrl](char *type, const char *key, char *out_value, size_t datasize) {
strncpy(out_value, servUrl, datasize - 1);
out_value[datasize - 1] = '\0';
return (int)strlen(out_value);
}));
ret = GetServURL(output, sizeof(output));
EXPECT_EQ(strncmp(output, "https://www.tr181Rfc.com/xconf/swu/stb", strlen("https://www.tr181Rfc.com/xconf/swu/stb")), 0);
printf("Output ========================= %s\n ", output);
ret = system("rm -f /tmp/swupdate.conf");
ret = system("rm -f /tmp/device_gtest.prop");
}

/* PROD + dbgServices=true + deviceType=test + labsigned=false → locked */
TEST_F(DeviceApiTestFixture, TestName_GetServURL_Prod_LabsignedFalse_Locked)
{
char output[64];
int ret;
char servUrl[]="https://www.tr181Rfc.com";
EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
.Times(1)
.WillOnce(Invoke([](char *deviceType, size_t size) {
strncpy(deviceType, "test", size - 1);
deviceType[size - 1] = '\0';
}));
EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
.Times(1)
.WillOnce(Invoke([](const char *model, char *data, int size) {
strncpy(data, "false", size - 1);
data[size - 1] = '\0';
return 0; /* UTILS_SUCCESS */
}));
ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
.Times(1)
.WillOnce(Invoke([&servUrl](char *type, const char *key, char *out_value, size_t datasize) {
strncpy(out_value, servUrl, datasize - 1);
out_value[datasize - 1] = '\0';
return (int)strlen(out_value);
}));
ret = GetServURL(output, sizeof(output));
EXPECT_EQ(strncmp(output, "https://www.tr181Rfc.com/xconf/swu/stb", strlen("https://www.tr181Rfc.com/xconf/swu/stb")), 0);
printf("Output ========================= %s\n ", output);
ret = system("rm -f /tmp/swupdate.conf");
ret = system("rm -f /tmp/device_gtest.prop");
}

/* PROD + dbgServices=true + deviceType=test + getDevicePropertyData fails → locked */
TEST_F(DeviceApiTestFixture, TestName_GetServURL_Prod_LabsignedCheckFails_Locked)
{
char output[64];
int ret;
char servUrl[]="https://www.tr181Rfc.com";
EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
.Times(1)
.WillOnce(Invoke([](char *deviceType, size_t size) {
strncpy(deviceType, "test", size - 1);
deviceType[size - 1] = '\0';
}));
EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
.Times(1)
.WillOnce(Return(-1)); /* simulate failure */
ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
.Times(1)
.WillOnce(Invoke([&servUrl](char *type, const char *key, char *out_value, size_t datasize) {
strncpy(out_value, servUrl, datasize - 1);
out_value[datasize - 1] = '\0';
return (int)strlen(out_value);
}));
ret = GetServURL(output, sizeof(output));
EXPECT_EQ(strncmp(output, "https://www.tr181Rfc.com/xconf/swu/stb", strlen("https://www.tr181Rfc.com/xconf/swu/stb")), 0);
printf("Output ========================= %s\n ", output);
ret = system("rm -f /tmp/swupdate.conf");
ret = system("rm -f /tmp/device_gtest.prop");
}

/* COMMENTED OUT: GetBuildType is now in common_utilities
TEST_F(DeviceApiTestFixture, TestName_GetBuildType_Success)
{
Expand Down