RDKEMW-15146 : Introduce mechanism to unlock secure debug properties - /opt/rfc.properties

rfcMgr/gtest/gtest_main.cpp

@@ -569,6 +569,60 @@ TEST(rfcMgrTest, checkWhoamiSupport) {
     EXPECT_EQ(result, true);
 }
 
+TEST(rfcMgrTest, isSecureDbgSrvUnlocked_dev) {
+    writeToTr181storeFile("BUILD_TYPE", "dev", "/tmp/device.properties", Plain);
+    RuntimeFeatureControlProcessor *rfcObj = new RuntimeFeatureControlProcessor();
+    rfcObj->initializeXconfHandler();
+    bool result = rfcObj->isSecureDbgSrvUnlocked();
+    delete rfcObj;
+    EXPECT_EQ(result, true);
+}
+
+TEST(rfcMgrTest, isSecureDbgSrvUnlocked_labsigned_true) {
+    writeToTr181storeFile("BUILD_TYPE", "prod", "/tmp/device.properties", Plain);
+	writeToTr181storeFile("LABSIGNED_ENABLED", "true", "/tmp/device.properties", Plain);
+	writeToTr181storeFile("Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType", "test", "/opt/secure/RFC/tr181store.ini", Quoted);
+	writeToTr181storeFile("Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DbgServices.Enable", "true", "/opt/secure/RFC/tr181store.ini", Quoted);
+    RuntimeFeatureControlProcessor *rfcObj = new RuntimeFeatureControlProcessor();
+    rfcObj->initializeXconfHandler();
+    bool result = rfcObj->isSecureDbgSrvUnlocked();
+    delete rfcObj;
+    EXPECT_EQ(result, true);
+}
+
+TEST(rfcMgrTest, isSecureDbgSrvUnlocked_prod) {
+    writeToTr181storeFile("BUILD_TYPE", "prod", "/tmp/device.properties", Plain);
+	writeToTr181storeFile("LABSIGNED_ENABLED", "false", "/tmp/device.properties", Plain);
+    RuntimeFeatureControlProcessor *rfcObj = new RuntimeFeatureControlProcessor();
+    rfcObj->initializeXconfHandler();
+    bool result = rfcObj->isSecureDbgSrvUnlocked();
+    delete rfcObj;
+    EXPECT_EQ(result, false);
+}
+
+TEST(rfcMgrTest, isSecureDbgSrvUnlocked_dType_prod) {
+    writeToTr181storeFile("BUILD_TYPE", "prod", "/tmp/device.properties", Plain);
+	writeToTr181storeFile("LABSIGNED_ENABLED", "true", "/tmp/device.properties", Plain);
+	writeToTr181storeFile("Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType", "prod", "/opt/secure/RFC/tr181store.ini", Quoted);
+    RuntimeFeatureControlProcessor *rfcObj = new RuntimeFeatureControlProcessor();
+    rfcObj->initializeXconfHandler();
+    bool result = rfcObj->isSecureDbgSrvUnlocked();
+    delete rfcObj;
+    EXPECT_EQ(result, false);
+}
+
+TEST(rfcMgrTest, isSecureDbgSrvUnlocked_labsigned_DbgSrv_false) {
+    writeToTr181storeFile("BUILD_TYPE", "prod", "/tmp/device.properties", Plain);
+	writeToTr181storeFile("LABSIGNED_ENABLED", "true", "/tmp/device.properties", Plain);
+	writeToTr181storeFile("Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType", "test", "/opt/secure/RFC/tr181store.ini", Quoted);
+	writeToTr181storeFile("Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DbgServices.Enable", "false", "/opt/secure/RFC/tr181store.ini", Quoted);
+    RuntimeFeatureControlProcessor *rfcObj = new RuntimeFeatureControlProcessor();
+    rfcObj->initializeXconfHandler();
+    bool result = rfcObj->isSecureDbgSrvUnlocked();
+    delete rfcObj;
+    EXPECT_EQ(result, false);
+}
+
 TEST(rfcMgrTest, isDebugServicesEnabled) {
     writeToTr181storeFile("Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DbgServices.Enable", "true", "/opt/secure/RFC/tr181store.ini", Quoted);    
     RuntimeFeatureControlProcessor *rfcObj = new RuntimeFeatureControlProcessor();

rfcMgr/rfc_xconf_handler.cpp

@@ -47,10 +47,43 @@ extern "C" {
 #define MTLS_FAILURE -1
 #endif
 
+bool RuntimeFeatureControlProcessor::isSecureDbgSrvUnlocked(void) {
+     bool isDebugServicesUnlocked = false; // return value
+
+	 if ((_ebuild_type != ePROD) && (_ebuild_type != eUNKNOWN)) {
+        isDebugServicesUnlocked = true;
+     }
+
+	 else if (_ebuild_type == ePROD) 
+	 {
+		 char deviceType[16] = {0};
+	     char value[8] = {0};
+ 		 bool dbgServices = isDebugServicesEnabled();  // check debug services enabled from RFC
+		 getDeviceTypeRFC(deviceType, sizeof(deviceType));
+         int ret = getDevicePropertyData("LABSIGNED_ENABLED", value, sizeof(value));
+         if (ret != 1) {
+            RDK_LOG(RDK_LOG_ERROR, LOG_RFCMGR, "[%s][%d] Failed to get LABSIGNED_ENABLED property. Status: %d\n", __FUNCTION__, __LINE__, ret);
+            return isDebugServicesUnlocked;
+        }
+		if ((strcasecmp(value, "true") == 0) &&(strcasecmp(deviceType, "test") == 0) && dbgServices)
+           {
+                   isDebugServicesUnlocked = true;
+           }
+	    else
+           {
+	               RDK_LOG(RDK_LOG_INFO, LOG_RFCMGR, "[%s][%d] unable to enable Debug Services\n", __FUNCTION__, __LINE__);                
+	       }
+	 }
+	 if (isDebugServicesUnlocked) {
+		RDK_LOG(RDK_LOG_INFO, LOG_RFCMGR, "[%s][%d] Enabling Debug Services\n", __FUNCTION__, __LINE__);
+		NotifyTelemetry2Count("SYST_INFO_RFC_DbgSrv");
+	 }
+     return isDebugServicesUnlocked;
+}
+
 int RuntimeFeatureControlProcessor:: InitializeRuntimeFeatureControlProcessor(void)
 {
      std::string rfc_file;
-     bool dbgServices = isDebugServicesEnabled();
 
     int rc = GetBootstrapXconfUrl(_boot_strap_xconf_url);
     if(rc != 0)
@@ -63,7 +96,7 @@ int RuntimeFeatureControlProcessor:: InitializeRuntimeFeatureControlProcessor(vo
 
     GetRFCPartnerID();
 
-    if((filePresentCheck(RFC_PROPERTIES_PERSISTENCE_FILE) == RDK_API_SUCCESS) && (_ebuild_type != ePROD || dbgServices == true))
+    if((filePresentCheck(RFC_PROPERTIES_PERSISTENCE_FILE) == RDK_API_SUCCESS) && (isSecureDbgSrvUnlocked()))
     {
 	rfc_file = RFC_PROPERTIES_PERSISTENCE_FILE;
 	rfc_state = Local;
@@ -121,6 +154,36 @@ int RuntimeFeatureControlProcessor:: InitializeRuntimeFeatureControlProcessor(vo
 }
 
 
+void RuntimeFeatureControlProcessor:: getDeviceTypeRFC(char *deviceType, size_t size) 
+{
+	if (deviceType == NULL || size == 0){
+		RDK_LOG(RDK_LOG_ERROR, LOG_RFCMGR, "[%s][%d] Error, invalid arguments passed!!!\n", __FUNCTION__, __LINE__);
+		return;
+	}
+
+	const char* type = "unknown";
+    char rfc_data[RFC_VALUE_BUF_SIZE] = {0};
+	strncpy(deviceType, type, size - 1);
+	deviceType[size - 1] = '\0';
+    int ret = read_RFCProperty("LABSGND", RFC_DEVICETYPE, rfc_data, sizeof(rfc_data));
+
+    if (ret == -1) {
+		RDK_LOG(RDK_LOG_ERROR, LOG_RFCMGR, "[%s][%d] rfc device type =%s failed Status %d\n", __FUNCTION__, __LINE__, RFC_DEVICETYPE, ret);
+        return;
+    }
+
+	RDK_LOG(RDK_LOG_INFO, LOG_RFCMGR, "[%s][%d] rfc device type = %s\n", __FUNCTION__, __LINE__, rfc_data);
+
+    if (strncasecmp(rfc_data, "prod", 4) == 0) {
+        type = "prod";
+    } else if (strncasecmp(rfc_data, "test", 4) == 0) {
+        type = "test";
+    }
+
+    strncpy(deviceType, type, size - 1);
+	deviceType[size - 1] = '\0';
+}
+
 
 bool RuntimeFeatureControlProcessor::checkWhoamiSupport()
 {
@@ -1532,13 +1595,13 @@ int RuntimeFeatureControlProcessor::ProcessRuntimeFeatureControlReq()
     int result = FAILURE;
 
     bool skip_direct = IsDirectBlocked();
-    bool dbgServices = isDebugServicesEnabled();
+    bool isDebugServicesUnlocked = isSecureDbgSrvUnlocked();
 
     if(skip_direct == false)
     {
         while(retries < RETRY_COUNT)
         {
-            if((filePresentCheck(RFC_PROPERTIES_PERSISTENCE_FILE) == RDK_API_SUCCESS) && (_ebuild_type != ePROD || dbgServices == true))
+            if((filePresentCheck(RFC_PROPERTIES_PERSISTENCE_FILE) == RDK_API_SUCCESS) && isDebugServicesUnlocked)
             {
                 RDK_LOG(RDK_LOG_INFO, LOG_RFCMGR, "[%s][%d] Setting URL from local override to %s\n", __FUNCTION__, __LINE__, _xconf_server_url.c_str());
                 NotifyTelemetry2Value("SYST_INFO_RFC_XconflocalURL", _xconf_server_url.c_str());

rfcMgr/rfc_xconf_handler.h

@@ -67,6 +67,7 @@ extern "C" {
 #define TR181STOREFILE                      "/opt/secure/RFC/tr181store.ini" 
 #define DIRECT_BLOCK_FILENAME              "/tmp/.lastdirectfail_rfc"
 #define RFC_DEBUGSRV                       "Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DbgServices.Enable"
+#define RFC_DEVICETYPE                     "Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType"
 
 #define RFC_VIDEO_CONTROL_ID               2504
 #define RFC_VIDEO_VOD_ID                   15660
@@ -205,6 +206,8 @@ class RuntimeFeatureControlProcessor : public xconf::XconfHandler
 	void cleanAllFile();
         int ProcessXconfUrl(const char *XconfUrl);
 	bool isDebugServicesEnabled(void);
+    void getDeviceTypeRFC(char *deviceType, size_t size);
+    bool isSecureDbgSrvUnlocked(void);
 
 #if defined(GTEST_ENABLE)
     FRIEND_TEST(rfcMgrTest, isNewFirmwareFirstRequest);
@@ -227,6 +230,11 @@ class RuntimeFeatureControlProcessor : public xconf::XconfHandler
     FRIEND_TEST(rfcMgrTest, getJsonRpc);
     FRIEND_TEST(rfcMgrTest, cleanAllFile);
     FRIEND_TEST(rfcMgrTest, checkWhoamiSupport);
+    FRIEND_TEST(rfcMgrTest, isSecureDbgSrvUnlocked_dev);
+    FRIEND_TEST(rfcMgrTest, isSecureDbgSrvUnlocked_labsigned_true);
+    FRIEND_TEST(rfcMgrTest, isSecureDbgSrvUnlocked_prod);
+    FRIEND_TEST(rfcMgrTest, isSecureDbgSrvUnlocked_dType_prod);
+    FRIEND_TEST(rfcMgrTest, isSecureDbgSrvUnlocked_labsigned_DbgSrv_false);
     FRIEND_TEST(rfcMgrTest, isDebugServicesEnabled);
     FRIEND_TEST(rfcMgrTest, isMaintenanceEnabled);
     FRIEND_TEST(rfcMgrTest, GetOsClass);

test/functional-tests/tests/rfc_test_helper.py

@@ -50,6 +50,7 @@
 PARODUS_LOG_FILE: str = "/opt/logs/parodus.log"
 RFC_PROPERTIES_PERSISTENCE_FILE: str = "/opt/rfc.properties"
 RFC_XCONF_OVERRIDE_URL: str = "https://mockxconf_opt_rfc_properties/featureControl/getSettings"
+DEVICE_PROPERTIES: str = "/etc/device.properties"
 
 def write_on_file(file: str, content: str) -> None:
     """

test/functional-tests/tests/test_rfc_override_rfc_prop.py

@@ -55,12 +55,65 @@ def modify_rfc_url(new_url: str) -> None:
             rfc_props.write('\n'.join(lines) + '\n')
             print(f"Modified existing content to: RFC_CONFIG_SERVER_URL={new_url}")
 
+def modify_labsigned_value(device_properties_path: str) -> None:
+    """
+    Modifies the LABSIGNED_ENABLED value in device.properties file to true.
+
+    If the properties file does not exist, it creates one with LABSIGNED_ENABLED set to true.
+    If the file exists but is empty, it adds the field as true.
+    If it already contains LABSIGNED_ENABLED, it sets the parameter to true.
+    """
+    if not os.path.exists(device_properties_path):
+        with open(device_properties_path, "w") as dev_props:
+            dev_props.write("LABSIGNED_ENABLED=true\n")
+        return
+
+    with open(device_properties_path, "r+") as dev_props:
+        content = dev_props.read()
+
+        if not content.strip():
+            dev_props.write("LABSIGNED_ENABLED=true\n")
+            return
+
+        lines = content.splitlines()
+        labsigned_found = False
+
+        for i in range(len(lines)):
+            if lines[i].startswith("LABSIGNED_ENABLED="):
+                lines[i] = "LABSIGNED_ENABLED=true"
+                labsigned_found = True
+                break
+
+        if not labsigned_found:
+            lines.append("LABSIGNED_ENABLED=true")
 
-def test_Set_DbgServices_value():
+        dev_props.seek(0)
+        dev_props.truncate()
+        dev_props.write("\n".join(lines) + "\n")
+
+def modify_devicetype_test():
+    command_to_check = "tr181 -d -s -t string -v test Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DeviceType"
+    result = run_shell_command(command_to_check)
+    assert "Set operation success" in result, '"Set operation success" not found in the output'
+
+def enable_dbg_services():
     command_to_check = "tr181 -d -s -t bool -v true Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Identity.DbgServices.Enable"
     result = run_shell_command(command_to_check)
     assert "Set operation success" in result, '"Set operation success" not found in the output'
 
+def set_secure_dbgsrv_preconditions():
+    """
+    Set all required TR-181 preconditions for isSecureDbgSrvUnlocked() in PROD builds
+    """
+    modify_devicetype_test()
+    enable_dbg_services()
+
+def test_Set_DeviceType_value():
+    modify_devicetype_test()
+
+def test_set_enable_dbg_services():
+    enable_dbg_services()
+
 def test_rfc_override_rfc_prop():
     """
     Test the communication between RFC Manager and XCONF.
@@ -76,7 +129,14 @@ def test_rfc_override_rfc_prop():
 
     modify_rfc_url(RFC_XCONF_OVERRIDE_URL) # update an unresolved URL to props file
 
+    device_properties_existed = os.path.exists(DEVICE_PROPERTIES)
+    original_content = ""
+    if device_properties_existed:
+        with open(DEVICE_PROPERTIES, "r") as f:
+            original_content = f.read()
     try:
+        set_secure_dbgsrv_preconditions()
+        modify_labsigned_value(DEVICE_PROPERTIES)
         rfc_run_binary()
         RFC_FILE_PATH_MSG = f"Found Persistent file /opt/rfc.properties"
         XCONF_URL_MSG = f"_xconf_server_url: [https://mockxconf_opt_rfc_properties/featureControl/getSettings]"
@@ -90,3 +150,8 @@ def test_rfc_override_rfc_prop():
     except Exception as e:
         print(f"Exception during Validate the Override function for rfc.properties file: {e}")
         assert False, f"Exception during Validate the Override function for rfc.properties file: {e}" 
+    finally:
+        if device_properties_existed:
+            if os.path.exists(DEVICE_PROPERTIES):
+                with open(DEVICE_PROPERTIES, "w") as f:
+                    f.write(original_content)