This patch set fixes some minor bugs, and adds explicit support for all
currently supported Provisioning authentication methods.
v2: Added prov-acceptor queuing, and fixed whitespace issues
Brian Gix (5):
mesh: Fix delivery of PB-ACK to acceptors
nesh: Normalize endian of public/private ECC keys
tools/mesh: Add all supported OOB methods to cfgclient
test/mesh: Add support for testing more OOB auth
mesh: Add single threading to prov-acp ob messaging
mesh/pb-adv.c | 1 -
mesh/prov-acceptor.c | 96 +++++++++++++++++++++++++++---------------
mesh/prov-initiator.c | 3 ++
mesh/provision.h | 1 +
test/agent.py | 23 ++++++++++
tools/mesh-cfgclient.c | 32 +++++++++++---
6 files changed, 116 insertions(+), 40 deletions(-)
--
2.25.4
To pass IOP testing, we need to be able to support Input OOB and Out of
band Public Key exchange, This patch adds agent methods to support
those capabilities, but are turned off because the test code uses
insecure fixed values instead of randomized values.
---
test/agent.py | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/test/agent.py b/test/agent.py
index b46cd95f4..57a74183d 100755
--- a/test/agent.py
+++ b/test/agent.py
@@ -35,7 +35,9 @@ class Agent(dbus.service.Object):
caps = []
oob = []
caps.append('out-numeric')
+ #caps.append('in-numeric') -- Do not use well known in-oob
caps.append('static-oob')
+ #caps.append('public-oob') -- Do not use well known key pairs
oob.append('other')
return {
AGENT_IFACE: {
@@ -56,6 +58,27 @@ class Agent(dbus.service.Object):
print(set_cyan('DisplayNumeric ('), type,
set_cyan(') number ='), set_green(value))
+ @dbus.service.method(AGENT_IFACE, in_signature="s", out_signature="u")
+ def PromptNumeric(self, type):
+ # Sample in-oob -- DO-NOT-USE
+ value = 12345
+ print(set_cyan('PromptNumeric ('), type,
+ set_cyan(') number ='), set_green(value))
+ return dbus.UInt32(value)
+
+ @dbus.service.method(AGENT_IFACE, in_signature="", out_signature="ay")
+ def PrivateKey(self):
+ # Sample Public/Private pair from Mesh Profile Spec DO-NOT-USE
+ private_key_str = '6872b109ea0574adcf88bf6da64996a4624fe018191d9322a4958837341284bc'
+ public_key_str = 'ce9027b5375fe5d3ed3ac89cef6a8370f699a2d3130db02b87e7a632f15b0002e5b72c775127dc0ce686002ecbe057e3d6a8000d4fbf2cdfffe0d38a1c55a043'
+ print(set_cyan('PrivateKey ()'))
+ print(set_cyan('Enter Public key on remote device: '),
+ set_green(public_key_str));
+ private_key = bytearray.fromhex(private_key_str)
+
+ return dbus.Array(private_key, signature='y')
+
+
@dbus.service.method(AGENT_IFACE, in_signature="s", out_signature="ay")
def PromptStatic(self, type):
static_key = numpy.random.randint(0, 255, 16)
--
2.25.4
To support the widest range of mesh devices, we need to support any
possible capability combinations that a remote device may request.
---
tools/mesh-cfgclient.c | 32 +++++++++++++++++++++++++++-----
1 file changed, 27 insertions(+), 5 deletions(-)
diff --git a/tools/mesh-cfgclient.c b/tools/mesh-cfgclient.c
index 49069674f..a4a6f21ab 100644
--- a/tools/mesh-cfgclient.c
+++ b/tools/mesh-cfgclient.c
@@ -104,7 +104,17 @@ static struct model_info *cfgcli;
static struct l_queue *devices;
static bool prov_in_progress;
-static const char *caps[] = {"static-oob", "out-numeric", "in-numeric"};
+static const char * const caps[] = {"static-oob",
+ "push",
+ "twist",
+ "blink",
+ "beep",
+ "vibrate",
+ "public-oob",
+ "out-alpha",
+ "in-alpha",
+ "out-numeric",
+ "in-numeric"};
static bool have_config;
@@ -419,7 +429,7 @@ static void agent_input_done(oob_type_t type, void *buf, uint16_t len,
struct l_dbus_message *reply = NULL;
struct l_dbus_message_builder *builder;
uint32_t val_u32;
- uint8_t oob_data[16];
+ uint8_t oob_data[64];
switch (type) {
case NONE:
@@ -435,15 +445,15 @@ static void agent_input_done(oob_type_t type, void *buf, uint16_t len,
/* Fall Through */
case HEXADECIMAL:
- if (len > 16) {
+ if (len > sizeof(oob_data)) {
bt_shell_printf("Bad input length\n");
break;
}
- memset(oob_data, 0, 16);
+ memset(oob_data, 0, sizeof(oob_data));
memcpy(oob_data, buf, len);
reply = l_dbus_message_new_method_return(msg);
builder = l_dbus_message_builder_new(reply);
- append_byte_array(builder, oob_data, 16);
+ append_byte_array(builder, oob_data, len);
l_dbus_message_builder_finalize(builder);
l_dbus_message_builder_destroy(builder);
break;
@@ -580,6 +590,16 @@ static struct l_dbus_message *prompt_numeric_call(struct l_dbus *dbus,
return NULL;
}
+static struct l_dbus_message *prompt_public_call(struct l_dbus *dbus,
+ struct l_dbus_message *msg,
+ void *user_data)
+{
+ l_dbus_message_ref(msg);
+ agent_input_request(HEXADECIMAL, 64, "Enter 512 bit Public Key",
+ agent_input_done, msg);
+ return NULL;
+}
+
static struct l_dbus_message *prompt_static_call(struct l_dbus *dbus,
struct l_dbus_message *msg,
void *user_data)
@@ -618,6 +638,8 @@ static void setup_agent_iface(struct l_dbus_interface *iface)
"u", "s", "number", "type");
l_dbus_interface_method(iface, "PromptStatic", 0, prompt_static_call,
"ay", "s", "data", "type");
+ l_dbus_interface_method(iface, "PublicKey", 0, prompt_public_call,
+ "ay", "", "data");
}
static bool register_agent(void)
--
2.25.4
Rwmove unneeded initialization that prevented the Acceptor roll of ever
recognizing a valid PB-ACK.
---
mesh/pb-adv.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/mesh/pb-adv.c b/mesh/pb-adv.c
index c74dae79f..83f922aa8 100644
--- a/mesh/pb-adv.c
+++ b/mesh/pb-adv.c
@@ -358,7 +358,6 @@ static void pb_adv_packet(void *user_data, const uint8_t *pkt, uint16_t len)
first = !session->link_id;
session->link_id = link_id;
session->last_peer_trans_num = 0xFF;
- session->local_acked = 0xFF;
session->peer_trans_num = 0x00;
session->local_trans_num = 0x7F;
session->opened = true;
--
2.25.4
Certain IOP and stress testing scenarios can cause additional outbound
messages to be attempted before the prior outbound message completes.
This patch adds queuing if outbpund messages are attempted too quickly
so that the additional message is not sent until the prior message is
ACKed.
---
mesh/prov-acceptor.c | 88 +++++++++++++++++++++++++++-----------------
mesh/provision.h | 1 +
2 files changed, 56 insertions(+), 33 deletions(-)
diff --git a/mesh/prov-acceptor.c b/mesh/prov-acceptor.c
index 0dbb84f50..f579a143b 100644
--- a/mesh/prov-acceptor.c
+++ b/mesh/prov-acceptor.c
@@ -42,26 +42,15 @@ static const uint16_t expected_pdu_size[] = {
#define BEACON_TYPE_UNPROVISIONED 0x00
+struct deferred_cmd {
+ uint16_t len;
+ uint8_t cmd[];
+};
+
static const uint8_t pkt_filter = MESH_AD_TYPE_PROVISION;
static const uint8_t bec_filter[] = {MESH_AD_TYPE_BEACON,
BEACON_TYPE_UNPROVISIONED};
-enum acp_state {
- ACP_PROV_IDLE = 0,
- ACP_PROV_CAPS_SENT,
- ACP_PROV_CAPS_ACKED,
- ACP_PROV_KEY_SENT,
- ACP_PROV_KEY_ACKED,
- ACP_PROV_INP_CMPLT_SENT,
- ACP_PROV_INP_CMPLT_ACKED,
- ACP_PROV_CONF_SENT,
- ACP_PROV_CONF_ACKED,
- ACP_PROV_RAND_SENT,
- ACP_PROV_RAND_ACKED,
- ACP_PROV_CMPLT_SENT,
- ACP_PROV_FAIL_SENT,
-};
-
#define MAT_REMOTE_PUBLIC 0x01
#define MAT_LOCAL_PRIVATE 0x02
#define MAT_RAND_AUTH 0x04
@@ -70,12 +59,13 @@ enum acp_state {
struct mesh_prov_acceptor {
mesh_prov_acceptor_complete_func_t cmplt;
prov_trans_tx_t trans_tx;
+ struct l_queue *ob;
void *agent;
void *caller_data;
void *trans_data;
struct l_timeout *timeout;
uint32_t to_secs;
- enum acp_state state;
+ uint8_t out_opcode;
uint8_t transport;
uint8_t material;
uint8_t expected;
@@ -99,6 +89,7 @@ static void acceptor_free(void)
return;
l_timeout_remove(prov->timeout);
+ l_queue_destroy(prov->ob, l_free);
mesh_send_cancel(bec_filter, sizeof(bec_filter));
mesh_send_cancel(&pkt_filter, sizeof(pkt_filter));
@@ -126,6 +117,21 @@ static void acp_prov_close(void *user_data, uint8_t reason)
acceptor_free();
}
+static void prov_send(struct mesh_prov_acceptor *prov, void *cmd, uint16_t len)
+{
+ struct deferred_cmd *defer;
+
+ if (prov->out_opcode == PROV_NONE) {
+ prov->out_opcode = *(uint8_t *) cmd;
+ prov->trans_tx(prov->trans_data, cmd, len);
+ } else {
+ defer = l_malloc(len + sizeof(struct deferred_cmd));
+ defer->len = len;
+ memcpy(defer->cmd, cmd, len);
+ l_queue_push_tail(prov->ob, defer);
+ }
+}
+
static void prov_to(struct l_timeout *timeout, void *user_data)
{
struct mesh_prov_acceptor *rx_prov = user_data;
@@ -140,7 +146,7 @@ static void prov_to(struct l_timeout *timeout, void *user_data)
if (prov->cmplt && prov->trans_tx) {
prov->cmplt(prov->caller_data, PROV_ERR_TIMEOUT, NULL);
prov->cmplt = NULL;
- prov->trans_tx(prov->trans_data, fail_code, 2);
+ prov_send(prov, fail_code, 2);
prov->timeout = l_timeout_create(1, prov_to, prov, NULL);
return;
}
@@ -258,7 +264,7 @@ static void number_cb(void *user_data, int err, uint32_t number)
if (err) {
msg.opcode = PROV_FAILED;
msg.reason = PROV_ERR_UNEXPECTED_ERR;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
return;
}
@@ -267,7 +273,7 @@ static void number_cb(void *user_data, int err, uint32_t number)
l_put_be32(number, prov->rand_auth_workspace + 44);
prov->material |= MAT_RAND_AUTH;
msg.opcode = PROV_INP_CMPLT;
- prov->trans_tx(prov->trans_data, &msg.opcode, 1);
+ prov_send(prov, &msg.opcode, 1);
}
static void static_cb(void *user_data, int err, uint8_t *key, uint32_t len)
@@ -281,7 +287,7 @@ static void static_cb(void *user_data, int err, uint8_t *key, uint32_t len)
if (err || !key || len != 16) {
msg.opcode = PROV_FAILED;
msg.reason = PROV_ERR_UNEXPECTED_ERR;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
return;
}
@@ -292,7 +298,7 @@ static void static_cb(void *user_data, int err, uint8_t *key, uint32_t len)
if (prov->conf_inputs.start.auth_action == PROV_ACTION_IN_ALPHA) {
msg.opcode = PROV_INP_CMPLT;
- prov->trans_tx(prov->trans_data, &msg.opcode, 1);
+ prov_send(prov, &msg.opcode, 1);
}
}
@@ -307,7 +313,7 @@ static void priv_key_cb(void *user_data, int err, uint8_t *key, uint32_t len)
if (err || !key || len != 32) {
msg.opcode = PROV_FAILED;
msg.reason = PROV_ERR_UNEXPECTED_ERR;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
return;
}
@@ -326,7 +332,7 @@ static void priv_key_cb(void *user_data, int err, uint8_t *key, uint32_t len)
if (!acp_credentials(prov)) {
msg.opcode = PROV_FAILED;
msg.reason = PROV_ERR_UNEXPECTED_ERR;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
}
}
}
@@ -339,9 +345,8 @@ static void send_caps(struct mesh_prov_acceptor *prov)
memcpy(&msg.caps, &prov->conf_inputs.caps,
sizeof(prov->conf_inputs.caps));
- prov->state = ACP_PROV_CAPS_SENT;
prov->expected = PROV_START;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
}
static void send_pub_key(struct mesh_prov_acceptor *prov)
@@ -350,7 +355,7 @@ static void send_pub_key(struct mesh_prov_acceptor *prov)
msg.opcode = PROV_PUB_KEY;
memcpy(msg.pub_key, prov->conf_inputs.dev_pub_key, sizeof(msg.pub_key));
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
}
static bool send_conf(struct mesh_prov_acceptor *prov)
@@ -365,7 +370,7 @@ static bool send_conf(struct mesh_prov_acceptor *prov)
if (!memcmp(msg.conf, prov->confirm, sizeof(msg.conf)))
return false;
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
return true;
}
@@ -375,7 +380,7 @@ static void send_rand(struct mesh_prov_acceptor *prov)
msg.opcode = PROV_RANDOM;
memcpy(msg.rand, prov->rand_auth_workspace, sizeof(msg.rand));
- prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+ prov_send(prov, &msg, sizeof(msg));
}
static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
@@ -614,8 +619,7 @@ static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
if (result) {
prov->rand_auth_workspace[0] = PROV_COMPLETE;
- prov->trans_tx(prov->trans_data,
- prov->rand_auth_workspace, 1);
+ prov_send(prov, prov->rand_auth_workspace, 1);
goto cleanup;
} else {
fail.reason = PROV_ERR_UNEXPECTED_ERR;
@@ -638,7 +642,7 @@ static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
failure:
fail.opcode = PROV_FAILED;
- prov->trans_tx(prov->trans_data, &fail, sizeof(fail));
+ prov_send(prov, &fail, sizeof(fail));
if (prov->cmplt)
prov->cmplt(prov->caller_data, fail.reason, NULL);
prov->cmplt = NULL;
@@ -652,7 +656,23 @@ cleanup:
static void acp_prov_ack(void *user_data, uint8_t msg_num)
{
- /* TODO: Handle PB-ADV Ack */
+ struct mesh_prov_acceptor *rx_prov = user_data;
+ struct deferred_cmd *deferred;
+
+ if (rx_prov != prov)
+ return;
+
+ if (prov->out_opcode == PROV_NONE)
+ return;
+
+ prov->out_opcode = PROV_NONE;
+
+ deferred = l_queue_pop_head(prov->ob);
+ if (!deferred)
+ return;
+
+ prov_send(prov, deferred->cmd, deferred->len);
+ l_free(deferred);
}
@@ -680,7 +700,9 @@ bool acceptor_start(uint8_t num_ele, uint8_t uuid[16],
prov->to_secs = timeout;
prov->agent = agent;
prov->cmplt = complete_cb;
+ prov->ob = l_queue_new();
prov->previous = -1;
+ prov->out_opcode = PROV_NONE;
prov->caller_data = caller_data;
caps = mesh_agent_get_caps(agent);
diff --git a/mesh/provision.h b/mesh/provision.h
index 1a11b691b..1634c4d40 100644
--- a/mesh/provision.h
+++ b/mesh/provision.h
@@ -38,6 +38,7 @@ struct mesh_agent;
#define PROV_DATA 0x07
#define PROV_COMPLETE 0x08
#define PROV_FAILED 0x09
+#define PROV_NONE 0xFF
/* Spec defined Error Codes */
#define PROV_ERR_SUCCESS 0x00
--
2.25.4