Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

provisioning: Prevent re-provisioning #94

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

provisioning: Prevent re-provisioning #94

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 24 additions & 13 deletions applications/freertos_iot_libraries_tests/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,25 +160,36 @@ int main( void )
mbedtls_platform_mutex_lock,
mbedtls_platform_mutex_unlock );

xRetVal = vDevModeKeyProvisioning();

if( xRetVal != CKR_OK )
{
LogError( ( "Device key provisioning failed [%d]\n", xRetVal ) );
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
return EXIT_FAILURE;
}
else
if( uxIsDeviceProvisioned() == false )
{
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();

if( uxReturnValue != CKR_OK )
{
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
return EXIT_FAILURE;
}

LogInfo( ( "Device key provisioning succeeded \n" ) );
status = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );

if( status != PSA_SUCCESS )
/* FIXME: Magic value */
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this comment going to be addressed? I see it in each main.c.

psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );

if( uxStatus != PSA_SUCCESS )
{
LogError( ( "OTA signing key provision failed [%d]\n", status ) );
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
return EXIT_FAILURE;
}
else
{
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
}

LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
{
return EXIT_FAILURE;
}
}

status = network_startup();
Expand Down
41 changes: 41 additions & 0 deletions applications/helpers/provisioning/dev_mode_key_provisioning.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,6 +67,9 @@
#include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h"

/* TF-M ITS include */
#include "psa/internal_trusted_storage.h"

/* Default FreeRTOS API for console logging. */
#define DEV_MODE_KEY_PROVISIONING_PRINT( X ) printf

Expand All @@ -91,6 +94,9 @@ extern void vLoggingPrint( const char * pcFormat );

#define DER_FORMAT_BUFFER_LENGTH 512

#define FIRST_BOOT_ITS_UID ( 1U )
#define BOOT_PATTERN ( 0x55 )

/* Adding one to all of the lengths because ASN1 may pad a leading 0 byte
* to numbers that could be interpreted as negative */
typedef struct RsaParams_t
Expand Down Expand Up @@ -1443,4 +1449,39 @@ int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
return result;
}

UBaseType_t uxIsDeviceProvisioned( void )
{
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
const psa_storage_uid_t uid = FIRST_BOOT_ITS_UID;
uint8_t boot_pattern_in_its = 0;
size_t read_data_length = 0;

status = psa_its_get( uid, 0, 1, &boot_pattern_in_its,
&read_data_length );

if( status != PSA_SUCCESS )
{
return 0;
Copy link
Member

@jasonpcarroll jasonpcarroll Sep 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor comment - I notice in calls to this function you check if it returns "false" and not 0. Should this function return "false" and "true" ?

}

if( boot_pattern_in_its == BOOT_PATTERN )
{
return 1;
}
else
{
return 0;
}
}

psa_status_t xWriteDeviceProvisioned( void )
{
const psa_storage_uid_t uid = FIRST_BOOT_ITS_UID;
const psa_storage_create_flags_t flags = PSA_STORAGE_FLAG_WRITE_ONCE;
uint8_t first_boot_pattern = BOOT_PATTERN;

/* Write the pattern to ITS */
return psa_its_set( uid, 1, &first_boot_pattern, flags );
}

/*-----------------------------------------------------------*/
4 changes: 4 additions & 0 deletions applications/helpers/provisioning/dev_mode_key_provisioning.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,4 +247,8 @@ CK_RV xDestroyProvidedObjects( CK_SESSION_HANDLE xSession,
*/
int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
size_t keyBits );

UBaseType_t uxIsDeviceProvisioned( void );
psa_status_t xWriteDeviceProvisioned( void );

#endif /* _AWS_DEV_MODE_KEY_PROVISIONING_H_ */
40 changes: 26 additions & 14 deletions applications/keyword_detection/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,25 +183,37 @@ int main( void )
}
#endif

UBaseType_t xRetVal = vDevModeKeyProvisioning();

if( xRetVal != CKR_OK )
if( uxIsDeviceProvisioned() == false )
{
LogError( ( "Device key provisioning failed [%d]\n", xRetVal ) );
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
return EXIT_FAILURE;
}
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();

LogInfo( ( "Device key provisioning succeeded \n" ) );
if( uxReturnValue != CKR_OK )
{
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
return EXIT_FAILURE;
}

status = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
LogInfo( ( "Device key provisioning succeeded \n" ) );

if( status != PSA_SUCCESS )
{
LogError( ( "OTA signing key provision failed [%d]\n", status ) );
}
/* FIXME: Magic value */
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );

if( uxStatus != PSA_SUCCESS )
{
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
return EXIT_FAILURE;
}
else
{
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
}

LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
{
return EXIT_FAILURE;
}
}

/* The next initializations are done as a part of the main */
/* function as these resources are shared between tasks */
Expand Down
41 changes: 26 additions & 15 deletions applications/object_detection/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,26 +171,37 @@ int main( void )
}
#endif

UBaseType_t xReturnValue = vDevModeKeyProvisioning();

if( xReturnValue != CKR_OK )
if( uxIsDeviceProvisioned() == false )
{
LogError( ( "Device key provisioning failed [%d]\n", xReturnValue ) );
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
return EXIT_FAILURE;
}
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();

LogInfo( ( "Device key provisioning succeeded \n" ) );
if( uxReturnValue != CKR_OK )
{
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
return EXIT_FAILURE;
}

/* FIXME: Magic value */
uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
LogInfo( ( "Device key provisioning succeeded \n" ) );

if( uxStatus != PSA_SUCCESS )
{
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
}
/* FIXME: Magic value */
uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );

if( uxStatus != PSA_SUCCESS )
{
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
return EXIT_FAILURE;
}
else
{
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
}

LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
{
return EXIT_FAILURE;
}
}

/* The next initializations are done as a part of the main */
/* function as these resources are shared between tasks */
Expand Down
40 changes: 26 additions & 14 deletions applications/speech_recognition/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,25 +182,37 @@ int main( void )
}
#endif

UBaseType_t xRetVal = vDevModeKeyProvisioning();

if( xRetVal != CKR_OK )
if( uxIsDeviceProvisioned() == false )
{
LogError( ( "Device key provisioning failed [%d]\n", xRetVal ) );
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
return EXIT_FAILURE;
}
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();

LogInfo( ( "Device key provisioning succeeded \n" ) );
if( uxReturnValue != CKR_OK )
{
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
return EXIT_FAILURE;
}

status = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
LogInfo( ( "Device key provisioning succeeded \n" ) );

if( status != PSA_SUCCESS )
{
LogError( ( "OTA signing key provision failed [%d]\n", status ) );
}
/* FIXME: Magic value */
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );

if( uxStatus != PSA_SUCCESS )
{
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
return EXIT_FAILURE;
}
else
{
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
}

LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
{
return EXIT_FAILURE;
}
}

/* The next initializations are done as a part of the main */
/* function as these resources are shared between tasks */
Expand Down
1 change: 1 addition & 0 deletions release_changes/202409101951.change.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
provisioning: Prevent re-provisioning
Loading