Skip to content

Commit ae1a788

Browse files
arduinopennam
arduino
authored and
pennam
committed
Add weak variable checking for device certificate update
1 parent c28ca7a commit ae1a788

File tree

2 files changed

+90
-30
lines changed

2 files changed

+90
-30
lines changed

‎src/ArduinoIoTCloudTCP.cpp‎

Lines changed: 74 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,13 @@ unsigned long getTime()
4343
return ArduinoCloud.getInternalTime();
4444
}
4545

46+
char NOT_AFTER[] __attribute__((weak)) = "";
47+
char NOT_BEFORE[] __attribute__((weak)) = "";
48+
char SERIAL_NUMBER[] __attribute__((weak)) = "";
49+
char AUTHORITY_KEY_ID[] __attribute__((weak)) = "";
50+
char SIGNATURE[] __attribute__((weak)) = "";
51+
52+
4653
/******************************************************************************
4754
CTOR/DTOR
4855
******************************************************************************/
@@ -59,6 +66,9 @@ ArduinoIoTCloudTCP::ArduinoIoTCloudTCP()
5966
#ifdef BOARD_HAS_SECRET_KEY
6067
, _password("")
6168
#endif
69+
#if defined(BOARD_HAS_SECURE_ELEMENT)
70+
, _writeOnConnect(false)
71+
#endif
6272
, _mqttClient{nullptr}
6373
, _messageTopicOut("")
6474
, _messageTopicIn("")
@@ -80,11 +90,6 @@ int ArduinoIoTCloudTCP::begin(ConnectionHandler & connection, bool const enable_
8090
{
8191
_connection = &connection;
8292
_brokerAddress = brokerAddress;
83-
#ifdef BOARD_HAS_SECRET_KEY
84-
_brokerPort = _password.length() ? DEFAULT_BROKER_PORT_USER_PASS_AUTH : brokerPort;
85-
#else
86-
_brokerPort = brokerPort;
87-
#endif
8893

8994
/* Setup broker TLS client */
9095
_brokerClient.begin(connection);
@@ -94,20 +99,7 @@ int ArduinoIoTCloudTCP::begin(ConnectionHandler & connection, bool const enable_
9499
_otaClient.begin(connection);
95100
#endif
96101

97-
/* Setup TimeService */
98-
_time_service.begin(_connection);
99-
100-
/* Setup retry timers */
101-
_connection_attempt.begin(AIOT_CONFIG_RECONNECTION_RETRY_DELAY_ms, AIOT_CONFIG_MAX_RECONNECTION_RETRY_DELAY_ms);
102-
return begin(enable_watchdog, _brokerAddress, _brokerPort);
103-
}
104-
105-
int ArduinoIoTCloudTCP::begin(bool const enable_watchdog, String brokerAddress, uint16_t brokerPort)
106-
{
107-
_brokerAddress = brokerAddress;
108-
_brokerPort = brokerPort;
109-
110-
#if defined(BOARD_HAS_SECRET_KEY)
102+
#if defined (BOARD_HAS_SECRET_KEY)
111103
/* If board is not configured for username and password login */
112104
if(!_password.length())
113105
{
@@ -129,23 +121,63 @@ int ArduinoIoTCloudTCP::begin(bool const enable_watchdog, String brokerAddress,
129121
DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device id.", __FUNCTION__);
130122
return 0;
131123
}
132-
#if !defined(BOARD_HAS_OFFLOADED_ECCX08)
124+
/* read certificate stored in secure element to compare AUTHORITY_KEY_ID */
133125
if (!SElementArduinoCloudCertificate::read(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
134126
{
135127
DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device certificate.", __FUNCTION__);
136128
return 0;
137129
}
130+
/* check if we need to update and try rebuild */
131+
int result = SElementArduinoCloudCertificate::update(_selement, _cert, getDeviceId(), String(NOT_BEFORE), String(NOT_AFTER), String(SERIAL_NUMBER), String(AUTHORITY_KEY_ID), String(SIGNATURE));
132+
if (result > 0)
133+
{
134+
DEBUG_INFO("ArduinoIoTCloudTCP::%s device certificate update request.", __FUNCTION__);
135+
_writeOnConnect = true;
136+
}
137+
else if (result < 0)
138+
{
139+
DEBUG_ERROR("ArduinoIoTCloudTCP::%s device certificate rebuild error.", __FUNCTION__);
140+
/* there was an error trying to rebuild certificate re-read old one */
141+
if (!SElementArduinoCloudCertificate::read(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
142+
{
143+
DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device id.", __FUNCTION__);
144+
return 0;
145+
}
146+
}
147+
else
148+
{
149+
DEBUG_VERBOSE("ArduinoIoTCloudTCP::%s device certificate updated.", __FUNCTION__);
150+
}
151+
#if !defined(BOARD_HAS_OFFLOADED_ECCX08)
138152
_brokerClient.setEccSlot(static_cast<int>(SElementArduinoCloudSlot::Key), _cert.bytes(), _cert.length());
139153
#if OTA_ENABLED
140154
_otaClient.setEccSlot(static_cast<int>(SElementArduinoCloudSlot::Key), _cert.bytes(), _cert.length());
141155
#endif
142156
#endif
157+
_brokerPort = (brokerPort == DEFAULT_BROKER_PORT_AUTO) ? mqttPort() : brokerPort;
143158
#endif
144159

145160
#if defined(BOARD_HAS_SECRET_KEY)
146161
}
162+
else
163+
{
164+
_brokerPort = (brokerPort == DEFAULT_BROKER_PORT_AUTO) ? DEFAULT_BROKER_PORT_USER_PASS_AUTH : brokerPort;
165+
}
147166
#endif
148167

168+
/* Setup TimeService */
169+
_time_service.begin(_connection);
170+
171+
/* Setup retry timers */
172+
_connection_attempt.begin(AIOT_CONFIG_RECONNECTION_RETRY_DELAY_ms, AIOT_CONFIG_MAX_RECONNECTION_RETRY_DELAY_ms);
173+
return begin(enable_watchdog, _brokerAddress, _brokerPort);
174+
}
175+
176+
int ArduinoIoTCloudTCP::begin(bool const enable_watchdog, String brokerAddress, uint16_t brokerPort)
177+
{
178+
_brokerAddress = brokerAddress;
179+
_brokerPort = brokerPort;
180+
149181
_mqttClient.setClient(_brokerClient);
150182

151183
#ifdef BOARD_HAS_SECRET_KEY
@@ -281,6 +313,17 @@ ArduinoIoTCloudTCP::State ArduinoIoTCloudTCP::handle_ConnectMqttBroker()
281313
/* Subscribe to message topic to receive commands */
282314
_mqttClient.subscribe(_messageTopicIn);
283315

316+
#if defined(BOARD_HAS_SECURE_ELEMENT)
317+
/* A device certificate update was pending */
318+
if (_writeOnConnect)
319+
{
320+
if (SElementArduinoCloudCertificate::write(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
321+
{
322+
DEBUG_INFO("ArduinoIoTCloudTCP::%s device certificate update done.", __FUNCTION__);
323+
_writeOnConnect = false;
324+
}
325+
}
326+
#endif
284327
DEBUG_VERBOSE("ArduinoIoTCloudTCP::%s connected to %s:%d", __FUNCTION__, _brokerAddress.c_str(), _brokerPort);
285328
return State::Connected;
286329
}
@@ -558,6 +601,17 @@ int ArduinoIoTCloudTCP::write(String const topic, byte const data[], int const l
558601
return 0;
559602
}
560603

604+
#if defined(BOARD_HAS_SECURE_ELEMENT)
605+
int ArduinoIoTCloudTCP::mqttPort()
606+
{
607+
if (memcmp(DEPRECATED_BROKER_AUTHORITY_KEY_IDENTIFIER, _cert.authorityKeyIdentifierBytes() , ECP256_CERT_AUTHORITY_KEY_ID_LENGTH) == 0) {
608+
return DEPRECATED_BROKER_PORT_SECURE_AUTH;
609+
} else {
610+
return DEFAULT_BROKER_PORT_SECURE_AUTH;
611+
}
612+
}
613+
#endif
614+
561615
/******************************************************************************
562616
* EXTERN DEFINITION
563617
******************************************************************************/

‎src/ArduinoIoTCloudTCP.h‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,14 @@
3131
#if defined(BOARD_HAS_SECURE_ELEMENT)
3232
#include <Arduino_SecureElement.h>
3333
#include <utility/SElementArduinoCloudDeviceId.h>
34-
#if !defined(BOARD_HAS_OFFLOADED_ECCX08)
35-
#include <utility/SElementArduinoCloudCertificate.h>
36-
#endif
34+
#include <utility/SElementArduinoCloudCertificate.h>
3735
#endif
3836

3937
#include <tls/utility/TLSClientMqtt.h>
4038
#include <tls/utility/TLSClientOta.h>
4139

4240
#if OTA_ENABLED
43-
#include <ota/OTA.h>
41+
#include <ota/OTA.h>
4442
#endif
4543

4644
#include "cbor/MessageDecoder.h"
@@ -49,9 +47,14 @@
4947
/******************************************************************************
5048
CONSTANTS
5149
******************************************************************************/
52-
static char const DEFAULT_BROKER_ADDRESS_SECURE_AUTH[] = "iot.arduino.cc";
53-
static uint16_t const DEFAULT_BROKER_PORT_SECURE_AUTH = 8883;
50+
static char const DEFAULT_BROKER_ADDRESS[] = "iot.arduino.cc";
51+
static uint16_t const DEFAULT_BROKER_PORT_SECURE_AUTH = 8885;
52+
static uint16_t const DEPRECATED_BROKER_PORT_SECURE_AUTH = 8883;
53+
static uint8_t const DEPRECATED_BROKER_AUTHORITY_KEY_IDENTIFIER[] = {
54+
0x5b, 0x3e, 0x2a, 0x6b, 0x8e, 0xc9, 0xb0, 0x1a, 0xa8, 0x54,
55+
0xe6, 0x36, 0x9b, 0x8c, 0x09, 0xf9, 0xfc, 0xe1, 0xb9, 0x80 };
5456
static uint16_t const DEFAULT_BROKER_PORT_USER_PASS_AUTH = 8884;
57+
static uint16_t const DEFAULT_BROKER_PORT_AUTO = 0;
5558

5659
/******************************************************************************
5760
* TYPEDEF
@@ -74,8 +77,8 @@ class ArduinoIoTCloudTCP: public ArduinoIoTCloudClass
7477
virtual int connected () override;
7578
virtual void printDebugInfo() override;
7679

77-
int begin(ConnectionHandler & connection, bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS_SECURE_AUTH, uint16_t brokerPort = DEFAULT_BROKER_PORT_SECURE_AUTH);
78-
int begin(bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS_SECURE_AUTH, uint16_t brokerPort = DEFAULT_BROKER_PORT_SECURE_AUTH);
80+
int begin(ConnectionHandler & connection, bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS, uint16_t brokerPort = DEFAULT_BROKER_PORT_AUTO);
81+
int begin(bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS, uint16_t brokerPort = DEFAULT_BROKER_PORT_AUTO);
7982

8083
#ifdef BOARD_HAS_SECRET_KEY
8184
inline void setBoardId (String const device_id) { setDeviceId(device_id); }
@@ -142,9 +145,8 @@ class ArduinoIoTCloudTCP: public ArduinoIoTCloudClass
142145

143146
#if defined(BOARD_HAS_SECURE_ELEMENT)
144147
SecureElement _selement;
145-
#if !defined(BOARD_HAS_OFFLOADED_ECCX08)
146148
ECP256Certificate _cert;
147-
#endif
149+
bool _writeOnConnect;
148150
#endif
149151

150152
TLSClientMqtt _brokerClient;
@@ -183,6 +185,10 @@ class ArduinoIoTCloudTCP: public ArduinoIoTCloudClass
183185
void detachThing();
184186
int write(String const topic, byte const data[], int const length);
185187

188+
#if defined(BOARD_HAS_SECURE_ELEMENT)
189+
int mqttPort();
190+
#endif
191+
186192
};
187193

188194
/******************************************************************************

0 commit comments

Comments
 (0)