mirror of
https://github.com/meshcore-dev/MeshCore.git
synced 2026-04-20 22:13:47 +00:00
Merge pull request #1457 from oltaco/remote-set-prvkey
Allow set prv.key over LoRa, clear ACL and validate key
This commit is contained in:
ripplebiz
GitHub
commit
153bcdc6a3
13 changed files with 105 additions and 35 deletions
|
|
@ -48,6 +48,50 @@ LocalIdentity::LocalIdentity(RNG* rng) {
|
|||
ed25519_create_keypair(pub_key, prv_key, seed);
|
||||
}
|
||||
|
||||
bool LocalIdentity::validatePrivateKey(const uint8_t prv[64]) {
|
||||
uint8_t pub[32];
|
||||
ed25519_derive_pub(pub, prv); // derive public key from given private key
|
||||
|
||||
// disallow 00 or FF prefixed public keys
|
||||
if (pub[0] == 0x00 || pub[0] == 0xFF) return false;
|
||||
|
||||
// known good test client keypair
|
||||
const uint8_t test_client_prv[64] = {
|
||||
0x70, 0x65, 0xe1, 0x8f, 0xd9, 0xfa, 0xbb, 0x70,
|
||||
0xc1, 0xed, 0x90, 0xdc, 0xa1, 0x99, 0x07, 0xde,
|
||||
0x69, 0x8c, 0x88, 0xb7, 0x09, 0xea, 0x14, 0x6e,
|
||||
0xaf, 0xd9, 0x3d, 0x9b, 0x83, 0x0c, 0x7b, 0x60,
|
||||
0xc4, 0x68, 0x11, 0x93, 0xc7, 0x9b, 0xbc, 0x39,
|
||||
0x94, 0x5b, 0xa8, 0x06, 0x41, 0x04, 0xbb, 0x61,
|
||||
0x8f, 0x8f, 0xd7, 0xa8, 0x4a, 0x0a, 0xf6, 0xf5,
|
||||
0x70, 0x33, 0xd6, 0xe8, 0xdd, 0xcd, 0x64, 0x71
|
||||
};
|
||||
const uint8_t test_client_pub[32] = {
|
||||
0x1e, 0xc7, 0x71, 0x75, 0xb0, 0x91, 0x8e, 0xd2,
|
||||
0x06, 0xf9, 0xae, 0x04, 0xec, 0x13, 0x6d, 0x6d,
|
||||
0x5d, 0x43, 0x15, 0xbb, 0x26, 0x30, 0x54, 0x27,
|
||||
0xf6, 0x45, 0xb4, 0x92, 0xe9, 0x35, 0x0c, 0x10
|
||||
};
|
||||
|
||||
uint8_t ss1[32], ss2[32];
|
||||
|
||||
// shared secret we calculte from test client pubkey and given private key
|
||||
ed25519_key_exchange(ss1, test_client_pub, prv);
|
||||
|
||||
// shared secret they calculate from our derived public key and test client private key
|
||||
ed25519_key_exchange(ss2, pub, test_client_prv);
|
||||
|
||||
// check that both shared secrets match
|
||||
if (memcmp(ss1, ss2, 32) != 0) return false;
|
||||
|
||||
// reject all-zero shared secret
|
||||
for (int i = 0; i < 32; i++) {
|
||||
if (ss1[i] != 0) return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
bool LocalIdentity::readFrom(Stream& s) {
|
||||
bool success = (s.readBytes(pub_key, PUB_KEY_SIZE) == PUB_KEY_SIZE);
|
||||
success = success && (s.readBytes(prv_key, PRV_KEY_SIZE) == PRV_KEY_SIZE);
|
||||
|
|
|
|||
|
|
@ -76,6 +76,13 @@ public:
|
|||
*/
|
||||
void calcSharedSecret(uint8_t* secret, const uint8_t* other_pub_key) const;
|
||||
|
||||
/**
|
||||
* \brief Validates that a given private key can be used for ECDH / shared-secret operations.
|
||||
* \param prv IN - the private key to validate (must be PRV_KEY_SIZE bytes)
|
||||
* \returns true, if the private key is valid for login.
|
||||
*/
|
||||
static bool validatePrivateKey(const uint8_t prv[64]);
|
||||
|
||||
bool readFrom(Stream& s);
|
||||
bool writeTo(Stream& s) const;
|
||||
void printTo(Stream& s) const;
|
||||
|
|
|
|||
|
|
@ -11,7 +11,8 @@ static File openWrite(FILESYSTEM* _fs, const char* filename) {
|
|||
#endif
|
||||
}
|
||||
|
||||
void ClientACL::load(FILESYSTEM* _fs) {
|
||||
void ClientACL::load(FILESYSTEM* fs, const mesh::LocalIdentity& self_id) {
|
||||
_fs = fs;
|
||||
num_clients = 0;
|
||||
if (_fs->exists("/s_contacts")) {
|
||||
#if defined(RP2040_PLATFORM)
|
||||
|
|
@ -34,11 +35,12 @@ void ClientACL::load(FILESYSTEM* _fs) {
|
|||
success = success && (file.read(unused, 2) == 2);
|
||||
success = success && (file.read((uint8_t *)&c.out_path_len, 1) == 1);
|
||||
success = success && (file.read(c.out_path, 64) == 64);
|
||||
success = success && (file.read(c.shared_secret, PUB_KEY_SIZE) == PUB_KEY_SIZE);
|
||||
success = success && (file.read(c.shared_secret, PUB_KEY_SIZE) == PUB_KEY_SIZE); // will be recalculated below
|
||||
|
||||
if (!success) break; // EOF
|
||||
|
||||
c.id = mesh::Identity(pub_key);
|
||||
self_id.calcSharedSecret(c.shared_secret, pub_key); // recalculate shared secrets in case our private key changed
|
||||
if (num_clients < MAX_CLIENTS) {
|
||||
clients[num_clients++] = c;
|
||||
} else {
|
||||
|
|
@ -50,7 +52,8 @@ void ClientACL::load(FILESYSTEM* _fs) {
|
|||
}
|
||||
}
|
||||
|
||||
void ClientACL::save(FILESYSTEM* _fs, bool (*filter)(ClientInfo*)) {
|
||||
void ClientACL::save(FILESYSTEM* fs, bool (*filter)(ClientInfo*)) {
|
||||
_fs = fs;
|
||||
File file = openWrite(_fs, "/s_contacts");
|
||||
if (file) {
|
||||
uint8_t unused[2];
|
||||
|
|
@ -74,6 +77,16 @@ void ClientACL::save(FILESYSTEM* _fs, bool (*filter)(ClientInfo*)) {
|
|||
}
|
||||
}
|
||||
|
||||
bool ClientACL::clear() {
|
||||
if (!_fs) return false; // no filesystem, nothing to clear
|
||||
if (_fs->exists("/s_contacts")) {
|
||||
_fs->remove("/s_contacts");
|
||||
}
|
||||
memset(clients, 0, sizeof(clients));
|
||||
num_clients = 0;
|
||||
return true;
|
||||
}
|
||||
|
||||
ClientInfo* ClientACL::getClient(const uint8_t* pubkey, int key_len) {
|
||||
for (int i = 0; i < num_clients; i++) {
|
||||
if (memcmp(pubkey, clients[i].id.pub_key, key_len) == 0) return &clients[i]; // already known
|
||||
|
|
|
|||
|
|
@ -36,6 +36,7 @@ struct ClientInfo {
|
|||
#endif
|
||||
|
||||
class ClientACL {
|
||||
FILESYSTEM* _fs;
|
||||
ClientInfo clients[MAX_CLIENTS];
|
||||
int num_clients;
|
||||
|
||||
|
|
@ -44,8 +45,9 @@ public:
|
|||
memset(clients, 0, sizeof(clients));
|
||||
num_clients = 0;
|
||||
}
|
||||
void load(FILESYSTEM* _fs);
|
||||
void load(FILESYSTEM* _fs, const mesh::LocalIdentity& self_id);
|
||||
void save(FILESYSTEM* _fs, bool (*filter)(ClientInfo*)=NULL);
|
||||
bool clear();
|
||||
|
||||
ClientInfo* getClient(const uint8_t* pubkey, int key_len);
|
||||
ClientInfo* putClient(const mesh::Identity& id, uint8_t init_perms);
|
||||
|
|
|
|||
|
|
@ -443,17 +443,18 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch
|
|||
StrHelper::strncpy(_prefs->guest_password, &config[15], sizeof(_prefs->guest_password));
|
||||
savePrefs();
|
||||
strcpy(reply, "OK");
|
||||
} else if (sender_timestamp == 0 &&
|
||||
memcmp(config, "prv.key ", 8) == 0) { // from serial command line only
|
||||
} else if (memcmp(config, "prv.key ", 8) == 0) {
|
||||
uint8_t prv_key[PRV_KEY_SIZE];
|
||||
bool success = mesh::Utils::fromHex(prv_key, PRV_KEY_SIZE, &config[8]);
|
||||
if (success) {
|
||||
// only allow rekey if key is valid
|
||||
if (success && mesh::LocalIdentity::validatePrivateKey(prv_key)) {
|
||||
mesh::LocalIdentity new_id;
|
||||
new_id.readFrom(prv_key, PRV_KEY_SIZE);
|
||||
_callbacks->saveIdentity(new_id);
|
||||
strcpy(reply, "OK");
|
||||
strcpy(reply, "OK, reboot to apply! New pubkey: ");
|
||||
mesh::Utils::toHex(&reply[33], new_id.pub_key, PUB_KEY_SIZE);
|
||||
} else {
|
||||
strcpy(reply, "Error, invalid key");
|
||||
strcpy(reply, "Error, bad key");
|
||||
}
|
||||
} else if (memcmp(config, "name ", 5) == 0) {
|
||||
if (isValidName(&config[5])) {
|
||||
|
|
|
|||
|
|
@ -3,6 +3,7 @@
|
|||
#include "Mesh.h"
|
||||
#include <helpers/IdentityStore.h>
|
||||
#include <helpers/SensorManager.h>
|
||||
#include <helpers/ClientACL.h>
|
||||
|
||||
#if defined(WITH_RS232_BRIDGE) || defined(WITH_ESPNOW_BRIDGE)
|
||||
#define WITH_BRIDGE
|
||||
|
|
@ -94,6 +95,7 @@ class CommonCLI {
|
|||
CommonCLICallbacks* _callbacks;
|
||||
mesh::MainBoard* _board;
|
||||
SensorManager* _sensors;
|
||||
ClientACL* _acl;
|
||||
char tmp[PRV_KEY_SIZE*2 + 4];
|
||||
|
||||
mesh::RTCClock* getRTCClock() { return _rtc; }
|
||||
|
|
@ -101,8 +103,8 @@ class CommonCLI {
|
|||
void loadPrefsInt(FILESYSTEM* _fs, const char* filename);
|
||||
|
||||
public:
|
||||
CommonCLI(mesh::MainBoard& board, mesh::RTCClock& rtc, SensorManager& sensors, NodePrefs* prefs, CommonCLICallbacks* callbacks)
|
||||
: _board(&board), _rtc(&rtc), _sensors(&sensors), _prefs(prefs), _callbacks(callbacks) { }
|
||||
CommonCLI(mesh::MainBoard& board, mesh::RTCClock& rtc, SensorManager& sensors, ClientACL& acl, NodePrefs* prefs, CommonCLICallbacks* callbacks)
|
||||
: _board(&board), _rtc(&rtc), _sensors(&sensors), _acl(&acl), _prefs(prefs), _callbacks(callbacks) { }
|
||||
|
||||
void loadPrefs(FILESYSTEM* _fs);
|
||||
void savePrefs(FILESYSTEM* _fs);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue