Files
MySensors/hal/transport/MyTransportNRF5_ESB.cpp
T
Marcelo Aquino 28c4f3f19e Signing improvements package (#871)
* Signing support with MAX_PAYLOAD>32

Support in the signing backends to handle configurations
where MAX_PAYLOAD is more than 32 bytes.

Fixes #748

* Support big message signatures

Support for signing messages larger than 32 bytes.
This is not fully testable with the current version of
the library but the change would add theoretical support
for signing any sized messages.

Fixes #749

* Have gw properly indicate whitelisting preferences

If the gateway hold a signing whitelist, inform all
nodes of this requirement and not just nodes that hold
whitelists themselves.

Fixes #806

* Harden security

The flag MY_SIGNING_GW_REQUEST_SIGNATURES_FROM_ALL
has been removed. Gateway will now request signatures
from everyone by default.
In addition to this, no nodes in the network will allow
clearing of signing/whitelisting preferences by OTA
commands by default.
If the old behaviour is needed (suitable for gradual
signing roll out and development purposes) a new flag,
MY_SIGNING_WEAK_SECURITY can be set.

Fixes #807

* Signing debug messages rewritten

All signing related debug has been rewritten to
better match other core debug printouts.
Also, backends are updated to have a smaller
implementation delta.

* Simplified signing option implemented

Enable by MY_SIGNING_SIMPLE_PASSWD. Signing, and signing requirements
will be enabled, as will encryption. Whitelisting is optional.
The value provided to MY_SIGNING_SIMPLE_PASSWD is used as HMAC and AES
key. Whitelists use the first 8 bytes of the password and the ninth
byte from the node ID as serial.
Password is required to be at least 8 characters wide. It is zero
padded if it is not long enough to cover the AES (16 bytes) and HMAC
(32 bytes) keys. It is not recommended to have a password shorter than
32 bytes, and there is no need for a password longer than 32 bytes.

* Add documentation section for signing debug

* Add nRF5 encryption to simple signing option

* Restructure MySigning documentation

* Minor fixes for Linux
2017-05-31 17:13:29 +02:00

164 lines
3.6 KiB
C++

/*
* The MySensors Arduino library handles the wireless radio link and protocol
* between your home built sensors/actuators and HA controller of choice.
* The sensors forms a self healing radio network with optional repeaters. Each
* repeater and gateway builds a routing tables in EEPROM which keeps track of
* the
* network topology allowing messages to be routed to nodes.
*
* Created by Henrik Ekblad <henrik.ekblad@mysensors.org>
* Copyright (C) 2013-2015 Sensnology AB
* Copyright (C) 2017 Frank Holtz
* Full contributor list:
* https://github.com/mysensors/Arduino/graphs/contributors
*
* Documentation: http://www.mysensors.org
* Support Forum: http://forum.mysensors.org
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* version 2 as published by the Free Software Foundation.
*/
#include "MyTransportHAL.h"
#include "drivers/NRF5/Radio.h"
#include "drivers/NRF5/Radio_ESB.h"
#include "drivers/CircularBuffer/CircularBuffer.h"
#if defined(MY_NRF5_ESB_ENABLE_ENCRYPTION)
#include "drivers/AES/AES.h"
#endif
#if defined(MY_NRF5_ESB_ENABLE_ENCRYPTION)
AES _aes;
uint8_t _dataenc[32] = {0};
uint8_t _psk[16];
#endif
bool transportInit(void)
{
#if defined(MY_NRF5_ESB_ENABLE_ENCRYPTION)
#ifdef MY_SIGNING_SIMPLE_PASSWD
memset(_psk, 0, 16);
memcpy(_psk, MY_SIGNING_SIMPLE_PASSWD, strnlen(MY_SIGNING_SIMPLE_PASSWD, 16));
#else
hwReadConfigBlock((void*)_psk, (void*)EEPROM_RF_ENCRYPTION_AES_KEY_ADDRESS, 16);
#endif
// set up AES-key
_aes.set_key(_psk, 16);
// Make sure it is purged from memory when set
memset(_psk, 0, 16);
#endif
return NRF5_ESB_initialize();
}
void transportSetAddress(const uint8_t address)
{
NRF5_ESB_setNodeAddress(address);
NRF5_ESB_startListening();
}
uint8_t transportGetAddress(void)
{
return NRF5_ESB_getNodeID();
}
bool transportSend(const uint8_t to, const void *data, const uint8_t len, const bool noACK)
{
#if defined(MY_NRF5_ESB_ENABLE_ENCRYPTION)
// copy input data because it is read-only
(void)memcpy(_dataenc, data, len);
// has to be adjusted, WIP!
_aes.set_IV(0);
const uint8_t finalLength = len > 16 ? 32 : 16;
// encrypt data
_aes.cbc_encrypt(_dataenc, _dataenc, finalLength / 16);
return NRF5_ESB_sendMessage(to, _dataenc, finalLength, noACK);
#else
return NRF5_ESB_sendMessage(to, data, len, noACK);
#endif
}
bool transportAvailable(void)
{
return NRF5_ESB_isDataAvailable();
}
bool transportSanityCheck(void)
{
return NRF5_ESB_sanityCheck();
}
uint8_t transportReceive(void *data)
{
uint8_t len = 0;
len = NRF5_ESB_readMessage(data);
#if defined(MY_NRF5_ESB_ENABLE_ENCRYPTION)
// has to be adjusted, WIP!
_aes.set_IV(0);
// decrypt data
if (_aes.cbc_decrypt((uint8_t *)(data), (uint8_t *)(data),
len > 16 ? 2 : 1) != AES_SUCCESS) {
len = 0;
}
#endif
return len;
}
void transportPowerDown(void)
{
NRF5_ESB_powerDown();
}
void transportPowerUp(void)
{
NRF5_ESB_powerUp();
}
void transportSleep(void)
{
NRF5_ESB_sleep();
}
void transportStandBy(void)
{
NRF5_ESB_standBy();
}
int16_t transportGetSendingRSSI(void)
{
return NRF5_ESB_getSendingRSSI();
}
int16_t transportGetReceivingRSSI(void)
{
return NRF5_ESB_getReceivingRSSI();
}
int16_t transportGetSendingSNR(void)
{
return INVALID_SNR;
}
int16_t transportGetReceivingSNR(void)
{
return INVALID_SNR;
}
int16_t transportGetTxPowerPercent(void)
{
return NRF5_getTxPowerPercent();
}
int16_t transportGetTxPowerLevel(void)
{
return static_cast<int16_t>(NRF5_getTxPowerLevel());
}
bool transportSetTxPowerPercent(const uint8_t powerPercent)
{
return NRF5_setTxPowerPercent(powerPercent);
}