Skip to content

Commit f27b98e

Browse files
david-hazi-armdavid-hazi-arm
authored
provisioning: Prevent re-provisioning (#94)
After successful provisioning, the code writes a pattern into the ITS, which could be checked on the next boot. Signed-off-by: Dávid Házi <[email protected]>
1 parent ca1fe7b commit f27b98e

File tree

7 files changed

+144
-56
lines changed

7 files changed

+144
-56
lines changed

‎applications/freertos_iot_libraries_tests/main.c‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -160,25 +160,35 @@ int main( void )
160160
mbedtls_platform_mutex_lock,
161161
mbedtls_platform_mutex_unlock );
162162

163-
xRetVal = vDevModeKeyProvisioning();
164-
165-
if( xRetVal != CKR_OK )
166-
{
167-
LogError( ( "Device key provisioning failed [%d]\n", xRetVal ) );
168-
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
169-
return EXIT_FAILURE;
170-
}
171-
else
163+
if( uxIsDeviceProvisioned() == 0 )
172164
{
165+
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();
166+
167+
if( uxReturnValue != CKR_OK )
168+
{
169+
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
170+
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
171+
return EXIT_FAILURE;
172+
}
173+
173174
LogInfo( ( "Device key provisioning succeeded \n" ) );
174-
status = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
175175

176-
if( status != PSA_SUCCESS )
176+
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
177+
178+
if( uxStatus != PSA_SUCCESS )
177179
{
178-
LogError( ( "OTA signing key provision failed [%d]\n", status ) );
180+
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
181+
return EXIT_FAILURE;
182+
}
183+
else
184+
{
185+
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
179186
}
180187

181-
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
188+
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
189+
{
190+
return EXIT_FAILURE;
191+
}
182192
}
183193

184194
status = network_startup();

‎applications/helpers/provisioning/dev_mode_key_provisioning.c‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,9 @@
6767
#include "mbedtls/entropy.h"
6868
#include "mbedtls/ctr_drbg.h"
6969

70+
/* TF-M ITS include */
71+
#include "psa/internal_trusted_storage.h"
72+
7073
/* Default FreeRTOS API for console logging. */
7174
#define DEV_MODE_KEY_PROVISIONING_PRINT( X ) printf
7275

@@ -91,6 +94,9 @@ extern void vLoggingPrint( const char * pcFormat );
9194

9295
#define DER_FORMAT_BUFFER_LENGTH 512
9396

97+
#define FIRST_BOOT_ITS_UID ( 1U )
98+
#define BOOT_PATTERN ( 0x55 )
99+
94100
/* Adding one to all of the lengths because ASN1 may pad a leading 0 byte
95101
* to numbers that could be interpreted as negative */
96102
typedef struct RsaParams_t
@@ -1443,4 +1449,39 @@ int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
14431449
return result;
14441450
}
14451451

1452+
UBaseType_t uxIsDeviceProvisioned( void )
1453+
{
1454+
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
1455+
const psa_storage_uid_t uid = FIRST_BOOT_ITS_UID;
1456+
uint8_t boot_pattern_in_its = 0;
1457+
size_t read_data_length = 0;
1458+
1459+
status = psa_its_get( uid, 0, 1, &boot_pattern_in_its,
1460+
&read_data_length );
1461+
1462+
if( status != PSA_SUCCESS )
1463+
{
1464+
return 0;
1465+
}
1466+
1467+
if( boot_pattern_in_its == BOOT_PATTERN )
1468+
{
1469+
return 1;
1470+
}
1471+
else
1472+
{
1473+
return 0;
1474+
}
1475+
}
1476+
1477+
psa_status_t xWriteDeviceProvisioned( void )
1478+
{
1479+
const psa_storage_uid_t uid = FIRST_BOOT_ITS_UID;
1480+
const psa_storage_create_flags_t flags = PSA_STORAGE_FLAG_WRITE_ONCE;
1481+
uint8_t first_boot_pattern = BOOT_PATTERN;
1482+
1483+
/* Write the pattern to ITS */
1484+
return psa_its_set( uid, 1, &first_boot_pattern, flags );
1485+
}
1486+
14461487
/*-----------------------------------------------------------*/

‎applications/helpers/provisioning/dev_mode_key_provisioning.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,4 +247,8 @@ CK_RV xDestroyProvidedObjects( CK_SESSION_HANDLE xSession,
247247
*/
248248
int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
249249
size_t keyBits );
250+
251+
UBaseType_t uxIsDeviceProvisioned( void );
252+
psa_status_t xWriteDeviceProvisioned( void );
253+
250254
#endif /* _AWS_DEV_MODE_KEY_PROVISIONING_H_ */

‎applications/keyword_detection/main.c‎

Lines changed: 25 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -183,25 +183,36 @@ int main( void )
183183
}
184184
#endif
185185

186-
UBaseType_t xRetVal = vDevModeKeyProvisioning();
187-
188-
if( xRetVal != CKR_OK )
186+
if( uxIsDeviceProvisioned() == 0 )
189187
{
190-
LogError( ( "Device key provisioning failed [%d]\n", xRetVal ) );
191-
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
192-
return EXIT_FAILURE;
193-
}
188+
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();
194189

195-
LogInfo( ( "Device key provisioning succeeded \n" ) );
190+
if( uxReturnValue != CKR_OK )
191+
{
192+
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
193+
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
194+
return EXIT_FAILURE;
195+
}
196196

197-
status = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
197+
LogInfo( ( "Device key provisioning succeeded \n" ) );
198198

199-
if( status != PSA_SUCCESS )
200-
{
201-
LogError( ( "OTA signing key provision failed [%d]\n", status ) );
202-
}
199+
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
200+
201+
if( uxStatus != PSA_SUCCESS )
202+
{
203+
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
204+
return EXIT_FAILURE;
205+
}
206+
else
207+
{
208+
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
209+
}
203210

204-
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
211+
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
212+
{
213+
return EXIT_FAILURE;
214+
}
215+
}
205216

206217
/* The next initializations are done as a part of the main */
207218
/* function as these resources are shared between tasks */

‎applications/object_detection/main.c‎

Lines changed: 25 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -171,26 +171,36 @@ int main( void )
171171
}
172172
#endif
173173

174-
UBaseType_t xReturnValue = vDevModeKeyProvisioning();
175-
176-
if( xReturnValue != CKR_OK )
174+
if( uxIsDeviceProvisioned() == 0 )
177175
{
178-
LogError( ( "Device key provisioning failed [%d]\n", xReturnValue ) );
179-
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
180-
return EXIT_FAILURE;
181-
}
176+
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();
182177

183-
LogInfo( ( "Device key provisioning succeeded \n" ) );
178+
if( uxReturnValue != CKR_OK )
179+
{
180+
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
181+
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
182+
return EXIT_FAILURE;
183+
}
184184

185-
/* FIXME: Magic value */
186-
uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
185+
LogInfo( ( "Device key provisioning succeeded \n" ) );
187186

188-
if( uxStatus != PSA_SUCCESS )
189-
{
190-
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
191-
}
187+
uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
188+
189+
if( uxStatus != PSA_SUCCESS )
190+
{
191+
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
192+
return EXIT_FAILURE;
193+
}
194+
else
195+
{
196+
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
197+
}
192198

193-
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
199+
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
200+
{
201+
return EXIT_FAILURE;
202+
}
203+
}
194204

195205
/* The next initializations are done as a part of the main */
196206
/* function as these resources are shared between tasks */

‎applications/speech_recognition/main.c‎

Lines changed: 25 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -182,25 +182,36 @@ int main( void )
182182
}
183183
#endif
184184

185-
UBaseType_t xRetVal = vDevModeKeyProvisioning();
186-
187-
if( xRetVal != CKR_OK )
185+
if( uxIsDeviceProvisioned() == 0 )
188186
{
189-
LogError( ( "Device key provisioning failed [%d]\n", xRetVal ) );
190-
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
191-
return EXIT_FAILURE;
192-
}
187+
UBaseType_t uxReturnValue = vDevModeKeyProvisioning();
193188

194-
LogInfo( ( "Device key provisioning succeeded \n" ) );
189+
if( uxReturnValue != CKR_OK )
190+
{
191+
LogError( ( "Device key provisioning failed [%d]\n", uxReturnValue ) );
192+
LogError( ( "Device cannot connect to IoT Core. Exiting...\n" ) );
193+
return EXIT_FAILURE;
194+
}
195195

196-
status = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
196+
LogInfo( ( "Device key provisioning succeeded \n" ) );
197197

198-
if( status != PSA_SUCCESS )
199-
{
200-
LogError( ( "OTA signing key provision failed [%d]\n", status ) );
201-
}
198+
psa_status_t uxStatus = xOtaProvisionCodeSigningKey( &xOTACodeVerifyKeyHandle, 3072 );
199+
200+
if( uxStatus != PSA_SUCCESS )
201+
{
202+
LogError( ( "OTA signing key provision failed [%d]\n", uxStatus ) );
203+
return EXIT_FAILURE;
204+
}
205+
else
206+
{
207+
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
208+
}
202209

203-
LogInfo( ( "OTA signing key provisioning succeeded \n" ) );
210+
if( xWriteDeviceProvisioned() != PSA_SUCCESS )
211+
{
212+
return EXIT_FAILURE;
213+
}
214+
}
204215

205216
/* The next initializations are done as a part of the main */
206217
/* function as these resources are shared between tasks */

‎release_changes/202409101951.change.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
provisioning: Prevent re-provisioning

0 commit comments

Comments
 (0)