Skip to content

Commit 9473884

Browse files
M65649M65649
committed
MCU8MASS-1669 Force validation of CA and remove debug bridge
1 parent c49047c commit 9473884

File tree

1 file changed

+79
-168
lines changed

1 file changed

+79
-168
lines changed

‎examples/provision/provision.ino‎

Lines changed: 79 additions & 168 deletions
Original file line numberDiff line numberDiff line change
@@ -452,53 +452,6 @@ static void askInputQuestion(const char* question,
452452
}
453453
}
454454

455-
#define DEL_CHARACTER 127
456-
#define ENTER_CHARACTER 13
457-
458-
#define INPUT_BUFFER_SIZE 256
459-
#define RESPONSE_BUFFER_SIZE 256
460-
461-
void debugBridgeUpdate(void) {
462-
static uint8_t character;
463-
static char input_buffer[INPUT_BUFFER_SIZE];
464-
static uint8_t input_buffer_index = 0;
465-
466-
if (SerialModule.available() > 0) {
467-
character = SerialModule.read();
468-
469-
switch (character) {
470-
case DEL_CHARACTER:
471-
if (strlen(input_buffer) > 0) {
472-
input_buffer[input_buffer_index--] = 0;
473-
}
474-
break;
475-
476-
case ENTER_CHARACTER:
477-
input_buffer[input_buffer_index] = '\r';
478-
input_buffer[input_buffer_index + 1] = '\0';
479-
SequansController.writeBytes((const uint8_t*)input_buffer,
480-
strlen(input_buffer));
481-
482-
// Reset buffer
483-
memset(input_buffer, 0, sizeof(input_buffer));
484-
input_buffer_index = 0;
485-
486-
break;
487-
488-
default:
489-
input_buffer[input_buffer_index++] = character;
490-
break;
491-
}
492-
493-
SerialModule.print((char)character);
494-
}
495-
496-
if (SequansController.isRxReady()) {
497-
// Send back data from modem to host
498-
SerialModule.write(SequansController.readByte());
499-
}
500-
}
501-
502455
/**
503456
* @brief Asks the user to input a certificate/private key and saves that the
504457
* NVM for the Sequans modem at the given @p slot.
@@ -609,9 +562,11 @@ static bool requestAndSaveToNonVolatileMemory(const char* message,
609562
SequansController.writeBytes((uint8_t*)data, data_length, true);
610563

611564
if (SequansController.readResponse() != ResponseResult::OK) {
612-
SerialModule.println(is_certificate
613-
? "Error occurred whilst storing certificate"
614-
: "Error occurred whilst storing private key");
565+
SerialModule.println(
566+
is_certificate
567+
? "Error occurred whilst storing certificate, please try again."
568+
: "Error occurred whilst storing private key, please try "
569+
"again.");
615570
return false;
616571
} else {
617572
SerialModule.println("Done");
@@ -1159,47 +1114,31 @@ void provisionMqtt() {
11591114

11601115
SerialModule.println("\r\n");
11611116

1162-
// ------------------------------------------------------------------------
1163-
// Step 4: Choose whether to verify the domain using a certificate
1164-
// authority (CA)
1165-
// ------------------------------------------------------------------------
1166-
11671117
uint8_t ca_index = DEFAULT_CA_SLOT;
11681118

1169-
bool verify_ca = askCloseEndedQuestion(
1170-
"Verify server certificate against "
1171-
"certificate authority (CA)? If you have problems connecting to\r\n"
1172-
"the server, you might consider turning this off or loading a CA "
1173-
"which can verify the server.");
1174-
1175-
SerialModule.println();
1176-
1177-
if (verify_ca) {
1119+
// --------------------------------------------------------------------
1120+
// Step 4: Custom CA
1121+
// --------------------------------------------------------------------
11781122

1179-
// --------------------------------------------------------------------
1180-
// Step 4.5: Custom CA
1181-
// --------------------------------------------------------------------
1123+
bool load_custom_ca = askCloseEndedQuestion(
1124+
"\r\nDo you want to load a custom certificate authority "
1125+
"certificate?");
11821126

1183-
bool load_custom_ca = askCloseEndedQuestion(
1184-
"\r\nDo you want to load a custom certificate authority "
1185-
"certificate?");
1127+
if (load_custom_ca) {
1128+
ca_index = MQTT_CUSTOM_CA_SLOT;
11861129

1187-
if (load_custom_ca) {
1188-
ca_index = MQTT_CUSTOM_CA_SLOT;
1130+
SerialModule.println("\r\n");
11891131

1132+
while (!requestAndSaveToNonVolatileMemory(
1133+
"Please paste in the CA certifiate and press enter. It "
1134+
"should "
1135+
"be on the follwing form:\r\n"
1136+
"-----BEGIN CERTIFICATE-----\r\n"
1137+
"MIIDXTCCAkWgAwIBAgIJAJC1[...]j3tCx2IUXVqRs5mlSbvA==\r\n"
1138+
"-----END CERTIFICATE-----\r\n\r\n",
1139+
ca_index,
1140+
true)) {
11901141
SerialModule.println("\r\n");
1191-
1192-
if (!requestAndSaveToNonVolatileMemory(
1193-
"Please paste in the CA certifiate and press enter. It "
1194-
"should "
1195-
"be on the follwing form:\r\n"
1196-
"-----BEGIN CERTIFICATE-----\r\n"
1197-
"MIIDXTCCAkWgAwIBAgIJAJC1[...]j3tCx2IUXVqRs5mlSbvA==\r\n"
1198-
"-----END CERTIFICATE-----\r\n\r\n",
1199-
ca_index,
1200-
true)) {
1201-
return;
1202-
}
12031142
}
12041143
}
12051144

@@ -1222,7 +1161,7 @@ void provisionMqtt() {
12221161
AT_MQTT_SECURITY_PROFILE,
12231162
tls_version,
12241163
ciphers,
1225-
verify_ca ? 1 : 0,
1164+
1,
12261165
ca_index,
12271166
psk,
12281167
psk_identity);
@@ -1276,17 +1215,17 @@ void provisionMqtt() {
12761215
// broker after using the CSR
12771216
// -----------------------------------------------------------------
12781217

1279-
if (!requestAndSaveToNonVolatileMemory(
1280-
"Please paste in the public key certifiate provide by "
1281-
"your broker after having signed the CSR\r\nand press "
1282-
"enter. It should be on the follwing form:\r\n"
1283-
"-----BEGIN CERTIFICATE-----\r\n"
1284-
"MIIDXTCCAkWgAwIBAgIJAJC1[...]j3tCx2IUXVqRs5mlSbvA=="
1285-
"\r\n"
1286-
"-----END CERTIFICATE-----\r\n\r\n",
1287-
MQTT_PUBLIC_KEY_SLOT,
1288-
true)) {
1289-
return;
1218+
while (!requestAndSaveToNonVolatileMemory(
1219+
"Please paste in the public key certifiate provide by "
1220+
"your broker after having signed the CSR\r\nand press "
1221+
"enter. It should be on the follwing form:\r\n"
1222+
"-----BEGIN CERTIFICATE-----\r\n"
1223+
"MIIDXTCCAkWgAwIBAgIJAJC1[...]j3tCx2IUXVqRs5mlSbvA=="
1224+
"\r\n"
1225+
"-----END CERTIFICATE-----\r\n\r\n",
1226+
MQTT_PUBLIC_KEY_SLOT,
1227+
true)) {
1228+
SerialModule.println("\r\n");
12901229
}
12911230

12921231
// -----------------------------------------------------------------
@@ -1305,7 +1244,7 @@ void provisionMqtt() {
13051244
AT_MQTT_SECURITY_PROFILE_WITH_CERTIFICATES_ECC,
13061245
tls_version,
13071246
ciphers,
1308-
verify_ca ? 1 : 0,
1247+
1,
13091248
ca_index,
13101249
MQTT_PUBLIC_KEY_SLOT,
13111250
MQTT_PRIVATE_KEY_SLOT,
@@ -1329,28 +1268,28 @@ void provisionMqtt() {
13291268
// Step 5: Load user's certificate and private key
13301269
// -----------------------------------------------------------------
13311270

1332-
if (!requestAndSaveToNonVolatileMemory(
1333-
"Please paste in the public key certifiate and press "
1334-
"enter. It "
1335-
"should be on the follwing form:\r\n"
1336-
"-----BEGIN CERTIFICATE-----\r\n"
1337-
"MIIDXTCCAkWgAwIBAgIJAJC1[...]j3tCx2IUXVqRs5mlSbvA==\r\n"
1338-
"-----END CERTIFICATE-----\r\n\r\n",
1339-
MQTT_PUBLIC_KEY_SLOT,
1340-
true)) {
1341-
return;
1271+
while (!requestAndSaveToNonVolatileMemory(
1272+
"Please paste in the public key certifiate and press "
1273+
"enter. It "
1274+
"should be on the follwing form:\r\n"
1275+
"-----BEGIN CERTIFICATE-----\r\n"
1276+
"MIIDXTCCAkWgAwIBAgIJAJC1[...]j3tCx2IUXVqRs5mlSbvA==\r\n"
1277+
"-----END CERTIFICATE-----\r\n\r\n",
1278+
MQTT_PUBLIC_KEY_SLOT,
1279+
true)) {
1280+
SerialModule.println("\r\n");
13421281
}
13431282

13441283
SerialModule.println("\r\n");
1345-
if (!requestAndSaveToNonVolatileMemory(
1346-
"Please paste in the private key and press enter. "
1347-
"It should be on the following form:\r\n"
1348-
"-----BEGIN RSA/EC PRIVATE KEY-----\r\n"
1349-
"...\r\n"
1350-
"-----END RSA/EC PRIVATE KEY-----\r\n\r\n",
1351-
MQTT_PRIVATE_KEY_SLOT,
1352-
false)) {
1353-
return;
1284+
while (!requestAndSaveToNonVolatileMemory(
1285+
"Please paste in the private key and press enter. "
1286+
"It should be on the following form:\r\n"
1287+
"-----BEGIN RSA/EC PRIVATE KEY-----\r\n"
1288+
"...\r\n"
1289+
"-----END RSA/EC PRIVATE KEY-----\r\n\r\n",
1290+
MQTT_PRIVATE_KEY_SLOT,
1291+
false)) {
1292+
SerialModule.println("\r\n");
13541293
}
13551294

13561295
// -----------------------------------------------------------------
@@ -1368,7 +1307,7 @@ void provisionMqtt() {
13681307
AT_MQTT_SECURITY_PROFILE_WITH_CERTIFICATES,
13691308
tls_version,
13701309
ciphers,
1371-
verify_ca ? 1 : 0,
1310+
1,
13721311
ca_index,
13731312
MQTT_PUBLIC_KEY_SLOT,
13741313
MQTT_PRIVATE_KEY_SLOT,
@@ -1413,50 +1352,34 @@ void provisionHttp() {
14131352
// uses 0 indexed, so just substract
14141353
tls_version -= 1;
14151354

1416-
SerialModule.println("\r\n\r\n");
1355+
SerialModule.println("\r\n");
14171356

1418-
// ------------------------------------------------------------------------
1419-
// Step 2: Choose whether to verify the domain using a certificate
1420-
// authority (CA)
1421-
// ------------------------------------------------------------------------
1357+
// --------------------------------------------------------------------
1358+
// Step 2: Custom CA
1359+
// --------------------------------------------------------------------
14221360

14231361
uint8_t ca_index = DEFAULT_CA_SLOT;
14241362

1425-
bool verify_ca = askCloseEndedQuestion(
1426-
"Verify server certificate against "
1427-
"certificate authority (CA)? If you have problems connecting to\r\n"
1428-
"the server, you might consider turning this off or loading a CA "
1429-
"which can verify the server.");
1430-
1431-
SerialModule.println();
1363+
bool load_custom_ca = askCloseEndedQuestion(
1364+
"\r\nDo you want to load a custom certificate authority "
1365+
"certificate?");
14321366

1433-
if (verify_ca) {
1367+
if (load_custom_ca) {
1368+
ca_index = HTTP_CUSTOM_CA_SLOT;
14341369

1435-
// --------------------------------------------------------------------
1436-
// Step 2.5: Custom CA
1437-
// --------------------------------------------------------------------
1438-
1439-
bool load_custom_ca = askCloseEndedQuestion(
1440-
"\r\nDo you want to load a custom certificate authority "
1441-
"certificate?");
1442-
1443-
if (load_custom_ca) {
1444-
ca_index = HTTP_CUSTOM_CA_SLOT;
1370+
SerialModule.println("\r\n");
14451371

1372+
while (!requestAndSaveToNonVolatileMemory(
1373+
"Please paste in the CA certifiate and press enter. It "
1374+
"should "
1375+
"be on the follwing form:\r\n"
1376+
"-----BEGIN CERTIFICATE-----\r\n"
1377+
"MIIDXTCCAkWgAwIBAgIJAJC1[...]j3tCx2IUXVqRs5mlSbvA=="
1378+
"\r\n"
1379+
"-----END CERTIFICATE-----\r\n\r\n",
1380+
ca_index,
1381+
true)) {
14461382
SerialModule.println("\r\n");
1447-
1448-
if (!requestAndSaveToNonVolatileMemory(
1449-
"Please paste in the CA certifiate and press enter. It "
1450-
"should "
1451-
"be on the follwing form:\r\n"
1452-
"-----BEGIN CERTIFICATE-----\r\n"
1453-
"MIIDXTCCAkWgAwIBAgIJAJC1[...]j3tCx2IUXVqRs5mlSbvA=="
1454-
"\r\n"
1455-
"-----END CERTIFICATE-----\r\n\r\n",
1456-
ca_index,
1457-
true)) {
1458-
return;
1459-
}
14601383
}
14611384
}
14621385

@@ -1471,11 +1394,7 @@ void provisionHttp() {
14711394

14721395
char command[strlen(AT_HTTPS_SECURITY_PROFILE) + 64] = "";
14731396

1474-
sprintf(command,
1475-
AT_HTTPS_SECURITY_PROFILE,
1476-
tls_version,
1477-
verify_ca ? 1 : 0,
1478-
ca_index);
1397+
sprintf(command, AT_HTTPS_SECURITY_PROFILE, tls_version, 1, ca_index);
14791398

14801399
SequansController.writeBytes((uint8_t*)command, strlen(command), true);
14811400

@@ -1509,10 +1428,9 @@ void loop() {
15091428
"What do you want to provision?\r\n"
15101429
"1: MQTT\r\n"
15111430
"2: HTTP\r\n"
1512-
"3: Jump to UART bridge \r\n"
15131431
"Please choose (press enter when done): ",
15141432
1,
1515-
3);
1433+
2);
15161434

15171435
switch (provision_type) {
15181436
case 1:
@@ -1525,12 +1443,5 @@ void loop() {
15251443
SerialModule.println("\r\n");
15261444
provisionHttp();
15271445
break;
1528-
1529-
case 3:
1530-
1531-
SerialModule.println("\r\n");
1532-
while (true) { debugBridgeUpdate(); }
1533-
1534-
break;
15351446
}
1536-
}
1447+
}

0 commit comments

Comments
 (0)