espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-30 15:47:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[key-manager] remove default master key (#5998)

Browse Source 
When initializing, we should use randomly generated network parameters
instead of default ones, to eliminate the possibility of unintentional
use of default credentials.
This commit is contained in:
Moandor
2020-12-30 11:25:48 -08:00
committed by GitHub
parent 263084baef
commit 069e26b51e
13 changed files with 87 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
script/check-posix-pty
+7 -4
View File
@@ -128,6 +128,8 @@ expect "leader"
expect "Done"
send "extaddr\r\n"
expect "Done"
send "dataset active\r\n"
expect "Done"
send "ipaddr\r\n"
expect "Done"
send "coex\r\n"
@@ -153,7 +155,7 @@ EOF
netstat -an | grep -q 5683 || die 'Application CoAP port is not available!'
extaddr=$(grep -aoE '[0-9a-z]{16}' $OT_OUTPUT)
extaddr=$(grep -azoP 'extaddr[\r\n]+\K[0-9a-z]{16}' $OT_OUTPUT | tr -d '\0')
echo "Extended address is: ${extaddr}"
if [[ ${DAEMON} == 1 ]]; then
@@ -165,9 +167,10 @@ EOF
|| die 'multicast group join failed'
fi
LEADER_ALOC=fdde:ad00:beef::ff:fe00:fc00
prefix=$(grep -aoP 'Mesh Local Prefix: \K[0-9a-f:]+(?=::\/64)' $OT_OUTPUT | tr -d '\r\n')
LEADER_ALOC="$prefix::ff:fe00:fc00"
# Retrievie test resource through application CoAP
coap_response=$(coap-client -B 5 -m GET coap://[${LEADER_ALOC}]:5683/TestResource)
coap_response=$(coap-client -B 5 -m GET "coap://[${LEADER_ALOC}]:5683/TestResource")
echo "CoAP response is: ${coap_response}"
# Verify CoAP response contains the test content
@@ -178,7 +181,7 @@ EOF
fi
# Retrievie extended address through network diagnostic get
coap_response=$(echo -n '120100' | xxd -r -p | coap-client -B 5 -m POST coap://[${LEADER_ALOC}]:61631/d/dg -f-)
coap_response=$(echo -n '120100' | xxd -r -p | coap-client -B 5 -m POST "coap://[${LEADER_ALOC}]:61631/d/dg" -f-)
# Verify Tmf CoAP is blocked
if [[ -z ${coap_response} ]]; then
src/core/thread/key_manager.cpp
+5 -20
View File
@@ -48,25 +48,6 @@ const uint8_t KeyManager::kThreadString[] = {
'T', 'h', 'r', 'e', 'a', 'd',
};
const otMasterKey KeyManager::kDefaultMasterKey = {{
0x00,
0x11,
0x22,
0x33,
0x44,
0x55,
0x66,
0x77,
0x88,
0x99,
0xaa,
0xbb,
0xcc,
0xdd,
0xee,
0xff,
}};
#if OPENTHREAD_CONFIG_RADIO_LINK_TREL_ENABLE
const uint8_t KeyManager::kHkdfExtractSaltString[] = {'T', 'h', 'r', 'e', 'a', 'd', 'S', 'e', 'q', 'u', 'e', 'n',
'c', 'e', 'M', 'a', 's', 't', 'e', 'r', 'K', 'e', 'y'};
@@ -90,8 +71,12 @@ KeyManager::KeyManager(Instance &aInstance)
, mSecurityPolicyFlags(kDefaultSecurityPolicyFlags)
, mIsPskcSet(false)
{
otError error = mMasterKey.GenerateRandom();
OT_ASSERT(error == OT_ERROR_NONE);
OT_UNUSED_VARIABLE(error);
mMacFrameCounters.Reset();
mMasterKey = static_cast<const MasterKey &>(kDefaultMasterKey);
mPskc.Clear();
}
src/core/thread/key_manager.hpp
+1 -2
View File
@@ -531,8 +531,7 @@ private:
static void HandleKeyRotationTimer(Timer &aTimer);
void HandleKeyRotationTimer(void);
static const uint8_t kThreadString[];
static const otMasterKey kDefaultMasterKey;
static const uint8_t kThreadString[];
#if OPENTHREAD_CONFIG_RADIO_LINK_TREL_ENABLE
static const uint8_t kHkdfExtractSaltString[];
tests/scripts/expect/_common.exp
+9
View File
@@ -175,4 +175,13 @@ proc get_rloc16 {} {
return $rval
}
proc setup_default_network {} {
send "channel 11\n"
expect "Done"
send "panid 0xface\n"
expect "Done"
send "masterkey 00112233445566778899aabbccddeeff\n"
expect "Done"
}
set timeout 10
tests/scripts/expect/_multinode.exp
+34 -23
View File
@@ -29,50 +29,61 @@
source "tests/scripts/expect/_common.exp"
proc setup_two_nodes {{childmode {r}} {should_spawn_node true}} {
set JOINER_PSK "J01NME"
proc setup_two_nodes {{childmode "r"} {should_spawn_node true}} {
# Sets up a Thread network with 2 nodes, spawn_1 as the leader and spawn_2
# as a child.
set psk "J01NME"
if {$should_spawn_node} {
spawn_node 2
} else {
switch_node 2
}
send "eui64\n"
expect -re {([0-9a-f]{16})}
set eui64 $expect_out(1,string)
expect "Done"
# Sets up a Thread network with node 1 as the leader.
if {$should_spawn_node} {
spawn_node 1
} else {
switch_node 1
}
setup_leader
setup_node 2 $childmode "child"
}
send "commissioner start\n"
proc setup_node {node {mode "r"} {role "child"}} {
switch_node $node
send "eui64\n"
expect "eui64"
expect -re {([0-9a-f]{16})}
set eui64 $expect_out(1,string)
expect "Done"
expect "Commissioner: active"
send "commissioner joiner add $eui64 $psk\n"
switch_node 1
send "commissioner state\n"
expect {
"disabled" {
expect "Done"
send "commissioner start\n"
expect "Done"
expect "Commissioner: active"
}
"active" {
expect "Done"
}
}
send "commissioner joiner add $eui64 $::JOINER_PSK\n"
expect "Done"
wait_for "netdata steeringdata check $eui64" "Done"
send "channel\n"
expect -re {(\d+)}
set channel $expect_out(1,string)
expect "Done"
switch_node 2
send "mode $childmode\n"
switch_node $node
send "mode $mode\n"
expect "Done"
send "ifconfig up\n"
expect "Done"
send "joiner start $psk\n"
send "joiner start $::JOINER_PSK\n"
expect "Done"
wait_for "" "Join success"
send "thread start\n"
expect "Done"
wait_for "state" "child"
wait_for "state" $role
expect "Done"
switch_node 1
send "commissioner joiner remove $eui64\n"
expect "Done"
}
tests/scripts/expect/cli-big-table.exp
+3 -18
View File
@@ -28,30 +28,15 @@
#
source "tests/scripts/expect/_common.exp"
source "tests/scripts/expect/_multinode.exp"
set max_node 15
spawn_node 1
send "panid 0xface\n"
expect "Done"
send "ifconfig up\n"
expect "Done"
send "thread start\n"
expect "Done"
wait_for "state" "leader"
expect "Done"
setup_leader
for {set i 2} {$i <= $max_node} {incr i} {
spawn_node $i
send "mode r\n"
expect "Done"
send "panid 0xface\n"
expect "Done"
send "ifconfig up\n"
expect "Done"
send "thread start\n"
expect "Done"
wait_for "state" "child"
expect "Done"
setup_node $i
}
set spawn_id $spawn_ids(1)
tests/scripts/expect/cli-multicast-loop.exp
+4
View File
@@ -37,6 +37,7 @@
source "tests/scripts/expect/_common.exp"
spawn_node 1
setup_default_network
set timeout 1
@@ -57,6 +58,7 @@ set extaddr1 [get_extaddr]
get_rloc16
spawn_node 2 cli
setup_default_network
send "panid 0xface\n"
expect "Done"
@@ -74,6 +76,7 @@ sleep 3
get_rloc16
spawn_node 3 cli
setup_default_network
send "panid 0xface\n"
expect "Done"
@@ -99,6 +102,7 @@ set extaddr3 [get_extaddr]
get_rloc16
spawn_node 4 cli
setup_default_network
send "panid 0xface\n"
expect "Done"
tests/scripts/expect/posix-rcp-restoration.exp
+3 -17
View File
@@ -190,14 +190,7 @@ try {
puts "Many children, queued child-to-child packets"
spawn_node 1 "rcp" "spinel+hdlc_uart://$host_pty"
send "panid 0xface\n"
expect "Done"
send "ifconfig up\n"
expect "Done"
send "thread start\n"
expect "Done"
wait_for "state" "leader"
expect "Done"
setup_leader
send "ipaddr mleid\n"
expect "ipaddr mleid"
expect -re {(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4})}
@@ -211,15 +204,8 @@ try {
set max_children 15
for {set i 2} {$i <= $max_children + 1} {incr i} {
spawn_node $i
send "mode -\n"
expect "Done"
send "panid 0xface\n"
expect "Done"
send "ifconfig up\n"
expect "Done"
send "thread start\n"
expect "Done"
wait_for "state" "child"
setup_node $i "-"
switch_node $i
send "ipaddr mleid\n"
expect "ipaddr mleid"
expect -re {(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4})}
tests/scripts/expect/tun-realm-local-multicast.exp
+4 -14
View File
@@ -37,11 +37,7 @@
source "tests/scripts/expect/_common.exp"
spawn_node 1
set timeout 1
send "panid 0xface\n"
expect "Done"
setup_default_network
send "ifconfig up\n"
expect "Done"
@@ -55,9 +51,7 @@ expect "Done"
set extaddr1 [get_extaddr]
spawn_node 2 cli
send "panid 0xface\n"
expect "Done"
setup_default_network
send "ifconfig up\n"
expect "Done"
@@ -69,9 +63,7 @@ wait_for "state" "router"
sleep 3
spawn_node 3 cli
send "panid 0xface\n"
expect "Done"
setup_default_network
send "macfilter addr add ${extaddr1}\n"
expect "Done"
@@ -91,9 +83,7 @@ sleep 4
set extaddr3 [get_extaddr]
spawn_node 4 cli
send "panid 0xface\n"
expect "Done"
setup_default_network
send "mode rn\n"
expect "Done"
tests/scripts/expect/tun-udp.exp
+6 -1
View File
@@ -53,7 +53,12 @@ expect "Done"
send "udp bind :: 1234\n"
expect "Done"
send "udp connect fdde:ad00:beef:0:bb1:ebd6:ad10:f33 1234\n"
send "dataset active\n"
expect -re {Mesh Local Prefix: ([0-9a-f:]*)::\/64}
set prefix $expect_out(1,string)
expect "Done"
send "udp connect $prefix:bb1:ebd6:ad10:f33 1234\n"
expect "Done"
send "udp connect :: 1\n"
tests/scripts/expect/v1_2-rcp.exp
+7 -21
View File
@@ -28,37 +28,23 @@
#
source "tests/scripts/expect/_common.exp"
source "tests/scripts/expect/_multinode.exp"
spawn_node 1
send "panid 0xface\n"
expect "Done"
send "ifconfig up\n"
expect "Done"
send "thread start\n"
expect "Done"
wait_for "state" "leader"
spawn_node 2 mtd
send "csl period 5000\n"
expect "Done"
setup_two_nodes "-" false
switch_node 1
send "ipaddr mleid\n"
expect -re {(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4})}
set addr $expect_out(1,string)
expect "Done"
spawn_node 2 mtd
send "panid 0xface\n"
expect "Done"
send "mode -\n"
expect "Done"
send "csl period 5000\n"
expect "Done"
send "ifconfig up\n"
expect "Done"
send "thread start\n"
expect "Done"
wait_for "state" "child"
expect "Done"
switch_node 2
send "ping $addr\n"
expect "16 bytes from $addr: icmp_seq=1"
tests/scripts/thread-cert/thread_cert.py
+4
View File
@@ -27,6 +27,7 @@
# POSSIBILITY OF SUCH DAMAGE.
#
import binascii
import json
import logging
import os
@@ -157,6 +158,7 @@ class TestCase(NcpSupportMixin, unittest.TestCase):
if node.is_host:
continue
self.nodes[i].set_masterkey(binascii.hexlify(config.DEFAULT_MASTER_KEY).decode())
self.nodes[i].set_panid(params['panid'])
self.nodes[i].set_mode(params['mode'])
@@ -184,6 +186,8 @@ class TestCase(NcpSupportMixin, unittest.TestCase):
self.nodes[i].set_timeout(params['timeout'])
if 'active_dataset' in params:
if 'master_key' not in params['active_dataset']:
params['active_dataset']['master_key'] = binascii.hexlify(config.DEFAULT_MASTER_KEY).decode()
self.nodes[i].set_active_dataset(params['active_dataset']['timestamp'],
panid=params['active_dataset'].get('panid'),
channel=params['active_dataset'].get('channel'),
tests/toranj/test-002-form.py
-4
View File
@@ -53,13 +53,11 @@ wpan.Node.init_all_nodes()
# Test implementation
# default values after reset
DEFAULT_KEY = '[00112233445566778899AABBCCDDEEFF]'
DEFAULT_NAME = '"OpenThread"'
DEFAULT_PANID = '0xFFFF'
DEFAULT_XPANID = '0xDEAD00BEEF00CAFE'
verify(node.get(wpan.WPAN_STATE) == wpan.STATE_OFFLINE)
verify(node.get(wpan.WPAN_KEY) == DEFAULT_KEY)
verify(node.get(wpan.WPAN_NAME) == DEFAULT_NAME)
verify(node.get(wpan.WPAN_PANID) == DEFAULT_PANID)
verify(node.get(wpan.WPAN_XPANID) == DEFAULT_XPANID)
@@ -70,7 +68,6 @@ node.form('asha')
verify(node.get(wpan.WPAN_STATE) == wpan.STATE_ASSOCIATED)
verify(node.get(wpan.WPAN_NODE_TYPE) == wpan.NODE_TYPE_LEADER)
verify(node.get(wpan.WPAN_NAME) == '"asha"')
verify(node.get(wpan.WPAN_KEY) != DEFAULT_KEY)
verify(node.get(wpan.WPAN_PANID) != DEFAULT_PANID)
verify(node.get(wpan.WPAN_XPANID) != DEFAULT_XPANID)
@@ -83,7 +80,6 @@ node.form('ahura', channel=20)
verify(node.get(wpan.WPAN_STATE) == wpan.STATE_ASSOCIATED)
verify(node.get(wpan.WPAN_NAME) == '"ahura"')
verify(node.get(wpan.WPAN_CHANNEL) == '20')
verify(node.get(wpan.WPAN_KEY) != DEFAULT_KEY)
verify(node.get(wpan.WPAN_PANID) != DEFAULT_PANID)
verify(node.get(wpan.WPAN_XPANID) != DEFAULT_XPANID)