riot-ci/RIOT
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #15093 from bergzand/pr/suit/pol_check_before_fetch

Browse Source 
suit: Move policy check to before fetch
This commit is contained in:
benpicco 2020-09-26 19:32:13 +02:00 committed by GitHub
commit d1afb8983e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sys/include/suit.h
View File

@ -87,6 +87,7 @@ typedef enum {
current sequence number */ current sequence number */
SUIT_ERR_SIGNATURE = -6, /**< Unable to verify signature */ SUIT_ERR_SIGNATURE = -6, /**< Unable to verify signature */
SUIT_ERR_DIGEST_MISMATCH = -7, /**< Digest mismatch with COSE and SUIT */ SUIT_ERR_DIGEST_MISMATCH = -7, /**< Digest mismatch with COSE and SUIT */
SUIT_ERR_POLICY_FORBIDDEN = -8, /**< Denied because of policy mismatch */
} suit_error_t; } suit_error_t;
/** /**

9
sys/suit/handlers_command_seq.c
View File

@ -270,6 +270,13 @@ static int _dtv_fetch(suit_manifest_t *manifest, int key,
const uint8_t *url; const uint8_t *url;
size_t url_len; size_t url_len;
/* Check the policy before fetching anything */
int res = suit_policy_check(manifest);
if (res) {
return SUIT_ERR_POLICY_FORBIDDEN;
}
suit_component_t *comp = _get_component(manifest); suit_component_t *comp = _get_component(manifest);
nanocbor_value_t param_uri; nanocbor_value_t param_uri;
@ -289,7 +296,7 @@ static int _dtv_fetch(suit_manifest_t *manifest, int key,
int target_slot = riotboot_slot_other(); int target_slot = riotboot_slot_other();
riotboot_flashwrite_init(manifest->writer, target_slot); riotboot_flashwrite_init(manifest->writer, target_slot);
int res = -1; res = -1;
if (0) {} if (0) {}
#ifdef MODULE_SUIT_TRANSPORT_COAP #ifdef MODULE_SUIT_TRANSPORT_COAP

6
sys/suit/transport/coap.c
View File

@ -379,12 +379,6 @@ static void _suit_handle_url(const char *url)
LOG_INFO("manifest parsed, but no image fetched\n"); LOG_INFO("manifest parsed, but no image fetched\n");
return; return;
} }
res = suit_policy_check(&manifest);
if (res) {
return;
}
#endif #endif
if (res == 0) { if (res == 0) {
LOG_INFO("suit_coap: finalizing image flash\n"); LOG_INFO("suit_coap: finalizing image flash\n");