From c75605726e7281b68cc4dee4e895d3386ba7708f Mon Sep 17 00:00:00 2001 From: Brian Gix Date: Thu, 26 Sep 2019 11:14:44 -0700 Subject: [PATCH] mesh: Fix Key Ring permissions for local nodes We do *not* automatically create populated key rings for imported or joined nodes, but we also do not *forbid* any node from adding a key in it's possesion to the local key ring. There are two (known) use cases for Import() 1. Node previously existed on a different physical piece of hardware, and is being migrated to this daemon. 2. Node was newly provisioned Out-Of-Band, and this is the net result of the provisioning. In *neither* case is it a given that the Node should be able to provision another node (the effect of adding the Net Key to the key ring). In neither case is it a given that the Node should be able to modify it's own Config Server states (the effect of adding it's Device Key to the key ring). --- mesh/manager.c | 5 ----- mesh/node.c | 15 --------------- 2 files changed, 20 deletions(-) diff --git a/mesh/manager.c b/mesh/manager.c index 501ec10fe..633597659 100644 --- a/mesh/manager.c +++ b/mesh/manager.c @@ -282,7 +282,6 @@ static struct l_dbus_message *import_node_call(struct l_dbus *dbus, void *user_data) { struct mesh_node *node = user_data; - struct mesh_net *net = node_get_net(node); struct l_dbus_message_iter iter_key; uint16_t primary; uint8_t num_ele; @@ -298,10 +297,6 @@ static struct l_dbus_message *import_node_call(struct l_dbus *dbus, return dbus_error(msg, MESH_ERROR_INVALID_ARGS, "Bad device key"); - if (mesh_net_is_local_address(net, primary, num_ele)) - return dbus_error(msg, MESH_ERROR_INVALID_ARGS, - "Cannot overwrite local device key"); - if (!keyring_put_remote_dev_key(node, primary, num_ele, key)) return dbus_error(msg, MESH_ERROR_FAILED, NULL); diff --git a/mesh/node.c b/mesh/node.c index 833377e99..af45a6130 100644 --- a/mesh/node.c +++ b/mesh/node.c @@ -1681,7 +1681,6 @@ static void get_managed_objects_cb(struct l_dbus_message *msg, void *user_data) } else if (req->type == REQUEST_TYPE_IMPORT) { struct node_import *import = req->import; - struct keyring_net_key net_key; if (!create_node_config(node, node->uuid)) goto fail; @@ -1692,23 +1691,9 @@ static void get_managed_objects_cb(struct l_dbus_message *msg, void *user_data) import->net_idx, import->net_key)) goto fail; - memcpy(net_key.old_key, import->net_key, 16); - net_key.net_idx = import->net_idx; - if (import->flags.kr) - net_key.phase = KEY_REFRESH_PHASE_TWO; - else - net_key.phase = KEY_REFRESH_PHASE_NONE; - /* Initialize directory for storing keyring info */ init_storage_dir(node); - if (!keyring_put_remote_dev_key(node, import->unicast, - num_ele, import->dev_key)) - goto fail; - - if (!keyring_put_net_key(node, import->net_idx, &net_key)) - goto fail; - } else { /* Callback for create node request */ struct keyring_net_key net_key; -- 2.47.3