added image validation and signature

components/mesh_ota/https_client.c

@@ -61,10 +61,9 @@ https_client_ret_t https_clientInitialize()
         break;
     default:
         i32RetHTTPClient = HTTPS_CLIENT_ERROR;
-        ESP_LOGE(TAG, "Unknown error while init");
+        ESP_LOGE(TAG, "Unknown error while init https client");
         break;
     }
-
     return i32RetHTTPClient;
 }
 
@@ -72,19 +71,20 @@ https_client_ret_t https_clientRetrieveData(char* pu8Data, uint32_t* pu32DataLen
 {
     https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;
     int32_t i32RetRetrieveData = ESP_OK;
-    bzero(pu8Data, *pu32DataLenght);
     bool bRetriveData = true;
 
+    bzero(pu8Data, *pu32DataLenght);
+    *pu32BytesRead = 0U;
+
     while (bRetriveData)
     {
         //Reading HTTP response
-        i32RetRetrieveData = mbedtls_ssl_read(&sHTTPS_ClientConfig.ssl, (unsigned char *)pu8Data, *pu32DataLenght);
+        i32RetRetrieveData = mbedtls_ssl_read(&sHTTPS_ClientConfig.ssl, (unsigned char *)(pu8Data+(*pu32BytesRead)), ((*pu32DataLenght)-(*pu32BytesRead)));
 
         if(i32RetRetrieveData > 0)
         {
             //Data received
             *pu32BytesRead = *pu32BytesRead + i32RetRetrieveData;
-            *pu32DataLenght = *pu32DataLenght - *pu32BytesRead;
 
             if(*pu32DataLenght > 0)
             {
@@ -102,6 +102,7 @@ https_client_ret_t https_clientRetrieveData(char* pu8Data, uint32_t* pu32DataLen
         {
             //all data read --> stop reading
             bRetriveData = false;
+            pu32BytesRead = 0;
         }
 
         if(i32RetRetrieveData == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY)
@@ -118,15 +119,15 @@ https_client_ret_t https_clientDeinitialize()
 {
     https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;
 
-    i32RetHTTPClient = mbedtls_ssl_close_notify(&sHTTPS_ClientConfig.ssl);
+    i32RetHTTPClient = mbedtls_ssl_close_notify(&sHTTPS_ClientConfig.ssl); //close session
 
     if(i32RetHTTPClient != ESP_OK)
     {
         ESP_LOGE(TAG, "mbedtls_ssl_close_notify returned 0x%x", i32RetHTTPClient);
     }
 
-    mbedtls_ssl_session_reset(&sHTTPS_ClientConfig.ssl);
-    mbedtls_net_free(&sHTTPS_ClientConfig.server_fd);
+    mbedtls_ssl_session_reset(&sHTTPS_ClientConfig.ssl); //reset embedssl
+    mbedtls_net_free(&sHTTPS_ClientConfig.server_fd); //free ram
 
     return i32RetHTTPClient;
 }
@@ -265,7 +266,7 @@ https_client_ret_t https_clientSendRequest()
     https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;
     int32_t i32RetSendRequest = ESP_OK;
     uint32_t u32WrittenBytes = 0;
-    bool bWrite = true;
+    bool bWrite = true; //flag to stop loop
 
     //Writing HTTP request
     while((u32WrittenBytes < strlen(REQUEST)) && bWrite)

components/mesh_ota/include/https_client.h

@@ -44,7 +44,6 @@
 #define CONFIG_OTA_HTTPS_SERVER_COMMON_NAME "exmaple.com"
 #endif
 
-
 #define HTTPS_CLIENT_OK 0
 #define HTTPS_CLIENT_ERROR -1
 #define HTTPS_CLIENT_ERROR_INIT_EMBEDTLS -2

components/mesh_ota/include/mesh_ota.h

@@ -16,7 +16,6 @@
 #include "https_client.h"
 
 bool bNewerVersion(const char* pu8Local, const char* pu8Remote);
-
 esp_err_t errExtractVersionNumber(const  char* pu8Data, uint32_t* pu32DataLenght, char* pc8RemoteVersionNumber);
 esp_err_t errFindImageStart(const  char* pu8Data, uint32_t* pu32DataLenght, uint32_t* pu32StartOffset);
 

components/mesh_ota/mesh_ota.c

@@ -1,43 +1,34 @@
 #include "mesh_ota.h"
 
-
-
 /*
  * 999.999.999
  * Return true if remote version is newer (higher) than local version
 */
-bool bNewerVersion(const char* pu8Local, const  char* pu8Remote) {
+bool bNewerVersion(const char* pu8Local, const  char* pu8Remote) 
+{
+    char u8LocalTmp[12]; //local version
+    char u8RemoteTmp[12]; //remote version
+    char* pu8saveptrLocal; //context for strok_r 
+    char* pu8saveptrRemote; //context for strok_r 
+    bool bReturn = false; //flag to stop loop
+    uint8_t u8Index = 0; //numbers counter in version string
 
-    char u8LocalTmp[12];
-    char u8RemoteTmp[12];
+    strcpy(u8LocalTmp, pu8Local); //copy in tmp
+    strcpy(u8RemoteTmp, pu8Remote); //copy in tmp
 
-    char* pu8saveptrLocal;
-    char* pu8saveptrRemote;
-
-    strcpy(u8LocalTmp, pu8Local);
-    strcpy(u8RemoteTmp, pu8Remote);
-
-    char* pu8TokenLocal = strtok_r(u8LocalTmp, ".", &pu8saveptrLocal);
-    char* pu8TokenRemote = strtok_r(u8RemoteTmp, ".", &pu8saveptrRemote) ;
-
-
-    bool bReturn = false;
-
-    uint8_t u8Index = 0;
-
-    while( (u8Index <= 2) && (bReturn == false)) {
+    char* pu8TokenLocal = strtok_r(u8LocalTmp, ".", &pu8saveptrLocal); //split tokens
+    char* pu8TokenRemote = strtok_r(u8RemoteTmp, ".", &pu8saveptrRemote); //split tokens
 
+    while( (u8Index <= 2) && (bReturn == false)) //loop through tokens
+    {
         u8Index++;
-
         if(atoi(pu8TokenLocal) < atoi(pu8TokenRemote))
         {
-            bReturn = true;
+            bReturn = true; //version number difference --> stop loop
         }
-
-        pu8TokenLocal = strtok_r(NULL, ".", &pu8saveptrLocal);
-        pu8TokenRemote = strtok_r(NULL, ".", &pu8saveptrRemote) ;
+        pu8TokenLocal = strtok_r(NULL, ".", &pu8saveptrLocal); //split tokens
+        pu8TokenRemote = strtok_r(NULL, ".", &pu8saveptrRemote); //split tokens
     }
-
     return bReturn;
 }
 
@@ -45,30 +36,26 @@ esp_err_t errFindImageStart(const char* pu8Data, uint32_t* pu32DataLenght, uint3
 {
     /*
     Offset  value
-    0      = E9
+    0      = 0xE9 (first byte in image --> magic byte)
     48     = first digit of version number
     */
 
     esp_err_t errReturn = ESP_OK;
-
     bool bImageStartOffsetFound = false;
-    
-    *pu32StartOffset = 0U;
-    
     uint32_t u32DataIndex = 0;
     uint32_t u32FirstDotOffset = 0;
     uint32_t u32SecondDotOffset = 0;
     uint8_t u8FirstDotIndex = 0;
     uint8_t u8SecondDotIndex = 0;
 
+    *pu32StartOffset = 0U; //reset offset to zero
+    
     while((u32DataIndex < *pu32DataLenght) &&  (bImageStartOffsetFound == false))
     {
         //search for magic byte
-        
         if(pu8Data[u32DataIndex] == 0xe9)
         {
             //magic byte found
-            //printf("\n magic byte found: %i\n", u32DataIndex);
             while ((u8FirstDotIndex < 3) && (u32FirstDotOffset == 0))
             {
                 //search first dot in version number
@@ -76,9 +63,8 @@ esp_err_t errFindImageStart(const char* pu8Data, uint32_t* pu32DataLenght, uint3
                 {
                     if((pu8Data[(u32DataIndex+49+u8FirstDotIndex)] == 0x2e))
                     {
-                        //first do found
+                        //first dot found
                         u32FirstDotOffset = (u32DataIndex+49+u8FirstDotIndex);
-                        //printf("First dot offset: %i\n", u32FirstDotOffset);
                     }
                 }
              u8FirstDotIndex++;
@@ -86,15 +72,13 @@ esp_err_t errFindImageStart(const char* pu8Data, uint32_t* pu32DataLenght, uint3
 
             while ((u8SecondDotIndex < 3) && (u32SecondDotOffset == 0) && (u32FirstDotOffset != 0))
             {
-                
                 //search first dot in version number
                 if((u32FirstDotOffset+(u8SecondDotIndex+2)) < *pu32DataLenght)
                 {
                     if((pu8Data[(u32FirstDotOffset+(u8SecondDotIndex+2))] == 0x2e))
                     {
-                        //second do found
+                        //second dot found
                         u32SecondDotOffset = (u32FirstDotOffset+(u8SecondDotIndex+2));
-                        //printf("Second dot offset: %i\n", u32SecondDotOffset);
                     }
                 }
                 u8SecondDotIndex++;
@@ -115,10 +99,7 @@ esp_err_t errFindImageStart(const char* pu8Data, uint32_t* pu32DataLenght, uint3
                 u8SecondDotIndex = 0;
             }
         }
-
         u32DataIndex++;
-        //putchar(pu8Data[i]);
-        //printf("%x ", pu8Data[u32DataIndex]);
     }
 
     if(bImageStartOffsetFound == false)
@@ -131,25 +112,17 @@ esp_err_t errFindImageStart(const char* pu8Data, uint32_t* pu32DataLenght, uint3
 
 esp_err_t errExtractVersionNumber(const char* pu8Data, uint32_t* pu32DataLenght, char* pc8RemoteVersionNumber)
 {
-    strcpy(pc8RemoteVersionNumber, "999.999.999"); //init value
-
     uint32_t u32StartOffset;
+    esp_err_t err = ESP_OK;
 
-    esp_err_t err = errFindImageStart(pu8Data, pu32DataLenght, &u32StartOffset);
+    strcpy(pc8RemoteVersionNumber, "999.999.999"); //init value
+    err = errFindImageStart(pu8Data, pu32DataLenght, &u32StartOffset); //get image start offset
 
     if(err == ESP_OK)
     {
-
-    //printf("\nImage start found: %i\n", u32StartOffset);
-
-    strncpy(pc8RemoteVersionNumber, pu8Data+(u32StartOffset+48),  11);
-    
+        //image found
+        strncpy(pc8RemoteVersionNumber, pu8Data+(u32StartOffset+48), 11); //copy version number
         pc8RemoteVersionNumber[12] = '\0';
-    
-    //printf("remote version number %s\n\n", pc8RemoteVersionNumber);
     }
-
-
-
     return err;
 }

components/mesh_ota/test/test_image_hex.h

@@ -1,7 +1,6 @@
 #ifndef H_TEST_IMAGE_HEX
 #define H_TEST_IMAGE_HEX
 
-
 //with http response +  0.0.1
 char dataWithHttpRespone0_0_1[] = 
 {
@@ -32,7 +31,6 @@ char dataWithHttpRespone0_0_1[] =
 0x65, 0x2f, 0x68, 0x65, 0x6e, 0x64, 0x72, 0x69, 0x6b, 0x2f, 0x65, 0x73, 0x70, 0x2f, 0x65, 0x73, 0x70, 0x2d, 0x69, 0x64, 0x66, 0x2f, 0x63, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74
 };
 
-
 //without http response +  0.0.1
 char dataWithoutHttpRespone0_0_1[] = 
 {
@@ -80,7 +78,6 @@ char dataWithoutHttpRespone999_999_999[] =
     
 };
 
-
 //with http response +  999.999.999
 char dataWithHttpRespone999_999_999[] = 
 {
@@ -171,5 +168,4 @@ char dataWithHttpRespone999_99_999[] =
 0x68, 0x6f, 0x6d, 0x65, 0x2f, 0x68, 0x65, 0x6e, 0x64, 0x72, 0x69, 0x6b, 0x2f, 0x65, 0x73, 0x70, 0x2f, 0x65, 0x73, 0x70, 0x2d, 0x69, 0x64, 0x66, 0x2f, 0x63, 0x6f, 0x6d, 0x70, 0x6f, 0x6e, 0x65, 0x6e, 0x74,
 };
  
-    
 #endif /* H_TEST_IMAGE_HEX */

components/mesh_ota/test/test_mesh_ota.c

@@ -2,7 +2,6 @@
 #include "unity.h"
 
 #include "mesh_ota.h"
-
 #include "test_image_hex.h"
 
 // ### ### ###  distinguish newer image version ### ### ###

main/main.c

@@ -13,7 +13,6 @@
 
 #include "mesh_ota.h"
 
-
 #define RX_SIZE          (1234)
 #define TX_SIZE          (1234)
 
@@ -491,9 +490,14 @@ static void test(void *pvParameters)
     char buffer[1024U];
     uint32_t u32BytesRead = 0;
     char pcRemoteVersionNumber[12];
+    const esp_partition_t * currentPartition;
+    const esp_partition_t * otaPartition;
+    static esp_ota_handle_t otaHandle;
+    uint32_t u32StartOffset;
+    esp_app_desc_t otaPartitionDesc;
 
     ESP_LOGI(MESH_TAG, "Hello World");
-    const esp_partition_t * currentPartition = esp_ota_get_boot_partition();
+    currentPartition = esp_ota_get_boot_partition();
     ESP_LOGI(MESH_TAG, "Type: %d",  (*currentPartition).subtype);
     ESP_LOGI(MESH_TAG, "Start address: %d",  (*currentPartition).address);
     ESP_LOGI(MESH_TAG, "Size: %d",  (*currentPartition).size);
@@ -507,9 +511,8 @@ static void test(void *pvParameters)
     ESP_LOGI(MESH_TAG, "currentPartition Timestamp: %s %s",  (curPartitionDesc).date, (curPartitionDesc).time);
 
     https_clientInitialize();
-
     https_clientRetrieveData(buffer, &u32BufferLenght, &u32BytesRead);
-
+    ESP_LOGI(MESH_TAG, "Data received: %i", u32BytesRead);
     err = errExtractVersionNumber(buffer, &u32BytesRead, pcRemoteVersionNumber);
 
     if(err == ESP_OK)
@@ -518,21 +521,58 @@ static void test(void *pvParameters)
          {
             ESP_LOGI(MESH_TAG, "Newer Version available");
             //write ota
+            otaPartition=  esp_ota_get_next_update_partition(currentPartition);
+
+            err = errFindImageStart(buffer, &u32BufferLenght, &u32StartOffset);
+
+            ESP_LOGI(MESH_TAG, "first byte offset: %i", u32StartOffset);
+            ESP_LOGI(MESH_TAG, "first byte: %x", buffer[u32StartOffset]);
+                 
+            err = esp_ota_begin(otaPartition, OTA_SIZE_UNKNOWN, &otaHandle);
+            ESP_ERROR_CHECK(err);
+
+            do 
+            {   
+                ESP_LOGI(MESH_TAG, "OTA-Data written: %i", u32BytesRead);
+                err = esp_ota_write(otaHandle, (const void*) buffer+u32StartOffset, (u32BytesRead-u32StartOffset));
+                u32StartOffset = 0U;
+                https_clientRetrieveData(buffer, &u32BufferLenght, &u32BytesRead);  
             }
+            while (u32BytesRead > 0);
+            
+            err = esp_ota_end(otaHandle);
+            ESP_ERROR_CHECK(err);
+            
+            err = esp_ota_get_partition_description(otaPartition, &otaPartitionDesc);
+            ESP_ERROR_CHECK(err);
+            ESP_LOGI(MESH_TAG, "otaPartition project_name: %s",  (otaPartitionDesc).project_name);
+            err = esp_ota_set_boot_partition(otaPartition);
+            ESP_ERROR_CHECK(err);
+            //esp_restart();
+         }
+         else
+         {
+           ESP_LOGI(MESH_TAG, "NO newer Version available");  
+         }
+    }
+    else
+    {
+        ESP_LOGI(MESH_TAG, "errExtractVersionNumber failed: %i", err);
     }
 
     https_clientDeinitialize();
 
+    ESP_LOGI(MESH_TAG, "\nend of task\n");  
     while(1)
     {
-
+        vTaskDelay(1000 / portTICK_PERIOD_MS);
     }
 }
 
 
 void app_main(void)
 {
-        
+        ESP_LOGI(MESH_TAG, "hardcoded: 0.0.1"); 
 /*
     err = nvs_flash_erase();
     if(err != ESP_OK){
@@ -607,16 +647,14 @@ void app_main(void)
              esp_mesh_is_root_fixed() ? "root fixed" : "root not fixed",
              esp_mesh_get_topology(), esp_mesh_get_topology() ? "(chain)":"(tree)", esp_mesh_is_ps_enabled());
 
-    
-        for(;;) {
+        for(;;) 
+        {
             if(gpio_get_level(0) == 0){
                 break;
             }
             vTaskDelay(1000 / portTICK_PERIOD_MS);
     }
-
       xTaskCreate(&test, "test_task", 8192, NULL, 5, NULL);
-
 }
 
 

sdkconfig

@@ -67,11 +67,12 @@ CONFIG_BOOTLOADER_RESERVE_RTC_SIZE=0
 #
 # Security features
 #
+CONFIG_SECURE_SIGNED_ON_BOOT=y
 CONFIG_SECURE_SIGNED_ON_UPDATE=y
 CONFIG_SECURE_SIGNED_APPS=y
 CONFIG_SECURE_SIGNED_APPS_NO_SECURE_BOOT=y
 CONFIG_SECURE_SIGNED_APPS_ECDSA_SCHEME=y
-# CONFIG_SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT is not set
+CONFIG_SECURE_SIGNED_ON_BOOT_NO_SECURE_BOOT=y
 CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT=y
 # CONFIG_SECURE_BOOT is not set
 CONFIG_SECURE_BOOT_BUILD_SIGNED_BINARIES=y
@@ -127,7 +128,7 @@ CONFIG_ESPTOOLPY_MONITOR_BAUD=115200
 CONFIG_PARTITION_TABLE_CUSTOM=y
 CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="partitions.csv"
 CONFIG_PARTITION_TABLE_FILENAME="partitions.csv"
-CONFIG_PARTITION_TABLE_OFFSET=0x8000
+CONFIG_PARTITION_TABLE_OFFSET=0x10000
 CONFIG_PARTITION_TABLE_MD5=y
 # end of Partition Table
 
@@ -159,7 +160,7 @@ CONFIG_MESH_AP_CONNECTIONS=6
 CONFIG_MESH_ROUTE_TABLE_SIZE=50
 CONFIG_OTA_HTTPS_SERVER_COMMON_NAME="ota.hendrikschutter.com"
 CONFIG_OTA_HTTPS_SERVER_PORT="443"
-CONFIG_OTA_HTTPS_URL="https://ota.hendrikschutter.com/hello-world.bin"
+CONFIG_OTA_HTTPS_URL="https://ota.hendrikschutter.com/mesh_ota.bin"
 CONFIG_OTA_HTTPS_AUTH="b3RhOnB3"
 # end of Mesh OTA Configuration