Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bluetooth: Mesh: no more tinycrypt in ble mesh tfm images #64696

Merged
merged 2 commits into from
Nov 8, 2023
Merged

Bluetooth: Mesh: no more tinycrypt in ble mesh tfm images #64696

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b8f839e
Bluetooth: Mesh: no more tinycrypt in ble mesh tfm image
alxelax Nov 1, 2023
be6e063
samples: Bluetooth: Mesh: add main stack for mesh provisioner
alxelax Nov 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions samples/bluetooth/mesh/boards/nrf5340dk_nrf5340_cpuapp_ns.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
# The option adds TinyCrypt based bt_rand.
CONFIG_BT_HOST_CRYPTO=n
# The option adds GATT caching feature that is based on TinyCrypt.
CONFIG_BT_GATT_CACHING=n
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we create an issue to host to support GATT Caching without using Tinycrypt? Not sure how much customers need this feature, but if so, they will get Tinycrypt back in their firmwares if they enable this option.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess this is not sufficient. Host also supports ecc, aes ccm and randomization with tinycrypt. Host requires significant refactoring to get rid of tinycrypt. This is quite huge work that we've already done for mesh.


# Known issue: non secure platforms do not work with settings subsystem.
CONFIG_SETTINGS=n
CONFIG_BT_SETTINGS=n
5 changes: 5 additions & 0 deletions samples/bluetooth/mesh_demo/boards/nrf5340dk_nrf5340_cpuapp_ns.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
# The option adds TinyCrypt based bt_rand.
CONFIG_BT_HOST_CRYPTO=n
# The option adds GATT caching feature that is based on TinyCrypt.
CONFIG_BT_GATT_CACHING=n

# Known issue: non secure platforms do not work with settings subsystem.
CONFIG_SETTINGS=n
CONFIG_BT_SETTINGS=n
3 changes: 3 additions & 0 deletions samples/bluetooth/mesh_provisioner/boards/nrf5340dk_nrf5340_cpuapp_ns.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
# The option adds TinyCrypt based bt_rand.
CONFIG_BT_HOST_CRYPTO=n

# Known issue: non secure platforms do not work with settings subsystem.
CONFIG_SETTINGS=n
CONFIG_BT_SETTINGS=n
2 changes: 1 addition & 1 deletion samples/bluetooth/mesh_provisioner/prj.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#CONFIG_INIT_STACKS=y
CONFIG_MAIN_STACK_SIZE=1408
CONFIG_MAIN_STACK_SIZE=2048
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=2048
# The Bluetooth API should not be used from a preemptive thread:
CONFIG_MAIN_THREAD_PRIORITY=-2
Expand Down
7 changes: 4 additions & 3 deletions subsys/bluetooth/host/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,12 +163,13 @@ rsource "../mesh/Kconfig"
rsource "../audio/Kconfig"

config BT_HOST_CRYPTO
# Hidden option that compiles in AES encryption support using TinyCrypt
# library if this is not provided by the controller implementation.
bool
bool "Use crypto functionality implemented in the Bluetooth host"
default y if !BT_CTLR_CRYPTO
select TINYCRYPT
select TINYCRYPT_AES
help
The option adds the AES encryption support using TinyCrypt
library if this is not provided by the controller implementation.

config BT_HOST_CRYPTO_PRNG
bool "Use Tinycrypt library for random number generation"
Expand Down
10 changes: 10 additions & 0 deletions subsys/bluetooth/mesh/crypto_psa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
#include <errno.h>

#include <zephyr/bluetooth/mesh.h>
#include <zephyr/sys/check.h>

#define LOG_LEVEL CONFIG_BT_MESH_CRYPTO_LOG_LEVEL
#include <zephyr/logging/log.h>
Expand Down Expand Up @@ -510,3 +511,12 @@ int bt_mesh_key_compare(const uint8_t raw_key[16], const struct bt_mesh_key *key

return memcmp(out, raw_key, 16);
}

__weak int bt_rand(void *buf, size_t len)
{
CHECKIF(buf == NULL || len == 0) {
return -EINVAL;
}

return psa_generate_random(buf, len) == PSA_SUCCESS ? 0 : -EIO;
}
5 changes: 5 additions & 0 deletions tests/bsim/bluetooth/mesh/overlay_psa.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,7 @@
# The option adds TinyCrypt based bt_rand.
CONFIG_BT_HOST_CRYPTO=n
# The option adds GATT caching feature that is based on TinyCrypt.
CONFIG_BT_GATT_CACHING=n

# Enable mbedTLS PSA as a crypto backend
CONFIG_BT_MESH_USES_MBEDTLS_PSA=y
35 changes: 18 additions & 17 deletions tests/bsim/bluetooth/mesh/src/test_dfu.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ LOG_MODULE_REGISTER(LOG_MODULE_NAME, LOG_LEVEL_INF);
#define TARGET_ADDR 0x0100
#define IMPOSTER_MODEL_ID 0xe000
#define TEST_BLOB_ID 0xaabbccdd
#define SEMAPHORE_TIMEOUT 250 /* seconds */

struct bind_params {
uint16_t model_id;
Expand Down Expand Up @@ -1016,7 +1017,7 @@ static void test_cli_fail_on_persistency(void)
FAIL("DFU Client send failed (err: %d)", err);
}

if (k_sem_take(&dfu_ended, K_SECONDS(200))) {
if (k_sem_take(&dfu_ended, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Firmware transfer failed");
}

Expand Down Expand Up @@ -1050,7 +1051,7 @@ static void test_cli_fail_on_persistency(void)
FAIL("DFU Client apply failed (err: %d)", err);
}

if (k_sem_take(&dfu_cli_applied_sem, K_SECONDS(200))) {
if (k_sem_take(&dfu_cli_applied_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Failed to apply firmware");
}

Expand All @@ -1063,7 +1064,7 @@ static void test_cli_fail_on_persistency(void)
FAIL("DFU Client confirm failed (err: %d)", err);
}

if (k_sem_take(&dfu_cli_confirmed_sem, K_SECONDS(200))) {
if (k_sem_take(&dfu_cli_confirmed_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Failed to confirm firmware");
}

Expand Down Expand Up @@ -1096,7 +1097,7 @@ static void test_cli_all_targets_lost_common(void)
FAIL("DFU Client send failed (err: %d)", err);
}

if (k_sem_take(&dfu_ended, K_SECONDS(200))) {
if (k_sem_take(&dfu_ended, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Firmware transfer failed");
}
}
Expand Down Expand Up @@ -1187,7 +1188,7 @@ static void test_cli_all_targets_lost_on_apply(void)
FAIL("DFU Client apply failed (err: %d)", err);
}

if (!k_sem_take(&dfu_cli_applied_sem, K_SECONDS(200))) {
if (!k_sem_take(&dfu_cli_applied_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Apply should not be successful on any target");
}

Expand Down Expand Up @@ -1218,7 +1219,7 @@ static void test_cli_stop(void)
FAIL("DFU Client send failed (err: %d)", err);
}

if (k_sem_take(&dfu_started, K_SECONDS(200))) {
if (k_sem_take(&dfu_started, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Firmware transfer failed");
}

Expand All @@ -1234,7 +1235,7 @@ static void test_cli_stop(void)
FAIL("DFU Client resume failed (err: %d)", err);
}

if (k_sem_take(&dfu_verifying, K_SECONDS(200))) {
if (k_sem_take(&dfu_verifying, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Firmware transfer failed");
}
ASSERT_EQUAL(BT_MESH_DFU_ERR_INTERNAL, dfu_cli_xfer.targets[0].status);
Expand All @@ -1253,7 +1254,7 @@ static void test_cli_stop(void)
FAIL("DFU Client send failed (err: %d)", err);
}

if (k_sem_take(&dfu_verify_failed, K_SECONDS(200))) {
if (k_sem_take(&dfu_verify_failed, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Firmware transfer failed");
}

Expand All @@ -1269,12 +1270,12 @@ static void test_cli_stop(void)
if (err) {
FAIL("DFU Client send failed (err: %d)", err);
}
if (k_sem_take(&dfu_ended, K_SECONDS(200))) {
if (k_sem_take(&dfu_ended, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Firmware transfer failed");
}

bt_mesh_dfu_cli_apply(&dfu_cli);
if (k_sem_take(&dfu_cli_applied_sem, K_SECONDS(200))) {
if (k_sem_take(&dfu_cli_applied_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
/* This will time out as target will reboot before applying */
}
ASSERT_EQUAL(BT_MESH_DFU_ERR_INTERNAL, dfu_cli_xfer.targets[0].status);
Expand Down Expand Up @@ -1464,7 +1465,7 @@ static void test_target_fail_on_metadata(void)
common_fail_on_target_init(&target_comp);
target_prov_and_conf_default();

if (k_sem_take(&dfu_metadata_check_sem, K_SECONDS(200))) {
if (k_sem_take(&dfu_metadata_check_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Metadata check CB wasn't called");
}

Expand All @@ -1478,7 +1479,7 @@ static void test_target_fail_on_caps_get(void)
common_fail_on_target_init(&srv_caps_broken_comp);
target_prov_and_conf_with_imposer();

if (k_sem_take(&caps_get_sem, K_SECONDS(200))) {
if (k_sem_take(&caps_get_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("BLOB Info Get msg handler wasn't called");
}

Expand All @@ -1492,11 +1493,11 @@ static void test_target_fail_on_update_get(void)
common_fail_on_target_init(&srv_update_get_broken_comp);
target_prov_and_conf_with_imposer();

if (k_sem_take(&dfu_verify_sem, K_SECONDS(200))) {
if (k_sem_take(&dfu_verify_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Transfer end CB wasn't triggered");
}

if (k_sem_take(&update_get_sem, K_SECONDS(200))) {
if (k_sem_take(&update_get_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Firmware Update Get msg handler wasn't called");
}

Expand All @@ -1511,7 +1512,7 @@ static void test_target_fail_on_verify(void)
common_fail_on_target_init(&target_comp);
target_prov_and_conf_default();

if (k_sem_take(&dfu_verify_sem, K_SECONDS(200))) {
if (k_sem_take(&dfu_verify_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Transfer end CB wasn't triggered");
}

Expand All @@ -1525,7 +1526,7 @@ static void test_target_fail_on_apply(void)
common_fail_on_target_init(&srv_update_apply_broken_comp);
target_prov_and_conf_with_imposer();

if (k_sem_take(&update_apply_sem, K_SECONDS(200))) {
if (k_sem_take(&update_apply_sem, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("Firmware Update Apply msg handler wasn't called");
}

Expand All @@ -1537,7 +1538,7 @@ static void test_target_fail_on_nothing(void)
common_fail_on_target_init(&target_comp);
target_prov_and_conf_default();

if (k_sem_take(&dfu_ended, K_SECONDS(200))) {
if (k_sem_take(&dfu_ended, K_SECONDS(SEMAPHORE_TIMEOUT))) {
FAIL("DFU failed");
}

Expand Down
2 changes: 1 addition & 1 deletion tests/bsim/bluetooth/mesh/src/test_persistence.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -549,7 +549,7 @@ static void node_configure(void)
*/
uint8_t net_transmit;

net_transmit = BT_MESH_TRANSMIT(3, 20);
net_transmit = BT_MESH_TRANSMIT(3, 50);
err = bt_mesh_cfg_cli_net_transmit_set(test_netkey_idx, TEST_ADDR, net_transmit, &status);
if (err || status != net_transmit) {
FAIL("Net transmit set failed (err %d, transmit %x)", err, status);
Expand Down
8 changes: 8 additions & 0 deletions tests/bsim/bluetooth/mesh/src/test_replay_cache.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,8 @@ static void test_tx_immediate_replay_attack(void)
}

ASSERT_TRUE(is_tx_succeeded);
/* Let complete advertising of the previous transaction to prevent collisions. */
k_sleep(K_SECONDS(1));
}

bt_mesh.seq = seq;
Expand All @@ -165,6 +167,8 @@ static void test_tx_immediate_replay_attack(void)
}

ASSERT_TRUE(!is_tx_succeeded);
/* Let complete advertising of the previous transaction to prevent collisions. */
k_sleep(K_SECONDS(1));
}

PASS();
Expand Down Expand Up @@ -208,6 +212,8 @@ static void test_tx_power_replay_attack(void)
}

ASSERT_TRUE(!is_tx_succeeded);
/* Let complete advertising of the previous transaction to prevent collisions. */
k_sleep(K_SECONDS(1));
}

for (int i = 0; i < 3; i++) {
Expand All @@ -222,6 +228,8 @@ static void test_tx_power_replay_attack(void)
}

ASSERT_TRUE(is_tx_succeeded);
/* Let complete advertising of the previous transaction to prevent collisions. */
k_sleep(K_SECONDS(1));
}

PASS();
Expand Down
Loading