Skip to content

Commit 901728d

Browse files
dido18lucarin91
dido18
and
lucarin91
authored
fix: allow to specify custom signatureKey in the config.ini (#1024)
* make the signaturePubKey overwritable * Add debug logging for signature key parsing and handle newline escape sequences * Add MustParseRsaPublicKey function for parsing PEM formatted public keys * Remove debug print statement for signature key and fix comment typo in key parsing logic * Add error logging for command verification and update comment for public key usage * refactor(main.go) remove unnecessary print statement in parseIni function * refactor(utilities): improve formatting in ParseRsaPublicKey function * style(tools): align field declarations for improved readability --------- Co-authored-by: Luca Rinaldi <[email protected]>
1 parent 5063c6c commit 901728d

File tree

10 files changed

+172
-123
lines changed

10 files changed

+172
-123
lines changed

‎conn.go

+81-77
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ package main
1919

2020
import (
2121
"bytes"
22+
"crypto/rsa"
2223
"encoding/json"
2324
"errors"
2425
"fmt"
@@ -79,111 +80,114 @@ type Upload struct {
7980

8081
var uploadStatusStr = "ProgrammerStatus"
8182

82-
func uploadHandler(c *gin.Context) {
83-
data := new(Upload)
84-
if err := c.BindJSON(data); err != nil {
85-
c.String(http.StatusBadRequest, fmt.Sprintf("err with the payload. %v", err.Error()))
86-
return
87-
}
88-
89-
log.Printf("%+v %+v %+v %+v %+v %+v", data.Port, data.Board, data.Rewrite, data.Commandline, data.Extra, data.Filename)
90-
91-
if data.Port == "" {
92-
c.String(http.StatusBadRequest, "port is required")
93-
return
94-
}
95-
96-
if data.Board == "" {
97-
c.String(http.StatusBadRequest, "board is required")
98-
log.Error("board is required")
99-
return
100-
}
101-
102-
if !data.Extra.Network {
103-
if data.Signature == "" {
104-
c.String(http.StatusBadRequest, "signature is required")
83+
func uploadHandler(pubKey *rsa.PublicKey) func(*gin.Context) {
84+
return func(c *gin.Context) {
85+
data := new(Upload)
86+
if err := c.BindJSON(data); err != nil {
87+
c.String(http.StatusBadRequest, fmt.Sprintf("err with the payload. %v", err.Error()))
10588
return
10689
}
10790

108-
if data.Commandline == "" {
109-
c.String(http.StatusBadRequest, "commandline is required for local board")
91+
log.Printf("%+v %+v %+v %+v %+v %+v", data.Port, data.Board, data.Rewrite, data.Commandline, data.Extra, data.Filename)
92+
93+
if data.Port == "" {
94+
c.String(http.StatusBadRequest, "port is required")
11095
return
11196
}
11297

113-
err := utilities.VerifyInput(data.Commandline, data.Signature)
114-
115-
if err != nil {
116-
c.String(http.StatusBadRequest, "signature is invalid")
98+
if data.Board == "" {
99+
c.String(http.StatusBadRequest, "board is required")
100+
log.Error("board is required")
117101
return
118102
}
119-
}
120103

121-
buffer := bytes.NewBuffer(data.Hex)
104+
if !data.Extra.Network {
105+
if data.Signature == "" {
106+
c.String(http.StatusBadRequest, "signature is required")
107+
return
108+
}
122109

123-
filePath, err := utilities.SaveFileonTempDir(data.Filename, buffer)
124-
if err != nil {
125-
c.String(http.StatusBadRequest, err.Error())
126-
return
127-
}
110+
if data.Commandline == "" {
111+
c.String(http.StatusBadRequest, "commandline is required for local board")
112+
return
113+
}
128114

129-
tmpdir, err := os.MkdirTemp("", "extrafiles")
130-
if err != nil {
131-
c.String(http.StatusBadRequest, err.Error())
132-
return
133-
}
115+
err := utilities.VerifyInput(data.Commandline, data.Signature, pubKey)
134116

135-
for _, extraFile := range data.ExtraFiles {
136-
path, err := utilities.SafeJoin(tmpdir, extraFile.Filename)
137-
if err != nil {
138-
c.String(http.StatusBadRequest, err.Error())
139-
return
117+
if err != nil {
118+
log.WithField("err", err).Error("Error verifying the command")
119+
c.String(http.StatusBadRequest, "signature is invalid")
120+
return
121+
}
140122
}
141-
log.Printf("Saving %s on %s", extraFile.Filename, path)
142123

143-
err = os.MkdirAll(filepath.Dir(path), 0744)
144-
if err != nil {
145-
c.String(http.StatusBadRequest, err.Error())
146-
return
147-
}
124+
buffer := bytes.NewBuffer(data.Hex)
148125

149-
err = os.WriteFile(path, extraFile.Hex, 0644)
126+
filePath, err := utilities.SaveFileonTempDir(data.Filename, buffer)
150127
if err != nil {
151128
c.String(http.StatusBadRequest, err.Error())
152129
return
153130
}
154-
}
155131

156-
if data.Rewrite != "" {
157-
data.Board = data.Rewrite
158-
}
159-
160-
go func() {
161-
// Resolve commandline
162-
commandline, err := upload.PartiallyResolve(data.Board, filePath, tmpdir, data.Commandline, data.Extra, Tools)
132+
tmpdir, err := os.MkdirTemp("", "extrafiles")
163133
if err != nil {
164-
send(map[string]string{uploadStatusStr: "Error", "Msg": err.Error()})
134+
c.String(http.StatusBadRequest, err.Error())
165135
return
166136
}
167137

168-
l := PLogger{Verbose: true}
169-
170-
// Upload
171-
if data.Extra.Network {
172-
err = errors.New("network upload is not supported anymore, pease use OTA instead")
173-
} else {
174-
send(map[string]string{uploadStatusStr: "Starting", "Cmd": "Serial"})
175-
err = upload.Serial(data.Port, commandline, data.Extra, l)
138+
for _, extraFile := range data.ExtraFiles {
139+
path, err := utilities.SafeJoin(tmpdir, extraFile.Filename)
140+
if err != nil {
141+
c.String(http.StatusBadRequest, err.Error())
142+
return
143+
}
144+
log.Printf("Saving %s on %s", extraFile.Filename, path)
145+
146+
err = os.MkdirAll(filepath.Dir(path), 0744)
147+
if err != nil {
148+
c.String(http.StatusBadRequest, err.Error())
149+
return
150+
}
151+
152+
err = os.WriteFile(path, extraFile.Hex, 0644)
153+
if err != nil {
154+
c.String(http.StatusBadRequest, err.Error())
155+
return
156+
}
176157
}
177158

178-
// Handle result
179-
if err != nil {
180-
send(map[string]string{uploadStatusStr: "Error", "Msg": err.Error()})
181-
return
159+
if data.Rewrite != "" {
160+
data.Board = data.Rewrite
182161
}
183-
send(map[string]string{uploadStatusStr: "Done", "Flash": "Ok"})
184-
}()
185162

186-
c.String(http.StatusAccepted, "")
163+
go func() {
164+
// Resolve commandline
165+
commandline, err := upload.PartiallyResolve(data.Board, filePath, tmpdir, data.Commandline, data.Extra, Tools)
166+
if err != nil {
167+
send(map[string]string{uploadStatusStr: "Error", "Msg": err.Error()})
168+
return
169+
}
170+
171+
l := PLogger{Verbose: true}
172+
173+
// Upload
174+
if data.Extra.Network {
175+
err = errors.New("network upload is not supported anymore, pease use OTA instead")
176+
} else {
177+
send(map[string]string{uploadStatusStr: "Starting", "Cmd": "Serial"})
178+
err = upload.Serial(data.Port, commandline, data.Extra, l)
179+
}
180+
181+
// Handle result
182+
if err != nil {
183+
send(map[string]string{uploadStatusStr: "Error", "Msg": err.Error()})
184+
return
185+
}
186+
send(map[string]string{uploadStatusStr: "Done", "Flash": "Ok"})
187+
}()
188+
189+
c.String(http.StatusAccepted, "")
190+
}
187191
}
188192

189193
// PLogger sends the info from the upload to the websocket

‎globals/globals.go

+10-3
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,15 @@
1515

1616
package globals
1717

18-
// DefaultIndexURL is the default index url
1918
var (
20-
// SignatureKey is the public key used to verify commands and url sent by the builder
21-
SignatureKey = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvc0yZr1yUSen7qmE3cxF\nIE12rCksDnqR+Hp7o0nGi9123eCSFcJ7CkIRC8F+8JMhgI3zNqn4cUEn47I3RKD1\nZChPUCMiJCvbLbloxfdJrUi7gcSgUXrlKQStOKF5Iz7xv1M4XOP3JtjXLGo3EnJ1\npFgdWTOyoSrA8/w1rck4c/ISXZSinVAggPxmLwVEAAln6Itj6giIZHKvA2fL2o8z\nCeK057Lu8X6u2CG8tRWSQzVoKIQw/PKK6CNXCAy8vo4EkXudRutnEYHEJlPkVgPn\n2qP06GI+I+9zKE37iqj0k1/wFaCVXHXIvn06YrmjQw6I0dDj/60Wvi500FuRVpn9\ntwIDAQAB\n-----END PUBLIC KEY-----"
19+
// ArduinoSignaturePubKey is the public key used to verify commands and url sent by the builder
20+
ArduinoSignaturePubKey = `-----BEGIN PUBLIC KEY-----
21+
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvc0yZr1yUSen7qmE3cxF
22+
IE12rCksDnqR+Hp7o0nGi9123eCSFcJ7CkIRC8F+8JMhgI3zNqn4cUEn47I3RKD1
23+
ZChPUCMiJCvbLbloxfdJrUi7gcSgUXrlKQStOKF5Iz7xv1M4XOP3JtjXLGo3EnJ1
24+
pFgdWTOyoSrA8/w1rck4c/ISXZSinVAggPxmLwVEAAln6Itj6giIZHKvA2fL2o8z
25+
CeK057Lu8X6u2CG8tRWSQzVoKIQw/PKK6CNXCAy8vo4EkXudRutnEYHEJlPkVgPn
26+
2qP06GI+I+9zKE37iqj0k1/wFaCVXHXIvn06YrmjQw6I0dDj/60Wvi500FuRVpn9
27+
twIDAQAB
28+
-----END PUBLIC KEY-----`
2229
)

‎main.go

+12-4
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ var (
8181
logDump = iniConf.String("log", "off", "off = (default)")
8282
origins = iniConf.String("origins", "", "Allowed origin list for CORS")
8383
portsFilterRegexp = iniConf.String("regex", "usb|acm|com", "Regular expression to filter serial port list")
84-
signatureKey = iniConf.String("signatureKey", globals.SignatureKey, "Pem-encoded public key to verify signed commandlines")
84+
signatureKey = iniConf.String("signatureKey", globals.ArduinoSignaturePubKey, "Pem-encoded public key to verify signed commandlines")
8585
updateURL = iniConf.String("updateUrl", "", "")
8686
verbose = iniConf.Bool("v", true, "show debug logging")
8787
crashreport = iniConf.Bool("crashreport", false, "enable crashreport logging")
@@ -278,9 +278,17 @@ func loop() {
278278
}
279279
}
280280

281+
if signatureKey == nil || len(*signatureKey) == 0 {
282+
log.Panicf("signature public key should be set")
283+
}
284+
signaturePubKey, err := utilities.ParseRsaPublicKey([]byte(*signatureKey))
285+
if err != nil {
286+
log.Panicf("cannot parse signature key '%s'. %s", *signatureKey, err)
287+
}
288+
281289
// Instantiate Index and Tools
282290
Index = index.Init(*indexURL, config.GetDataDir())
283-
Tools = tools.New(config.GetDataDir(), Index, logger)
291+
Tools = tools.New(config.GetDataDir(), Index, logger, signaturePubKey)
284292

285293
// see if we are supposed to wait 5 seconds
286294
if *isLaunchSelf {
@@ -454,7 +462,7 @@ func loop() {
454462
r.LoadHTMLFiles("templates/nofirefox.html")
455463

456464
r.GET("/", homeHandler)
457-
r.POST("/upload", uploadHandler)
465+
r.POST("/upload", uploadHandler(signaturePubKey))
458466
r.GET("/socket.io/", socketHandler)
459467
r.POST("/socket.io/", socketHandler)
460468
r.Handle("WS", "/socket.io/", socketHandler)
@@ -464,7 +472,7 @@ func loop() {
464472
r.POST("/update", updateHandler)
465473

466474
// Mount goa handlers
467-
goa := v2.Server(config.GetDataDir().String(), Index)
475+
goa := v2.Server(config.GetDataDir().String(), Index, signaturePubKey)
468476
r.Any("/v2/*path", gin.WrapH(goa))
469477

470478
go func() {

‎main_test.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,10 @@ import (
3030

3131
"github.com/arduino/arduino-create-agent/config"
3232
"github.com/arduino/arduino-create-agent/gen/tools"
33+
"github.com/arduino/arduino-create-agent/globals"
3334
"github.com/arduino/arduino-create-agent/index"
3435
"github.com/arduino/arduino-create-agent/upload"
36+
"github.com/arduino/arduino-create-agent/utilities"
3537
v2 "github.com/arduino/arduino-create-agent/v2"
3638
"github.com/gin-gonic/gin"
3739
"github.com/stretchr/testify/require"
@@ -54,7 +56,7 @@ func TestValidSignatureKey(t *testing.T) {
5456

5557
func TestUploadHandlerAgainstEvilFileNames(t *testing.T) {
5658
r := gin.New()
57-
r.POST("/", uploadHandler)
59+
r.POST("/", uploadHandler(utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey))))
5860
ts := httptest.NewServer(r)
5961

6062
uploadEvilFileName := Upload{
@@ -90,7 +92,7 @@ func TestUploadHandlerAgainstEvilFileNames(t *testing.T) {
9092

9193
func TestUploadHandlerAgainstBase64WithoutPaddingMustFail(t *testing.T) {
9294
r := gin.New()
93-
r.POST("/", uploadHandler)
95+
r.POST("/", uploadHandler(utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey))))
9496
ts := httptest.NewServer(r)
9597
defer ts.Close()
9698

@@ -119,7 +121,7 @@ func TestInstallToolV2(t *testing.T) {
119121
Index := index.Init(indexURL, config.GetDataDir())
120122

121123
r := gin.New()
122-
goa := v2.Server(config.GetDataDir().String(), Index)
124+
goa := v2.Server(config.GetDataDir().String(), Index, utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
123125
r.Any("/v2/*path", gin.WrapH(goa))
124126
ts := httptest.NewServer(r)
125127

@@ -213,7 +215,7 @@ func TestInstalledHead(t *testing.T) {
213215
Index := index.Init(indexURL, config.GetDataDir())
214216

215217
r := gin.New()
216-
goa := v2.Server(config.GetDataDir().String(), Index)
218+
goa := v2.Server(config.GetDataDir().String(), Index, utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
217219
r.Any("/v2/*path", gin.WrapH(goa))
218220
ts := httptest.NewServer(r)
219221

‎tools/download_test.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ import (
2121
"testing"
2222
"time"
2323

24+
"github.com/arduino/arduino-create-agent/globals"
2425
"github.com/arduino/arduino-create-agent/index"
26+
"github.com/arduino/arduino-create-agent/utilities"
2527
"github.com/arduino/arduino-create-agent/v2/pkgs"
2628
"github.com/arduino/go-paths-helper"
2729
"github.com/stretchr/testify/require"
@@ -128,7 +130,7 @@ func TestDownload(t *testing.T) {
128130
IndexFile: *paths.New("testdata", "test_tool_index.json"),
129131
LastRefresh: time.Now(),
130132
}
131-
testTools := New(tempDirPath, &testIndex, func(msg string) { t.Log(msg) })
133+
testTools := New(tempDirPath, &testIndex, func(msg string) { t.Log(msg) }, utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
132134

133135
for _, tc := range testCases {
134136
t.Run(tc.name+"-"+tc.version, func(t *testing.T) {
@@ -175,7 +177,7 @@ func TestCorruptedInstalled(t *testing.T) {
175177
defer fileJSON.Close()
176178
_, err = fileJSON.Write([]byte("Hello"))
177179
require.NoError(t, err)
178-
testTools := New(tempDirPath, &testIndex, func(msg string) { t.Log(msg) })
180+
testTools := New(tempDirPath, &testIndex, func(msg string) { t.Log(msg) }, utilities.MustParseRsaPublicKey([]byte(globals.ArduinoSignaturePubKey)))
179181
// Download the tool
180182
err = testTools.Download("arduino-test", "avrdude", "6.3.0-arduino17", "keep")
181183
require.NoError(t, err)

‎tools/tools.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
package tools
1717

1818
import (
19+
"crypto/rsa"
1920
"encoding/json"
2021
"path/filepath"
2122
"strings"
@@ -55,14 +56,14 @@ type Tools struct {
5556
// The New functions accept the directory to use to host the tools,
5657
// an index (used to download the tools),
5758
// and a logger to log the operations
58-
func New(directory *paths.Path, index *index.Resource, logger func(msg string)) *Tools {
59+
func New(directory *paths.Path, index *index.Resource, logger func(msg string), signPubKey *rsa.PublicKey) *Tools {
5960
t := &Tools{
6061
directory: directory,
6162
index: index,
6263
logger: logger,
6364
installed: map[string]string{},
6465
mutex: sync.RWMutex{},
65-
tools: pkgs.New(index, directory.String(), "replace"),
66+
tools: pkgs.New(index, directory.String(), "replace", signPubKey),
6667
}
6768
_ = t.readMap()
6869
return t

0 commit comments

Comments
 (0)