ruuvi / ruuvi.gateway_esp.c

Ruuvi Gateway ESP32 code
BSD 3-Clause "New" or "Revised" License
24 stars 15 forks source link

Saved HMAC-KEY for Ruuvi Cloud is overridden by a custom HTTP target during URL validation, resulting in ER_FORBIDDEN response from Ruuvi Cloud #970

Closed TheSomeMan closed 5 months ago

TheSomeMan commented 5 months ago
I (82241) http_server: [http_server/1] Request from 192.168.1.109 to 192.168.1.124 (Host: 192.168.1.124): GET /validate_url?url=https%3A%2F%2Fruuvi-dev.local%3A8000&validate_type=check_post_advs&auth_type=none&use_ssl_client_cert=false&use_ssl_server_cert=true
I (82255) gw_status: [http_server/1] SUSPEND RELAYING
E (82261) http_server: [http_server/1] ./main/http_server_cb.c:707 {http_server_get_from_params_with_decoding}: HTTP params: Can't find 'user='
E (82273) http_server: [http_server/1] ./main/http_server_cb.c:707 {http_server_get_from_params_with_decoding}: HTTP params: Can't find 'encrypted_password='
E (82288) http_server: [http_server/1] ./main/http_server_cb.c:707 {http_server_get_from_params_with_decoding}: HTTP params: Can't find 'use_saved_password='
E (82303) http_server: [http_server/1] ./main/validate_url.c:55 {validate_url_get_bool_from_params}: Can't find key: use_saved_password=
I (82316) http_server: [http_server/1] Found use_ssl_client_cert: false
I (82323) http_server: [http_server/1] Found use_ssl_server_cert: true
I (82330) http_server: [http_server/1] Found validate_type: check_post_advs
I (82339) http_server: [http_server/1] Validate URL (POST advs): https://ruuvi-dev.local:8000
I (82347) http_server: [http_server/1] Validate URL (POST advs): auth_type=none
I (82355) http_server: [http_server/1] Validate URL (POST advs): user=NULL
I (82362) http_server: [http_server/1] Validate URL (POST advs): use_saved_password=0
I (82373) http_server: [http_server/1] Validate URL (POST advs): use_ssl_client_cert=0
I (82380) http_server: [http_server/1] Validate URL (POST advs): use_ssl_server_cert=1
I (82389) gw_cfg: [http_server/1] Read file 'http_srv_cert' from NVS
I (82397) gw_cfg: [http_server/1] File 'http_srv_cert' was successfully read from NVS
I (82408) http: [http_server/1] ### HTTP POST to URL=https://ruuvi-dev.local:8000
I (82412) http: [http_server/1] HTTP POST DATA len=146:
I (82418) http: [http_server/1] HTTP POST DATA:
{
  "data": {
    "coordinates": "",
    "timestamp": 1706628240,
    "nonce": 1496931120,
    "gw_mac": "C8:25:2D:8E:9C:2C",
    "tags": {}
  }
}
I (82443) transport_base: Get TLS saved session for ssl=0x3ffe4e08, hostname=ruuvi-dev.local: not found
I (82447) transport_base: There is no saved TLS session ticket for host: ruuvi-dev.local
I (82455) esp-tls: [http_server] esp_tls_init: tls=0x3ffe3b3c
I (82514) esp-tls: [http_server] hostname 'ruuvi-dev.local' resolved to 192.168.1.109
I (83173) ADV_POST_TASK: [adv_post_task/5] Advs cnt: 6
I (83227) esp-tls-mbedtls: SSL handshake success, TLS version: TLSv1.3
I (83228) transport_base: Unlock TLS saved session for ssl=0x3ffe4e08
W (83302) transport_base: esp_tls_conn_read error - no data available (ret=-0x6900, errno=SSL - No data of requested type currently available on underlying transport)
W (83362) esp-tls-mbedtls: esp_mbedtls_read: RECEIVED_NEW_SESSION_TICKET
I (83362) transport_base: Cur free heap: 74284
I (83365) transport_base: Got new TLS session ticket for host: ruuvi-dev.local, save it at slot idx=0
I (83373) transport_base: Cur free heap: 71728
W (83434) transport_base: esp_tls_conn_read error - no data available (ret=-0x6900, errno=SSL - No data of requested type currently available on underlying transport)
W (83493) esp-tls-mbedtls: esp_mbedtls_read: RECEIVED_NEW_SESSION_TICKET
I (83493) transport_base: Cur free heap: 72236
I (83496) transport_base: Got new TLS session ticket for host: ruuvi-dev.local, replace existing one (slot 0)
I (83505) transport_base: Cur free heap: 72232
I (83565) ADV_POST_TASK: [http_server/1] Ruuvi-HMAC-KEY: Server updated HMAC_SHA256 key for Ruuvi target: new_key
markoaamunkajo commented 4 months ago

QA passed