security audit on log forging

Author: suculent

library.json

@@ -1,12 +1,12 @@
 {
   "name": "THiNX",
-  "keywords": "json, rest, http, web",
+  "keywords": "json, rest, http, web, thinx, ota, management, mqtt, esp8266",
   "description": "THiNX Device Management for ESP8266",
   "repository": {
     "type": "git",
     "url": "https://github.com/suculent/thinx-firmware-esp8266"
   },
-  "version": "2.1.171",
+  "version": "2.1.172",
   "authors": {
     "name": "Matej Sychra",
     "url": "https://thinx.cloud"

library.properties

@@ -1,5 +1,5 @@
 name=THiNX
-version=2.1.171
+version=2.1.172
 author=Matej Sychra
 maintainer=Matej Sychra
 sentence=A library to wrap THiNX device registration, MQTT and ESP8266HttpUpdate/ArduinoOTA

src/THiNXLib.cpp

@@ -16,7 +16,7 @@ extern "C" {
 #endif
 
 #ifndef THINX_COMMIT_ID
-#define THINX_COMMIT_ID "c680610df8457bb634cbaa80ce00b2b761208347"
+#define THINX_COMMIT_ID "0"
 #endif
 
 char* THiNX::thinx_api_key;
@@ -177,7 +177,7 @@ THiNX::THiNX(const char * __apikey, const char * __owner_id) {
 void THiNX::initWithAPIKey(const char * __apikey) {
 
   #ifdef __USE_SPIFFS__
-  Serial.println(F("*TH: Checking FS..."));
+  Serial.println(F("*TH: Checking filesystem, please don't turn off or reset the device now..."));
   if (!fsck()) {
     Serial.println(F("*TH: Filesystem check failed, disabling THiNX."));
     return;
@@ -456,13 +456,12 @@ void THiNX::senddata(String body) {
 
 void THiNX::parse(String payload) {
 
-  // TODO: Should parse response only for this device_id (which must be internal and not a mac)
+  // TODO: Should parse response only for this device
 
   payload_type ptype = Unknown;
 
   int start_index = 0;
   int endIndex = payload.length();
-
   int reg_index = payload.indexOf("{\"registration\"");
   int upd_index = payload.indexOf("{\"FIRMWARE_UPDATE\"");
   int not_index = payload.indexOf("{\"notification\"");
@@ -525,33 +524,38 @@ void THiNX::parse(String payload) {
       Serial.println(String("mac: ") + mac);
 
       if (!mac.equals(this_mac)) {
-        Serial.println(F("*TH: Warning: firmware is dedicated to device with different MAC."));
+        Serial.println(F("*TH: Firmware is dedicated to device with different MAC. Skipping update."));
+        Serial.print("Local MAC: "); Serial.println(this_mac);
+        Serial.print("Remote MAC: "); Serial.println(mac);
+        return;
       }
 
       String udid = root["udid"];
       if ( udid.length() > 4 ) {
         thinx_udid = strdup(udid.c_str());
-        Serial.println(String("thinx_udid: ") + thinx_udid);
+        Serial.println(String("Update for thinx_udid: ") + thinx_udid);
       }
 
       // Check current firmware based on commit id and store Updated state...
       String commit = update["commit"];
-      Serial.println(String("commit: ") + commit);
+      Serial.println(String("Update commit: ") + commit);
 
       // Check current firmware based on version and store Updated state...
       String version = update["version"];
-      Serial.println(String("version: ") + version);
-
-      //if ((commit == thinx_commit_id) && (version == thinx_version_id)) { WHY?
-      if (strlen(available_update_url) > 5) {
-        Serial.println(F("*TH: firmware has same thx_commit_id as current and update availability is stored. Firmware has been installed."));
-        available_update_url = strdup("");
-        notify_on_successful_update();
-        return;
-      } else {
-        Serial.println(F("*TH: Info: firmware has same thx_commit_id as current and no update is available."));
+      Serial.println(String("Update version: ") + version);
+
+      // Well, the backend should not actually provide firmware when these two things are same,
+      // following block may deprecate.
+      if ((commit.equals(thinx_commit_id)) && (version.equals(thinx_version_id))) {
+        if (strlen(available_update_url) > 5) {
+          Serial.println(F("*TH: firmware has same thx_commit_id as current and update availability is stored. Firmware has been installed."));
+          available_update_url = strdup("");
+          notify_on_successful_update();
+          return;
+        } else {
+          Serial.println(F("*TH: Info: firmware has same thx_commit_id as current and no update is available."));
+        }
       }
-      //}
 
       save_device_info();
 
@@ -852,11 +856,15 @@ String THiNX::date(const char* optional_format) {
 */
 
 const char * THiNX::thinx_mac() {
+
 #if defined(ESP8266)
-  sprintf(mac_string, "5CCF7F%6X", ESP.getChipId());
-#else
+  sprintf(mac_string, "5CCF7F%6X", ESP.getChipId()); // ESP8266 only!
+#endif
+
+#if defined(ESP32)
   sprintf(mac_string, "5CCF7F%6X", ESP.getEfuseMac());
 #endif
+
   return mac_string;
 }
 
@@ -873,7 +881,7 @@ void THiNX::notify_on_successful_update() {
     );
     mqtt_client->loop();
   } else {
-    Serial.println(F("*TH: Device updated but MQTT not active to notify. TODO: Store."));
+    Serial.println(F("*TH: Device updated but MQTT not active to notify.")); // TODO: Store as boot status
   }
 }
 
@@ -1000,8 +1008,6 @@ bool THiNX::start_mqtt() {
       }
 
     } else {
-      Serial.println(F("*TH: MQTT Type: String or JSON..."));
-      Serial.println(pub.payload_string());
       parse(pub.payload_string());
         if (_mqtt_callback) {
             _mqtt_callback(pub.payload_string());
@@ -1025,8 +1031,6 @@ bool THiNX::start_mqtt() {
 
 void THiNX::restore_device_info() {
 
-  Serial.println(F("*TH: Restoring device info..."));
-
   int json_end = 0;
 
   #ifndef __USE_SPIFFS__
@@ -1067,21 +1071,18 @@ void THiNX::restore_device_info() {
 
   // Validating bracket count
   if (json_end != 0) {
-    Serial.println(F("*TH: JSON invalid... bailing out."));
+    // Serial.println(F("*TH: JSON invalid... bailing out."));
     return;
   }
 
-  Serial.println(F("*TH: Converting data to String..."));
-
   #else
   if (!SPIFFS.exists("/thx.cfg")) {
-    Serial.println(F("*TH: No saved configuration."));
+    // Serial.println(F("*TH: No saved configuration."));
     return;
   }
   File f = SPIFFS.open("/thx.cfg", "r");
-  Serial.println(F("*TH: Found persistent data..."));
   if (!f) {
-    Serial.println(F("*TH: No remote configuration found so far..."));
+    // Serial.println(F("*TH: No remote configuration found so far..."));
     return;
   }
   if (f.size() == 0) {
@@ -1092,9 +1093,6 @@ void THiNX::restore_device_info() {
   f.readBytesUntil('\n', json_info, 511);
   #endif
 
-  Serial.println(json_info);
-  Serial.println(F("*TH: Parsing..."));
-
   DynamicJsonBuffer jsonBuffer(512);
   JsonObject& config = jsonBuffer.parseObject((char*)json_info); // must not be String!
 
@@ -1104,12 +1102,8 @@ void THiNX::restore_device_info() {
 
   } else {
 
-    Serial.println(F("*TH: Reading JSON..."));
-
     if (config["alias"]) {
       thinx_alias = strdup(config["alias"]);
-      Serial.print("alias: ");
-      Serial.println(thinx_alias);
     }
 
     if (config["udid"]) {
@@ -1123,25 +1117,16 @@ void THiNX::restore_device_info() {
       thinx_udid = strdup(THINX_UDID);
     }
 
-    Serial.print("thinx_udid: ");
-    Serial.println(thinx_udid);
-
     if (config["apikey"]) {
       thinx_api_key = strdup(config["apikey"]);
-      Serial.print("apikey: ");
-      Serial.println(thinx_api_key);
     }
 
     if (config["owner"]) {
       thinx_owner = strdup(config["owner"]);
-      Serial.print("owner: ");
-      Serial.println(thinx_owner);
     }
 
     if (config["ott"]) {
       available_update_url = strdup(config["ott"]);
-      Serial.print("available_update_url: ");
-      Serial.println(available_update_url);
     }
 
     #ifdef __USE_SPIFFS__
@@ -1223,7 +1208,7 @@ void THiNX::deviceInfo() {
 
 void THiNX::update_and_reboot(String url) {
 
-  Serial.print("*TH: Update with URL: ");
+  Serial.print("*TH: Update from URL: ");
   Serial.println(url);
 
   // #define __USE_STREAM_UPDATER__ ; // Warning, this is MQTT-based streamed update!
@@ -1343,13 +1328,11 @@ void THiNX::evt_save_api_key() {
   if (should_save_config) {
     if (strlen(thx_api_key) > 4) {
       thinx_api_key = thx_api_key;
-      Serial.print(F("Saving thx_api_key from Captive Portal: "));
-      Serial.println(thinx_api_key);
+      Serial.print(F("Saving thx_api_key from Captive Portal."));
     }
     if (strlen(thx_owner_key) > 4) {
       thinx_owner_key = thx_owner_key;
-      Serial.print(F("Saving thx_owner_key from Captive Portal: "));
-      Serial.println(thinx_owner_key);
+      Serial.print(F("Saving thx_owner_key from Captive Portal."));
     }
     save_device_info();
     should_save_config = false;
@@ -1400,11 +1383,8 @@ void THiNX::loop() {
       wifi_connected = false;
       if (wifi_connection_in_progress != true) {
         Serial.println(F("*TH: CONNECTING »"));
-        Serial.println(F("*TH: LOOP «÷»")); Serial.flush();
         connect(); // blocking
-        Serial.println(F("*TH: Enabling connection state (1283)"));
         wifi_connection_in_progress = true;
-        Serial.println(F("*TH: LOOP «"));
         wifi_connection_in_progress = true;
         return;
       } else {
@@ -1418,18 +1398,11 @@ void THiNX::loop() {
         Serial.println(F("*TH: Error setting up mDNS"));
       } else {
         // Query MDNS proxy
-        Serial.println(F("*TH: Searching for thinx-connect on local network..."));
+        Serial.println(F("*TH: Searching for thinx-connect proxy on local network..."));
         int n = MDNS.queryService("thinx", "tcp"); // TODO: WARNING! may be _tcp!
         if (n > 0) {
           thinx_cloud_url = strdup(String(MDNS.hostname(0)).c_str());
           thinx_mqtt_url = strdup(String(MDNS.hostname(0)).c_str());
-
-          Serial.println(F("*TH: Routing traffic through thinx-connect..."));
-          Serial.print(F("     host            : ")); Serial.println(MDNS.hostname(0));
-          Serial.print(F("     IP              : ")); Serial.println(MDNS.IP(0));
-          Serial.print(F("     port            : ")); Serial.println(MDNS.port(0));
-          Serial.print(F("     thinx_cloud_url : ")); Serial.println(thinx_cloud_url);
-          Serial.print(F("     thinx_mqtt_url  : ")); Serial.println(thinx_mqtt_url);
         }
       }
 
@@ -1442,10 +1415,7 @@ void THiNX::loop() {
     thinx_mqtt_channel(); // initialize channel variable
     if (strlen(mqtt_device_channel) > 5) {
       if (mqtt_client->subscribe(mqtt_device_channel)) {
-        Serial.print(F("*TH: MQTT device topic: "));
-        Serial.print(mqtt_device_channel);
-        Serial.println(F(" successfully subscribed."));
-        Serial.println(F("*TH: Publishing device status over MQTT... "));
+        Serial.print(F("*TH: MQTT device topic subscribed."));
         // Publish status on status channel
         mqtt_client->publish(
           mqtt_device_status_channel,
@@ -1483,7 +1453,6 @@ void THiNX::loop() {
   // If connected, perform the MQTT loop and bail out ASAP
   if (thinx_phase == CONNECT_API) {
     if (WiFi.getMode() == WIFI_AP) {
-      Serial.println(F("*TH: LOOP « (AP_MODE)"));
       return;
     }
     if (strlen(thinx_api_key) > 4) {

src/THiNXLib.h

@@ -9,14 +9,14 @@
 
 // Provides placeholder for THINX_FIRMWARE_VERSION_SHORT
 #ifndef VERSION
-#define VERSION "2.1.171"
+#define VERSION "2.1.172"
 #endif
 
 #ifndef THX_REVISION
 #ifdef THINX_FIRMWARE_VERSION_SHORT
 #define THX_REVISION THINX_FIRMWARE_VERSION_SHORT
 #else
-#define THX_REVISION "171"
+#define THX_REVISION "170"
 #endif
 #endif
 

src/thinx.h

@@ -4,11 +4,11 @@
 
 const char * THINX_ALIAS = "unnamed";
 const char * THINX_API_KEY = "0";
-const char * THINX_APP_VERSION = "thinx-lib-esp8266-arduino:2.1.171:2018-03-19";
+const char * THINX_APP_VERSION = "thinx-lib-esp8266-arduino:2.1.172:2018-03-21";
 const char * THINX_CLOUD_URL = "thinx.cloud";
 const char * THINX_COMMIT_ID = "0";
-const char * THINX_FIRMWARE_VERSION = "thinx-lib-esp8266-arduino:2.1.171";
-const char * THINX_FIRMWARE_VERSION_SHORT = "2.1.171";
+const char * THINX_FIRMWARE_VERSION = "thinx-lib-esp8266-arduino:2.1.172";
+const char * THINX_FIRMWARE_VERSION_SHORT = "2.1.172";
 const char * THINX_MQTT_URL = "thinx.cloud";
 const char * THINX_OWNER = "0";
 const char * THINX_PLATFORM  = "platformio";