Azure IoT FOTA cannot download update images

[srubin-ns]

I have a test application which uses the "Azure IoT Hub" library. I have set up the IoT Hub, Update Account, update instance, etc. The device does successfully connect to the IoT Hub and sends test MQTT data to the hub. My problem is that the over-the-air updates (FOTA) are not working.

Specifically, the Device Twin info about the update does in fact get to my device and my device does try to download the update binary. It's obvious that my device does not have the credential (SAS?) to download the binary from the Azure storage container.

I do not have the container setup for public access. My assumption is that it should not be public, but the access to the files uses a SAS which is provided by the update.

Here is a snippet of the log (with some specifics x'd out):

00> [00:00:22.744,262] <dbg> azure_iot_hub: device_twin_result_process: Request ID: 221
00> [00:00:22.745,513] <inf> azure_iot_hub_sample: Azure FOTA state report is created and ready to be sent
00> [00:00:22.745,574] <inf> azure_iot_hub_sample: Report: {"firmware":{"fwUpdateStatus":"current","currentFwVersion":"0.0.1"}}
00> [00:00:22.746,978] <inf> azure_fota: Attempting to download firmware (version '0.0.2') from xxxxxxxxxxxxxxxx.blob.core.windows.net/xxxxxxxxxxxxxxxxxx/xxxxxxxxxxx-update_0.1_generated.importmanifest.json
00> [00:00:22.747,100] <inf> download_client: Downloading: xxxxxxxxxxxxcontainer1/xxxxxxxxxxxx-update_0.1_generated.importmanifest.json [0]
00> [00:00:22.747,253] <inf> azure_iot_hub_sample: Azure FOTA download has started
00> [00:00:22.747,314] <inf> azure_iot_hub_sample: Report: {"firmware":{"fwUpdateStatus":"downloading","currentFwVersion":"0.0.1","pendingFwVersion":"0.0.2","jobId":"xxxxxxxxxxx-4171-4209-a49d-700c35567d1d"}}
00> [00:00:22.747,344] <dbg> azure_iot_hub: device_twin_result_process: FOTA message handled
00> [00:00:22.747,375] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_TWIN_RECEIVED
00> [00:00:23.402,954] <inf> download_client: Setting up TLS credentials, sec tag count 1
00> [00:00:23.403,137] <inf> download_client: Connecting to xxxx.xxxx.xxxx.xxxx
00> [00:00:28.398,742] <err> download_client: Unexpected HTTP response: 409 public access is not permitted on this storage account.
00> [00:00:28.398,773] <err> fota_download: Download client error
00> [00:00:28.400,390] <err> azure_fota: FOTA download failed
00> [00:00:28.400,512] <inf> azure_iot_hub_sample: Azure FOTA error

Questions:

1. Am I supposed to expose the update file(s) to the public? How are they protected such that only my device(s) can download them?

2. Which update file(s) should be used? The zip (which contains the binary) or the manifest json (which would presumably instruct the code as to how to install the update)?

3. Once the update file (zip? Bin? Json?) file is downloaded, does the FOTA library know how to apply it, i.e. reflash itself?

Thank you!

[dejans]

Hi,

Which NCS version do you use?

Have you tried to use Shared Access Signatures (SAS)? You can look at granting limited access using SAS delegating access using SAS, create account SAS, create service SAS and service SAS examples, authorize with shared key, anonymous read access (for testing, presents security risk).

Best regards,
Dejan

[srubin-ns]

 dejans  I am using v2.8.0. (I have also tried v2.9.9 with the same results).

I think I understand the idea of the SAS stuff you mentioned, but what's missing is that there is no token sent in the manifest, or maybe there is, but the FOTA download is not using it.

None of the nRF documentation or examples give any hint as to how to use the tokens. It was my understanding that this was all built into the Azure FOTA library.

Will you please confirm that there is in fact working Azure IoT FOTA in the NCS? Has this actually been made to work with Azure?

Thank you!

[dejans]

Hi,

srubin-ns said:

I think I understand the idea of the SAS stuff you mentioned, but what's missing is that there is no token sent in the manifest, or maybe there is, but the FOTA download is not using it.

None of the nRF documentation or examples give any hint as to how to use the tokens. It was my understanding that this was all built into the Azure FOTA library.

SAS tokens are not natively supported by the Azure FOTA library. This means that if you want to use them, you need to implement that yourself. I am sorry for any possible confusion. Possible alternative is to use encrypted images which can be decrypted by MCUboot when they arrive at the device.

srubin-ns said:

Will you please confirm that there is in fact working Azure IoT FOTA in the NCS? Has this actually been made to work with Azure?

Am I supposed to expose the update file(s) to the public? How are they protected such that only my device(s) can download them?

The Azure FOTA library makes no assumptions on how the files are hosted and about security involved. It has been tested using publicly hosted file on Azure blob storage.

Which update file(s) should be used? The zip (which contains the binary) or the manifest json (which would presumably instruct the code as to how to install the update)?

Documentation provides information about output build files. In this case, zephyr.signed.bin should be used. Alternatively, you can use the same binary file from dfu_application.zip.

Once the update file (zip? Bin? Json?) file is downloaded, does the FOTA library know how to apply it, i.e. reflash itself?

When the download starts, the DFU target library used by FOTA download library will check what type of image it is downloading and handle it accordingly. For an application update, this means downloading the entire image to the secondary MCUboot slot and then attempt to use that image on subsequent reboot.

Best regards,
Dejan

[srubin-ns]

 dejans , thanks for your detailed response. They do lead me back to the more basic questions: Does FOTA with NCS and Azure IoT actually work? Is there an example? Thank you

[dejans]

Hi,

Azure FOTA is part of the Azure IoT Hub sample. You can look at firmware update and additional configuration sections of the sample. Additional information is available in Azure FOTA library configuration. You may also want to look at Azure FOTA sample which was separate sample before NCS v2.5.0.

Best regards,
Dejan 

[dejans]

Hi,

Do you have any update on your testing? Have you made any progress?

Best regards,
Dejan

[Thomas]

I have the Azure FOTA  working in more than one project. It is based on the sample and nothing is changed related to FOTA. So I will say that the current implementation works.

In my schedule is a task to update the nRF Connect Azure FOTA code so that it propery supports the Azure ADU (Azure Device Update) service. This will integrate updating much better with IoT Hub and Azure provissioning service.

I also have some workaround to support Azure PnP devices which is not possible with the current nRF Connect Azure code. I will see if i can integrate this better, currently you need to modify the SDK code to make PnP work.

[srubin-ns]

Thoman, thanks for that response. It's encouraging! Can you please tell me which NCS version you're using?

[srubin-ns]

Also, my problem(s) seems to be rooted in how the credentials for downloading the firmware image are passed down to the device. I'm not seeing them. Are your update images stored in a secured Azure storage container? Thanks again

[Thomas]

I have been on different version, now at 3.0 but at least from 2.6.x.

[Thomas]

Not sure what you mean by "secured" container. My firmware files are stored in an Azure storage account in the blob containeres  area. The files are accessible from the internet.