Mesh proxy re connection and sequence number

RE: Mesh proxy re connection and sequence number

Hung Bui — Thu, 02 Apr 2020 12:33:43 GMT

Hi Olivier,

From Roshan:

As of now, the spec does not state anything for a scenario like you have specified, but still there is a way around it. You can still use the backed up json to retrieve the last provisioner and change the provisioner address to something new and this should let you continue with a new sequence number if that address is not in use.

Sequence number is important in mesh it's used for encryption, identifying a unique messages from each device and also to protect devices from replay attacks. Our sample app will clear the local app data will erase everything just like any other app out there and it's only a sample app. You can improve your end user app to handle these case better. Like I mentioned before this is why we left the API open and provide our users with the flexibility just for purposes like this.

RE: Mesh proxy re connection and sequence number

OlivierOZEO — Wed, 01 Apr 2020 15:11:42 GMT

Hi,

I want to go back on this sentanse : "The NrfMeshh app will invite you to create a new provisioner, but is there a way to 'restore' the one we lost?"

If my smartphone controls a mesh network, it has a valid SeqN that I store in local. If I lose my phone and want to install an app (that control this network) on a new smartphone, is there a better procedure than recreating a new provisionner?

Is there any other local solution to get back a valid SeqN?

RE: Mesh proxy re connection and sequence number

benjamin — Wed, 01 Apr 2020 14:52:11 GMT

after some bad manipulation of the website, I accidentatly delete a part of the thead and your last message, that was very helpfull. Here is the content of it:

According to the mesh configuration database specification, sequence numbers are not exported for security reasons hence the sequence number is not exported. If someone get's hold of the json spec they can start sending messages reusing an existing provisioner and their sequence number which will make the device reject the original provisioner. Exporting the sequence number would be a spec breaker for us.

They can store the sequence numbers safely and separately (in their own cloud) themselves for each provisioner and each node address in the network. Therefore we have left the sequence number public if a user wants to store/set it manually themselves using the api as shown here.

One solution would be to have their own database with the relevant network UUID, provisioner's sequence number for each node in the network. If not They can even append this information to the json file themselves and parse their information themselves and give the rest of the original to the mesh library which will parse the original json data.

RE: Mesh proxy re connection and sequence number

benjamin — Wed, 01 Apr 2020 14:49:41 GMT

Hi all

Sorry for this long period of silence. I had a lot of things to care of.

First, I would like to thank you all, for your help in this period of confinement.

Yesterday, we made a good step in our comprehension of our problem: We still have an issue for the reconnection after stoping the app, and, in fact, this is our source of the problem:

Restarting the app: As you said:

Roshan Rajaratnam said:

the app stores each sequence number related to a specific node address in an internal database.

But, for us, the network configuration is stored online. We store it online each time the network changes, and we download it when the app starts, wiping the local database.

We are working on a way to avoid this data loss, but we have a few questions that need answering, first:

What is the reason why the sequence number isn't part of the data we get after exporting the network configuration? (Security? Volume?)

Depending on this, we will decide 'where/if' we will store it, in addition to the local database.

In case destruction/deletion of this local database (phone get lost or broken), how can we 'restore' it? or getting, a least, one correct connection to the nodes?

To understand this problem, we invite you to create a mesh network with NrfMesh. Export it and wipe the app data, then, import the network configuration you export earlier.

The NrfMeshh app will invite you to create a new provisioner, but is there a way to 'restore' the one we lost?

Thank you

RE: Mesh proxy re connection and sequence number

benjamin — Mon, 16 Mar 2020 12:13:19 GMT

Hi Roshan

we are not 'reaching' the 'correct' sequence number.

the contents of these two messages grant the ability to the ADK to update its sequence number.

RE: Mesh proxy re connection and sequence number

Roshan Rajaratnam — Mon, 16 Mar 2020 12:04:02 GMT

This is not ideal, I don't think you should send messages until you reach the correct sequence number. I have a couple of questions, does this happen with our example sdk or Does it happen only with your fw? Could you give us some exact steps to reproduce this issue so that we can fast track the testing?

RE: Mesh proxy re connection and sequence number

benjamin — Thu, 12 Mar 2020 15:01:27 GMT

yes, it is a problem for us.

indeed the sequence number is stored, but it changes across the time. and after a while, it get out of sync with the FW.

we found a way to 'update' this stored sequence number. but we had to change a bit the sdk.

at the moment the BLE connection is etablished (device ready), the FW send, spontaneously, 2 messages: proxy filter status and proxy state status.

with these message, the mobile app is able to update the sequence number, and can send messages to the FW, and the FW can decrypt the messages.

will this affect bluetooth qualification?

RE: Mesh proxy re connection and sequence number

Roshan Rajaratnam — Fri, 21 Feb 2020 15:12:51 GMT

Hi Olivier, the app stores each sequence number related to a specific node address in an internal database. So the library will always save an sequence number of an outgoing message. Is there any chance that you could log the sequence number received on the fw side? I just hope that you have not run out of sequence numbers here...

RE: Mesh proxy re connection and sequence number

olivdeso — Fri, 21 Feb 2020 14:53:09 GMT

Hi Roshaan

it can occur for instance whenn the phone is switched OFF and back ON the next day.

-> how, in that case, the phone/app will re-synchronize its seq number in order to get re-connected and synchronized to the mesh.

best regards

Olivier

RE: Mesh proxy re connection and sequence number

Roshan Rajaratnam — Fri, 21 Feb 2020 14:12:03 GMT

Could you give us the exact steps to reproduce this please?

RE: Mesh proxy re connection and sequence number

benjamin — Fri, 21 Feb 2020 13:51:48 GMT

It happens on both, the examples and our fw. I am checking if you have signed the NDA.

RE: Mesh proxy re connection and sequence number

Roshan Rajaratnam — Fri, 21 Feb 2020 12:38:47 GMT

Ideally the mesh lib should not loose the sequence number for a given node address. Does this happen on the sdk examples or have you got a custom fw? Is it possible thatyou can share it with us?

RE: Mesh proxy re connection and sequence number

benjamin — Fri, 21 Feb 2020 12:04:41 GMT

nop

RE: Mesh proxy re connection and sequence number

Roshan Rajaratnam — Fri, 21 Feb 2020 11:34:56 GMT

Hi. regarding the comment it's an affirmation. However it's a bit strange that the app loses the sequence number. Is the address used by the provisioner being used by some other provisioner?

RE: Mesh proxy re connection and sequence number

benjamin — Wed, 19 Feb 2020 11:35:24 GMT

Hi Roshan

First, we didn't change the library. We are using it as it is.

We need a sequence number to send messages to the mesh network, obviously.

regarding that one

The sequence number is automatically incremented from the library for every message that's sent out?

Is a question or an affirmation?

The original question is : how do we get the sequence number from the proxy server to initiate the communication?

For the moment, the App send a command that don't requiere a sequence number (proxy config command) to retrieve it, like it is done in the exemples. But it is not working for reconnections, when the App is disconnected for a while.

When the app reconnect, it sends messages to the node that can't be decrypt until the phone seq num didn't reach a sufficient value.

In the board SDK, the symptoma is that the packet cannot be decrypted.

the error we are facing on board side is:

proxy.c:547        {
proxy.c:548            __LOG(LOG_SRC_BEARER, LOG_LEVEL_INFO, "Decryption failed\n");
proxy.c:549        }

This come from the function

net_packet.c:231 uint32_t net_packet_decrypt(network_packet_metadata_t * p_net_metadata,
net_packet.c:232                             uint32_t net_packet_len,
net_packet.c:233                             const packet_mesh_net_packet_t * p_net_encrypted_packet,
net_packet.c:234                             packet_mesh_net_packet_t * p_net_decrypted_packet,
net_packet.c:235                             net_packet_kind_t packet_kind)
net_packet.c:236 {
net_packet.c:237     NRF_MESH_ASSERT(p_net_metadata != NULL && p_net_encrypted_packet != NULL &&
net_packet.c:238                     p_net_decrypted_packet != NULL &&
net_packet.c:239                     p_net_decrypted_packet != p_net_encrypted_packet);
net_packet.c:240 
net_packet.c:241     if (net_packet_len < PACKET_MESH_NET_PDU_OFFSET || net_packet_len > PACKET_MESH_NET_MAX_SIZE)
net_packet.c:242     {
net_packet.c:243         return NRF_ERROR_INVALID_LENGTH;
net_packet.c:244     }
net_packet.c:245 
net_packet.c:246     p_net_metadata->internal.iv_index = net_state_rx_iv_index_get(packet_mesh_net_ivi_get(p_net_encrypted_packet));
net_packet.c:247     p_net_metadata->p_security_material = NULL;
net_packet.c:248     uint8_t nid = packet_mesh_net_nid_get(p_net_encrypted_packet);
net_packet.c:249 
net_packet.c:250     const nrf_mesh_network_secmat_t * p_secmat[2] = { NULL, NULL };
net_packet.c:251     do {
net_packet.c:252         nrf_mesh_net_secmat_next_get(nid, &p_secmat[0], &p_secmat[1]);
net_packet.c:253 
net_packet.c:254         for (uint32_t i = 0; i < ARRAY_SIZE(p_secmat) && p_secmat[i] != NULL; i++)
net_packet.c:255         {
net_packet.c:256             if (try_decrypt(p_net_metadata,
net_packet.c:257                             net_packet_len,
net_packet.c:258                             p_net_encrypted_packet,
net_packet.c:259                             p_net_decrypted_packet,
net_packet.c:260                             p_secmat[i],
net_packet.c:261                             packet_kind))
net_packet.c:262             {
net_packet.c:263                 return NRF_SUCCESS;
net_packet.c:264             }
net_packet.c:265         }
net_packet.c:266     } while (p_secmat[0] != NULL);
net_packet.c:267 
net_packet.c:268     return NRF_ERROR_NOT_FOUND;
net_packet.c:269 }

that give 268: NRF_ERROR_NOT_FOUND

so how do we get the sequence number from the proxy server to initiate the communication?

is it still the better solution to send a proxy config command to retreive it?

RE: Mesh proxy re connection and sequence number

Roshan Rajaratnam — Tue, 18 Feb 2020 08:16:51 GMT

Hi EricTranAvnet I'm trying to understand the issue you aer facing here, why do you need the sequence number here? The sequence number is automatically incremented from the library for every message that's sent out? Have you made changes to the sample application?

The sample android app will try to connect after the provisioning completes, it will try to scan and connect for a duration of 30 seconds and if it fails the app will let the user connect manually.

RE: Mesh proxy re connection and sequence number

EricTranAvnet — Mon, 10 Feb 2020 10:49:42 GMT

Hi Joakim,

Do you have any news about this question ?

Thank you in advance,

RE: Mesh proxy re connection and sequence number

benjamin — Thu, 06 Feb 2020 16:39:52 GMT

Hi Joakim,

Any news from the Devs?

If it can helps, we noticed one news strange behaviour,

indeed, when nrf mesh app try to reconnect some times after the provisionning, the board did not accept any messages.

turn off and on the board appear to 'fix' the problem.

Did someone have an idea?

thanks, best regards.

RE: Mesh proxy re connection and sequence number

Joakim Jakobsen — Thu, 30 Jan 2020 12:53:39 GMT

Hi.

Forwarding this to our developers. Will get back to you with more information.

Best regards,
Joakim Jakobsen