add ability to re-sign packets before forwarding them on

Author: peterbarker

MAVProxy/mavproxy.py

@@ -903,6 +903,10 @@ def process_mavlink(slave):
         allow_fwd = False
     if allow_fwd:
         for m in msgs:
+            if (slave.mav.signing.secret_key is not None and
+                not m.get_signed()):
+                continue
+
             target_sysid = getattr(m, 'target_system', -1)
             mbuf = m.get_msgbuf()
             if mpstate.settings.mavfwd_link > 0 and mpstate.settings.mavfwd_link <= len(mpstate.mav_master):

MAVProxy/modules/mavproxy_link.py

@@ -12,6 +12,7 @@
 
 from pymavlink import mavutil
 
+import copy
 import fnmatch
 import json
 import math
@@ -925,7 +926,8 @@ def accumulated_statustext(self):
                     m.command not in [mavutil.mavlink.MAV_CMD_GET_HOME_POSITION,
                                       mavutil.mavlink.MAV_CMD_DO_DIGICAM_CONTROL]):
                     self.mpstate.console.writeln("Got COMMAND_ACK: %s: %s" % (cmd, res))
-            except Exception:
+            except Exception as e:
+                print("exception: %s" % str(e))
                 self.mpstate.console.writeln("Got MAVLink msg: %s" % m)
 
             if m.command == mavutil.mavlink.MAV_CMD_PREFLIGHT_CALIBRATION:
@@ -1058,7 +1060,14 @@ def master_callback(self, m, master):
                             from wsproto.connection import ConnectionState
                             if r.ws.state != ConnectionState.OPEN:  # Ensure Websocket handshake is done
                                 continue
-                        r.write(m.get_msgbuf())
+
+                        # if an output has a key assigned then require its use:
+                        if r.mav.signing.secret_key is not None:
+                            c = copy.copy(m)
+                            m.resign_packet(r.mav)
+                            r.write(c.get_msgbuf())
+                        else:
+                            r.write(m.get_msgbuf())
 
             sysid = m.get_srcSystem()
             target_sysid = self.target_system

MAVProxy/modules/mavproxy_signing.py

@@ -29,6 +29,8 @@ def cmd_signing(self, args):
             self.cmd_signing_setup(args[1:])
         elif args[0] == 'key':
             self.cmd_signing_key(args[1:])
+        elif args[0] == 'output_key':
+            self.cmd_signing_output_key(args[1:])
         elif args[0] == 'disable':
             self.cmd_signing_disable(args[1:])
         elif args[0] == 'remove':
@@ -87,7 +89,7 @@ def allow_unsigned(self, mav, msgId):
     def cmd_signing_key(self, args):
         '''set signing key on connection'''
         if len(args) == 0:
-            print("usage: signing setup passphrase")
+            print("usage: signing key passphrase")
             return
         if not self.master.mavlink20():
             print("You must be using MAVLink2 for signing")
@@ -97,6 +99,23 @@ def cmd_signing_key(self, args):
         self.master.setup_signing(key, sign_outgoing=True, allow_unsigned_callback=self.allow_unsigned)
         print("Setup signing key")
 
+    def cmd_signing_output_key(self, args):
+        '''set signing key on connection'''
+        if len(args) == 0:
+            print("usage: signing output_key output_num passphrase")
+            return
+        if not self.master.mavlink20():
+            print("You must be using MAVLink2 for signing")
+            return
+        output_num = int(args[0])
+        if output_num < 0 or output_num > len(self.mpstate.mav_outputs):
+            print("Bad output")
+            return
+        passphrase = args[1]
+        key = self.passphrase_to_key(passphrase)
+        self.mpstate.mav_outputs[output_num].setup_signing(key, sign_outgoing=True, allow_unsigned_callback=self.allow_unsigned)
+        print("Setup signing key on output %u" % output_num)
+
     def cmd_signing_disable(self, args):
         '''disable signing locally'''
         self.master.disable_signing()