diff --git a/.env b/.env index f355045..a956362 100644 --- a/.env +++ b/.env @@ -27,4 +27,6 @@ MESH_HIDE_DESTINATION_DATA=false ## Filtered ports in the exporter (default: 1, can be a comma-separated list of ports) FILTERED_PORTS=0 ## Hide message content in the TEXT_MESSAGE_APP packets (default: true) (Currently we only log message length, if we hide then all messages would have the same length) -HIDE_MESSAGE=false \ No newline at end of file +HIDE_MESSAGE=false +## MQTT server Key for decoding +MQTT_SERVER_KEY=1PG7OiApB1nwvP+rz05pAQ== \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index 31950ba..836f772 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -9,6 +9,8 @@ services: restart: unless-stopped extra_hosts: - "host.docker.internal:host-gateway" + ports: + - "9090:9090" networks: - mesh-bridge volumes: diff --git a/exporter/processors.py b/exporter/processors.py index 0f6d21a..adf72fb 100644 --- a/exporter/processors.py +++ b/exporter/processors.py @@ -1,9 +1,12 @@ +import base64 import json import os import redis +from cryptography.hazmat.backends import default_backend +from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes from meshtastic.config_pb2 import Config -from meshtastic.mesh_pb2 import MeshPacket, HardwareModel +from meshtastic.mesh_pb2 import MeshPacket, HardwareModel, Data from meshtastic.portnums_pb2 import PortNum from prometheus_client import CollectorRegistry, Counter, Histogram, Gauge @@ -116,6 +119,21 @@ class MessageProcessor: ) def process(self, mesh_packet: MeshPacket): + if getattr(mesh_packet, 'encrypted'): + key_bytes = base64.b64decode(os.getenv('MQTT_SERVER_KEY', '1PG7OiApB1nwvP+rz05pAQ==').encode('ascii')) + nonce_packet_id = getattr(mesh_packet, "id").to_bytes(8, "little") + nonce_from_node = getattr(mesh_packet, "from").to_bytes(8, "little") + + # Put both parts into a single byte array. + nonce = nonce_packet_id + nonce_from_node + + cipher = Cipher(algorithms.AES(key_bytes), modes.CTR(nonce), backend=default_backend()) + decryptor = cipher.decryptor() + decrypted_bytes = decryptor.update(getattr(mesh_packet, "encrypted")) + decryptor.finalize() + + data = Data() + data.ParseFromString(decrypted_bytes) + mesh_packet.decoded.CopyFrom(data) port_num = int(mesh_packet.decoded.portnum) payload = mesh_packet.decoded.payload diff --git a/requirements.txt b/requirements.txt index ff100c3..0c1eab4 100644 --- a/requirements.txt +++ b/requirements.txt @@ -3,4 +3,5 @@ redis~=5.0.6 python-dotenv~=1.0.1 meshtastic~=2.3.11 prometheus_client~=0.20.0 -unishox2-py3~=1.0.0 \ No newline at end of file +unishox2-py3~=1.0.0 +cryptography~=42.0.8 \ No newline at end of file