Reference

Network and security

Corvus is a web interface served by a local HTTP server, and the API behind that interface is the whole application: arming, a takeoff, a parameter write and a firmware upload are each one request. There is no login, because the ground station is a program on your laptop rather than a service on a network. This page explains how that stays true.

This machine only

The server listens on 127.0.0.1, so it answers only programs on the same computer. On a flight line hotspot the alternative would be every laptop and phone on that WiFi being able to arm your aircraft.

Requests are also checked for the name they were addressed to. A web page that tricks the browser into treating a hostile name as 127.0.0.1 (DNS rebinding) still sends that name, and is refused.

A second screen on the network

If you really want a second screen, for example a tablet showing the interface off the same link, set CORVUS_BIND and the server listens where you point it: 

CORVUS_BIND=0.0.0.0 ./run.sh

Corvus says so in its log at every launch. There is still no authentication, so treat that network the way you would treat handing someone the transmitter.

What a web page can do

Reading your telemetry: no

A website you visit cannot read your telemetry. The API names only loopback origins as allowed to read its answers, so another tool on your own machine still works and the web at large gets nothing. Before this, any page open in any tab could have fetched http://localhost:8000/api/state and read back position, battery and mode, or pulled the SSH host, user name and key path out of the configuration. If a tool on another origin genuinely needs access, name exactly that origin in CORVUS_ALLOWED_ORIGIN.

Sending data out: no

The interface is fenced in with a Content Security Policy. Everything the page loads comes from the Corvus server, and, the line that matters most, the page may not talk to any other host. If something ever managed to inject a script (a plugin you installed, a value that slipped through), it could not send your telemetry, SSH credentials or map keys off the machine. The page also refuses to be embedded in another page, so nobody can frame the interface and trick you into clicking ARM.

Keys and passwords

  • Map keys stay in the config file, which is readable by you alone. Corvus fetches tiles itself, so a key never appears in a page, a URL or a log line. See Map service.
  • Camera passwords never reach the browser and never appear on a command line. See Camera passwords.
  • SSH passwords are never held by a plugin; a launcher button names a saved connection and the backend takes the credentials from there.
  • Settings exports leave passwords and map keys out unless you switch them on.

SSH host keys

SSH connections to a companion computer remember host keys, in ~/.corvus/known_hosts. The first connection to a new machine is accepted and written down: you rarely have a known hosts entry for a companion computer, and being stopped at the field is worse than the risk. Every later connection is checked, and a key that does not match what was recorded is refused, which is the case that actually means something.

To refuse unknown hosts as well, set:

CORVUS_SSH_HOST_KEYS=strict

MAVLink signing

A SiK radio authenticates nothing: it relays whatever it hears on its frequency, so anyone within radio range could inject a disarm. MAVLink 2 signing closes that, and Corvus supports it as an opt-in.

  1. Give the autopilot a 32 byte signing key.
  2. Put the same key in a file on the ground station, either as 32 raw bytes or as 64 hexadecimal characters. On macOS and Linux the file must be owned by you and readable by you alone (chmod 600).
  3. Point CORVUS_MAVLINK_SIGNING_KEY_FILE at it and start Corvus.
CORVUS_MAVLINK_SIGNING_KEY_FILE="$HOME/.corvus/signing.key" ./run.sh

With signing on, every frame Corvus sends is signed and unsigned frames are rejected. Three messages stay exempt on purpose: RADIO_STATUS comes from the SiK modem, which has no key; ADSB_VEHICLE and COLLISION are traffic warnings from outside the vehicle. None of them can command anything.

A key that cannot be loaded fails the connection rather than falling back to an unsigned link. Otherwise a typo in a path would silently remove the protection you asked for, and nothing on the outside would show it.

Plugins

A plugin is ordinary JavaScript running in the app's own page, and the launcher plugins run whatever command you give them. Local commands can only be started from this computer, even when Corvus is reachable from the network. Read a plugin before you install it. See Plugins.

Suggest a change to this page