Merge pull request #45 from c-jimenez/dev/security_firmware_update

Dev/security firmware update

Author: c-jimenez

README.md

@@ -39,7 +39,7 @@ As of this version :
 
 * All the messages defined in the OCPP 1.6 edition 2 protocol have been implemented except GetCompositeSchedule for Charge Point role
 * All the configuration keys defined in the OCPP 1.6 edition 2 protocol have been implemented for the Charge Point role
-* Most of Charge Point and Central System behavior related to the OCPP 1.6 security whitepaper edition 2 has been implemented (work in progress, see [OCPP security extensions](#ocpp-security-extensions))
+* All the messages defined in the OCPP 1.6 security whitepaper edition 2 have been implemented
 
 The user application will have to implement some callbacks to provide the data needed by **Open OCPP** or to handle OCPP events (boot notification, remote start/stop notifications, meter values...).
 
@@ -123,12 +123,13 @@ In the "Owner" column, "S" means that the configuration key behavior is handled
 | ChargingScheduleMaxPeriods | S | None |
 | ConnectorSwitch3to1PhaseSupported | S | None |
 | MaxChargingProfilesInstalled | S | None |
-| AdditionalRootCertificateCheck | U/S | Not implemented yet : implemented behavior is the same as if AdditionalRootCertificateCheck = False |
+| AdditionalRootCertificateCheck | U/S | If internal certificate management is enabled, the stack handle this parameter (implemented behavior for now is the always the one corresponding to AdditionalRootCertificateCheck = False), otherwise it must be the user application |
 | AuthorizationKey | S | None |
 | CertificateSignedMaxChainSize | S | None |
 | CertificateStoreMaxLength | U/S | If internal certificate management is enabled, the stack handle this parameter, otherwise it must be the user application |
 | CpoName | S | None |
 | SecurityProfile | S | None |
+| SupportedFileTransferProtocols | U | None |
 
 ### OCPP security extensions
 
@@ -145,6 +146,8 @@ In Charge Point role, the stack will automatically disconnect and then reconnect
 * **AuthorizationKey**
 * **Security Profile**
 
+**Restriction** : The automatic fallback to old connection parameters if the connection fails after switching to a new security is not implemented yet.
+
 #### Security events
 
 **Open OCPP** support the whole use cases of security events and logging. 
@@ -177,6 +180,14 @@ If **InternalCertificateManagementEnabled** is set to **false**, the actual stor
 
 If **InternalCertificateManagementEnabled** is set to **true**, the storage of certificates and their keys is fully handled by **Open OCPP**. The user application just has to provide a passphrase using the **TlsClientCertificatePrivateKeyPassphrase** configuration key to securily encrypt the certicates' private keys using AES-256-CBC algorithm. **Open OCPP** will automatically use the installed corresponding certificates depending on the configured Security Profile and the certificates validity dates.
 
+**Restriction** : The automatic fallback to old certificate if the connection fails after installing new certificate is not implemented yet.
+
+#### Signed firmware update
+
+**Open OCPP** support this feature for both Charge Point and Central System roles.
+
+**Open OCPP** provides helper classes based on OpenSSL to ease private keys, certificate and certificate requests usage : generation, signature, verification. They can be used in the user application callbacks. These helpers can be found in the ocpp::tools::x509 namespace and are widely used in the **Open OCPP** source code and examples.
+
 ### Internal configuration keys
 
 The behavior and the configuration of the **Open OCPP** stack can be modified through configuration keys. Some are specific to an OCPP role and some are common.

examples/README.md

@@ -2,12 +2,18 @@
 
 All the examples are licensed under the MIT licence so that code can be used and modified at will without having to contribute back.
 
-The following examples are available :
+The following examples are available for OCPP 1.6 standard :
+
 * [Quick start Central System example](./quick_start_centralsystem/README.md)
 * [Quick start Charge Point example](./quick_start_chargepoint/README.md)
 * [Remote Charge Point example](./remote_chargepoint/README.md)
+
+The following examples are available for OCPP 1.6 security extensions :
+
+* [Security Central System example](./security_centralsystem/README.md)
 * [Security Charge Point example](./security_chargepoint/README.md)
 
 How to run the examples:
+
 * Customize the *config.ini* file of the selected example with the URL of the Central System and the other connection parameters has well has the OCPP configuration keys
 * Run the example using the **-w** option to specify the path of the configuration file

examples/common/DefaultCentralSystemEventsHandler.cpp

@@ -321,7 +321,7 @@ void DefaultCentralSystemEventsHandler::ChargePointRequestHandler::securityEvent
          << " - message = " << message << endl;
 }
 
-/** @copydoc bool IChargePointRequestHandler::signCertificate(const ocpp::x509::CertificateRequest& certificate_request) */
+/** @copydoc bool IChargePointRequestHandler::signCertificate(const ocpp::x509::CertificateRequest&) */
 bool DefaultCentralSystemEventsHandler::ChargePointRequestHandler::signCertificate(
     const ocpp::x509::CertificateRequest& certificate_request)
 {
@@ -403,3 +403,13 @@ bool DefaultCentralSystemEventsHandler::ChargePointRequestHandler::signCertifica
     }
     return ret;
 }
+
+/** @copydoc void IChargePointRequestHandler::signedFirmwareUpdateStatusNotification(ocpp::types::FirmwareStatusEnumType,
+                                                                                             const ocpp::types::Optional<int>&) */
+void DefaultCentralSystemEventsHandler::ChargePointRequestHandler::signedFirmwareUpdateStatusNotification(
+    ocpp::types::FirmwareStatusEnumType status, const ocpp::types::Optional<int>& request_id)
+{
+    cout << "[" << m_chargepoint->identifier()
+         << "] - Signed firmware update status notification : status = " << FirmwareStatusEnumTypeHelper.toString(status)
+         << " - request_id = " << (request_id.isSet() ? std::to_string(request_id) : "not set");
+}

examples/common/DefaultCentralSystemEventsHandler.h

@@ -169,9 +169,14 @@ class DefaultCentralSystemEventsHandler : public ocpp::centralsystem::ICentralSy
                                        const ocpp::types::DateTime& timestamp,
                                        const std::string&           message) override;
 
-        /** @copydoc bool IChargePointRequestHandler::signCertificate(const ocpp::x509::CertificateRequest& certificate_request) */
+        /** @copydoc bool IChargePointRequestHandler::signCertificate(const ocpp::x509::CertificateRequest&) */
         bool signCertificate(const ocpp::x509::CertificateRequest& certificate_request) override;
 
+        /** @copydoc void IChargePointRequestHandler::signedFirmwareUpdateStatusNotification(ocpp::types::FirmwareStatusEnumType,
+                                                                                             const ocpp::types::Optional<int>&) */
+        void signedFirmwareUpdateStatusNotification(ocpp::types::FirmwareStatusEnumType status,
+                                                    const ocpp::types::Optional<int>&   request_id) override;
+
       protected:
         /** @brief Get the serial number of the charge point */
         virtual std::string getChargePointSerialNumber(const std::string& chargepoint_id)

examples/common/DefaultChargePointEventsHandler.cpp

@@ -629,6 +629,45 @@ bool DefaultChargePointEventsHandler::hasChargePointCertificateInstalled()
     return false;
 }
 
+/** @copydoc ocpp::types::UpdateFirmwareStatusEnumType IChargePointEventsHandler::checkFirmwareSigningCertificate(
+ *                                            const ocpp::x509::Certificate&) */
+ocpp::types::UpdateFirmwareStatusEnumType DefaultChargePointEventsHandler::checkFirmwareSigningCertificate(
+    const ocpp::x509::Certificate& signing_certificate)
+{
+    UpdateFirmwareStatusEnumType ret = UpdateFirmwareStatusEnumType::InvalidCertificate;
+
+    cout << "Check of firmware signing certificate requested : subject = " << signing_certificate.subjectString()
+         << " - issuer = " << signing_certificate.issuerString() << endl;
+
+    // Load all installed Manufacturer CA certificates
+    std::vector<Certificate> ca_certificates;
+    for (auto const& dir_entry : std::filesystem::directory_iterator{m_working_dir})
+    {
+        if (!dir_entry.is_directory())
+        {
+            std::string filename = dir_entry.path().filename();
+            if (ocpp::helpers::startsWith(filename, "fw_") && ocpp::helpers::endsWith(filename, ".pem"))
+            {
+                ca_certificates.emplace_back(dir_entry.path());
+            }
+        }
+    }
+    if (!ca_certificates.empty())
+    {
+        // Check signing certificate
+        if (signing_certificate.verify(ca_certificates))
+        {
+            ret = UpdateFirmwareStatusEnumType::Accepted;
+        }
+    }
+    else
+    {
+        cout << "No manufacturer CA installed" << endl;
+    }
+
+    return ret;
+}
+
 /** @brief Get the number of installed CA certificates */
 unsigned int DefaultChargePointEventsHandler::getNumberOfCaCertificateInstalled(bool manufacturer, bool central_system)
 {

examples/common/DefaultChargePointEventsHandler.h

@@ -158,6 +158,10 @@ class DefaultChargePointEventsHandler : public ocpp::chargepoint::IChargePointEv
     /** @copydoc bool IChargePointEventsHandler::hasChargePointCertificateInstalled() */
     bool hasChargePointCertificateInstalled() override;
 
+    /** @copydoc ocpp::types::UpdateFirmwareStatusEnumType IChargePointEventsHandler::checkFirmwareSigningCertificate(
+     *                                            const ocpp::x509::Certificate&) */
+    ocpp::types::UpdateFirmwareStatusEnumType checkFirmwareSigningCertificate(const ocpp::x509::Certificate& signing_certificate) override;
+
     // API
 
     /** @brief Indicate a pending remote start transaction */

examples/common/config/OcppConfig.cpp

@@ -99,6 +99,7 @@ static const map<string, int> CONFIGURATION_VALUES = {
     {"CertificateStoreMaxLength", PARAM_READ | PARAM_OCPP},
     {"CpoName", PARAM_READ | PARAM_WRITE | PARAM_OCPP},
     {"SecurityProfile", PARAM_READ_WRITE | PARAM_OCPP},
+    {"SupportedFileTransferProtocols", PARAM_READ | PARAM_OCPP},
 
     ///
     /// Charge point configuration

examples/common/config/OcppConfig.h

@@ -259,6 +259,10 @@ class OcppConfig : public ocpp::config::IOcppConfig
                Default, when no security profile is yet configured: 0. */
     unsigned int securityProfile() const override { return getUInt("SecurityProfile"); }
 
+    /** @brief Comma separated list of supported file transfer protocols for upload AND download
+               Allowed values : FTP, FTPS, HTTP, HTTPS, SFTP */
+    std::string supportedFileTransferProtocols() const override { return getString("SupportedFileTransferProtocols"); }
+
   private:
     /** @brief Configuration file */
     ocpp::helpers::IniFile& m_config;

examples/quick_start_chargepoint/config/quick_start_chargepoint.ini

@@ -91,3 +91,4 @@ CertificateSignedMaxChainSize=10000
 CertificateStoreMaxLength=50
 CpoName=SteVe
 SecurityProfile=0
+SupportedFileTransferProtocols=FTP,FTPS,HTTP,HTTPS

examples/remote_chargepoint/config/remote_chargepoint.ini

@@ -91,3 +91,4 @@ CertificateSignedMaxChainSize=10000
 CertificateStoreMaxLength=50
 CpoName=SteVe
 SecurityProfile=0
+SupportedFileTransferProtocols=FTP,FTPS,HTTP,HTTPS