Add "server_cert" parameter to firmware_update command. (#1043)
When updating from the MQTT command from a SSL enabled server this adds an option to provide the server SSL certificate with the command. This is useful if connecting to different servers or if the configured certificate has expired and requires updating to not lose the ability to update via OTA. The certificate provided will be saved to flash memory for use on subsequent restarts.
This commit is contained in:
h2zero authored and GitHub committed
1 parent
a4a85ff14b
commit
2dedabc52f
4 files changed
+65
-10
No files matched your search
+30
-5
@@ -97,19 +97,44 @@ The gateway can be updated through an MQTT message by providing a JSON formatted
|
||||
To enable this functionality, `MQTT_HTTPS_FW_UPDATE` will need to be defined or the line that defines in in user_config.h will need to be uncommented.
|
||||
|
||||
::: tip
|
||||
If using an unsecure MQTT broker it is **highly recommended** to disable the password checking by setting the macro `MQTT_HTTPS_FW_UPDATE_USE_PASSWORD` to 0 (default is 1 (enabled)), otherwise a clear text password may be sent over the network.
|
||||
If using an unsecure MQTT broker it is **highly recommended** to disable the password checking by setting the macro `MQTT_HTTPS_FW_UPDATE_USE_PASSWORD` to 0 (default is 1 (enabled)), otherwise a clear text password may be sent over the network.
|
||||
|
||||
The `server_cert` parameter is optional. If the update server has changed or certificate updated or not set in `user_config.h` then you can provide the certifiate here.
|
||||
:::
|
||||
|
||||
### Example firmware update message:
|
||||
```
|
||||
mosquitto_pub -t "home/<gateway_name>/commands/firmware_update" -m
|
||||
'{
|
||||
mosquitto_pub -t "home/<gateway_name>/commands/firmware_update" -m '{
|
||||
"version": "test",
|
||||
"password": "OTAPASSWORD",
|
||||
"url": "https://github.com/1technophile/OpenMQTTGateway/releases/download/v0.9.6/esp32-m5stack-ble-firmware.bin"
|
||||
}'
|
||||
"url": "https://github.com/1technophile/OpenMQTTGateway/releases/download/v0.9.7/esp32dev-ble-firmware.bin",
|
||||
"server_cert": "-----BEGIN CERTIFICATE-----
|
||||
MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs
|
||||
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
|
||||
d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j
|
||||
ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL
|
||||
MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3
|
||||
LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug
|
||||
RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm
|
||||
+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW
|
||||
PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM
|
||||
xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB
|
||||
Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3
|
||||
hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg
|
||||
EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF
|
||||
MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA
|
||||
FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec
|
||||
nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z
|
||||
eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF
|
||||
hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2
|
||||
Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe
|
||||
vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
|
||||
+OkuE6N36B9K
|
||||
-----END CERTIFICATE-----"}'
|
||||
```
|
||||
|
||||
A bash script is available [here](ota_command_cert.zip) to simplify the use of the `server_cert` parameter.
|
||||
|
||||
# State LED usage
|
||||
|
||||
The gateway can support up to 3 LED to display its operating state:
|
||||
|
||||
Binary file not shown.
+7
-3
@@ -121,9 +121,13 @@ const byte mac[] = {0xDE, 0xED, 0xBA, 0xFE, 0x54, 0x95}; //W5100 ethernet shield
|
||||
/*-------------DEFINE YOUR MQTT PARAMETERS BELOW----------------*/
|
||||
//MQTT Parameters definition
|
||||
#if defined(ESP8266) || defined(ESP32) || defined(__AVR_ATmega2560__) || defined(__AVR_ATmega1280__)
|
||||
# define parameters_size 30
|
||||
# define mqtt_topic_max_size 100
|
||||
# define mqtt_max_packet_size 1024
|
||||
# define parameters_size 30
|
||||
# define mqtt_topic_max_size 100
|
||||
# ifdef MQTT_HTTPS_FW_UPDATE
|
||||
# define mqtt_max_packet_size 2048
|
||||
# else
|
||||
# define mqtt_max_packet_size 1024
|
||||
# endif
|
||||
#else
|
||||
# define parameters_size 15
|
||||
# define mqtt_topic_max_size 50
|
||||
|
||||
+28
-2
@@ -185,6 +185,7 @@ static void* eClient = nullptr;
|
||||
static bool mqtt_secure = (MQTT_SECURE_DEFAULT || MQTT_SECURE_SELF_SIGNED);
|
||||
static uint8_t mqtt_ss_index = MQTT_SECURE_SELF_SIGNED_INDEX_DEFAULT;
|
||||
static String mqtt_cert = "";
|
||||
static String ota_server_cert = "";
|
||||
#endif
|
||||
|
||||
#ifdef ESP32
|
||||
@@ -1034,6 +1035,7 @@ void saveMqttConfig() {
|
||||
json["mqtt_broker_secure"] = mqtt_secure;
|
||||
json["mqtt_broker_cert"] = mqtt_cert;
|
||||
json["mqtt_ss_index"] = mqtt_ss_index;
|
||||
json["ota_server_cert"] = ota_server_cert;
|
||||
|
||||
File configFile = SPIFFS.open("/config.json", "w");
|
||||
if (!configFile) {
|
||||
@@ -1099,6 +1101,8 @@ void setup_wifimanager(bool reset_settings) {
|
||||
mqtt_ss_index = json.get<uint8_t>("mqtt_ss_index");
|
||||
if (json.containsKey("gateway_name"))
|
||||
strcpy(gateway_name, json["gateway_name"]);
|
||||
if (json.containsKey("ota_server_cert"))
|
||||
ota_server_cert = json.get<const char*>("ota_server_cert");
|
||||
} else {
|
||||
Log.warning(F("failed to load json config" CR));
|
||||
}
|
||||
@@ -1772,6 +1776,17 @@ void MQTTHttpsFWUpdate(char* topicOri, JsonObject& HttpsFwUpdateData) {
|
||||
stopProcessing();
|
||||
# endif
|
||||
|
||||
const char* ota_cert = HttpsFwUpdateData["server_cert"];
|
||||
if (!ota_cert) {
|
||||
if (ota_server_cert.length() > 0) {
|
||||
Log.error(F("using stored cert" CR));
|
||||
ota_cert = ota_server_cert.c_str();
|
||||
} else {
|
||||
Log.error(F("using config cert" CR));
|
||||
ota_cert = OTAserver_cert;
|
||||
}
|
||||
}
|
||||
|
||||
t_httpUpdate_return result = HTTP_UPDATE_FAILED;
|
||||
if (strstr(url, "http:")) {
|
||||
WiFiClient update_client;
|
||||
@@ -1808,15 +1823,17 @@ void MQTTHttpsFWUpdate(char* topicOri, JsonObject& HttpsFwUpdateData) {
|
||||
}
|
||||
|
||||
# ifdef ESP32
|
||||
update_client.setCACert(OTAserver_cert);
|
||||
update_client.setCACert(ota_cert);
|
||||
update_client.setTimeout(12);
|
||||
httpUpdate.setFollowRedirects(HTTPC_STRICT_FOLLOW_REDIRECTS);
|
||||
httpUpdate.rebootOnUpdate(false);
|
||||
result = httpUpdate.update(update_client, url);
|
||||
# elif ESP8266
|
||||
caCert.append(OTAserver_cert);
|
||||
caCert.append(ota_cert);
|
||||
update_client.setTrustAnchors(&caCert);
|
||||
update_client.setTimeout(12000);
|
||||
ESPhttpUpdate.setFollowRedirects(HTTPC_STRICT_FOLLOW_REDIRECTS);
|
||||
ESPhttpUpdate.rebootOnUpdate(false);
|
||||
result = ESPhttpUpdate.update(update_client, url);
|
||||
# endif
|
||||
}
|
||||
@@ -1836,6 +1853,15 @@ void MQTTHttpsFWUpdate(char* topicOri, JsonObject& HttpsFwUpdateData) {
|
||||
|
||||
case HTTP_UPDATE_OK:
|
||||
Log.notice(F("HTTP_UPDATE_OK" CR));
|
||||
ota_server_cert = ota_cert;
|
||||
# ifndef ESPWifiManualSetup
|
||||
saveMqttConfig();
|
||||
# endif
|
||||
# ifdef ESP32
|
||||
ESP.restart();
|
||||
# elif ESP8266
|
||||
ESP.reset();
|
||||
# endif
|
||||
break;
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user