diff --git a/docs/use/gateway.md b/docs/use/gateway.md index f08b15c..fb5807c 100644 --- a/docs/use/gateway.md +++ b/docs/use/gateway.md @@ -97,19 +97,44 @@ The gateway can be updated through an MQTT message by providing a JSON formatted To enable this functionality, `MQTT_HTTPS_FW_UPDATE` will need to be defined or the line that defines in in user_config.h will need to be uncommented. ::: tip -If using an unsecure MQTT broker it is **highly recommended** to disable the password checking by setting the macro `MQTT_HTTPS_FW_UPDATE_USE_PASSWORD` to 0 (default is 1 (enabled)), otherwise a clear text password may be sent over the network. +If using an unsecure MQTT broker it is **highly recommended** to disable the password checking by setting the macro `MQTT_HTTPS_FW_UPDATE_USE_PASSWORD` to 0 (default is 1 (enabled)), otherwise a clear text password may be sent over the network. + +The `server_cert` parameter is optional. If the update server has changed or certificate updated or not set in `user_config.h` then you can provide the certifiate here. ::: ### Example firmware update message: ``` -mosquitto_pub -t "home//commands/firmware_update" -m -'{ +mosquitto_pub -t "home//commands/firmware_update" -m '{ "version": "test", "password": "OTAPASSWORD", - "url": "https://github.com/1technophile/OpenMQTTGateway/releases/download/v0.9.6/esp32-m5stack-ble-firmware.bin" -}' + "url": "https://github.com/1technophile/OpenMQTTGateway/releases/download/v0.9.7/esp32dev-ble-firmware.bin", + "server_cert": "-----BEGIN CERTIFICATE----- +MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j +ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL +MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 +LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug +RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm ++9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW +PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM +xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB +Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3 +hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg +EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA +FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec +nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z +eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF +hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2 +Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe +vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep ++OkuE6N36B9K +-----END CERTIFICATE-----"}' ``` +A bash script is available [here](ota_command_cert.zip) to simplify the use of the `server_cert` parameter. + # State LED usage The gateway can support up to 3 LED to display its operating state: diff --git a/docs/use/ota_command_cert.zip b/docs/use/ota_command_cert.zip new file mode 100644 index 0000000..64fb4c9 Binary files /dev/null and b/docs/use/ota_command_cert.zip differ diff --git a/main/User_config.h b/main/User_config.h index b888d7d..275257c 100644 --- a/main/User_config.h +++ b/main/User_config.h @@ -121,9 +121,13 @@ const byte mac[] = {0xDE, 0xED, 0xBA, 0xFE, 0x54, 0x95}; //W5100 ethernet shield /*-------------DEFINE YOUR MQTT PARAMETERS BELOW----------------*/ //MQTT Parameters definition #if defined(ESP8266) || defined(ESP32) || defined(__AVR_ATmega2560__) || defined(__AVR_ATmega1280__) -# define parameters_size 30 -# define mqtt_topic_max_size 100 -# define mqtt_max_packet_size 1024 +# define parameters_size 30 +# define mqtt_topic_max_size 100 +# ifdef MQTT_HTTPS_FW_UPDATE +# define mqtt_max_packet_size 2048 +# else +# define mqtt_max_packet_size 1024 +# endif #else # define parameters_size 15 # define mqtt_topic_max_size 50 diff --git a/main/main.ino b/main/main.ino index 61b1ce1..e811bce 100644 --- a/main/main.ino +++ b/main/main.ino @@ -185,6 +185,7 @@ static void* eClient = nullptr; static bool mqtt_secure = (MQTT_SECURE_DEFAULT || MQTT_SECURE_SELF_SIGNED); static uint8_t mqtt_ss_index = MQTT_SECURE_SELF_SIGNED_INDEX_DEFAULT; static String mqtt_cert = ""; +static String ota_server_cert = ""; #endif #ifdef ESP32 @@ -1034,6 +1035,7 @@ void saveMqttConfig() { json["mqtt_broker_secure"] = mqtt_secure; json["mqtt_broker_cert"] = mqtt_cert; json["mqtt_ss_index"] = mqtt_ss_index; + json["ota_server_cert"] = ota_server_cert; File configFile = SPIFFS.open("/config.json", "w"); if (!configFile) { @@ -1099,6 +1101,8 @@ void setup_wifimanager(bool reset_settings) { mqtt_ss_index = json.get("mqtt_ss_index"); if (json.containsKey("gateway_name")) strcpy(gateway_name, json["gateway_name"]); + if (json.containsKey("ota_server_cert")) + ota_server_cert = json.get("ota_server_cert"); } else { Log.warning(F("failed to load json config" CR)); } @@ -1772,6 +1776,17 @@ void MQTTHttpsFWUpdate(char* topicOri, JsonObject& HttpsFwUpdateData) { stopProcessing(); # endif + const char* ota_cert = HttpsFwUpdateData["server_cert"]; + if (!ota_cert) { + if (ota_server_cert.length() > 0) { + Log.error(F("using stored cert" CR)); + ota_cert = ota_server_cert.c_str(); + } else { + Log.error(F("using config cert" CR)); + ota_cert = OTAserver_cert; + } + } + t_httpUpdate_return result = HTTP_UPDATE_FAILED; if (strstr(url, "http:")) { WiFiClient update_client; @@ -1808,15 +1823,17 @@ void MQTTHttpsFWUpdate(char* topicOri, JsonObject& HttpsFwUpdateData) { } # ifdef ESP32 - update_client.setCACert(OTAserver_cert); + update_client.setCACert(ota_cert); update_client.setTimeout(12); httpUpdate.setFollowRedirects(HTTPC_STRICT_FOLLOW_REDIRECTS); + httpUpdate.rebootOnUpdate(false); result = httpUpdate.update(update_client, url); # elif ESP8266 - caCert.append(OTAserver_cert); + caCert.append(ota_cert); update_client.setTrustAnchors(&caCert); update_client.setTimeout(12000); ESPhttpUpdate.setFollowRedirects(HTTPC_STRICT_FOLLOW_REDIRECTS); + ESPhttpUpdate.rebootOnUpdate(false); result = ESPhttpUpdate.update(update_client, url); # endif } @@ -1836,6 +1853,15 @@ void MQTTHttpsFWUpdate(char* topicOri, JsonObject& HttpsFwUpdateData) { case HTTP_UPDATE_OK: Log.notice(F("HTTP_UPDATE_OK" CR)); + ota_server_cert = ota_cert; +# ifndef ESPWifiManualSetup + saveMqttConfig(); +# endif +# ifdef ESP32 + ESP.restart(); +# elif ESP8266 + ESP.reset(); +# endif break; }