From 2dedabc52f92027ea3a9c01dc9d21fdf6c746507 Mon Sep 17 00:00:00 2001 From: h2zero <32826625+h2zero@users.noreply.github.com> Date: Thu, 29 Jul 2021 15:13:30 -0600 Subject: [PATCH] Add "server_cert" parameter to firmware_update command. (#1043) When updating from the MQTT command from a SSL enabled server this adds an option to provide the server SSL certificate with the command. This is useful if connecting to different servers or if the configured certificate has expired and requires updating to not lose the ability to update via OTA. The certificate provided will be saved to flash memory for use on subsequent restarts. --- docs/use/gateway.md | 35 +++++++++++++++++++++++++++++----- docs/use/ota_command_cert.zip | Bin 0 -> 1385 bytes main/User_config.h | 10 +++++++--- main/main.ino | 30 +++++++++++++++++++++++++++-- 4 files changed, 65 insertions(+), 10 deletions(-) create mode 100644 docs/use/ota_command_cert.zip diff --git a/docs/use/gateway.md b/docs/use/gateway.md index f08b15c..fb5807c 100644 --- a/docs/use/gateway.md +++ b/docs/use/gateway.md @@ -97,19 +97,44 @@ The gateway can be updated through an MQTT message by providing a JSON formatted To enable this functionality, `MQTT_HTTPS_FW_UPDATE` will need to be defined or the line that defines in in user_config.h will need to be uncommented. ::: tip -If using an unsecure MQTT broker it is **highly recommended** to disable the password checking by setting the macro `MQTT_HTTPS_FW_UPDATE_USE_PASSWORD` to 0 (default is 1 (enabled)), otherwise a clear text password may be sent over the network. +If using an unsecure MQTT broker it is **highly recommended** to disable the password checking by setting the macro `MQTT_HTTPS_FW_UPDATE_USE_PASSWORD` to 0 (default is 1 (enabled)), otherwise a clear text password may be sent over the network. + +The `server_cert` parameter is optional. If the update server has changed or certificate updated or not set in `user_config.h` then you can provide the certifiate here. ::: ### Example firmware update message: ``` -mosquitto_pub -t "home//commands/firmware_update" -m -'{ +mosquitto_pub -t "home//commands/firmware_update" -m '{ "version": "test", "password": "OTAPASSWORD", - "url": "https://github.com/1technophile/OpenMQTTGateway/releases/download/v0.9.6/esp32-m5stack-ble-firmware.bin" -}' + "url": "https://github.com/1technophile/OpenMQTTGateway/releases/download/v0.9.7/esp32dev-ble-firmware.bin", + "server_cert": "-----BEGIN CERTIFICATE----- +MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs +MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 +d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j +ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL +MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 +LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug +RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm ++9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW +PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM +xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB +Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3 +hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg +EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA +FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec +nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z +eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF +hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2 +Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe +vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep ++OkuE6N36B9K +-----END CERTIFICATE-----"}' ``` +A bash script is available [here](ota_command_cert.zip) to simplify the use of the `server_cert` parameter. + # State LED usage The gateway can support up to 3 LED to display its operating state: diff --git a/docs/use/ota_command_cert.zip b/docs/use/ota_command_cert.zip new file mode 100644 index 0000000000000000000000000000000000000000..64fb4c95c51dc95fceeb1920a84a0ebbb9dec375 GIT binary patch literal 1385 zcmZ{kdpOez9L9gcC~Fd8L`8dCJ1)5#qGgPJXH3g2m$~d&GuJH>xprJ8k{nd@Sgt)4 zI)z-C+d(}pL%FtC^>{K&XfD&1`_XyMpXYqv=lOn~=Y9YG;GHC;lmGxY0Bn?RyDlIN z2<=h;kSYxTiu*0?8Zm%Gi-;gnuLO|D^lOGu!Ab5P<%(?OllTVVTf;IRE6R>;Ho;(8 zr~4h0{MD!ubPs{Wj<^EHY{0b~WE)3WMg@r&*J+@U9ys)zq-C_|%QVAnG={cM_J%fH zLBxydirXU=S9W7WtHuew&C#C=#ewm+DKy?o>XXVi$2d^%thTc#B#Wvj5`dfJl2!-& z-NKm?vEbY`*R#u=iDFZhJC4v=SNwIztD=FW2t^n76PZ)+lIHe zJvg`b0pJ;I5$ih&hwCFNZbn}6jLhG8Hhny(+&9Bq^AwxVjxy}>XBC!kE_APn`6=a;(`xU(Me{{`QUVWrB>?DuL zm!_t53^+M_Y?R3{>`4fvbV*hkV`-5^nc*GDw$`%A8RjXCEqpWPD>EEs=iOOUZn~y& z*IFhELGl}v6;}q`D0k=yN$QU0!ggRaWsp&f?bdUlRIz^<=gEZhv1p?`|CLU627Yi_Qr386Sn5kG;EoI~%$GwA(azSIzwS3yl< zFn~_XwilwgIl=%)HT=H&N2fC@<9-6|(zgW2dJ_KRit# z=W;>4fmNE0kUDBD#Hf!4)fGl>q$qojL+NB9sbk6}dyEbaErvyf2~F!S^6V39O(Rjg z{GxbdPqp|AHN)8Cs!4-kFc{fsh&dQ%<9OHI9Vfab<1By37c_6DU zRr{JKQ+ry*rfcUCjip}Z;H9E2nowCuKa$;-=xrU6?d1&y-rB8E3Y) z_U1_PeY0DTzYxt7A9zwlY<9llWWG7|+}Budc3kY@&EP|>W!~Akrt6>4PsjY*KiMf1 z7dYG{CWc=QK?t+fH_(h&-t&S5?%_6Px*14*8c{N@=j*v)zq9o0kVkbEewK&U&(h5c z>8mN=D3|8ed;3GREGEvOSVuVD7Fiw09P0TVI4`RdV%_WUzy{MT&2|}yUp?KoeifW0 zIB??LBK$_&7(1YsABSyDnQG=*wyOF0iDhl=SZc4D@_hIs@~~DORxn;4%uY$sx-*30 zOI7uyV=@*@DT6A!+Bv_6)a!#B%M*sbvIns4-<`_`?OjuExM+;SWog!@bg{c@z-Uh6 zc&*mlR)a&S$EN8O@-$C)^8OzG!-i-pVOj?71d%uo{GacT`^NiuC;$2XX+PP2M+krb oROAyMpJ04|h&}IA{Uks!6{_wN?*!e~Cjdb9L*A!gU#I}^H(G0mHvj+t literal 0 HcmV?d00001 diff --git a/main/User_config.h b/main/User_config.h index b888d7d..275257c 100644 --- a/main/User_config.h +++ b/main/User_config.h @@ -121,9 +121,13 @@ const byte mac[] = {0xDE, 0xED, 0xBA, 0xFE, 0x54, 0x95}; //W5100 ethernet shield /*-------------DEFINE YOUR MQTT PARAMETERS BELOW----------------*/ //MQTT Parameters definition #if defined(ESP8266) || defined(ESP32) || defined(__AVR_ATmega2560__) || defined(__AVR_ATmega1280__) -# define parameters_size 30 -# define mqtt_topic_max_size 100 -# define mqtt_max_packet_size 1024 +# define parameters_size 30 +# define mqtt_topic_max_size 100 +# ifdef MQTT_HTTPS_FW_UPDATE +# define mqtt_max_packet_size 2048 +# else +# define mqtt_max_packet_size 1024 +# endif #else # define parameters_size 15 # define mqtt_topic_max_size 50 diff --git a/main/main.ino b/main/main.ino index 61b1ce1..e811bce 100644 --- a/main/main.ino +++ b/main/main.ino @@ -185,6 +185,7 @@ static void* eClient = nullptr; static bool mqtt_secure = (MQTT_SECURE_DEFAULT || MQTT_SECURE_SELF_SIGNED); static uint8_t mqtt_ss_index = MQTT_SECURE_SELF_SIGNED_INDEX_DEFAULT; static String mqtt_cert = ""; +static String ota_server_cert = ""; #endif #ifdef ESP32 @@ -1034,6 +1035,7 @@ void saveMqttConfig() { json["mqtt_broker_secure"] = mqtt_secure; json["mqtt_broker_cert"] = mqtt_cert; json["mqtt_ss_index"] = mqtt_ss_index; + json["ota_server_cert"] = ota_server_cert; File configFile = SPIFFS.open("/config.json", "w"); if (!configFile) { @@ -1099,6 +1101,8 @@ void setup_wifimanager(bool reset_settings) { mqtt_ss_index = json.get("mqtt_ss_index"); if (json.containsKey("gateway_name")) strcpy(gateway_name, json["gateway_name"]); + if (json.containsKey("ota_server_cert")) + ota_server_cert = json.get("ota_server_cert"); } else { Log.warning(F("failed to load json config" CR)); } @@ -1772,6 +1776,17 @@ void MQTTHttpsFWUpdate(char* topicOri, JsonObject& HttpsFwUpdateData) { stopProcessing(); # endif + const char* ota_cert = HttpsFwUpdateData["server_cert"]; + if (!ota_cert) { + if (ota_server_cert.length() > 0) { + Log.error(F("using stored cert" CR)); + ota_cert = ota_server_cert.c_str(); + } else { + Log.error(F("using config cert" CR)); + ota_cert = OTAserver_cert; + } + } + t_httpUpdate_return result = HTTP_UPDATE_FAILED; if (strstr(url, "http:")) { WiFiClient update_client; @@ -1808,15 +1823,17 @@ void MQTTHttpsFWUpdate(char* topicOri, JsonObject& HttpsFwUpdateData) { } # ifdef ESP32 - update_client.setCACert(OTAserver_cert); + update_client.setCACert(ota_cert); update_client.setTimeout(12); httpUpdate.setFollowRedirects(HTTPC_STRICT_FOLLOW_REDIRECTS); + httpUpdate.rebootOnUpdate(false); result = httpUpdate.update(update_client, url); # elif ESP8266 - caCert.append(OTAserver_cert); + caCert.append(ota_cert); update_client.setTrustAnchors(&caCert); update_client.setTimeout(12000); ESPhttpUpdate.setFollowRedirects(HTTPC_STRICT_FOLLOW_REDIRECTS); + ESPhttpUpdate.rebootOnUpdate(false); result = ESPhttpUpdate.update(update_client, url); # endif } @@ -1836,6 +1853,15 @@ void MQTTHttpsFWUpdate(char* topicOri, JsonObject& HttpsFwUpdateData) { case HTTP_UPDATE_OK: Log.notice(F("HTTP_UPDATE_OK" CR)); + ota_server_cert = ota_cert; +# ifndef ESPWifiManualSetup + saveMqttConfig(); +# endif +# ifdef ESP32 + ESP.restart(); +# elif ESP8266 + ESP.reset(); +# endif break; }