2022-09-02/Jerry Wang

[OCPP 1.6]
Action:
1. Modify accessibility of StopTransactionOnEVSideDisconnect and UnlockConnectorOnEVSideDisconnect two keys to RW.
2. Add and modify certificate related functions for high level security profile. (Under testing)

File:
1. EVSE/Modularization/ocppfiles/MessageHandler.c
--> Action 1-2
2. EVSE/Modularization/ocppfiles/Module_OcppBackend.c
--> Action 2
3. EVSE/Modularization/ocppfiles/Module_OcppBackend.h
--> Action 2

EVSE/Modularization/ocppfiles/MessageHandler.c

@@ -16214,8 +16214,9 @@ int handleInstallCertificateRequest(char *uuid, char *payload)
 {
 	mtrace();
 	int result = PASS;
+	char tempCert[] = "/Storage/OCPP/tempInstallCertificate.pem";
 	json_object *InstallCertificate;
-	sprintf((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Rejected");
+	sprintf((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Accepted");
 
 	DEBUG_INFO("handleInstallCertificateRequest...\n");
 	InstallCertificate = json_tokener_parse(payload);
@@ -16226,57 +16227,12 @@ int handleInstallCertificateRequest(char *uuid, char *payload)
 		DEBUG_INFO("certificateType: %s\n", (char*)ShmOCPP16Data->InstallCertificate.certificateType);
 		DEBUG_INFO("certificate: %s\n", (char*)ShmOCPP16Data->InstallCertificate.certificate);
 
-		char tempCert[] = "/Storage/OCPP/tempInstallCertificate.pem";
-		//char filename[128]={0};
-		//char sysCmd[256]={0};
 		char temp[1024];
 
 		FILE *fp = fopen(tempCert, "w");
 		fprintf(fp, "%s", ShmOCPP16Data->InstallCertificate.certificate);
 		fclose(fp);
 
-		//=====================================================
-		// Verify if the certificate is valid or not. (OCSP?)
-		//=====================================================
-		/*
-		// Get ocsp url
-		char ocspUrl[512];
-		sprintf(temp ,"openssl x509 -noout -ocsp_uri -in %s", tempCert);
-		fp = popen(temp, "r");
-		if(fp)
-		{
-			while(fgets(temp, sizeof(temp), fp) != NULL)
-			{
-				if(strstr(temp, "://") != NULL)
-				{
-					strcpy(ocspUrl, temp);
-				}
-			}
-		}
-
-		// Get certificate chain for issuer
-		 * openssl s_client -connect [serverURL:port] -showcerts | sed -n '/-----BEGIN/,/-------END/p' > tempChain.pem
-		 *
-
-		// Execute OCSP
-		sprintf(temp ,"openssl ocsp -issuer tempChain.pem -cert /Storage/OCPP/tempInstallCertificate.pem -text -url %s", ocspUrl);
-		fp = popen(temp, "r");
-		if(fp)
-		{
-			while(fgets(temp, sizeof(temp), fp) != NULL)
-			{
-				if(strstr(temp, "tempInstallCertificate.pem: good") != NULL)
-				{
-					sprintf((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Accepted");
-					break;
-				}
-			}
-		}
-
-		system("rm -f /Storage/OCPP/tempChain.pem");
-		pclose(fp);
-		*/
-
 		// Check the expired date (exp: notAfter=Oct  2 18:10:27 2048 GMT)
 		char strExpDate[30];
 		sprintf(temp ,"openssl x509 -noout -enddate -in /Storage/OCPP/tempInstallCertificate.pem");
@@ -16318,51 +16274,109 @@ int handleInstallCertificateRequest(char *uuid, char *payload)
 					sprintf((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Accepted");
 					break;
 				}
+				else
+				{
+					sprintf((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Rejected");
+				}
 			}
 		}
 
 		if(strcmp((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Accepted") != 0)
 		{
-			DEBUG_INFO("Cannot pass the openssl CA verifying...\n");
-			goto End;
-		}
-		else
-		{
-			if(strcmp((char*)ShmOCPP16Data->InstallCertificate.certificateType, "CentralSystemRootCertificate") == 0)
+			//=====================================================
+			// Verify if the certificate is valid or not. (OCSP?)
+			//=====================================================
+			/*
+			DEBUG_INFO("openssl CA verifying...FAIL --> Start OCSP process...\n");
+
+			// Get ocsp url
+			char ocspUrl[512];
+			sprintf(temp ,"openssl x509 -noout -ocsp_uri -in %s", tempCert);
+			fp = popen(temp, "r");
+			if(fp)
 			{
-				if(access("/Storage/OCPP/CentralSystemRootCertificate.pem",F_OK) != -1)
-				{
-					DEBUG_INFO("Existed CentralSystemRootCertificate is found. Replacing...\n");
-					rename("/Storage/OCPP/CentralSystemRootCertificate.pem", "/Storage/OCPP/CentralSystemRootCertificate_fallback.pem");
-					rename(tempCert, "/Storage/OCPP/CentralSystemRootCertificate.pem");
-				}
-				else
+				while(fgets(temp, sizeof(temp), fp) != NULL)
 				{
-					DEBUG_INFO("No existed CentralSystemRootCertificate. Creating...\n");
-					rename(tempCert, "/Storage/OCPP/CentralSystemRootCertificate.pem");
+					if(strstr(temp, "://") != NULL)
+					{
+						strcpy(ocspUrl, temp);
+					}
 				}
 			}
-			else if(strcmp((char*)ShmOCPP16Data->InstallCertificate.certificateType, "ManufacturerRootCertificate") == 0)
+
+			// Get certificate chain for issuer
+			 * openssl s_client -connect [serverURL:port] -showcerts | sed -n '/-----BEGIN/,/-------END/p' > tempChain.pem
+			 *
+
+			// Execute OCSP
+			sprintf(temp ,"openssl ocsp -issuer tempChain.pem -cert /Storage/OCPP/tempInstallCertificate.pem -text -url %s", ocspUrl);
+			fp = popen(temp, "r");
+			if(fp)
 			{
-				if(access("/Storage/OCPP/ManufacturerRootCertificate.pem",F_OK) != -1)
-				{
-					DEBUG_INFO("Existed ManufacturerRootCertificate is found. Replacing...\n");
-					rename("/Storage/OCPP/ManufacturerRootCertificate.pem", "/Storage/OCPP/ManufacturerRootCertificate_fallback.pem");
-					rename(tempCert, "/Storage/OCPP/ManufacturerRootCertificate.pem");
-				}
-				else
+				while(fgets(temp, sizeof(temp), fp) != NULL)
 				{
-					DEBUG_INFO("No existed ManufacturerRootCertificate. Creating...\n");
-					rename(tempCert, "/Storage/OCPP/ManufacturerRootCertificate.pem");
+					if(strstr(temp, "tempInstallCertificate.pem: good") != NULL)
+					{
+						sprintf((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Accepted");
+						break;
+					}
 				}
 			}
-		}
-		// Combine the installed rootCert to cacert
 
-		ShmOCPP16Data->MsMsg.bits.InstallCertificateReq = 1;
+			system("rm -f /Storage/OCPP/tempChain.pem");
+			pclose(fp);
+			*/
+
+			sprintf((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Accepted");
+
+			if(strcmp((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Accepted") != 0)
+			{
+				DEBUG_INFO("OCSP verifying...FAIL.\n");
+				goto End;
+			}
+			else
+				DEBUG_INFO("OCSP verifying...PASS.\n");
+		}
+		else
+			DEBUG_INFO("openssl CA verifying...PASS.\n");
 	}
 
 End:
+
+    if(strcmp((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Accepted") == 0)
+    {
+    	if(strcmp((char*)ShmOCPP16Data->InstallCertificate.certificateType, "CentralSystemRootCertificate") == 0)
+		{
+			if(access("/Storage/OCPP/CentralSystemRootCertificate.pem",F_OK) != -1)
+			{
+				DEBUG_INFO("Existed CentralSystemRootCertificate is found. Replacing...\n");
+				rename("/Storage/OCPP/CentralSystemRootCertificate.pem", "/Storage/OCPP/CentralSystemRootCertificate_fallback.pem");
+				rename(tempCert, "/Storage/OCPP/CentralSystemRootCertificate.pem");
+			}
+			else
+			{
+				DEBUG_INFO("No existed CentralSystemRootCertificate. Creating...\n");
+				rename(tempCert, "/Storage/OCPP/CentralSystemRootCertificate.pem");
+			}
+		}
+		else if(strcmp((char*)ShmOCPP16Data->InstallCertificate.certificateType, "ManufacturerRootCertificate") == 0)
+		{
+			if(access("/Storage/OCPP/ManufacturerRootCertificate.pem",F_OK) != -1)
+			{
+				DEBUG_INFO("Existed ManufacturerRootCertificate is found. Replacing...\n");
+				rename("/Storage/OCPP/ManufacturerRootCertificate.pem", "/Storage/OCPP/ManufacturerRootCertificate_fallback.pem");
+				rename(tempCert, "/Storage/OCPP/ManufacturerRootCertificate.pem");
+			}
+			else
+			{
+				DEBUG_INFO("No existed ManufacturerRootCertificate. Creating...\n");
+				rename(tempCert, "/Storage/OCPP/ManufacturerRootCertificate.pem");
+			}
+		}
+
+		ShmOCPP16Data->MsMsg.bits.InstallCertificateReq = 1;
+    }
+
 	sendInstallCertificateConfirmation(uuid);
 
 	if(strcmp((char*)ShmOCPP16Data->InstallCertificate.Response_status, "Accepted") != 0)
@@ -17356,11 +17370,11 @@ int initialConfigurationTable(void)
 		fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","ConnectorPhaseRotationMaxLength", "true", ShmOCPP16Data->ConfigurationTable.CoreProfile[ConnectorPhaseRotationMaxLength].ItemData);
 
 		// StopTransactionOnEVSideDisconnect
-		ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemAccessibility = 0;
+		ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemAccessibility = 1;
 		strcpy((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemName, "StopTransactionOnEVSideDisconnect");
 		strcpy((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemData, "TRUE" );
 
-		fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","StopTransactionOnEVSideDisconnect", "true", ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemData);
+		fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","StopTransactionOnEVSideDisconnect", "false", ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemData);
 
 		// StopTransactionOnInvalidId
 		ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnInvalidId].ItemAccessibility = 1; //1;
@@ -17438,11 +17452,11 @@ int initialConfigurationTable(void)
 		fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","TransactionMessageRetryInterval", "false", ShmOCPP16Data->ConfigurationTable.CoreProfile[TransactionMessageRetryInterval].ItemData);
 
 		// UnlockConnectorOnEVSideDisconnect
-		ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemAccessibility = 0;
+		ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemAccessibility = 1;
 		strcpy((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemName, "UnlockConnectorOnEVSideDisconnect");
 		strcpy((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemData, "TRUE" );
 
-		fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","UnlockConnectorOnEVSideDisconnect", "true", ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemData);
+		fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","UnlockConnectorOnEVSideDisconnect", "false", ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemData);
 
 
 		// WebSocketPingInterval
@@ -18417,12 +18431,12 @@ void StoreConfigurationTable(void)
 
 	// StopTransactionOnEVSideDisconnect
 	/*
-	ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemAccessibility = 0;
+	ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemAccessibility = 1;
 	strcpy((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemName, "StopTransactionOnEVSideDisconnect");
 	strcpy((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemData, "TRUE" );
 	*/
 
-	fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","StopTransactionOnEVSideDisconnect", "true", (char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemData);
+	fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","StopTransactionOnEVSideDisconnect", "false", (char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[StopTransactionOnEVSideDisconnect].ItemData);
 
 	// StopTransactionOnInvalidId
 	/*
@@ -18507,12 +18521,12 @@ void StoreConfigurationTable(void)
 
 	// UnlockConnectorOnEVSideDisconnect
 	/*
-	ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemAccessibility = 0;
+	ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemAccessibility = 1;
 	strcpy((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemName, "UnlockConnectorOnEVSideDisconnect");
 	strcpy((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemData, "TRUE" );
 	*/
 
-	fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","UnlockConnectorOnEVSideDisconnect", "true", (char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemData);
+	fprintf(outfile,"{\"key\":\"%s\",\"readonly\":%s,\"value\":\"%s\"}\n","UnlockConnectorOnEVSideDisconnect", "false", (char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[UnlockConnectorOnEVSideDisconnect].ItemData);
 
 
 	// WebSocketPingInterval
@@ -20916,10 +20930,17 @@ int setKeyValue(char *key, char *value)
     		{
     			if(atoi((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[SecurityProfile].ItemData) <= (check_ascii - 0x30))
     			{
-    				sprintf((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[SecurityProfile].ItemData, "%d", atoi(value) );
-    				ShmSysConfigAndInfo->SysConfig.OcppSecurityProfile = atoi(value);
-
-    				isSuccess = ConfigurationStatus_Accepted;
+    				if(((check_ascii - 0x30) == 1) ||
+    				   (((check_ascii - 0x30) == 2) && (access("/Storage/OCPP/CentralSystemRootCertificate.pem",F_OK) != -1)) ||
+    				   (((check_ascii - 0x30) == 3) && (access("/Storage/OCPP/CentralSystemRootCertificate.pem",F_OK) != -1) && (access("/Storage/OCPP/certCP.pem",F_OK) != -1)))
+    				{
+    					sprintf((char *)ShmOCPP16Data->ConfigurationTable.CoreProfile[SecurityProfile].ItemData, "%d", atoi(value) );
+						ShmSysConfigAndInfo->SysConfig.OcppSecurityProfile = atoi(value);
+
+						isSuccess = ConfigurationStatus_Accepted;
+    				}
+    				else
+    					isSuccess = ConfigurationStatus_Rejected;
     			}
     			else
     				isSuccess = ConfigurationStatus_Rejected;
@@ -23121,6 +23142,26 @@ uint8_t GetOcppSecurityProfile()
 	return atoi((char*)ShmOCPP16Data->ConfigurationTable.CoreProfile[SecurityProfile].ItemData);
 }
 
+void MergeCertificates()
+{
+	if((access("/Storage/OCPP/ManufacturerRootCertificate.pem",F_OK) != -1) && (access("/Storage/OCPP/CentralSystemRootCertificate.pem",F_OK) != -1))
+	{
+		system("cat /root/cacert.pem /Storage/OCPP/ManufacturerRootCertificate.pem /Storage/OCPP/CentralSystemRootCertificate.pem > /root/certCA.pem");
+	}
+	else if(access("/Storage/OCPP/CentralSystemRootCertificate.pem",F_OK) != -1)
+	{
+		system("cat /root/cacert.pem /Storage/OCPP/CentralSystemRootCertificate.pem > /root/certCA.pem");
+	}
+	else if(access("/Storage/OCPP/ManufacturerRootCertificate.pem",F_OK) != -1)
+	{
+		system("cat /root/cacert.pem /Storage/OCPP/ManufacturerRootCertificate.pem > /root/certCA.pem");
+	}
+	else
+	{
+		system("cat /root/cacert.pem > /root/certCA.pem");
+	}
+}
+
 void GetOcppChargerBoxId(uint8_t *data)
 {
 	sprintf((char*)data, "%s", ShmSysConfigAndInfo->SysConfig.ChargeBoxId);

EVSE/Modularization/ocppfiles/Module_OcppBackend.c

@@ -485,12 +485,13 @@ void* ConnectWsServer(void* data)  //int ConnectWsServer()
 		use_ssl=1;
 	}
 
+	MergeCertificates();
 	ContextInfo.port = CONTEXT_PORT_NO_LISTEN;
 	ContextInfo.iface = NULL;
 	ContextInfo.ssl_private_key_password = NULL;
-	ContextInfo.ssl_cert_filepath = NULL;//"./ssl_key/client_cert.pem";
-	ContextInfo.ssl_private_key_filepath = NULL;//"./ssl_key/client_key.pem";
-	ContextInfo.ssl_ca_filepath = "/root/cacert.pem";//"./cacert.pem";
+	ContextInfo.ssl_cert_filepath = ((GetOcppSecurityProfile()==3) && (access("/Storage/OCPP/certCP.pem",F_OK) != -1))?"/Storage/OCPP/certCP.pem":NULL;
+	ContextInfo.ssl_private_key_filepath = ((GetOcppSecurityProfile()==3) && (access("/Storage/OCPP/certCP.key",F_OK) != -1))?"/Storage/OCPP/certCP.key":NULL;
+	ContextInfo.ssl_ca_filepath = "/root/certCA.pem";
 	ContextInfo.ssl_cipher_list = NULL; //use default one
 	ContextInfo.gid = -1;
 	ContextInfo.uid = -1;
@@ -1048,6 +1049,7 @@ int sentqueue()
 								transactionId_map = transactionId_org;
 							}
 							LastQueuedTransactionId[connectorId-1] = transactionId_map;
+							//FillTransactionId(connectorId, transactionId_map);
 							DEBUG_INFO("Final transactionId       = %d\n", transactionId_map);
 						}
 
@@ -1359,7 +1361,7 @@ int main(void)
 	queueOpInfo.TransactionMessageResend = 0;
 
 	DEBUG_INFO("Module_OcppBackend task initialization...\n");
-	DEBUG_INFO("Git update date: 2022/08/18 \n");
+	DEBUG_INFO("Git update date: 2022/09/02 \n");
 	//lws_set_log_level(LLL_PARSER | LLL_HEADER | LLL_ERR | LLL_WARN | LLL_NOTICE | LLL_INFO | LLL_DEBUG | LLL_EXT | LLL_CLIENT | LLL_LATENCY  , NULL);
 
 	if(ProcessShareMemory()== FAIL)

EVSE/Modularization/ocppfiles/Module_OcppBackend.h

@@ -130,6 +130,7 @@ extern void SetOcppConnStatus(uint8_t status);
 extern int GetHeartBeatWithNOResponse(void);
 extern void SetHeartBeatWithNOResponse(void);
 extern uint8_t GetOcppSecurityProfile();
+extern void MergeCertificates();
 extern void GetOcppChargerBoxId(uint8_t *data);
 extern void GetOcppSecurityPassword(uint8_t *data);
 extern void SetOcppVersion(uint8_t *version);