[knx] support for KNX secure #8872

holgerfriedrich · 2020-10-26T16:15:06Z

[open] Support for KNX data secure packets shall be added to OpenHAB.
Reading and writing authenticated KNX packets should be possible.
[done] Support for KNX IP secure shall be added to OpenHAB.
Using an encrypted connection to a IP secure interface or an IP secure router shall be possible.

Calimero library seems to have all the necessary prerequisites at hand in latest version (2.5M1).
The process includes exporting an encrypted keyring from ETS software, decrypt it using the Calimero library functions in the OH knx binding, and use the corresponding group address keys from the keyring file.

Prerequesites

Calimero -> Java 11
Calimero -> Calimero version >=2.5M1

Suggested Approach

switch to Calimero 2.5 ([knx] update to most recent calimero version #6849)
add configuration items for keyring file and password ([knx] Allow decoding of KNX Data Secure frames #12434)
data secure: reading of keyring, and use decryption for packets with matching group addresses from the keyring (listening only) ([knx] Allow decoding of KNX Data Secure frames #12434)
data secure: allow write access
data secure: allow triggered read
IP secure: support secure tunneling ([knx] Add support for KNX IP Secure #12709)
IP secure: support secure routing (implemented, untested) ([knx] Add support for KNX IP Secure #12709)

holgerfriedrich · 2020-10-26T16:16:44Z

I have already been playing around with this and willing to implement. If anyone is already working on this topic or wants to give some advice, it would be appreciated.

* use Calimero library in latest version 2.5-SNAPSHOT (needs to be installed locally, mvn install) (to be replaced once a release is available) * add config options for keyring file(s) and password(s) * add tests for security functions Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

* use Calimero library in latest version 2.5-SNAPSHOT (needs to be installed locally, mvn install) (to be replaced once a release is available) * add config options for keyring file(s) and password(s) * add tests for security functions * TODO replace ProcessCommunicationResponder, SAL required modification of Calimero lib Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

J-N-K · 2020-11-12T14:55:22Z

If there is no immediate need (i.e. bugs or security issues), we usually don't use snapshots of dependencies. Do you happen to know when Calimero 2.5 will be released? And thanks for the offer to implement that.

holgerfriedrich · 2020-11-12T18:28:07Z

@J-N-K thanks for letting me know. My PR is still WIP and far from finished. Decrypting secure PDUs using the exported keyring from ETS works fine with the Calimero snapshot.
The more complicated thing is to setup a secure device needed for transmitting secure messages from openhab to other devices on the bus. I was not able to get this implemented properly yet.
Once it is running, I will contact the author.

J-N-K · 2020-11-12T18:38:49Z

If you need help regarding the openHAB side, please ping me.

* use Calimero library in latest version 2.5-SNAPSHOT (needs to be installed locally, mvn install) (to be replaced once a release is available) * add config options for keyring file(s) and password(s) * add tests for security functions * TODO replace ProcessCommunicationResponder, SAL required modification of Calimero lib Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

* use Calimero library in latest version 2.5-M1 (to be replaced once release 2.5 is available) * add config options for keyring file(s) and password(s) * add tests for security functions * TODO replace ProcessCommunicationResponder Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

scholzi100 · 2021-03-30T16:14:44Z

Looks like Calimero got a milestone release ready. Following a release candidate some what soon. (Ref)

openhab-bot · 2021-04-06T16:54:10Z

This issue has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/enable-knx-binding-to-use-knx-ip-secure/13785/4

* use Calimero library in latest version 2.5-M1 (to be replaced once release 2.5 is available) * add config options for keyring file(s) and password(s) * add tests for security functions * TODO replace ProcessCommunicationResponder * build for OH 302 and 31x Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

* add config options for keyring file(s) and password(s) * add initial support for reading secure traffic * add tests for security functions Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

* use Calimero library in latest version 2.5-M1 (to be replaced once release 2.5 is available) * add config options for keyring file(s) and password(s) * add tests for security functions * TODO replace ProcessCommunicationResponder * build for OH 302 and 31x Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

* add support for KNX IP Secure, new options SECURETUNNEL and SECUREROUTER * add config options for keyring file and password, and credentials for secure connections * add passive (listening only) access for KNX data secure frames * add tests for security functions * add useCEMI option for newer serial devices like KNX RF sticks, kBerry, etc. * update user documentation Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

holgerfriedrich · 2022-02-16T21:21:02Z

I have put together a version which actually supports IP secure, i.e. secure tunneling (tested) and secure routing (untested).
Data secure is working only passive (i.e. it can decrypt any received message, but not send successfully).
Documentation can be found here:
https://github.com/holgerfriedrich/openhab-addons/tree/pr-knx-data-secure/bundles/org.openhab.binding.knx#knx-secure
Precompiled plugin for 3.2 and 3.3.x can be downloaded here:
https://github.com/holgerfriedrich/openhab-addons/actions?query=event%3Apush+branch%3Apr-knx-data-secure

I could need help testing this, especially the secure routing feature as I do not have a secure router at hand.
Event though the data secure write access seems to be still a way to go, I would try to get this merged, as the IP secure topic is a real benefit.

WDYT?

* add passive (listening only) access for KNX Data Secure frames, openhab#8872 * add config options for KNX keyring file and password * ease setup if IP Secure, as required parameters can be read from keyring * add tests for security functions * update user documentation Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

* [knx] Add support for KNX IP Secure * add support for KNX IP Secure, new options SECURETUNNEL and SECUREROUTER, refers to openhab#8872 * add config options for credentials for secure connections * update user documentation * add test cases Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

* add passive (listening only) access for KNX Data Secure frames, openhab#8872 * add config options for KNX keyring file and password * ease setup if IP Secure, as required parameters can be read from keyring * add tests for security functions * update user documentation Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

openhab-bot · 2023-05-28T06:33:29Z

This issue has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/ipsecure-router-knx-binding-online-until-i-enable-another-thing/146894/5

* add passive (listening only) access for KNX Data Secure frames, openhab#8872 * add config options for KNX keyring file and password * ease setup if IP Secure, as required parameters can be read from keyring * add tests for security functions * update user documentation Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

florian-h05 · 2024-11-10T21:05:36Z

@holgerfriedrich Do you think you can implement data secure write and triggered read for openHAB 5?

holgerfriedrich · 2024-11-10T21:18:49Z

Hopefully. I do not know what is going on. I had the feeling that it once worked at least partially - a long time ago. Could not make it work on my current setup.

I will need more time to dig into this. Specs are still not publicly available. Maybe I need to create a minimal example just with Calimero.

Could need some help :-)

florian-h05 · 2024-11-14T11:49:21Z

Thanks for the update — does Calimero itself support data secure write and triggered read?

Wrt to help: Unfortunately I have no data secure setup available for testing, but I could help with reviewing code.

holgerfriedrich added the enhancement An enhancement or new feature for an existing add-on label Oct 26, 2020

holgerfriedrich self-assigned this Mar 21, 2021

boellner mentioned this issue Dec 29, 2021

support of KNX secure iobroker-community-adapters/ioBroker.openknx#59

Closed

holgerfriedrich changed the title ~~[knx] support KNX data secure for OH3~~ [knx] support for KNX secure Feb 16, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[knx] support for KNX secure #8872

[knx] support for KNX secure #8872

holgerfriedrich commented Oct 26, 2020 •

edited by lewie

Loading

holgerfriedrich commented Oct 26, 2020

J-N-K commented Nov 12, 2020 •

edited

Loading

holgerfriedrich commented Nov 12, 2020

J-N-K commented Nov 12, 2020

scholzi100 commented Mar 30, 2021 •

edited

Loading

openhab-bot commented Apr 6, 2021

holgerfriedrich commented Feb 16, 2022

openhab-bot commented May 28, 2023

florian-h05 commented Nov 10, 2024

holgerfriedrich commented Nov 10, 2024

florian-h05 commented Nov 14, 2024

[knx] support for KNX secure #8872

[knx] support for KNX secure #8872

Comments

holgerfriedrich commented Oct 26, 2020 • edited by lewie Loading

Prerequesites

Suggested Approach

holgerfriedrich commented Oct 26, 2020

J-N-K commented Nov 12, 2020 • edited Loading

holgerfriedrich commented Nov 12, 2020

J-N-K commented Nov 12, 2020

scholzi100 commented Mar 30, 2021 • edited Loading

openhab-bot commented Apr 6, 2021

holgerfriedrich commented Feb 16, 2022

openhab-bot commented May 28, 2023

florian-h05 commented Nov 10, 2024

holgerfriedrich commented Nov 10, 2024

florian-h05 commented Nov 14, 2024

holgerfriedrich commented Oct 26, 2020 •

edited by lewie

Loading

J-N-K commented Nov 12, 2020 •

edited

Loading

scholzi100 commented Mar 30, 2021 •

edited

Loading