[knx] Allow decoding of KNX Data Secure frames #12434

holgerfriedrich · 2022-03-06T15:55:51Z

add passive (listening only) access for KNX Data Secure frames, [knx] support for KNX secure #8872
add config options for KNX keyring file and password
ease setup if IP Secure, as required parameters can be read from keyring
add tests for security functions
update user documentation

Signed-off-by: Holger Friedrich mail@holger-friedrich.de

holgerfriedrich · 2022-03-06T16:01:50Z

This PR brings support to KNX IP secure, and partial support for KNX data secure (listening only). See previous discussions in #8872.

What has been tested:

Secure tunneling, seems to work fine for a few days

What is to be tested by someone else:

Secure routing (don't have a secure router at hand)

holgerfriedrich · 2022-03-06T16:41:57Z

@kaikreuzer I followed your advise and have only included the passive support for data secure. Outgoing writes and poll requests for secure group adresses are dropped at lowest level.

Though, when I change a switch connected to a secure GA, the event log still shows the "Item ... predicted to become ..." (which of course will not happen as I drop the write). Is there a clean way to signal a failed write to the upper layer? Throwing an exception is probably too much, as it gets logged with a full stack trace.

J-N-K · 2022-03-07T16:54:39Z

bundles/org.openhab.binding.knx/src/main/resources/OH-INF/thing/serial.xml

+				<default>false</default>
+				<advanced>true</advanced>
+			</parameter>
+			<parameter name="keyringFile" type="text" groupName="knxsecure">


Wouldn't it make sense to add that directly to the JSON database (i.e. add the file content directly here instead of a filename).

@J-N-K thanks for looking into this. I am not sure. At least there are a few practical reasons to keep it as a separate file:

keyring files need to be replaced everytime you add devices or secure group adresses, this is much easier if you can copy it over using scp

Calimero Keyring expects an URI for a file location, and does not provide other constructors besides Keyring::load()

Keyring files contain a signature, which might be invalid if we use a copy-paste approach here....

openhab-bot · 2022-03-11T17:21:03Z

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/knx-secure-initial-implementation/134133/1

holgerfriedrich · 2022-04-12T06:43:05Z

@slueder
During the last days, I tried to factor out everything which was not related to the feature itself. Give me a few days until I have a "release candidate" to test.

Not sure about the problem with Keyring files you mentioned in #8872. I have added several keyrings to the tests in this PR, all working fine. Spaces may be a problem, the code uses trim() to strip whitespace (maybe I will remove that).
Overall, for the first merge it might be way to remove the whole keyring stuff and go for the password parameters. If we cannot find out why keyrings are not working for you, this will be the way. Though, for me the keyring is working fine and gives the additional benefit that openHAB can listen to and decode data secure GAs as well....

Which branch did you use for your testing?

slueder · 2022-04-14T04:51:00Z

@holgerfriedrich

I retested the keyring approach with the latest version of ETS (6.0.4) and reasonably strong keyring export passwords (8 characters, consisting of upper & lower letters, digits and a limited set of special chars :#,;) and it worked now.

I am using commit ID holgerfriedrich@c7114f5

Happy to re-test as soon as you let me know.

florian-h05 · 2024-08-18T21:28:47Z

Just FYI you program KNX using a program called ETS and the keyring required here is exported from the ETS, it’s the same keyring that allows the ETS full access to the KNX bus.

lsiepel · 2024-08-20T20:05:30Z

@holgerfriedrich did this PR get some test mileage on different installations ?

holgerfriedrich · 2024-08-20T22:15:58Z

@lsiepel unfortunately not yet, at least not after the rebase and latest modifications.

I typically deploy to RPI, and I am using Enertex IP interface (connected via IP, with IP secure), Weinzierl 730 (IP w/o IP secure), or Weinzierl kBerry (RPI hat, using serial connection).

Give me some time to double check that data secure (decoding incoming encrypted frames) still works as expected.....

bundles/org.openhab.binding.knx/README.md

bundles/org.openhab.binding.knx/src/main/resources/OH-INF/thing/ip.xml

lsiepel

Left two comments. LGTM, but ift would also be nice of @J-N-K and @florian-h05 to confirm.

florian-h05 · 2024-09-08T20:57:14Z

I am currently busy till beginning of October, but then should be able to review.

lsiepel

LGTM, let's wait for @florian-h05's review before merge.

* add passive (listening only) access for KNX Data Secure frames, openhab#8872 * add config options for KNX keyring file and password * ease setup if IP Secure, as required parameters can be read from keyring * add tests for security functions * update user documentation Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

holgerfriedrich · 2024-09-15T16:54:08Z

Accidentally pushed to this PR when working on a followup PR, rolled back, rebased to current main as a force push was anyway necessary.
Sorry for the noise.

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

florian-h05

Code LGTM, thanks! Just one minor comment:

I would have loved to give it a try, but I don't have KNX Data nor IP Secure devices.
I have of course tested it against my system - everything still works as expected.

...hab.binding.knx/src/main/java/org/openhab/binding/knx/internal/client/AbstractKNXClient.java

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

florian-h05 · 2024-09-15T19:31:38Z

@lsiepel You can merge now 🚀

* [knx] Allow decoding of KNX Data Secure frames Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

holgerfriedrich force-pushed the pr-knx-ip-secure branch 2 times, most recently from 2e2d5d3 to ca6de24 Compare March 6, 2022 16:33

holgerfriedrich requested review from kaikreuzer and J-N-K March 6, 2022 16:43

holgerfriedrich added the help wanted label Mar 6, 2022

wborn added the enhancement An enhancement or new feature for an existing add-on label Mar 6, 2022

J-N-K reviewed Mar 7, 2022

View reviewed changes

holgerfriedrich force-pushed the pr-knx-ip-secure branch from ca6de24 to c5180cc Compare March 9, 2022 00:13

wborn added the work in progress A PR that is not yet ready to be merged label Mar 9, 2022

holgerfriedrich mentioned this pull request Mar 11, 2022

[knx] support for KNX secure #8872

Open

7 tasks

holgerfriedrich force-pushed the pr-knx-ip-secure branch from c5180cc to 7f52886 Compare March 11, 2022 16:38

holgerfriedrich changed the title ~~[knx] add initial support for KNX secure [WIP]~~ [knx] add initial support for KNX secure Mar 11, 2022

holgerfriedrich force-pushed the pr-knx-ip-secure branch 2 times, most recently from 2553802 to 021cd88 Compare March 14, 2022 23:40

This was referenced Mar 25, 2022

[knx] Reduce compiler warnings #12518

Merged

[knx] Handle exceptions during initial read #12520

Merged

holgerfriedrich force-pushed the pr-knx-ip-secure branch from 021cd88 to c7114f5 Compare March 27, 2022 12:19

holgerfriedrich force-pushed the pr-knx-ip-secure branch 7 times, most recently from 84bc872 to 14daa8d Compare April 9, 2022 19:42

holgerfriedrich force-pushed the pr-knx-ip-secure branch from 14daa8d to 53c5f37 Compare April 16, 2022 19:05

holgerfriedrich force-pushed the pr-knx-ip-secure branch from c2f7d0f to 48488cd Compare August 20, 2024 19:34

lsiepel reviewed Sep 8, 2024

View reviewed changes

bundles/org.openhab.binding.knx/README.md Outdated Show resolved Hide resolved

lsiepel reviewed Sep 8, 2024

View reviewed changes

bundles/org.openhab.binding.knx/src/main/resources/OH-INF/thing/ip.xml Outdated Show resolved Hide resolved

lsiepel reviewed Sep 8, 2024

View reviewed changes

lsiepel reviewed Sep 9, 2024

View reviewed changes

holgerfriedrich added 2 commits September 15, 2024 18:38

review comments

7a937ac

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

holgerfriedrich force-pushed the pr-knx-ip-secure branch from b705bc7 to 7a937ac Compare September 15, 2024 16:39

holgerfriedrich added rebuild Triggers Jenkins PR build and removed rebuild Triggers Jenkins PR build labels Sep 15, 2024

holgerfriedrich mentioned this pull request Sep 15, 2024

[knx] Code rework #17420

Merged

lsiepel approved these changes Sep 15, 2024

View reviewed changes

Fix serial.xml, parameter groups cannot be tagged as advanced

ba315e7

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

florian-h05 approved these changes Sep 15, 2024

View reviewed changes

...hab.binding.knx/src/main/java/org/openhab/binding/knx/internal/client/AbstractKNXClient.java Outdated Show resolved Hide resolved

Review

dfd8a65

Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

holgerfriedrich added rebuild Triggers Jenkins PR build and removed rebuild Triggers Jenkins PR build labels Sep 15, 2024

lsiepel merged commit dbc607a into openhab:main Sep 15, 2024
5 checks passed

lsiepel added this to the 4.3 milestone Sep 15, 2024

holgerfriedrich deleted the pr-knx-ip-secure branch September 15, 2024 20:00

holgerfriedrich restored the pr-knx-ip-secure branch September 15, 2024 20:00

digitaldan pushed a commit to digitaldan/openhab-addons that referenced this pull request Sep 24, 2024

[knx] Allow decoding of KNX Data Secure frames (openhab#12434)

4a42a47

* [knx] Allow decoding of KNX Data Secure frames Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

joni1993 pushed a commit to joni1993/openhab-addons that referenced this pull request Oct 15, 2024

[knx] Allow decoding of KNX Data Secure frames (openhab#12434)

1a5ace9

* [knx] Allow decoding of KNX Data Secure frames Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

matchews pushed a commit to matchews/openhab-addons that referenced this pull request Oct 18, 2024

[knx] Allow decoding of KNX Data Secure frames (openhab#12434)

3ed97a8

* [knx] Allow decoding of KNX Data Secure frames Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[knx] Allow decoding of KNX Data Secure frames #12434

[knx] Allow decoding of KNX Data Secure frames #12434

holgerfriedrich commented Mar 6, 2022 •

edited

Loading

holgerfriedrich commented Mar 6, 2022 •

edited

Loading

holgerfriedrich commented Mar 6, 2022

J-N-K Mar 7, 2022

holgerfriedrich Mar 7, 2022 •

edited

Loading

openhab-bot commented Mar 11, 2022

holgerfriedrich commented Apr 12, 2022 •

edited

Loading

slueder commented Apr 14, 2022

florian-h05 commented Aug 18, 2024

lsiepel commented Aug 20, 2024

holgerfriedrich commented Aug 20, 2024

lsiepel left a comment

florian-h05 commented Sep 8, 2024

lsiepel left a comment

holgerfriedrich commented Sep 15, 2024

florian-h05 left a comment •

edited

Loading

florian-h05 commented Sep 15, 2024

[knx] Allow decoding of KNX Data Secure frames #12434

[knx] Allow decoding of KNX Data Secure frames #12434

Conversation

holgerfriedrich commented Mar 6, 2022 • edited Loading

holgerfriedrich commented Mar 6, 2022 • edited Loading

holgerfriedrich commented Mar 6, 2022

J-N-K Mar 7, 2022

Choose a reason for hiding this comment

holgerfriedrich Mar 7, 2022 • edited Loading

Choose a reason for hiding this comment

openhab-bot commented Mar 11, 2022

holgerfriedrich commented Apr 12, 2022 • edited Loading

slueder commented Apr 14, 2022

florian-h05 commented Aug 18, 2024

lsiepel commented Aug 20, 2024

holgerfriedrich commented Aug 20, 2024

lsiepel left a comment

Choose a reason for hiding this comment

florian-h05 commented Sep 8, 2024

lsiepel left a comment

Choose a reason for hiding this comment

holgerfriedrich commented Sep 15, 2024

florian-h05 left a comment • edited Loading

Choose a reason for hiding this comment

florian-h05 commented Sep 15, 2024

holgerfriedrich commented Mar 6, 2022 •

edited

Loading

holgerfriedrich commented Mar 6, 2022 •

edited

Loading

holgerfriedrich Mar 7, 2022 •

edited

Loading

holgerfriedrich commented Apr 12, 2022 •

edited

Loading

florian-h05 left a comment •

edited

Loading