Added OpenSSL server that supports TLS certificate status request

.github/CODEOWNERS

@@ -13,6 +13,7 @@
 /lib/staging/gpio/ @corneliusclaussen @hikinggrass @hikinggrass
 /lib/staging/ocpp/ @hikinggrass @pietfried @corneliusclaussen
 /lib/staging/slac/ @a-w50 @corneliusclaussen @SebaLukas
+/lib/staging/tls/ @james-ctc @AssemblyJohn @corneliusclaussen @SebaLukas
 
 # modules
 /modules/API/ @hikinggrass @pietfried @corneliusclaussen

config/CMakeLists.txt

@@ -3,6 +3,7 @@ generate_config_run_script(CONFIG sil-two-evse)
 generate_config_run_script(CONFIG sil-ocpp)
 generate_config_run_script(CONFIG sil-ocpp201)
 generate_config_run_script(CONFIG sil-dc)
+generate_config_run_script(CONFIG sil-dc-tls)
 generate_config_run_script(CONFIG sil-dc-sae-v2g)
 generate_config_run_script(CONFIG sil-dc-sae-v2h)
 generate_config_run_script(CONFIG sil-two-evse-dc)
@@ -25,7 +26,7 @@ install(
 install(
     DIRECTORY "certs"
     DESTINATION "${CMAKE_INSTALL_SYSCONFDIR}/everest"
-    FILES_MATCHING PATTERN "*.pem" PATTERN "*.key" PATTERN "*.der" PATTERN "*.txt" PATTERN "*.jks" PATTERN "*.p12" 
+    FILES_MATCHING PATTERN "*.pem" PATTERN "*.key" PATTERN "*.der" PATTERN "*.txt" PATTERN "*.jks" PATTERN "*.p12"
 )
 
 install(

config/config-sil-dc-tls.yaml

@@ -0,0 +1,147 @@
+active_modules:
+  iso15118_charger:
+    module: EvseV2G
+    config_module:
+      device: auto
+      tls_security: force
+    connections:
+      security:
+        - module_id: evse_security
+          implementation_id: main
+  iso15118_car:
+    module: PyEvJosev
+    config_module:
+      device: auto
+      supported_DIN70121: false
+      supported_ISO15118_2: true
+      tls_active: true
+      enforce_tls: true
+  evse_manager:
+    module: EvseManager
+    config_module:
+      connector_id: 1
+      country_code: DE
+      evse_id: DE*PNX*E12345*1
+      evse_id_din: 49A80737A45678
+      session_logging: true
+      session_logging_xml: false
+      session_logging_path: /tmp/everest-logs
+      charge_mode: DC
+      hack_allow_bpt_with_iso2: true
+      payment_enable_contract: false
+    connections:
+      bsp:
+        - module_id: yeti_driver
+          implementation_id: board_support
+      powermeter_car_side:
+        - module_id: powersupply_dc
+          implementation_id: powermeter
+      slac:
+        - module_id: slac
+          implementation_id: evse
+      hlc:
+        - module_id: iso15118_charger
+          implementation_id: charger
+      powersupply_DC:
+        - module_id: powersupply_dc
+          implementation_id: main
+      imd:
+        - module_id: imd
+          implementation_id: main
+  powersupply_dc:
+    module: DCSupplySimulator
+  yeti_driver:
+    module: JsYetiSimulator
+    config_module:
+      connector_id: 1
+  slac:
+    module: JsSlacSimulator
+  imd:
+    config_implementation:
+      main:
+        selftest_success: true
+    module: IMDSimulator
+  ev_manager:
+    module: EvManager
+    config_module:
+      connector_id: 1
+      auto_enable: true
+      auto_exec: false
+      auto_exec_commands: sleep 1;iec_wait_pwr_ready;sleep 1;draw_power_regulated 16,3;sleep 30;unplug
+      dc_target_current: 20
+      dc_target_voltage: 400
+    connections:
+      ev_board_support:
+        - module_id: yeti_driver
+          implementation_id: ev_board_support
+      ev:
+        - module_id: iso15118_car
+          implementation_id: ev
+      slac:
+        - module_id: slac
+          implementation_id: ev
+  auth:
+    module: Auth
+    config_module:
+      connection_timeout: 10
+      selection_algorithm: FindFirst
+    connections:
+      token_provider:
+        - module_id: token_provider
+          implementation_id: main
+      token_validator:
+        - module_id: token_validator
+          implementation_id: main
+      evse_manager:
+        - module_id: evse_manager
+          implementation_id: evse
+  token_provider:
+    module: DummyTokenProvider
+    config_implementation:
+      main:
+        token: TOKEN1
+    connections:
+      evse:
+        - module_id: evse_manager
+          implementation_id: evse
+  token_validator:
+    module: DummyTokenValidator
+    config_implementation:
+      main:
+        validation_result: Accepted
+        validation_reason: Token seems valid
+        sleep: 0.25
+  evse_security:
+    module: EvseSecurity
+    config_module:
+      private_key_password: "123456"
+  energy_manager:
+    module: EnergyManager
+    config_module:
+      schedule_total_duration: 1
+      schedule_interval_duration: 60
+      debug: false
+    connections:
+      energy_trunk:
+        - module_id: grid_connection_point
+          implementation_id: energy_grid
+  grid_connection_point:
+    module: EnergyNode
+    config_module:
+      fuse_limit_A: 40.0
+      phase_count: 3
+    connections:
+      price_information: []
+      energy_consumer:
+        - module_id: evse_manager
+          implementation_id: energy_grid
+      powermeter:
+        - module_id: yeti_driver
+          implementation_id: powermeter
+  api:
+    module: API
+    connections:
+      evse_manager:
+        - module_id: evse_manager
+          implementation_id: evse
+x-module-layout: {}

dependencies.yaml

@@ -54,7 +54,7 @@ libcurl:
 # and would otherwise be overwritten by the version used there
 libevse-security:
   git: https://github.com/EVerest/libevse-security.git
-  git_tag: v0.7.0
+  git_tag: b140c17b0a5eaf09b60035605ed8aeb84627eb78
   cmake_condition: "EVEREST_DEPENDENCY_ENABLED_LIBEVSE_SECURITY"
 
 # OCPP

lib/staging/CMakeLists.txt

@@ -1,5 +1,6 @@
 add_subdirectory(can_dpm1000)
 add_subdirectory(evse_security)
+add_subdirectory(tls)
 if(EVEREST_DEPENDENCY_ENABLED_LIBSLAC AND EVEREST_DEPENDENCY_ENABLED_LIBFSM)
     add_subdirectory(slac)
 endif()

lib/staging/tls/CMakeLists.txt

@@ -0,0 +1,29 @@
+add_library(tls STATIC)
+add_library(everest::tls ALIAS tls)
+
+find_package(OpenSSL 3)
+
+target_sources(tls
+    PRIVATE
+        openssl_conv.cpp
+        openssl_util.cpp
+        tls.cpp
+)
+
+target_include_directories(tls
+    PUBLIC
+    $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
+    $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../util>
+)
+
+target_link_libraries(tls
+    PUBLIC
+        OpenSSL::SSL
+        OpenSSL::Crypto
+        everest::evse_security
+        everest::framework
+)
+
+if(EVEREST_CORE_BUILD_TESTING)
+    add_subdirectory(tests)
+endif()

lib/staging/tls/openssl-3.0.8-feat-updates-to-support-status_request_v2.patch

@@ -0,0 +1,139 @@
+From 92125584f2fe87023cbfe96bba06358111ed8c13 Mon Sep 17 00:00:00 2001
+From: James Chapman <[email protected]>
+Date: Fri, 21 Jun 2024 10:29:44 +0100
+Subject: [PATCH 1/1] feat: updates to support status_request_v2
+
+Signed-off-by: James Chapman <[email protected]>
+---
+ include/openssl/ssl.h.in     | 2 ++
+ include/openssl/tls1.h       | 7 +++++++
+ ssl/s3_lib.c                 | 8 ++++++++
+ ssl/statem/extensions_clnt.c | 3 ++-
+ ssl/statem/extensions_srvr.c | 4 ++++
+ ssl/statem/statem_clnt.c     | 3 ++-
+ 6 files changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
+index 105b4a4a3c..b29f65fbfa 100644
+--- a/include/openssl/ssl.h.in
++++ b/include/openssl/ssl.h.in
+@@ -1251,6 +1251,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
+ # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS      69
+ # define SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP        70
+ # define SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP        71
++# define SSL_CTRL_GET_TLSEXT_STATUS_EXPECTED        270
++# define SSL_CTRL_SET_TLSEXT_STATUS_EXPECTED        271
+ # ifndef OPENSSL_NO_DEPRECATED_3_0
+ #  define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB      72
+ # endif
+diff --git a/include/openssl/tls1.h b/include/openssl/tls1.h
+index d6e9331fa1..f0a8413703 100644
+--- a/include/openssl/tls1.h
++++ b/include/openssl/tls1.h
+@@ -160,6 +160,7 @@ extern "C" {
+ # define TLSEXT_NAMETYPE_host_name 0
+ /* status request value from RFC3546 */
+ # define TLSEXT_STATUSTYPE_ocsp 1
++# define TLSEXT_STATUSTYPE_ocsp_multi 2
+
+ /* ECPointFormat values from RFC4492 */
+ # define TLSEXT_ECPOINTFORMAT_first                      0
+@@ -291,6 +292,12 @@ __owur int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
+ # define SSL_set_tlsext_status_ocsp_resp(ssl, arg, arglen) \
+         SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP,arglen,arg)
+
++# define SSL_get_tlsext_status_expected(ssl) \
++        SSL_ctrl(ssl,SSL_CTRL_GET_TLSEXT_STATUS_EXPECTED,0,NULL)
++
++# define SSL_set_tlsext_status_expected(ssl, arg) \
++        SSL_ctrl(ssl,SSL_CTRL_SET_TLSEXT_STATUS_EXPECTED,arg,NULL)
++
+ # define SSL_CTX_set_tlsext_servername_callback(ctx, cb) \
+         SSL_CTX_callback_ctrl(ctx,SSL_CTRL_SET_TLSEXT_SERVERNAME_CB,\
+                 (void (*)(void))cb)
+diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
+index 78d4f04056..ede3a56f2f 100644
+--- a/ssl/s3_lib.c
++++ b/ssl/s3_lib.c
+@@ -3556,6 +3556,14 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
+         ret = 1;
+         break;
+
++    case SSL_CTRL_GET_TLSEXT_STATUS_EXPECTED:
++        return (long)s->ext.status_expected;
++
++    case SSL_CTRL_SET_TLSEXT_STATUS_EXPECTED:
++        s->ext.status_expected = larg;
++        ret = 1;
++        break;
++
+     case SSL_CTRL_CHAIN:
+         if (larg)
+             return ssl_cert_set1_chain(s, NULL, (STACK_OF(X509) *)parg);
+diff --git a/ssl/statem/extensions_clnt.c b/ssl/statem/extensions_clnt.c
+index 842be0722b..b9d5493e72 100644
+--- a/ssl/statem/extensions_clnt.c
++++ b/ssl/statem/extensions_clnt.c
+@@ -8,6 +8,7 @@
+  */
+
+ #include <openssl/ocsp.h>
++#include <openssl/tls1.h>
+ #include "../ssl_local.h"
+ #include "internal/cryptlib.h"
+ #include "statem_local.h"
+@@ -1397,7 +1398,7 @@ int tls_parse_stoc_status_request(SSL *s, PACKET *pkt, unsigned int context,
+      * MUST only be sent if we've requested a status
+      * request message. In TLS <= 1.2 it must also be empty.
+      */
+-    if (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) {
++    if ((s->ext.status_type != TLSEXT_STATUSTYPE_ocsp) && (s->ext.status_type != TLSEXT_STATUSTYPE_ocsp_multi)) {
+         SSLfatal(s, SSL_AD_UNSUPPORTED_EXTENSION, SSL_R_BAD_EXTENSION);
+         return 0;
+     }
+diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c
+index 16765a5a5b..7fb67937bf 100644
+--- a/ssl/statem/extensions_srvr.c
++++ b/ssl/statem/extensions_srvr.c
+@@ -8,6 +8,7 @@
+  */
+
+ #include <openssl/ocsp.h>
++#include <openssl/tls1.h>
+ #include "../ssl_local.h"
+ #include "statem_local.h"
+ #include "internal/cryptlib.h"
+@@ -1421,6 +1422,9 @@ EXT_RETURN tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,
+     if (!s->ext.status_expected)
+         return EXT_RETURN_NOT_SENT;
+
++    if (s->ext.status_type == TLSEXT_STATUSTYPE_ocsp_multi)
++        return EXT_RETURN_NOT_SENT;
++
+     if (SSL_IS_TLS13(s) && chainidx != 0)
+         return EXT_RETURN_NOT_SENT;
+
+diff --git a/ssl/statem/statem_clnt.c b/ssl/statem/statem_clnt.c
+index 3cd1ee2d3d..29a07bd413 100644
+--- a/ssl/statem/statem_clnt.c
++++ b/ssl/statem/statem_clnt.c
+@@ -9,6 +9,7 @@
+  * https://www.openssl.org/source/license.html
+  */
+
++#include <openssl/tls1.h>
+ #include <stdio.h>
+ #include <time.h>
+ #include <assert.h>
+@@ -2636,7 +2637,7 @@ int tls_process_cert_status_body(SSL *s, PACKET *pkt)
+     unsigned int type;
+
+     if (!PACKET_get_1(pkt, &type)
+-        || type != TLSEXT_STATUSTYPE_ocsp) {
++        || (type != TLSEXT_STATUSTYPE_ocsp) && (type != TLSEXT_STATUSTYPE_ocsp_multi)) {
+         SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_UNSUPPORTED_STATUS_TYPE);
+         return 0;
+     }
+-- 
+2.34.1
+