Merge pull request #1365 from shadowguardian507-irl/AWS_IoT_Core_support

Server V3 (MQTT): AWS IoT Core support

Author: dexterbg

docs/source/userguide/components.rst

@@ -123,6 +123,32 @@ Send all ``v.b`` metrics except ``v.b.soc``::
   OVMS# config set server.v3 metrics.include v.b.*
   OVMS# config set server.v3 metrics.exclude v.b.soc
 
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+Broker compatibility options
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Some brokers have additional requirements:
+
+- ``retain.depth.limit`` (default: ``no``) — omits the RETAIN flag on topics deeper than 8 path segments. Needed for AWS IoT Core, which silently drops retained publishes on topics deeper than 8 levels.
+
+Example::
+
+  OVMS# config set server.v3 retain.depth.limit yes
+
+.. note:: AWS IoT Core requires the MQTT keepalive to be 1200 seconds or less.
+  Set ``updatetime.keepalive`` accordingly::
+
+    OVMS# config set server.v3 updatetime.keepalive 1200
+
+These options can also be set from the **Config → Server V3 (MQTT)** web page.
+
+^^^^^^^^^^^^^^^^^^^^^^^^^
+TLS client authentication
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The module supports client certificate authentication (mTLS) for brokers that need it.
+Paste the PEM certificate and key into the **Config → Server V3 (MQTT)** web page.
+
 -------------------------------
 Upgrading from OVMS v1/v2 to v3
 -------------------------------

docs/source/userguide/ssltls.rst

@@ -48,6 +48,9 @@ These trusted certificate authorities are used by the various module in the OVMS
 establishing SSL/TLS connections (in order to verify the certificate of the server being
 connected to).
 
+.. note:: For MQTT brokers that require **client certificate authentication** (mTLS),
+  see the :doc:`Server V3 configuration <components>` section on TLS client authentication.
+
 
 ----------------------------------
 How to get the CA PEM for a Server

vehicle/OVMS.V3/changes.txt

@@ -1,6 +1,12 @@
 Open Vehicle Monitor System v3 - Change log
 
 ????-??-?? ???  ???????  OTA release
+- Server V3 (MQTT): AWS IoT Core compatibility fixes:
+    - mTLS client certificate authentication for MQTT brokers that require it
+      (e.g. AWS IoT Core). Configured via web UI (Config → Server V3).
+    - Fixed MQTT CONNECT to omit empty username/password for certificate-only auth.
+    - New option "retain.depth.limit": disables RETAIN on deep topics (>8 segments)
+      for brokers like AWS IoT Core that reject them.
 - Autostart: added init option "minimal" to boot with just basic networking as configured; this is
     now the first fallback in case of repeated early crashes, aiming at keeping the module reachable
     in case of a bug in a higher level module / configuration. Auto init will be disabled only if

vehicle/OVMS.V3/components/ovms_server_v3/src/ovms_server_v3.cpp

@@ -36,6 +36,7 @@ static const char *TAG = "ovms-server-v3";
 #include <vector>
 #include <algorithm>
 #include "ovms_server_v3.h"
+#include "ovms_utils.h"
 #include "buffered_shell.h"
 #include "ovms_command.h"
 #include "ovms_metrics.h"
@@ -96,8 +97,9 @@ static void OvmsServerV3MongooseCallback(struct mg_connection *nc, int ev, void
           ESP_LOGI(TAG, "Connection successful");
           struct mg_send_mqtt_handshake_opts opts;
           memset(&opts, 0, sizeof(opts));
-          opts.user_name = MyOvmsServerV3->m_user.c_str();
-          opts.password = MyOvmsServerV3->m_password.c_str();
+          //If no user/password is set avoid sending an empty string
+          opts.user_name = MyOvmsServerV3->m_user.empty() ? NULL : MyOvmsServerV3->m_user.c_str();
+          opts.password = MyOvmsServerV3->m_password.empty() ? NULL : MyOvmsServerV3->m_password.c_str();
           opts.will_topic = MyOvmsServerV3->m_will_topic.c_str();
           opts.will_message = "no";
           opts.flags |= MG_MQTT_WILL_RETAIN;
@@ -237,6 +239,7 @@ OvmsServerV3::OvmsServerV3(const char* name)
   m_updatetime_sendall = 1200;
   m_updatetime_keepalive = 29*60;
   m_legacy_event_topic = true;
+  m_retain_depth_limit = false;
   m_notify_info_pending = false;
   m_notify_error_pending = false;
   m_notify_alert_pending = false;
@@ -458,8 +461,22 @@ void OvmsServerV3::TransmitMetric(OvmsMetric* metric)
 
   std::string val = metric->AsString();
 
+  // When retain.depth.limit is enabled, topics with more than 7 slashes (>8 segments)
+  // are published without the RETAIN flag. This is required for AWS IoT Core, which
+  // rejects retained publishes on topics deeper than 8 segments.
+  int qos_flags;
+  if (m_retain_depth_limit)
+    {
+    int slash_count = (int)std::count(topic.begin(), topic.end(), '/');
+    qos_flags = MG_MQTT_QOS(0) | (slash_count <= 7 ? MG_MQTT_RETAIN : 0);
+    }
+  else
+    {
+    qos_flags = MG_MQTT_QOS(0) | MG_MQTT_RETAIN;
+    }
+
   mg_mqtt_publish(m_mgconn, topic.c_str(), NextMsgId(),
-    MG_MQTT_QOS(0) | MG_MQTT_RETAIN, val.c_str(), val.length());
+    qos_flags, val.c_str(), val.length());
   ESP_LOGV(TAG,"Tx metric %s=%s",topic.c_str(),val.c_str());
   }
 
@@ -986,6 +1003,12 @@ void OvmsServerV3::Connect()
 #if CONFIG_MG_ENABLE_SSL
     opts.ssl_ca_cert = MyOvmsTLS.GetTrustedList();
     opts.ssl_server_name = m_server.c_str();
+    if (path_exists("/store/tls/serverv3_client.crt") && path_exists("/store/tls/serverv3_client.key"))
+      {
+      opts.ssl_cert = "/store/tls/serverv3_client.crt";
+      opts.ssl_key  = "/store/tls/serverv3_client.key";
+      ESP_LOGI(TAG, "Using MQTT mTLS client certificate authentication");
+      }
 #else
     ESP_LOGE(TAG, "mg_connect(%s) failed: SSL support disabled", address.c_str());
     SetStatus("Error: Connection failed (SSL support disabled)", true, Undefined);
@@ -1187,6 +1210,7 @@ void OvmsServerV3::ConfigChanged(OvmsConfigParam* param)
   m_updatetime_sendall = param->GetValueInt("updatetime.sendall", m_updatetime_sendall);
   m_updatetime_keepalive = param->GetValueInt("updatetime.keepalive", m_updatetime_keepalive);
   m_legacy_event_topic = param->GetValueBool("events.legacy_topic", true);
+  m_retain_depth_limit = param->GetValueBool("retain.depth.limit", m_retain_depth_limit);
   m_updatetime_priority = param->GetValueBool("updatetime.priority", false);
   m_updatetime_immediately = param->GetValueBool("updatetime.immediately", false);
   m_max_per_call_sendall = param->GetValueInt("queue.sendall", m_max_per_call_sendall);

vehicle/OVMS.V3/components/ovms_server_v3/src/ovms_server_v3.h

@@ -114,6 +114,7 @@ class OvmsServerV3 : public OvmsServer, MongooseClient
     int m_max_per_call_modified;
     bool m_updatetime_priority;
     bool m_legacy_event_topic;
+    bool m_retain_depth_limit;
     bool m_updatetime_immediately;
     std::atomic<bool> m_have_immediately;
     bool m_connection_available;

vehicle/OVMS.V3/components/ovms_webserver/src/web_cfg_server_v3.cpp

@@ -36,11 +36,12 @@ void OvmsWebServer::HandleCfgServerV3(PageEntry_t& p, PageContext_t& c)
   auto lock = MyConfig.Lock();
   std::string error;
   std::string server, clientid, user, password, port, topic_prefix;
+  extram::string client_cert, client_key;
   std::string updatetime_connected, updatetime_idle, updatetime_on;
   std::string updatetime_charging, updatetime_awake, updatetime_sendall, updatetime_keepalive;
   std::string metrics_priority, metrics_include, metrics_exclude, metrics_immediately, metrics_exclude_immediately;
   std::string queue_sendall, queue_modified;
-  bool tls, legacy_event_topic, updatetime_priority, updatetime_immediately;
+  bool tls, legacy_event_topic, updatetime_priority, updatetime_immediately, retain_depth_limit;
 
   if (c.method == "POST") {
     // process form submission:
@@ -50,6 +51,8 @@ void OvmsWebServer::HandleCfgServerV3(PageEntry_t& p, PageContext_t& c)
     clientid = c.getvar("clientid");
     user = c.getvar("user");
     password = c.getvar("password");
+    c.getvar("client_cert", client_cert);
+    c.getvar("client_key", client_key);
     port = c.getvar("port");
     topic_prefix = c.getvar("topic_prefix");
     updatetime_connected = c.getvar("updatetime_connected");
@@ -61,6 +64,7 @@ void OvmsWebServer::HandleCfgServerV3(PageEntry_t& p, PageContext_t& c)
     updatetime_keepalive = c.getvar("updatetime_keepalive");
     updatetime_priority = (c.getvar("updatetime_priority") == "yes");
     updatetime_immediately = (c.getvar("updatetime_immediately") == "yes");
+    retain_depth_limit = (c.getvar("retain_depth_limit") == "yes");
     metrics_priority = c.getvar("metrics_priority");
     metrics_include = c.getvar("metrics_include");
     metrics_exclude = c.getvar("metrics_exclude");
@@ -111,6 +115,18 @@ void OvmsWebServer::HandleCfgServerV3(PageEntry_t& p, PageContext_t& c)
         error += "<li data-input=\"updatetime_keepalive\">Keepalive interval must be at least 60 seconds</li>";
       }
     }
+    if (!client_cert.empty() && !startsWith(client_cert, "-----BEGIN CERTIFICATE-----")) {
+      error += "<li data-input=\"client_cert\">Client certificate must be in PEM CERTIFICATE format</li>";
+    }
+    if (!client_key.empty() &&
+        !startsWith(client_key, "-----BEGIN PRIVATE KEY-----") &&
+        !startsWith(client_key, "-----BEGIN RSA PRIVATE KEY-----") &&
+        !startsWith(client_key, "-----BEGIN EC PRIVATE KEY-----")) {
+      error += "<li data-input=\"client_key\">Client private key must be in PEM PRIVATE KEY format</li>";
+    }
+    if (client_cert.empty() != client_key.empty()) {
+      error += "<li data-input=\"client_cert,client_key\">Both client certificate and private key must be given</li>";
+    }
 
     if (error == "") {
       // success:
@@ -132,14 +148,40 @@ void OvmsWebServer::HandleCfgServerV3(PageEntry_t& p, PageContext_t& c)
       MyConfig.SetParamValue("server.v3", "updatetime.keepalive", updatetime_keepalive);
       MyConfig.SetParamValueBool("server.v3", "updatetime.priority", updatetime_priority);
       MyConfig.SetParamValueBool("server.v3", "updatetime.immediately", updatetime_immediately);
+      MyConfig.SetParamValueBool("server.v3", "retain.depth.limit", retain_depth_limit);
       MyConfig.SetParamValue("server.v3", "metrics.priority", metrics_priority);
       MyConfig.SetParamValue("server.v3", "metrics.include", metrics_include);
       MyConfig.SetParamValue("server.v3", "metrics.exclude", metrics_exclude);
       MyConfig.SetParamValue("server.v3", "metrics.include.immediately", metrics_immediately);
       MyConfig.SetParamValue("server.v3", "metrics.exclude.immediately", metrics_exclude_immediately);
       MyConfig.SetParamValue("server.v3", "queue.sendall", queue_sendall);
       MyConfig.SetParamValue("server.v3", "queue.modified", queue_modified);
-
+      if (client_cert.empty()) {
+        unlink("/store/tls/serverv3_client.crt");
+        unlink("/store/tls/serverv3_client.key");
+      }
+      else {
+        if (save_file("/store/tls/serverv3_client.crt", client_cert) != 0) {
+          error = "<li data-input=\"client_cert\">Error saving TLS certificate: ";
+          error += strerror(errno);
+          error += "</li>";
+          error = "<p class=\"lead\">Error!</p><ul class=\"errorlist\">" + error + "</ul>";
+          c.head(400);
+          c.alert("danger", error.c_str());
+          c.done();
+          return;
+        }
+        if (save_file("/store/tls/serverv3_client.key", client_key) != 0) {
+          error = "<li data-input=\"client_key\">Error saving TLS private key: ";
+          error += strerror(errno);
+          error += "</li>";
+          error = "<p class=\"lead\">Error!</p><ul class=\"errorlist\">" + error + "</ul>";
+          c.head(400);
+          c.alert("danger", error.c_str());
+          c.done();
+          return;
+        }
+      }
       c.head(200);
       c.alert("success", "<p class=\"lead\">Server V3 (MQTT) connection configured.</p>");
       OutputHome(p, c);
@@ -160,6 +202,8 @@ void OvmsWebServer::HandleCfgServerV3(PageEntry_t& p, PageContext_t& c)
     clientid = MyConfig.GetParamValue("server.v3", "clientid");
     user = MyConfig.GetParamValue("server.v3", "user");
     password = MyConfig.GetParamValue("password", "server.v3");
+    load_file("/store/tls/serverv3_client.crt", client_cert);
+    load_file("/store/tls/serverv3_client.key", client_key);
     port = MyConfig.GetParamValue("server.v3", "port");
     topic_prefix = MyConfig.GetParamValue("server.v3", "topic.prefix");
     updatetime_connected = MyConfig.GetParamValue("server.v3", "updatetime.connected");
@@ -171,6 +215,7 @@ void OvmsWebServer::HandleCfgServerV3(PageEntry_t& p, PageContext_t& c)
     updatetime_keepalive = MyConfig.GetParamValue("server.v3", "updatetime.keepalive", "1740");
     updatetime_priority = MyConfig.GetParamValueBool("server.v3", "updatetime.priority", false);
     updatetime_immediately = MyConfig.GetParamValueBool("server.v3", "updatetime.immediately", false);
+    retain_depth_limit = MyConfig.GetParamValueBool("server.v3", "retain.depth.limit", false);
     metrics_priority = MyConfig.GetParamValue("server.v3", "metrics.priority");
     metrics_include = MyConfig.GetParamValue("server.v3", "metrics.include");
     metrics_exclude = MyConfig.GetParamValue("server.v3", "metrics.exclude");
@@ -207,6 +252,46 @@ void OvmsWebServer::HandleCfgServerV3(PageEntry_t& p, PageContext_t& c)
   c.input_text("Topic Prefix", "topic_prefix", topic_prefix.c_str(),
     "optional, default: ovms/<username>/<vehicle id>/");
 
+  c.fieldset_start("TLS client authentication (optional)");
+  c.printf(
+    "<div class=\"form-group\">\n"
+      "<label class=\"control-label col-sm-3\" for=\"input-content\">Client certificate:</label>\n"
+      "<div class=\"col-sm-9\">\n"
+        "<textarea class=\"form-control font-monospace\" style=\"font-size:80%%;white-space:pre;\"\n"
+          "autocapitalize=\"none\" autocorrect=\"off\" autocomplete=\"off\" spellcheck=\"false\"\n"
+          "placeholder=\"-----BEGIN CERTIFICATE-----&#13;&#10;...&#13;&#10;-----END CERTIFICATE-----\"\n"
+          "rows=\"5\" id=\"input-client_cert\" name=\"client_cert\">%s</textarea>\n"
+      "</div>\n"
+    "</div>\n"
+    , c.encode_html(client_cert).c_str());
+  c.printf(
+    "<div class=\"form-group\">\n"
+      "<label class=\"control-label col-sm-3\" for=\"input-content\">Client private key:</label>\n"
+      "<div class=\"col-sm-9\">\n"
+        "<textarea class=\"form-control font-monospace\" style=\"font-size:80%%;white-space:pre;\"\n"
+          "autocapitalize=\"none\" autocorrect=\"off\" autocomplete=\"off\" spellcheck=\"false\"\n"
+          "placeholder=\"-----BEGIN PRIVATE KEY-----&#13;&#10;...&#13;&#10;-----END PRIVATE KEY-----\"\n"
+          "rows=\"5\" id=\"input-client_key\" name=\"client_key\">%s</textarea>\n"
+        "<p class=\"help-block\">Supports PKCS#8, RSA and EC PEM private keys. <br/>"
+        " Leave both the certificate and key empty to authenticate with username/password only.</p>\n"
+      "</div>\n"
+    "</div>\n"
+    , c.encode_html(client_key).c_str());
+  c.fieldset_end();
+  c.fieldset_start("AWS IoT Core (optional)");
+  c.input_checkbox("Limit retain to 8-segment topics", "retain_depth_limit", retain_depth_limit,
+    "<p>Omits the MQTT RETAIN flag on topics with more than 8 path segments."
+    " Required for AWS IoT Core. Default: disabled.</p>");
+  c.printf(
+    "<div class=\"form-group\">\n"
+      "<div class=\"col-sm-9 col-sm-offset-3\">\n"
+        "<b> MQTT keepalive </b><br>\n"
+        "<p class=\"help-block\">AWS IoT Core requires the MQTT keepalive to be 1200 seconds or less."
+        " Set the <em>Keepalive</em> interval below to 1200 or lower.</p>\n"
+      "</div>\n"
+    "</div>\n");
+  c.fieldset_end();
+
   c.fieldset_start("Update intervals");
   c.input("number", "…idle", "updatetime_idle", updatetime_idle.c_str(), "default: 600", "default: 600, update interval when client not connected", "min=\"1\" max=\"1200\" step=\"1\"", "seconds");
   c.input("number", "…on", "updatetime_on", updatetime_on.c_str(), "default: 5", "default: 5, update interval when Car is on", "min=\"1\" max=\"600\" step=\"1\"", "seconds");