fix: enhance KNX OAM router functionality and security features

Signed-off-by: Tony <tonylu@tony-cloud.com>

components/gateway_knx/src/oam_router_runtime.cpp

@@ -4,19 +4,52 @@
 
 #include "esp_log.h"
 #include "esp_mac.h"
+#include "esp_timer.h"
 #include "knx/cemi_server.h"
 #include "knx/property.h"
 
 #include <algorithm>
+#include <array>
+#include <cstddef>
 #include <cstdio>
 #include <cstring>
 #include <utility>
 
+extern "C" bool knx_platform_get_fdsk_for_namespace(const char* nvs_namespace,
+                                                     uint8_t* data,
+                                                     size_t len) __attribute__((weak));
+
 namespace gateway::openknx {
 namespace {
 
 constexpr uint16_t kInvalidIndividualAddress = 0xffff;
 constexpr uint16_t kKnxUnconfiguredBroadcastAddress = 0xffff;
+constexpr uint8_t kSecureDataPdu = 0;
+constexpr uint8_t kSecureSyncRequest = 2;
+constexpr uint8_t kSecureToolAccessFlag = 0x80;
+constexpr size_t kKnxSerialLength = 6;
+constexpr size_t kSecureApduScfOffset = 1;
+constexpr size_t kSecureApduSerialOffset = 8;
+constexpr size_t kSecureApduMinimumSyncRequestLength =
+  kSecureApduSerialOffset + kKnxSerialLength;
+constexpr int64_t kSecureToolAccessRouteWindowUs = 120LL * 1000LL * 1000LL;
+constexpr uint16_t kOamDeviceObjectVersion = 3;
+
+bool HardwareTypeEquals(const uint8_t* actual, const uint8_t* expected) {
+  return actual != nullptr && expected != nullptr &&
+         std::memcmp(actual, expected, sizeof(knx_internal::kOamRouterHardwareType)) == 0;
+}
+
+VersionCheckResult OamRouterVersionCheck(uint16_t manufacturer_id,
+                                         uint8_t* hardware_type,
+                                         uint16_t version) {
+  if (manufacturer_id != knx_internal::kOamRouterManufacturerId ||
+      (!HardwareTypeEquals(hardware_type, knx_internal::kOamRouterHardwareType) &&
+       !HardwareTypeEquals(hardware_type, knx_internal::kOamRouterLegacyHardwareType))) {
+    return FlashAllInvalid;
+  }
+  return version == kOamDeviceObjectVersion ? FlashValid : FlashTablesInvalid;
+}
 
 bool IsUsableIndividualAddress(uint16_t address) {
   return address != 0 && address != kInvalidIndividualAddress;
@@ -37,6 +70,21 @@ bool IsBroadcastManagementRequest(CemiFrame& frame) {
   }
 }
 
+bool IsGroupBroadcastSecureToolAccess(CemiFrame& frame, uint8_t* service) {
+  if (frame.addressType() != GroupAddress || frame.destinationAddress() != 0x0000 ||
+      frame.apdu().type() != SecureService || frame.apdu().length() <= kSecureApduScfOffset) {
+    return false;
+  }
+  const uint8_t scf = frame.apdu().data()[kSecureApduScfOffset];
+  if ((scf & kSecureToolAccessFlag) == 0) {
+    return false;
+  }
+  if (service != nullptr) {
+    *service = scf & 0x07;
+  }
+  return true;
+}
+
 uint32_t OamBauNumberFromBaseMac() {
   uint8_t mac[6]{};
   if (esp_efuse_mac_get_default(mac) != ESP_OK && esp_read_mac(mac, ESP_MAC_WIFI_STA) != ESP_OK) {
@@ -59,6 +107,22 @@ void ApplyOamRouterIdentity(Bau091A& device) {
     property->write(knx_internal::kOamRouterProgramVersion);
   }
 }
+
+void ApplyOamFactoryFdsk(Bau091A& device, const std::string& nvs_namespace) {
+#if defined(USE_DATASECURE)
+  if (knx_platform_get_fdsk_for_namespace == nullptr) {
+    return;
+  }
+  std::array<uint8_t, 16> fdsk{};
+  if (knx_platform_get_fdsk_for_namespace(nvs_namespace.c_str(), fdsk.data(), fdsk.size())) {
+    device.factoryFdsk(fdsk.data(), fdsk.size());
+  }
+  std::fill(fdsk.begin(), fdsk.end(), 0);
+#else
+  (void)device;
+  (void)nvs_namespace;
+#endif
+}
 #endif
 
 }  // namespace
@@ -75,12 +139,15 @@ OamRouterRuntime::OamRouterRuntime(std::string nvs_namespace,
 {
 #if defined(ENABLE_BAU091A_PERSONA)
   platform_.outboundCemiFrameCallback(&OamRouterRuntime::HandleOutboundCemiFrame, this);
+  ApplyOamFactoryFdsk(device_, nvs_namespace_);
   ApplyOamRouterIdentity(device_);
+  device_.versionCheckCallback(&OamRouterVersionCheck);
   if (IsUsableIndividualAddress(fallback_individual_address)) {
     device_.deviceObject().individualAddress(fallback_individual_address);
   }
   ESP_LOGI("gateway_knx", "OAM OpenKNX loading memory namespace=%s", nvs_namespace_.c_str());
   device_.readMemory();
+  ApplyOamFactoryFdsk(device_, nvs_namespace_);
   ApplyOamRouterIdentity(device_);
   if (!IsUsableIndividualAddress(device_.deviceObject().individualAddress()) &&
       IsUsableIndividualAddress(fallback_individual_address)) {
@@ -174,6 +241,55 @@ void OamRouterRuntime::setProgrammingMode(bool enabled) {
 
 void OamRouterRuntime::toggleProgrammingMode() { setProgrammingMode(!programmingMode()); }
 
+bool OamRouterRuntime::matchesSecureSyncSerial(CemiFrame& frame) const {
+#if defined(ENABLE_BAU091A_PERSONA) && defined(USE_DATASECURE)
+  uint8_t service = 0;
+  if (!IsGroupBroadcastSecureToolAccess(frame, &service) ||
+      frame.apdu().length() < kSecureApduMinimumSyncRequestLength) {
+    return false;
+  }
+
+  if (service != kSecureSyncRequest) {
+    return false;
+  }
+
+  const uint8_t* apdu_data = frame.apdu().data();
+  const uint8_t* serial = apdu_data + kSecureApduSerialOffset;
+  const uint8_t* local_serial =
+      const_cast<Bau091A&>(device_).deviceObject().propertyData(PID_SERIAL_NUMBER);
+  const bool matches = local_serial != nullptr &&
+                       std::memcmp(serial, local_serial, kKnxSerialLength) == 0;
+  if (matches) {
+    recent_secure_tool_source_ = frame.sourceAddress();
+    recent_secure_tool_sync_us_ = esp_timer_get_time();
+  }
+  return matches;
+#else
+  (void)frame;
+  return false;
+#endif
+}
+
+bool OamRouterRuntime::matchesRecentSecureToolAccess(CemiFrame& frame) const {
+#if defined(ENABLE_BAU091A_PERSONA) && defined(USE_DATASECURE)
+  uint8_t service = 0;
+  if (!IsGroupBroadcastSecureToolAccess(frame, &service) || service != kSecureDataPdu ||
+      recent_secure_tool_sync_us_ <= 0 || frame.sourceAddress() != recent_secure_tool_source_) {
+    return false;
+  }
+  const int64_t now = esp_timer_get_time();
+  if (now < recent_secure_tool_sync_us_ ||
+      now - recent_secure_tool_sync_us_ > kSecureToolAccessRouteWindowUs) {
+    return false;
+  }
+  recent_secure_tool_sync_us_ = now;
+  return true;
+#else
+  (void)frame;
+  return false;
+#endif
+}
+
 EtsMemorySnapshot OamRouterRuntime::snapshot() const {
   EtsMemorySnapshot out;
 #if defined(ENABLE_BAU091A_PERSONA)
@@ -300,11 +416,18 @@ void OamRouterRuntime::loop() {
 
 bool OamRouterRuntime::HandleOutboundCemiFrame(CemiFrame& frame, void* context) {
   auto* self = static_cast<OamRouterRuntime*>(context);
-  if (self == nullptr || !self->sender_) {
+  if (self == nullptr) {
     return false;
   }
-  self->sender_(frame.data(), frame.dataLength());
-  return true;
+  if (self->sender_) {
+    self->sender_(frame.data(), frame.dataLength());
+    return true;
+  }
+  if (self->bus_frame_sender_) {
+    self->bus_frame_sender_(frame.data(), frame.dataLength());
+    return true;
+  }
+  return false;
 }
 
 void OamRouterRuntime::EmitTunnelFrame(CemiFrame& frame, void* context) {
@@ -348,6 +471,12 @@ bool OamRouterRuntime::shouldConsumeTunnelFrame(CemiFrame& frame) const {
         return dest == individualAddress() || dest == tunnelClientAddress() ||
                (commissioning && dest == kKnxUnconfiguredBroadcastAddress);
       }
+      if (matchesSecureSyncSerial(frame)) {
+        return true;
+      }
+      if (matchesRecentSecureToolAccess(frame)) {
+        return true;
+      }
       if (IsBroadcastManagementRequest(frame)) {
         return true;
       }
@@ -365,6 +494,12 @@ bool OamRouterRuntime::shouldConsumeBusFrame(CemiFrame& frame) const {
   if (IsBroadcastManagementRequest(frame)) {
     return true;
   }
+  if (matchesSecureSyncSerial(frame)) {
+    return true;
+  }
+  if (matchesRecentSecureToolAccess(frame)) {
+    return true;
+  }
   if (frame.addressType() != IndividualAddress) {
     return false;
   }