update#1
Conversation
Protocol Compliance Violation DetectedPR violates OCPP specification by changing WebSocket subprotocol from correct 'ocpp1.6' to incorrect 'ocpp-1.6', which will break protocol negotiation and prevent secure OCPP communication. Critical Issues1. Protocol Compliance Violation in WebSocket subprotocol changed from OCPP-compliant 'ocpp1.6' to non-compliant 'ocpp-1.6'. According to OCPP specification (Table 1), OCPP version 1.6 must use subprotocol name 'ocpp1.6' without hyphen. This will cause WebSocket handshake failures with compliant OCPP backend servers. 2. Protocol Compliance Violation in WebSocket subprotocol changed from OCPP-compliant 'ocpp1.6' to non-compliant 'ocpp-1.6' in non-TLS connection. According to OCPP specification (Table 1), OCPP version 1.6 must use subprotocol name 'ocpp1.6' without hyphen. This will cause WebSocket handshake failures with compliant OCPP backend servers. AnalysisAccording to the user-provided OCPP guidelines (Table 1: OCPP Versions), the WebSocket subprotocol name for OCPP version 1.6 must be 'ocpp1.6' (without hyphen). This PR changes the protocol string from the correct format to an incorrect format in both TLS and non-TLS WebSocket initialization calls. This compliance violation has security implications because: (1) WebSocket handshake will likely fail when connecting to OCPP-compliant backend servers that expect 'ocpp1.6', (2) Failed protocol negotiation prevents the entire OCPP security framework (authentication, authorization, encrypted communication) from functioning, (3) Chargers will be unable to establish secure connections to backend systems, potentially leaving charging infrastructure inoperable. The code comments in MicroOcpp.h explicitly document 'protocol=ocpp1.6' as the expected format, confirming the current implementation is correct. This change violates the OCPP standard and should not be merged without understanding why the non-compliant format is being introduced. |
No description provided.