Unvalidated Constraint Cases in OCPP Specification-Based Testing Tool Report

[jongchan988]

Hello

We are currently conducting research on the OCPP protocol and would like to share some of our findings.
In our OCPP specification-based testing tool, we observed cases where the resulting constraints are not being validated.
Even if it takes some time to fix, we kindly ask that you leave a comment to acknowledge that the issue has been recognized.

Thank you for your attention and support.
Best regards,

OCPP Core Report.xlsx

[dallmann-consulting]

Thank you for your tests and results. May I ask about the background of these tests? Who is conducting these tests?

The OCPP protocol is quite complex and (from my point of view) it is expected that systems/chargers all have slight interpretation differences and sometimes even programming errors (I'm sure OCPP.Core has some :-)). So what is the advantage when you want to charge your car but the backend server denies it because of (unimportant) protocol violations in certain situations?

There already were some external tests (see for example #32) that showed some issues allowing DoS attacks or similar. I added some content checks to resolve such issues. But where is the risk when a charger sends an overlong vendor ID (that is ignored), as long as the overall message has a resonable length and understandable content? In my opinion it is more important that the systems generally just work and ignore smaller protocol errors.

A protocol testing tool of course should check and document all such violations. And for every system it makes sense to check that it only generates valid messages and adheres to the protocol. But incoming messages should be accepted as long as they don't lead to stability or security issues. From a quick look into your results most issues seem to be related to rather unimportant data (additionalInfo, verdor data etc.).
I will check your results further and will especially have a look at the results where you didn't expect an error but got one from OCPP.Core.

The only violations from OCPP.Core are the lines where no errors were expected ("none" as rules) and OCPP.Core responded with an error, correct?