Keep the colleague's microbu-esp32c5 tree in this repository

obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but
that tree was gitignored, so a clone of this repository could not build the
firmware it ships. It is now committed here as ordinary files in its own
folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP
bridge's signature verification (--trust) used on the bench. Nothing is
fetched from or pushed to the colleague's repository; this repository and
its remotes carry everything. The folder's own .gitignore keeps build output,
downloaded components and private key material out, as it did there; the
committed file set is identical to that repository's tracked files.

The ESP32-C5 is still flashed from obu-firmware/, which only takes
vanetza-idf from microbu-esp32c5/, so the two stay separate folders.
FLASHING.md says how to take a newer version of the colleague's tree (copy
it over the folder, rebuild, test, commit).

microbu-esp32c5/external/vanetza-idf/tools/benchmark/cases/security/base.cpp

@@ -0,0 +1,49 @@
+#include "base.hpp"
+#include "vanetza/security/v2/sign_service.hpp"
+#include "vanetza/security/straight_verify_service.hpp"
+#include <boost/date_time/posix_time/posix_time.hpp>
+#include <iostream>
+
+using namespace vanetza;
+using namespace vanetza::security;
+
+SecurityBaseCase::SecurityBaseCase() :
+    runtime(Clock::at(boost::posix_time::microsec_clock::universal_time())),
+    crypto_backend(create_backend("default")),
+    certificate_cache(runtime),
+    certificate_provider(runtime),
+    certificate_validator(*crypto_backend, certificate_cache, trust_store),
+    sign_header_policy(runtime, positioning),
+    security_entity(create_sign_service(), create_verify_service())
+{
+    // nothing to do
+}
+
+void SecurityBaseCase::prepare()
+{
+    PositionFix position;
+    position.latitude = 49.014420 * units::degree;
+    position.longitude = 8.404417 * units::degree;
+    position.confidence.semi_major = 25.0 * units::si::meter;
+    position.confidence.semi_minor = 25.0 * units::si::meter;
+    assert(position.confidence);
+
+    positioning.position_fix(position);
+}
+
+std::unique_ptr<SignService> SecurityBaseCase::create_sign_service()
+{
+    return std::unique_ptr<SignService> {
+        new v2::StraightSignService(certificate_provider, *crypto_backend, sign_header_policy)
+    };
+}
+
+std::unique_ptr<VerifyService> SecurityBaseCase::create_verify_service()
+{
+    std::unique_ptr<StraightVerifyService> verify_service { new StraightVerifyService(runtime, *crypto_backend, positioning) };
+    verify_service->use_certificate_cache(&certificate_cache);
+    verify_service->use_certificate_provider(&certificate_provider);
+    verify_service->use_certificate_validator(&certificate_validator);
+    verify_service->use_sign_header_policy(&sign_header_policy);
+    return verify_service;
+}

microbu-esp32c5/external/vanetza-idf/tools/benchmark/cases/security/base.hpp

@@ -0,0 +1,37 @@
+#ifndef BENCHMARK_CASES_SECURITY_BASE_HPP
+#define BENCHMARK_CASES_SECURITY_BASE_HPP
+
+#include "case.hpp"
+#include <vanetza/common/manual_runtime.hpp>
+#include <vanetza/common/stored_position_provider.hpp>
+#include <vanetza/security/backend.hpp>
+#include <vanetza/security/delegating_security_entity.hpp>
+#include <vanetza/security/v2/certificate_cache.hpp>
+#include <vanetza/security/v2/default_certificate_validator.hpp>
+#include <vanetza/security/v2/naive_certificate_provider.hpp>
+#include <vanetza/security/v2/sign_header_policy.hpp>
+#include <vanetza/security/v2/trust_store.hpp>
+
+class SecurityBaseCase : public Case
+{
+public:
+    SecurityBaseCase();
+
+    void prepare() override;
+
+protected:
+    vanetza::ManualRuntime runtime;
+    vanetza::StoredPositionProvider positioning;
+    std::unique_ptr<vanetza::security::Backend> crypto_backend;
+    vanetza::security::v2::TrustStore trust_store;
+    vanetza::security::v2::CertificateCache certificate_cache;
+    vanetza::security::v2::NaiveCertificateProvider certificate_provider;
+    vanetza::security::v2::DefaultCertificateValidator certificate_validator;
+    vanetza::security::v2::DefaultSignHeaderPolicy sign_header_policy;
+    vanetza::security::DelegatingSecurityEntity security_entity;
+
+    std::unique_ptr<vanetza::security::SignService> create_sign_service();
+    std::unique_ptr<vanetza::security::VerifyService> create_verify_service();
+};
+
+#endif /* BENCHMARK_CASES_SECURITY_BASE_HPP */

microbu-esp32c5/external/vanetza-idf/tools/benchmark/cases/security/signing.cpp

@@ -0,0 +1,78 @@
+#include "signing.hpp"
+#include <boost/program_options.hpp>
+#include <iostream>
+#include <random>
+
+using namespace vanetza;
+using namespace vanetza::security;
+namespace po = boost::program_options;
+
+bool SecuritySigningCase::parse(const std::vector<std::string>& opts)
+{
+    po::options_description desc("Available options");
+    desc.add_options()
+        ("help", "Print out available options.")
+        ("messages", po::value<unsigned>(&messages)->default_value(10000), "Number of messages.")
+        ("signer", po::value<std::string>(&signer_info_type)->default_value("certificate"), "Signer embedded into the messages, may be 'certificate', 'hash' or 'chain'.")
+    ;
+
+    po::variables_map vm;
+    po::store(po::command_line_parser(opts).options(desc).run(), vm);
+
+    if (vm.count("help")) {
+        std::cerr << desc << std::endl;
+
+        return false;
+    }
+
+    try {
+        po::notify(vm);
+
+        if (signer_info_type != "certificate" && signer_info_type != "hash" && signer_info_type != "chain") {
+            throw std::runtime_error("Invalid signer info type.");
+        }
+    } catch (const std::exception& e) {
+        std::cerr << "Error: " << e.what() << std::endl << std::endl << desc << std::endl;
+
+        return false;
+    }
+
+    return true;
+}
+
+int SecuritySigningCase::execute()
+{
+    if (signer_info_type == "hash") {
+        // Sign one message with CAM profile, so the next message only includes the certificate hash
+        DownPacket packet;
+        packet.layer(OsiLayer::Application) = ByteBuffer { 0xC0, 0xFF, 0xEE };
+
+        SignRequest initial_sign_request;
+        initial_sign_request.plain_message = std::move(packet);
+        initial_sign_request.its_aid = aid::CA;
+        security_entity.encapsulate_packet(std::move(initial_sign_request));
+    }
+
+    if (signer_info_type == "certificate") {
+        sign_header_policy.request_certificate();
+    } else if (signer_info_type == "chain") {
+        sign_header_policy.request_certificate_chain();
+    }
+
+    std::cout << "Starting benchmark for messages ... ";
+
+    for (unsigned i = 0; i < messages; i++) {
+        DownPacket packet;
+        packet.layer(OsiLayer::Application) = ByteBuffer { 0xC0, 0xFF, 0xEE };
+
+        SignRequest sign_request;
+        sign_request.plain_message= std::move(packet);
+        sign_request.its_aid = aid::CA;
+
+        EncapConfirm encap_confirm = security_entity.encapsulate_packet(std::move(sign_request));
+    }
+
+    std::cout << "[Done]" << std::endl;
+
+    return 0;
+}

microbu-esp32c5/external/vanetza-idf/tools/benchmark/cases/security/signing.hpp

@@ -0,0 +1,17 @@
+#ifndef BENCHMARK_CASES_SECURITY_SIGNING_HPP
+#define BENCHMARK_CASES_SECURITY_SIGNING_HPP
+
+#include "base.hpp"
+
+class SecuritySigningCase : public SecurityBaseCase
+{
+public:
+    bool parse(const std::vector<std::string>&) override;
+    int execute() override;
+
+private:
+    unsigned messages;
+    std::string signer_info_type;
+};
+
+#endif /* BENCHMARK_CASES_SECURITY_SIGNING_HPP */

microbu-esp32c5/external/vanetza-idf/tools/benchmark/cases/security/validation.cpp

@@ -0,0 +1,119 @@
+#include "validation.hpp"
+#include <vanetza/security/delegating_security_entity.hpp>
+#include <vanetza/security/v2/secured_message.hpp>
+#include <vanetza/security/v2/sign_service.hpp>
+#include <boost/program_options.hpp>
+#include <iostream>
+#include <random>
+
+using namespace vanetza;
+using namespace vanetza::security;
+namespace po = boost::program_options;
+
+bool SecurityValidationCase::parse(const std::vector<std::string>& opts)
+{
+    po::options_description desc("Available options");
+    desc.add_options()
+        ("help", "Print out available options.")
+        ("identities", po::value<unsigned>(&identities)->default_value(1), "Number of identities (certificates).")
+        ("messages", po::value<unsigned>(&messages)->default_value(10000), "Number of messages.")
+        ("signer", po::value<std::string>(&signer_info_type)->default_value("certificate"), "Signer embedded into the messages, may be 'certificate', 'hash' or 'chain'.")
+    ;
+
+    po::variables_map vm;
+    po::store(po::command_line_parser(opts).options(desc).run(), vm);
+
+    if (vm.count("help")) {
+        std::cerr << desc << std::endl;
+
+        return false;
+    }
+
+    try {
+        po::notify(vm);
+
+        if (signer_info_type != "certificate" && signer_info_type != "hash" && signer_info_type != "chain") {
+            throw std::runtime_error("Invalid signer info type.");
+        }
+    } catch (const std::exception& e) {
+        std::cerr << "Error: " << e.what() << std::endl << std::endl << desc << std::endl;
+
+        return false;
+    }
+
+    return true;
+}
+
+int SecurityValidationCase::execute()
+{
+    DownPacket packet;
+    packet.layer(OsiLayer::Application) = ByteBuffer { 0xC0, 0xFF, 0xEE };
+
+    certificate_cache.insert(certificate_provider.own_certificate());
+    certificate_cache.insert(certificate_provider.aa_certificate());
+    trust_store.insert(certificate_provider.root_certificate());
+
+    std::vector<std::unique_ptr<v2::CertificateProvider>> providers;
+    std::vector<std::unique_ptr<SecurityEntity>> entities;
+    std::vector<SecuredMessage> secured_messages(identities);
+
+    for (unsigned i = 0; i < identities; i++) {
+        providers.emplace_back(new v2::NaiveCertificateProvider(runtime));
+        entities.emplace_back(new DelegatingSecurityEntity { create_sign_service(), create_verify_service() });
+        certificate_cache.insert(providers.back()->own_certificate());
+    }
+
+    if (signer_info_type == "hash") {
+        // Sign one message with CAM profile, so the next message only includes the certificate hash
+        SignRequest initial_sign_request;
+        initial_sign_request.plain_message = packet;
+        initial_sign_request.its_aid = aid::CA;
+        entities[0]->encapsulate_packet(std::move(initial_sign_request));
+    }
+
+    for (unsigned i = 0; i < identities; i++) {
+        if (signer_info_type == "certificate") {
+            sign_header_policy.request_certificate();
+        } else if (signer_info_type == "chain") {
+            sign_header_policy.request_certificate_chain();
+        }
+
+        SignRequest sign_request;
+        sign_request.plain_message = packet;
+        sign_request.its_aid = aid::CA;
+
+        EncapConfirm encap_confirm = entities[i]->encapsulate_packet(std::move(sign_request));
+        auto secured_msg = encap_confirm.secured_message();
+        if (!secured_msg) {
+            std::cerr << "Failed to encapsulate packet." << std::endl;
+            return 1;
+        }
+        auto v2_sec_msg = boost::get<v2::SecuredMessage>(*secured_msg);
+        auto signer_info = v2_sec_msg.header_field<v2::HeaderFieldType::Signer_Info>();
+        
+        if (signer_info_type == "hash") {
+            assert(signer_info && get_type(*signer_info) == v2::SignerInfoType::Certificate_Digest_With_SHA256);
+        } else if (signer_info_type == "certificate") {
+            assert(signer_info && get_type(*signer_info) == v2::SignerInfoType::Certificate);
+        } else if (signer_info_type == "chain") {
+            assert(signer_info && get_type(*signer_info) == v2::SignerInfoType::Certificate_Chain);
+        }
+
+        secured_messages.push_back(v2_sec_msg);
+    }
+
+    std::mt19937 gen(0);
+    std::uniform_int_distribution<> dis(0, identities - 1);
+
+    std::cout << "Starting benchmark for messages ... ";
+
+    for (unsigned i = 0; i < messages; i++) {
+        DecapRequest decap_request { SecuredMessageView { secured_messages[dis(gen)] }};
+        auto decap_confirm = security_entity.decapsulate_packet(std::move(decap_request));
+        assert(decap_confirm.report == VerificationReport::Success);
+    }
+
+    std::cout << "[Done]" << std::endl;
+
+    return 0;
+}

microbu-esp32c5/external/vanetza-idf/tools/benchmark/cases/security/validation.hpp

@@ -0,0 +1,18 @@
+#ifndef BENCHMARK_CASES_SECURITY_VALIDATION_HPP
+#define BENCHMARK_CASES_SECURITY_VALIDATION_HPP
+
+#include "base.hpp"
+
+class SecurityValidationCase : public SecurityBaseCase
+{
+public:
+    bool parse(const std::vector<std::string>&) override;
+    int execute() override;
+
+private:
+    unsigned identities;
+    unsigned messages;
+    std::string signer_info_type;
+};
+
+#endif /* BENCHMARK_CASES_SECURITY_VALIDATION_HPP */