Add KNX IP Secure server-side TCP tunnelling

[evgeny-boger]

Summary

Add KNX IP Secure (03_08_09) support for the TCP tunnel server, allowing encrypted and authenticated KNXnet/IP connections from ETS and other clients.

How it works

• Both plain and secure connections accepted on the same TCP port (3671)
• ETS automatically detects IP Secure via Secure Service Families DIB (type 0x06)
• No KNX IP Router needs to be configured in the ETS project — ETS initiates IP Secure when it sees the DIB
• UDP multicast discovery is optional — ETS can connect directly via TCP

Passwords

• user-password (mandatory) — authenticates the client to the server. ETS calls this "Commissioning Password". Set for both management (user 1) and tunnelling (user 2) access.
• device-auth (optional) — the Device Authentication Code. Authenticates the server to the client to prevent MITM attacks. The client may skip verification if it doesn't know the code. IP Secure works without it.

Configuration

Simple (recommended):

[tcptun]
server = tcptunsrv
port = 3671
user-password = MyPassword123

With device authentication and custom serial number:

[tcptun]
server = tcptunsrv
port = 3671
device-auth = MyAuthCode
user-password = MyPassword123
serial-number = 00FAAABBCCDD

For UDP discovery with security advertisement:

[server]
server = ets_router
secure = true
discover = true
serial-number = 00FAAABBCCDD

Build options

./configure --enable-ipsecure    # default: enabled
./configure --disable-ipsecure   # builds without libcrypto

Dependencies

• OpenSSL libcrypto — only when --enable-ipsecure (default)

Note on .knxkeys keyring files

Keyring loading was intentionally not implemented. ETS prompts the user for the "Commissioning Password" when connecting to an IP Secure device, regardless of whether the keyring is loaded. Since knxd is not a real KNX device, ETS never programs passwords into it. The simplest approach is to set user-password directly in the config and enter the same password in ETS when prompted.

Test plan

• End-to-end with ETS 6 — secure tunnel, device diagnostics, bus access
• End-to-end with XKNX Python library
• Hardcoded passwords with ETS commissioning password prompt
• Session lifecycle: handshake, authentication, tunnel, keepalive, close
• Both plain and secure connections on same port
• Builds with --enable-ipsecure (default) and --disable-ipsecure
• Cross-compiled for arm64 (Wirenboard) via devcontainer

🤖 Generated with Claude Code