debugging gateway internet access

ingester/gateway/mbus_mqtt_gebos.lua

@@ -1,11 +1,15 @@
-ver="1.8"
+ver="1.11"
 ----- CONFIGURATION -----
 -------- NB-IoT ---------
 APN = "auto"  -- APN for the SIM card
 PLMNID = 0  -- PLMNID for the SIM card
 reinitOnWakeGather = 1  -- 1 for reinitialization of the NB Iot module before gathering
 --------- MQTT ---------
-mqtt_server = "ingest.gebos.online"  -- broker
+-- DIAGNOSTIC: connect by IP to bypass carrier DNS — the modem fails with
+-- +CMQTTCONNECT: 0,25 (DNS error) when given the hostname. Revert to
+-- "ingest.gebos.online" once DNS works on this SIM/APN (fix the APN or set
+-- modem DNS servers); a hardcoded IP breaks silently if the host ever moves.
+mqtt_server = "178.104.178.108"  -- broker (= ingest.gebos.online)
 mqtt_user_base = "acrcv-"  -- client name template
 mqtt_client_name = nil  -- client name - set to some value, otherwise will be mqtt_user_base .. imsi
 mqtt_topic_base = "acrios/"  -- topic template, will add IMSI/ .. topic name
@@ -13,7 +17,7 @@ mqtt_user = "bender"  -- user name (for login)
 mqtt_password = "hancock"  -- password (for login)
 mqtt_port = 8883  -- port (8883 using TLS/SSL)
 mqtt_mode = "auto" -- "TCP" or "SSL" or autodetection based on port (8883 for SSL, else TCP)
-mqtt_timeout = 20000  -- timeout used for connecting and waiting for subscription
+mqtt_timeout = 60000  -- timeout used for connecting and waiting for subscription; generous because the TLS handshake (~6 kB cert chain) is slow over NB-IoT
 reportScheduled = true  -- true for reporting settings to the MQTT. List of days on which gathering occurs
 willMessage = true  -- true to enable MQTT disconnect message
 atDebug = true  -- true for debugging AT commands
@@ -87,6 +91,21 @@ function MQTT_SSL_Start()
     end
 
 	wSc(SCmV)
+	-- DIAGNOSTIC: dump PDP context / assigned IP / DNS before every connect
+	-- attempt. No IP in AT+CGPADDR = no data session (wrong APN) — explains
+	-- +CMQTTCONNECT: 0,25 (DNS) and 0,3 (socket connect fail).
+	at("AT+CGDCONT?", 5000)
+	at("AT+CGPADDR", 5000)
+	at("AT+CGCONTRDP", 5000)
+
+	-- DIAGNOSTIC: eUICC probe (run once, then remove). ICCID identifies the
+	-- SIM issuer; the AT+CSIM APDUs ask the card whether it has an eUICC
+	-- ISD-R applet and, if so, its EID.
+	--   select ISD-R: response ending 9000 or 61xx = eUICC; 6A82 = plain SIM.
+	--   GetEID:       response contains BF3E..5A10<32 hex digits> = the EID.
+	at("AT+CCID", 5000)
+	at('AT+CSIM=42,"00A4040410A0000005591010FFFFFFFF8900000100"', 10000)
+	at('AT+CSIM=22,"81E2910006BF3E035C015A"', 10000)
 	at("AT+QCPMUCFG=1,2")
 	at('AT+CEDRXS=2,5,"1111"')
 	at('AT+QCPTWEDRXS=2,5,"0000","1111"')
@@ -94,10 +113,14 @@ function MQTT_SSL_Start()
     if mqtt_mode == "SSL" then
 	    at("AT+CSSLCFG=\"sslversion\",0,4")
     end
-    if mqtt_mode == "SSL" and (mqtt_user == nil or mqtt_user == "") then
-	    at("AT+CSSLCFG=\"authmode\",0,0")
-    else
-        at("AT+CSSLCFG=\"authmode\",0,1")
+    if mqtt_mode == "SSL" then
+        -- authmode 0 = TLS without server-certificate verification. The modem
+        -- has no CA certificate configured (no AT+CSSLCFG="cacert",...), so
+        -- authmode 1 could never validate the broker's Let's Encrypt chain and
+        -- the handshake stalled with no CONNACK. To restore verification:
+        -- provision ISRG Root X1 on the module (AT+CCERTDOWN), point
+        -- AT+CSSLCFG="cacert",0,"<file>" at it, then set authmode back to 1.
+        at("AT+CSSLCFG=\"authmode\",0,0")
     end
 
 	if mqtt_client_name == nil then
@@ -985,6 +1008,13 @@ function onStartup()
 	at("APN=" .. APN)
 	at("PLMNID=" .. PLMNID)
 
+	-- DIAGNOSTIC: dump the PDP context, assigned IP and DNS servers to the
+	-- serial log. If AT+CGPADDR shows no address (or 0.0.0.0) the SIM has no
+	-- data path — wrong APN — and no socket/DNS can ever work.
+	at("AT+CGDCONT?", 5000)
+	at("AT+CGPADDR", 5000)
+	at("AT+CGCONTRDP", 5000)
+
 	ex("setSwWdogNoComReloadValue", noComWdg)
 
 	mqtt_topic_base = mqtt_topic_base .. getIMSI() .. '/'