From 18995046b1cde1346e1c09fb7d4e02ffda736750 Mon Sep 17 00:00:00 2001 From: Wang Qixiang <43193572+wqx6@users.noreply.github.com> Date: Thu, 2 Feb 2023 23:56:47 +0800 Subject: [PATCH] Add a method to send the NOC with CATs when pairing devices (#24774) * controller: Add interface for setting CATs in ExampleOperationalCredentialsIssuer * chiptool: Add option to set CATs encoded in device's NOC for pairing command * Update examples/chip-tool/commands/common/CredentialIssuerCommands.h Co-authored-by: Boris Zbarsky --------- Co-authored-by: Boris Zbarsky --- .../commands/common/CredentialIssuerCommands.h | 2 ++ .../example/ExampleCredentialIssuerCommands.h | 1 + .../chip-tool/commands/pairing/PairingCommand.cpp | 15 +++++++++++++++ .../chip-tool/commands/pairing/PairingCommand.h | 2 ++ .../ExampleOperationalCredentialsIssuer.cpp | 2 +- .../ExampleOperationalCredentialsIssuer.h | 3 +++ 6 files changed, 24 insertions(+), 1 deletion(-) diff --git a/examples/chip-tool/commands/common/CredentialIssuerCommands.h b/examples/chip-tool/commands/common/CredentialIssuerCommands.h index 1ea712ffa9593f..afb36773529e1e 100644 --- a/examples/chip-tool/commands/common/CredentialIssuerCommands.h +++ b/examples/chip-tool/commands/common/CredentialIssuerCommands.h @@ -73,6 +73,8 @@ class CredentialIssuerCommands virtual chip::Controller::OperationalCredentialsDelegate * GetCredentialIssuer() = 0; + virtual void SetCredentialIssuerCATValues(chip::CATValues cats) = 0; + /** * @brief * This function is used to Generate NOC Chain for the Controller/Commissioner. Parameters follow the example implementation, diff --git a/examples/chip-tool/commands/example/ExampleCredentialIssuerCommands.h b/examples/chip-tool/commands/example/ExampleCredentialIssuerCommands.h index e06466ca4ab67d..a8694f02ff894e 100644 --- a/examples/chip-tool/commands/example/ExampleCredentialIssuerCommands.h +++ b/examples/chip-tool/commands/example/ExampleCredentialIssuerCommands.h @@ -45,6 +45,7 @@ class ExampleCredentialIssuerCommands : public CredentialIssuerCommands return CHIP_NO_ERROR; } chip::Controller::OperationalCredentialsDelegate * GetCredentialIssuer() override { return &mOpCredsIssuer; } + void SetCredentialIssuerCATValues(chip::CATValues cats) override { mOpCredsIssuer.SetCATValuesForNextNOCRequest(cats); } CHIP_ERROR GenerateControllerNOCChain(chip::NodeId nodeId, chip::FabricId fabricId, const chip::CATValues & cats, chip::Crypto::P256Keypair & keypair, chip::MutableByteSpan & rcac, chip::MutableByteSpan & icac, chip::MutableByteSpan & noc) override diff --git a/examples/chip-tool/commands/pairing/PairingCommand.cpp b/examples/chip-tool/commands/pairing/PairingCommand.cpp index ec8deb76a6081f..6467e8ffcbe989 100644 --- a/examples/chip-tool/commands/pairing/PairingCommand.cpp +++ b/examples/chip-tool/commands/pairing/PairingCommand.cpp @@ -33,6 +33,21 @@ using namespace ::chip::Controller; CHIP_ERROR PairingCommand::RunCommand() { CurrentCommissioner().RegisterPairingDelegate(this); + // Clear the CATs in OperationalCredentialsIssuer + mCredIssuerCmds->SetCredentialIssuerCATValues(kUndefinedCATs); + + if (mCASEAuthTags.HasValue() && mCASEAuthTags.Value().size() <= kMaxSubjectCATAttributeCount) + { + CATValues cats = kUndefinedCATs; + for (size_t index = 0; index < mCASEAuthTags.Value().size(); ++index) + { + cats.values[index] = mCASEAuthTags.Value()[index]; + } + if (cats.AreValid()) + { + mCredIssuerCmds->SetCredentialIssuerCATValues(cats); + } + } return RunInternal(mNodeId); } diff --git a/examples/chip-tool/commands/pairing/PairingCommand.h b/examples/chip-tool/commands/pairing/PairingCommand.h index 142a09013806af..656b4c60d4db02 100644 --- a/examples/chip-tool/commands/pairing/PairingCommand.h +++ b/examples/chip-tool/commands/pairing/PairingCommand.h @@ -64,6 +64,7 @@ class PairingCommand : public CHIPCommand, AddArgument("bypass-attestation-verifier", 0, 1, &mBypassAttestationVerifier, "Bypass the attestation verifier. If not provided or false, the attestation verifier is not bypassed." " If true, the commissioning will continue in case of attestation verification failure."); + AddArgument("case-auth-tags", 1, UINT32_MAX, &mCASEAuthTags, "The CATs to be encoded in the NOC sent to the commissionee"); switch (networkType) { @@ -188,6 +189,7 @@ class PairingCommand : public CHIPCommand, chip::Optional mPaseOnly; chip::Optional mSkipCommissioningComplete; chip::Optional mBypassAttestationVerifier; + chip::Optional> mCASEAuthTags; uint16_t mRemotePort; uint16_t mDiscriminator; uint32_t mSetupPINCode; diff --git a/src/controller/ExampleOperationalCredentialsIssuer.cpp b/src/controller/ExampleOperationalCredentialsIssuer.cpp index a651c0d070d9a9..132f111a18c3e0 100644 --- a/src/controller/ExampleOperationalCredentialsIssuer.cpp +++ b/src/controller/ExampleOperationalCredentialsIssuer.cpp @@ -374,7 +374,7 @@ CHIP_ERROR ExampleOperationalCredentialsIssuer::GenerateNOCChain(const ByteSpan MutableByteSpan rcacSpan(rcac.Get(), kMaxDERCertLength); ReturnErrorOnFailure( - GenerateNOCChainAfterValidation(assignedId, mNextFabricId, chip::kUndefinedCATs, pubkey, rcacSpan, icacSpan, nocSpan)); + GenerateNOCChainAfterValidation(assignedId, mNextFabricId, mNextCATs, pubkey, rcacSpan, icacSpan, nocSpan)); // TODO(#13825): Should always generate some IPK. Using a temporary fixed value until APIs are plumbed in to set it end-to-end // TODO: Force callers to set IPK if used before GenerateNOCChain will succeed. diff --git a/src/controller/ExampleOperationalCredentialsIssuer.h b/src/controller/ExampleOperationalCredentialsIssuer.h index 6e3b1e554d4288..0f779f753dfaec 100644 --- a/src/controller/ExampleOperationalCredentialsIssuer.h +++ b/src/controller/ExampleOperationalCredentialsIssuer.h @@ -69,6 +69,8 @@ class DLL_EXPORT ExampleOperationalCredentialsIssuer : public OperationalCredent void SetFabricIdForNextNOCRequest(FabricId fabricId) override { mNextFabricId = fabricId; } + void SetCATValuesForNextNOCRequest(CATValues cats) { mNextCATs = cats; } + /** * @brief Initialize the issuer with the keypair in the storage. * If the storage doesn't have one, it'll create one, and it to the storage. @@ -123,6 +125,7 @@ class DLL_EXPORT ExampleOperationalCredentialsIssuer : public OperationalCredent NodeId mNextRequestedNodeId = 1; FabricId mNextFabricId = 1; + CATValues mNextCATs = kUndefinedCATs; bool mNodeIdRequested = false; uint64_t mIndex = 0; };