Integrate CASE state machine with the controller (#6810)

* Implemented CASEServer to fetch credentials, and wait for SigmaR1 message * Integrate CASE session establishment with controller * For now, disable test for disabled feature * some cleanup after rebase * address review comments * Update src/protocols/secure_channel/CASEServer.cpp Co-authored-by: Tennessee Carmel-Veilleux <[email protected]> Co-authored-by: Tennessee Carmel-Veilleux <[email protected]>
project-chip · Jun 23, 2021 · 2348496 · 2348496
1 parent 782a91c
commit 2348496
Show file tree

Hide file tree

Showing 15 changed files with 288 additions and 92 deletions.
diff --git a/src/app/clusters/operational-credentials-server/operational-credentials-server.cpp b/src/app/clusters/operational-credentials-server/operational-credentials-server.cpp
@@ -336,6 +336,8 @@ bool emberAfOperationalCredentialsClusterAddOpCertCallback(chip::app::Command *
     VerifyOrExit(admin->SetOperationalCert(ByteSpan(certBuf, NOC.size() + ICACertificate.size())) == CHIP_NO_ERROR,
                  status = EMBER_ZCL_STATUS_FAILURE);
 
+    VerifyOrExit(GetGlobalAdminPairingTable().Store(admin->GetAdminId()) == CHIP_NO_ERROR, status = EMBER_ZCL_STATUS_FAILURE);
+
 exit:
     emberAfSendImmediateDefaultResponse(status);
     if (status == EMBER_ZCL_STATUS_FAILURE)

diff --git a/src/app/clusters/trusted-root-certificates-server/trusted-root-certificates-server.cpp b/src/app/clusters/trusted-root-certificates-server/trusted-root-certificates-server.cpp
@@ -57,6 +57,8 @@ bool emberAfTrustedRootCertificatesClusterAddTrustedRootCertificateCallback(chip
     VerifyOrExit(admin != nullptr, status = EMBER_ZCL_STATUS_FAILURE);
     VerifyOrExit(admin->SetRootCert(RootCertificate) == CHIP_NO_ERROR, status = EMBER_ZCL_STATUS_FAILURE);
 
+    VerifyOrExit(GetGlobalAdminPairingTable().Store(admin->GetAdminId()) == CHIP_NO_ERROR, status = EMBER_ZCL_STATUS_FAILURE);
+
 exit:
     emberAfSendImmediateDefaultResponse(status);
     if (status == EMBER_ZCL_STATUS_FAILURE)

diff --git a/src/controller/CHIPDevice.cpp b/src/controller/CHIPDevice.cpp
@@ -164,6 +164,9 @@ CHIP_ERROR Device::Serialize(SerializedDevice & output)
     serializable.mDevicePort = Encoding::LittleEndian::HostSwap16(mDeviceAddress.GetPort());
     serializable.mAdminId    = Encoding::LittleEndian::HostSwap16(mAdminId);
 
+    serializable.mCASESessionKeyId           = Encoding::LittleEndian::HostSwap16(mCASESessionKeyId);
+    serializable.mDeviceProvisioningComplete = (mDeviceProvisioningComplete) ? 1 : 0;
+
     static_assert(std::is_same<std::underlying_type<decltype(mDeviceAddress.GetTransportType())>::type, uint8_t>::value,
                   "The underlying type of Transport::Type is not uint8_t.");
     serializable.mDeviceTransport = static_cast<uint8_t>(mDeviceAddress.GetTransportType());
@@ -217,6 +220,9 @@ CHIP_ERROR Device::Deserialize(const SerializedDevice & input)
     port      = Encoding::LittleEndian::HostSwap16(serializable.mDevicePort);
     mAdminId  = Encoding::LittleEndian::HostSwap16(serializable.mAdminId);
 
+    mCASESessionKeyId           = Encoding::LittleEndian::HostSwap16(serializable.mCASESessionKeyId);
+    mDeviceProvisioningComplete = (serializable.mDeviceProvisioningComplete != 0);
+
     // The InterfaceNameToId() API requires initialization of mInterface, and lock/unlock of
     // LwIP stack.
     interfaceId = INET_NULL_INTERFACEID;
@@ -370,6 +376,12 @@ CHIP_ERROR Device::LoadSecureSessionParameters(ResetTransport resetNeeded)
                                       SecureSession::SessionRole::kInitiator, mAdminId);
     SuccessOrExit(err);
 
+    if (IsProvisioningComplete())
+    {
+        err = EstablishCASESession();
+        SuccessOrExit(err);
+    }
+
 exit:
 
     if (err != CHIP_NO_ERROR)
@@ -389,6 +401,37 @@ bool Device::GetAddress(Inet::IPAddress & addr, uint16_t & port) const
     return true;
 }
 
+CHIP_ERROR Device::EstablishCASESession()
+{
+    Messaging::ExchangeContext * exchange = mExchangeMgr->NewContext(SecureSessionHandle(), &mCASESession);
+    VerifyOrReturnError(exchange != nullptr, CHIP_ERROR_INTERNAL);
+
+    ReturnErrorOnFailure(mCASESession.MessageDispatch().Init(mSessionManager->GetTransportManager()));
+    mCASESession.MessageDispatch().SetPeerAddress(mDeviceAddress);
+
+    ReturnErrorOnFailure(mCASESession.EstablishSession(mDeviceAddress, mCredentials, mDeviceId, 0, exchange, this));
+
+    return CHIP_NO_ERROR;
+}
+
+void Device::OnSessionEstablishmentError(CHIP_ERROR error) {}
+
+void Device::OnSessionEstablished()
+{
+    mCASESession.PeerConnection().SetPeerNodeId(mDeviceId);
+
+    // TODO - Enable keys derived from CASE Session
+    // CHIP_ERROR err = mSessionManager->NewPairing(Optional<Transport::PeerAddress>::Value(mDeviceAddress), mDeviceId,
+    // &mCASESession,
+    //                                              SecureSession::SessionRole::kInitiator, mAdminId, nullptr);
+    // if (err != CHIP_NO_ERROR)
+    // {
+    //     ChipLogError(Controller, "Failed in setting up CASE secure channel: err %s", ErrorStr(err));
+    //     OnSessionEstablishmentError(err);
+    //     return;
+    // }
+}
+
 void Device::AddResponseHandler(uint8_t seqNum, Callback::Cancelable * onSuccessCallback, Callback::Cancelable * onFailureCallback)
 {
     mCallbacksMgr.AddResponseCallback(mDeviceId, seqNum, onSuccessCallback, onFailureCallback);

diff --git a/src/controller/CHIPDevice.h b/src/controller/CHIPDevice.h
@@ -32,9 +32,11 @@
 #include <app/util/basic-types.h>
 #include <core/CHIPCallback.h>
 #include <core/CHIPCore.h>
+#include <credentials/CHIPOperationalCredentials.h>
 #include <messaging/ExchangeContext.h>
 #include <messaging/ExchangeDelegate.h>
 #include <messaging/ExchangeMgr.h>
+#include <protocols/secure_channel/CASESession.h>
 #include <protocols/secure_channel/PASESession.h>
 #include <setup_payload/SetupPayload.h>
 #include <support/Base64.h>
@@ -75,12 +77,14 @@ struct ControllerDeviceInitParams
     SecureSessionMgr * sessionMgr            = nullptr;
     Messaging::ExchangeManager * exchangeMgr = nullptr;
     Inet::InetLayer * inetLayer              = nullptr;
+
+    Credentials::OperationalCredentialSet * credentials = nullptr;
 #if CONFIG_NETWORK_LAYER_BLE
     Ble::BleLayer * bleLayer = nullptr;
 #endif
 };
 
-class DLL_EXPORT Device : public Messaging::ExchangeDelegate
+class DLL_EXPORT Device : public Messaging::ExchangeDelegate, public SessionEstablishmentDelegate
 {
 public:
     ~Device()
@@ -183,6 +187,7 @@ class DLL_EXPORT Device : public Messaging::ExchangeDelegate
         mInetLayer      = params.inetLayer;
         mListenPort     = listenPort;
         mAdminId        = admin;
+        mCredentials    = params.credentials;
 #if CONFIG_NETWORK_LAYER_BLE
         mBleLayer = params.bleLayer;
 #endif
@@ -198,7 +203,7 @@ class DLL_EXPORT Device : public Messaging::ExchangeDelegate
      *   all device specifc parameters (address, port, interface etc).
      *
      *   This is not done as part of constructor so that the controller can have a list of
-     *   uninitialzed/unpaired device objects. The object is initialized only when the device
+     *   uninitialized/unpaired device objects. The object is initialized only when the device
      *   is actually paired.
      *
      * @param[in] params       Wrapper object for transport manager etc.
@@ -354,6 +359,19 @@ class DLL_EXPORT Device : public Messaging::ExchangeDelegate
     void AddIMResponseHandler(Callback::Cancelable * onSuccessCallback, Callback::Cancelable * onFailureCallback);
     void CancelIMResponseHandler();
 
+    void ProvisioningComplete(uint16_t caseKeyId)
+    {
+        mDeviceProvisioningComplete = true;
+        mCASESessionKeyId           = caseKeyId;
+    }
+    bool IsProvisioningComplete() const { return mDeviceProvisioningComplete; }
+
+    //////////// SessionEstablishmentDelegate Implementation ///////////////
+    void OnSessionEstablishmentError(CHIP_ERROR error) override;
+    void OnSessionEstablished() override;
+
+    CASESession & GetCASESession() { return mCASESession; }
+
 private:
     enum class ConnectionState
     {
@@ -428,9 +446,18 @@ class DLL_EXPORT Device : public Messaging::ExchangeDelegate
      */
     void InitCommandSender();
 
+    CHIP_ERROR EstablishCASESession();
+
     uint16_t mListenPort;
 
     Transport::AdminId mAdminId = Transport::kUndefinedAdminId;
+
+    bool mDeviceProvisioningComplete = false;
+
+    CASESession mCASESession;
+    uint16_t mCASESessionKeyId = 0;
+
+    Credentials::OperationalCredentialSet * mCredentials = nullptr;
 };
 
 /**
@@ -479,9 +506,11 @@ typedef struct SerializableDevice
     PASESessionSerializable mOpsCreds;
     uint64_t mDeviceId; /* This field is serialized in LittleEndian byte order */
     uint8_t mDeviceAddr[INET6_ADDRSTRLEN];
-    uint16_t mDevicePort; /* This field is serialized in LittleEndian byte order */
-    uint16_t mAdminId;    /* This field is serialized in LittleEndian byte order */
+    uint16_t mDevicePort;       /* This field is serialized in LittleEndian byte order */
+    uint16_t mAdminId;          /* This field is serialized in LittleEndian byte order */
+    uint16_t mCASESessionKeyId; /* This field is serialized in LittleEndian byte order */
     uint8_t mDeviceTransport;
+    uint8_t mDeviceProvisioningComplete;
     uint8_t mInterfaceName[kMaxInterfaceName];
 } SerializableDevice;