-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove direct operational certs access from FabricInfo #19531
Merged
tcarmelveilleux
merged 8 commits into
project-chip:master
from
tcarmelveilleux:opcert-refactor2
Jun 13, 2022
Merged
Remove direct operational certs access from FabricInfo #19531
tcarmelveilleux
merged 8 commits into
project-chip:master
from
tcarmelveilleux:opcert-refactor2
Jun 13, 2022
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
To support moving to non-permanent storage, need to ensure there is never direct access to certificates from FabricInfo classes outside the FabricTable which owns all validations. This prevents dangling FabricInfo instances and enables the changes needed to make the fail-safe work to spec for AddNOC, UpdateNOC and AddTrustedRootCertificate. Issue project-chip#15585 Issue project-chip#7695 - Always go through the FabricTable, don't allow going directly via FabricInfo - Updated CASESession to go through FabricTable also - Getters for certs and root public key are now copying operations, rather than updating a ByteSpan to internally owned data (which may be stale!) - First step towards moving to spec-compliant lifecycle for UpdateNOC with the same model as OperationalKeystore - No functional changes, only structural changes Testing done: - Cert tests still pass - Unit tests still pass
pullapprove
bot
requested review from
andy31415,
anush-apple,
arkq,
Byungjoo-Lee,
bzbarsky-apple,
carol-apple,
chrisdecenzo,
chshu,
chulspro,
Damian-Nordic,
dhrishi,
electrocucaracha,
erjiaqing,
franck-apple,
gjc13,
hawk248,
harsha-rajendran,
isiu-apple,
jelderton,
jepenven-silabs,
jmartinez-silabs,
jtung-apple,
kpschoedel,
lazarkov and
LuDuda
June 13, 2022 16:30
pullapprove
bot
requested review from
wbschiller,
woody-apple,
xylophone21,
yufengwangca and
yunhanw-google
June 13, 2022 16:30
andy31415
approved these changes
Jun 13, 2022
src/app/clusters/operational-credentials-server/operational-credentials-server.cpp
Show resolved
Hide resolved
src/app/clusters/operational-credentials-server/operational-credentials-server.cpp
Outdated
Show resolved
Hide resolved
PR #19531: Size comparison from 0e9b2cc to 0952ad5 Increases (34 builds for cc13x2_26x2, cyw30739, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (5 builds for cc13x2_26x2)
Full report (34 builds for cc13x2_26x2, cyw30739, k32w, linux, mbed, nrfconnect, p6, telink)
|
PR #19531: Size comparison from 0e9b2cc to d956b35 Increases (34 builds for cc13x2_26x2, cyw30739, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (5 builds for cc13x2_26x2)
Full report (34 builds for cc13x2_26x2, cyw30739, k32w, linux, mbed, nrfconnect, p6, telink)
|
msandstedt
approved these changes
Jun 13, 2022
PR #19531: Size comparison from 0e9b2cc to 4a69a1d Increases (34 builds for cc13x2_26x2, cyw30739, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (5 builds for cc13x2_26x2)
Full report (34 builds for cc13x2_26x2, cyw30739, k32w, linux, mbed, nrfconnect, p6, telink)
|
bzbarsky-apple
requested changes
Jun 13, 2022
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The Darwin bits need something slightly different....
bzbarsky-apple
approved these changes
Jun 13, 2022
Fix build on Darwin
PR #19531: Size comparison from 0e9b2cc to c7a2f29 Increases (34 builds for cc13x2_26x2, cyw30739, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (5 builds for cc13x2_26x2)
Full report (34 builds for cc13x2_26x2, cyw30739, k32w, linux, mbed, nrfconnect, p6, telink)
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
To support moving to non-permanent storage, need to ensure
there is never direct access to certificates from FabricInfo classes
outside the FabricTable which owns all validations. This prevents
dangling FabricInfo instances and enables the changes needed to
make the fail-safe work to spec for AddNOC, UpdateNOC and
AddTrustedRootCertificate.
Issue #15585
Issue #7695
Change overview
FabricInfo
rather than updating a ByteSpan to internally owned data (which
may be stale!)
with the same model as OperationalKeystore
Testing