Remove controller API for device pairing without security (#10935)

* Remove controller API for device pairing using test keys

* remove from Android/JNI

docs/QUICK_START.md

@@ -7,10 +7,10 @@ platforms.
 
 ## Wi-Fi Nodes
 
-| <div style="width:200px">Controller / Admin</div> | <div style="width:200px">Node</div> | Description  |
-| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [**chip-tool**](https://github.com/project-chip/connectedhomeip/blob/master/examples/chip-tool/README.md) (Linux / Mac)<br> Includes docs for all the cluster commands supported <br> | **all-clusters-app** <li> [M5Stack](https://github.com/project-chip/connectedhomeip/blob/master/examples/all-clusters-app/esp32/README.md) (ESP)<li>[Linux](https://github.com/project-chip/connectedhomeip/tree/master/examples/all-clusters-app/linux) simulation | Use the command line tool on a laptop to pair with and control an embedded Wi-Fi platform. This demo supports the “all-clusters-app”, so it provides the basic onoff light test and more. Two incremental modes of operation are supported for testing (configurable via Kconfig tool when building M5): <ol><li> Unsecured (Wi-Fi only) <br> Bluetooth LE Rendezvous Mode Bypass = 1 <li> PASE secured <br> (BLE pairing, Wi-Fi operational) </ol> |
-| [**chip-device-ctrl.py**](https://github.com/project-chip/connectedhomeip/blob/master/src/controller/python/README.md) | **all-clusters-app**<li> [M5Stack](https://github.com/project-chip/connectedhomeip/blob/master/examples/all-clusters-app/esp32/README.md) (ESP)<li> [Linux](https://github.com/project-chip/connectedhomeip/tree/master/examples/all-clusters-app/linux) simulation | Same as above, but uses the pychip tool as Controller Node, and focuses on Bluetooth LE flow rather than Bypass.  |
+| <div style="width:200px">Controller / Admin</div> | <div style="width:200px">Node</div> | Description |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [**chip-tool**](https://github.com/project-chip/connectedhomeip/blob/master/examples/chip-tool/README.md) (Linux / Mac)<br> Includes docs for all the cluster commands supported <br> | **all-clusters-app** <li> [M5Stack](https://github.com/project-chip/connectedhomeip/blob/master/examples/all-clusters-app/esp32/README.md) (ESP)<li>[Linux](https://github.com/project-chip/connectedhomeip/tree/master/examples/all-clusters-app/linux) simulation | Use the command line tool on a laptop to pair with and control an embedded Wi-Fi platform. This demo supports the “all-clusters-app”, so it provides the basic onoff light test and more. |
+| [**chip-device-ctrl.py**](https://github.com/project-chip/connectedhomeip/blob/master/src/controller/python/README.md) | **all-clusters-app**<li> [M5Stack](https://github.com/project-chip/connectedhomeip/blob/master/examples/all-clusters-app/esp32/README.md) (ESP)<li> [Linux](https://github.com/project-chip/connectedhomeip/tree/master/examples/all-clusters-app/linux) simulation | Same as above, but uses the pychip tool as Controller Node. |
 
 ## Thread Nodes
 

examples/chip-tool/commands/pairing/Commands.h

@@ -26,12 +26,6 @@ class Unpair : public PairingCommand
  Unpair() : PairingCommand("unpair", PairingMode::None, PairingNetworkType::None) {}
 };
 
-class PairBypass : public PairingCommand
-{
-public:
- PairBypass() : PairingCommand("bypass", PairingMode::Bypass, PairingNetworkType::None) {}
-};
-
 class PairQRCode : public PairingCommand
 {
 public:
@@ -159,7 +153,6 @@ void registerCommandsPairing(Commands & commands)
 
  commands_list clusterCommands = {
  make_unique<Unpair>(),
- make_unique<PairBypass>(),
  make_unique<PairQRCode>(),
  make_unique<PairManualCode>(),
  make_unique<PairBleWiFi>(),

examples/chip-tool/commands/pairing/PairingCommand.cpp

@@ -57,9 +57,6 @@ CHIP_ERROR PairingCommand::RunInternal(NodeId remoteId)
  case PairingMode::None:
  err = Unpair(remoteId);
  break;
- case PairingMode::Bypass:
- err = PairWithoutSecurity(remoteId, PeerAddress::UDP(mRemoteAddr.address, mRemotePort));
- break;
  case PairingMode::QRCode:
  err = PairWithQRCode(remoteId);
  break;
@@ -151,12 +148,6 @@ CHIP_ERROR PairingCommand::PairWithMdns(NodeId remoteId)
  return mController.DiscoverCommissionableNodes(filter);
 }
 
-CHIP_ERROR PairingCommand::PairWithoutSecurity(NodeId remoteId, PeerAddress address)
-{
- ChipSerializedDevice serializedTestDevice;
- return mController.PairTestDeviceWithoutSecurity(remoteId, address, serializedTestDevice);
-}
-
 CHIP_ERROR PairingCommand::Unpair(NodeId remoteId)
 {
  CHIP_ERROR err = mController.UnpairDevice(remoteId);

examples/chip-tool/commands/pairing/PairingCommand.h

@@ -31,7 +31,6 @@
 enum class PairingMode
 {
  None,
- Bypass,
  QRCode,
  ManualCode,
  Ble,
@@ -82,10 +81,6 @@ class PairingCommand : public CHIPCommand,
  {
  case PairingMode::None:
  break;
- case PairingMode::Bypass:
- AddArgument("device-remote-ip", &mRemoteAddr);
- AddArgument("device-remote-port", 0, UINT16_MAX, &mRemotePort);
- break;
  case PairingMode::QRCode:
  case PairingMode::ManualCode:
  AddArgument("payload", &mOnboardingPayload);
@@ -176,7 +171,6 @@ class PairingCommand : public CHIPCommand,
  CHIP_ERROR PairWithQRCode(NodeId remoteId);
  CHIP_ERROR PairWithManualCode(NodeId remoteId);
  CHIP_ERROR PairWithCode(NodeId remoteId, chip::SetupPayload payload);
- CHIP_ERROR PairWithoutSecurity(NodeId remoteId, PeerAddress address);
  CHIP_ERROR Unpair(NodeId remoteId);
  CHIP_ERROR OpenCommissioningWindow();
 

src/controller/CHIPDeviceController.cpp

@@ -819,78 +819,6 @@ CHIP_ERROR DeviceCommissioner::PairDevice(NodeId remoteDeviceId, RendezvousParam
  return err;
 }
 
-CHIP_ERROR DeviceCommissioner::PairTestDeviceWithoutSecurity(NodeId remoteDeviceId, const Transport::PeerAddress & peerAddress,
- SerializedDevice & serialized)
-{
- CHIP_ERROR err = CHIP_NO_ERROR;
- Device * device = nullptr;
-
- SecurePairingUsingTestSecret * testSecurePairingSecret = nullptr;
-
- // Check that the caller has provided an IP address (instead of a BLE peer address)
- VerifyOrExit(peerAddress.GetTransportType() == Transport::Type::kUdp, err = CHIP_ERROR_INVALID_ARGUMENT);
- VerifyOrExit(IsOperationalNodeId(remoteDeviceId), err = CHIP_ERROR_INVALID_ARGUMENT);
-
- VerifyOrExit(mState == State::Initialized, err = CHIP_ERROR_INCORRECT_STATE);
- VerifyOrExit(mDeviceBeingPaired == kNumMaxActiveDevices, err = CHIP_ERROR_INCORRECT_STATE);
-
- testSecurePairingSecret = chip::Platform::New<SecurePairingUsingTestSecret>();
- VerifyOrExit(testSecurePairingSecret != nullptr, err = CHIP_ERROR_NO_MEMORY);
-
- mDeviceBeingPaired = GetInactiveDeviceIndex();
- VerifyOrExit(mDeviceBeingPaired < kNumMaxActiveDevices, err = CHIP_ERROR_NO_MEMORY);
- device = &mActiveDevices[mDeviceBeingPaired];
-
- testSecurePairingSecret->ToSerializable(device->GetPairing());
-
- device->Init(GetControllerDeviceInitParams(), remoteDeviceId, peerAddress, mFabricIndex);
-
- device->Serialize(serialized);
-
- err = mSystemState->SessionMgr()->NewPairing(Optional<Transport::PeerAddress>::Value(peerAddress), device->GetDeviceId(),
- testSecurePairingSecret, CryptoContext::SessionRole::kInitiator, mFabricIndex);
- if (err != CHIP_NO_ERROR)
- {
- ChipLogError(Controller, "Failed in setting up secure channel: err %s", ErrorStr(err));
- OnSessionEstablishmentError(err);
- }
- SuccessOrExit(err);
-
- mPairedDevices.Insert(device->GetDeviceId());
- mPairedDevicesUpdated = true;
-
- // Note - This assumes storage is synchronous, the device must be in storage before we can cleanup
- // the rendezvous session and mark pairing success
- PersistDevice(device);
- // Also persist the device list at this time
- // This makes sure that a newly added device is immediately available
- PersistDeviceList();
-
- if (mPairingDelegate != nullptr)
- {
- mPairingDelegate->OnStatusUpdate(DevicePairingDelegate::SecurePairingSuccess);
- }
-
- RendezvousCleanup(CHIP_NO_ERROR);
-
-exit:
- if (testSecurePairingSecret != nullptr)
- {
- chip::Platform::Delete(testSecurePairingSecret);
- }
-
- if (err != CHIP_NO_ERROR)
- {
- if (device != nullptr)
- {
- ReleaseDevice(device);
- mDeviceBeingPaired = kNumMaxActiveDevices;
- }
- }
-
- return err;
-}
-
 CHIP_ERROR DeviceCommissioner::StopPairing(NodeId remoteDeviceId)
 {
  VerifyOrReturnError(mState == State::Initialized, CHIP_ERROR_INCORRECT_STATE);

src/controller/CHIPDeviceController.h

@@ -412,9 +412,6 @@ class DLL_EXPORT DeviceCommissioner : public DeviceController,
  */
  CHIP_ERROR PairDevice(NodeId remoteDeviceId, RendezvousParameters & params);
 
- [[deprecated("Available until Rendezvous is implemented")]] CHIP_ERROR
- PairTestDeviceWithoutSecurity(NodeId remoteDeviceId, const Transport::PeerAddress & peerAddress, SerializedDevice & serialized);
-
  /**
  * @brief
  * This function stops a pairing process that's in progress. It does not delete the pairing of a previously

src/controller/java/CHIPDeviceController-JNI.cpp

@@ -286,30 +286,6 @@ JNI_METHOD(void, getConnectedDevicePointer)(JNIEnv * env, jobject self, jlong ha
  wrapper->Controller()->GetConnectedDevice(nodeId, &connectedDeviceCallback->mOnSuccess, &connectedDeviceCallback->mOnFailure);
 }
 
-JNI_METHOD(void, pairTestDeviceWithoutSecurity)(JNIEnv * env, jobject self, jlong handle, jstring deviceAddr)
-{
- chip::DeviceLayer::StackLock lock;
- CHIP_ERROR err = CHIP_NO_ERROR;
- AndroidDeviceControllerWrapper * wrapper = AndroidDeviceControllerWrapper::FromJNIHandle(handle);
- chip::Inet::IPAddress deviceIPAddr;
-
- ChipLogProgress(Controller, "pairTestDeviceWithoutSecurity() called with IP Address");
-
- const char * deviceAddrStr = env->GetStringUTFChars(deviceAddr, 0);
- deviceIPAddr.FromString(deviceAddrStr, deviceIPAddr);
- env->ReleaseStringUTFChars(deviceAddr, deviceAddrStr);
-
- Controller::SerializedDevice mSerializedTestDevice;
- err = wrapper->Controller()->PairTestDeviceWithoutSecurity(kRemoteDeviceId, chip::Transport::PeerAddress::UDP(deviceIPAddr),
- mSerializedTestDevice);
-
- if (err != CHIP_NO_ERROR)
- {
- ChipLogError(Controller, "Failed to connect to device.");
- ThrowError(env, err);
- }
-}
-
 JNI_METHOD(void, disconnectDevice)(JNIEnv * env, jobject self, jlong handle, jlong deviceId)
 {
  chip::DeviceLayer::StackLock lock;

src/controller/java/src/chip/devicecontroller/ChipDeviceController.java

@@ -100,10 +100,6 @@ public void unpairDevice(long deviceId) {
  unpairDevice(deviceControllerPtr, deviceId);
  }
 
- public void pairTestDeviceWithoutSecurity(String ipAddress) {
- pairTestDeviceWithoutSecurity(deviceControllerPtr, ipAddress);
- }
-
  /**
  * Through GetConnectedDeviceCallback, returns a pointer to a connected device or an error.
  *
@@ -253,8 +249,6 @@ private native void pairDeviceWithAddress(
  private native void getConnectedDevicePointer(
  long deviceControllerPtr, long deviceId, long callbackHandle);
 
- private native void pairTestDeviceWithoutSecurity(long deviceControllerPtr, String ipAddress);
-
  private native boolean disconnectDevice(long deviceControllerPtr, long deviceId);
 
  private native void deleteDeviceController(long deviceControllerPtr);

src/darwin/Framework/CHIP/CHIPDeviceController.h

@@ -49,11 +49,6 @@ typedef void (^CHIPDeviceConnectionCallback)(CHIPDevice * _Nullable device, NSEr
  setupPINCode:(uint32_t)setupPINCode
  error:(NSError * __autoreleasing *)error;
 
-- (BOOL)pairDeviceWithoutSecurity:(uint64_t)deviceID
- address:(NSString *)address
- port:(uint16_t)port
- error:(NSError * __autoreleasing *)error;
-
 - (BOOL)pairDevice:(uint64_t)deviceID
  onboardingPayload:(NSString *)onboardingPayload
  onboardingPayloadType:(CHIPOnboardingPayloadType)onboardingPayloadType

src/darwin/Framework/CHIP/CHIPDeviceController.mm

@@ -320,33 +320,6 @@ - (BOOL)pairDevice:(uint64_t)deviceID
  return success;
 }
 
-- (BOOL)pairDeviceWithoutSecurity:(uint64_t)deviceID
- address:(NSString *)address
- port:(uint16_t)port
- error:(NSError * __autoreleasing *)error
-{
- __block CHIP_ERROR errorCode = CHIP_ERROR_INCORRECT_STATE;
- __block BOOL success = NO;
- if (![self isRunning]) {
- success = ![self checkForError:errorCode logMsg:kErrorNotRunning error:error];
- return success;
- }
- dispatch_sync(_chipWorkQueue, ^{
- chip::Controller::SerializedDevice serializedTestDevice;
- chip::Inet::IPAddress addr;
- chip::Inet::IPAddress::FromString([address UTF8String], addr);
-
- if ([self isRunning]) {
- _operationalCredentialsDelegate->SetDeviceID(deviceID);
- errorCode = _cppCommissioner->PairTestDeviceWithoutSecurity(
- deviceID, chip::Transport::PeerAddress::UDP(addr, port), serializedTestDevice);
- }
- success = ![self checkForError:errorCode logMsg:kErrorPairDevice error:error];
- });
-
- return success;
-}
-
 - (BOOL)pairDevice:(uint64_t)deviceID
  onboardingPayload:(NSString *)onboardingPayload
  onboardingPayloadType:(CHIPOnboardingPayloadType)onboardingPayloadType