Skip to content

Commit

Permalink
Added New Credentials Validity Checks for UpdateNOC Command. (#18866)
Browse files Browse the repository at this point in the history
* Added New Credentials Validity Checks for UpdateNOC Command.

* Added Reset of gFabricBeingCommissioned object at the end of the UpdateNOC process.
  • Loading branch information
emargolis authored and pull[bot] committed Feb 2, 2024
1 parent 5d6fd6e commit 1158688
Show file tree
Hide file tree
Showing 2 changed files with 34 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -801,6 +801,7 @@ bool emberAfOperationalCredentialsClusterUpdateNOCCallback(app::CommandHandler *

FailSafeContext & failSafeContext = DeviceControlServer::DeviceControlSvr().GetFailSafeContext();
FabricInfo * fabric = RetrieveCurrentFabric(commandObj);
ByteSpan rcac;

VerifyOrExit(NOCValue.size() <= Credentials::kMaxCHIPCertLength, nonDefaultStatus = Status::InvalidCommand);
VerifyOrExit(!ICACValue.HasValue() || ICACValue.Value().size() <= Credentials::kMaxCHIPCertLength,
Expand All @@ -814,10 +815,35 @@ bool emberAfOperationalCredentialsClusterUpdateNOCCallback(app::CommandHandler *
VerifyOrExit(fabric != nullptr, nocResponse = ConvertToNOCResponseStatus(CHIP_ERROR_INSUFFICIENT_PRIVILEGE));
fabricIndex = fabric->GetFabricIndex();

err = fabric->SetNOCCert(NOCValue);
// Initialize fields of gFabricBeingCommissioned:
// - the root certificate, fabric label, and vendor id are copied from the existing fabric record
// - the NOC and ICAC certificates are taken from the UpdateNOC command
// Note that the operational keypair was set at the preceding CSRRequest step.
// The remaining operation id and fabric id fields will be extracted from the new operational
// credentials and set by following SetFabricInfo() call.
{
err = fabric->GetRootCert(rcac);
VerifyOrExit(err == CHIP_NO_ERROR, nocResponse = ConvertToNOCResponseStatus(err));

err = gFabricBeingCommissioned.SetRootCert(rcac);
VerifyOrExit(err == CHIP_NO_ERROR, nocResponse = ConvertToNOCResponseStatus(err));

err = gFabricBeingCommissioned.SetFabricLabel(fabric->GetFabricLabel());
VerifyOrExit(err == CHIP_NO_ERROR, nocResponse = ConvertToNOCResponseStatus(err));

gFabricBeingCommissioned.SetVendorId(fabric->GetVendorId());

err = gFabricBeingCommissioned.SetNOCCert(NOCValue);
VerifyOrExit(err == CHIP_NO_ERROR, nocResponse = ConvertToNOCResponseStatus(err));

err = gFabricBeingCommissioned.SetICACert(ICACValue);
VerifyOrExit(err == CHIP_NO_ERROR, nocResponse = ConvertToNOCResponseStatus(err));
}

err = fabric->SetFabricInfo(gFabricBeingCommissioned);
VerifyOrExit(err == CHIP_NO_ERROR, nocResponse = ConvertToNOCResponseStatus(err));

err = fabric->SetICACert(ICACValue);
err = Server::GetInstance().GetFabricTable().Store(fabricIndex);
VerifyOrExit(err == CHIP_NO_ERROR, nocResponse = ConvertToNOCResponseStatus(err));

// Flag on the fail-safe context that the UpdateNOC command was invoked.
Expand All @@ -830,6 +856,7 @@ bool emberAfOperationalCredentialsClusterUpdateNOCCallback(app::CommandHandler *
app::DnssdServer::Instance().StartServer();

exit:
gFabricBeingCommissioned.Reset();
// We have an NOC response
if (nonDefaultStatus == Status::Success)
{
Expand Down
5 changes: 5 additions & 0 deletions src/credentials/FabricTable.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -609,6 +609,11 @@ CHIP_ERROR FabricInfo::SetFabricInfo(FabricInfo & newFabric)
VerifyOrReturnError(memcmp(operationalKey->Pubkey().ConstBytes(), pubkey.Bytes(), pubkey.Length()) == 0,
CHIP_ERROR_INVALID_PUBLIC_KEY);

if (mFabricId != kUndefinedFabricId)
{
VerifyOrReturnError(mFabricId == fabricId, CHIP_ERROR_UNSUPPORTED_CERT_FORMAT);
}

if (newFabric.mHasExternallyOwnedOperationalKey)
{
ReturnErrorOnFailure(SetExternallyOwnedOperationalKeypair(operationalKey));
Expand Down

0 comments on commit 1158688

Please sign in to comment.