Implemented CASEServer to fetch credentials, and wait for SigmaR1 (#6791

)

src/app/server/Server.cpp

@@ -33,6 +33,7 @@
 #include <messaging/ExchangeMgr.h>
 #include <platform/CHIPDeviceLayer.h>
 #include <platform/KeyValueStoreManager.h>
+#include <protocols/secure_channel/CASEServer.h>
 #include <protocols/secure_channel/MessageCounterManager.h>
 #include <setup_payload/SetupPayload.h>
 #include <support/CodeUtils.h>
@@ -285,6 +286,7 @@ class ServerRendezvousAdvertisementDelegate : public RendezvousAdvertisementDele
 DemoTransportMgr gTransports;
 SecureSessionMgr gSessions;
 RendezvousServer gRendezvousServer;
+CASEServer gCASEServer;
 Messaging::ExchangeManager gExchangeMgr;
 ServerRendezvousAdvertisementDelegate gAdvDelegate;
 
@@ -567,6 +569,9 @@ void InitServer(AppDelegate * delegate)
  err = gExchangeMgr.RegisterUnsolicitedMessageHandlerForProtocol(Protocols::ServiceProvisioning::Id, &gCallbacks);
  VerifyOrExit(err == CHIP_NO_ERROR, err = CHIP_ERROR_NO_UNSOLICITED_MESSAGE_HANDLER);
 
+ err = gCASEServer.ListenForSessionEstablishment(&gExchangeMgr, &gTransports, &gSessions, &GetGlobalAdminPairingTable());
+ SuccessOrExit(err);
+
 exit:
  if (err != CHIP_NO_ERROR)
  {

src/protocols/secure_channel/BUILD.gn

@@ -4,6 +4,8 @@ static_library("secure_channel") {
  output_name = "libSecureChannel"
 
  sources = [
+ "CASEServer.cpp",
+ "CASEServer.h",
  "CASESession.cpp",
  "CASESession.h",
  "PASESession.cpp",

src/protocols/secure_channel/CASEServer.cpp

@@ -0,0 +1,119 @@
+/*
+ *
+ * Copyright (c) 2021 Project CHIP Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <protocols/secure_channel/CASEServer.h>
+
+#include <core/CHIPError.h>
+#include <support/CodeUtils.h>
+#include <support/SafeInt.h>
+#include <transport/SecureSessionMgr.h>
+
+using namespace ::chip::Inet;
+using namespace ::chip::Transport;
+
+namespace chip {
+
+CHIP_ERROR CASEServer::ListenForSessionEstablishment(Messaging::ExchangeManager * exchangeManager, TransportMgrBase * transportMgr,
+ SecureSessionMgr * sessionMgr, Transport::AdminPairingTable * admins)
+{
+ VerifyOrReturnError(transportMgr != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
+ VerifyOrReturnError(exchangeManager != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
+ VerifyOrReturnError(sessionMgr != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
+ VerifyOrReturnError(admins != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
+
+ mSessionMgr = sessionMgr;
+ mAdmins = admins;
+ mExchangeManager = exchangeManager;
+
+ ReturnErrorOnFailure(mPairingSession.MessageDispatch().Init(transportMgr));
+
+ ReturnErrorOnFailure(
+ mExchangeManager->RegisterUnsolicitedMessageHandlerForType(Protocols::SecureChannel::MsgType::CASE_SigmaR1, this));
+ return CHIP_NO_ERROR;
+}
+
+CHIP_ERROR CASEServer::InitCASEHandshake(Messaging::ExchangeContext * ec)
+{
+ ReturnErrorCodeIf(ec == nullptr, CHIP_ERROR_INVALID_ARGUMENT);
+
+ // Lookup the admin that corresponds to the CASE session setup request.
+ // Each admin provisions their own credentials on the device. So it's essential to
+ // use the correct operational certificates for CASE session setup.
+ mAdminId = ec->GetSecureSession().GetAdminId();
+ ReturnErrorCodeIf(mAdminId == Transport::kUndefinedAdminId, CHIP_ERROR_INVALID_ARGUMENT);
+
+ Transport::AdminPairingInfo * admin = mAdmins->FindAdminWithId(mAdminId);
+ ReturnErrorCodeIf(admin == nullptr, CHIP_ERROR_INVALID_ARGUMENT);
+
+ ReturnErrorOnFailure(admin->GetOperationalCertificateSet(mCertificates));
+
+ mCredentials.Release();
+ ReturnErrorOnFailure(mCredentials.Init(&mCertificates, mCertificates.GetCertCount()));
+
+ // Setup CASE state machine using the credentials for the current admin.
+ ReturnErrorOnFailure(mPairingSession.ListenForSessionEstablishment(&mCredentials, mNextKeyId++, this));
+
+ // Hand over the exchange context to the CASE session.
+ ec->SetDelegate(&mPairingSession);
+
+ return CHIP_NO_ERROR;
+}
+
+void CASEServer::OnMessageReceived(Messaging::ExchangeContext * ec, const PacketHeader & packetHeader,
+ const PayloadHeader & payloadHeader, System::PacketBufferHandle payload)
+{
+ ReturnOnFailure(InitCASEHandshake(ec));
+ mPairingSession.OnMessageReceived(ec, packetHeader, payloadHeader, std::move(payload));
+
+ // TODO - Enable multiple concurrent CASE session establishment
+ // This will prevent CASEServer to process another CASE session establishment request until the current
+ // one completes (successfully or failed)
+ mExchangeManager->UnregisterUnsolicitedMessageHandlerForType(Protocols::SecureChannel::MsgType::CASE_SigmaR1);
+}
+
+void CASEServer::Cleanup()
+{
+ // Let's re-register for CASE SigmaR1 message, so that the next CASE session setup request can be processed.
+ mExchangeManager->RegisterUnsolicitedMessageHandlerForType(Protocols::SecureChannel::MsgType::CASE_SigmaR1, this);
+ mAdminId = Transport::kUndefinedAdminId;
+ mCredentials.Release();
+}
+
+void CASEServer::OnSessionEstablishmentError(CHIP_ERROR err)
+{
+ ChipLogProgress(AppServer, "CASE Session establishment failed: %s", ErrorStr(err));
+ Cleanup();
+}
+
+void CASEServer::OnSessionEstablished()
+{
+ ChipLogProgress(AppServer, "CASE Session established. Setting up the secure channel.");
+ CHIP_ERROR err =
+ mSessionMgr->NewPairing(Optional<Transport::PeerAddress>::Value(mPairingSession.PeerConnection().GetPeerAddress()),
+ mPairingSession.PeerConnection().GetPeerNodeId(), &mPairingSession,
+ SecureSession::SessionRole::kResponder, mAdminId, nullptr);
+ if (err != CHIP_NO_ERROR)
+ {
+ ChipLogError(Ble, "Failed in setting up secure channel: err %s", ErrorStr(err));
+ OnSessionEstablishmentError(err);
+ return;
+ }
+
+ ChipLogProgress(AppServer, "CASE secure channel is available now.");
+ Cleanup();
+}
+} // namespace chip

src/protocols/secure_channel/CASEServer.h

@@ -0,0 +1,74 @@
+/*
+ *
+ * Copyright (c) 2021 Project CHIP Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <messaging/ExchangeDelegate.h>
+#include <messaging/ExchangeMgr.h>
+#include <protocols/secure_channel/CASESession.h>
+
+namespace chip {
+
+class CASEServer : public SessionEstablishmentDelegate, public Messaging::ExchangeDelegateBase
+{
+public:
+ CASEServer() {}
+ ~CASEServer()
+ {
+ if (mExchangeManager != nullptr)
+ {
+ mExchangeManager->UnregisterUnsolicitedMessageHandlerForType(Protocols::SecureChannel::MsgType::CASE_SigmaR1);
+ }
+
+ mCredentials.Release();
+ }
+
+ CHIP_ERROR ListenForSessionEstablishment(Messaging::ExchangeManager * exchangeManager, TransportMgrBase * transportMgr,
+ SecureSessionMgr * sessionMgr, Transport::AdminPairingTable * admins);
+
+ //////////// SessionEstablishmentDelegate Implementation ///////////////
+ void OnSessionEstablishmentError(CHIP_ERROR error) override;
+ void OnSessionEstablished() override;
+
+ //// ExchangeDelegate Implementation ////
+ void OnMessageReceived(Messaging::ExchangeContext * ec, const PacketHeader & packetHeader, const PayloadHeader & payloadHeader,
+ System::PacketBufferHandle payload) override;
+ void OnResponseTimeout(Messaging::ExchangeContext * ec) override {}
+ Messaging::ExchangeMessageDispatch * GetMessageDispatch(Messaging::ReliableMessageMgr * reliableMessageManager,
+ SecureSessionMgr * sessionMgr) override
+ {
+ return mPairingSession.GetMessageDispatch(reliableMessageManager, sessionMgr);
+ }
+
+private:
+ Messaging::ExchangeManager * mExchangeManager = nullptr;
+
+ CASESession mPairingSession;
+ uint16_t mNextKeyId = 0;
+ SecureSessionMgr * mSessionMgr = nullptr;
+
+ Transport::AdminId mAdminId = Transport::kUndefinedAdminId;
+
+ Transport::AdminPairingTable * mAdmins = nullptr;
+ ChipCertificateSet mCertificates;
+ OperationalCredentialSet mCredentials;
+
+ CHIP_ERROR InitCASEHandshake(Messaging::ExchangeContext * ec);
+ void Cleanup();
+};
+
+} // namespace chip

src/protocols/secure_channel/CASESession.cpp

@@ -211,8 +211,8 @@ CHIP_ERROR CASESession::Init(OperationalCredentialSet * operationalCredentialSet
 }
 
 CHIP_ERROR
-CASESession::WaitForSessionEstablishment(OperationalCredentialSet * operationalCredentialSet, uint16_t myKeyId,
- SessionEstablishmentDelegate * delegate)
+CASESession::ListenForSessionEstablishment(OperationalCredentialSet * operationalCredentialSet, uint16_t myKeyId,
+  SessionEstablishmentDelegate * delegate)
 {
  ReturnErrorOnFailure(Init(operationalCredentialSet, myKeyId, delegate));
 

src/protocols/secure_channel/CASESession.h

@@ -93,8 +93,8 @@ class DLL_EXPORT CASESession : public Messaging::ExchangeDelegateBase, public Pa
  *
  * @return CHIP_ERROR The result of initialization
  */
- CHIP_ERROR WaitForSessionEstablishment(OperationalCredentialSet * operationalCredentialSet, uint16_t myKeyId,
- SessionEstablishmentDelegate * delegate);
+ CHIP_ERROR ListenForSessionEstablishment(OperationalCredentialSet * operationalCredentialSet, uint16_t myKeyId,
+  SessionEstablishmentDelegate * delegate);
 
  /**
  * @brief

src/protocols/secure_channel/tests/TestCASESession.cpp

@@ -108,8 +108,8 @@ void CASE_SecurePairingWaitTest(nlTestSuite * inSuite, void * inContext)
  TestCASESecurePairingDelegate delegate;
  CASESession pairing;
 
- NL_TEST_ASSERT(inSuite, pairing.WaitForSessionEstablishment(&accessoryDevOpCred, 0, nullptr) == CHIP_ERROR_INVALID_ARGUMENT);
- NL_TEST_ASSERT(inSuite, pairing.WaitForSessionEstablishment(&accessoryDevOpCred, 0, &delegate) == CHIP_NO_ERROR);
+ NL_TEST_ASSERT(inSuite, pairing.ListenForSessionEstablishment(&accessoryDevOpCred, 0, nullptr) == CHIP_ERROR_INVALID_ARGUMENT);
+ NL_TEST_ASSERT(inSuite, pairing.ListenForSessionEstablishment(&accessoryDevOpCred, 0, &delegate) == CHIP_NO_ERROR);
 }
 
 void CASE_SecurePairingStartTest(nlTestSuite * inSuite, void * inContext)
@@ -169,7 +169,7 @@ void CASE_SecurePairingHandshakeTestCommon(nlTestSuite * inSuite, void * inConte
  ExchangeContext * contextCommissioner = ctx.NewExchangeToLocal(&pairingCommissioner);
 
  NL_TEST_ASSERT(inSuite,
- pairingAccessory.WaitForSessionEstablishment(&accessoryDevOpCred, 0, &delegateAccessory) == CHIP_NO_ERROR);
+ pairingAccessory.ListenForSessionEstablishment(&accessoryDevOpCred, 0, &delegateAccessory) == CHIP_NO_ERROR);
  NL_TEST_ASSERT(inSuite,
  pairingCommissioner.EstablishSession(Transport::PeerAddress(Transport::Type::kBle), &commissionerDevOpCred, 1, 0,
  contextCommissioner, &delegateCommissioner) == CHIP_NO_ERROR);

src/transport/AdminPairingTable.cpp

@@ -25,6 +25,8 @@
 #include <transport/AdminPairingTable.h>
 
 namespace chip {
+using namespace Credentials;
+using namespace Crypto;
 
 namespace Transport {
 
@@ -49,7 +51,7 @@ CHIP_ERROR AdminPairingInfo::StoreIntoKVS(PersistentStorageDelegate * kvs)
  }
  else
  {
- Crypto::P256Keypair keypair;
+ P256Keypair keypair;
  SuccessOrExit(err = keypair.Initialize());
  SuccessOrExit(err = keypair.Serialize(info->mOperationalKey));
  }
@@ -115,7 +117,7 @@ CHIP_ERROR AdminPairingInfo::FetchFromKVS(PersistentStorageDelegate * kvs)
 
  if (mOperationalKey == nullptr)
  {
- mOperationalKey = chip::Platform::New<Crypto::P256Keypair>();
+ mOperationalKey = chip::Platform::New<P256Keypair>();
  }
  VerifyOrExit(mOperationalKey != nullptr, err = CHIP_ERROR_NO_MEMORY);
  SuccessOrExit(err = mOperationalKey->Deserialize(info->mOperationalKey));
@@ -160,13 +162,13 @@ CHIP_ERROR AdminPairingInfo::GenerateKey(AdminId id, char * key, size_t len)
  return CHIP_NO_ERROR;
 }
 
-CHIP_ERROR AdminPairingInfo::SetOperationalKey(const Crypto::P256Keypair & key)
+CHIP_ERROR AdminPairingInfo::SetOperationalKey(const P256Keypair & key)
 {
- Crypto::P256SerializedKeypair serialized;
+ P256SerializedKeypair serialized;
  ReturnErrorOnFailure(key.Serialize(serialized));
  if (mOperationalKey == nullptr)
  {
- mOperationalKey = chip::Platform::New<Crypto::P256Keypair>();
+ mOperationalKey = chip::Platform::New<P256Keypair>();
  }
  VerifyOrReturnError(mOperationalKey != nullptr, CHIP_ERROR_NO_MEMORY);
  return mOperationalKey->Deserialize(serialized);
@@ -248,6 +250,20 @@ CHIP_ERROR AdminPairingInfo::SetOperationalCert(const ByteSpan & cert)
  return CHIP_NO_ERROR;
 }
 
+CHIP_ERROR AdminPairingInfo::GetOperationalCertificateSet(ChipCertificateSet & certSet)
+{
+ constexpr uint8_t kMaxNumCertsInOpCreds = 3;
+ ReturnErrorOnFailure(certSet.Init(kMaxNumCertsInOpCreds, kMaxChipCertSize * kMaxNumCertsInOpCreds));
+
+ ReturnErrorOnFailure(
+ certSet.LoadCert(mRootCert, mRootCertLen,
+ BitFlags<CertDecodeFlags>(CertDecodeFlags::kIsTrustAnchor).Set(CertDecodeFlags::kGenerateTBSHash)));
+ // TODO - Add support of ICA certificates
+ ReturnErrorOnFailure(
+ certSet.LoadCert(mOperationalCert, mOpCertLen, BitFlags<CertDecodeFlags>(CertDecodeFlags::kGenerateTBSHash)));
+ return CHIP_NO_ERROR;
+}
+
 AdminPairingInfo * AdminPairingTable::AssignAdminId(AdminId adminId)
 {
  for (size_t i = 0; i < CHIP_CONFIG_MAX_DEVICE_ADMINS; i++)

src/transport/AdminPairingTable.h

@@ -23,6 +23,7 @@
 
 #include <app/util/basic-types.h>
 #include <core/CHIPPersistentStorageDelegate.h>
+#include <credentials/CHIPCert.h>
 #include <crypto/CHIPCryptoPAL.h>
 #include <support/CHIPMem.h>
 #include <support/DLLUtil.h>
@@ -42,11 +43,6 @@ constexpr char kAdminTableCountKey[] = "CHIPAdminNextId";
 
 constexpr uint16_t kMaxChipCertSize = 600;
 
-struct OperationalCredentials
-{
- uint32_t placeholder;
-};
-
 struct AccessControlList
 {
  uint32_t placeholder;
@@ -100,9 +96,7 @@ class DLL_EXPORT AdminPairingInfo
  CHIP_ERROR SetOperationalCert(const chip::ByteSpan & cert);
  CHIP_ERROR SetRootCert(const chip::ByteSpan & cert);
 
- const OperationalCredentials & GetOperationalCreds() const { return mOpCred; }
- OperationalCredentials & GetOperationalCreds() { return mOpCred; }
- void SetOperationalCreds(const OperationalCredentials & creds) { mOpCred = creds; }
+ CHIP_ERROR GetOperationalCertificateSet(Credentials::ChipCertificateSet & certSet);
 
  const AccessControlList & GetACL() const { return mACL; }
  AccessControlList & GetACL() { return mACL; }
@@ -131,12 +125,11 @@ class DLL_EXPORT AdminPairingInfo
  friend class AdminPairingTable;
 
 private:
- AdminId mAdmin = kUndefinedAdminId;
  NodeId mNodeId = kUndefinedNodeId;
  FabricId mFabricId = kUndefinedFabricId;
+ AdminId mAdmin = kUndefinedAdminId;
  uint16_t mVendorId = kUndefinedVendorId;
 
- OperationalCredentials mOpCred;
  AccessControlList mACL;
 
  Crypto::P256Keypair * mOperationalKey = nullptr;