Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed/Added CASE Identity Checks. #15829

Conversation

emargolis
Copy link
Contributor

@emargolis emargolis commented Mar 3, 2022

Problem

CASE identity checks are not done (#8859)

Following Spec clarifications:
Add missing identity checks in CASE #3682

Change overview

Added checks:
-- Verify that peer NOC FabricId matches the expected Fabric ID.
-- On Processing of Sigma2: Verify that peer NodeId matches one used to generate
Destination Identifier in Sigma1.
-- On Processing of Sigma3: Assign peer NodeId from peer NOC.
-- If root certificate includes Fabric ID verify it matches ICAC and NOC Fabric IDs.

Testing

Existing tests

@github-actions
Copy link

github-actions bot commented Mar 3, 2022

PR #15829: Size comparison from 5a8ffc1 to 67fe3ef

Increases (21 builds for cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, qpg, telink)
platform target config section 5a8ffc1 67fe3ef change % change
cyw30739 light cyw930739m2evb_01 (read/write) 600294 600402 108 0.0
.app_xip_area 505316 505424 108 0.0
lock cyw930739m2evb_01 (read/write) 558290 558398 108 0.0
.app_xip_area 464848 464956 108 0.0
ota-requestor cyw930739m2evb_01 (read/write) 580290 580398 108 0.0
.app_xip_area 477128 477236 108 0.0
efr32 lighting-app BRD4161A (read only) 919804 919932 128 0.0
.text 919796 919924 128 0.0
BRD4161A+rpc (read only) 949880 950008 128 0.0
.text 949872 950000 128 0.0
lock-app BRD4161A+wf200 (read only) 988140 988268 128 0.0
.text 988132 988260 128 0.0
window-app BRD4161A (read only) 853136 853248 112 0.0
.text 853128 853240 112 0.0
esp32 all-clusters-app c3devkit (read only) 953132 953248 116 0.0
.flash.text 953132 953248 116 0.0
m5stack (read only) 1008407 1008523 116 0.0
.flash.text 1003023 1003139 116 0.0
k32w light k32w061+release (read/write) 694008 694120 112 0.0
.text 608556 608668 112 0.0
lock k32w061+release (read/write) 695760 695872 112 0.0
.text 610372 610484 112 0.0
linux chip-tool-ipv6only arm64 (read only) 9097844 9098164 320 0.0
.text 7706468 7706788 320 0.0
thermostat-no-ble arm64 (read only) 2169156 2169476 320 0.0
.text 1817984 1818304 320 0.0
mbed lock-app CY8CPROTO_062_4343W+release (read/write) 2350772 2350916 144 0.0
.text 1313372 1313516 144 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 (read/write) 1078115 1078227 112 0.0
text 731896 732008 112 0.0
p6 all-clusters-app default (read/write) 2489608 2489736 128 0.0
.text 1447872 1448000 128 0.0
light-app default (read/write) 2396728 2396856 128 0.0
.text 1354992 1355120 128 0.0
lock-app default (read/write) 2360240 2360368 128 0.0
.text 1318504 1318632 128 0.0
qpg lighting-app qpg6105+debug (read only) 603152 603256 104 0.0
.text 597832 597936 104 0.0
lock-app qpg6105+debug (read only) 568836 568940 104 0.0
.text 563516 563620 104 0.0
telink lighting-app tlsr9518adk80d (read/write) 887462 887582 120 0.0
text 626986 627108 122 0.0
Full report (22 builds for cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, qpg, telink)
platform target config section 5a8ffc1 67fe3ef change % change
cyw30739 light cyw930739m2evb_01 (read/write) 600294 600402 108 0.0
.app_xip_area 505316 505424 108 0.0
.bss 77660 77660 0 0.0
.data 660 660 0 0.0
.rodata 0 0 0 0.0
.text 0 0 0 0.0
lock cyw930739m2evb_01 (read/write) 558290 558398 108 0.0
.app_xip_area 464848 464956 108 0.0
.bss 76164 76164 0 0.0
.data 624 624 0 0.0
.rodata 0 0 0 0.0
.text 0 0 0 0.0
ota-requestor cyw930739m2evb_01 (read/write) 580290 580398 108 0.0
.app_xip_area 477128 477236 108 0.0
.bss 85524 85524 0 0.0
.data 600 600 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
efr32 lighting-app BRD4161A (read only) 919804 919932 128 0.0
(read/write) 128840 128840 0 0.0
.bss 126752 126752 0 0.0
.data 2088 2088 0 0.0
.text 919796 919924 128 0.0
BRD4161A+rpc (read only) 949880 950008 128 0.0
(read/write) 145784 145784 0 0.0
.bss 143528 143528 0 0.0
.data 2252 2252 0 0.0
.text 949872 950000 128 0.0
lock-app BRD4161A+wf200 (read only) 988140 988268 128 0.0
(read/write) 120312 120312 0 0.0
.bss 118380 118380 0 0.0
.data 1932 1932 0 0.0
.text 988132 988260 128 0.0
window-app BRD4161A (read only) 853136 853248 112 0.0
(read/write) 126784 126784 0 0.0
.bss 124856 124856 0 0.0
.data 1924 1924 0 0.0
.text 853128 853240 112 0.0
esp32 all-clusters-app c3devkit (read only) 953132 953248 116 0.0
(read/write) 1392570 1392570 0 0.0
.dram0.bss 62536 62536 0 0.0
.dram0.data 14236 14236 0 0.0
.flash.rodata 196880 196880 0 0.0
.flash.text 953132 953248 116 0.0
.iram0.text 62016 62016 0 0.0
m5stack (read only) 1008407 1008523 116 0.0
(read/write) 459692 459692 0 0.0
.dram0.bss 68056 68056 0 0.0
.dram0.data 34080 34080 0 0.0
.flash.rodata 225720 225720 0 0.0
.flash.text 1003023 1003139 116 0.0
.iram0.text 123107 123107 0 0.0
k32w light k32w061+release (read/write) 694008 694120 112 0.0
.bss 77680 77680 0 0.0
.data 1972 1972 0 0.0
.text 608556 608668 112 0.0
lock k32w061+release (read/write) 695760 695872 112 0.0
.bss 77616 77616 0 0.0
.data 1972 1972 0 0.0
.text 610372 610484 112 0.0
linux chip-tool-ipv6only arm64 (read only) 9097844 9098164 320 0.0
(read/write) 418529 418529 0 0.0
.bss 43761 43761 0 0.0
.data 1192 1192 0 0.0
.data.rel.ro 317936 317936 0 0.0
.dynamic 560 560 0 0.0
.got 51856 51856 0 0.0
.init 24 24 0 0.0
.init_array 192 192 0 0.0
.rodata 473628 473628 0 0.0
.text 7706468 7706788 320 0.0
thermostat-no-ble arm64 (read only) 2169156 2169476 320 0.0
(read/write) 148417 148417 0 0.0
.bss 65121 65121 0 0.0
.data 1072 1072 0 0.0
.data.rel.ro 75048 75048 0 0.0
.dynamic 560 560 0 0.0
.got 4216 4216 0 0.0
.init 24 24 0 0.0
.init_array 352 352 0 0.0
.rodata 132900 132900 0 0.0
.text 1817984 1818304 320 0.0
mbed lock-app CY8CPROTO_062_4343W+release (read only) 6224 6224 0 0.0
(read/write) 2350772 2350916 144 0.0
.bss 187036 187036 0 0.0
.data 5784 5784 0 0.0
.text 1313372 1313516 144 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 (read/write) 1078115 1078227 112 0.0
bss 128900 128900 0 0.0
rodata 142028 142028 0 0.0
text 731896 732008 112 0.0
p6 all-clusters-app default (read/write) 2489608 2489736 128 0.0
.bss 118608 118608 0 0.0
.data 2696 2696 0 0.0
.text 1447872 1448000 128 0.0
light-app default (read/write) 2396728 2396856 128 0.0
.bss 112920 112920 0 0.0
.data 2544 2544 0 0.0
.text 1354992 1355120 128 0.0
lock-app default (read/write) 2360240 2360368 128 0.0
.bss 112664 112664 0 0.0
.data 2504 2504 0 0.0
.text 1318504 1318632 128 0.0
qpg lighting-app qpg6105+debug (read only) 603152 603256 104 0.0
(read/write) 146936 146936 0 0.0
.bss 91056 91056 0 0.0
.data 1172 1172 0 0.0
.text 597832 597936 104 0.0
lock-app qpg6105+debug (read only) 568836 568940 104 0.0
(read/write) 146936 146936 0 0.0
.bss 91064 91064 0 0.0
.data 1124 1124 0 0.0
.text 563516 563620 104 0.0
persistent-storage-app qpg6105+debug (read only) 99520 99520 0 0.0
(read/write) 146940 146940 0 0.0
.bss 24004 24004 0 0.0
.data 176 176 0 0.0
.text 94200 94200 0 0.0
telink lighting-app tlsr9518adk80d (read/write) 887462 887582 120 0.0
bss 86864 86864 0 0.0
noinit 37160 37160 0 0.0
text 626986 627108 122 0.0

src/credentials/FabricTable.cpp Outdated Show resolved Hide resolved
src/credentials/FabricTable.cpp Outdated Show resolved Hide resolved
Added checks:
  -- Verify that peer NOC FabricId matches the expected Fabric ID.
  -- On Processing of Sigma2: Verify that peer NodeId matches one used to generate
     Destination Identifier in Sigma1.
  -- On Processing of Sigma3: Assign peer NodeId from peer NOC.
  -- If root certificate includes Fabric ID verify it matches ICAC and NOC Fabric IDs.
@emargolis emargolis force-pushed the emargolis/feature/case-identity-check branch from 67fe3ef to 36e101f Compare March 4, 2022 14:24
@github-actions
Copy link

github-actions bot commented Mar 4, 2022

PR #15829: Size comparison from 9dcdf37 to 36e101f

Increases (30 builds for cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, qpg, telink)
platform target config section 9dcdf37 36e101f change % change
cyw30739 light cyw930739m2evb_01 (read/write) 600286 600394 108 0.0
.app_xip_area 505308 505416 108 0.0
lock cyw930739m2evb_01 (read/write) 558282 558390 108 0.0
.app_xip_area 464840 464948 108 0.0
ota-requestor cyw930739m2evb_01 (read/write) 580226 580334 108 0.0
.app_xip_area 477112 477220 108 0.0
efr32 lighting-app BRD4161A (read only) 919740 919868 128 0.0
.text 919732 919860 128 0.0
BRD4161A+rpc (read only) 948560 948688 128 0.0
.text 948552 948680 128 0.0
lock-app BRD4161A+wf200 (read only) 988140 988252 112 0.0
.text 988132 988244 112 0.0
window-app BRD4161A (read only) 853120 853232 112 0.0
.text 853112 853224 112 0.0
esp32 all-clusters-app c3devkit (read only) 953148 953266 118 0.0
.flash.text 953148 953266 118 0.0
m5stack (read only) 1008319 1008499 180 0.0
.flash.text 1002935 1003115 180 0.0
k32w light k32w061+release (read/write) 693896 694008 112 0.0
.text 608492 608604 112 0.0
lock k32w061+release (read/write) 695744 695856 112 0.0
.text 610356 610468 112 0.0
linux all-clusters-app debug (read only) 2402833 2403441 608 0.0
.text 2034754 2035362 608 0.0
bridge-app debug+rpc (read only) 1728637 1729245 608 0.0
.text 1470965 1471573 608 0.0
chip-tool debug (read only) 9400493 9401101 608 0.0
.text 8241349 8241957 608 0.0
chip-tool-ipv6only arm64 (read only) 9099044 9099364 320 0.0
.text 7707460 7707780 320 0.0
door-lock-app debug (read only) 1943265 1943873 608 0.0
.text 1620978 1621586 608 0.0
lighting-app debug+rpc (read only) 2074561 2075169 608 0.0
.text 1753234 1753842 608 0.0
ota-provider-app debug (read only) 1875481 1876089 608 0.0
.text 1565874 1566482 608 0.0
ota-requestor-app debug (read only) 1891585 1892193 608 0.0
.text 1589202 1589810 608 0.0
shell debug (read only) 2371857 2372465 608 0.0
.text 2010018 2010626 608 0.0
thermostat-no-ble arm64 (read only) 2169220 2169524 304 0.0
.text 1817888 1818192 304 0.0
tv-app debug (read only) 2610001 2610609 608 0.0
.text 2236706 2237314 608 0.0
mbed lock-app CY8CPROTO_062_4343W+release (read/write) 2349940 2350084 144 0.0
.text 1312540 1312684 144 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 (read/write) 1077995 1078107 112 0.0
text 731892 732004 112 0.0
p6 all-clusters-app default (read/write) 2489624 2489752 128 0.0
.text 1447888 1448016 128 0.0
light-app default (read/write) 2396728 2396856 128 0.0
.text 1354992 1355120 128 0.0
lock-app default (read/write) 2360240 2360368 128 0.0
.text 1318504 1318632 128 0.0
qpg lighting-app qpg6105+debug (read only) 603112 603216 104 0.0
.text 597792 597896 104 0.0
lock-app qpg6105+debug (read only) 568796 568900 104 0.0
.text 563476 563580 104 0.0
telink lighting-app tlsr9518adk80d (read/write) 887454 887574 120 0.0
text 626978 627102 124 0.0
Full report (31 builds for cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, qpg, telink)
platform target config section 9dcdf37 36e101f change % change
cyw30739 light cyw930739m2evb_01 (read/write) 600286 600394 108 0.0
.app_xip_area 505308 505416 108 0.0
.bss 77660 77660 0 0.0
.data 660 660 0 0.0
.rodata 0 0 0 0.0
.text 0 0 0 0.0
lock cyw930739m2evb_01 (read/write) 558282 558390 108 0.0
.app_xip_area 464840 464948 108 0.0
.bss 76164 76164 0 0.0
.data 624 624 0 0.0
.rodata 0 0 0 0.0
.text 0 0 0 0.0
ota-requestor cyw930739m2evb_01 (read/write) 580226 580334 108 0.0
.app_xip_area 477112 477220 108 0.0
.bss 85484 85484 0 0.0
.data 592 592 0 0.0
.rodata 0 0 0 0.0
.text 112 112 0 0.0
efr32 lighting-app BRD4161A (read only) 919740 919868 128 0.0
(read/write) 128784 128784 0 0.0
.bss 126704 126704 0 0.0
.data 2080 2080 0 0.0
.text 919732 919860 128 0.0
BRD4161A+rpc (read only) 948560 948688 128 0.0
(read/write) 144744 144744 0 0.0
.bss 142480 142480 0 0.0
.data 2260 2260 0 0.0
.text 948552 948680 128 0.0
lock-app BRD4161A+wf200 (read only) 988140 988252 112 0.0
(read/write) 120312 120312 0 0.0
.bss 118380 118380 0 0.0
.data 1932 1932 0 0.0
.text 988132 988244 112 0.0
window-app BRD4161A (read only) 853120 853232 112 0.0
(read/write) 126784 126784 0 0.0
.bss 124856 124856 0 0.0
.data 1924 1924 0 0.0
.text 853112 853224 112 0.0
esp32 all-clusters-app c3devkit (read only) 953148 953266 118 0.0
(read/write) 1392586 1392586 0 0.0
.dram0.bss 62536 62536 0 0.0
.dram0.data 14236 14236 0 0.0
.flash.rodata 196896 196896 0 0.0
.flash.text 953148 953266 118 0.0
.iram0.text 62016 62016 0 0.0
m5stack (read only) 1008319 1008499 180 0.0
(read/write) 459700 459700 0 0.0
.dram0.bss 68056 68056 0 0.0
.dram0.data 34080 34080 0 0.0
.flash.rodata 225728 225728 0 0.0
.flash.text 1002935 1003115 180 0.0
.iram0.text 123107 123107 0 0.0
k32w light k32w061+release (read/write) 693896 694008 112 0.0
.bss 77640 77640 0 0.0
.data 1964 1964 0 0.0
.text 608492 608604 112 0.0
lock k32w061+release (read/write) 695744 695856 112 0.0
.bss 77616 77616 0 0.0
.data 1972 1972 0 0.0
.text 610356 610468 112 0.0
linux all-clusters-app debug (read only) 2402833 2403441 608 0.0
(read/write) 144632 144632 0 0.0
.bss 59104 59104 0 0.0
.data 1392 1392 0 0.0
.data.rel.ro 78408 78408 0 0.0
.dynamic 592 592 0 0.0
.got 4176 4176 0 0.0
.init 27 27 0 0.0
.init_array 912 912 0 0.0
.rodata 205093 205093 0 0.0
.text 2034754 2035362 608 0.0
bridge-app debug+rpc (read only) 1728637 1729245 608 0.0
(read/write) 92592 92592 0 0.0
.bss 47400 47400 0 0.0
.data 2048 2048 0 0.0
.data.rel.ro 38056 38056 0 0.0
.dynamic 592 592 0 0.0
.got 3928 3928 0 0.0
.init 27 27 0 0.0
.init_array 544 544 0 0.0
.rodata 141652 141652 0 0.0
.text 1470965 1471573 608 0.0
chip-tool debug (read only) 9400493 9401101 608 0.0
(read/write) 305832 305832 0 0.0
.bss 25440 25440 0 0.0
.data 1136 1136 0 0.0
.data.rel.ro 273232 273232 0 0.0
.dynamic 608 608 0 0.0
.got 4776 4776 0 0.0
.init 27 27 0 0.0
.init_array 608 608 0 0.0
.rodata 497845 497845 0 0.0
.text 8241349 8241957 608 0.0
chip-tool-ipv6only arm64 (read only) 9099044 9099364 320 0.0
(read/write) 418593 418593 0 0.0
.bss 43761 43761 0 0.0
.data 1192 1192 0 0.0
.data.rel.ro 317984 317984 0 0.0
.dynamic 560 560 0 0.0
.got 51856 51856 0 0.0
.init 24 24 0 0.0
.init_array 192 192 0 0.0
.rodata 473660 473660 0 0.0
.text 7707460 7707780 320 0.0
door-lock-app debug (read only) 1943265 1943873 608 0.0
(read/write) 119040 119040 0 0.0
.bss 50400 50400 0 0.0
.data 1056 1056 0 0.0
.data.rel.ro 62184 62184 0 0.0
.dynamic 592 592 0 0.0
.got 4112 4112 0 0.0
.init 27 27 0 0.0
.init_array 664 664 0 0.0
.rodata 173596 173596 0 0.0
.text 1620978 1621586 608 0.0
lighting-app debug+rpc (read only) 2074561 2075169 608 0.0
(read/write) 124336 124336 0 0.0
.bss 51232 51232 0 0.0
.data 1536 1536 0 0.0
.data.rel.ro 66088 66088 0 0.0
.dynamic 608 608 0 0.0
.got 4144 4144 0 0.0
.init 27 27 0 0.0
.init_array 712 712 0 0.0
.rodata 165692 165692 0 0.0
.text 1753234 1753842 608 0.0
ota-provider-app debug (read only) 1875481 1876089 608 0.0
(read/write) 114672 114672 0 0.0
.bss 50208 50208 0 0.0
.data 1352 1352 0 0.0
.data.rel.ro 57464 57464 0 0.0
.dynamic 608 608 0 0.0
.got 4368 4368 0 0.0
.init 27 27 0 0.0
.init_array 616 616 0 0.0
.rodata 158835 158835 0 0.0
.text 1565874 1566482 608 0.0
ota-requestor-app debug (read only) 1891585 1892193 608 0.0
(read/write) 116984 116984 0 0.0
.bss 51200 51200 0 0.0
.data 1512 1512 0 0.0
.data.rel.ro 58856 58856 0 0.0
.dynamic 592 592 0 0.0
.got 4160 4160 0 0.0
.init 27 27 0 0.0
.init_array 624 624 0 0.0
.rodata 152972 152972 0 0.0
.text 1589202 1589810 608 0.0
shell debug (read only) 2371857 2372465 608 0.0
(read/write) 146864 146864 0 0.0
.bss 67176 67176 0 0.0
.data 864 864 0 0.0
.data.rel.ro 73144 73144 0 0.0
.dynamic 592 592 0 0.0
.got 4160 4160 0 0.0
.init 27 27 0 0.0
.init_array 896 896 0 0.0
.rodata 205074 205074 0 0.0
.text 2010018 2010626 608 0.0
thermostat-no-ble arm64 (read only) 2169220 2169524 304 0.0
(read/write) 148433 148433 0 0.0
.bss 65121 65121 0 0.0
.data 1072 1072 0 0.0
.data.rel.ro 75048 75048 0 0.0
.dynamic 560 560 0 0.0
.got 4216 4216 0 0.0
.init 24 24 0 0.0
.init_array 352 352 0 0.0
.rodata 132900 132900 0 0.0
.text 1817888 1818192 304 0.0
tv-app debug (read only) 2610001 2610609 608 0.0
(read/write) 250744 250744 0 0.0
.bss 167904 167904 0 0.0
.data 3200 3200 0 0.0
.data.rel.ro 73616 73616 0 0.0
.dynamic 592 592 0 0.0
.got 4544 4544 0 0.0
.init 27 27 0 0.0
.init_array 880 880 0 0.0
.rodata 199133 199133 0 0.0
.text 2236706 2237314 608 0.0
mbed lock-app CY8CPROTO_062_4343W+release (read only) 6224 6224 0 0.0
(read/write) 2349940 2350084 144 0.0
.bss 186028 186028 0 0.0
.data 5800 5800 0 0.0
.text 1312540 1312684 144 0.0
nrfconnect all-clusters-app nrf52840dk_nrf52840 (read/write) 1077995 1078107 112 0.0
bss 128844 128844 0 0.0
rodata 142036 142036 0 0.0
text 731892 732004 112 0.0
p6 all-clusters-app default (read/write) 2489624 2489752 128 0.0
.bss 118608 118608 0 0.0
.data 2696 2696 0 0.0
.text 1447888 1448016 128 0.0
light-app default (read/write) 2396728 2396856 128 0.0
.bss 112920 112920 0 0.0
.data 2544 2544 0 0.0
.text 1354992 1355120 128 0.0
lock-app default (read/write) 2360240 2360368 128 0.0
.bss 112664 112664 0 0.0
.data 2504 2504 0 0.0
.text 1318504 1318632 128 0.0
qpg lighting-app qpg6105+debug (read only) 603112 603216 104 0.0
(read/write) 146936 146936 0 0.0
.bss 91016 91016 0 0.0
.data 1164 1164 0 0.0
.text 597792 597896 104 0.0
lock-app qpg6105+debug (read only) 568796 568900 104 0.0
(read/write) 146936 146936 0 0.0
.bss 91024 91024 0 0.0
.data 1116 1116 0 0.0
.text 563476 563580 104 0.0
persistent-storage-app qpg6105+debug (read only) 99520 99520 0 0.0
(read/write) 146940 146940 0 0.0
.bss 24004 24004 0 0.0
.data 176 176 0 0.0
.text 94200 94200 0 0.0
telink lighting-app tlsr9518adk80d (read/write) 887454 887574 120 0.0
bss 86864 86864 0 0.0
noinit 37160 37160 0 0.0
text 626978 627102 124 0.0

@woody-apple woody-apple merged commit dbbc6e9 into project-chip:master Mar 5, 2022
@bzbarsky-apple
Copy link
Contributor

Was looking at resolution for my comments and realized this logic just does not match the spec. Filed #15892 @emargolis

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants