Device Attestation (Modular) #9617

mleisner · 2021-09-11T00:22:32Z

Problem

Working device attestation

Change overview

Added CertChainRequest and AttestationRequest commands to lighting-app ZAP script
Introduced CertChainRequest, CertChainResponse, AttestationRequest and AttestationResponse commands into operational-credentials-cluster.xml
Added the above commands' callbacks to operational-credentials-server.cpp
Introduced the Attestation Nonce buffer to CHIPDevice Class
Added Certificate Chain Request and Attestation Request Commands to CHIPDeviceController
Added global method to Server.cpp in order to retrieve Server's SecureSessionMgr (needed to retrieve Attestation Challenge)
Added support to DAC/PAI certificates in CHIPDevice

(includes two files
src/credentials/DeviceAttestationConstructor.cpp
src/credentials/DeviceAttestationConstructor.h
which was in PR #9544)

Testing

Tested Commissioning using chip-tool and lighting apps

helpers Moved CopySpantoMutableSpan into src/lib/support/Span.h as a general use routine. Added ExtractVIDFromX509Cert and ExtractAKIDFromX509Cert Changed attestation data to equate with updated spec. coauthor: restyled io

…p ZAP script Introduced CertChainRequest, CertChainResponse, AttestationRequest and AttestationResponse commands into operational-credentials-cluster.xml Added the above commands' callbacks to operational-credentials-server.cpp Introduced the Attestation Nonce buffer to CHIPDevice Class Added Certificate Chain Request and Attestation Request Commands to CHIPDeviceController Added global method to Server.cpp in order to retrieve Server's SecureSessionMgr (needed to retrieve Attestation Challenge) Added support to DAC/PAI certificates in CHIPDevice Include files from the DA constructor PR src/credentials/DeviceAttestationConstructor.cpp src/credentials/DeviceAttestationConstructor.h

…thub.com/project-chip/connectedhomeip into feature/device_attestation_complete

…thub.com/project-chip/connectedhomeip into feature/DA-constructors

Changing naming convention for constants simpler logic for context tags. Eliminate boolean array indexed by tag and have boolean flags. Removed vector for VendorReserved data and changed signature of helper functions.

…thub.com/project-chip/connectedhomeip into feature/device_attestation_complete

todo · 2021-09-11T00:22:33Z

remove line below

connectedhomeip/src/app/clusters/operational-credentials-server/operational-credentials-server.cpp

Lines 442 to 452 in 0e9dcf8

    
           // TODO: remove line below 
        
           Credentials::SetDeviceAttestationCredentialsProvider(Credentials::Examples::GetExampleDACProvider()); 
        
           Credentials::DeviceAttestationCredentialsProvider * dacProvider = Credentials::GetDeviceAttestationCredentialsProvider(); 
        
           VerifyOrExit(commandObj != nullptr, err = CHIP_ERROR_INCORRECT_STATE); 
        
           SuccessOrExit(err = commandObj->PrepareCommand(cmdParams)); 
        
           writer = commandObj->GetCommandDataElementTLVWriter(); 
        
           if (certChainType == kDACCertificate) 
        
           { 
        
               SuccessOrExit(err = dacProvider->GetDeviceAttestationCert(derBufSpan));

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

todo · 2021-09-11T00:22:36Z

remove line below

connectedhomeip/src/app/clusters/operational-credentials-server/operational-credentials-server.cpp

Lines 497 to 507 in 0e9dcf8

    
           // TODO: remove line below 
        
           Credentials::SetDeviceAttestationCredentialsProvider(Credentials::Examples::GetExampleDACProvider()); 
        
           Credentials::DeviceAttestationCredentialsProvider * dacProvider = Credentials::GetDeviceAttestationCredentialsProvider(); 
        
           VerifyOrExit(commandObj != nullptr, err = CHIP_ERROR_INCORRECT_STATE); 
        
           VerifyOrExit(attestationNonce.size() == 32, status = EMBER_ZCL_STATUS_FAILURE); 
        
           { 
        
               uint8_t certDeclBuf[512]; 
        
               MutableByteSpan certDeclSpan(certDeclBuf);

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

todo · 2021-09-11T00:22:39Z

Map error status to correct error code

connectedhomeip/src/controller/CHIPDeviceController.cpp

Lines 1235 to 1245 in 0e9dcf8

    
               // TODO: Map error status to correct error code 
        
               commissioner->OnSessionEstablishmentError(CHIP_ERROR_INTERNAL); 
        
           } 
        
           void DeviceCommissioner::OnCertificateChainResponse(void * context, ByteSpan certificate) 
        
           { 
        
               ChipLogProgress(Controller, "Received certificate chain from the device"); 
        
               DeviceCommissioner * commissioner = reinterpret_cast<DeviceCommissioner *>(context); 
        
               commissioner->mCertChainResponseCallback.Cancel(); 
        
               commissioner->mOnCertChainFailureCallback.Cancel();

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

todo · 2021-09-11T00:22:42Z

Map error status to correct error code

connectedhomeip/src/controller/CHIPDeviceController.cpp

Lines 1251 to 1261 in 0e9dcf8

    
                   // TODO: Map error status to correct error code 
        
                   commissioner->OnSessionEstablishmentError(CHIP_ERROR_INTERNAL); 
        
               } 
        
           } 
        
           CHIP_ERROR DeviceCommissioner::ProcessCertificateChain(const ByteSpan & certificate) 
        
           { 
        
               VerifyOrReturnError(mState == State::Initialized, CHIP_ERROR_INCORRECT_STATE); 
        
               VerifyOrReturnError(mDeviceBeingPaired < kNumMaxActiveDevices, CHIP_ERROR_INCORRECT_STATE); 
        
               Device * device = &mActiveDevices[mDeviceBeingPaired];

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

todo · 2021-09-11T00:22:45Z

Map error status to correct error code

connectedhomeip/src/controller/CHIPDeviceController.cpp

Lines 1319 to 1329 in 0e9dcf8

    
               // TODO: Map error status to correct error code 
        
               commissioner->OnSessionEstablishmentError(CHIP_ERROR_INTERNAL); 
        
           } 
        
           void DeviceCommissioner::OnAttestationResponse(void * context, chip::ByteSpan attestationElements, chip::ByteSpan signature) 
        
           { 
        
               ChipLogProgress(Controller, "Received Attestation Information from the device"); 
        
               DeviceCommissioner * commissioner = reinterpret_cast<DeviceCommissioner *>(context); 
        
               commissioner->mAttestationResponseCallback.Cancel(); 
        
               commissioner->mOnAttestationFailureCallback.Cancel();

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

todo · 2021-09-11T00:22:48Z

Map error status to correct error code

connectedhomeip/src/controller/CHIPDeviceController.cpp

Lines 1336 to 1346 in 0e9dcf8

    
                   // TODO: Map error status to correct error code 
        
                   commissioner->OnSessionEstablishmentError(CHIP_ERROR_INTERNAL); 
        
               } 
        
           } 
        
           CHIP_ERROR DeviceCommissioner::ValidateAttestationInfo(chip::ByteSpan attestationElements, chip::ByteSpan signature) 
        
           { 
        
               VerifyOrReturnError(mState == State::Initialized, CHIP_ERROR_INCORRECT_STATE); 
        
               VerifyOrReturnError(mDeviceBeingPaired < kNumMaxActiveDevices, CHIP_ERROR_INCORRECT_STATE); 
        
               Device * device = &mActiveDevices[mDeviceBeingPaired];

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

todo · 2021-09-11T00:22:51Z

Step g/h validate CertDeclaration

connectedhomeip/src/controller/CHIPDeviceController.cpp

Lines 1361 to 1371 in 0e9dcf8

    
           // TODO: Step g/h validate CertDeclaration 
        
           // TODO: Step i: validate firmware information 
        
           ChipLogProgress(Controller, "Sending 'CSR request' command to the device."); 
        
           CHIP_ERROR error = SendOperationalCertificateSigningRequestCommand(device); 
        
           if (error != CHIP_NO_ERROR) 
        
           { 
        
               ChipLogError(Controller, "Failed in sending 'CSR request' command to the device: err %s", ErrorStr(error)); 
        
               OnSessionEstablishmentError(error); 
        
               return error; 
        
           }

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

todo · 2021-09-11T00:22:54Z

Step i: validate firmware information

connectedhomeip/src/controller/CHIPDeviceController.cpp

Lines 1362 to 1372 in 0e9dcf8

    
           // TODO: Step i: validate firmware information 
        
           ChipLogProgress(Controller, "Sending 'CSR request' command to the device."); 
        
           CHIP_ERROR error = SendOperationalCertificateSigningRequestCommand(device); 
        
           if (error != CHIP_NO_ERROR) 
        
           { 
        
               ChipLogError(Controller, "Failed in sending 'CSR request' command to the device: err %s", ErrorStr(error)); 
        
               OnSessionEstablishmentError(error); 
        
               return error; 
        
           }

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

include generated zap files. coauthor -- clang format

version

…-comcast:mleisner/connectedhomeip into feature/device_attestation_complete

… rest of code to comply with latest changes. added more TODOs. Added Error and Progress Logs to Attestation Flow in CHIPDeviceController.

…-comcast:mleisner/connectedhomeip into feature/device_attestation_complete

coauthor: restyle-io (clang-format)

src/controller/CHIPDeviceController.cpp

github-actions · 2021-09-27T14:02:03Z

Size increase report for "gn_qpg-example-build" from 4bafdcf

File	Section	File	VM
chip-qpg6100-lighting-example.out	.text	1524	1524

Full report output

BLOAT REPORT

Files found only in the build output:
    report.csv

Comparing ./master_artifact/chip-qpg6100-lighting-example.out and ./pull_artifact/chip-qpg6100-lighting-example.out:

sections,vmsize,filesize
.debug_info,0,29910
.debug_loc,0,11395
.debug_line,0,6554
.debug_str,0,2264
.debug_abbrev,0,2021
.debug_ranges,0,1840
.text,1524,1524
.debug_frame,0,340
.strtab,0,335
.symtab,0,224
.debug_aranges,0,96
.shstrtab,0,1
[Unmapped],0,-1524

Comparing ./master_artifact/chip-qpg6100-lighting-example.out.map and ./pull_artifact/chip-qpg6100-lighting-example.out.map:

BLOAT EXECUTION FAILED WITH CODE 1:
bloaty: unknown file type for file './pull_artifact/chip-qpg6100-lighting-example.out.map'

github-actions · 2021-09-27T14:27:53Z

Size increase report for "nrfconnect-example-build" from 4bafdcf

File	Section	File	VM
chip-lock.elf	text	1356	1356
chip-lock.elf	rodata	200	200
chip-lock.elf	device_handles	-12	-12

Full report output

BLOAT REPORT

Files found only in the build output:
    report.csv

Comparing ./master_artifact/chip-shell.elf and ./pull_artifact/chip-shell.elf:

sections,vmsize,filesize
.debug_info,0,248
.debug_str,0,76
.debug_loc,0,-60

Comparing ./master_artifact/chip-lock.elf and ./pull_artifact/chip-lock.elf:

sections,vmsize,filesize
.debug_info,0,28512
.debug_loc,0,10141
.debug_line,0,5765
.debug_abbrev,0,2023
.debug_ranges,0,1800
.debug_str,0,1627
text,1356,1356
.strtab,0,335
.debug_frame,0,228
.symtab,0,224
rodata,200,200
.debug_aranges,0,64
.shstrtab,0,-3
device_handles,-12,-12

github-actions · 2021-09-27T14:46:00Z

Size increase report for "esp32-example-build" from 4bafdcf

File	Section	File	VM
chip-all-clusters-app.elf	.flash.text	1408	1408
chip-all-clusters-app.elf	.flash.rodata	216	216

Full report output

BLOAT REPORT

Files found only in the build output:
    report.csv

Comparing ./master_artifact/chip-all-clusters-app.elf and ./pull_artifact/chip-all-clusters-app.elf:

sections,vmsize,filesize
.debug_info,0,42345
.debug_line,0,8170
.debug_loc,0,5476
.debug_abbrev,0,2571
[Unmapped],0,2472
.debug_str,0,1803
.debug_ranges,0,1592
.flash.text,1408,1408
.strtab,0,495
.debug_frame,0,320
.flash.rodata,216,216
.symtab,0,96
.debug_aranges,0,64
.riscv.attributes,0,-1
.shstrtab,0,-3

Marty Leisner added 6 commits September 8, 2021 20:35

Merge commit '78469bb8012524e5921216783937cc7349ac2628' of https://gi…

99b1fa3

…thub.com/project-chip/connectedhomeip into feature/device_attestation_complete

Merge commit '44f8ea7bbb0f7eae47c504ccd2a3f39d8f6ea74a' of https://gi…

cfedec6

…thub.com/project-chip/connectedhomeip into feature/DA-constructors

Address review comments

6e779a2

Changing naming convention for constants simpler logic for context tags. Eliminate boolean array indexed by tag and have boolean flags. Removed vector for VendorReserved data and changed signature of helper functions.

Merge commit '44f8ea7bbb0f7eae47c504ccd2a3f39d8f6ea74a' of https://gi…

38454ea

…thub.com/project-chip/connectedhomeip into feature/device_attestation_complete

boring-cyborg bot added app controller darwin examples transport labels Sep 11, 2021

restyled-io bot mentioned this pull request Sep 11, 2021

Restyle Device Attestation (Modular) #9618

Closed

minor changes (mainly review rework of Constructor/Deconstructor) and

adb5725

include generated zap files. coauthor -- clang format

mleisner force-pushed the feature/device_attestation_complete branch from 0e9dcf8 to adb5725 Compare September 11, 2021 00:38

pullapprove bot requested review from chrisdecenzo, jelderton, jmartinez-silabs, LuDuda, mspang, saurabhst and woody-apple September 11, 2021 00:39

pullapprove bot added the review - pending label Sep 11, 2021

Marty Leisner added 7 commits September 22, 2021 11:49

undid last commit -- regenerated zap to use 9/20 version versus 9/1

bd2699b

version

Merge branch 'master' into feature/device_attestation_complete

5fad0be

Add DAC Verifier Setup command to Android, Darwin and Python builds.

9237e6b

Merge branch 'master' into feature/device_attestation_complete

015573c

Merge commit 'a9ce3207a39de030ddd86e286696c928d5a5d0d4' of github.com…

8110d5c

…-comcast:mleisner/connectedhomeip into feature/device_attestation_complete

move GetAttestationChallenge method to new CryptoContext class. Adapt…

866a1c8

… rest of code to comply with latest changes. added more TODOs. Added Error and Progress Logs to Attestation Flow in CHIPDeviceController.

rerun zap

a61c1f1

restyled-io bot mentioned this pull request Sep 23, 2021

Restyle Device Attestation (Modular) #9935

Closed

Marty Leisner added 2 commits September 23, 2021 15:22

Merge commit 'e1f3aa1bb4084f89b3762b346f67da2350cadadb' of github.com…

b080b4b

…-comcast:mleisner/connectedhomeip into feature/device_attestation_complete

reran zap

c9f00f8

coauthor: restyle-io (clang-format)

mleisner requested review from tcarmelveilleux, cecille, msandstedt and pan-apple September 24, 2021 14:06

tcarmelveilleux approved these changes Sep 24, 2021

View reviewed changes

pullapprove bot added review - approved and removed review - pending labels Sep 24, 2021

tcarmelveilleux reviewed Sep 24, 2021

View reviewed changes

src/controller/CHIPDeviceController.cpp Outdated Show resolved Hide resolved

Attestation failure shouldn't break the SessionEstablishment flow

4d1d0d0

tcarmelveilleux reviewed Sep 24, 2021

View reviewed changes

src/controller/CHIPDeviceController.cpp Outdated Show resolved Hide resolved

cecille reviewed Sep 24, 2021

View reviewed changes

src/controller/CHIPDeviceController.cpp Show resolved Hide resolved

Marty Leisner added 3 commits September 24, 2021 16:16

Merge branch 'master' into feature/device_attestation_complete

d80b25d

Merge branch 'master' into feature/device_attestation_complete

c224eb0

Send CSR Request even if Attestation Information fails to be validated.

b9e3deb

hawk248 merged commit 0e52970 into project-chip:master Sep 27, 2021

This was referenced Oct 15, 2021

Issue #9825 -- handle vendor reserved data properly #10543

Closed

Issue #9825 -- handle vendor reserved data properly #10546

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Device Attestation (Modular) #9617

Device Attestation (Modular) #9617

mleisner commented Sep 11, 2021

todo bot commented Sep 11, 2021

todo bot commented Sep 11, 2021

todo bot commented Sep 11, 2021

todo bot commented Sep 11, 2021

todo bot commented Sep 11, 2021

todo bot commented Sep 11, 2021

todo bot commented Sep 11, 2021

todo bot commented Sep 11, 2021

github-actions bot commented Sep 27, 2021

github-actions bot commented Sep 27, 2021

github-actions bot commented Sep 27, 2021

Device Attestation (Modular) #9617

Device Attestation (Modular) #9617

Conversation

mleisner commented Sep 11, 2021

Problem

Change overview

Testing

todo bot commented Sep 11, 2021

remove line below

This comment was generated by todo based on a TODO comment in 0e9dcf8 in #9617. cc @mleisner.

todo bot commented Sep 11, 2021

remove line below

This comment was generated by todo based on a TODO comment in 0e9dcf8 in #9617. cc @mleisner.

todo bot commented Sep 11, 2021

Map error status to correct error code

This comment was generated by todo based on a TODO comment in 0e9dcf8 in #9617. cc @mleisner.

todo bot commented Sep 11, 2021

Map error status to correct error code

This comment was generated by todo based on a TODO comment in 0e9dcf8 in #9617. cc @mleisner.

todo bot commented Sep 11, 2021

Map error status to correct error code

This comment was generated by todo based on a TODO comment in 0e9dcf8 in #9617. cc @mleisner.

todo bot commented Sep 11, 2021

Map error status to correct error code

This comment was generated by todo based on a TODO comment in 0e9dcf8 in #9617. cc @mleisner.

todo bot commented Sep 11, 2021

Step g/h validate CertDeclaration

This comment was generated by todo based on a TODO comment in 0e9dcf8 in #9617. cc @mleisner.

todo bot commented Sep 11, 2021

Step i: validate firmware information

This comment was generated by todo based on a TODO comment in 0e9dcf8 in #9617. cc @mleisner.

github-actions bot commented Sep 27, 2021

github-actions bot commented Sep 27, 2021

github-actions bot commented Sep 27, 2021

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.

This comment was generated by todo based on a `TODO` comment in `0e9dcf8` in #9617. cc @mleisner.