Added steps to validate CASE Authentication Tags (CAT)

[vijs]

Problem

• ACL currently does not validate CASE Authentication Tags (CAT) Access Control Requests (Issue #10243).

Change overview

• Added step to validate CASE Authentication Tags.
• Added new test cases for checking valid/non-valid CAT access requests.

Testing

• Added Matter Unit Tests

[github-actions]

PR #11806: Size comparison from 1903401 to 63d1860

Full report (35 builds for efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)

platform	target	config	section	1903401	63d1860	change	% change
efr32	lighting-app	BRD4161A	(read only)	746648	746648	0	0.0
			(read/write)	115364	115364	0	0.0
			.bss	113564	113564	0	0.0
			.data	1800	1800	0	0.0
			.text	746640	746640	0	0.0
		BRD4161A+rpc	(read only)	734188	734188	0	0.0
			(read/write)	131992	131992	0	0.0
			.bss	130068	130068	0	0.0
			.data	1924	1924	0	0.0
			.text	734180	734180	0	0.0
	lock-app	BRD4161A	(read only)	723712	723712	0	0.0
			(read/write)	113148	113148	0	0.0
			.bss	111388	111388	0	0.0
			.data	1756	1756	0	0.0
			.text	723704	723704	0	0.0
	window-app	BRD4161A	(read only)	724704	724704	0	0.0
			(read/write)	113468	113468	0	0.0
			.bss	111708	111708	0	0.0
			.data	1760	1760	0	0.0
			.text	724696	724696	0	0.0
esp32	all-clusters-app	c3devkit	(read only)	825820	825820	0	0.0
			(read/write)	1220258	1220258	0	0.0
			.dram0.bss	56512	56512	0	0.0
			.dram0.data	14084	14084	0	0.0
			.flash.rodata	164408	164408	0	0.0
			.flash.text	825820	825820	0	0.0
			.iram0.text	61394	61394	0	0.0
		m5stack	(read only)	896619	896619	0	0.0
			(read/write)	419580	419580	0	0.0
			.dram0.bss	61864	61864	0	0.0
			.dram0.data	34056	34056	0	0.0
			.flash.rodata	192380	192380	0	0.0
			.flash.text	891235	891235	0	0.0
			.iram0.text	122943	122943	0	0.0
k32w	lighting-app	k32w061+se05x+release	(read/write)	705032	705032	0	0.0
			.bss	76988	76988	0	0.0
			.data	1912	1912	0	0.0
			.text	620332	620332	0	0.0
	lock-app	k32w061+debug	(read/write)	596448	596448	0	0.0
			.bss	67500	67500	0	0.0
			.data	1880	1880	0	0.0
			.text	521268	521268	0	0.0
	shell	k32w061+debug	(read/write)	661664	661664	0	0.0
			.bss	78564	78564	0	0.0
			.data	1848	1848	0	0.0
			.text	575452	575452	0	0.0
linux	all-clusters-app	debug	(read only)	1709953	1709953	0	0.0
			(read/write)	126624	126624	0	0.0
			.bss	57520	57520	0	0.0
			.data	1042	1042	0	0.0
			.data.rel.ro	62784	62784	0	0.0
			.dynamic	592	592	0	0.0
			.got	4112	4112	0	0.0
			.init	27	27	0	0.0
			.init_array	552	552	0	0.0
			.rodata	135349	135349	0	0.0
			.text	1441154	1441154	0	0.0
	bridge-app	debug+rpc	(read only)	1305125	1305125	0	0.0
			(read/write)	76816	76816	0	0.0
			.bss	42224	42224	0	0.0
			.data	1568	1568	0	0.0
			.data.rel.ro	28024	28024	0	0.0
			.dynamic	592	592	0	0.0
			.got	3984	3984	0	0.0
			.init	27	27	0	0.0
			.init_array	408	408	0	0.0
			.rodata	110764	110764	0	0.0
			.text	1097461	1097461	0	0.0
	chip-tool	debug	(read only)	4900629	4900629	0	0.0
			(read/write)	166280	166280	0	0.0
			.bss	40584	40584	0	0.0
			.data	2272	2272	0	0.0
			.data.rel.ro	117936	117936	0	0.0
			.dynamic	592	592	0	0.0
			.got	4416	4416	0	0.0
			.init	27	27	0	0.0
			.init_array	472	472	0	0.0
			.rodata	265618	265618	0	0.0
			.text	4326037	4326037	0	0.0
	lighting-app	debug+rpc	(read only)	1574153	1574153	0	0.0
			(read/write)	110064	110064	0	0.0
			.bss	47888	47888	0	0.0
			.data	1234	1234	0	0.0
			.data.rel.ro	55616	55616	0	0.0
			.dynamic	608	608	0	0.0
			.got	4136	4136	0	0.0
			.init	27	27	0	0.0
			.init_array	536	536	0	0.0
			.rodata	128337	128337	0	0.0
			.text	1311314	1311314	0	0.0
	ota-provider-app	debug	(read only)	1260553	1260553	0	0.0
			(read/write)	75560	75560	0	0.0
			.bss	44832	44832	0	0.0
			.data	784	784	0	0.0
			.data.rel.ro	24840	24840	0	0.0
			.dynamic	592	592	0	0.0
			.got	4016	4016	0	0.0
			.init	27	27	0	0.0
			.init_array	448	448	0	0.0
			.rodata	113063	113063	0	0.0
			.text	1050402	1050402	0	0.0
	ota-requestor-app	debug	(read only)	1343681	1343681	0	0.0
			(read/write)	79264	79264	0	0.0
			.bss	47296	47296	0	0.0
			.data	848	848	0	0.0
			.data.rel.ro	26024	26024	0	0.0
			.dynamic	592	592	0	0.0
			.got	3992	3992	0	0.0
			.init	27	27	0	0.0
			.init_array	472	472	0	0.0
			.rodata	123888	123888	0	0.0
			.text	1120370	1120370	0	0.0
	shell	debug	(read only)	794665	794665	0	0.0
			(read/write)	66088	66088	0	0.0
			.bss	23816	23816	0	0.0
			.data	242	242	0	0.0
			.data.rel.ro	37520	37520	0	0.0
			.dynamic	592	592	0	0.0
			.got	3528	3528	0	0.0
			.init	27	27	0	0.0
			.init_array	344	344	0	0.0
			.rodata	78479	78479	0	0.0
			.text	612674	612674	0	0.0
	tv-app	debug	(read only)	1846809	1846809	0	0.0
			(read/write)	405016	405016	0	0.0
			.bss	336968	336968	0	0.0
			.data	2768	2768	0	0.0
			.data.rel.ro	59600	59600	0	0.0
			.dynamic	592	592	0	0.0
			.got	4432	4432	0	0.0
			.init	27	27	0	0.0
			.init_array	616	616	0	0.0
			.rodata	155213	155213	0	0.0
			.text	1547330	1547330	0	0.0
mbed	all-clusters-app	CY8CPROTO_062_4343W+release	(read only)	6224	6224	0	0.0
			(read/write)	2285472	2285472	0	0.0
			.bss	179108	179108	0	0.0
			.data	5216	5216	0	0.0
			.heap	852120	852120	0	0.0
			.text	1248072	1248072	0	0.0
	lighting-app	CY8CPROTO_062_4343W+release	(read only)	6224	6224	0	0.0
			(read/write)	2271408	2271408	0	0.0
			.bss	171972	171972	0	0.0
			.data	5576	5576	0	0.0
			.heap	858896	858896	0	0.0
			.text	1234008	1234008	0	0.0
	lock-app	CY8CPROTO_062_4343W+release	(read only)	6224	6224	0	0.0
			(read/write)	2247312	2247312	0	0.0
			.bss	170860	170860	0	0.0
			.data	5568	5568	0	0.0
			.heap	860016	860016	0	0.0
			.text	1209912	1209912	0	0.0
	pigweed-app	CY8CPROTO_062_4343W+release	(read only)	6224	6224	0	0.0
			(read/write)	1139744	1139744	0	0.0
			.bss	11752	11752	0	0.0
			.data	4368	4368	0	0.0
			.heap	1020328	1020328	0	0.0
			.text	103128	103128	0	0.0
	shell	CY8CPROTO_062_4343W+release	(read only)	6224	6224	0	0.0
			(read/write)	2049520	2049520	0	0.0
			.bss	156160	156160	0	0.0
			.data	4968	4968	0	0.0
			.heap	875320	875320	0	0.0
			.text	1012120	1012120	0	0.0
nrfconnect	lighting-app	nrf52840dk_nrf52840	(read/write)	861319	861319	0	0.0
			bss	110384	110384	0	0.0
			rodata	95400	95400	0	0.0
			text	579904	579904	0	0.0
		nrf52840dk_nrf52840+rpc	(read/write)	823691	823691	0	0.0
			bss	106740	106740	0	0.0
			rodata	86588	86588	0	0.0
			text	554076	554076	0	0.0
		nrf5340dk_nrf5340_cpuapp	(read/write)	786362	786362	0	0.0
			bss	111760	111760	0	0.0
			rodata	90660	90660	0	0.0
			text	509372	509372	0	0.0
	lock-app	nrf52840dk_nrf52840	(read/write)	836719	836719	0	0.0
			bss	109408	109408	0	0.0
			rodata	91872	91872	0	0.0
			text	560004	560004	0	0.0
		nrf5340dk_nrf5340_cpuapp	(read/write)	762038	762038	0	0.0
			bss	110820	110820	0	0.0
			rodata	87176	87176	0	0.0
			text	489564	489564	0	0.0
	pigweed-app	nrf52840dk_nrf52840	(read/write)	497327	497327	0	0.0
			bss	51824	51824	0	0.0
			rodata	45780	45780	0	0.0
			text	339436	339436	0	0.0
	pump-app	nrf52840dk_nrf52840	(read/write)	842859	842859	0	0.0
			bss	109548	109548	0	0.0
			rodata	93580	93580	0	0.0
			text	564184	564184	0	0.0
	pump-controller-app	nrf52840dk_nrf52840	(read/write)	836451	836451	0	0.0
			bss	109444	109444	0	0.0
			rodata	91828	91828	0	0.0
			text	559624	559624	0	0.0
	shell	nrf52840dk_nrf52840	(read/write)	776239	776239	0	0.0
			bss	109004	109004	0	0.0
			rodata	72516	72516	0	0.0
			text	520124	520124	0	0.0
		nrf5340dk_nrf5340_cpuapp	(read/write)	691294	691294	0	0.0
			bss	109988	109988	0	0.0
			rodata	67160	67160	0	0.0
			text	440732	440732	0	0.0
p6	all-clusters-app	default	(read/write)	2294024	2294024	0	0.0
			.bss	112096	112096	0	0.0
			.data	2520	2520	0	0.0
			.heap	918728	918728	0	0.0
			.text	1252288	1252288	0	0.0
	lock-app	default	(read/write)	2211448	2211448	0	0.0
			.bss	100720	100720	0	0.0
			.data	2400	2400	0	0.0
			.heap	930224	930224	0	0.0
			.text	1169712	1169712	0	0.0
telink	lighting-app	tlsr9518adk80d	(read/write)	764266	764266	0	0.0
			bss	78896	78896	0	0.0
			noinit	37160	37160	0	0.0
			text	530138	530138	0	0.0

[msandstedt]

I thought that even with the move from 32-bit tags to the split 16-bit tag ID and 16-bit tag version we still had CAT1 and CAT2 RDNs.

Does this PR correctly support that?

[mlepage-google]

Hi Vijay, just seeing this now (was sick yesterday). PR #11550 is now merged, which does provide a full implementation of Access Control module (storing entries etc.) using full interface (iterating entries etc.). The SubjectDescriptor has changed slightly (since we can put everything into a NodeId), and the test code is entirely rewritten. Also I know Evgeni is working on adding CATs into the session, its test code (including certs), and then to the subject descriptor (e.g. PR #11697). Therefore this will require coordination and rework, my apologies on that. I'll reach out to you on slack.

[vijs]

Hi Marc, I started working on #10243 as it wasn't assigned to anyone. Sorry, I didn't know it's actively being worked on. Let us discuss this in Slack and see how to collaborate.

[vijs]

Abandoning this PR as Evgeni is working on it.