Separate device attestation and operational cert provisioning into separate steps

src/controller/AutoCommissioner.cpp

@@ -19,13 +19,22 @@
 #include <controller/AutoCommissioner.h>
 
 #include <controller/CHIPDeviceController.h>
+#include <credentials/CHIPCert.h>
+#include <lib/support/SafeInt.h>
 
 namespace chip {
 namespace Controller {
 
+AutoCommissioner::~AutoCommissioner()
+{
+    ReleaseDAC();
+    ReleasePAI();
+}
+
 CHIP_ERROR AutoCommissioner::SetCommissioningParameters(const CommissioningParameters & params)
 {
     mParams = params;
+    ChipLogProgress(Controller, "Setting Commissioning parameters");
     if (params.HasThreadOperationalDataset())
     {
         ByteSpan dataset = params.GetThreadOperationalDataset().Value();
@@ -34,6 +43,7 @@ CHIP_ERROR AutoCommissioner::SetCommissioningParameters(const CommissioningParam
             return CHIP_ERROR_INVALID_ARGUMENT;
         }
         memcpy(mThreadOperationalDataset, dataset.data(), dataset.size());
+        ChipLogProgress(Controller, "Setting thread operational dataset from parameters");
         mParams.SetThreadOperationalDataset(ByteSpan(mThreadOperationalDataset, dataset.size()));
     }
     if (params.HasWifiCredentials())
@@ -46,9 +56,37 @@ CHIP_ERROR AutoCommissioner::SetCommissioningParameters(const CommissioningParam
         }
         memcpy(mSsid, creds.ssid.data(), creds.ssid.size());
         memcpy(mCredentials, creds.credentials.data(), creds.credentials.size());
+        ChipLogProgress(Controller, "Setting wifi credentials from parameters");
         mParams.SetWifiCredentials(
             WifiCredentials(ByteSpan(mSsid, creds.ssid.size()), ByteSpan(mCredentials, creds.credentials.size())));
     }
+    // If the AttestationNonce is passed in, using that else using a random one..
+    if (params.HasAttestationNonce())
+    {
+        ChipLogProgress(Controller, "Setting attestation nonce from parameters");
+        VerifyOrReturnError(params.GetAttestationNonce().Value().size() == sizeof(mAttestationNonce), CHIP_ERROR_INVALID_ARGUMENT);
+        memcpy(mAttestationNonce, params.GetAttestationNonce().Value().data(), params.GetAttestationNonce().Value().size());
+    }
+    else
+    {
+        ChipLogProgress(Controller, "Setting attestation nonce to random value");
+        Crypto::DRBG_get_bytes(mAttestationNonce, sizeof(mAttestationNonce));
+    }
+    mParams.SetAttestationNonce(ByteSpan(mAttestationNonce, sizeof(mAttestationNonce)));
+
+    if (params.HasCSRNonce())
+    {
+        ChipLogProgress(Controller, "Setting CSR nonce from parameters");
+        VerifyOrReturnError(params.GetCSRNonce().Value().size() == sizeof(mCSRNonce), CHIP_ERROR_INVALID_ARGUMENT);
+        memcpy(mCSRNonce, params.GetCSRNonce().Value().data(), params.GetCSRNonce().Value().size());
+    }
+    else
+    {
+        ChipLogProgress(Controller, "Setting CSR nonce to random value");
+        Crypto::DRBG_get_bytes(mCSRNonce, sizeof(mCSRNonce));
+    }
+    mParams.SetCSRNonce(ByteSpan(mCSRNonce, sizeof(mCSRNonce)));
+
     return CHIP_NO_ERROR;
 }
 
@@ -61,8 +99,20 @@ CommissioningStage AutoCommissioner::GetNextCommissioningStage(CommissioningStag
     case CommissioningStage::kArmFailsafe:
         return CommissioningStage::kConfigRegulatory;
     case CommissioningStage::kConfigRegulatory:
-        return CommissioningStage::kDeviceAttestation;
-    case CommissioningStage::kDeviceAttestation:
+        return CommissioningStage::kSendPAICertificateRequest;
+    case CommissioningStage::kSendPAICertificateRequest:
+        return CommissioningStage::kSendDACCertificateRequest;
+    case CommissioningStage::kSendDACCertificateRequest:
+        return CommissioningStage::kSendAttestationRequest;
+    case CommissioningStage::kSendAttestationRequest:
+        return CommissioningStage::kSendOpCertSigningRequest;
+    case CommissioningStage::kSendOpCertSigningRequest:
+        return CommissioningStage::kGenerateNOCChain;
+    case CommissioningStage::kGenerateNOCChain:
+        return CommissioningStage::kSendTrustedRootCert;
+    case CommissioningStage::kSendTrustedRootCert:
+        return CommissioningStage::kSendNOC;
+    case CommissioningStage::kSendNOC:
         // TODO(cecille): device attestation casues operational cert provisioinging to happen, This should be a separate stage.
         // For thread and wifi, this should go to network setup then enable. For on-network we can skip right to finding the
         // operational network because the provisioning of certificates will trigger the device to start operational advertising.
@@ -119,7 +169,6 @@ CommissioningStage AutoCommissioner::GetNextCommissioningStage(CommissioningStag
 
     // Currently unimplemented.
     case CommissioningStage::kConfigACL:
-    case CommissioningStage::kCheckCertificates:
         return CommissioningStage::kError;
     // Neither of these have a next stage so return kError;
     case CommissioningStage::kCleanup:
@@ -136,15 +185,80 @@ void AutoCommissioner::StartCommissioning(CommissioneeDeviceProxy * proxy)
     mCommissioner->PerformCommissioningStep(mCommissioneeDeviceProxy, CommissioningStage::kArmFailsafe, mParams, this);
 }
 
-void AutoCommissioner::CommissioningStepFinished(CHIP_ERROR err, CommissioningDelegate::CommissioningReport report)
+CHIP_ERROR AutoCommissioner::NOCChainGenerated(ByteSpan noc, ByteSpan icac, ByteSpan rcac)
 {
+    {
+        // Reuse NOC Cert buffer for temporary store Root Cert.
+        MutableByteSpan rootCert = MutableByteSpan(mNOCCertBuffer);
+        ReturnErrorOnFailure(Credentials::ConvertX509CertToChipCert(rcac, rootCert));
+        mParams.SetRootCert(rootCert);
+        mCommissioner->PerformCommissioningStep(mCommissioneeDeviceProxy, CommissioningStage::kSendTrustedRootCert, mParams, this);
+    }
+
+    NOCerts certs;
+    if (!icac.empty())
+    {
+        MutableByteSpan icaCert = MutableByteSpan(mICACertBuffer);
+        ReturnErrorOnFailure(Credentials::ConvertX509CertToChipCert(icac, icaCert));
+        certs.icac = icaCert;
+    }
+    {
+        MutableByteSpan nocCert = MutableByteSpan(mNOCCertBuffer);
+        ReturnErrorOnFailure(Credentials::ConvertX509CertToChipCert(noc, nocCert));
+        certs.noc = nocCert;
+    }
+    mParams.SetNOCerts(certs);
+    return CHIP_NO_ERROR;
+}
 
-    if (report.stageCompleted == CommissioningStage::kFindOperational)
+CHIP_ERROR AutoCommissioner::CommissioningStepFinished(CHIP_ERROR err, CommissioningDelegate::CommissioningReport report)
+{
+    if (err != CHIP_NO_ERROR)
+    {
+        ChipLogError(Controller, "Failed to perform commissioning step %d", static_cast<int>(report.stageCompleted));
+        return err;
+    }
+    switch (report.stageCompleted)
     {
+    case CommissioningStage::kSendPAICertificateRequest:
+        SetPAI(report.requestedCertificate.certificate);
+        break;
+    case CommissioningStage::kSendDACCertificateRequest:
+        SetDAC(report.requestedCertificate.certificate);
+        break;
+    case CommissioningStage::kSendAttestationRequest:
+        ReturnErrorOnFailure(mCommissioner->ValidateAttestationInfo(
+            report.attestationResponse.attestationElements, report.attestationResponse.signature,
+            mParams.GetAttestationNonce().Value(), GetPAI(), GetDAC(), mCommissioneeDeviceProxy));
+        break;
+    case CommissioningStage::kSendOpCertSigningRequest: {
+        NOCChainGenerationParameters nocParams;
+        nocParams.nocsrElements = report.attestationResponse.attestationElements;
+        nocParams.signature     = report.attestationResponse.signature;
+        mParams.SetNOCChainGenerationParameters(nocParams);
+    }
+    break;
+    case CommissioningStage::kGenerateNOCChain:
+        // For NOC chain generation, we re-use the buffers. NOCChainGenerated triggers the next stage before
+        // storing the returned certs, so just return here without triggering the next stage.
+        return NOCChainGenerated(report.nocChain.noc, report.nocChain.icac, report.nocChain.rcac);
+    case CommissioningStage::kFindOperational:
         mOperationalDeviceProxy = report.OperationalNodeFoundData.operationalProxy;
+        break;
+    case CommissioningStage::kCleanup:
+        ReleasePAI();
+        ReleaseDAC();
+        mCommissioneeDeviceProxy = nullptr;
+        mOperationalDeviceProxy  = nullptr;
+        mParams                  = CommissioningParameters();
+        return CHIP_NO_ERROR;
+    default:
+        break;
     }
+
     CommissioningStage nextStage = GetNextCommissioningStage(report.stageCompleted);
-    DeviceProxy * proxy          = mCommissioneeDeviceProxy;
+
+    DeviceProxy * proxy = mCommissioneeDeviceProxy;
     if (nextStage == CommissioningStage::kSendComplete || nextStage == CommissioningStage::kCleanup)
     {
         proxy = mOperationalDeviceProxy;
@@ -153,9 +267,82 @@ void AutoCommissioner::CommissioningStepFinished(CHIP_ERROR err, CommissioningDe
     if (proxy == nullptr)
     {
         ChipLogError(Controller, "Invalid device for commissioning");
-        return;
+        return CHIP_ERROR_INCORRECT_STATE;
     }
     mCommissioner->PerformCommissioningStep(proxy, nextStage, mParams, this);
+    return CHIP_NO_ERROR;
+}
+
+void AutoCommissioner::ReleaseDAC()
+{
+    if (mDAC != nullptr)
+    {
+        Platform::MemoryFree(mDAC);
+    }
+    mDACLen = 0;
+    mDAC    = nullptr;
+}
+
+CHIP_ERROR AutoCommissioner::SetDAC(const ByteSpan & dac)
+{
+    if (dac.size() == 0)
+    {
+        ReleaseDAC();
+        return CHIP_NO_ERROR;
+    }
+
+    VerifyOrReturnError(dac.size() <= Credentials::kMaxDERCertLength, CHIP_ERROR_INVALID_ARGUMENT);
+    if (mDACLen != 0)
+    {
+        ReleaseDAC();
+    }
+
+    VerifyOrReturnError(CanCastTo<uint16_t>(dac.size()), CHIP_ERROR_INVALID_ARGUMENT);
+    if (mDAC == nullptr)
+    {
+        mDAC = static_cast<uint8_t *>(chip::Platform::MemoryAlloc(dac.size()));
+    }
+    VerifyOrReturnError(mDAC != nullptr, CHIP_ERROR_NO_MEMORY);
+    mDACLen = static_cast<uint16_t>(dac.size());
+    memcpy(mDAC, dac.data(), mDACLen);
+
+    return CHIP_NO_ERROR;
+}
+
+void AutoCommissioner::ReleasePAI()
+{
+    if (mPAI != nullptr)
+    {
+        chip::Platform::MemoryFree(mPAI);
+    }
+    mPAILen = 0;
+    mPAI    = nullptr;
+}
+
+CHIP_ERROR AutoCommissioner::SetPAI(const chip::ByteSpan & pai)
+{
+    if (pai.size() == 0)
+    {
+        ReleasePAI();
+        return CHIP_NO_ERROR;
+    }
+
+    VerifyOrReturnError(pai.size() <= Credentials::kMaxDERCertLength, CHIP_ERROR_INVALID_ARGUMENT);
+    if (mPAILen != 0)
+    {
+        ReleasePAI();
+    }
+
+    VerifyOrReturnError(CanCastTo<uint16_t>(pai.size()), CHIP_ERROR_INVALID_ARGUMENT);
+    if (mPAI == nullptr)
+    {
+        mPAI = static_cast<uint8_t *>(chip::Platform::MemoryAlloc(pai.size()));
+    }
+    VerifyOrReturnError(mPAI != nullptr, CHIP_ERROR_NO_MEMORY);
+    mPAILen = static_cast<uint16_t>(pai.size());
+    memcpy(mPAI, pai.data(), mPAILen);
+
+    return CHIP_NO_ERROR;
 }
 
 } // namespace Controller

src/controller/AutoCommissioner.h

@@ -29,13 +29,25 @@ class AutoCommissioner : public CommissioningDelegate
 {
 public:
     AutoCommissioner(DeviceCommissioner * commissioner) : mCommissioner(commissioner) {}
+    ~AutoCommissioner();
     CHIP_ERROR SetCommissioningParameters(const CommissioningParameters & params);
     void StartCommissioning(CommissioneeDeviceProxy * proxy);
 
-    void CommissioningStepFinished(CHIP_ERROR err, CommissioningDelegate::CommissioningReport report) override;
+    CHIP_ERROR CommissioningStepFinished(CHIP_ERROR err, CommissioningDelegate::CommissioningReport report) override;
 
 private:
     CommissioningStage GetNextCommissioningStage(CommissioningStage currentStage);
+    void ReleaseDAC();
+    void ReleasePAI();
+
+    CHIP_ERROR SetDAC(const ByteSpan & dac);
+    CHIP_ERROR SetPAI(const ByteSpan & pai);
+
+    ByteSpan GetDAC() const { return ByteSpan(mDAC, mDACLen); }
+    ByteSpan GetPAI() const { return ByteSpan(mPAI, mPAILen); }
+
+    CHIP_ERROR NOCChainGenerated(ByteSpan noc, ByteSpan icac, ByteSpan rcac);
+
     DeviceCommissioner * mCommissioner;
     CommissioneeDeviceProxy * mCommissioneeDeviceProxy = nullptr;
     OperationalDeviceProxy * mOperationalDeviceProxy   = nullptr;
@@ -45,6 +57,16 @@ class AutoCommissioner : public CommissioningDelegate
     uint8_t mSsid[CommissioningParameters::kMaxSsidLen];
     uint8_t mCredentials[CommissioningParameters::kMaxCredentialsLen];
     uint8_t mThreadOperationalDataset[CommissioningParameters::kMaxThreadDatasetLen];
+
+    // TODO: Why were the nonces statically allocated, but the certs dynamically allocated?
+    uint8_t * mDAC   = nullptr;
+    uint16_t mDACLen = 0;
+    uint8_t * mPAI   = nullptr;
+    uint16_t mPAILen = 0;
+    uint8_t mAttestationNonce[kAttestationNonceLength];
+    uint8_t mCSRNonce[kOpCSRNonceLength];
+    uint8_t mNOCCertBuffer[Credentials::kMaxCHIPCertLength];
+    uint8_t mICACertBuffer[Credentials::kMaxCHIPCertLength];
 };
 
 } // namespace Controller