Align TC_JFPKI_2_2.py with test plan (project-chip#43119)

* Implement ICACCSRRequest handler guard

* Restyled by clang-format

* Reset mVerifiedFabricIndex at the start of HandleAnnounceJointFabricAdministrator

* Update TC_JFADMIN to test VIDNotVerified response from ICACCSRRequest

* Switch pairing command to use onnetwork-long with discriminator

* Add missing shutdowns

* full compile of todos in HandleICACCSReq, no testing yet

* Successful compile of handle ICAC checks, still no tests

* change for passing all current tests in JFADMIN2_2

* fixed error on handle fabric index from testing

* Quick python testing changes of uncommented test case 8, not fully working

* Add test step details

* Move commissioning and subsequent actions from setup to step 1

* Rename JFADMIN 2.2 to JFPKI 2.2

* Reimplement test steps using enums instead of strings

* Add a try/finally to shut down the resources initialized at the start of the script

* Remove outdated todo

* Remove unnecessary guard on VIDNotVerified check

* Reorder HandleICACCSRRequest checks to satisfy TC_JFPKI_2_2

* Implement JFPKI_2_2 steps 5-7

* Add TC_JFPKI_2.2.py to slow_tests

* Implement all TC_JFPKI_2_2 steps except 17

* Use teardown_class for resource shutdown

* Refactor to use default_controller

* Immediately expire failsafes to speed up the test

* Implement Step 17

* Clean up code

* Switch to with assert_raises where relevant

* Relocate VID verification tracking to joint-fabric-administrator-server

* Revert ReadAdministratorFabricIndex implementation

* Add PICS and desc

* Use new name in desc_TC_JFPKI_2_2

* Implement Copilot feedback

* Remove section number from description

---------

Co-authored-by: Restyled.io <commits@restyled.io>
Co-authored-by: Zack Foreman <z.foreman@cablelabs.com>
Co-authored-by: Robert Farnum <robertfarnum@gmail.com>

Author: 4 people

src/app/clusters/joint-fabric-administrator-server/joint-fabric-administrator-server.cpp

@@ -22,6 +22,7 @@
 
 #include <access/AccessControl.h>
 #include <app-common/zap-generated/attributes/Accessors.h>
+#include <app-common/zap-generated/cluster-objects.h>
 #include <app-common/zap-generated/ids/Attributes.h>
 #include <app/AttributeAccessInterface.h>
 #include <app/AttributeAccessInterfaceRegistry.h>
@@ -74,6 +75,7 @@ class JointFabricAdministratorGlobalInstance : public AttributeAccessInterface,
     {}
 
     CHIP_ERROR Read(const ConcreteReadAttributePath & aPath, AttributeValueEncoder & aEncoder) override;
+    void OnFailSafeTimerExpired();
 
 private:
     CHIP_ERROR ReadAdministratorFabricIndex(AttributeValueEncoder & aEncoder);
@@ -90,6 +92,10 @@ class JointFabricAdministratorGlobalInstance : public AttributeAccessInterface,
 
     static void OnTrustVerificationCompletion(CHIP_ERROR err);
 
+    CHIP_ERROR VerifyAddICACStep1(const FabricIndex accessFabric, const Commands::AddICAC::DecodableType & commandData);
+    CHIP_ERROR VerifyAddICACPublicKey(const Commands::AddICAC::DecodableType & commandData);
+    CHIP_ERROR VerifyAddICACDNEncodingRules(const Commands::AddICAC::DecodableType & commandData);
+
     // Cleans up asynchronous resources used in HandleAnnounceJointFabricAdministrator
     void CleanupAnnounceJFA();
 
@@ -99,6 +105,18 @@ class JointFabricAdministratorGlobalInstance : public AttributeAccessInterface,
 
 JointFabricAdministratorGlobalInstance gJointFabricAdministratorGlobalInstance;
 
+namespace {
+void OnPlatformEventHandler(const chip::DeviceLayer::ChipDeviceEvent * event, intptr_t arg)
+{
+    if (event->Type == DeviceLayer::DeviceEventType::kFailSafeTimerExpired)
+    {
+        auto * instance = reinterpret_cast<JointFabricAdministratorGlobalInstance *>(arg);
+        VerifyOrReturn(instance != nullptr);
+        instance->OnFailSafeTimerExpired();
+    }
+}
+} // anonymous namespace
+
 CHIP_ERROR JointFabricAdministratorGlobalInstance::Read(const ConcreteReadAttributePath & aPath, AttributeValueEncoder & aEncoder)
 {
     VerifyOrDie(aPath.mClusterId == JointFabricAdministratorCluster::Id);
@@ -167,6 +185,7 @@ void JointFabricAdministratorGlobalInstance::HandleOJCW(HandlerContext & ctx,
     Optional<StatusCodeEnum> status = Optional<StatusCodeEnum>::Missing();
     Status globalStatus             = Status::Success;
     Spake2pVerifier verifier;
+    DataModel::Nullable<FabricIndex> administratorFabricIndex;
 
     ChipLogProgress(Zcl, "Received command to open joint commissioning window");
 
@@ -176,6 +195,11 @@ void JointFabricAdministratorGlobalInstance::HandleOJCW(HandlerContext & ctx,
     auto & commissionMgr          = Server::GetInstance().GetCommissioningWindowManager();
 
     VerifyOrExit(fabricInfo != nullptr, status.Emplace(StatusCodeEnum::kPAKEParameterError));
+    VerifyOrExit(Attributes::AdministratorFabricIndex::Get(ctx.mRequestPath.mEndpointId, administratorFabricIndex) ==
+                     Status::Success,
+                 globalStatus = Status::Failure);
+    VerifyOrExit(!administratorFabricIndex.IsNull() && administratorFabricIndex.Value() != 0,
+                 status.Emplace(StatusCodeEnum::kInvalidAdministratorFabricIndex));
     VerifyOrExit(failSafeContext.IsFailSafeFullyDisarmed(), status.Emplace(StatusCodeEnum::kBusy));
 
     VerifyOrExit(!commissionMgr.IsCommissioningWindowOpen(), status.Emplace(StatusCodeEnum::kBusy));
@@ -219,14 +243,19 @@ void JointFabricAdministratorGlobalInstance::HandleAnnounceJointFabricAdministra
 
     std::optional<Status> globalStatus = std::nullopt;
     ConcreteCommandPath cachedPath(ctx.mRequestPath.mEndpointId, ctx.mRequestPath.mClusterId, ctx.mRequestPath.mCommandId);
+    const FabricIndex accessingFabricIndex = ctx.mCommandHandler.GetAccessingFabricIndex();
+
+    // Ensure that the accessing fabric is not marked as verified before we proceed
+    Server::GetInstance().GetJointFabricAdministrator().ClearVidVerificationForFabric();
 
-    auto onComplete = [this, cachedPath](const CHIP_ERROR & err) {
+    auto onComplete = [this, cachedPath, accessingFabricIndex](const CHIP_ERROR & err) {
         if (mActiveCommandHandle.has_value())
         {
             auto * commandHandler = mActiveCommandHandle.value().Get();
             if (err == CHIP_NO_ERROR)
             {
                 ChipLogProgress(JointFabric, "Successfully verified trust against commissioning fabric administrator");
+                Server::GetInstance().GetJointFabricAdministrator().SetVidVerificationForFabric(accessingFabricIndex);
                 commandHandler->AddStatus(cachedPath, Status::Success);
             }
             else
@@ -236,8 +265,6 @@ void JointFabricAdministratorGlobalInstance::HandleAnnounceJointFabricAdministra
             }
         }
 
-        // TODO: Potential edge case: if TrustVerification is interrupted such that this callback isn't invoked,
-        // CleanupAnnounceJFA wouldn't run and HandleAnnounceJointFabricAdministrator will permanently return Status::Busy.
         CleanupAnnounceJFA();
     };
 
@@ -267,19 +294,28 @@ void JointFabricAdministratorGlobalInstance::CleanupAnnounceJFA()
     mActiveCommandHandle.reset();
 }
 
+void JointFabricAdministratorGlobalInstance::OnFailSafeTimerExpired()
+{
+    CleanupAnnounceJFA();
+    Server::GetInstance().GetJointFabricAdministrator().ClearVidVerificationForFabric();
+    Server::GetInstance().GetJointFabricAdministrator().SetPeerJFAdminClusterEndpointId(kInvalidEndpointId);
+}
+
 void JointFabricAdministratorGlobalInstance::HandleICACCSRRequest(HandlerContext & ctx,
                                                                   const Commands::ICACCSRRequest::DecodableType & commandData)
 {
     MATTER_TRACE_SCOPE("ICACCSRRequest", "JointFabricAdministrator");
     ChipLogProgress(Zcl, "JointFabricAdministrator: Received an ICACCSRRequest command");
 
     auto nonDefaultStatus           = Status::Success;
+    Optional<StatusCodeEnum> status = Optional<StatusCodeEnum>::Missing();
     auto & failSafeContext          = Server::GetInstance().GetFailSafeContext();
     auto & jointFabricAdministrator = Server::GetInstance().GetJointFabricAdministrator();
 
     uint8_t buf[Credentials::kMaxDERCertLength];
     MutableByteSpan icacCsr(buf, Credentials::kMaxDERCertLength);
     Commands::ICACCSRResponse::Type response;
+    DataModel::Nullable<FabricIndex> administratorFabricIndex;
 
     // command must be invoked over CASE
     VerifyOrExit(ctx.mCommandHandler.GetSubjectDescriptor().authMode == Access::AuthMode::kCase,
@@ -288,20 +324,28 @@ void JointFabricAdministratorGlobalInstance::HandleICACCSRRequest(HandlerContext
     VerifyOrExit(failSafeContext.IsFailSafeArmed(ctx.mCommandHandler.GetAccessingFabricIndex()),
                  nonDefaultStatus = Status::FailsafeRequired);
 
-    /* TODO spec.: If the <<ref_FabricTableVendorIdVerificationProcedure, FabricFabric Table Vendor ID Verification Procedure>>
-     * has not been executed against the initiator of this command, the command SHALL fail
-     * with a <<ref_JFVidNotVerified, JfVidNotVerified>> status code SHALL be sent back to the initiator.*/
-
     VerifyOrExit(!failSafeContext.AddICACCommandHasBeenInvoked(), nonDefaultStatus = Status::ConstraintError);
 
+    VerifyOrExit(jointFabricAdministrator.WasVidVerificationExecutedForFabric(ctx.mCommandHandler.GetAccessingFabricIndex()),
+                 status.Emplace(StatusCodeEnum::kVIDNotVerified));
+
+    VerifyOrExit(Attributes::AdministratorFabricIndex::Get(ctx.mRequestPath.mEndpointId, administratorFabricIndex) ==
+                     Status::Success,
+                 nonDefaultStatus = Status::Failure);
+    VerifyOrExit(!administratorFabricIndex.IsNull(), status.Emplace(StatusCodeEnum::kInvalidAdministratorFabricIndex));
+
     VerifyOrExit(jointFabricAdministrator.GetDelegate() != nullptr, nonDefaultStatus = Status::Failure);
     VerifyOrExit(jointFabricAdministrator.GetDelegate()->GetIcacCsr(icacCsr) == CHIP_NO_ERROR, nonDefaultStatus = Status::Failure);
 
     response.icaccsr = icacCsr;
     ctx.mCommandHandler.AddResponse(ctx.mRequestPath, response);
 
 exit:
-    if (nonDefaultStatus != Status::Success)
+    if (status.HasValue())
+    {
+        TEMPORARY_RETURN_IGNORED ctx.mCommandHandler.AddClusterSpecificFailure(ctx.mRequestPath, to_underlying(status.Value()));
+    }
+    else if (nonDefaultStatus != Status::Success)
     {
         ctx.mCommandHandler.AddStatus(ctx.mRequestPath, nonDefaultStatus);
     }
@@ -313,9 +357,9 @@ void JointFabricAdministratorGlobalInstance::HandleAddICAC(HandlerContext & ctx,
     MATTER_TRACE_SCOPE("AddICAC", "JointFabricAdministrator");
     ChipLogProgress(Zcl, "JointFabricAdministrator: Received an AddICAC command");
 
-    auto nonDefaultStatus  = Status::Success;
-    auto & failSafeContext = Server::GetInstance().GetFailSafeContext();
-
+    auto nonDefaultStatus                   = Status::Success;
+    auto & failSafeContext                  = Server::GetInstance().GetFailSafeContext();
+    Optional<ICACResponseStatusEnum> status = Optional<ICACResponseStatusEnum>::Missing();
     // command must be invoked over CASE
     VerifyOrExit(ctx.mCommandHandler.GetSubjectDescriptor().authMode == Access::AuthMode::kCase,
                  nonDefaultStatus = Status::InvalidCommand);
@@ -326,12 +370,70 @@ void JointFabricAdministratorGlobalInstance::HandleAddICAC(HandlerContext & ctx,
     VerifyOrExit(!failSafeContext.AddICACCommandHasBeenInvoked(), nonDefaultStatus = Status::ConstraintError);
     failSafeContext.SetAddICACHasBeenInvoked();
 
-    /* TODO: implement rest of the AddICAC checks */
+    VerifyOrExit(VerifyAddICACStep1(ctx.mCommandHandler.GetAccessingFabricIndex(), commandData) == CHIP_NO_ERROR,
+                 status.Emplace(ICACResponseStatusEnum::kInvalidICAC));
+
+    VerifyOrExit(VerifyAddICACPublicKey(commandData) == CHIP_NO_ERROR, status.Emplace(ICACResponseStatusEnum::kInvalidPublicKey));
+
+    VerifyOrExit(VerifyAddICACDNEncodingRules(commandData) == CHIP_NO_ERROR, status.Emplace(ICACResponseStatusEnum::kInvalidICAC));
 
 exit:
+    if (status.HasValue())
+    {
+        Commands::ICACResponse::Type response;
+        response.statusCode = status.Value();
+        ctx.mCommandHandler.AddResponse(ctx.mRequestPath, response);
+        return;
+    }
     ctx.mCommandHandler.AddStatus(ctx.mRequestPath, nonDefaultStatus);
 }
 
+CHIP_ERROR JointFabricAdministratorGlobalInstance::VerifyAddICACStep1(const FabricIndex accessFabric,
+                                                                      const Commands::AddICAC::DecodableType & commandData)
+{
+    constexpr uint8_t kMaxCertsInChain = 2;
+    uint8_t rcacBuf[Credentials::kMaxCHIPCertLength];
+    MutableByteSpan rcacSpan{ rcacBuf };
+    ChipCertificateSet certificates;
+    ValidationContext validContext;
+
+    ReturnErrorOnFailure(Server::GetInstance().GetFabricTable().FetchRootCert(accessFabric, rcacSpan));
+    ReturnErrorOnFailure(certificates.Init(kMaxCertsInChain));
+    ReturnErrorOnFailure(certificates.LoadCert(rcacSpan, BitFlags<CertDecodeFlags>(CertDecodeFlags::kIsTrustAnchor)));
+    ReturnErrorOnFailure(
+        certificates.LoadCert(commandData.ICACValue, BitFlags<CertDecodeFlags>(CertDecodeFlags::kGenerateTBSHash)));
+    validContext.Reset();
+    validContext.mRequiredKeyUsages.Set(KeyUsageFlags::kKeyCertSign);
+    validContext.mRequiredCertType = CertType::kICA;
+    return certificates.ValidateCert(certificates.GetLastCert(), validContext);
+}
+
+CHIP_ERROR JointFabricAdministratorGlobalInstance::VerifyAddICACPublicKey(const Commands::AddICAC::DecodableType & commandData)
+{
+    uint8_t csrBuf[Credentials::kMaxDERCertLength];
+    MutableByteSpan icacCsr{ csrBuf };
+    Crypto::P256PublicKey csrPubKey;
+    Credentials::P256PublicKeySpan icacPubKeySpan;
+
+    auto & jointFabricAdministrator = Server::GetInstance().GetJointFabricAdministrator();
+    VerifyOrReturnError(jointFabricAdministrator.GetDelegate() != nullptr, CHIP_ERROR_INCORRECT_STATE);
+    ReturnErrorOnFailure(jointFabricAdministrator.GetDelegate()->GetIcacCsr(icacCsr));
+    ReturnErrorOnFailure(Crypto::VerifyCertificateSigningRequest(icacCsr.data(), icacCsr.size(), csrPubKey));
+    ReturnErrorOnFailure(Credentials::ExtractPublicKeyFromChipCert(commandData.ICACValue, icacPubKeySpan));
+
+    Credentials::P256PublicKeySpan csrPubKeySpan(csrPubKey.ConstBytes());
+    VerifyOrReturnError(memcmp(icacPubKeySpan.data(), csrPubKeySpan.data(), icacPubKeySpan.size()) == 0,
+                        CHIP_ERROR_INVALID_ARGUMENT);
+    return CHIP_NO_ERROR;
+}
+
+CHIP_ERROR
+JointFabricAdministratorGlobalInstance::VerifyAddICACDNEncodingRules(const Commands::AddICAC::DecodableType & commandData)
+{
+    Credentials::ChipCertificateData certData;
+    return Credentials::DecodeChipCert(commandData.ICACValue, certData);
+}
+
 void JointFabricAdministratorGlobalInstance::HandleTransferAnchorRequest(
     HandlerContext & ctx, const Commands::TransferAnchorRequest::DecodableType & commandData)
 {
@@ -374,10 +476,13 @@ void MatterJointFabricAdministratorPluginServerInitCallback()
     ChipLogProgress(DataManagement, "JointFabricAdministrator: initializing");
     AttributeAccessInterfaceRegistry::Instance().Register(&gJointFabricAdministratorGlobalInstance);
     ReturnOnFailure(CommandHandlerInterfaceRegistry::Instance().RegisterCommandHandler(&gJointFabricAdministratorGlobalInstance));
+    ReturnOnFailure(DeviceLayer::PlatformMgr().AddEventHandler(
+        OnPlatformEventHandler, reinterpret_cast<intptr_t>(&gJointFabricAdministratorGlobalInstance)));
 }
 
 void MatterJointFabricAdministratorPluginServerShutdownCallback()
 {
+    DeviceLayer::PlatformMgr().RemoveEventHandler(OnPlatformEventHandler);
     AttributeAccessInterfaceRegistry::Instance().Unregister(&gJointFabricAdministratorGlobalInstance);
     ReturnOnFailure(CommandHandlerInterfaceRegistry::Instance().UnregisterCommandHandler(&gJointFabricAdministratorGlobalInstance));
 }

src/app/server/JointFabricAdministrator.h

@@ -20,8 +20,11 @@
 #include <app-common/zap-generated/cluster-objects.h>
 #include <lib/core/CHIPPersistentStorageDelegate.h>
 #include <lib/core/CHIPVendorIdentifiers.hpp>
+#include <lib/core/DataModelTypes.h>
 #include <lib/core/NodeId.h>
 
+#include <optional>
+
 namespace chip {
 namespace app {
 
@@ -48,6 +51,13 @@ class JointFabricAdministrator
         mPeerJFAdminClusterEndpointId = peerJFAdminClusterEndpointId;
     }
 
+    void SetVidVerificationForFabric(chip::FabricIndex fabricIndex) { mVidVerificationFabricIndex = fabricIndex; }
+    void ClearVidVerificationForFabric() { mVidVerificationFabricIndex.reset(); }
+    bool WasVidVerificationExecutedForFabric(chip::FabricIndex fabricIndex) const
+    {
+        return mVidVerificationFabricIndex.has_value() && (mVidVerificationFabricIndex.value() == fabricIndex);
+    }
+
     CHIP_ERROR SetDelegate(JointFabricAdministrator::Delegate * delegate)
     {
         VerifyOrReturnError(delegate != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
@@ -62,6 +72,7 @@ class JointFabricAdministrator
 
 private:
     chip::EndpointId mPeerJFAdminClusterEndpointId = chip::kInvalidEndpointId;
+    std::optional<chip::FabricIndex> mVidVerificationFabricIndex;
     JointFabricAdministrator::Delegate * mDelegate = nullptr;
 };