Restricted controller apps to scan and pair only with JF-compatible devices (project-chip#40414)

Author: vijs

examples/chip-tool/commands/discover/DiscoverCommissionablesCommand.cpp

@@ -23,8 +23,13 @@
 
 using namespace ::chip;
 
-void DiscoverCommissionablesCommandBase::OnDiscoveredDevice(const chip::Dnssd::CommissionNodeData & nodeData)
+void DiscoverCommissionablesCommandBase::OnDiscoveredDevice(const Dnssd::CommissionNodeData & nodeData)
 {
+    if (mCommissioningMode.HasValue() && nodeData.commissioningMode != mCommissioningMode.Value())
+    {
+        return; // Skip nodes that do not match the commissioning mode filter.
+    }
+
     nodeData.LogDetail();
     LogErrorOnFailure(RemoteDataModelLogger::LogDiscoveredNodeData(nodeData));
 

examples/chip-tool/commands/discover/DiscoverCommissionablesCommand.h

@@ -20,6 +20,8 @@
 
 #include "../common/CHIPCommand.h"
 
+#include <lib/dnssd/Advertiser.h>
+
 class DiscoverCommissionablesCommandBase : public CHIPCommand, public chip::Controller::DeviceDiscoveryDelegate
 {
 public:
@@ -39,6 +41,8 @@ class DiscoverCommissionablesCommandBase : public CHIPCommand, public chip::Cont
 protected:
     chip::Controller::DeviceCommissioner * mCommissioner;
 
+    chip::Optional<uint64_t> mCommissioningMode;
+
 private:
     chip::Optional<bool> mDiscoverOnce;
 };
@@ -121,7 +125,12 @@ class DiscoverCommissionableByCommissioningModeCommand : public DiscoverCommissi
 public:
     DiscoverCommissionableByCommissioningModeCommand(CredentialIssuerCommands * credsIssuerConfig) :
         DiscoverCommissionablesCommandBase("find-commissionable-by-commissioning-mode", credsIssuerConfig)
-    {}
+    {
+        AddArgument("commissioning-mode", chip::to_underlying(chip::Dnssd::CommissioningMode::kEnabledBasic),
+                    chip::to_underlying(chip::Dnssd::CommissioningMode::kEnabledJointFabric), &mCommissioningMode,
+                    "Optional integer value representing the commissioning mode to filter devices. If provided, only devices with "
+                    "the specified commissioning mode will be discovered.");
+    }
 
     /////////// CHIPCommand Interface /////////
     CHIP_ERROR RunCommand() override;

examples/jf-control-app/commands/pairing/PairingCommand.cpp

@@ -27,6 +27,7 @@
 #include <credentials/CHIPCert.h>
 #include <crypto/CHIPCryptoPAL.h>
 #include <lib/core/CHIPSafeCasts.h>
+#include <lib/dnssd/Advertiser.h>
 #include <lib/support/logging/CHIPLogging.h>
 #include <protocols/secure_channel/PASESession.h>
 
@@ -468,10 +469,6 @@ CHIP_ERROR PairingCommand::PairWithMdns(NodeId remoteId)
         filter.code = mDiscoveryFilterCode;
         break;
     case Dnssd::DiscoveryFilterType::kCommissioningMode:
-        if (mExecuteJCM.ValueOr(false))
-        {
-            filter.code = 3;
-        }
         break;
     case Dnssd::DiscoveryFilterType::kCommissioner:
         filter.code = 1;
@@ -840,7 +837,13 @@ void PairingCommand::OnICDStayActiveComplete(ScopedNodeId deviceId, uint32_t pro
 void PairingCommand::OnDiscoveredDevice(const Dnssd::CommissionNodeData & nodeData)
 {
     // Ignore nodes with closed commissioning window
-    VerifyOrReturn(nodeData.commissioningMode != 0);
+    VerifyOrReturn(nodeData.commissioningMode != to_underlying(Dnssd::CommissioningMode::kDisabled));
+
+    if (mJCM.ValueOr(false) && nodeData.commissioningMode != to_underlying(Dnssd::CommissioningMode::kEnabledJointFabric))
+    {
+        ChipLogProgress(chipTool, "Skipping device with commissioning mode %u", nodeData.commissioningMode);
+        return; // Skip nodes that do not match the JCM commissioning mode.
+    }
 
     auto & resolutionData = nodeData;
 

examples/jf-control-app/commands/pairing/PairingCommand.h

@@ -332,7 +332,6 @@ class PairingCommand : public CHIPCommand,
     bool mDeviceIsICD = false;
     uint8_t mRandomGeneratedICDSymmetricKey[chip::Crypto::kAES_CCM128_Key_Length];
 
-    chip::Optional<bool> mExecuteJCM;
     ::pw::rpc::NanopbClientReader<::RequestOptions> rpcGetStream;
 
     // For unpair

src/controller/CHIPDeviceController.cpp

@@ -3805,5 +3805,15 @@ CHIP_ERROR DeviceController::GetRootPublicKey(Crypto::P256PublicKey & outRootPub
     return fabricTable->FetchRootPubkey(mFabricIndex, outRootPublicKey);
 }
 
+bool DeviceCommissioner::HasValidCommissioningMode(const Dnssd::CommissionNodeData & nodeData)
+{
+    if (nodeData.commissioningMode == to_underlying(Dnssd::CommissioningMode::kDisabled))
+    {
+        ChipLogProgress(Controller, "Discovered device does not have an open commissioning window.");
+        return false;
+    }
+    return true;
+}
+
 } // namespace Controller
 } // namespace chip

src/controller/CHIPDeviceController.h

@@ -836,6 +836,9 @@ class DLL_EXPORT DeviceCommissioner : public DeviceController,
                                          /* fireAndForget = */ true);
     }
 
+    // Check if the commissioning mode is valid for the current commissioning parameters.
+    virtual bool HasValidCommissioningMode(const Dnssd::CommissionNodeData & nodeData);
+
 protected:
     // Cleans up and resets failsafe as appropriate depending on the error and the failed stage.
     // For success, sends completion report with the CommissioningDelegate and sends callbacks to the PairingDelegate

src/controller/SetUpCodePairer.cpp

@@ -491,11 +491,9 @@ bool SetUpCodePairer::NodeMatchesCurrentFilter(const Dnssd::DiscoveredNodeData &
     }
 
     const Dnssd::CommissionNodeData & nodeData = discNodeData.Get<Dnssd::CommissionNodeData>();
-    if (nodeData.commissioningMode == 0)
-    {
-        ChipLogProgress(Controller, "Discovered device does not have an open commissioning window.");
-        return false;
-    }
+
+    VerifyOrReturnError(mCommissioner != nullptr, false);
+    VerifyOrReturnError(mCommissioner->HasValidCommissioningMode(nodeData), false);
 
     // Check whether this matches one of our setup payloads.
     for (auto & payload : mSetupPayloads)

src/controller/jcm/DeviceCommissioner.cpp

@@ -24,6 +24,7 @@
 #include <credentials/CHIPCert.h>
 #include <lib/core/CHIPCore.h>
 #include <lib/core/CHIPError.h>
+#include <lib/dnssd/Advertiser.h>
 
 using namespace ::chip;
 using namespace ::chip::app;
@@ -534,6 +535,25 @@ void DeviceCommissioner::CleanupCommissioning(DeviceProxy * proxy, NodeId nodeId
     mInfo.Cleanup();
 }
 
+bool DeviceCommissioner::HasValidCommissioningMode(const Dnssd::CommissionNodeData & nodeData)
+{
+    if (GetCommissioningParameters().HasValue() && GetCommissioningParameters().Value().GetUseJCM().ValueOr(false))
+    {
+        if (nodeData.commissioningMode != to_underlying(Dnssd::CommissioningMode::kEnabledJointFabric))
+        {
+            ChipLogProgress(Controller, "Discovered device has a commissioning mode (%u) that is not supported by JCM.",
+                            static_cast<unsigned>(nodeData.commissioningMode));
+            return false;
+        }
+    }
+    else
+    {
+        return chip::Controller::DeviceCommissioner::HasValidCommissioningMode(nodeData);
+    }
+
+    return true;
+}
+
 } // namespace JCM
 } // namespace Controller
 } // namespace chip

src/controller/jcm/DeviceCommissioner.h

@@ -88,6 +88,8 @@ class DeviceCommissioner : public chip::Controller::DeviceCommissioner
      */
     TrustVerificationInfo & GetTrustVerificationInfo() { return mInfo; }
 
+    bool HasValidCommissioningMode(const Dnssd::CommissionNodeData & nodeData) override;
+
 protected:
     // Override ParseExtraCommissioningInfo to parse JCM administrator info
     CHIP_ERROR ParseExtraCommissioningInfo(ReadCommissioningInfo & info, const CommissioningParameters & params) override;