Added CASE Authenticated Tags Support to Access Control Check. (#12689)

* Added CASE Authenticated Tags Support to Access Control Check. -- Added CATValues field to the SubjectDescriptor struct -- Moved declaration of CASEAuthTag and CATValues into separate file src/lib/core/CASEAuthTag.h -- Added new CAT test cases to TestAccessControl.cpp -- Minor test cleanups * fixed typo in the TestDeleteEntry() access control test.
project-chip · Oct 21, 2023 · 1480042 · 1480042
1 parent 87d714a
commit 1480042
Show file tree

Hide file tree

Showing 17 changed files with 504 additions and 391 deletions.
diff --git a/src/access/AccessControl.cpp b/src/access/AccessControl.cpp
@@ -20,7 +20,9 @@
 
 namespace {
 
+using chip::CATValues;
 using chip::FabricIndex;
+using chip::NodeId;
 using namespace chip::Access;
 
 AccessControl defaultAccessControl;
@@ -115,12 +117,46 @@ CHIP_ERROR AccessControl::Check(const SubjectDescriptor & subjectDescriptor, con
             {
                 NodeId subject = kUndefinedNodeId;
                 ReturnErrorOnFailure(entry.GetSubject(i, subject));
-                if (subject == subjectDescriptor.subjects[0])
+                if (IsOperationalNodeId(subject))
                 {
-                    subjectMatched = true;
-                    break;
+                    if (subject == subjectDescriptor.subject)
+                    {
+                        subjectMatched = true;
+                        break;
+                    }
+                }
+                else if (IsGroupId(subject))
+                {
+                    VerifyOrReturnError(authMode == AuthMode::kGroup, CHIP_ERROR_INVALID_ARGUMENT);
+                    if (subject == subjectDescriptor.subject)
+                    {
+                        subjectMatched = true;
+                        break;
+                    }
+                }
+                // TODO: Add the implicit admit for PASE after the spec is updated.
+                else if (IsPAKEKeyId(subject))
+                {
+                    VerifyOrReturnError(authMode == AuthMode::kPase, CHIP_ERROR_INVALID_ARGUMENT);
+                    if (subject == subjectDescriptor.subject)
+                    {
+                        subjectMatched = true;
+                        break;
+                    }
+                }
+                else if (IsCASEAuthTag(subject))
+                {
+                    VerifyOrReturnError(authMode == AuthMode::kCase, CHIP_ERROR_INVALID_ARGUMENT);
+                    if (subjectDescriptor.cats.CheckSubjectAgainstCATs(subject))
+                    {
+                        subjectMatched = true;
+                        break;
+                    }
+                }
+                else
+                {
+                    return CHIP_ERROR_INVALID_ARGUMENT;
                 }
-                // TODO: check against CATs in subject descriptor
             }
             if (!subjectMatched)
             {

diff --git a/src/access/SubjectDescriptor.h b/src/access/SubjectDescriptor.h
@@ -20,6 +20,7 @@
 
 #include "AuthMode.h"
 
+#include <lib/core/CASEAuthTag.h>
 #include <lib/core/DataModelTypes.h>
 #include <lib/core/NodeId.h>
 
@@ -36,9 +37,11 @@ struct SubjectDescriptor
 
     // NOTE: due to packing there should be free bytes here
 
-    // Holds subjects according to auth mode, and the latter two are only valid
-    // if auth mode is CASE.
-    NodeId subjects[3] = { kUndefinedNodeId, kUndefinedNodeId, kUndefinedNodeId };
+    // Holds subject according to auth mode.
+    NodeId subject = kUndefinedNodeId;
+
+    // CASE Authenticated Tags (CATs) only valid if auth mode is CASE.
+    CATValues cats;
 };
 
 } // namespace Access