GroupKeyManagement server: Added validation against groupKeySetID == …

…0. (#16683) * GroupKeyManagement server: Added validation against groupKeySetID == 0. * GroupKeyManagement cluster: YAML test added. * GroupKeyManagement cluster: Review comment applied.
project-chip · Oct 12, 2023 · 2419304 · 2419304
1 parent 9ba5038
commit 2419304
Show file tree

Hide file tree

Showing 5 changed files with 230 additions and 104 deletions.
diff --git a/src/app/clusters/group-key-mgmt-server/group-key-mgmt-server.cpp b/src/app/clusters/group-key-mgmt-server/group-key-mgmt-server.cpp
@@ -203,6 +203,9 @@ class GroupKeyManagementAttributeAccess : public AttributeAccessInterface
             {
                 const auto & value = iter.GetValue();
                 VerifyOrReturnError(fabric_index == value.fabricIndex, CHIP_ERROR_INVALID_FABRIC_ID);
+                // Cannot map to IPK, see `GroupKeyMapStruct` in Group Key Management cluster spec
+                VerifyOrReturnError(value.groupKeySetID != 0, CHIP_IM_GLOBAL_STATUS(ConstraintError));
+
                 ReturnErrorOnFailure(provider->SetGroupKeyAt(value.fabricIndex, i++,
                                                              GroupDataProvider::GroupKey(value.groupId, value.groupKeySetID)));
             }
@@ -215,6 +218,8 @@ class GroupKeyManagementAttributeAccess : public AttributeAccessInterface
             VerifyOrReturnError(nullptr != provider, CHIP_ERROR_INTERNAL);
             ReturnErrorOnFailure(aDecoder.Decode(value));
             VerifyOrReturnError(fabric_index == value.fabricIndex, CHIP_ERROR_INVALID_FABRIC_ID);
+            // Cannot map to IPK, see `GroupKeyMapStruct` in Group Key Management cluster spec
+            VerifyOrReturnError(value.groupKeySetID != 0, CHIP_IM_GLOBAL_STATUS(ConstraintError));
 
             {
                 auto iter     = provider->IterateGroupKeys(fabric_index);

diff --git a/src/app/tests/suites/TestGroupKeyManagementCluster.yaml b/src/app/tests/suites/TestGroupKeyManagementCluster.yaml
@@ -138,6 +138,14 @@ tests:
               - name: "GroupKeySetIDs"
                 value: [0x01a1, 0x01a2]
 
+    - label: "Write Group Keys (invalid)"
+      command: "writeAttribute"
+      attribute: "GroupKeyMap"
+      arguments:
+          value: [{ FabricIndex: 1, GroupId: 0x0102, GroupKeySetID: 0 }]
+      response:
+          error: CONSTRAINT_ERROR
+
     - label: "Write Group Keys"
       command: "writeAttribute"
       attribute: "GroupKeyMap"

diff --git a/src/darwin/Framework/CHIPTests/CHIPClustersTests.m b/src/darwin/Framework/CHIPTests/CHIPClustersTests.m
diff --git a/zzz_generated/chip-tool-darwin/zap-generated/test/Commands.h b/zzz_generated/chip-tool-darwin/zap-generated/test/Commands.h