Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Persist NOC and ICA after async retrieval #8090

Closed
samadDotDev opened this issue Jul 2, 2021 · 1 comment
Closed

Persist NOC and ICA after async retrieval #8090

samadDotDev opened this issue Jul 2, 2021 · 1 comment

Comments

@samadDotDev
Copy link
Contributor

Problem

The CHIP device controller is not persisting the credentials (NOC and ICA) upon async retrieval from OperationalCredentialsDelegate. Currently, AdminPairingTable::Store(adminId) is called after root certificate has been retrieved while request for NOC is pending.

Expected Behavior

All credentials should be persisted, and loaded into runtime credentials for controller after they are available. Any subsequent operations requiring these credentials (such as Pairing) should also be delayed until the credentials are loaded.

Actual Behavior

Only root certificate is persisted, whereas NOC and ICA are not. Also, these are only set in adminPairingInfo and not loaded into controller's runtime credentials upon OnLocalNOCGenerated callback.

Steps to Reproduce

  1. Clear any persistent storage
  2. Initialize controller, it should request NOC through operational credentials delegate (upon not finding them in storage)
  3. Return OnLocalNOCGenerated callback with some delay assuming NOC was generated through a service.
  4. Re-initialize controller, it would only have retained root cert, but since NOC and ICA weren't persisted in storage, they will be requested again.

Proposed Solution

Store and load credentials after successful retrieval (and setting in adminPairingInfo object) in OnLocalNOCGenerated callback using following operations here

SuccessOrExit(controller->mAdmins.Store(controller->mAdminId));
SuccessOrExit(admin->GetCredentials(controller->mCredentials, controller->mCertificates, controller->mRootKeyId));

Any attempts to operations requiring these credentials should also be either delayed or returned with error.

@samadDotDev
Copy link
Contributor Author

Combining the certificates in a single NOC chain also solves this issue. This was fixed by certificates sequence PR #8550.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant