Add custom privileges for opcreds cluster #16590
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
One attribute and most commands require administer privilege. (Cluster has no events.) Commissioning chip-all-clusters-app via chip-tool on Linux results in the following commands and their required privilege: GeneralCommissioning/ArmFailSafe --> 0x30 0x0 --> operate GeneralCommissioning/SetRegulatoryConfig --> 0x30 0x2 --> operate OperationalCredentials/CertificateChainRequest --> 0x3e 0x2 --> administer OperationalCredentials/CertificateChainRequest --> 0x3e 0x2 --> administer OperationalCredentials/AttestationRequest --> 0x3e 0x0 --> administer OperationalCredentials/CSRRequest --> 0x3e 0x4 --> administer OperationalCredentials/AddTrustedRootCertificate --> 0x3e 0xb --> administer OperationalCredentials/AddNOC --> 0x3e 0x6 --> administer GeneralCommissioning/CommissioningComplete --> 0x30 0x4 --> operate The last is satisfied over CASE (via the AddNOC installed ACL) and the others before it are satisfied by implicit administer privilege over PASE during commissioning.
pullapprove
bot
requested review from
anush-apple,
austinh0,
Byungjoo-Lee,
bzbarsky-apple,
carol-apple,
chrisdecenzo,
chshu,
chulspro,
Damian-Nordic,
dhrishi,
electrocucaracha,
erjiaqing,
franck-apple,
gjc13,
hawk248,
holbrookt,
harsha-rajendran,
isiu-apple,
jelderton,
jepenven-silabs,
jmartinez-silabs,
kghost,
kpschoedel,
lazarkov,
LuDuda and
lzgrablic02
pullapprove
bot
requested review from
mrjerryjohns,
msandstedt,
mspang,
robszewczyk,
sagar-apple,
saurabhst,
selissia,
tecimovic,
vijs,
vivien-apple,
wbschiller,
woody-apple,
xylophone21 and
yufengwangca
|
PR #16590: Size comparison from c7b4913 to db15ace Increases (22 builds for cyw30739, efr32, esp32, k32w, linux, p6)
Decreases (1 build for esp32)
Full report (27 builds for cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
bzbarsky-apple
approved these changes
Mar 24, 2022
|
PR #16590: Size comparison from 011efcf to 73b46f1 Increases (24 builds for cyw30739, efr32, esp32, k32w, linux, p6)
Decreases (3 builds for esp32, linux)
Full report (27 builds for cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
|
PR #16590: Size comparison from c14faeb to a705281 Increases (22 builds for cyw30739, efr32, esp32, k32w, linux, p6)
Decreases (1 build for esp32)
Full report (27 builds for cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
tcarmelveilleux
approved these changes
Mar 25, 2022
rochaferraz
pushed a commit
to rochaferraz/connectedhomeip
that referenced
this pull request
Mar 31, 2022
One attribute and most commands require administer privilege. (This cluster has no events.) Commissioning chip-all-clusters-app via chip-tool on Linux results in the following commands and their required privilege: GeneralCommissioning/ArmFailSafe --> 0x30 0x0 --> operate GeneralCommissioning/SetRegulatoryConfig --> 0x30 0x2 --> operate OperationalCredentials/CertificateChainRequest --> 0x3e 0x2 --> administer OperationalCredentials/CertificateChainRequest --> 0x3e 0x2 --> administer OperationalCredentials/AttestationRequest --> 0x3e 0x0 --> administer OperationalCredentials/CSRRequest --> 0x3e 0x4 --> administer OperationalCredentials/AddTrustedRootCertificate --> 0x3e 0xb --> administer OperationalCredentials/AddNOC --> 0x3e 0x6 --> administer GeneralCommissioning/CommissioningComplete --> 0x30 0x4 --> operate The last is satisfied over CASE (via the AddNOC installed ACL) and the others before it are satisfied by implicit administer privilege over PASE during commissioning.
andrei-menzopol
pushed a commit
to andrei-menzopol/connectedhomeip
that referenced
this pull request
Apr 14, 2022
One attribute and most commands require administer privilege. (This cluster has no events.) Commissioning chip-all-clusters-app via chip-tool on Linux results in the following commands and their required privilege: GeneralCommissioning/ArmFailSafe --> 0x30 0x0 --> operate GeneralCommissioning/SetRegulatoryConfig --> 0x30 0x2 --> operate OperationalCredentials/CertificateChainRequest --> 0x3e 0x2 --> administer OperationalCredentials/CertificateChainRequest --> 0x3e 0x2 --> administer OperationalCredentials/AttestationRequest --> 0x3e 0x0 --> administer OperationalCredentials/CSRRequest --> 0x3e 0x4 --> administer OperationalCredentials/AddTrustedRootCertificate --> 0x3e 0xb --> administer OperationalCredentials/AddNOC --> 0x3e 0x6 --> administer GeneralCommissioning/CommissioningComplete --> 0x30 0x4 --> operate The last is satisfied over CASE (via the AddNOC installed ACL) and the others before it are satisfied by implicit administer privilege over PASE during commissioning.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
Operational Credentials Cluster needs its custom required privileges defined.
Change overview
One attribute and most commands require administer privilege.
(Cluster has no events.)
Testing
Commissioning chip-all-clusters-app via chip-tool on Linux results
in the following commands and their required privilege:
GeneralCommissioning/ArmFailSafe --> 0x30 0x0 --> operate
GeneralCommissioning/SetRegulatoryConfig --> 0x30 0x2 --> operate
OperationalCredentials/CertificateChainRequest --> 0x3e 0x2 --> administer
OperationalCredentials/CertificateChainRequest --> 0x3e 0x2 --> administer
OperationalCredentials/AttestationRequest --> 0x3e 0x0 --> administer
OperationalCredentials/CSRRequest --> 0x3e 0x4 --> administer
OperationalCredentials/AddTrustedRootCertificate --> 0x3e 0xb --> administer
OperationalCredentials/AddNOC --> 0x3e 0x6 --> administer
GeneralCommissioning/CommissioningComplete --> 0x30 0x4 --> operate
The last is satisfied over CASE (via the AddNOC installed ACL) and the
others before it are satisfied by implicit administer privilege over
PASE during commissioning.
Also verified the read of OperationalCredentials/NOCs attribute (0x0).