Bring certificate validity logic into spec compliance #19119
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* remove use of hard-coded time * add configuration manager support for firmware build time * implement spec-mandated Last Known Good UTC Time support * enable certificate validity NotBefore checks * add application-injectable certificate validity policies * add ESP32 platform workaround for project-chip#19081 Fixes: project-chip#14202, project-chip#15584
pullapprove
bot
requested review from
anush-apple,
arkq,
Byungjoo-Lee,
bzbarsky-apple,
carol-apple,
chrisdecenzo,
chshu,
chulspro,
Damian-Nordic,
dhrishi and
electrocucaracha
This test revealed that for CASE sessions initiated by the local node, the CASESession holds a null FabricTable reference and instead uses a FabricInfo reference for the initating fabric. This commit changes CASESession to instead always hold FabricTable and FabricIndex. This way the FabricTable is available even from the initiator side, which is needed to retrieve Last Known Good Time. This is also generally better, as it is dangerous to retain FabricInfo references.
|
PR #19119: Size comparison from 588c6fa to 5dab205 Increases above 0.2%:
Increases (26 builds for cc13x2_26x2, cyw30739, efr32, k32w, linux, mbed, p6, telink)
Decreases (3 builds for cc13x2_26x2)
Full report (26 builds for cc13x2_26x2, cyw30739, efr32, k32w, linux, mbed, p6, telink)
|
|
PR #19119: Size comparison from 588c6fa to aa89c3d Increases above 0.2%:
Increases (39 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, p6, telink)
Decreases (3 builds for cc13x2_26x2)
Full report (39 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, p6, telink)
|
|
PR #19119: Size comparison from 588c6fa to 8105df9 Increases above 0.2%:
Increases (37 builds for cc13x2_26x2, cyw30739, efr32, k32w, linux, mbed, p6, telink)
Decreases (3 builds for cc13x2_26x2)
Full report (37 builds for cc13x2_26x2, cyw30739, efr32, k32w, linux, mbed, p6, telink)
|
The ConfigurationManager firmware build time setter is breaking tests because we don't have isolated processes for each unit test execution in NRF. So instead of trying compare the Configuration Manager's reported firmware build time to __DATE__ and __TIME__ macros, which is unreliable with the existence of the setter, verify that our BuildTime.h parsers can correctly parse __DATE__ and __TIME__ in isolation from whatever ConfigurationManager reports as current firmware build time. This has the added benefit of removing Configuration Manager APIs that were only used for testing.
|
PR #19119: Size comparison from 588c6fa to 8343ff7 Increases above 0.2%:
Increases (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (3 builds for cc13x2_26x2)
Full report (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
|
PR #19119: Size comparison from 588c6fa to b3433a4 Increases above 0.2%:
Increases (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
Decreases (3 builds for cc13x2_26x2)
Full report (41 builds for cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, p6, telink)
|
msandstedt
added a commit
to msandstedt/connectedhomeip
that referenced
this pull request
Jun 10, 2022
… of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that the _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inpsection to be giving obviously incorrect time. the GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source.
msandstedt
added a commit
to msandstedt/connectedhomeip
that referenced
this pull request
Jun 10, 2022
… of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inpsection to be giving obviously incorrect time. the GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source.
msandstedt
added a commit
to msandstedt/connectedhomeip
that referenced
this pull request
Jun 10, 2022
… of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inpsection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source.
msandstedt
added a commit
to msandstedt/connectedhomeip
that referenced
this pull request
Jun 10, 2022
… of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inspection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source.
msandstedt
added a commit
to msandstedt/connectedhomeip
that referenced
this pull request
Jun 10, 2022
… of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inspection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source. Fixes project-chip#19459
mkardous-silabs
pushed a commit
to mkardous-silabs/connectedhomeip
that referenced
this pull request
Jun 10, 2022
… of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inspection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source. Fixes project-chip#19459
jmartinez-silabs
pushed a commit
that referenced
this pull request
Jun 10, 2022
… of wall clock time (#19470) * Inject a certificate validity policy that accounts for unavailability of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With #19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inspection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source. Fixes #19459 * per tcarmelveilleux, #if 0 #19081 workaround
step0035
pushed a commit
to hank820/connectedhomeip
that referenced
this pull request
Jun 13, 2022
… of wall clock time (project-chip#19470) * Inject a certificate validity policy that accounts for unavailability of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inspection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source. Fixes project-chip#19459 * per tcarmelveilleux, #if 0 project-chip#19081 workaround
pankore
pushed a commit
to pankore/connectedhomeip
that referenced
this pull request
Jun 13, 2022
… of wall clock time (project-chip#19470) * Inject a certificate validity policy that accounts for unavailability of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inspection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source. Fixes project-chip#19459 * per tcarmelveilleux, #if 0 project-chip#19081 workaround
chrisbeach59
pushed a commit
to chrisbeach59/connectedhomeip
that referenced
this pull request
Jun 19, 2022
… of wall clock time (project-chip#19470) * Inject a certificate validity policy that accounts for unavailability of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inspection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source. Fixes project-chip#19459 * per tcarmelveilleux, #if 0 project-chip#19081 workaround
chrisbeach59
pushed a commit
to chrisbeach59/connectedhomeip
that referenced
this pull request
Jun 29, 2022
… of wall clock time (project-chip#19470) * Inject a certificate validity policy that accounts for unavailability of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inspection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source. Fixes project-chip#19459 * per tcarmelveilleux, #if 0 project-chip#19081 workaround
thcu-gp
pushed a commit
to thcu-gp/connectedhomeip
that referenced
this pull request
Oct 5, 2022
… of wall clock time (project-chip#19470) * Inject a certificate validity policy that accounts for unavailability of wall clock time Most of our in-tree example server platforms do not have wall clock time. But to complicate matters, most are also reporting that they _do_ have wall clock time through the GetClock_RealTime interface. With project-chip#19119, this is now breaking CASE on these platforms. This commit does two things: first, where in-tree example platforms are seen by inspection to be giving obviously incorrect time, GetClock_RealTime now returns an error. Second, a default policy is injected from the server code that ignores NotBefore / NotAfter validation. This prevents NotBefore / NotAfter certificate validation breakages in other server implementations, whether in tree or out of tree, and is pragmatic in that it recognizes that many server-oriented nodes may not have access to a reliable time source. Fixes project-chip#19459 * per tcarmelveilleux, #if 0 project-chip#19081 workaround
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
The sdk is currently using a hard-coded time for certificate validity checks and does not implement the spec-mandated Last Known Good UTC Time feature to seed time information from certificates received at commissioning for nodes that do not have access to wall clock time.
Change overview
This adds support for Last Known Good UTC Time, initializing this to firmware build time, and adds an ability to inject the following into the CHIPCert validation logic:
Last Known Good Time is implemented within the session table, as computation of this requires consideration of all installed certificates. Fail-safe fallback of the Last Known Good Time is also implemented.
With this, hard-coded time can now be removed and NotBefore certificate validity checks can be enabled.
Firmware build time is exposed through the Configuration Manager, with override provided by the CHIP_DEVICE_CONFIG_FIRMWARE_BUILD_TIME and CHIP_DEVICE_CONFIG_FIRMWARE_BUILD_DATE compile-time defines.
Additionally, this provides a workaround to #19081, whereby the ESP32 platform was erroneously reporting that it had access to wall clock time when in reality this was initialized to the CHIP epoch. Now those time methods simply return a not-implemented error.
Fixes: #14202, #15584
Testing
Functional testing was performed with the m5stack platform through several commissioning sequences.