Icd handler

examples/chip-tool/BUILD.gn

@@ -102,6 +102,7 @@ static_library("chip-tool-utils") {
 
   public_deps = [
     "${chip_root}/examples/common/tracing:commandline",
+    "${chip_root}/src/app/icd/client:handler",
     "${chip_root}/src/app/icd/client:manager",
     "${chip_root}/src/app/server",
     "${chip_root}/src/app/tests/suites/commands/interaction_model",

examples/chip-tool/commands/common/CHIPCommand.cpp

@@ -50,6 +50,8 @@ chip::Credentials::GroupDataProviderImpl CHIPCommand::sGroupDataProvider{ kMaxGr
 // All fabrics share the same ICD client storage.
 chip::app::DefaultICDClientStorage CHIPCommand::sICDClientStorage;
 chip::Crypto::RawKeySessionKeystore CHIPCommand::sSessionKeystore;
+chip::app::DefaultCheckInDelegate CHIPCommand::sCheckInDelegate;
+chip::app::CheckInHandler CHIPCommand::sCheckInHandler;
 
 namespace {
 
@@ -139,6 +141,10 @@ CHIP_ERROR CHIPCommand::MaybeSetUpStack()
 
     ReturnErrorOnFailure(GetAttestationTrustStore(mPaaTrustStorePath.ValueOr(nullptr), &sTrustStore));
 
+    ReturnLogErrorOnFailure(sCheckInDelegate.Init(&sICDClientStorage));
+    ReturnLogErrorOnFailure(sCheckInHandler.Init(DeviceControllerFactory::GetInstance().GetSystemState()->ExchangeMgr(),
+                                                 &sICDClientStorage, &sCheckInDelegate));
+
     CommissionerIdentity nullIdentity{ kIdentityNull, chip::kUndefinedNodeId };
     ReturnLogErrorOnFailure(InitializeCommissioner(nullIdentity, kIdentityNullFabricId));
 

examples/chip-tool/commands/common/CHIPCommand.h

@@ -25,6 +25,8 @@
 #include "Command.h"
 
 #include <TracingCommandLineArgument.h>
+#include <app/icd/client/CheckInHandler.h>
+#include <app/icd/client/DefaultCheckInDelegate.h>
 #include <app/icd/client/DefaultICDClientStorage.h>
 #include <commands/common/CredentialIssuerCommands.h>
 #include <commands/example/ExampleCredentialIssuerCommands.h>
@@ -160,6 +162,8 @@ class CHIPCommand : public Command
 
     static chip::Credentials::GroupDataProviderImpl sGroupDataProvider;
     static chip::app::DefaultICDClientStorage sICDClientStorage;
+    static chip::app::DefaultCheckInDelegate sCheckInDelegate;
+    static chip::app::CheckInHandler sCheckInHandler;
     CredentialIssuerCommands * mCredIssuerCmds;
 
     std::string GetIdentity();

examples/tv-casting-app/tv-casting-common/BUILD.gn

@@ -118,6 +118,7 @@ chip_data_model("tv-casting-common") {
 
   deps = [
     "${chip_root}/examples/common/tracing:commandline",
+    "${chip_root}/src/app/icd/client:handler",
     "${chip_root}/src/app/icd/client:manager",
     "${chip_root}/src/app/tests/suites/commands/interaction_model",
     "${chip_root}/src/lib/support/jsontlv",

src/app/icd/client/BUILD.gn

@@ -28,5 +28,25 @@ source_set("manager") {
     "${chip_root}/src/app:app_config",
     "${chip_root}/src/crypto",
     "${chip_root}/src/lib/support",
+    "${chip_root}/src/protocols",
+  ]
+}
+
+# ICD Handler source-set is broken out of the main source-set to enable unit tests
+# All sources and configurations used by the CheckInHandler need to go in this source-set
+source_set("handler") {
+  sources = [
+    "CheckInDelegate.h",
+    "CheckInHandler.cpp",
+    "CheckInHandler.h",
+    "DefaultCheckInDelegate.cpp",
+    "DefaultCheckInDelegate.h",
+  ]
+  public_deps = [
+    ":manager",
+    "${chip_root}/src/app",
+    "${chip_root}/src/lib/core",
+    "${chip_root}/src/messaging",
+    "${chip_root}/src/protocols",
   ]
 }

src/app/icd/client/CheckInDelegate.h

@@ -0,0 +1,82 @@
+/*
+ *
+ *    Copyright (c) 2023 Project CHIP Authors
+ *    All rights reserved.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+
+#pragma once
+
+#include <app/icd/client/ICDClientInfo.h>
+#include <app/icd/client/ICDRefreshKeyInfo.h>
+
+namespace chip {
+namespace app {
+
+/// Callbacks for check in protocol
+/**
+ * @brief The application implementing an ICD client should inherit the CheckInDelegate and implement the listed callbacks
+ */
+class DLL_EXPORT CheckInDelegate
+{
+public:
+    virtual ~CheckInDelegate() {}
+
+    /**
+     * @brief Callback used to let the application know that a check-in message was received and validated.
+     *
+     * @param[in] clientInfo - ICDClientInfo object representing the state associated with the
+                               node that sent the check-in message.
+     */
+    virtual void OnCheckInComplete(const ICDClientInfo & clientInfo) = 0;
+
+    /**
+     * @brief Callback used to let the application know that a key refresh is
+     * needed to avoid counter rollover problems.
+     *
+     * The implementer of this function should generate a new key and store it in a map with peer nodeID as the key and
+     * ICDRefreshKeyInfo as the value.
+     *
+     * @param[in] clientInfo - ICDClientInfo object representing the state associated with the
+                               node that sent the check-in message. The callee can use the clientInfo to determine the type of key
+                               to generate.
+     * @param[out] keyData - pointer to the keyData buffer of size keyDataLength. The implementer of this callback should generate a
+                             new key of size keyLength and copy it to the keyData buffer
+     * @param[in] keyLength - length of the new key to be generated
+     */
+    virtual void OnRefreshKeyGenerate(const ICDClientInfo & clientInfo, uint8_t * keyData, uint8_t keyLength) = 0;
+
+    /**
+     * @brief Callback used to retrieve the refresh key information from the application after establishing a new secure session for
+     * re-registration. The application should be able to store the corresponding ICDRefreshKeyInfo for every peer node. The
+     * application can determine the best way to do this. Please refer to ICDRefreshKeyInfo.h for details.
+     *
+     * @param[in] nodeId - node ID of the peer with whom the client needs to re-register with a new key to avoid rollover problems.
+     * @param[out] refreshKeyInfo - stored refreshKeyInfo for the corresponding nodeId from the ICDRefreshKeyMap
+     */
+    virtual CHIP_ERROR OnRefreshKeyRetrieve(const ScopedNodeId & nodeId, ICDRefreshKeyInfo & refreshKeyInfo) = 0;
+
+    /**
+ * @brief Callback used to let the application know that the re-registration with the new key was successful and provides the
+ * updated ICDClientInfo
+ *
+ * @param[in] clientInfo - ICDClientInfo object representing the state associated with the
+                           node that sent the check-in message. This will have the new key used for registration and the updated icd
+                           counter.
+ */
+    virtual void OnRegistrationComplete(const ICDClientInfo & clientInfo) = 0;
+};
+
+} // namespace app
+} // namespace chip

src/app/icd/client/CheckInHandler.cpp

@@ -0,0 +1,191 @@
+/*
+ *
+ *    Copyright (c) 2023 Project CHIP Authors
+ *    All rights reserved.
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+
+/**
+ *    @file
+ *      This file defines objects for a CHIP ICD handler which handles unsolicited Check-In messages.
+ *
+ */
+
+#include <app/CommandPathParams.h>
+#include <app/InteractionModelTimeout.h>
+#include <app/icd/client/CheckInDelegate.h>
+#include <app/icd/client/CheckInHandler.h>
+#include <app/icd/client/ICDRefreshKeyInfo.h>
+
+#include <cinttypes>
+
+#include <lib/core/Global.h>
+#include <lib/support/CodeUtils.h>
+#include <messaging/Flags.h>
+#include <protocols/Protocols.h>
+
+#include <app/InteractionModelEngine.h>
+#include <app/OperationalSessionSetup.h>
+#include <protocols/secure_channel/Constants.h>
+
+namespace chip {
+namespace app {
+
+inline constexpr uint64_t kCheckInCounterMax = (1ULL << 32);
+inline constexpr uint32_t kKeyRefreshLimit   = (1U << 31);
+
+CheckInHandler::CheckInHandler() :
+    mOnConnectedCallback(HandleDeviceConnected, this), mOnConnectionFailureCallback(HandleDeviceConnectionFailure, this)
+{}
+
+CHIP_ERROR CheckInHandler::Init(Messaging::ExchangeManager * exchangeManager, ICDClientStorage * clientStorage,
+                                CheckInDelegate * delegate)
+{
+    VerifyOrReturnError(exchangeManager != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
+    VerifyOrReturnError(clientStorage != nullptr, CHIP_ERROR_INVALID_ARGUMENT);
+    VerifyOrReturnError(mpExchangeManager == nullptr, CHIP_ERROR_INCORRECT_STATE);
+    VerifyOrReturnError(mpICDClientStorage == nullptr, CHIP_ERROR_INCORRECT_STATE);
+
+    mpExchangeManager  = exchangeManager;
+    mpICDClientStorage = clientStorage;
+    mpCheckInDelegate  = delegate;
+
+    return mpExchangeManager->RegisterUnsolicitedMessageHandlerForType(Protocols::SecureChannel::MsgType::ICD_CheckIn, this);
+}
+
+void CheckInHandler::Shutdown()
+{
+    mpICDClientStorage = nullptr;
+    mpCheckInDelegate  = nullptr;
+    if (mpExchangeManager)
+    {
+        mpExchangeManager->UnregisterUnsolicitedMessageHandlerForType(Protocols::SecureChannel::MsgType::ICD_CheckIn);
+        mpExchangeManager = nullptr;
+    }
+}
+
+CHIP_ERROR CheckInHandler::OnUnsolicitedMessageReceived(const PayloadHeader & payloadHeader, ExchangeDelegate *& newDelegate)
+{
+    // Return error for wrong message type
+    VerifyOrReturnError(payloadHeader.HasMessageType(Protocols::SecureChannel::MsgType::ICD_CheckIn),
+                        CHIP_ERROR_INVALID_MESSAGE_TYPE);
+
+    newDelegate = this;
+    return CHIP_NO_ERROR;
+}
+
+CHIP_ERROR CheckInHandler::OnMessageReceived(Messaging::ExchangeContext * ec, const PayloadHeader & payloadHeader,
+                                             System::PacketBufferHandle && payload)
+{
+    // If the message type is not ICD_CheckIn, return CHIP_NO_ERROR and exit
+    VerifyOrReturnError(payloadHeader.HasMessageType(Protocols::SecureChannel::MsgType::ICD_CheckIn), CHIP_NO_ERROR);
+
+    ByteSpan payloadByteSpan{ payload->Start(), payload->DataLength() };
+    ICDClientInfo clientInfo;
+    CounterType counter = 0;
+    // If the check-in message processing fails, return CHIP_NO_ERROR and exit.
+    VerifyOrReturnError(CHIP_NO_ERROR == mpICDClientStorage->ProcessCheckInPayload(payloadByteSpan, clientInfo, counter),
+                        CHIP_NO_ERROR);
+    CounterType receivedCheckInCounterOffset = (counter - clientInfo.start_icd_counter) % kCheckInCounterMax;
+
+    // Detect duplicate check-in messages and return CHIP_NO_ERROR on receiving a duplicate message
+    if (receivedCheckInCounterOffset <= clientInfo.offset)
+    {
+        ChipLogError(ICD, "A duplicate check-in message was received and discarded");
+        return CHIP_NO_ERROR;
+    }
+
+    clientInfo.offset = receivedCheckInCounterOffset;
+    bool refreshKey   = (receivedCheckInCounterOffset > kKeyRefreshLimit);
+
+    if (refreshKey)
+    {
+        uint8_t newKeyData[chip::Crypto::kAES_CCM128_Key_Length];
+        mpCheckInDelegate->OnRefreshKeyGenerate(clientInfo, newKeyData, chip::Crypto::kAES_CCM128_Key_Length);
+        // A new session should be established to re-register the client using the new key. The registration will happen in
+        // mOnDeviceConnected callback
+        EstablishSessionToPeer(clientInfo.peer_node);
+    }
+    else
+    {
+        mpCheckInDelegate->OnCheckInComplete(clientInfo);
+    }
+
+    return CHIP_NO_ERROR;
+}
+
+CHIP_ERROR CheckInHandler::RegisterClientWithNewKey(ICDClientInfo & clientInfo, ByteSpan newKey,
+                                                    Messaging::ExchangeManager & exchangeMgr, const SessionHandle & sessionHandle)
+{
+    // using namespace Clusters::IcdManagement;
+    // TODO : Determine if using an Objectpool of commandSenders is the best approach here
+    //  app::CommandSender registerCommandSender(&registerCommandSenderDelegate, &exchangeMgr);
+
+    // auto commandPathParams = CommandPathParams(0, 0, Id, Commands::RegisterClient::Id, (CommandPathFlags::kEndpointIdValid));
+    // ReturnErrorOnFailure(registerCommandSender.PrepareCommand(commandPathParams));
+
+    // chip::TLV::TLVWriter * writer = registerCommandSender.GetCommandDataIBTLVWriter();
+
+    // ReturnErrorOnFailure(
+    //     writer->Put(chip::TLV::ContextTag(Commands::RegisterClient::Fields::kCheckInNodeID), clientInfo.peer_node.GetNodeId()));
+    // ReturnErrorOnFailure(
+    //     writer->Put(chip::TLV::ContextTag(Commands::RegisterClient::Fields::kMonitoredSubject), clientInfo.monitored_subject));
+    // ReturnErrorOnFailure(writer->Put(chip::TLV::ContextTag(Commands::RegisterClient::Fields::kKey), newKey));
+
+    // // TODO : We don't have plain data for the old key
+
+    // ReturnErrorOnFailure(registerCommandSender.FinishCommand());
+    // ReturnErrorOnFailure(registerCommandSender.SendCommandRequest(sessionHandle));
+
+    return CHIP_NO_ERROR;
+}
+
+void CheckInHandler::EstablishSessionToPeer(ScopedNodeId peerId)
+{
+    ChipLogProgress(ICD, "Trying to establish a CASE session for re-registering an ICD client");
+    auto * caseSessionManager = InteractionModelEngine::GetInstance()->GetCASESessionManager();
+    VerifyOrReturn(caseSessionManager != nullptr);
+    caseSessionManager->FindOrEstablishSession(peerId, &mOnConnectedCallback, &mOnConnectionFailureCallback);
+}
+
+void CheckInHandler::HandleDeviceConnected(void * context, Messaging::ExchangeManager & exchangeMgr,
+                                           const SessionHandle & sessionHandle)
+{
+    CheckInHandler * const _this = static_cast<CheckInHandler *>(context);
+    VerifyOrDie(_this != nullptr);
+    ICDRefreshKeyInfo refreshKeyInfo;
+    if (CHIP_NO_ERROR !=
+        _this->mpCheckInDelegate->OnRefreshKeyRetrieve(sessionHandle->AsSecureSession()->GetPeer(), refreshKeyInfo))
+    {
+        ChipLogError(ICD, "Failed to retrieve a new key for re-registration of the ICD client");
+    }
+    ByteSpan newKey(refreshKeyInfo.newKey);
+    if (CHIP_NO_ERROR != _this->RegisterClientWithNewKey(refreshKeyInfo.clientInfo, newKey, exchangeMgr, sessionHandle))
+    {
+        ChipLogError(ICD, "Failed to send register client command");
+    }
+}
+
+void CheckInHandler::HandleDeviceConnectionFailure(void * context, const ScopedNodeId & peerId, CHIP_ERROR err)
+{
+    CheckInHandler * const _this = static_cast<CheckInHandler *>(context);
+    VerifyOrDie(_this != nullptr);
+
+    ChipLogError(ICD, "Failed to establish CASE for re-registration with error '%" CHIP_ERROR_FORMAT "'", err.Format());
+}
+
+void CheckInHandler::OnResponseTimeout(Messaging::ExchangeContext * ec) {}
+
+} // namespace app
+} // namespace chip