Add a lint for toplevel "using namespace" in headers.

.github/workflows/lint.yml

@@ -285,3 +285,18 @@ jobs:
               if: always()
               run: |
                   git grep -I -n 'SuccessOrExit([^=)]*(' -- './*' ':(exclude).github/workflows/lint.yml' && exit 1 || exit 0
+
+            # git grep exits with 0 if it finds a match, but we want
+            # to fail (exit nonzero) on match.
+            - name: Check for use of "using namespace" outside of a class/function in headers.
+              if: always()
+              run: |
+                  # Various platforms have `using namespace chip::Ble` in their BLEManager* headers; just exclude those for now.
+                  #
+                  # Exclude platform openiotsdk bits that do this in their persistent storage header.
+                  #
+                  # Also exclude examples (for now) and third_party, which have various instances of this.
+                  #
+                  # Ignore uses of `System::Clock::Literals`, because that's the only way to have things using _ms32 or whatnot
+                  # in a header file.
+                  git grep -I -n -e '^using namespace' --and --not -e 'System::Clock::Literals' -- './**/*.h' ':(exclude)src/platform/*/BLEManager*.h' ':(exclude)src/platform/openiotsdk/KVPsaPsStore.h' ':(exclude)./examples' ':(exclude)./third_party' && exit 1 || exit 0

examples/chip-tool/commands/pairing/IssueNOCChainCommand.h

@@ -46,7 +46,7 @@ class IssueNOCChainCommand : public CHIPCommand
 
     static void OnDeviceNOCChainGeneration(void * context, CHIP_ERROR status, const chip::ByteSpan & noc,
                                            const chip::ByteSpan & icac, const chip::ByteSpan & rcac,
-                                           chip::Optional<chip::IdentityProtectionKeySpan> ipk,
+                                           chip::Optional<chip::Crypto::IdentityProtectionKeySpan> ipk,
                                            chip::Optional<chip::NodeId> adminSubject)
     {
         auto command = static_cast<IssueNOCChainCommand *>(context);

examples/chip-tool/commands/pairing/OpenCommissioningWindowCommand.h

@@ -36,8 +36,8 @@ class OpenCommissioningWindowCommand : public CHIPCommand
                     "1 to use Enhanced Commissioning Method.\n  0 to use Basic Commissioning Method.");
         AddArgument("window-timeout", 0, UINT16_MAX, &mCommissioningWindowTimeout,
                     "Time, in seconds, before the commissioning window closes.");
-        AddArgument("iteration", chip::kSpake2p_Min_PBKDF_Iterations, chip::kSpake2p_Max_PBKDF_Iterations, &mIteration,
-                    "Number of PBKDF iterations to use to derive the verifier.  Ignored if 'option' is 0.");
+        AddArgument("iteration", chip::Crypto::kSpake2p_Min_PBKDF_Iterations, chip::Crypto::kSpake2p_Max_PBKDF_Iterations,
+                    &mIteration, "Number of PBKDF iterations to use to derive the verifier.  Ignored if 'option' is 0.");
         AddArgument("discriminator", 0, 4096, &mDiscriminator, "Discriminator to use for advertising.  Ignored if 'option' is 0.");
         AddArgument("timeout", 0, UINT16_MAX, &mTimeout, "Time, in seconds, before this command is considered to have timed out.");
     }

examples/common/pigweed/rpc_services/Device.h

@@ -31,6 +31,7 @@
 #include "platform/ConfigurationManager.h"
 #include "platform/DiagnosticDataProvider.h"
 #include "platform/PlatformManager.h"
+#include <crypto/CHIPCryptoPAL.h>
 #include <platform/DeviceInstanceInfoProvider.h>
 #include <setup_payload/QRCodeSetupPayloadGenerator.h>
 
@@ -188,9 +189,9 @@ class CommissionableDataProviderRpcWrapper : public DeviceLayer::CommissionableD
 private:
     std::optional<uint16_t> mDiscriminatorOverride;
     std::optional<uint32_t> mPasscodeOverride;
-    Spake2pVerifierSerialized mVerifierBuf;
+    Crypto::Spake2pVerifierSerialized mVerifierBuf;
     std::optional<ByteSpan> mVerifierOverride;
-    uint8_t mSaltBuf[kSpake2p_Max_PBKDF_Salt_Length];
+    uint8_t mSaltBuf[Crypto::kSpake2p_Max_PBKDF_Salt_Length];
     std::optional<ByteSpan> mSaltOverride;
     std::optional<uint32_t> mIterationCountOverride;
     DeviceLayer::CommissionableDataProvider * mCommissionableDataProvider = nullptr;

examples/energy-management-app/energy-management-common/src/ElectricalPowerMeasurementDelegate.cpp

@@ -26,6 +26,8 @@ using namespace chip::app;
 using namespace chip::app::DataModel;
 using namespace chip::app::Clusters;
 using namespace chip::app::Clusters::ElectricalPowerMeasurement;
+using namespace chip::app::Clusters::ElectricalPowerMeasurement::Attributes;
+using namespace chip::app::Clusters::ElectricalPowerMeasurement::Structs;
 
 CHIP_ERROR ElectricalPowerMeasurementInstance::Init()
 {

examples/platform/linux/CommissionerMain.cpp

@@ -71,6 +71,7 @@ using namespace chip::DeviceLayer;
 using namespace chip::Inet;
 using namespace chip::Transport;
 using namespace chip::app::Clusters;
+using namespace chip::Protocols::UserDirectedCommissioning;
 
 using namespace ::chip::Messaging;
 using namespace ::chip::Controller;

examples/tv-app/android/java/TVApp-JNI.cpp

@@ -49,6 +49,7 @@ using namespace chip::app;
 using namespace chip::app::Clusters;
 using namespace chip::AppPlatform;
 using namespace chip::Credentials;
+using namespace chip::Protocols::UserDirectedCommissioning;
 
 #define JNI_METHOD(RETURN, METHOD_NAME) extern "C" JNIEXPORT RETURN JNICALL Java_com_matter_tv_server_tvapp_TvApp_##METHOD_NAME
 
@@ -204,15 +205,15 @@ class MyPincodeService : public PasscodeService
         bool foundApp = ContentAppPlatform::GetInstance().HasTargetContentApp(vendorId, productId, rotatingId, info, passcode);
         if (!foundApp)
         {
-            info.checkState = chip::Controller::TargetAppCheckState::kAppNotFound;
+            info.checkState = TargetAppCheckState::kAppNotFound;
         }
         else if (passcode != 0)
         {
-            info.checkState = chip::Controller::TargetAppCheckState::kAppFoundPasscodeReturned;
+            info.checkState = TargetAppCheckState::kAppFoundPasscodeReturned;
         }
         else
         {
-            info.checkState = chip::Controller::TargetAppCheckState::kAppFoundNoPasscode;
+            info.checkState = TargetAppCheckState::kAppFoundNoPasscode;
         }
         CommissionerDiscoveryController * cdc = GetCommissionerDiscoveryController();
         if (cdc != nullptr)

examples/tv-app/tv-common/src/AppTv.cpp

@@ -52,6 +52,7 @@ extern CommissionerDiscoveryController * GetCommissionerDiscoveryController();
 using namespace chip;
 using namespace chip::AppPlatform;
 using namespace chip::app::Clusters;
+using namespace chip::Protocols::UserDirectedCommissioning;
 
 #if CHIP_DEVICE_CONFIG_ENABLE_BOTH_COMMISSIONER_AND_COMMISSIONEE
 class MyUserPrompter : public UserPrompter

src/app/clusters/administrator-commissioning-server/administrator-commissioning-server.cpp

@@ -42,6 +42,7 @@ using namespace chip::app;
 using namespace chip::app::Clusters;
 using namespace chip::app::Clusters::AdministratorCommissioning;
 using namespace chip::Protocols;
+using namespace chip::Crypto;
 using chip::Protocols::InteractionModel::Status;
 
 class AdministratorCommissioningAttrAccess : public AttributeAccessInterface

src/app/clusters/device-energy-management-server/device-energy-management-server.h

@@ -34,8 +34,6 @@ namespace app {
 namespace Clusters {
 namespace DeviceEnergyManagement {
 
-using namespace chip::app::Clusters::DeviceEnergyManagement::Attributes;
-
 class Delegate
 {
 public:
@@ -160,24 +158,24 @@ class Delegate
 
     // ------------------------------------------------------------------
     // Get attribute methods
-    virtual ESATypeEnum GetESAType()                                                 = 0;
-    virtual bool GetESACanGenerate()                                                 = 0;
-    virtual ESAStateEnum GetESAState()                                               = 0;
-    virtual int64_t GetAbsMinPower()                                                 = 0;
-    virtual int64_t GetAbsMaxPower()                                                 = 0;
-    virtual PowerAdjustmentCapability::TypeInfo::Type GetPowerAdjustmentCapability() = 0;
-    virtual DataModel::Nullable<Structs::ForecastStruct::Type> GetForecast()         = 0;
-    virtual OptOutStateEnum GetOptOutState()                                         = 0;
+    virtual ESATypeEnum GetESAType()                                                             = 0;
+    virtual bool GetESACanGenerate()                                                             = 0;
+    virtual ESAStateEnum GetESAState()                                                           = 0;
+    virtual int64_t GetAbsMinPower()                                                             = 0;
+    virtual int64_t GetAbsMaxPower()                                                             = 0;
+    virtual Attributes::PowerAdjustmentCapability::TypeInfo::Type GetPowerAdjustmentCapability() = 0;
+    virtual DataModel::Nullable<Structs::ForecastStruct::Type> GetForecast()                     = 0;
+    virtual OptOutStateEnum GetOptOutState()                                                     = 0;
 
     // ------------------------------------------------------------------
     // Set attribute methods
-    virtual CHIP_ERROR SetESAType(ESATypeEnum)                                                 = 0;
-    virtual CHIP_ERROR SetESACanGenerate(bool)                                                 = 0;
-    virtual CHIP_ERROR SetESAState(ESAStateEnum)                                               = 0;
-    virtual CHIP_ERROR SetAbsMinPower(int64_t)                                                 = 0;
-    virtual CHIP_ERROR SetAbsMaxPower(int64_t)                                                 = 0;
-    virtual CHIP_ERROR SetPowerAdjustmentCapability(PowerAdjustmentCapability::TypeInfo::Type) = 0;
-    virtual CHIP_ERROR SetForecast(DataModel::Nullable<Structs::ForecastStruct::Type>)         = 0;
+    virtual CHIP_ERROR SetESAType(ESATypeEnum)                                                             = 0;
+    virtual CHIP_ERROR SetESACanGenerate(bool)                                                             = 0;
+    virtual CHIP_ERROR SetESAState(ESAStateEnum)                                                           = 0;
+    virtual CHIP_ERROR SetAbsMinPower(int64_t)                                                             = 0;
+    virtual CHIP_ERROR SetAbsMaxPower(int64_t)                                                             = 0;
+    virtual CHIP_ERROR SetPowerAdjustmentCapability(Attributes::PowerAdjustmentCapability::TypeInfo::Type) = 0;
+    virtual CHIP_ERROR SetForecast(DataModel::Nullable<Structs::ForecastStruct::Type>)                     = 0;
 
 protected:
     EndpointId mEndpointId = 0;

src/app/clusters/electrical-power-measurement-server/electrical-power-measurement-server.h

@@ -29,9 +29,6 @@ namespace app {
 namespace Clusters {
 namespace ElectricalPowerMeasurement {
 
-using namespace chip::app::Clusters::ElectricalPowerMeasurement::Attributes;
-using namespace chip::app::Clusters::ElectricalPowerMeasurement::Structs;
-
 class Delegate
 {
 public:

src/app/clusters/operational-credentials-server/operational-credentials-server.cpp

@@ -55,6 +55,7 @@ using namespace chip::app;
 using namespace chip::app::Clusters;
 using namespace chip::app::Clusters::OperationalCredentials;
 using namespace chip::Credentials;
+using namespace chip::Crypto;
 using namespace chip::Protocols::InteractionModel;
 
 namespace {

src/app/icd/client/CheckInHandler.cpp

@@ -37,6 +37,8 @@
 
 #include <protocols/secure_channel/Constants.h>
 
+using namespace chip::Protocols::SecureChannel;
+
 namespace chip {
 namespace app {
 

src/app/icd/client/DefaultCheckInDelegate.h

@@ -24,8 +24,6 @@
 namespace chip {
 namespace app {
 
-using namespace std;
-
 class InteractionModelEngine;
 
 /// Callbacks for check in protocol

src/app/icd/client/DefaultICDClientStorage.cpp

@@ -463,7 +463,7 @@ CHIP_ERROR DefaultICDClientStorage::DeleteAllEntries(FabricIndex fabricIndex)
 }
 
 CHIP_ERROR DefaultICDClientStorage::ProcessCheckInPayload(const ByteSpan & payload, ICDClientInfo & clientInfo,
-                                                          CounterType & counter)
+                                                          Protocols::SecureChannel::CounterType & counter)
 {
     uint8_t appDataBuffer[kAppDataLength];
     MutableByteSpan appData(appDataBuffer);

src/app/icd/client/DefaultICDClientStorage.h

@@ -117,7 +117,8 @@ class DefaultICDClientStorage : public ICDClientStorage
      */
     CHIP_ERROR DeleteAllEntries(FabricIndex fabricIndex);
 
-    CHIP_ERROR ProcessCheckInPayload(const ByteSpan & payload, ICDClientInfo & clientInfo, CounterType & counter) override;
+    CHIP_ERROR ProcessCheckInPayload(const ByteSpan & payload, ICDClientInfo & clientInfo,
+                                     Protocols::SecureChannel::CounterType & counter) override;
 
 protected:
     enum class ClientInfoTag : uint8_t

src/app/icd/client/ICDClientStorage.h

@@ -31,7 +31,6 @@
 namespace chip {
 namespace app {
 
-using namespace Protocols::SecureChannel;
 /**
  * The ICDClientStorage class is an abstract interface that defines the operations
  * for storing, retrieving and deleting ICD client information in persistent storage.
@@ -81,7 +80,8 @@ class ICDClientStorage
      * @param[out] clientInfo retrieved matched clientInfo from storage
      * @param[out] counter counter value received in the check-in message
      */
-    virtual CHIP_ERROR ProcessCheckInPayload(const ByteSpan & payload, ICDClientInfo & clientInfo, CounterType & counter) = 0;
+    virtual CHIP_ERROR ProcessCheckInPayload(const ByteSpan & payload, ICDClientInfo & clientInfo,
+                                             Protocols::SecureChannel::CounterType & counter) = 0;
 
     // 4 bytes for counter + 2 bytes for ActiveModeThreshold
     static inline constexpr uint8_t kAppDataLength = 6;

src/app/server/CommissioningWindowManager.cpp

@@ -31,6 +31,7 @@
 
 using namespace chip::app::Clusters;
 using namespace chip::System::Clock;
+using namespace chip::Crypto;
 
 using AdministratorCommissioning::CommissioningWindowStatusEnum;
 using chip::app::DataModel::MakeNullable;

src/app/server/CommissioningWindowManager.h

@@ -20,6 +20,7 @@
 #include <app/data-model/Nullable.h>
 #include <app/server/AppDelegate.h>
 #include <app/server/CommissioningModeProvider.h>
+#include <crypto/CHIPCryptoPAL.h>
 #include <lib/core/CHIPVendorIdentifiers.hpp>
 #include <lib/core/ClusterEnums.h>
 #include <lib/core/DataModelTypes.h>
@@ -93,7 +94,7 @@ class CommissioningWindowManager : public Messaging::UnsolicitedMessageHandler,
                                                                      FabricIndex fabricIndex, VendorId vendorId);
 
     CHIP_ERROR OpenEnhancedCommissioningWindow(System::Clock::Seconds16 commissioningTimeout, uint16_t discriminator,
-                                               Spake2pVerifier & verifier, uint32_t iterations, chip::ByteSpan salt,
+                                               Crypto::Spake2pVerifier & verifier, uint32_t iterations, chip::ByteSpan salt,
                                                FabricIndex fabricIndex, VendorId vendorId);
 
     void CloseCommissioningWindow();
@@ -204,7 +205,7 @@ class CommissioningWindowManager : public Messaging::UnsolicitedMessageHandler,
     uint8_t mFailedCommissioningAttempts = 0;
 
     bool mUseECM = false;
-    Spake2pVerifier mECMPASEVerifier;
+    Crypto::Spake2pVerifier mECMPASEVerifier;
     uint16_t mECMDiscriminator = 0;
     // mListeningForPASE is true only when we are listening for
     // PBKDFParamRequest messages or when we're in the middle of a PASE
@@ -214,7 +215,7 @@ class CommissioningWindowManager : public Messaging::UnsolicitedMessageHandler,
     bool mCommissioningTimeoutTimerArmed = false;
     uint32_t mECMIterations              = 0;
     uint32_t mECMSaltLength              = 0;
-    uint8_t mECMSalt[kSpake2p_Max_PBKDF_Salt_Length];
+    uint8_t mECMSalt[Crypto::kSpake2p_Max_PBKDF_Salt_Length];
 
     // For tests only, so that we can test the commissioning window timeout
     // without having to wait 3 minutes.

src/app/tests/TestCommissionManager.cpp

@@ -32,6 +32,8 @@
 
 #include <nlunit-test.h>
 
+using namespace chip::Crypto;
+
 using chip::CommissioningWindowAdvertisement;
 using chip::CommissioningWindowManager;
 using chip::Server;
@@ -328,9 +330,9 @@ void CheckCommissioningWindowManagerEnhancedWindowTask(intptr_t context)
     CHIP_ERROR err = chip::DeviceLayer::GetCommissionableDataProvider()->GetSetupDiscriminator(originDiscriminator);
     NL_TEST_ASSERT(suite, err == CHIP_NO_ERROR);
     uint16_t newDiscriminator = static_cast<uint16_t>(originDiscriminator + 1);
-    chip::Spake2pVerifier verifier;
-    constexpr uint32_t kIterations = chip::kSpake2p_Min_PBKDF_Iterations;
-    uint8_t salt[chip::kSpake2p_Min_PBKDF_Salt_Length];
+    Spake2pVerifier verifier;
+    constexpr uint32_t kIterations = kSpake2p_Min_PBKDF_Iterations;
+    uint8_t salt[kSpake2p_Min_PBKDF_Salt_Length];
     chip::ByteSpan saltData(salt);
 
     NL_TEST_ASSERT(suite, !sWindowStatusDirty);

src/controller/AutoCommissioner.cpp

@@ -29,6 +29,7 @@ namespace chip {
 namespace Controller {
 
 using namespace chip::app::Clusters;
+using namespace chip::Crypto;
 using chip::app::DataModel::MakeNullable;
 using chip::app::DataModel::NullNullable;
 

src/controller/AutoCommissioner.h

@@ -19,6 +19,7 @@
 #include <controller/CommissioneeDeviceProxy.h>
 #include <controller/CommissioningDelegate.h>
 #include <credentials/DeviceAttestationConstructor.h>
+#include <crypto/CHIPCryptoPAL.h>
 #include <protocols/secure_channel/RendezvousParameters.h>
 
 namespace chip {
@@ -70,7 +71,8 @@ class AutoCommissioner : public CommissioningDelegate
     ByteSpan GetDAC() const { return ByteSpan(mDAC, mDACLen); }
     ByteSpan GetPAI() const { return ByteSpan(mPAI, mPAILen); }
 
-    CHIP_ERROR NOCChainGenerated(ByteSpan noc, ByteSpan icac, ByteSpan rcac, IdentityProtectionKeySpan ipk, NodeId adminSubject);
+    CHIP_ERROR NOCChainGenerated(ByteSpan noc, ByteSpan icac, ByteSpan rcac, Crypto::IdentityProtectionKeySpan ipk,
+                                 NodeId adminSubject);
     EndpointId GetEndpoint(const CommissioningStage & stage) const;
     CommissioningStage GetNextCommissioningStageInternal(CommissioningStage currentStage, CHIP_ERROR & lastErr);
 

src/controller/CHIPDeviceController.cpp

@@ -77,6 +77,7 @@ using namespace chip::System;
 using namespace chip::Transport;
 using namespace chip::Credentials;
 using namespace chip::app::Clusters;
+using namespace chip::Crypto;
 
 namespace chip {
 namespace Controller {