Expire associated secure sessions when a fabric is deleted #9571

pan-apple · 2021-09-09T17:16:59Z

Problem

The controller is able to send commands to the device after its fabric has been removed.

Change overview

The secure session on which the remove fabric command was received was not being torn down. This PR marks all secure sessions associated with the fabric as expired.

Testing

Added a new test to test the RemoveFabric cluster command.
Performed manual testing to ensure that commands sent after removing the fabric are dropped, as the session is no longer valid.

src/app/clusters/operational-credentials-server/operational-credentials-server.cpp

src/protocols/secure_channel/CASESession.cpp

src/transport/PeerConnections.h

src/transport/SecureSessionMgr.cpp

src/app/clusters/operational-credentials-server/operational-credentials-server.cpp

src/transport/PeerConnections.h

todo · 2021-09-13T19:45:45Z

#9642

connectedhomeip/src/app/clusters/operational-credentials-server/operational-credentials-server.cpp

Lines 288 to 298 in ceee4f3

    
                       // TODO: https://github.com/project-chip/connectedhomeip/issues/9642 
        
                       ec->SetDelegate(&gFabricCleanupExchangeDelegate); 
        
                   } 
        
                   else 
        
                   { 
        
                       ec->GetExchangeMgr()->GetSessionMgr()->ExpireAllPairingsForFabric(fabricBeingRemoved); 
        
                   } 
        
               } 
        
               return true; 
        
           }

This comment was generated by todo based on a `TODO` comment in `ceee4f3` in #9571. cc @pan-apple.

pan-apple · 2021-09-13T20:02:00Z

rebased

src/app/clusters/operational-credentials-server/operational-credentials-server.cpp

github-actions · 2021-09-13T21:37:43Z

Size increase report for "gn_qpg-example-build" from bc2d74b

File	Section	File	VM
chip-qpg6100-lighting-example.out	.text	1696	1696
chip-qpg6100-lighting-example.out	.bss	0	32
chip-qpg6100-lighting-example.out	.data	4	4
chip-qpg6100-lighting-example.out	.heap	0	-32

Full report output

BLOAT REPORT

Files found only in the build output:
    report.csv

Comparing ./master_artifact/chip-qpg6100-lighting-example.out and ./pull_artifact/chip-qpg6100-lighting-example.out:

sections,vmsize,filesize
.debug_info,0,23620
.debug_loc,0,5407
.debug_line,0,3648
.text,1696,1696
.debug_ranges,0,1040
.strtab,0,600
.debug_frame,0,396
.debug_abbrev,0,361
.symtab,0,320
.debug_str,0,116
.debug_aranges,0,104
.bss,32,0
.data,4,4
.heap,-32,0
[ELF Program Headers],0,-32
[Unmapped],0,-1664

Comparing ./master_artifact/chip-qpg6100-lighting-example.out.map and ./pull_artifact/chip-qpg6100-lighting-example.out.map:

BLOAT EXECUTION FAILED WITH CODE 1:
bloaty: unknown file type for file './pull_artifact/chip-qpg6100-lighting-example.out.map'

github-actions · 2021-09-13T22:04:33Z

Size increase report for "esp32-example-build" from bc2d74b

File	Section	File	VM
chip-ipv6only-app.elf	.flash.text	172	172
chip-bridge-app.elf	.flash.text	1556	1556
chip-bridge-app.elf	.flash.rodata	152	152
chip-bridge-app.elf	.dram0.bss	0	32
chip-bridge-app.elf	.dram0.data	8	8
chip-shell.elf	.flash.text	20	20
chip-temperature-measurement-app.elf	.flash.text	1432	1432
chip-temperature-measurement-app.elf	.flash.rodata	152	152
chip-temperature-measurement-app.elf	.dram0.bss	0	32
chip-temperature-measurement-app.elf	.dram0.data	8	8
chip-all-clusters-app.elf	.flash.text	1396	1396
chip-all-clusters-app.elf	.flash.rodata	168	168
chip-all-clusters-app.elf	.dram0.bss	0	32
chip-lock-app.elf	.flash.text	1520	1520
chip-lock-app.elf	.flash.rodata	152	152
chip-lock-app.elf	.dram0.bss	0	32

Full report output

BLOAT REPORT

Files found only in the build output:
    report.csv

Comparing ./master_artifact/chip-ipv6only-app.elf and ./pull_artifact/chip-ipv6only-app.elf:

sections,vmsize,filesize
[Unmapped],0,3924
.flash.text,172,172

Comparing ./master_artifact/chip-bridge-app.elf and ./pull_artifact/chip-bridge-app.elf:

sections,vmsize,filesize
.debug_info,0,23692
.debug_line,0,7222
.debug_loc,0,4863
.flash.text,1556,1556
.debug_ranges,0,1296
.strtab,0,600
.debug_frame,0,312
.debug_abbrev,0,257
.flash.rodata,152,152
.debug_str,0,122
.symtab,0,112
.debug_aranges,0,104
.xt.prop._ZN4chip9Transport15PeerConnectionsILj16ELNS_4Time6SourceE0EE31FindPeerConnectionStateByFabricEh,0,84
.dram0.bss,32,0
.dram0.data,8,8
.xt.prop._ZN4chip8Encoding22PacketBufferWriterBaseINS0_12LittleEndian12BufferWriterEEC2EONS_6System18PacketBufferHandleE,0,-36
.xt.prop._ZNK4chip8Encoding12BufferWriter3FitEv,0,-36
[ELF Section Headers],0,-80
.shstrtab,0,-200
[Unmapped],0,-1716

Comparing ./master_artifact/chip-shell.elf and ./pull_artifact/chip-shell.elf:

sections,vmsize,filesize
.debug_info,0,2537
.debug_line,0,719
.debug_str,0,549
.debug_loc,0,510
.debug_ranges,0,336
.debug_frame,0,48
.flash.text,20,20
.debug_abbrev,0,17
.debug_aranges,0,16
[Unmapped],0,-20

Comparing ./master_artifact/chip-temperature-measurement-app.elf and ./pull_artifact/chip-temperature-measurement-app.elf:

sections,vmsize,filesize
.debug_info,0,23211
.debug_line,0,7096
.debug_loc,0,4936
.flash.text,1432,1432
.debug_ranges,0,1296
.strtab,0,600
.debug_frame,0,312
.debug_abbrev,0,257
.flash.rodata,152,152
.debug_str,0,124
.symtab,0,112
.debug_aranges,0,104
.xt.prop._ZN4chip9Transport15PeerConnectionsILj16ELNS_4Time6SourceE0EE31FindPeerConnectionStateByFabricEh,0,84
.dram0.bss,32,0
.dram0.data,8,8
.xt.prop._ZN4chip8Encoding22PacketBufferWriterBaseINS0_12LittleEndian12BufferWriterEEC2EONS_6System18PacketBufferHandleE,0,-36
.xt.prop._ZNK4chip8Encoding12BufferWriter3FitEv,0,-36
[ELF Section Headers],0,-80
.shstrtab,0,-200
[Unmapped],0,-1592

Comparing ./master_artifact/chip-persistent-storage.elf and ./pull_artifact/chip-persistent-storage.elf:

sections,vmsize,filesize

Comparing ./master_artifact/chip-pigweed-app.elf and ./pull_artifact/chip-pigweed-app.elf:

sections,vmsize,filesize

Comparing ./master_artifact/chip-all-clusters-app.elf and ./pull_artifact/chip-all-clusters-app.elf:

sections,vmsize,filesize
.debug_info,0,19117
.debug_line,0,5079
.debug_loc,0,3304
.flash.text,1396,1396
.debug_ranges,0,1312
.strtab,0,600
.debug_frame,0,412
.debug_abbrev,0,203
.flash.rodata,168,168
.symtab,0,144
.debug_aranges,0,104
.dram0.bss,32,0
.dram0.data,0,8
.debug_str,0,4
.riscv.attributes,0,1
[Unmapped],0,-1572

Comparing ./master_artifact/chip-lock-app.elf and ./pull_artifact/chip-lock-app.elf:

sections,vmsize,filesize
.debug_info,0,18312
.debug_line,0,7174
.debug_loc,0,4543
[Unmapped],0,2424
.flash.text,1520,1520
.debug_ranges,0,1296
.strtab,0,600
.debug_frame,0,312
.debug_abbrev,0,209
.flash.rodata,152,152
.symtab,0,112
.debug_aranges,0,104
.xt.prop._ZN4chip9Transport15PeerConnectionsILj16ELNS_4Time6SourceE0EE31FindPeerConnectionStateByFabricEh,0,84
.dram0.bss,32,0
[1 Others],0,2
.xt.lit._ZNK4chip4SpanIhE7SubSpanEjj,0,-8
.xt.prop._ZNK4chip4SpanIhE7SubSpanEjj,0,-12
.xt.prop._ZN4chip8Encoding22PacketBufferWriterBaseINS0_12LittleEndian12BufferWriterEEC2EONS_6System18PacketBufferHandleE,0,-36
.xt.prop._ZNK4chip8Encoding12BufferWriter3FitEv,0,-36
[ELF Section Headers],0,-80
.shstrtab,0,-200

github-actions · 2021-09-13T22:11:54Z

Size increase report for "nrfconnect-example-build" from bc2d74b

File	Section	File	VM
chip-lock.elf	text	1624	1624
chip-lock.elf	rodata	216	220
chip-lock.elf	bss	0	32
chip-lock.elf	datas	4	4
chip-lock.elf	devices	4	4
chip-lock.elf	device_handles	-8	-8
chip-shell.elf	text	12	12
chip-shell.elf	device_handles	4	4

Full report output

BLOAT REPORT

Files found only in the build output:
    report.csv

Comparing ./master_artifact/chip-lock.elf and ./pull_artifact/chip-lock.elf:

sections,vmsize,filesize
.debug_info,0,23143
.debug_loc,0,5588
.debug_line,0,3692
text,1624,1624
.debug_ranges,0,1000
.strtab,0,600
.debug_frame,0,396
.debug_abbrev,0,361
.symtab,0,336
rodata,220,216
.debug_str,0,116
.debug_aranges,0,104
bss,32,0
datas,4,4
devices,4,4
device_handles,-8,-8

Comparing ./master_artifact/chip-shell.elf and ./pull_artifact/chip-shell.elf:

sections,vmsize,filesize
.debug_info,0,2760
.debug_loc,0,847
.debug_str,0,549
.debug_line,0,417
.debug_ranges,0,304
.debug_frame,0,72
.debug_abbrev,0,27
.debug_aranges,0,16
text,12,12
device_handles,4,4

boring-cyborg bot added app darwin transport labels Sep 9, 2021

pullapprove bot requested review from andy31415, bzbarsky-apple, chrisdecenzo, Damian-Nordic, hawk248, jepenven-silabs, msandstedt and sagar-apple September 9, 2021 17:18

pullapprove bot added the review - pending label Sep 9, 2021

msandstedt reviewed Sep 9, 2021

View reviewed changes

src/app/clusters/operational-credentials-server/operational-credentials-server.cpp Outdated Show resolved Hide resolved

msandstedt reviewed Sep 9, 2021

View reviewed changes

src/app/clusters/operational-credentials-server/operational-credentials-server.cpp Outdated Show resolved Hide resolved

woody-apple added the SDK Approved label Sep 9, 2021

bzbarsky-apple requested changes Sep 9, 2021

View reviewed changes

pan-apple requested review from msandstedt and bzbarsky-apple September 10, 2021 00:14

pan-apple force-pushed the remove-fabric branch from ae2a0f2 to 1f3a62a Compare September 13, 2021 14:32

msandstedt approved these changes Sep 13, 2021

View reviewed changes

bzbarsky-apple mentioned this pull request Sep 13, 2021

Figure out a better way to handle expiration of sessions on fabric deletion #9642

Closed

bzbarsky-apple approved these changes Sep 13, 2021

View reviewed changes

woody-apple approved these changes Sep 13, 2021

View reviewed changes

pan-apple force-pushed the remove-fabric branch from ceee4f3 to d6c23d5 Compare September 13, 2021 20:01

bzbarsky-apple reviewed Sep 13, 2021

View reviewed changes

src/app/clusters/operational-credentials-server/operational-credentials-server.cpp Outdated Show resolved Hide resolved

pan-apple added 3 commits September 13, 2021 13:26

Expire associated secure sessions when a fabric is deleted

19514e3

regen zap files

078736f

another zap regen

c9b7b4a

pan-apple added 3 commits September 13, 2021 13:26

address review comments

4f80151

address review comments

fd5a925

updates

b684a68

pan-apple force-pushed the remove-fabric branch from d6c23d5 to b684a68 Compare September 13, 2021 20:29

andy31415 approved these changes Sep 13, 2021

View reviewed changes

pullapprove bot added review - approved and removed review - pending labels Sep 13, 2021

andy31415 added the technical review - DONE label Sep 13, 2021

pan-apple added 2 commits September 13, 2021 14:04

update CASESession error handling

00419dc

fix build error

626e657

bzbarsky-apple merged commit 692b86c into project-chip:master Sep 13, 2021

todo bot mentioned this pull request Sep 13, 2021

https://github.com/project-chip/connectedhomeip/issues/9642 #9665

Closed

pan-apple deleted the remove-fabric branch September 13, 2021 22:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Expire associated secure sessions when a fabric is deleted #9571

Expire associated secure sessions when a fabric is deleted #9571

pan-apple commented Sep 9, 2021

todo bot commented Sep 13, 2021

pan-apple commented Sep 13, 2021

github-actions bot commented Sep 13, 2021

github-actions bot commented Sep 13, 2021

github-actions bot commented Sep 13, 2021

Expire associated secure sessions when a fabric is deleted #9571

Expire associated secure sessions when a fabric is deleted #9571

Conversation

pan-apple commented Sep 9, 2021

Problem

Change overview

Testing

todo bot commented Sep 13, 2021

#9642

This comment was generated by todo based on a TODO comment in ceee4f3 in #9571. cc @pan-apple.

pan-apple commented Sep 13, 2021

github-actions bot commented Sep 13, 2021

github-actions bot commented Sep 13, 2021

github-actions bot commented Sep 13, 2021

This comment was generated by todo based on a `TODO` comment in `ceee4f3` in #9571. cc @pan-apple.