Line data    Source code

       1             : /*
       2             :  *    Copyright (c) 2022 Project CHIP Authors
       3             :  *    All rights reserved.
       4             :  *
       5             :  *    Licensed under the Apache License, Version 2.0 (the "License");
       6             :  *    you may not use this file except in compliance with the License.
       7             :  *    You may obtain a copy of the License at
       8             :  *
       9             :  *        http://www.apache.org/licenses/LICENSE-2.0
      10             :  *
      11             :  *    Unless required by applicable law or agreed to in writing, software
      12             :  *    distributed under the License is distributed on an "AS IS" BASIS,
      13             :  *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
      14             :  *    See the License for the specific language governing permissions and
      15             :  *    limitations under the License.
      16             :  */
      17             : 
      18             : #pragma once
      19             : 
      20             : #include <lib/core/CHIPError.h>
      21             : #include <lib/core/CHIPPersistentStorageDelegate.h>
      22             : #include <lib/core/DataModelTypes.h>
      23             : #include <lib/support/BitFlags.h>
      24             : #include <lib/support/CHIPMem.h>
      25             : #include <lib/support/CodeUtils.h>
      26             : #include <lib/support/ScopedBuffer.h>
      27             : 
      28             : #include "OperationalCertificateStore.h"
      29             : 
      30             : namespace chip {
      31             : namespace Credentials {
      32             : 
      33             : /**
      34             :  * @brief OperationalCertificateStore implementation making use of PersistentStorageDelegate
      35             :  *        to load/store certificates. This is the legacy behavior of `FabricTable` prior
      36             :  *        to refactors to use `OperationalCertificateStore` and exists as a baseline example
      37             :  *        of how to use the interface.
      38             :  */
      39             : class PersistentStorageOpCertStore final : public OperationalCertificateStore
      40             : {
      41             : public:
      42           1 :     PersistentStorageOpCertStore() {}
      43           1 :     virtual ~PersistentStorageOpCertStore() { Finish(); }
      44             : 
      45             :     // Non-copyable
      46             :     PersistentStorageOpCertStore(PersistentStorageOpCertStore const &) = delete;
      47             :     void operator=(PersistentStorageOpCertStore const &)               = delete;
      48             : 
      49             :     /**
      50             :      * @brief Initialize the certificate store to map to a given storage delegate.
      51             :      *
      52             :      * @param storage Pointer to persistent storage delegate to use. Must outlive this instance.
      53             :      * @retval CHIP_NO_ERROR on success
      54             :      * @retval CHIP_ERROR_INCORRECT_STATE if already initialized
      55             :      */
      56             :     CHIP_ERROR Init(PersistentStorageDelegate * storage)
      57             :     {
      58             :         VerifyOrReturnError(mStorage == nullptr, CHIP_ERROR_INCORRECT_STATE);
      59             :         RevertPendingOpCerts();
      60             :         mStorage = storage;
      61             :         return CHIP_NO_ERROR;
      62             :     }
      63             : 
      64             :     /**
      65             :      * @brief Finalize the certificate store, so that subsequent operations fail
      66             :      */
      67           1 :     void Finish()
      68             :     {
      69           1 :         VerifyOrReturn(mStorage != nullptr);
      70             : 
      71           1 :         RevertPendingOpCerts();
      72           1 :         mStorage = nullptr;
      73             :     }
      74             : 
      75             :     bool HasPendingRootCert() const override;
      76             :     bool HasPendingNocChain() const override;
      77             : 
      78             :     bool HasCertificateForFabric(FabricIndex fabricIndex, CertChainElement element) const override;
      79             : 
      80             :     CHIP_ERROR AddNewTrustedRootCertForFabric(FabricIndex fabricIndex, const ByteSpan & rcac) override;
      81             :     CHIP_ERROR AddNewOpCertsForFabric(FabricIndex fabricIndex, const ByteSpan & noc, const ByteSpan & icac) override;
      82             :     CHIP_ERROR UpdateOpCertsForFabric(FabricIndex fabricIndex, const ByteSpan & noc, const ByteSpan & icac) override;
      83             : 
      84             :     CHIP_ERROR CommitOpCertsForFabric(FabricIndex fabricIndex) override;
      85             :     CHIP_ERROR RemoveOpCertsForFabric(FabricIndex fabricIndex) override;
      86             : 
      87           0 :     void RevertPendingOpCertsExceptRoot() override
      88             :     {
      89           0 :         mPendingIcac.Free();
      90           0 :         mPendingNoc.Free();
      91             : 
      92           0 :         if (mPendingRcac.Get() == nullptr)
      93             :         {
      94           0 :             mPendingFabricIndex = kUndefinedFabricIndex;
      95             :         }
      96           0 :         mStateFlags.Clear(StateFlags::kAddNewOpCertsCalled);
      97           0 :         mStateFlags.Clear(StateFlags::kUpdateOpCertsCalled);
      98           0 :     }
      99             : 
     100           0 :     void RevertPendingOpCerts() override
     101             :     {
     102           0 :         RevertPendingOpCertsExceptRoot();
     103             : 
     104             :         // Clear the rest statelessly
     105           0 :         mPendingRcac.Free();
     106           0 :         mPendingFabricIndex = kUndefinedFabricIndex;
     107           0 :         mStateFlags.ClearAll();
     108           0 :     }
     109             : 
     110             :     CHIP_ERROR GetCertificate(FabricIndex fabricIndex, CertChainElement element, MutableByteSpan & outCertificate) const override;
     111             : 
     112             : protected:
     113             :     enum class StateFlags : uint8_t
     114             :     {
     115             :         // Below are flags to assist interlock logic
     116             :         kAddNewOpCertsCalled     = (1u << 0),
     117             :         kAddNewTrustedRootCalled = (1u << 1),
     118             :         kUpdateOpCertsCalled     = (1u << 2),
     119             :     };
     120             : 
     121             :     // Returns CHIP_ERROR_NOT_FOUND if a pending certificate couldn't be found, otherwise status of pending copy
     122             :     CHIP_ERROR GetPendingCertificate(FabricIndex fabricIndex, CertChainElement element, MutableByteSpan & outCertificate) const;
     123             : 
     124             :     // Returns true if any pending or persisted state exists for the fabricIndex, false if nothing at all is found.
     125             :     bool HasAnyCertificateForFabric(FabricIndex fabricIndex) const;
     126             : 
     127             :     PersistentStorageDelegate * mStorage = nullptr;
     128             : 
     129             :     // This pending fabric index is `kUndefinedFabricIndex` if there are no pending certs at all for the fabric
     130             :     FabricIndex mPendingFabricIndex = kUndefinedFabricIndex;
     131             : 
     132             :     Platform::ScopedMemoryBufferWithSize<uint8_t> mPendingRcac;
     133             :     Platform::ScopedMemoryBufferWithSize<uint8_t> mPendingIcac;
     134             :     Platform::ScopedMemoryBufferWithSize<uint8_t> mPendingNoc;
     135             : 
     136             :     BitFlags<StateFlags> mStateFlags;
     137             : };
     138             : 
     139             : } // namespace Credentials
     140             : } // namespace chip