| #!/usr/bin/env python |
| |
| import argparse |
| import json |
| import os |
| import subprocess |
| import sys |
| import typing |
| import cryptography.x509 |
| import os.path |
| import glob |
| from binascii import hexlify, unhexlify |
| from enum import Enum |
| |
| VID_NOT_PRESENT = 0xFFFF |
| PID_NOT_PRESENT = 0x0000 |
| |
| VALID_IN_PAST = "2020-06-28 14:23:43" |
| VALID_NOW = "2022-09-28 14:23:43" |
| VALID_IN_FUTURE = "2031-06-28 14:23:43" |
| |
| |
| class CertType(Enum): |
| PAA = 1 |
| PAI = 2 |
| DAC = 3 |
| |
| |
| CERT_STRUCT_TEST_CASES = [ |
| { |
| "description": 'Valid certificate version field set to v3(2)', |
| "test_folder": 'cert_version_v3', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Invalid certificate version field set to v2(1)', |
| "test_folder": 'cert_version_v2', |
| "error_flag": 'cert-version', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Valid certificate signature algorithm ECDSA_WITH_SHA256', |
| "test_folder": 'sig_algo_ecdsa_with_sha256', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Invalid certificate signature algorithm ECDSA_WITH_SHA1', |
| "test_folder": 'sig_algo_ecdsa_with_sha1', |
| "error_flag": 'sig-algo', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "VID in Subject field doesn't match VID in Issuer field", |
| "test_folder": 'subject_vid_mismatch', |
| "error_flag": 'subject-vid-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "PID in Subject field doesn't match PID in Issuer field", |
| "test_folder": 'subject_pid_mismatch', |
| "error_flag": 'subject-pid-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Valid certificate public key curve prime256v1", |
| "test_folder": 'sig_curve_prime256v1', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": "Invalid certificate public key curve secp256k1", |
| "test_folder": 'sig_curve_secp256k1', |
| "error_flag": 'sig-curve', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate validity period starts in the past", |
| "test_folder": 'valid_in_past', |
| "error_flag": 'no-error', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate validity period starts in the future", |
| "test_folder": 'valid_in_future', |
| "error_flag": 'no-error', |
| "is_success_case": 'false', |
| }, |
| # TODO Cases: |
| # 'issuer-vid' |
| # 'issuer-pid' |
| # 'subject-vid' |
| # 'subject-pid' |
| { |
| "description": "Certificate doesn't include Basic Constraint extension", |
| "test_folder": 'ext_basic_missing', |
| "error_flag": 'ext-basic-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension critical field is missing", |
| "test_folder": 'ext_basic_critical_missing', |
| "error_flag": 'ext-basic-critical-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension critical field is set as 'non-critical'", |
| "test_folder": 'ext_basic_critical_wrong', |
| "error_flag": 'ext-basic-critical-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension CA field is missing", |
| "test_folder": 'ext_basic_ca_missing', |
| "error_flag": 'ext-basic-ca-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension CA field is wrong (TRUE for DAC and FALSE for PAI)", |
| "test_folder": 'ext_basic_ca_wrong', |
| "error_flag": 'ext-basic-ca-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension PathLen field presence is wrong (present for DAC not present for PAI)", |
| "test_folder": 'ext_basic_pathlen_presence_wrong', |
| "error_flag": 'ext-basic-pathlen-presence-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension PathLen field set to 0", |
| "test_folder": 'ext_basic_pathlen0', |
| "error_flag": 'ext-basic-pathlen0', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension PathLen field set to 1", |
| "test_folder": 'ext_basic_pathlen1', |
| "error_flag": 'ext-basic-pathlen1', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Basic Constraint extension PathLen field set to 2", |
| "test_folder": 'ext_basic_pathlen2', |
| "error_flag": 'ext-basic-pathlen2', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate doesn't include Key Usage extension", |
| "test_folder": 'ext_key_usage_missing', |
| "error_flag": 'ext-key-usage-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Key Usage extension critical field is missing", |
| "test_folder": 'ext_key_usage_critical_missing', |
| "error_flag": 'ext-key-usage-critical-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Key Usage extension critical field is set as 'non-critical'", |
| "test_folder": 'ext_key_usage_critical_wrong', |
| "error_flag": 'ext-key-usage-critical-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Key Usage extension diginalSignature field is wrong (not present for DAC and present for PAI, which is OK as optional)", |
| "test_folder": 'ext_key_usage_dig_sig_wrong', |
| "error_flag": 'ext-key-usage-dig-sig', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Key Usage extension keyCertSign field is wrong (present for DAC and not present for PAI)", |
| "test_folder": 'ext_key_usage_key_cert_sign_wrong', |
| "error_flag": 'ext-key-usage-key-cert-sign', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate Key Usage extension cRLSign field is wrong (present for DAC and not present for PAI)", |
| "test_folder": 'ext_key_usage_crl_sign_wrong', |
| "error_flag": 'ext-key-usage-crl-sign', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate doesn't include Authority Key ID (AKID) extension", |
| "test_folder": 'ext_akid_missing', |
| "error_flag": 'ext-akid-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate doesn't include Subject Key ID (SKID) extension", |
| "test_folder": 'ext_skid_missing', |
| "error_flag": 'ext-skid-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "Certificate includes optional Extended Key Usage extension", |
| "test_folder": 'ext_extended_key_usage_present', |
| "error_flag": 'ext-extended-key-usage', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": "Certificate includes optional Authority Information Access extension", |
| "test_folder": 'ext_authority_info_access_present', |
| "error_flag": 'ext-authority-info-access', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": "Certificate includes optional Subject Alternative Name extension", |
| "test_folder": 'ext_subject_alt_name_present', |
| "error_flag": 'ext-subject-alt-name', |
| "is_success_case": 'true', |
| }, |
| ] |
| |
| VIDPID_FALLBACK_ENCODING_TEST_CASES = [ |
| # Valid/Invalid encoding examples from the spec: |
| { |
| "description": 'Fallback VID and PID encoding example from spec: valid and recommended since easily human-readable', |
| "common_name": 'ACME Matter Devel DAC 5CDA9899 Mvid:FFF1 Mpid:00B1', |
| "test_folder": 'vidpid_fallback_encoding_01', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example from spec: valid and recommended since easily human-readable', |
| "common_name": 'ACME Matter Devel DAC 5CDA9899 Mpid:00B1 Mvid:FFF1', |
| "test_folder": 'vidpid_fallback_encoding_02', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example from spec: valid example showing that order or separators are not considered at all for the overall validity of the embedded fields', |
| "common_name": 'Mpid:00B1,ACME Matter Devel DAC 5CDA9899,Mvid:FFF1', |
| "test_folder": 'vidpid_fallback_encoding_03', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example from spec: valid, but less readable', |
| "common_name": 'ACME Matter Devel DAC 5CDA9899 Mvid:FFF1Mpid:00B1', |
| "test_folder": 'vidpid_fallback_encoding_04', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example from spec: valid, but highly discouraged, since embedding of substrings within other substrings may be confusing to human readers', |
| "common_name": 'Mvid:FFF1ACME Matter Devel DAC 5CDAMpid:00B19899', |
| "test_folder": 'vidpid_fallback_encoding_05', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example from spec: invalid, since substring following Mvid: is not exactly 4 uppercase hexadecimal digits', |
| "common_name": 'ACME Matter Devel DAC 5CDA9899 Mvid:FF1 Mpid:00B1', |
| "test_folder": 'vidpid_fallback_encoding_06', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example from spec: invalid, since substring following Mvid: is not exactly 4 uppercase hexadecimal digits', |
| "common_name": 'ACME Matter Devel DAC 5CDA9899 Mvid:fff1 Mpid:00B1', |
| "test_folder": 'vidpid_fallback_encoding_07', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example from spec: invalid, since substring following Mpid: is not exactly 4 uppercase hexadecimal digits', |
| "common_name": 'ACME Matter Devel DAC 5CDA9899 Mvid:FFF1 Mpid:B1', |
| "test_folder": 'vidpid_fallback_encoding_08', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example from spec: invalid, since substring following Mpid: is not exactly 4 uppercase hexadecimal digits', |
| "common_name": 'ACME Matter Devel DAC 5CDA9899 Mpid: Mvid:FFF1', |
| "test_folder": 'vidpid_fallback_encoding_09', |
| "is_success_case": 'false', |
| }, |
| # More valid/invalid fallback encoding examples: |
| { |
| "description": 'Fallback VID and PID encoding example: invalid VID encoding', |
| "common_name": 'Mvid:FFF Mpid:00B10x', |
| "test_folder": 'vidpid_fallback_encoding_10', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example: valid, but less human-readable', |
| "common_name": 'MpidMvid:FFF10 Matter Test Mpid:00B1', |
| "test_folder": 'vidpid_fallback_encoding_11', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example: invalid, PID not present and VID not upper case', |
| "common_name": 'Matter Devel DAC Mpid:Mvid:Fff1', |
| "test_folder": 'vidpid_fallback_encoding_12', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example: invalid VID prefix', |
| "common_name": 'Matter Devel DAC Mpid:00B1 MVID:FFF1', |
| "test_folder": 'vidpid_fallback_encoding_13', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Fallback VID and PID encoding example: invalid PID and VID prefixes', |
| "common_name": 'Matter Devel DAC Mpid_00B1 Mvid_FFF1', |
| "test_folder": 'vidpid_fallback_encoding_14', |
| "is_success_case": 'false', |
| }, |
| # Examples with both fallback encoding in the common name and using Matter specific OIDs |
| { |
| "description": 'Mix of Fallback and Matter OID encoding for VID and PID: valid, Matter OIDs are used and wrong values in the common-name are ignored', |
| "common_name": 'ACME Matter Devel DAC 5CDA9899 Mvid:FFF2 Mpid:00B2', |
| "vid": 0xFFF1, |
| "pid": 0x00B1, |
| "test_folder": 'vidpid_fallback_encoding_15', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Mix of Fallback and Matter OID encoding for VID and PID: wrong, Correct values encoded in the common-name are ignored', |
| "common_name": 'ACME Matter Devel DAC 5CDA9899 Mvid:FFF1 Mpid:00B1', |
| "vid": 0xFFF2, |
| "pid": 0x00B2, |
| "test_folder": 'vidpid_fallback_encoding_16', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Mix of Fallback and Matter OID encoding for VID and PID: invalid, PID is using Matter OID then VID must also use Matter OID', |
| "common_name": 'Mvid:FFF1', |
| "pid": 0x00B1, |
| "test_folder": 'vidpid_fallback_encoding_17', |
| "is_success_case": 'false', |
| }, |
| ] |
| |
| CD_STRUCT_TEST_CASES = [ |
| { |
| "description": 'Valid format_version field set to 1.', |
| "test_folder": 'format_version_1', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'The format_version field is missing.', |
| "test_folder": 'format_version_missing', |
| "error_flag": 'format-version-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Invalid format_version field set to 2.', |
| "test_folder": 'format_version_2', |
| "error_flag": 'format-version-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The vendor_id field is missing.', |
| "test_folder": 'vid_missing', |
| "error_flag": 'vid-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The vendor_id field doesn't match the VID in DAC.", |
| "test_folder": 'vid_mismatch', |
| "error_flag": 'vid-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The product_id_array field is missing.', |
| "test_folder": 'pid_array_missing', |
| "error_flag": 'pid-array-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The product_id_array field is empty TLV array.", |
| "test_folder": 'pid_array_count0', |
| "error_flag": 'pid-array-count0', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The product_id_array field has one PID value which matches the PID value in DAC.", |
| "test_folder": 'pid_array_count01_valid', |
| "error_flag": 'pid-array-count01-valid', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": "The product_id_array field has one PID value that doesn't match the PID value in DAC.", |
| "test_folder": 'pid_array_count01_mismatch', |
| "error_flag": 'pid-array-count01-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The product_id_array field has 10 PID values one of which matches the PID value in DAC.", |
| "test_folder": 'pid_array_count10_valid', |
| "error_flag": 'pid-array-count10-valid', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": "The product_id_array field has 10 PID values none of which matches the PID value in DAC.", |
| "test_folder": 'pid_array_count10_mismatch', |
| "error_flag": 'pid-array-count10-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The product_id_array field has 100 PID values one of which matches the PID value in DAC.", |
| "test_folder": 'pid_array_count100_valid', |
| "error_flag": 'pid-array-count100-valid', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": "The product_id_array field has 100 PID values none of which matches the PID value in DAC.", |
| "test_folder": 'pid_array_count100_mismatch', |
| "error_flag": 'pid-array-count100-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The device_type_id field is missing.", |
| "test_folder": 'device_type_id_missing', |
| "error_flag": 'device-type-id-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The device_type_id field doesn't match the device_type_id value in the DCL entries associated with the VID and PID.", |
| "test_folder": 'device_type_id_mismatch', |
| "error_flag": 'device-type-id-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The certificate_id field is missing.", |
| "test_folder": 'cert_id_missing', |
| "error_flag": 'cert-id-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The certificate_id field doesn't contain a globally unique serial number allocated by the CSA for this CD.", |
| "test_folder": 'cert_id_mismatch', |
| "error_flag": 'cert-id-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The certificate_id field has wrong length.', |
| "test_folder": 'cert_id_len_wrong', |
| "error_flag": 'cert-id-len-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The security_level field is missing.', |
| "test_folder": 'security_level_missing', |
| "error_flag": 'security-level-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The security_level field is set to invalid value (different from 0).', |
| "test_folder": 'security_level_wrong', |
| "error_flag": 'security-level-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The security_information field is missing.', |
| "test_folder": 'security_info_missing', |
| "error_flag": 'security-info-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The security_information field is set to invalid value (different from 0).', |
| "test_folder": 'security_info_wrong', |
| "error_flag": 'security-info-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The version_number field is missing.', |
| "test_folder": 'version_number_missing', |
| "error_flag": 'version-number-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The version_number field matches the VID and PID used in a DeviceSoftwareVersionModel entry in the DCL matching the certification record associated with the product presenting this CD.', |
| "test_folder": 'version_number_match', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": "The version_number field doesn't match the VID and PID used in a DeviceSoftwareVersionModel entry in the DCL matching the certification record associated with the product presenting this CD.", |
| "test_folder": 'version_number_wrong', |
| "error_flag": 'version-number-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The certification_type field is missing.', |
| "test_folder": 'cert_type_missing', |
| "error_flag": 'cert-type-missing', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The certification_type field is set to invalid value.', |
| "test_folder": 'cert_type_wrong', |
| "error_flag": 'cert-type-wrong', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The dac_origin_vendor_id and dac_origin_product_id fields are not present.', |
| "test_folder": 'dac_origin_vid_pid_missing', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'The dac_origin_vendor_id field is present and dac_origin_product_id fields is not present.', |
| "test_folder": 'dac_origin_vid_present_pid_missing', |
| "error_flag": 'dac-origin-vid-present', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The dac_origin_vendor_id field is not present and dac_origin_product_id is present.', |
| "test_folder": 'dac_origin_vid_missing_pid_present', |
| "error_flag": 'dac-origin-pid-present', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The dac_origin_vendor_id and dac_origin_product_id fields present and contain the VID and PID values that match the VID and PID found in the DAC Subject DN.', |
| "test_folder": 'dac_origin_vid_pid_present_match', |
| "error_flag": 'dac-origin-vid-pid-present', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": "The dac_origin_vendor_id and dac_origin_product_id fields present and the VID value doesn't match the VID found in the DAC Subject DN.", |
| "test_folder": 'dac_origin_vid_pid_present_vid_mismatch', |
| "error_flag": 'dac-origin-vid-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": "The dac_origin_vendor_id and dac_origin_product_id fields present and the PID value doesn't match the PID found in the DAC Subject DN.", |
| "test_folder": 'dac_origin_vid_pid_present_pid_mismatch', |
| "error_flag": 'dac-origin-pid-mismatch', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The optional authorized_paa_list field is not present.', |
| "test_folder": 'authorized_paa_list_missing', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'The authorized_paa_list contains one valid PAA which is authorized to sign the PAI.', |
| "test_folder": 'authorized_paa_list_count0', |
| "error_flag": 'authorized-paa-list-count0', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The authorized_paa_list contains one valid PAA which is authorized to sign the PAI.', |
| "test_folder": 'authorized_paa_list_count1_valid', |
| "error_flag": 'authorized-paa-list-count1-valid', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'The authorized_paa_list contains two PAAs one of which is valid PAA authorized to sign the PAI.', |
| "test_folder": 'authorized_paa_list_count2_valid', |
| "error_flag": 'authorized-paa-list-count2-valid', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'The authorized_paa_list contains three PAAs none of which is a valid PAA authorized to sign the PAI.', |
| "test_folder": 'authorized_paa_list_count3_invalid', |
| "error_flag": 'authorized-paa-list-count3-invalid', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The authorized_paa_list contains ten PAAs one of which is valid PAA authorized to sign the PAI.', |
| "test_folder": 'authorized_paa_list_count10_valid', |
| "error_flag": 'authorized-paa-list-count10-valid', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'The authorized_paa_list contains ten PAAs none of which is a valid PAA authorized to sign the PAI.', |
| "test_folder": 'authorized_paa_list_count10_invalid', |
| "error_flag": 'authorized-paa-list-count10-invalid', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Invalid Signer Info version set to v2.', |
| "test_folder": 'signer_info_v2', |
| "error_flag": 'signer-info-v2', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Invalid Signer Info digest algorithm SHA1.', |
| "test_folder": 'signer_info_digest_algo_sha1', |
| "error_flag": 'signer-info-digest-algo', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'The subjectKeyIdentifier contains SKID of a well-known Zigbee Alliance certificate.', |
| "test_folder": 'signer_info_skid_valid', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'The subjectKeyIdentifier contains invalid SKID of a certificate unknown by Zigbee Alliance.', |
| "test_folder": 'signer_info_skid_invalid', |
| "error_flag": 'signer-info-skid', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Valid CMS version set to v3.', |
| "test_folder": 'cms_v3', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Invalid CMS version set to v2.', |
| "test_folder": 'cms_v2', |
| "error_flag": 'cms-v2', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Valid CMS digest algorithm SHA256.', |
| "test_folder": 'cms_digest_algo_sha256', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Invalid CMS digest algorithm SHA1.', |
| "test_folder": 'cms_digest_algo_sha1', |
| "error_flag": 'cms-digest-algo', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Valid CMS signature algorithm ECDSA_WITH_SHA256.', |
| "test_folder": 'cms_sig_algo_ecdsa_with_sha256', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Invalid CMS signature algorithm ECDSA_WITH_SHA1.', |
| "test_folder": 'cms_sig_algo_ecdsa_with_sha1', |
| "error_flag": 'cms-sig-algo', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Valid CMS eContentType pkcs7-data.', |
| "test_folder": 'cms_econtent_type_pkcs7_data', |
| "error_flag": 'no-error', |
| "is_success_case": 'true', |
| }, |
| { |
| "description": 'Invalid CMS eContentType is set to Microsoft Authenticode [MSAC] OID = { 1.3.6.1.4.1.311.2.1.4 }.', |
| "test_folder": 'cms_econtent_type_msac', |
| "error_flag": 'cms-econtent-type', |
| "is_success_case": 'false', |
| }, |
| { |
| "description": 'Invalid CMS Signature.', |
| "test_folder": 'cms_signature', |
| "error_flag": 'cms-sig', |
| "is_success_case": 'false', |
| }, |
| ] |
| |
| |
| class Names: |
| def __init__(self, cert_type: CertType, paa_path, test_case_out_dir): |
| prefixes = {CertType.PAA: paa_path, |
| CertType.PAI: test_case_out_dir + '/pai-', |
| CertType.DAC: test_case_out_dir + '/dac-'} |
| prefix = prefixes[cert_type] |
| |
| self.cert_pem = prefix + 'Cert.pem' |
| self.cert_der = prefix + 'Cert.der' |
| self.key_pem = prefix + 'Key.pem' |
| self.key_der = prefix + 'Key.der' |
| |
| |
| class DevCertBuilder: |
| def __init__(self, cert_type: CertType, error_type: str, paa_path: str, test_case_out_dir: str, chip_cert: str, vid: int, pid: int, custom_cn_attribute: str, valid_from: str): |
| self.vid = vid |
| self.pid = pid |
| self.cert_type = cert_type |
| self.error_type = error_type |
| self.chipcert = chip_cert |
| self.custom_cn_attribute = custom_cn_attribute |
| self.valid_from = valid_from |
| |
| if not os.path.exists(self.chipcert): |
| raise Exception('Path not found: %s' % self.chipcert) |
| |
| if not os.path.exists(test_case_out_dir): |
| os.mkdir(test_case_out_dir) |
| |
| paa = Names(CertType.PAA, paa_path, test_case_out_dir) |
| pai = Names(CertType.PAI, paa_path, test_case_out_dir) |
| dac = Names(CertType.DAC, paa_path, test_case_out_dir) |
| if cert_type == CertType.PAI: |
| self.signer = paa |
| self.own = pai |
| if cert_type == CertType.DAC: |
| self.signer = pai |
| self.own = dac |
| |
| def make_certs_and_keys(self) -> None: |
| """Creates the PEM and DER certs and keyfiles""" |
| error_type_flag = ' -I -E' + self.error_type |
| subject_name = self.custom_cn_attribute |
| vid_flag = ' -V 0x{:X}'.format(self.vid) |
| pid_flag = ' -P 0x{:X}'.format(self.pid) |
| if (len(self.valid_from) == 0): |
| validity_flags = ' -l 4294967295 ' |
| else: |
| validity_flags = ' -f "' + self.valid_from + '" -l 730 ' |
| |
| if self.cert_type == CertType.PAI: |
| if (len(subject_name) == 0): |
| subject_name = 'Matter Test PAI' |
| type_flag = '-t i' |
| elif self.cert_type == CertType.DAC: |
| if (len(subject_name) == 0): |
| subject_name = 'Matter Test DAC' |
| type_flag = '-t d' |
| else: |
| return |
| |
| cmd = self.chipcert + ' gen-att-cert ' + type_flag + error_type_flag + ' -c "' + subject_name + '" -C ' + self.signer.cert_pem + ' -K ' + \ |
| self.signer.key_pem + vid_flag + pid_flag + validity_flags + ' -o ' + self.own.cert_pem + ' -O ' + self.own.key_pem |
| subprocess.run(cmd, shell=True) |
| cmd = 'openssl x509 -inform pem -in ' + self.own.cert_pem + \ |
| ' -out ' + self.own.cert_der + ' -outform DER' |
| subprocess.run(cmd, shell=True) |
| cmd = 'openssl ec -inform pem -in ' + self.own.key_pem + \ |
| ' -out ' + self.own.key_der + ' -outform DER' |
| subprocess.run(cmd, shell=True) |
| |
| |
| def add_raw_ec_keypair_to_dict_from_der(der_key_filename: str, json_dict: dict): |
| with open(der_key_filename, 'rb') as infile: |
| key_data_der = infile.read() |
| |
| key_der = cryptography.hazmat.primitives.serialization.load_der_private_key(key_data_der, None) |
| json_dict["dac_private_key"] = hexlify(key_der.private_numbers().private_value.to_bytes(32, byteorder='big')).decode('utf-8') |
| |
| pk_x = key_der.public_key().public_numbers().x |
| pk_y = key_der.public_key().public_numbers().y |
| |
| public_key_raw_bytes = bytearray([0x04]) |
| public_key_raw_bytes.extend(bytearray(pk_x.to_bytes(32, byteorder='big'))) |
| public_key_raw_bytes.extend(bytearray(pk_y.to_bytes(32, byteorder='big'))) |
| |
| json_dict["dac_public_key"] = hexlify(bytes(public_key_raw_bytes)).decode('utf-8') |
| |
| |
| def add_files_to_json_config(files_mapping: dict, json_dict: dict): |
| for output_key_name, filename in files_mapping.items(): |
| with open(filename, "rb") as infile: |
| file_bytes = infile.read() |
| json_dict[output_key_name] = hexlify(file_bytes).decode('utf-8') |
| |
| |
| def generate_test_case_vector_json(test_case_out_dir: str, test_cert: str, test_case): |
| json_dict = {} |
| files_in_path = glob.glob(os.path.join(test_case_out_dir, "*")) |
| output_json_filename = test_case_out_dir + "/test_case_vector.json" |
| |
| files_to_add = { |
| "dac_cert": "dac-Cert.der", |
| "pai_cert": "pai-Cert.der", |
| "firmware_information": "firmware-info.bin", |
| "certification_declaration": "cd.der", |
| } |
| |
| # Add description fields to JSON Config |
| if "description" in test_case: |
| json_dict["description"] = test_cert.upper() + " Test Vector: " + test_case["description"] |
| if "is_success_case" in test_case: |
| # These test cases are expected to fail when error injected in DAC but expected to pass when error injected in PAI |
| if (test_cert == 'pai') and (test_case["test_folder"] in ['ext_basic_pathlen0', 'vidpid_fallback_encoding_08', 'vidpid_fallback_encoding_09', 'ext_key_usage_dig_sig_wrong']): |
| json_dict["is_success_case"] = "true" |
| else: |
| json_dict["is_success_case"] = test_case["is_success_case"] |
| |
| # Out of all files we could add, find the ones that were present in test case, and embed them in hex |
| files_available = {os.path.basename(path) for path in files_in_path} |
| files_to_add = {key: os.path.join(test_case_out_dir, filename) |
| for key, filename in files_to_add.items() if filename in files_available} |
| |
| add_files_to_json_config(files_to_add, json_dict) |
| |
| # Embed the DAC key if present |
| if "dac-Key.der" in files_available: |
| der_key_filename = os.path.join(test_case_out_dir, "dac-Key.der") |
| add_raw_ec_keypair_to_dict_from_der(der_key_filename, json_dict) |
| |
| with open(output_json_filename, "wt+") as outfile: |
| json.dump(json_dict, outfile, indent=2) |
| |
| |
| def main(): |
| argparser = argparse.ArgumentParser() |
| argparser.add_argument('-o', '--out_dir', dest='outdir', |
| default='credentials/development/commissioner_dut', |
| help='output directory for all generated test vectors') |
| argparser.add_argument('-p', '--paa', dest='paapath', |
| default='credentials/test/attestation/Chip-Test-PAA-FFF1-', help='PAA to use') |
| argparser.add_argument('-d', '--cd', dest='cdpath', |
| default='credentials/test/certification-declaration/Chip-Test-CD-Signing-', |
| help='CD Signing Key/Cert to use') |
| argparser.add_argument('-c', '--chip-cert_dir', dest='chipcertdir', |
| default='out/debug/linux_x64_clang/', help='Directory where chip-cert tool is located') |
| |
| args = argparser.parse_args() |
| |
| if not os.path.exists(args.outdir): |
| os.mkdir(args.outdir) |
| |
| chipcert = args.chipcertdir + 'chip-cert' |
| |
| if not os.path.exists(chipcert): |
| raise Exception('Path not found: %s' % chipcert) |
| |
| cd_cert = args.cdpath + 'Cert.pem' |
| cd_key = args.cdpath + 'Key.pem' |
| |
| for test_cert in ['dac', 'pai']: |
| for test_case in CERT_STRUCT_TEST_CASES: |
| test_case_out_dir = args.outdir + '/struct_' + test_cert + '_' + test_case["test_folder"] |
| |
| if test_case["test_folder"] == 'valid_in_past': |
| if test_cert == 'dac': |
| dac_valid_from = VALID_IN_PAST |
| pai_valid_from = VALID_NOW |
| else: |
| dac_valid_from = VALID_NOW |
| pai_valid_from = VALID_IN_PAST |
| elif test_case["test_folder"] == 'valid_in_future': |
| if test_cert == 'dac': |
| dac_valid_from = VALID_IN_FUTURE |
| pai_valid_from = VALID_NOW |
| else: |
| dac_valid_from = VALID_NOW |
| pai_valid_from = VALID_IN_FUTURE |
| else: |
| dac_valid_from = '' |
| pai_valid_from = '' |
| |
| if test_cert == 'dac': |
| error_type_dac = test_case["error_flag"] |
| error_type_pai = 'no-error' |
| else: |
| if test_case["error_flag"] == 'ext-skid-missing': |
| error_type_dac = 'ext-akid-missing' |
| else: |
| error_type_dac = 'no-error' |
| error_type_pai = test_case["error_flag"] |
| |
| vid = 0xFFF1 |
| pid = 0x8000 |
| |
| # Generate PAI Cert/Key |
| builder = DevCertBuilder(CertType.PAI, error_type_pai, args.paapath, test_case_out_dir, |
| chipcert, vid, PID_NOT_PRESENT, '', pai_valid_from) |
| builder.make_certs_and_keys() |
| |
| if test_cert == 'pai': |
| if test_case["error_flag"] == 'subject-vid-mismatch': |
| vid += 1 |
| if test_case["error_flag"] == 'subject-pid-mismatch': |
| pid += 1 |
| |
| # Generate DAC Cert/Key |
| builder = DevCertBuilder(CertType.DAC, error_type_dac, args.paapath, test_case_out_dir, |
| chipcert, vid, pid, '', dac_valid_from) |
| builder.make_certs_and_keys() |
| |
| # Generate Certification Declaration (CD) |
| vid_flag = ' -V 0x{:X}'.format(vid) |
| pid_flag = ' -p 0x{:X}'.format(pid) |
| cmd = chipcert + ' gen-cd -K ' + cd_key + ' -C ' + cd_cert + ' -O ' + test_case_out_dir + '/cd.der' + \ |
| ' -f 1 ' + vid_flag + pid_flag + ' -d 0x1234 -c "ZIG20141ZB330001-24" -l 0 -i 0 -n 9876 -t 0' |
| subprocess.run(cmd, shell=True) |
| |
| # Generate Test Case Data Container in JSON Format |
| generate_test_case_vector_json(test_case_out_dir, test_cert, test_case) |
| |
| for test_cert in ['dac', 'pai']: |
| for test_case in VIDPID_FALLBACK_ENCODING_TEST_CASES: |
| test_case_out_dir = args.outdir + '/struct_' + test_cert + '_' + test_case["test_folder"] |
| if test_cert == 'dac': |
| common_name_dac = test_case["common_name"] |
| common_name_pai = '' |
| if "vid" in test_case: |
| vid_dac = test_case["vid"] |
| else: |
| vid_dac = VID_NOT_PRESENT |
| if "pid" in test_case: |
| pid_dac = test_case["pid"] |
| else: |
| pid_dac = PID_NOT_PRESENT |
| vid_pai = 0xFFF1 |
| pid_pai = 0x00B1 |
| else: |
| common_name_dac = '' |
| common_name_pai = test_case["common_name"] |
| common_name_pai = common_name_pai.replace('DAC', 'PAI') |
| vid_dac = 0xFFF1 |
| pid_dac = 0x00B1 |
| if "vid" in test_case: |
| vid_pai = test_case["vid"] |
| else: |
| vid_pai = VID_NOT_PRESENT |
| if "pid" in test_case: |
| pid_pai = test_case["pid"] |
| else: |
| pid_pai = PID_NOT_PRESENT |
| |
| # Generate PAI Cert/Key |
| builder = DevCertBuilder(CertType.PAI, 'no-error', args.paapath, test_case_out_dir, |
| chipcert, vid_pai, pid_pai, common_name_pai, '') |
| builder.make_certs_and_keys() |
| |
| # Generate DAC Cert/Key |
| builder = DevCertBuilder(CertType.DAC, 'no-error', args.paapath, test_case_out_dir, |
| chipcert, vid_dac, pid_dac, common_name_dac, '') |
| builder.make_certs_and_keys() |
| |
| # Generate Certification Declaration (CD) |
| cmd = chipcert + ' gen-cd -K ' + cd_key + ' -C ' + cd_cert + ' -O ' + test_case_out_dir + '/cd.der' + \ |
| ' -f 1 -V 0xFFF1 -p 0x00B1 -d 0x1234 -c "ZIG20141ZB330001-24" -l 0 -i 0 -n 9876 -t 0' |
| subprocess.run(cmd, shell=True) |
| |
| # Generate Test Case Data Container in JSON Format |
| generate_test_case_vector_json(test_case_out_dir, test_cert, test_case) |
| |
| for test_case in CD_STRUCT_TEST_CASES: |
| test_case_out_dir = args.outdir + '/struct_cd_' + test_case["test_folder"] |
| vid = 0xFFF1 |
| pid = 0x8000 |
| |
| # Generate PAI Cert/Key |
| builder = DevCertBuilder(CertType.PAI, 'no-error', args.paapath, test_case_out_dir, |
| chipcert, vid, pid, '', '') |
| builder.make_certs_and_keys() |
| |
| # Generate DAC Cert/Key |
| builder = DevCertBuilder(CertType.DAC, 'no-error', args.paapath, test_case_out_dir, |
| chipcert, vid, pid, '', '') |
| builder.make_certs_and_keys() |
| |
| # Generate Certification Declaration (CD) |
| vid_flag = ' -V 0x{:X}'.format(vid) |
| pid_flag = ' -p 0x{:X}'.format(pid) |
| |
| dac_origin_flag = ' ' |
| if test_case["error_flag"] == 'dac-origin-vid-present' or test_case["error_flag"] == 'dac-origin-vid-pid-present': |
| dac_origin_flag += ' -o 0x{:X}'.format(vid) |
| if test_case["error_flag"] == 'dac-origin-pid-present' or test_case["error_flag"] == 'dac-origin-vid-pid-present': |
| dac_origin_flag += ' -r 0x{:X}'.format(pid) |
| |
| if test_case["error_flag"] == 'authorized-paa-list-count0' or test_case["error_flag"] == 'authorized-paa-list-count1-valid' or test_case["error_flag"] == 'authorized-paa-list-count2-valid' or test_case["error_flag"] == 'authorized-paa-list-count3-invalid' or test_case["error_flag"] == 'authorized-paa-list-count10-valid' or test_case["error_flag"] == 'authorized-paa-list-count10-invalid': |
| authorized_paa_flag = ' -a ' + args.paapath + 'Cert.pem' |
| else: |
| authorized_paa_flag = '' |
| |
| cmd = chipcert + ' gen-cd -I -E ' + test_case["error_flag"] + ' -K ' + cd_key + ' -C ' + cd_cert + ' -O ' + test_case_out_dir + '/cd.der' + \ |
| ' -f 1 ' + vid_flag + pid_flag + dac_origin_flag + authorized_paa_flag + ' -d 0x1234 -c "ZIG20141ZB330001-24" -l 0 -i 0 -n 9876 -t 0' |
| subprocess.run(cmd, shell=True) |
| |
| # Generate Test Case Data Container in JSON Format |
| generate_test_case_vector_json(test_case_out_dir, 'cd', test_case) |
| |
| # Test case: Generate {DAC, PAI, PAA} chain with random (invalid) PAA |
| test_case = { |
| "description": 'Use Invalid PAA (Not Registered in the DCL).', |
| "test_folder": 'invalid_paa', |
| "error_flag": 'no-error', |
| "is_success_case": 'false', |
| } |
| test_case_out_dir = args.outdir + '/' + test_case["test_folder"] |
| paapath = test_case_out_dir + '/paa-' |
| |
| if not os.path.exists(test_case_out_dir): |
| os.mkdir(test_case_out_dir) |
| |
| # Generate PAA Cert/Key |
| cmd = chipcert + ' gen-att-cert -t a -c "Invalid (Not Registered in the DCL) Matter PAA" -f "' + VALID_IN_PAST + \ |
| '" -l 4294967295 -o ' + paapath + 'Cert.pem -O ' + paapath + 'Key.pem' |
| subprocess.run(cmd, shell=True) |
| |
| vid = 0xFFF1 |
| pid = 0x8000 |
| |
| # Generate PAI Cert/Key |
| builder = DevCertBuilder(CertType.PAI, test_case["error_flag"], paapath, test_case_out_dir, |
| chipcert, vid, PID_NOT_PRESENT, '', VALID_IN_PAST) |
| builder.make_certs_and_keys() |
| |
| # Generate DAC Cert/Key |
| builder = DevCertBuilder(CertType.DAC, test_case["error_flag"], paapath, test_case_out_dir, |
| chipcert, vid, pid, '', VALID_IN_PAST) |
| builder.make_certs_and_keys() |
| |
| # Generate Certification Declaration (CD) |
| vid_flag = ' -V 0x{:X}'.format(vid) |
| pid_flag = ' -p 0x{:X}'.format(pid) |
| cmd = chipcert + ' gen-cd -K ' + cd_key + ' -C ' + cd_cert + ' -O ' + test_case_out_dir + '/cd.der' + \ |
| ' -f 1 ' + vid_flag + pid_flag + ' -d 0x1234 -c "ZIG20141ZB330001-24" -l 0 -i 0 -n 9876 -t 0' |
| subprocess.run(cmd, shell=True) |
| |
| # Generate Test Case Data Container in JSON Format |
| generate_test_case_vector_json(test_case_out_dir, 'paa', test_case) |
| |
| |
| if __name__ == '__main__': |
| sys.exit(main()) |
