| /* |
| * |
| * Copyright (c) 2022 Project CHIP Authors |
| * All rights reserved. |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include <inttypes.h> |
| |
| #include <credentials/PersistentStorageOpCertStore.h> |
| #include <gtest/gtest.h> |
| #include <lib/support/CHIPMem.h> |
| #include <lib/support/CodeUtils.h> |
| #include <lib/support/DefaultStorageKeyAllocator.h> |
| #include <lib/support/Span.h> |
| #include <lib/support/TestPersistentStorageDelegate.h> |
| |
| using namespace chip; |
| using namespace chip::Credentials; |
| using CertChainElement = OperationalCertificateStore::CertChainElement; |
| |
| namespace { |
| |
| constexpr FabricIndex kFabricIndex1 = 1; |
| constexpr FabricIndex kFabricIndex2 = 2; |
| constexpr FabricIndex kOtherFabricIndex = static_cast<FabricIndex>(kFabricIndex1 + 10u); |
| |
| // The PersistentStorageOpCertStore does not validate cert contents, so we can use simple constants |
| const uint8_t kTestRcacBuf[] = { 'r', 'c', 'a', 'c' }; |
| const ByteSpan kTestRcacSpan{ kTestRcacBuf }; |
| |
| const uint8_t kTestIcacBuf[] = { 'i', 'c', 'a', 'c' }; |
| const ByteSpan kTestIcacSpan{ kTestIcacBuf }; |
| |
| const uint8_t kTestNocBuf[] = { 'n', 'o', 'c' }; |
| const ByteSpan kTestNocSpan{ kTestNocBuf }; |
| |
| struct TestPersistentStorageOpCertStore : public ::testing::Test |
| { |
| static void SetUpTestSuite() { ASSERT_EQ(chip::Platform::MemoryInit(), CHIP_NO_ERROR); } |
| static void TearDownTestSuite() { chip::Platform::MemoryShutdown(); } |
| }; |
| |
| TEST_F(TestPersistentStorageOpCertStore, TestAddNocFlow) |
| { |
| TestPersistentStorageDelegate storageDelegate; |
| PersistentStorageOpCertStore opCertStore; |
| |
| // Failure before Init |
| CHIP_ERROR err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); |
| |
| // Init succeeds |
| err = opCertStore.Init(&storageDelegate); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| |
| // Manually add existing root for the FabricIndex, should fail AddNewTrustedRootCertForFabric for |
| // same fabric but succeed GetCertificate. |
| const uint8_t kTestRcacBufExists[] = { 'r', 'c', 'a', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' }; |
| |
| err = storageDelegate.SyncSetKeyValue(DefaultStorageKeyAllocator::FabricRCAC(kFabricIndex1).KeyName(), kTestRcacBufExists, |
| sizeof(kTestRcacBufExists)); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 1u); |
| EXPECT_TRUE(opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kRcac)); //< From manual add |
| |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| |
| uint8_t largeBuf[400]; |
| MutableByteSpan largeSpan{ largeBuf }; |
| |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_ERROR_NOT_FOUND); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacBufExists })); |
| |
| // Adding root for another FabricIndex should work |
| err = opCertStore.AddNewTrustedRootCertForFabric(kUndefinedFabricIndex, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INVALID_FABRIC_INDEX); |
| |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex2, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 1u); //< Storage count did not yet increase |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| |
| // Should be able to read pending RCAC right away |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacSpan })); |
| |
| // Trying to commit with pending RCAC but no NOC should fail but leave everything as-is |
| err = opCertStore.CommitOpCertsForFabric(kFabricIndex2); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| |
| // Trying to do AddNewOpCertsForFabric for fabric different that with pending RCAC should fail |
| err = opCertStore.AddNewOpCertsForFabric(kOtherFabricIndex, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INVALID_FABRIC_INDEX); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| |
| // Clear other bad cases from storage for now |
| storageDelegate.ClearStorage(); |
| |
| // Trying to do AddNewOpCertsForFabric for same fabric as that with pending RCAC should fail |
| // if there are already existing NOC chain elements for the given fabric. |
| const uint8_t kTestIcacBufExists[] = { 'i', 'c', 'a', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' }; |
| const uint8_t kTestNocBufExists[] = { 'n', 'o', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' }; |
| |
| err = storageDelegate.SyncSetKeyValue(DefaultStorageKeyAllocator::FabricICAC(kFabricIndex2).KeyName(), kTestIcacBufExists, |
| sizeof(kTestIcacBufExists)); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 1u); |
| |
| err = storageDelegate.SyncSetKeyValue(DefaultStorageKeyAllocator::FabricNOC(kFabricIndex2).KeyName(), kTestNocBufExists, |
| sizeof(kTestNocBufExists)); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 2u); |
| |
| EXPECT_TRUE(opCertStore.HasCertificateForFabric(kFabricIndex2, CertChainElement::kIcac)); //< From manual add |
| EXPECT_TRUE(opCertStore.HasCertificateForFabric(kFabricIndex2, CertChainElement::kNoc)); //< From manual add |
| |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex2, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| |
| storageDelegate.SyncDeleteKeyValue(DefaultStorageKeyAllocator::FabricICAC(kFabricIndex2).KeyName()); |
| storageDelegate.SyncDeleteKeyValue(DefaultStorageKeyAllocator::FabricNOC(kFabricIndex2).KeyName()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); |
| |
| // Trying to do AddNewOpCertsForFabric for same fabric as that with pending RCAC should succeed |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex2, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| |
| // Should be able to get the pending cert even if not in persisted storage |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestIcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestNocSpan })); |
| |
| // Trying to do AddNewOpCertsForFabric a second time after success before commit should fail, |
| // but leave state as-is |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex2, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| |
| // Should be able to get the pending cert even if not in persisted storage, after an API error |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestIcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestNocSpan })); |
| |
| // Trying to commit with wrong FabricIndex should fail |
| err = opCertStore.CommitOpCertsForFabric(kOtherFabricIndex); |
| EXPECT_EQ(err, CHIP_ERROR_INVALID_FABRIC_INDEX); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| |
| // Commiting new certs should succeed on correct fabric |
| err = opCertStore.CommitOpCertsForFabric(kFabricIndex2); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); //< All certs now committed |
| |
| // Should be able to get the committed certs |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestIcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex2, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestNocSpan })); |
| |
| opCertStore.Finish(); |
| } |
| |
| TEST_F(TestPersistentStorageOpCertStore, TestUpdateNocFlow) |
| { |
| TestPersistentStorageDelegate storageDelegate; |
| PersistentStorageOpCertStore opCertStore; |
| |
| // Failure before Init |
| CHIP_ERROR err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); |
| |
| // Init succeeds |
| err = opCertStore.Init(&storageDelegate); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| |
| // Add a new pending trusted root to test for UpdateOpCertsForFabric failure on new root present |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Trying to do an UpdateOpCertsForFabric with new root pending should fail |
| err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Revert state for next tests |
| opCertStore.RevertPendingOpCerts(); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| |
| // Manually add root, ICAC and NOC to validate update since existing chain required |
| const uint8_t kTestRcacBufExists[] = { 'r', 'c', 'a', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' }; |
| const uint8_t kTestIcacBufExists[] = { 'i', 'c', 'a', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' }; |
| const uint8_t kTestNocBufExists[] = { 'n', 'o', 'c', ' ', 'e', 'x', 'i', 's', 't', 's' }; |
| |
| uint8_t largeBuf[400]; |
| MutableByteSpan largeSpan{ largeBuf }; |
| |
| { |
| err = storageDelegate.SyncSetKeyValue(DefaultStorageKeyAllocator::FabricRCAC(kFabricIndex1).KeyName(), kTestRcacBufExists, |
| sizeof(kTestRcacBufExists)); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 1u); |
| EXPECT_TRUE(opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kRcac)); //< From manual add |
| |
| err = storageDelegate.SyncSetKeyValue(DefaultStorageKeyAllocator::FabricICAC(kFabricIndex1).KeyName(), kTestIcacBufExists, |
| sizeof(kTestIcacBufExists)); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 2u); |
| EXPECT_TRUE(opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kIcac)); //< From manual add |
| |
| err = storageDelegate.SyncSetKeyValue(DefaultStorageKeyAllocator::FabricNOC(kFabricIndex1).KeyName(), kTestNocBufExists, |
| sizeof(kTestNocBufExists)); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); |
| EXPECT_TRUE(opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kNoc)); //< From manual add |
| |
| // Test that we can manually stored certs |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacBufExists })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestIcacBufExists })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestNocBufExists })); |
| } |
| |
| // Update fails on fabric with wrong FabricIndex |
| err = opCertStore.UpdateOpCertsForFabric(kOtherFabricIndex, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Update succeeds on fabric with existing data |
| err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); |
| |
| // Can read back existing root unchanged |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacBufExists })); |
| |
| // NOC chain elements see the pending updated certs |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestIcacBuf })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestNocBuf })); |
| |
| // Trying update again fails |
| err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); |
| |
| // Trying to add a new root after update, before commit/revert fails |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); |
| |
| // Trying to add new opcerts for any fabric after update, before commit/revert fails |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex2, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| |
| // Committing writes the new values (we even "background-remove" the old ICAC/NOC before commit) |
| storageDelegate.SyncDeleteKeyValue(DefaultStorageKeyAllocator::FabricICAC(kFabricIndex1).KeyName()); |
| storageDelegate.SyncDeleteKeyValue(DefaultStorageKeyAllocator::FabricNOC(kFabricIndex1).KeyName()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 1u); //< Root remains |
| |
| err = opCertStore.CommitOpCertsForFabric(kFabricIndex1); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); //< All certs now committed |
| |
| // Should be able to get the committed cert even if not in persisted storage, after an API error |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacBufExists })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestIcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestNocSpan })); |
| |
| // Calling revert doesn't undo the work we just did |
| opCertStore.RevertPendingOpCerts(); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); //< All certs now committed |
| |
| // Verify the revert after commit left all data alone |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacBufExists })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestIcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestNocSpan })); |
| |
| // Verify that RemoveOpCertsForFabric fails on fabric with no data |
| err = opCertStore.RemoveOpCertsForFabric(kFabricIndex2); |
| EXPECT_EQ(err, CHIP_ERROR_INVALID_FABRIC_INDEX); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); |
| |
| // Verify that RemoveOpCertsForFabric works for fabric we just updated |
| err = opCertStore.RemoveOpCertsForFabric(kFabricIndex1); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); // All keys gone |
| |
| opCertStore.Finish(); |
| } |
| |
| TEST_F(TestPersistentStorageOpCertStore, TestReverts) |
| { |
| TestPersistentStorageDelegate storageDelegate; |
| PersistentStorageOpCertStore opCertStore; |
| |
| // Failure before Init |
| CHIP_ERROR err = opCertStore.RemoveOpCertsForFabric(kFabricIndex1); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); |
| |
| // Init succeeds |
| err = opCertStore.Init(&storageDelegate); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| |
| // Add a new pending trusted root |
| uint8_t largeBuf[400]; |
| MutableByteSpan largeSpan{ largeBuf }; |
| |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Verify we can see the new trusted root |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(kTestRcacSpan)); |
| |
| // Verify that after revert, we can't see the root anymore |
| opCertStore.RevertPendingOpCerts(); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_ERROR_NOT_FOUND); |
| |
| { |
| // Add new root again, to then test review of AddNewTrustedCertificates |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Add NOC chain |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| } |
| |
| // Make sure we can see all pending certs before revert |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(kTestRcacSpan)); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(kTestIcacSpan)); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(kTestNocSpan)); |
| } |
| |
| // Revert |
| opCertStore.RevertPendingOpCerts(); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| |
| // Verify that after revert, we can't see the root or chain anymore |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_ERROR_NOT_FOUND); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_ERROR_NOT_FOUND); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_ERROR_NOT_FOUND); |
| } |
| |
| // Start again to add a new set, but then let's commit |
| { |
| // Add new root again, to then test review of AddNewTrustedCertificates |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Add NOC chain |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, kTestIcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| } |
| |
| // Commiting new certs should succeed on correct fabric |
| err = opCertStore.CommitOpCertsForFabric(kFabricIndex1); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); //< All certs now committed |
| |
| // Should be able to get the committed certs |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestIcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestNocSpan })); |
| } |
| |
| const uint8_t kNewNoc[] = { 'n', 'o', 'c', ' ', 'n', 'e', 'w' }; |
| |
| // Updating certs should work (NO ICAC) |
| err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, ByteSpan{ kNewNoc }, ByteSpan{}); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); //< No change to keys |
| |
| // Should see committed root, pending NOC, absent ICAC |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_ERROR_NOT_FOUND); |
| EXPECT_FALSE(opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kIcac)); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kNewNoc })); |
| } |
| |
| // Revert, should be back at previous state |
| opCertStore.RevertPendingOpCerts(); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); //< Storage count did not yet change |
| |
| // Should be able to get the previously committed certs |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestIcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestNocSpan })); |
| } |
| |
| // Try again to update with missing ICAC and commit |
| err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, ByteSpan{ kNewNoc }, ByteSpan{}); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); //< No change to keys |
| |
| err = opCertStore.CommitOpCertsForFabric(kFabricIndex1); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 2u); //< ICAC cert should be gone |
| |
| // Should see committed root, new NOC, absent ICAC |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacSpan })); |
| EXPECT_TRUE(opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kRcac)); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_ERROR_NOT_FOUND); |
| EXPECT_FALSE(opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kIcac)); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kNewNoc })); |
| EXPECT_TRUE(opCertStore.HasCertificateForFabric(kFabricIndex1, CertChainElement::kNoc)); |
| } |
| |
| opCertStore.Finish(); |
| } |
| |
| TEST_F(TestPersistentStorageOpCertStore, TestRevertAddNoc) |
| { |
| TestPersistentStorageDelegate storageDelegate; |
| PersistentStorageOpCertStore opCertStore; |
| |
| // Init succeeds |
| CHIP_ERROR err = opCertStore.Init(&storageDelegate); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| |
| // Add a new pending trusted root |
| uint8_t largeBuf[400]; |
| MutableByteSpan largeSpan{ largeBuf }; |
| |
| { |
| // Add new root |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Add NOC chain, with NO ICAC |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, ByteSpan{}); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| } |
| |
| // Make sure we get expected pending state before revert |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(kTestRcacSpan)); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_ERROR_NOT_FOUND); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(kTestNocSpan)); |
| } |
| |
| // Revert using RemoveOpCertsForFabric |
| err = opCertStore.RemoveOpCertsForFabric(kFabricIndex1); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| |
| // Add again, and commit |
| { |
| // Add new root |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Add NOC chain, with NO ICAC |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, ByteSpan{}); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| |
| err = opCertStore.CommitOpCertsForFabric(kFabricIndex1); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 2u); //< We have RCAC, NOC, no ICAC |
| } |
| |
| // Update to add an ICAC |
| const uint8_t kNewIcac[] = { 'i', 'c', 'a', 'c', ' ', 'n', 'e', 'w' }; |
| const uint8_t kNewNoc[] = { 'n', 'o', 'c', ' ', 'n', 'e', 'w' }; |
| |
| // Updating certs should work (NO ICAC) |
| err = opCertStore.UpdateOpCertsForFabric(kFabricIndex1, ByteSpan{ kNewNoc }, ByteSpan{ kNewIcac }); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 2u); //< No change to keys |
| |
| // Should see committed root, pending NOC, pending ICAC |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kNewIcac })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kNewNoc })); |
| } |
| |
| // Commit, should see the new ICAC appear. |
| err = opCertStore.CommitOpCertsForFabric(kFabricIndex1); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 3u); //< We have RCAC, NOC, ICAC |
| |
| // Should see committed root, new NOC, new ICAC |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kTestRcacSpan })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kNewIcac })); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(ByteSpan{ kNewNoc })); |
| } |
| |
| opCertStore.Finish(); |
| } |
| |
| TEST_F(TestPersistentStorageOpCertStore, TestRevertPendingOpCertsExceptRoot) |
| { |
| TestPersistentStorageDelegate storageDelegate; |
| PersistentStorageOpCertStore opCertStore; |
| |
| // Init succeeds |
| CHIP_ERROR err = opCertStore.Init(&storageDelegate); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| |
| // Add a new pending trusted root |
| uint8_t largeBuf[400]; |
| MutableByteSpan largeSpan{ largeBuf }; |
| |
| { |
| // Add new root |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Add NOC chain, with NO ICAC |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, ByteSpan{}); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| } |
| |
| // Make sure we get expected pending state before revert |
| { |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kRcac, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(kTestRcacSpan)); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kIcac, largeSpan); |
| EXPECT_EQ(err, CHIP_ERROR_NOT_FOUND); |
| |
| largeSpan = MutableByteSpan{ largeBuf }; |
| err = opCertStore.GetCertificate(kFabricIndex1, CertChainElement::kNoc, largeSpan); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(largeSpan.data_equal(kTestNocSpan)); |
| } |
| |
| // Revert using RevertPendingOpCertsExceptRoot |
| opCertStore.RevertPendingOpCertsExceptRoot(); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| |
| // Add again, and commit |
| { |
| // Add new root: should fail, since it should still be pending |
| err = opCertStore.AddNewTrustedRootCertForFabric(kFabricIndex1, kTestRcacSpan); |
| EXPECT_EQ(err, CHIP_ERROR_INCORRECT_STATE); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| |
| // Add NOC chain, with NO ICAC |
| err = opCertStore.AddNewOpCertsForFabric(kFabricIndex1, kTestNocSpan, ByteSpan{}); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_TRUE(opCertStore.HasPendingNocChain()); |
| EXPECT_TRUE(opCertStore.HasPendingRootCert()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 0u); //< Storage count did not yet increase |
| |
| err = opCertStore.CommitOpCertsForFabric(kFabricIndex1); |
| EXPECT_EQ(err, CHIP_NO_ERROR); |
| EXPECT_FALSE(opCertStore.HasPendingRootCert()); |
| EXPECT_FALSE(opCertStore.HasPendingNocChain()); |
| EXPECT_EQ(storageDelegate.GetNumKeys(), 2u); //< We have RCAC, NOC, no ICAC |
| } |
| |
| opCertStore.Finish(); |
| } |
| |
| } // namespace |
