| # Copyright (c) 2023 Project CHIP Authors |
| # |
| # Licensed under the Apache License, Version 2.0 (the "License"); |
| # you may not use this file except in compliance with the License. |
| # You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, software |
| # distributed under the License is distributed on an "AS IS" BASIS, |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| # See the License for the specific language governing permissions and |
| # limitations under the License. |
| |
| name: 49.1.6. [TC-ACE-1.6] Group auth mode |
| |
| PICS: |
| - MCORE.ROLE.COMMISSIONEE |
| - G.S |
| |
| config: |
| nodeId: 0x12344321 |
| cluster: "Access Control" |
| endpoint: 0 |
| |
| #PIXIT.G.ENDPOINT |
| Groups.Endpoint: 1 |
| |
| tests: |
| - label: "Step 0: Wait for the commissioned device to be retrieved for TH1" |
| cluster: "DelayCommands" |
| command: "WaitForCommissionee" |
| arguments: |
| values: |
| - name: "nodeId" |
| value: nodeId |
| |
| - label: "TH reads the fabric index and saves for future use." |
| cluster: "Operational Credentials" |
| command: "readAttribute" |
| attribute: "CurrentFabricIndex" |
| response: |
| saveAs: FabricIndexValue |
| |
| - label: "TH reads the commissioner nodeID and saves for future use." |
| cluster: "CommissionerCommands" |
| command: "GetCommissionerNodeId" |
| response: |
| values: |
| - name: "nodeId" |
| saveAs: commissionerNodeId |
| |
| - label: |
| "Step 1a: TH sends KeySetWrite command in the GroupKeyManagement |
| cluster to DUT using a key that is pre-installed on the TH. |
| GroupKeySet fields are as follows: GroupKeySetID: 0x01a3 |
| GroupKeySecurityPolicy: TrustFirst (0) EpochKey0: |
| d0d1d2d3d4d5d6d7d8d9dadbdcdddedf EpochStartTime0: 2220000 EpochKey1: |
| d1d1d2d3d4d5d6d7d8d9dadbdcdddedf EpochStartTime1: 2220001 EpochKey2: |
| d2d1d2d3d4d5d6d7d8d9dadbdcdddedf EpochStartTime2: 2220002" |
| cluster: "Group Key Management" |
| command: "KeySetWrite" |
| arguments: |
| values: |
| - name: GroupKeySet |
| value: |
| { |
| GroupKeySetID: 0x01a3, |
| GroupKeySecurityPolicy: 0, |
| EpochKey0: "hex:d0d1d2d3d4d5d6d7d8d9dadbdcdddedf", |
| EpochStartTime0: 2220000, |
| EpochKey1: "hex:d1d1d2d3d4d5d6d7d8d9dadbdcdddedf", |
| EpochStartTime1: 2220001, |
| EpochKey2: "hex:d2d1d2d3d4d5d6d7d8d9dadbdcdddedf", |
| EpochStartTime2: 2220002, |
| } |
| - label: |
| "Step 1b: TH sends KeySetWrite command in the GroupKeyManagement |
| cluster to DUT using a key that is pre-installed on the TH. |
| GroupKeySet fields are as follows: GroupKeySetID: 0x01a1 |
| GroupKeySecurityPolicy: TrustFirst (0) EpochKey0: |
| a0d1d2d3d4d5d6d7d8d9dadbdcdddedf EpochStartTime0: 2220000 EpochKey1: |
| b1d1d2d3d4d5d6d7d8d9dadbdcdddedf EpochStartTime1: 2220001 EpochKey2: |
| c2d1d2d3d4d5d6d7d8d9dadbdcdddedf EpochStartTime2: 2220002" |
| cluster: "Group Key Management" |
| command: "KeySetWrite" |
| arguments: |
| values: |
| - name: GroupKeySet |
| value: |
| { |
| GroupKeySetID: 0x01a1, |
| GroupKeySecurityPolicy: 0, |
| EpochKey0: "hex:a0d1d2d3d4d5d6d7d8d9dadbdcdddedf", |
| EpochStartTime0: 2220000, |
| EpochKey1: "hex:b1d1d2d3d4d5d6d7d8d9dadbdcdddedf", |
| EpochStartTime1: 2220001, |
| EpochKey2: "hex:c2d1d2d3d4d5d6d7d8d9dadbdcdddedf", |
| EpochStartTime2: 2220002, |
| } |
| |
| - label: |
| "Step 2: TH binds GroupIds 0x0101 and 0x0102 with GroupKeySetID 0x01a1 |
| and GroupId 0x0103 with GroupKeySetID 0x01a3 in the GroupKeyMap |
| attribute list on GroupKeyManagement cluster by writing the |
| GroupKeyMap attribute with three entries as follows: List item 1: |
| GroupId: 0x0101, GroupKeySetId: 0x01a1, List item 2: GroupId: 0x0102, |
| GroupKeySetId: 0x01a1, List item 3: GroupId: 0x0103, GroupKeySetId: |
| 0x01a3" |
| cluster: "Group Key Management" |
| command: "writeAttribute" |
| attribute: "GroupKeyMap" |
| arguments: |
| value: |
| [ |
| { FabricIndex: 0, GroupId: 0x0101, GroupKeySetID: 0x01a1 }, |
| { FabricIndex: 0, GroupId: 0x0102, GroupKeySetID: 0x01a1 }, |
| { FabricIndex: 0, GroupId: 0x0103, GroupKeySetID: 0x01a3 }, |
| ] |
| |
| - label: |
| "Step 3: TH sends a AddGroup Command to the Groups cluster on Endpoint |
| PIXIT.G.ENDPOINT over CASE with the GroupID field set to 0x0103 and |
| the GroupName set to an empty string" |
| cluster: "Groups" |
| endpoint: Groups.Endpoint |
| command: "AddGroup" |
| arguments: |
| values: |
| - name: GroupID |
| value: 0x0103 |
| - name: GroupName |
| value: "" |
| |
| - label: |
| "Step 4: TH writes The ACL attribute in the Access Control cluster to |
| add Manage privileges for group 0x0103 and maintain the current |
| administrative privileges for the TH on the Access Control cluster. |
| The following access control list shall be used: List item 1 (TH |
| admin): Privilege: Administer (5) AuthMode: CASE (2) Subjects: [N1] |
| Targets: [{Cluster: AccessControl (0x001f), Endpoint: 0}] List item 2 |
| (group Manage access): Privilege: Manage (4) AuthMode: Group (3) |
| Subjects: group 0x0103 ([0x0103]) Targets: {Cluster: Groups (0x0004), |
| Endpoint: PIXIT.G.ENDPOINT}" |
| command: "writeAttribute" |
| attribute: "ACL" |
| arguments: |
| value: [ |
| { |
| FabricIndex: 0, |
| Privilege: 5, #Administer |
| AuthMode: 2, #CASE |
| Subjects: [commissionerNodeId], |
| Targets: |
| [ |
| { |
| Cluster: 0x001f, |
| Endpoint: endpoint, |
| DeviceType: null, |
| }, |
| ], |
| }, |
| { |
| FabricIndex: 0, |
| Privilege: 4, #Manage |
| AuthMode: 3, #Group |
| Subjects: [0x0103], #group 0x0103 |
| Targets: |
| [ |
| { |
| Cluster: 0x0004, |
| Endpoint: Groups.Endpoint, |
| DeviceType: null, |
| }, |
| ], |
| }, |
| ] |
| |
| - label: |
| "Step 5: TH sends a AddGroup Command to the Groups cluster on Endpoint |
| PIXIT.G.ENDPOINT over CASE with the GroupID field set to 0x0104 and |
| the GroupName set to an empty string" |
| cluster: "Groups" |
| endpoint: Groups.Endpoint |
| command: "AddGroup" |
| arguments: |
| values: |
| - name: GroupID |
| value: 0x0104 |
| - name: GroupName |
| value: "" |
| response: |
| error: UNSUPPORTED_ACCESS |
| |
| - label: |
| "Step 6: TH sends a AddGroup Command to the Groups cluster with the |
| GroupID field set to 0x0101 and the GroupName set to an empty string. |
| The command is sent as a group command using GroupID 0x0103" |
| cluster: "Groups" |
| groupId: 0x0103 |
| command: "AddGroup" |
| arguments: |
| values: |
| - name: GroupID |
| value: 0x0101 |
| - name: GroupName |
| value: "" |
| |
| # multicast if the unicast packet is sent immediately after the multicast one. |
| - label: "Wait for AddGroup" |
| cluster: "DelayCommands" |
| command: "WaitForMs" |
| arguments: |
| values: |
| - name: "ms" |
| value: 1000 |
| |
| - label: |
| "Step 7: TH sends a AddGroup Command to the Groups cluster with the |
| GroupID field set to 0x0102 and the GroupName set to an empty string. |
| The command is sent as a group command using GroupID 0x0101" |
| cluster: "Groups" |
| groupId: 0x0101 |
| command: "AddGroup" |
| arguments: |
| values: |
| - name: GroupID |
| value: 0x0102 |
| - name: GroupName |
| value: "" |
| |
| # multicast if the unicast packet is sent immediately after the multicast one. |
| - label: "Wait for AddGroup" |
| cluster: "DelayCommands" |
| command: "WaitForMs" |
| arguments: |
| values: |
| - name: "ms" |
| value: 1000 |
| |
| - label: |
| "Step 8: TH writes The ACL attribute in the Access Control cluster to |
| revoke groups Management access and restore full access over CASE by |
| setting the following ACL list items: List item 1 (TH admin): |
| Privilege: Administer (5) AuthMode: CASE (2) Subjects: [N1] Targets: |
| null" |
| command: "writeAttribute" |
| attribute: "ACL" |
| arguments: |
| value: [ |
| { |
| FabricIndex: 0, |
| Privilege: 5, #Administer |
| AuthMode: 2, #CASE |
| Subjects: [commissionerNodeId], |
| Targets: null, |
| }, |
| ] |
| |
| - label: |
| "Step 9: TH sends a ViewGroup Command to the Groups cluster on |
| Endpoint PIXIT.G.ENDPOINT over CASE with the GroupID set to 0x0101 to |
| confirm that the AddGroup command from step 6 was successful" |
| cluster: "Groups" |
| endpoint: Groups.Endpoint |
| command: "ViewGroup" |
| arguments: |
| values: |
| - name: GroupID |
| value: 0x0101 |
| response: |
| values: |
| - name: Status |
| value: 0 |
| - name: GroupID |
| value: 0x0101 |
| - name: GroupName |
| value: "" |
| |
| - label: |
| "Step 10: TH sends a ViewGroup Command to the Groups cluster on |
| Endpoint PIXIT.G.ENDPOINT over CASE with the GroupID set to 0x0102 to |
| confirm that the AddGroup command from step 7 was not successful" |
| cluster: "Groups" |
| endpoint: Groups.Endpoint |
| command: "ViewGroup" |
| arguments: |
| values: |
| - name: GroupID |
| value: 0x0102 |
| response: |
| values: |
| - name: Status |
| value: 139 |
| - name: GroupID |
| value: 0x0102 |
| - name: GroupName |
| value: "" |
| |
| - label: |
| "Step 11: TH sends a AddGroup Command to the Groups cluster with the |
| GroupID field set to 0x0105 and the GroupName set to an empty string. |
| The command is sent as a group command using GroupID 0x0103" |
| cluster: "Groups" |
| groupId: 0x0103 |
| command: "AddGroup" |
| arguments: |
| values: |
| - name: GroupID |
| value: 0x0105 |
| - name: GroupName |
| value: "" |
| |
| - label: |
| "Step 12: TH sends a ViewGroup Command to the Groups cluster on |
| Endpoint PIXIT.G.ENDPOINT over CASE with the GroupID set to 0x0105 to |
| confirm that the AddGroup command from step 11 was not successful" |
| cluster: "Groups" |
| endpoint: Groups.Endpoint |
| command: "ViewGroup" |
| arguments: |
| values: |
| - name: GroupID |
| value: 0x0105 |
| response: |
| values: |
| - name: Status |
| value: 139 |
| - name: GroupID |
| value: 0x0105 |
| - name: GroupName |
| value: "" |
| |
| - label: |
| "Step 13: TH sends the RemoveAllGroups Command to the Groups cluster |
| on Endpoint PIXIT.G.ENDPOINT over CASE" |
| cluster: "Groups" |
| endpoint: Groups.Endpoint |
| command: "RemoveAllGroups" |
| |
| - label: |
| "Step 14: TH resets the GroupKeyMap attribute list on |
| GroupKeyManagement cluster by writing the GroupKeyMap attribute with |
| an empty list" |
| cluster: "Group Key Management" |
| command: "writeAttribute" |
| attribute: "GroupKeyMap" |
| arguments: |
| value: [] |
| |
| - label: |
| "Step 15: TH resets the key set by sending the KeySetRemove command to |
| the GroupKeyManagement cluster over CASE with the following fields: |
| GroupKeySetID: 0x01a3" |
| cluster: "Group Key Management" |
| command: "KeySetRemove" |
| arguments: |
| values: |
| - name: GroupKeySetID |
| value: 0x01a3 |
| |
| - label: |
| "Step 16: TH resets the key set by sending the KeySetRemove command to |
| the GroupKeyManagement cluster over CASE with the following fields: |
| GroupKeySetID: 0x01a1" |
| cluster: "Group Key Management" |
| command: "KeySetRemove" |
| arguments: |
| values: |
| - name: GroupKeySetID |
| value: 0x01a1 |
