forked from project-chip/connectedhomeip
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[nrfconnect] Adapt nrfconnect examples to PSA Crypto API
Enabled PSA Crypto api in all nrfconnect examples.
- Loading branch information
1 parent
8bf8c25
commit 51770af
Showing
6 changed files
with
186 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| /* | ||
| * Copyright (c) 2024 Project CHIP Authors | ||
| * All rights reserved. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| #include "migration_manager.h" | ||
|
|
||
| #include <crypto/OperationalKeystore.h> | ||
| #include <crypto/PersistentStorageOperationalKeystore.h> | ||
|
|
||
| #ifdef CONFIG_CHIP_MIGRATE_OPERATIONAL_KEYS_TO_ITS | ||
| CHIP_ERROR MoveOperationalKeysFromKvsToIts(chip::PersistentStorageDelegate * storage, chip::Crypto::OperationalKeystore * keystore) | ||
| { | ||
| CHIP_ERROR err = CHIP_NO_ERROR; | ||
|
|
||
| VerifyOrReturnError(keystore && storage, CHIP_ERROR_INVALID_ARGUMENT); | ||
|
|
||
| /* Initialize the obsolete Operational Keystore*/ | ||
| chip::PersistentStorageOperationalKeystore obsoleteKeystore; | ||
| err = obsoleteKeystore.Init(storage); | ||
| VerifyOrReturnError(err == CHIP_NO_ERROR, err); | ||
|
|
||
| /* Migrate all obsolete Operational Keys to PSA ITS */ | ||
| for (const chip::FabricInfo & fabric : chip::Server::GetInstance().GetFabricTable()) | ||
| { | ||
| err = keystore->MigrateOpKeypairForFabric(fabric.GetFabricIndex(), obsoleteKeystore); | ||
| if (CHIP_NO_ERROR != err) | ||
| { | ||
| break; | ||
| } | ||
| } | ||
|
|
||
| #ifdef CONFIG_CHIP_FACTORY_RESET_ON_KEY_MIGRATION_FAILURE | ||
| if (CHIP_NO_ERROR != err) | ||
| { | ||
| chip::Server::GetInstance().ScheduleFactoryReset(); | ||
| /* Return a success to not block the Matter event Loop and allow to call scheduled factory | ||
| * reset. */ | ||
| err = CHIP_NO_ERROR; | ||
| } | ||
| #endif /* CONFIG_CHIP_FACTORY_RESET_ON_KEY_MIGRATION_FAILURE */ | ||
|
|
||
| return err; | ||
| } | ||
| #endif /* CONFIG_CHIP_MIGRATE_OPERATIONAL_KEYS_TO_ITS */ |
41 changes: 41 additions & 0 deletions
41
examples/platform/nrfconnect/util/include/MigrationManager.h
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| /* | ||
| * Copyright (c) 2024 Project CHIP Authors | ||
| * All rights reserved. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| #pragma once | ||
|
|
||
| #include <app/server/Server.h> | ||
|
|
||
| #ifdef CONFIG_CHIP_MIGRATE_OPERATIONAL_KEYS_TO_ITS | ||
| /** | ||
| * @brief Migrate all stored Operational Keys from the persistent storage (KVS) to secure PSA ITS. | ||
| * | ||
| * This function will schedule a factory reset automatically if the | ||
| * CONFIG_CHIP_FACTORY_RESET_ON_KEY_MIGRATION_FAILURE | ||
| * Kconfig option is set to 'y'. In this case, the function returns CHIP_NO_ERROR to not block any further | ||
| * operations until the scheduled factory reset is done. | ||
| * | ||
| * @note This function should be called just after Matter Server Init to avoid problems with further CASE | ||
| * session re-establishments. | ||
| * @param storage | ||
| * @param keystore | ||
| * @retval CHIP_NO_ERROR if all keys have been migrated properly to PSA ITS or if the error occurs, but | ||
| * the CONFIG_CHIP_FACTORY_RESET_ON_KEY_MIGRATION_FAILURE kconfig is set to 'y'. | ||
| * @retval CHIP_ERROR_INVALID_ARGUMENT when keystore or storage are not defined. | ||
| * @retval Other CHIP_ERROR codes related to internal Migration operations. | ||
| */ | ||
| CHIP_ERROR MoveOperationalKeysFromKvsToIts(chip::PersistentStorageDelegate * storage, chip::Crypto::OperationalKeystore * keystore); | ||
| #endif |