Skip to content

Commit 7999db8

Browse files
gmarcosbgmarcosb
authored
TLSCertificateManagement Cluster (#36379)
* Generated using: ./alchemy zap --attribute="in-progress" --sdkRoot=[] --specRoot=[] 'TLSCertificateManagement.adoc' With manual edits adding description & apiMaturity * Generated using ./scripts/tools/zap_regen_all.py
1 parent 11a6571 commit 7999db8

File tree

56 files changed

+11872
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+11872
-0
lines changed

‎.github/workflows/tests.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,7 @@ jobs:
198198
src/app/zap-templates/zcl/data-model/chip/time-format-localization-cluster.xml \
199199
src/app/zap-templates/zcl/data-model/chip/time-synchronization-cluster.xml \
200200
src/app/zap-templates/zcl/data-model/chip/timer-cluster.xml \
201+
src/app/zap-templates/zcl/data-model/chip/tls-certificate-management-cluster.xml \
201202
src/app/zap-templates/zcl/data-model/chip/user-label-cluster.xml \
202203
src/app/zap-templates/zcl/data-model/chip/unit-localization-cluster.xml \
203204
src/app/zap-templates/zcl/data-model/chip/wake-on-lan-cluster.xml \

‎docs/ids_and_codes/zap_clusters.md

+1
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,7 @@ Generally regenerate using one of:
138138
| 1366 | 0x556 | Chime |
139139
| 1872 | 0x750 | EcosystemInformation |
140140
| 1873 | 0x751 | CommissionerControl |
141+
| 2049 | 0x801 | TlsCertificateManagement |
141142
| 4294048773 | 0xFFF1FC05 | UnitTesting |
142143
| 4294048774 | 0xFFF1FC06 | FaultInjection |
143144
| 4294048800 | 0xFFF1FC20 | SampleMei |

‎scripts/rules.matterlint

+1
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ load "../src/app/zap-templates/zcl/data-model/chip/thread-network-directory-clus
105105
load "../src/app/zap-templates/zcl/data-model/chip/time-format-localization-cluster.xml";
106106
load "../src/app/zap-templates/zcl/data-model/chip/time-synchronization-cluster.xml";
107107
load "../src/app/zap-templates/zcl/data-model/chip/timer-cluster.xml";
108+
load "../src/app/zap-templates/zcl/data-model/chip/tls-certificate-management-cluster.xml";
108109
load "../src/app/zap-templates/zcl/data-model/chip/unit-localization-cluster.xml";
109110
load "../src/app/zap-templates/zcl/data-model/chip/user-label-cluster.xml";
110111
load "../src/app/zap-templates/zcl/data-model/chip/wake-on-lan-cluster.xml";

‎src/app/zap-templates/zcl/data-model/chip/tls-certificate-management-cluster.xml

+142
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
<?xml version="1.0"?>
2+
<!--
3+
Copyright (c) 2024-2025 Project CHIP Authors
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
-->
17+
<!--
18+
XML generated by Alchemy; DO NOT EDIT.
19+
Source: src/tls/TLSCertificateManagement.adoc
20+
Parameters: in-progress
21+
Git: 1.4-534-g3214b3502
22+
-->
23+
<configurator xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../../zcl.xsd">
24+
<domain name="General"/>
25+
<struct name="TLSCertStruct" apiMaturity="provisional">
26+
<cluster code="0x0801"/>
27+
<item fieldId="0" name="CAID" type="int16u"/>
28+
<item fieldId="1" name="Certificate" type="long_octet_string" length="3000"/>
29+
</struct>
30+
31+
<struct name="TLSClientCertificateDetailStruct" apiMaturity="provisional">
32+
<cluster code="0x0801"/>
33+
<item fieldId="0" name="CCDID" type="int16u"/>
34+
<item fieldId="1" name="ClientCertificate" type="long_octet_string" length="3000"/>
35+
<item fieldId="2" name="IntermediateCertificates" array="true" type="octet_string"/>
36+
</struct>
37+
38+
<cluster apiMaturity="provisional">
39+
<domain name="General"/>
40+
<name>TLS Certificate Management</name>
41+
<code>0x0801</code>
42+
<define>TLS_CERTIFICATE_MANAGEMENT_CLUSTER</define>
43+
<description>This Cluster is used to manage TLS Client Certificates and to provision
44+
TLS endpoints with enough information to facilitate subsequent connection.</description>
45+
<client init="false" tick="false">true</client>
46+
<server init="false" tick="false">true</server>
47+
<globalAttribute code="0xFFFD" side="either" value="1"/>
48+
<attribute code="0x0000" side="server" define="MAX_ROOT_CERTIFICATES" type="int8u">MaxRootCertificates</attribute>
49+
<attribute code="0x0001" side="server" define="CURRENT_ROOT_CERTIFICATES" type="int8u">CurrentRootCertificates</attribute>
50+
<attribute code="0x0002" side="server" define="MAX_CLIENT_CERTIFICATES" type="int8u">MaxClientCertificates</attribute>
51+
<attribute code="0x0003" side="server" define="CURRENT_CLIENT_CERTIFICATES" type="int8u">CurrentClientCertificates</attribute>
52+
<command code="0x00" source="client" name="ProvisionRootCertificate" optional="false" response="ProvisionRootCertificateResponse">
53+
<description>This command SHALL provision the provided certificate for the passed in CAID.</description>
54+
<access op="invoke" privilege="administer"/>
55+
<arg id="0" name="Certificate" type="long_octet_string" length="3000"/>
56+
<arg id="1" name="CAID" type="int16u" isNullable="true"/>
57+
</command>
58+
59+
<command code="0x01" source="server" name="ProvisionRootCertificateResponse" optional="false" disableDefaultResponse="true">
60+
<description>This command SHALL be generated in response to a ProvisionRootCertificate command.</description>
61+
<arg id="0" name="CAID" type="int16u"/>
62+
</command>
63+
64+
<command code="0x02" source="client" name="FindRootCertificate" optional="false" response="FindRootCertificateResponse">
65+
<description>This command SHALL return the TLSCertStruct for the passed in CAID.</description>
66+
<arg id="0" name="CAID" type="int16u" isNullable="true"/>
67+
</command>
68+
69+
<command code="0x03" source="server" name="FindRootCertificateResponse" optional="false" disableDefaultResponse="true">
70+
<description>This command SHALL be generated in response to a FindRootCertificate command.</description>
71+
<arg id="0" name="CertificateDetails" array="true" type="TLSCertStruct"/>
72+
</command>
73+
74+
<command code="0x04" source="client" name="LookupRootCertificate" optional="false" response="LookupRootCertificateResponse">
75+
<description>This command SHALL return the CAID for the passed in fingerprint.</description>
76+
<arg id="0" name="Fingerprint" type="octet_string" length="64"/>
77+
</command>
78+
79+
<command code="0x05" source="server" name="LookupRootCertificateResponse" optional="false" disableDefaultResponse="true">
80+
<description>This command SHALL be generated in response to a LookupRootCertificate command.</description>
81+
<arg id="0" name="CAID" type="int16u"/>
82+
</command>
83+
84+
<command code="0x06" source="client" name="RemoveRootCertificate" optional="false">
85+
<description>This command SHALL be generated to request the server removes the certificate provisioned to the provided Certificate Authority ID.</description>
86+
<access op="invoke" privilege="administer"/>
87+
<arg id="0" name="CAID" type="int16u"/>
88+
</command>
89+
90+
<command code="0x07" source="client" name="TLSClientCSR" optional="false" response="TLSClientCSRResponse">
91+
<description>This command SHALL be generated to request the Node generates a Certificate Signing Request.</description>
92+
<access op="invoke" privilege="administer"/>
93+
<arg id="1" name="Nonce" type="octet_string"/>
94+
</command>
95+
96+
<command code="0x08" source="server" name="TLSClientCSRResponse" optional="false" disableDefaultResponse="true">
97+
<description>This command SHALL be generated in response to a TLSClientCSR command.</description>
98+
<arg id="0" name="CCDID" type="int16u"/>
99+
<arg id="1" name="CSR" type="octet_string"/>
100+
<arg id="2" name="Nonce" type="octet_string"/>
101+
</command>
102+
103+
<command code="0x09" source="client" name="ProvisionClientCertificate" optional="false" response="ProvisionClientCertificateResponse">
104+
<description>This command SHALL be generated to request the Node provisions the provided Client Certificate Details.</description>
105+
<access op="invoke" privilege="administer"/>
106+
<arg id="0" name="CCDID" type="int16u"/>
107+
<arg id="1" name="ClientCertificateDetails" type="TLSClientCertificateDetailStruct"/>
108+
</command>
109+
110+
<command code="0x0A" source="server" name="ProvisionClientCertificateResponse" optional="false" disableDefaultResponse="true">
111+
<description>This command SHALL be generated in response to a ProvisionClientCertificate command.</description>
112+
<arg id="0" name="CCDID" type="int16u"/>
113+
</command>
114+
115+
<command code="0x0B" source="client" name="FindClientCertificate" optional="false" response="FindClientCertificateResponse">
116+
<description>This command SHALL return the TLSClientCertificateDetailStruct for the passed in CCDID.</description>
117+
<arg id="0" name="CCDID" type="int16u"/>
118+
</command>
119+
120+
<command code="0x0C" source="server" name="FindClientCertificateResponse" optional="false" disableDefaultResponse="true">
121+
<description>This command SHALL be generated in response to a FindClientCertificate command.</description>
122+
<arg id="0" name="CertificateDetails" array="true" type="TLSClientCertificateDetailStruct"/>
123+
</command>
124+
125+
<command code="0x0D" source="client" name="LookupClientCertificate" optional="false" response="LookupClientCertificateResponse">
126+
<description>This command SHALL return the CCDID for the passed in Fingerprint.</description>
127+
<arg id="0" name="Fingerprint" type="octet_string" length="64"/>
128+
</command>
129+
130+
<command code="0x0E" source="server" name="LookupClientCertificateResponse" optional="false" disableDefaultResponse="true">
131+
<description>This command SHALL be generated in response to a LookupClientCertificate command.</description>
132+
<arg id="0" name="CCDID" type="int16u"/>
133+
</command>
134+
135+
<command code="0x0F" source="client" name="RemoveClientCertificate" optional="false">
136+
<description>This command SHALL be generated to request the Node removes the certificate provisioned to the provided Client Certificate Details ID.</description>
137+
<access op="invoke" privilege="administer"/>
138+
<arg id="0" name="CCDID" type="int16u"/>
139+
</command>
140+
141+
</cluster>
142+
</configurator>

‎src/app/zap-templates/zcl/zcl-with-test-extensions.json

+1
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,7 @@
127127
"time-format-localization-cluster.xml",
128128
"time-synchronization-cluster.xml",
129129
"timer-cluster.xml",
130+
"tls-certificate-management-cluster.xml",
130131
"user-label-cluster.xml",
131132
"unit-localization-cluster.xml",
132133
"valve-configuration-and-control-cluster.xml",

‎src/app/zap-templates/zcl/zcl.json

+1
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,7 @@
121121
"time-format-localization-cluster.xml",
122122
"time-synchronization-cluster.xml",
123123
"timer-cluster.xml",
124+
"tls-certificate-management-cluster.xml",
124125
"user-label-cluster.xml",
125126
"unit-localization-cluster.xml",
126127
"valve-configuration-and-control-cluster.xml",

‎src/app/zap_cluster_list.json

+2
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,7 @@
123123
"TIME_FORMAT_LOCALIZATION_CLUSTER": [],
124124
"TIME_SYNCHRONIZATION_CLUSTER": [],
125125
"TIMER_CLUSTER": [],
126+
"TLS_CERTIFICATE_MANAGEMENT_CLUSTER": [],
126127
"TRUSTED_ROOT_CERTIFICATES_CLUSTER": [],
127128
"UNIT_LOCALIZATION_CLUSTER": [],
128129
"UNIT_TESTING_CLUSTER": [],
@@ -307,6 +308,7 @@
307308
"TIME_FORMAT_LOCALIZATION_CLUSTER": ["time-format-localization-server"],
308309
"TIME_SYNCHRONIZATION_CLUSTER": ["time-synchronization-server"],
309310
"TIMER_CLUSTER": ["timer-server"],
311+
"TLS_CERTIFICATE_MANAGEMENT_CLUSTER": [],
310312
"TVOC_CONCENTRATION_MEASUREMENT_CLUSTER": [
311313
"concentration-measurement-server"
312314
],

‎src/controller/data_model/controller-clusters.matter

+115
Original file line numberDiff line numberDiff line change
@@ -10441,6 +10441,121 @@ cluster CommissionerControl = 1873 {
1044110441
command access(invoke: manage) CommissionNode(CommissionNodeRequest): ReverseOpenCommissioningWindow = 1;
1044210442
}
1044310443

10444+
/** This Cluster is used to manage TLS Client Certificates and to provision
10445+
TLS endpoints with enough information to facilitate subsequent connection. */
10446+
provisional cluster TlsCertificateManagement = 2049 {
10447+
revision 1;
10448+
10449+
struct TLSCertStruct {
10450+
int16u caid = 0;
10451+
long_octet_string<3000> certificate = 1;
10452+
}
10453+
10454+
struct TLSClientCertificateDetailStruct {
10455+
int16u ccdid = 0;
10456+
long_octet_string<3000> clientCertificate = 1;
10457+
octet_string intermediateCertificates[] = 2;
10458+
}
10459+
10460+
readonly attribute int8u maxRootCertificates = 0;
10461+
readonly attribute int8u currentRootCertificates = 1;
10462+
readonly attribute int8u maxClientCertificates = 2;
10463+
readonly attribute int8u currentClientCertificates = 3;
10464+
readonly attribute command_id generatedCommandList[] = 65528;
10465+
readonly attribute command_id acceptedCommandList[] = 65529;
10466+
readonly attribute event_id eventList[] = 65530;
10467+
readonly attribute attrib_id attributeList[] = 65531;
10468+
readonly attribute bitmap32 featureMap = 65532;
10469+
readonly attribute int16u clusterRevision = 65533;
10470+
10471+
request struct ProvisionRootCertificateRequest {
10472+
long_octet_string<3000> certificate = 0;
10473+
nullable int16u caid = 1;
10474+
}
10475+
10476+
response struct ProvisionRootCertificateResponse = 1 {
10477+
int16u caid = 0;
10478+
}
10479+
10480+
request struct FindRootCertificateRequest {
10481+
nullable int16u caid = 0;
10482+
}
10483+
10484+
response struct FindRootCertificateResponse = 3 {
10485+
TLSCertStruct certificateDetails[] = 0;
10486+
}
10487+
10488+
request struct LookupRootCertificateRequest {
10489+
octet_string<64> fingerprint = 0;
10490+
}
10491+
10492+
response struct LookupRootCertificateResponse = 5 {
10493+
int16u caid = 0;
10494+
}
10495+
10496+
request struct RemoveRootCertificateRequest {
10497+
int16u caid = 0;
10498+
}
10499+
10500+
request struct TLSClientCSRRequest {
10501+
octet_string nonce = 0;
10502+
}
10503+
10504+
response struct TLSClientCSRResponse = 8 {
10505+
int16u ccdid = 0;
10506+
octet_string csr = 1;
10507+
octet_string nonce = 2;
10508+
}
10509+
10510+
request struct ProvisionClientCertificateRequest {
10511+
int16u ccdid = 0;
10512+
TLSClientCertificateDetailStruct clientCertificateDetails = 1;
10513+
}
10514+
10515+
response struct ProvisionClientCertificateResponse = 10 {
10516+
int16u ccdid = 0;
10517+
}
10518+
10519+
request struct FindClientCertificateRequest {
10520+
int16u ccdid = 0;
10521+
}
10522+
10523+
response struct FindClientCertificateResponse = 12 {
10524+
TLSClientCertificateDetailStruct certificateDetails[] = 0;
10525+
}
10526+
10527+
request struct LookupClientCertificateRequest {
10528+
octet_string<64> fingerprint = 0;
10529+
}
10530+
10531+
response struct LookupClientCertificateResponse = 14 {
10532+
int16u ccdid = 0;
10533+
}
10534+
10535+
request struct RemoveClientCertificateRequest {
10536+
int16u ccdid = 0;
10537+
}
10538+
10539+
/** This command SHALL provision the provided certificate for the passed in CAID. */
10540+
command access(invoke: administer) ProvisionRootCertificate(ProvisionRootCertificateRequest): ProvisionRootCertificateResponse = 0;
10541+
/** This command SHALL return the TLSCertStruct for the passed in CAID. */
10542+
command FindRootCertificate(FindRootCertificateRequest): FindRootCertificateResponse = 2;
10543+
/** This command SHALL return the CAID for the passed in fingerprint. */
10544+
command LookupRootCertificate(LookupRootCertificateRequest): LookupRootCertificateResponse = 4;
10545+
/** This command SHALL be generated to request the server removes the certificate provisioned to the provided Certificate Authority ID. */
10546+
command access(invoke: administer) RemoveRootCertificate(RemoveRootCertificateRequest): DefaultSuccess = 6;
10547+
/** This command SHALL be generated to request the Node generates a Certificate Signing Request. */
10548+
command access(invoke: administer) TLSClientCSR(TLSClientCSRRequest): TLSClientCSRResponse = 7;
10549+
/** This command SHALL be generated to request the Node provisions the provided Client Certificate Details. */
10550+
command access(invoke: administer) ProvisionClientCertificate(ProvisionClientCertificateRequest): ProvisionClientCertificateResponse = 9;
10551+
/** This command SHALL return the TLSClientCertificateDetailStruct for the passed in CCDID. */
10552+
command FindClientCertificate(FindClientCertificateRequest): FindClientCertificateResponse = 11;
10553+
/** This command SHALL return the CCDID for the passed in Fingerprint. */
10554+
command LookupClientCertificate(LookupClientCertificateRequest): LookupClientCertificateResponse = 13;
10555+
/** This command SHALL be generated to request the Node removes the certificate provisioned to the provided Client Certificate Details ID. */
10556+
command access(invoke: administer) RemoveClientCertificate(RemoveClientCertificateRequest): DefaultSuccess = 15;
10557+
}
10558+
1044410559
/** The Test Cluster is meant to validate the generated code */
1044510560
internal cluster UnitTesting = 4294048773 {
1044610561
revision 1; // NOTE: Default/not specifically set

0 commit comments

Comments
 (0)