@project-chip/matter.js 0.2.0 → 0.3.0

package/dist/es/session/SecureSession.js

@@ -0,0 +1,131 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { MessageCodec } from "../codec/MessageCodec.js";
+import { Crypto } from "../crypto/Crypto.js";
+import { DEFAULT_ACTIVE_RETRANSMISSION_TIMEOUT_MS, DEFAULT_IDLE_RETRANSMISSION_TIMEOUT_MS, DEFAULT_RETRANSMISSION_RETRIES, SLEEPY_ACTIVE_THRESHOLD_MS } from "./Session.js";
+import { UNDEFINED_NODE_ID } from "./SessionManager.js";
+import { ByteArray, Endian } from "../util/ByteArray.js";
+import { Logger } from "../log/Logger.js";
+import { Time } from "../time/Time.js";
+import { DataWriter } from "../util/DataWriter.js";
+const logger = Logger.get("SecureSession");
+const SESSION_KEYS_INFO = ByteArray.fromString("SessionKeys");
+const SESSION_RESUMPTION_KEYS_INFO = ByteArray.fromString("SessionResumptionKeys");
+export class SecureSession {
+    static create(context, id, fabric, peerNodeId, peerSessionId, sharedSecret, salt, isInitiator, isResumption, closeCallback, idleRetransTimeoutMs, activeRetransTimeoutMs) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const keys = yield Crypto.hkdf(sharedSecret, salt, isResumption ? SESSION_RESUMPTION_KEYS_INFO : SESSION_KEYS_INFO, 16 * 3);
+            const decryptKey = isInitiator ? keys.slice(16, 32) : keys.slice(0, 16);
+            const encryptKey = isInitiator ? keys.slice(0, 16) : keys.slice(16, 32);
+            const attestationKey = keys.slice(32, 48);
+            return new SecureSession(context, id, fabric, peerNodeId, peerSessionId, sharedSecret, decryptKey, encryptKey, attestationKey, closeCallback, idleRetransTimeoutMs, activeRetransTimeoutMs);
+        });
+    }
+    constructor(context, id, fabric, peerNodeId, peerSessionId, _sharedSecret, decryptKey, encryptKey, attestationKey, closeCallback, idleRetransmissionTimeoutMs = DEFAULT_IDLE_RETRANSMISSION_TIMEOUT_MS, activeRetransmissionTimeoutMs = DEFAULT_ACTIVE_RETRANSMISSION_TIMEOUT_MS, retransmissionRetries = DEFAULT_RETRANSMISSION_RETRIES) {
+        this.context = context;
+        this.id = id;
+        this.fabric = fabric;
+        this.peerNodeId = peerNodeId;
+        this.peerSessionId = peerSessionId;
+        this.decryptKey = decryptKey;
+        this.encryptKey = encryptKey;
+        this.attestationKey = attestationKey;
+        this.closeCallback = closeCallback;
+        this.idleRetransmissionTimeoutMs = idleRetransmissionTimeoutMs;
+        this.activeRetransmissionTimeoutMs = activeRetransmissionTimeoutMs;
+        this.retransmissionRetries = retransmissionRetries;
+        this.subscriptions = new Array();
+        this.timestamp = Time.nowMs();
+        this.activeTimestamp = this.timestamp;
+        fabric === null || fabric === void 0 ? void 0 : fabric.addSession(this);
+    }
+    isSecure() {
+        return true;
+    }
+    notifyActivity(messageReceived) {
+        this.timestamp = Time.nowMs();
+        if (messageReceived) { // only update active timestamp if we received a message
+            this.activeTimestamp = this.timestamp;
+        }
+    }
+    isPeerActive() {
+        return (Time.nowMs() - this.activeTimestamp) < SLEEPY_ACTIVE_THRESHOLD_MS;
+    }
+    decode({ header, bytes }) {
+        const headerBytes = MessageCodec.encodePacketHeader(header);
+        const securityFlags = headerBytes[3];
+        const nonce = this.generateNonce(securityFlags, header.messageId, this.peerNodeId);
+        return MessageCodec.decodePayload({ header, bytes: Crypto.decrypt(this.decryptKey, bytes, nonce, headerBytes) });
+    }
+    encode(message) {
+        var _a, _b;
+        message.packetHeader.sessionId = this.peerSessionId;
+        const { header, bytes } = MessageCodec.encodePayload(message);
+        const headerBytes = MessageCodec.encodePacketHeader(message.packetHeader);
+        const securityFlags = headerBytes[3];
+        const nonce = this.generateNonce(securityFlags, header.messageId, (_b = (_a = this.fabric) === null || _a === void 0 ? void 0 : _a.nodeId) !== null && _b !== void 0 ? _b : UNDEFINED_NODE_ID);
+        return { header, bytes: Crypto.encrypt(this.encryptKey, bytes, nonce, headerBytes) };
+    }
+    getAttestationChallengeKey() {
+        return this.attestationKey;
+    }
+    getFabric() {
+        return this.fabric;
+    }
+    getName() {
+        return `secure/${this.id}`;
+    }
+    getMrpParameters() {
+        const { idleRetransmissionTimeoutMs, activeRetransmissionTimeoutMs, retransmissionRetries } = this;
+        return { idleRetransmissionTimeoutMs, activeRetransmissionTimeoutMs, retransmissionRetries };
+    }
+    getContext() {
+        return this.context;
+    }
+    getId() {
+        return this.id;
+    }
+    getPeerSessionId() {
+        return this.peerSessionId;
+    }
+    getNodeId() {
+        var _a, _b;
+        return (_b = (_a = this.fabric) === null || _a === void 0 ? void 0 : _a.nodeId) !== null && _b !== void 0 ? _b : UNDEFINED_NODE_ID;
+    }
+    getPeerNodeId() {
+        return this.peerNodeId;
+    }
+    addSubscription(subscription) {
+        this.subscriptions.push(subscription);
+        logger.debug(`Added subscription ${subscription.subscriptionId} to ${this.getName()}/${this.id}`);
+    }
+    clearSubscriptions() {
+        this.subscriptions.forEach(subscription => subscription.cancel());
+        this.subscriptions.length = 0;
+    }
+    destroy() {
+        var _a;
+        this.clearSubscriptions();
+        (_a = this.fabric) === null || _a === void 0 ? void 0 : _a.removeSession(this);
+        this.closeCallback();
+    }
+    generateNonce(securityFlags, messageId, nodeId) {
+        const writer = new DataWriter(Endian.Little);
+        writer.writeUInt8(securityFlags);
+        writer.writeUInt32(messageId);
+        writer.writeUInt64(nodeId.id);
+        return writer.toByteArray();
+    }
+}

package/dist/es/session/Session.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Message, Packet } from "../codec/MessageCodec.js";
+import { NodeId } from "../datatype/NodeId.js";
+export declare const DEFAULT_IDLE_RETRANSMISSION_TIMEOUT_MS = 5000;
+export declare const DEFAULT_ACTIVE_RETRANSMISSION_TIMEOUT_MS = 300;
+export declare const DEFAULT_RETRANSMISSION_RETRIES = 5;
+/** Maximum sleep interval of node when in active mode. */
+export declare const SLEEPY_ACTIVE_INTERVAL_MS = 300;
+/** Maximum sleep interval of node when in idle mode. */
+export declare const SLEEPY_IDLE_INTERVAL_MS = 300;
+/** Minimum amount the node SHOULD stay awake after network activity. */
+export declare const SLEEPY_ACTIVE_THRESHOLD_MS = 4000;
+interface MrpParameters {
+    idleRetransmissionTimeoutMs: number;
+    activeRetransmissionTimeoutMs: number;
+    retransmissionRetries: number;
+}
+export interface Session<T> {
+    isSecure(): boolean;
+    getName(): string;
+    decode(packet: Packet): Message;
+    encode(message: Message): Packet;
+    getMrpParameters(): MrpParameters;
+    getContext(): T;
+    getId(): number;
+    getPeerSessionId(): number;
+    getNodeId(): NodeId | undefined;
+    getPeerNodeId(): NodeId | undefined;
+    destroy(): void;
+    notifyActivity(messageReceived: boolean): void;
+    isPeerActive(): boolean;
+}
+export {};
+//# sourceMappingURL=Session.d.ts.map

package/dist/es/session/Session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Session.d.ts","sourceRoot":"","sources":["../../../src/session/Session.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,eAAO,MAAM,sCAAsC,OAAO,CAAC;AAC3D,eAAO,MAAM,wCAAwC,MAAM,CAAC;AAC5D,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAEhD,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,wDAAwD;AACxD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAE/C,UAAU,aAAa;IACnB,2BAA2B,EAAE,MAAM,CAAC;IACpC,6BAA6B,EAAE,MAAM,CAAC;IACtC,qBAAqB,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,OAAO,CAAC,CAAC;IACtB,QAAQ,IAAI,OAAO,CAAC;IACpB,OAAO,IAAI,MAAM,CAAC;IAClB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IACjC,gBAAgB,IAAI,aAAa,CAAC;IAClC,UAAU,IAAI,CAAC,CAAC;IAChB,KAAK,IAAI,MAAM,CAAC;IAChB,gBAAgB,IAAI,MAAM,CAAC;IAC3B,SAAS,IAAI,MAAM,GAAG,SAAS,CAAC;IAChC,aAAa,IAAI,MAAM,GAAG,SAAS,CAAC;IACpC,OAAO,IAAI,IAAI,CAAC;IAChB,cAAc,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/C,YAAY,IAAI,OAAO,CAAC;CAC3B"}

package/dist/es/session/Session.js

@@ -0,0 +1,14 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export const DEFAULT_IDLE_RETRANSMISSION_TIMEOUT_MS = 5000;
+export const DEFAULT_ACTIVE_RETRANSMISSION_TIMEOUT_MS = 300;
+export const DEFAULT_RETRANSMISSION_RETRIES = 5;
+/** Maximum sleep interval of node when in active mode. */
+export const SLEEPY_ACTIVE_INTERVAL_MS = 300;
+/** Maximum sleep interval of node when in idle mode. */
+export const SLEEPY_IDLE_INTERVAL_MS = 300;
+/** Minimum amount the node SHOULD stay awake after network activity. */
+export const SLEEPY_ACTIVE_THRESHOLD_MS = 4000;

package/dist/es/session/SessionManager.d.ts

@@ -0,0 +1,41 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { NodeId } from "../datatype/NodeId.js";
+import { Fabric } from "../fabric/Fabric.js";
+import { ByteArray } from "../util/ByteArray.js";
+import { StorageManager } from "../storage/StorageManager.js";
+import { SecureSession } from "./SecureSession.js";
+import { Session } from "./Session.js";
+import { UnsecureSession } from "./UnsecureSession.js";
+export declare const UNDEFINED_NODE_ID: NodeId;
+export declare const UNICAST_UNSECURE_SESSION_ID = 0;
+export interface ResumptionRecord {
+    sharedSecret: ByteArray;
+    resumptionId: ByteArray;
+    fabric: Fabric;
+    peerNodeId: NodeId;
+}
+export declare class SessionManager<ContextT> {
+    private readonly context;
+    private readonly unsecureSession;
+    private readonly sessions;
+    private nextSessionId;
+    private resumptionRecords;
+    private readonly sessionStorage;
+    constructor(context: ContextT, storageManager: StorageManager);
+    createSecureSession(sessionId: number, fabric: Fabric | undefined, peerNodeId: NodeId, peerSessionId: number, sharedSecret: ByteArray, salt: ByteArray, isInitiator: boolean, isResumption: boolean, idleRetransTimeoutMs?: number, activeRetransTimeoutMs?: number): Promise<SecureSession<ContextT>>;
+    removeSession(sessionId: number, peerNodeId: NodeId): void;
+    getNextAvailableSessionId(): number;
+    getSession(sessionId: number): Session<ContextT> | undefined;
+    getSessionForNode(fabric: Fabric, nodeId: NodeId): Session<ContextT> | undefined;
+    getUnsecureSession(): UnsecureSession<ContextT>;
+    findResumptionRecordById(resumptionId: ByteArray): ResumptionRecord | undefined;
+    findResumptionRecordByNodeId(nodeId: NodeId): ResumptionRecord | undefined;
+    saveResumptionRecord(resumptionRecord: ResumptionRecord): void;
+    storeResumptionRecords(): void;
+    initFromStorage(fabrics: Fabric[]): void;
+}
+//# sourceMappingURL=SessionManager.d.ts.map

package/dist/es/session/SessionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../../src/session/SessionManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,eAAO,MAAM,iBAAiB,QAAwB,CAAC;AAEvD,eAAO,MAAM,2BAA2B,IAAS,CAAC;AAElD,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,SAAS,CAAC;IACxB,YAAY,EAAE,SAAS,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB;AAUD,qBAAa,cAAc,CAAC,QAAQ;IAQ5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP5B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,iBAAiB,CAAuC;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;gBAG3B,OAAO,EAAE,QAAQ,EAClC,cAAc,EAAE,cAAc;IAO5B,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC,EAAE,MAAM;IAQzQ,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAMnD,yBAAyB;IAWzB,UAAU,CAAC,SAAS,EAAE,MAAM;IAI5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAShD,kBAAkB;IAIlB,wBAAwB,CAAC,YAAY,EAAE,SAAS;IAIhD,4BAA4B,CAAC,MAAM,EAAE,MAAM;IAI3C,oBAAoB,CAAC,gBAAgB,EAAE,gBAAgB;IAKvD,sBAAsB;IAUtB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE;CAkBpC"}

package/dist/es/session/SessionManager.js

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Crypto } from "../crypto/Crypto.js";
+import { NodeId } from "../datatype/NodeId.js";
+import { SecureSession } from "./SecureSession.js";
+import { UnsecureSession } from "./UnsecureSession.js";
+export const UNDEFINED_NODE_ID = new NodeId(BigInt(0));
+export const UNICAST_UNSECURE_SESSION_ID = 0x0000;
+export class SessionManager {
+    constructor(context, storageManager) {
+        this.context = context;
+        this.sessions = new Map();
+        this.nextSessionId = Crypto.getRandomUInt16();
+        this.resumptionRecords = new Map();
+        this.sessionStorage = storageManager.createContext("SessionManager");
+        this.unsecureSession = new UnsecureSession(context);
+        this.sessions.set(UNICAST_UNSECURE_SESSION_ID, this.unsecureSession);
+    }
+    createSecureSession(sessionId, fabric, peerNodeId, peerSessionId, sharedSecret, salt, isInitiator, isResumption, idleRetransTimeoutMs, activeRetransTimeoutMs) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const session = yield SecureSession.create(this.context, sessionId, fabric, peerNodeId, peerSessionId, sharedSecret, salt, isInitiator, isResumption, () => this.removeSession(sessionId, peerNodeId), idleRetransTimeoutMs, activeRetransTimeoutMs);
+            this.sessions.set(sessionId, session);
+            // TODO: close previous secure channel for
+            return session;
+        });
+    }
+    removeSession(sessionId, peerNodeId) {
+        this.sessions.delete(sessionId);
+        this.resumptionRecords.delete(peerNodeId.id);
+        this.storeResumptionRecords();
+    }
+    getNextAvailableSessionId() {
+        while (true) {
+            if (this.sessions.has(this.nextSessionId)) {
+                this.nextSessionId = (this.nextSessionId + 1) & 0xFFFF;
+                if (this.nextSessionId === 0)
+                    this.nextSessionId++;
+                continue;
+            }
+            return this.nextSessionId++;
+        }
+    }
+    getSession(sessionId) {
+        return this.sessions.get(sessionId);
+    }
+    getSessionForNode(fabric, nodeId) {
+        //TODO: It can have multiple sessions for one node ...
+        return [...this.sessions.values()].find(session => {
+            var _a;
+            if (!session.isSecure())
+                return false;
+            const secureSession = session;
+            return ((_a = secureSession.getFabric()) === null || _a === void 0 ? void 0 : _a.fabricId.id) === fabric.fabricId.id && secureSession.getPeerNodeId().id === nodeId.id;
+        });
+    }
+    getUnsecureSession() {
+        return this.unsecureSession;
+    }
+    findResumptionRecordById(resumptionId) {
+        return [...this.resumptionRecords.values()].find(record => record.resumptionId.equals(resumptionId));
+    }
+    findResumptionRecordByNodeId(nodeId) {
+        return this.resumptionRecords.get(nodeId.id);
+    }
+    saveResumptionRecord(resumptionRecord) {
+        this.resumptionRecords.set(resumptionRecord.peerNodeId.id, resumptionRecord);
+        this.storeResumptionRecords();
+    }
+    storeResumptionRecords() {
+        this.sessionStorage.set("resumptionRecords", [...this.resumptionRecords].map(([nodeId, { sharedSecret, resumptionId, peerNodeId, fabric }]) => ({
+            nodeId,
+            sharedSecret,
+            resumptionId,
+            fabricId: fabric.fabricId.id,
+            peerNodeId: peerNodeId.id,
+        })));
+    }
+    initFromStorage(fabrics) {
+        const storedResumptionRecords = this.sessionStorage.get("resumptionRecords", []);
+        storedResumptionRecords.forEach(({ nodeId, sharedSecret, resumptionId, fabricId, peerNodeId }) => {
+            console.log("restoring resumption record for node", nodeId);
+            const fabric = fabrics.find(fabric => fabric.fabricId.id === fabricId);
+            if (!fabric) {
+                console.log("fabric not found for resumption record", fabricId);
+                return;
+            }
+            this.resumptionRecords.set(nodeId, {
+                sharedSecret,
+                resumptionId,
+                fabric,
+                peerNodeId: new NodeId(peerNodeId),
+            });
+        });
+    }
+}

package/dist/es/session/UnsecureSession.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Packet, Message } from "../codec/MessageCodec.js";
+import { Fabric } from "../fabric/Fabric.js";
+import { Session } from "./Session.js";
+import { ByteArray } from "../util/ByteArray.js";
+import { NodeId } from "../datatype/NodeId.js";
+export declare class UnsecureSession<T> implements Session<T> {
+    private readonly context;
+    private readonly initiatorNodeId;
+    constructor(context: T);
+    isSecure(): boolean;
+    notifyActivity(_messageReceived: boolean): void;
+    isPeerActive(): boolean;
+    decode(packet: Packet): Message;
+    encode(message: Message): Packet;
+    getAttestationChallengeKey(): ByteArray;
+    setFabric(_fabric: Fabric): void;
+    getName(): string;
+    getMrpParameters(): {
+        idleRetransmissionTimeoutMs: number;
+        activeRetransmissionTimeoutMs: number;
+        retransmissionRetries: number;
+    };
+    getContext(): T;
+    getId(): number;
+    getPeerSessionId(): number;
+    getNodeId(): NodeId;
+    getPeerNodeId(): undefined;
+    destroy(): void;
+}
+//# sourceMappingURL=UnsecureSession.d.ts.map

package/dist/es/session/UnsecureSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnsecureSession.d.ts","sourceRoot":"","sources":["../../../src/session/UnsecureSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAgB,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAoH,OAAO,EAAE,MAAM,cAAc,CAAC;AAEzJ,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,qBAAa,eAAe,CAAC,CAAC,CAAE,YAAW,OAAO,CAAC,CAAC,CAAC;IAI7C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH5B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAuC;gBAGlD,OAAO,EAAE,CAAC;IAG/B,QAAQ,IAAI,OAAO;IAInB,cAAc,CAAC,gBAAgB,EAAE,OAAO;IAIxC,YAAY,IAAI,OAAO;IAIvB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI/B,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM;IAIhC,0BAA0B,IAAI,SAAS;IAIvC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIhC,OAAO;IAIP,gBAAgB;;;;;IAQhB,UAAU;IAIV,KAAK,IAAI,MAAM;IAIf,gBAAgB,IAAI,MAAM;IAI1B,SAAS;IAIT,aAAa;IAIb,OAAO;CAGV"}

package/dist/es/session/UnsecureSession.js

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { MessageCodec } from "../codec/MessageCodec.js";
+import { DEFAULT_ACTIVE_RETRANSMISSION_TIMEOUT_MS, DEFAULT_IDLE_RETRANSMISSION_TIMEOUT_MS, DEFAULT_RETRANSMISSION_RETRIES } from "./Session.js";
+import { UNICAST_UNSECURE_SESSION_ID } from "./SessionManager.js";
+import { NodeId } from "../datatype/NodeId.js";
+export class UnsecureSession {
+    constructor(context) {
+        this.context = context;
+        this.initiatorNodeId = NodeId.getRandomOperationalNodeId();
+    }
+    isSecure() {
+        return false;
+    }
+    notifyActivity(_messageReceived) {
+        // Do nothing
+    }
+    isPeerActive() {
+        return true;
+    }
+    decode(packet) {
+        return MessageCodec.decodePayload(packet);
+    }
+    encode(message) {
+        return MessageCodec.encodePayload(message);
+    }
+    getAttestationChallengeKey() {
+        throw new Error("Not supported on an unsecure session");
+    }
+    setFabric(_fabric) {
+        throw new Error("Not supported on an unsecure session");
+    }
+    getName() {
+        return "unsecure";
+    }
+    getMrpParameters() {
+        return {
+            idleRetransmissionTimeoutMs: DEFAULT_IDLE_RETRANSMISSION_TIMEOUT_MS,
+            activeRetransmissionTimeoutMs: DEFAULT_ACTIVE_RETRANSMISSION_TIMEOUT_MS,
+            retransmissionRetries: DEFAULT_RETRANSMISSION_RETRIES,
+        };
+    }
+    getContext() {
+        return this.context;
+    }
+    getId() {
+        return UNICAST_UNSECURE_SESSION_ID;
+    }
+    getPeerSessionId() {
+        return UNICAST_UNSECURE_SESSION_ID;
+    }
+    getNodeId() {
+        return this.initiatorNodeId;
+    }
+    getPeerNodeId() {
+        return undefined;
+    }
+    destroy() {
+        throw new Error("The unsecure session should never be destroyed.");
+    }
+}

package/dist/es/session/case/CaseClient.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Fabric } from "../../fabric/Fabric.js";
+import { MessageExchange } from "../../protocol/MessageExchange.js";
+import { MatterController } from "../../MatterController.js";
+import { NodeId } from "../../datatype/NodeId.js";
+export declare class CaseClient {
+    pair(client: MatterController, exchange: MessageExchange<MatterController>, fabric: Fabric, peerNodeId: NodeId): Promise<any>;
+}
+//# sourceMappingURL=CaseClient.d.ts.map

package/dist/es/session/case/CaseClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaseClient.d.ts","sourceRoot":"","sources":["../../../../src/session/case/CaseClient.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAQ7D,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAIlD,qBAAa,UAAU;IACb,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CA0EvH"}

package/dist/es/session/case/CaseClient.js

@@ -0,0 +1,93 @@
+/**
+ * @license
+ * Copyright 2022-2023 Project CHIP Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { TlvOperationalCertificate } from "../../certificate/CertificateManager.js";
+import { Crypto } from "../../crypto/Crypto.js";
+import { KDFSR1_KEY_INFO, KDFSR2_INFO, KDFSR2_KEY_INFO, KDFSR3_INFO, RESUME1_MIC_NONCE, RESUME2_MIC_NONCE, TlvEncryptedDataSigma2, TlvSignedData, TBE_DATA2_NONCE, TBE_DATA3_NONCE, TlvEncryptedDataSigma3 } from "./CaseMessages.js";
+import { CaseClientMessenger } from "./CaseMessenger.js";
+import { ByteArray } from "../../util/ByteArray.js";
+import { Logger } from "../../log/Logger.js";
+const logger = Logger.get("CaseClient");
+export class CaseClient {
+    pair(client, exchange, fabric, peerNodeId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const messenger = new CaseClientMessenger(exchange);
+            // Generate pairing info
+            const random = Crypto.getRandom();
+            const sessionId = client.getNextAvailableSessionId();
+            const { operationalIdentityProtectionKey, operationalCert: nodeOpCert, intermediateCACert } = fabric;
+            const { publicKey: ecdhPublicKey, ecdh } = Crypto.ecdhGeneratePublicKey();
+            // Send sigma1
+            let sigma1Bytes;
+            let resumptionRecord = client.findResumptionRecordByNodeId(peerNodeId);
+            if (resumptionRecord !== undefined) {
+                const { sharedSecret, resumptionId } = resumptionRecord;
+                const resumeKey = yield Crypto.hkdf(sharedSecret, ByteArray.concat(random, resumptionId), KDFSR1_KEY_INFO);
+                const resumeMic = Crypto.encrypt(resumeKey, new ByteArray(0), RESUME1_MIC_NONCE);
+                sigma1Bytes = yield messenger.sendSigma1({ sessionId, destinationId: fabric.getDestinationId(peerNodeId, random), ecdhPublicKey, random, resumptionId, resumeMic });
+            }
+            else {
+                sigma1Bytes = yield messenger.sendSigma1({ sessionId, destinationId: fabric.getDestinationId(peerNodeId, random), ecdhPublicKey, random });
+            }
+            let secureSession;
+            const { sigma2Bytes, sigma2, sigma2Resume } = yield messenger.readSigma2();
+            if (sigma2Resume !== undefined) {
+                // Process sigma2 resume
+                if (resumptionRecord === undefined)
+                    throw new Error("Received an unexpected sigma2Resume");
+                const { sharedSecret, fabric } = resumptionRecord;
+                const { sessionId: peerSessionId, resumptionId, resumeMic } = sigma2Resume;
+                const resumeSalt = ByteArray.concat(random, resumptionId);
+                const resumeKey = yield Crypto.hkdf(sharedSecret, resumeSalt, KDFSR2_KEY_INFO);
+                Crypto.decrypt(resumeKey, resumeMic, RESUME2_MIC_NONCE);
+                const secureSessionSalt = ByteArray.concat(random, resumptionRecord.resumptionId);
+                secureSession = yield client.createSecureSession(sessionId, fabric, peerNodeId, peerSessionId, sharedSecret, secureSessionSalt, true, true);
+                yield messenger.sendSuccess();
+                logger.info(`Case client: session resumed with ${messenger.getChannelName()}`);
+                resumptionRecord.resumptionId = resumptionId; /* update resumptionId */
+            }
+            else {
+                // Process sigma2
+                const { ecdhPublicKey: peerEcdhPublicKey, encrypted: peerEncrypted, random: peerRandom, sessionId: peerSessionId } = sigma2;
+                const sharedSecret = Crypto.ecdhGenerateSecret(peerEcdhPublicKey, ecdh);
+                const sigma2Salt = ByteArray.concat(operationalIdentityProtectionKey, peerRandom, peerEcdhPublicKey, Crypto.hash(sigma1Bytes));
+                const sigma2Key = yield Crypto.hkdf(sharedSecret, sigma2Salt, KDFSR2_INFO);
+                const peerEncryptedData = Crypto.decrypt(sigma2Key, peerEncrypted, TBE_DATA2_NONCE);
+                const { nodeOpCert: peerNewOpCert, intermediateCACert: peerIntermediateCACert, signature: peerSignature, resumptionId: peerResumptionId } = TlvEncryptedDataSigma2.decode(peerEncryptedData);
+                const peerSignatureData = TlvSignedData.encode({ nodeOpCert: peerNewOpCert, intermediateCACert: peerIntermediateCACert, ecdhPublicKey: peerEcdhPublicKey, peerEcdhPublicKey: ecdhPublicKey });
+                const { ellipticCurvePublicKey: peerPublicKey, subject: { nodeId: peerNodeIdCert } } = TlvOperationalCertificate.decode(peerNewOpCert);
+                if (peerNodeIdCert.id !== peerNodeId.id)
+                    throw new Error("The node ID in the peer certificate doesn't match the expected peer node ID");
+                Crypto.verifySpki(peerPublicKey, peerSignatureData, peerSignature);
+                // Generate and send sigma3
+                const sigma3Salt = ByteArray.concat(operationalIdentityProtectionKey, Crypto.hash([sigma1Bytes, sigma2Bytes]));
+                const sigma3Key = yield Crypto.hkdf(sharedSecret, sigma3Salt, KDFSR3_INFO);
+                const signatureData = TlvSignedData.encode({ nodeOpCert, intermediateCACert, ecdhPublicKey, peerEcdhPublicKey });
+                const signature = fabric.sign(signatureData);
+                const encryptedData = TlvEncryptedDataSigma3.encode({ nodeOpCert, intermediateCACert, signature });
+                const encrypted = Crypto.encrypt(sigma3Key, encryptedData, TBE_DATA3_NONCE);
+                const sigma3Bytes = yield messenger.sendSigma3({ encrypted });
+                yield messenger.waitForSuccess();
+                // All good! Create secure session
+                const secureSessionSalt = ByteArray.concat(operationalIdentityProtectionKey, Crypto.hash([sigma1Bytes, sigma2Bytes, sigma3Bytes]));
+                secureSession = yield client.createSecureSession(sessionId, fabric, peerNodeId, peerSessionId, sharedSecret, secureSessionSalt, true, false);
+                logger.info(`Case client: Paired succesfully with ${messenger.getChannelName()}`);
+                resumptionRecord = { fabric, peerNodeId, sharedSecret, resumptionId: peerResumptionId };
+            }
+            messenger.close();
+            client.saveResumptionRecord(resumptionRecord);
+            return secureSession;
+        });
+    }
+}

package/dist/es/session/case/CaseMessages.d.ts

@@ -0,0 +1,63 @@
+export declare const KDFSR1_KEY_INFO: Uint8Array;
+export declare const KDFSR2_KEY_INFO: Uint8Array;
+export declare const RESUME1_MIC_NONCE: Uint8Array;
+export declare const RESUME2_MIC_NONCE: Uint8Array;
+export declare const KDFSR2_INFO: Uint8Array;
+export declare const KDFSR3_INFO: Uint8Array;
+export declare const TBE_DATA2_NONCE: Uint8Array;
+export declare const TBE_DATA3_NONCE: Uint8Array;
+/** @see {@link MatterCoreSpecificationV1_0} § 4.13.2.3 */
+export declare const TlvCaseSigma1: import("../../tlv/TlvObject.js").ObjectSchema<{
+    random: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    sessionId: import("../../tlv/TlvObject.js").FieldType<number>;
+    destinationId: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    ecdhPublicKey: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    mrpParams: import("../../tlv/TlvObject.js").OptionalFieldType<{
+        idleRetransTimeoutMs?: number | undefined;
+        activeRetransTimeoutMs?: number | undefined;
+    }>;
+    resumptionId: import("../../tlv/TlvObject.js").OptionalFieldType<Uint8Array>;
+    resumeMic: import("../../tlv/TlvObject.js").OptionalFieldType<Uint8Array>;
+}>;
+/** @see {@link MatterCoreSpecificationV1_0} § 4.13.2.3 */
+export declare const TlvCaseSigma2: import("../../tlv/TlvObject.js").ObjectSchema<{
+    random: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    sessionId: import("../../tlv/TlvObject.js").FieldType<number>;
+    ecdhPublicKey: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    encrypted: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    mrpParams: import("../../tlv/TlvObject.js").OptionalFieldType<{
+        idleRetransTimeoutMs?: number | undefined;
+        activeRetransTimeoutMs?: number | undefined;
+    }>;
+}>;
+/** @see {@link MatterCoreSpecificationV1_0} § 4.13.2.3 */
+export declare const TlvCaseSigma2Resume: import("../../tlv/TlvObject.js").ObjectSchema<{
+    resumptionId: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    resumeMic: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    sessionId: import("../../tlv/TlvObject.js").FieldType<number>;
+}>;
+/** @see {@link MatterCoreSpecificationV1_0} § 4.13.2.3 */
+export declare const TlvCaseSigma3: import("../../tlv/TlvObject.js").ObjectSchema<{
+    encrypted: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+}>;
+/** @see {@link MatterCoreSpecificationV1_0} § 4.13.2.3 */
+export declare const TlvSignedData: import("../../tlv/TlvObject.js").ObjectSchema<{
+    nodeOpCert: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    intermediateCACert: import("../../tlv/TlvObject.js").OptionalFieldType<Uint8Array>;
+    ecdhPublicKey: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    peerEcdhPublicKey: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+}>;
+/** @see {@link MatterCoreSpecificationV1_0} § 4.13.2.3 */
+export declare const TlvEncryptedDataSigma2: import("../../tlv/TlvObject.js").ObjectSchema<{
+    nodeOpCert: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    intermediateCACert: import("../../tlv/TlvObject.js").OptionalFieldType<Uint8Array>;
+    signature: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    resumptionId: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+}>;
+/** @see {@link MatterCoreSpecificationV1_0} § 4.13.2.3 */
+export declare const TlvEncryptedDataSigma3: import("../../tlv/TlvObject.js").ObjectSchema<{
+    nodeOpCert: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+    intermediateCACert: import("../../tlv/TlvObject.js").OptionalFieldType<Uint8Array>;
+    signature: import("../../tlv/TlvObject.js").FieldType<Uint8Array>;
+}>;
+//# sourceMappingURL=CaseMessages.d.ts.map

package/dist/es/session/case/CaseMessages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaseMessages.d.ts","sourceRoot":"","sources":["../../../../src/session/case/CaseMessages.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,eAAe,YAAwC,CAAC;AACrE,eAAO,MAAM,eAAe,YAAwC,CAAC;AACrE,eAAO,MAAM,iBAAiB,YAAwC,CAAC;AACvE,eAAO,MAAM,iBAAiB,YAAwC,CAAC;AACvE,eAAO,MAAM,WAAW,YAAiC,CAAC;AAC1D,eAAO,MAAM,WAAW,YAAiC,CAAC;AAC1D,eAAO,MAAM,eAAe,YAAwC,CAAC;AACrE,eAAO,MAAM,eAAe,YAAwC,CAAC;AAWrE,0DAA0D;AAC1D,eAAO,MAAM,aAAa;;;;;;;;;;;EAQxB,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,aAAa;;;;;;;;;EAMxB,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB;;;;EAI9B,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,aAAa;;EAExB,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,aAAa;;;;;EAKxB,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,sBAAsB;;;;;EAKjC,CAAC;AAEH,0DAA0D;AAC1D,eAAO,MAAM,sBAAsB;;;;EAIjC,CAAC"}