[tcat] implementation of TCAT general class commands (openthread#10700)

Commit introduces implementation of missing general class commands:
- PresentPskdHash
- PresentPskcHash
- PresentInstallCodeHash
- RequestRandomNumChallenge
- RequestPskdHash

Also include minor fixes in Tcat python client and refactoring of expect
tests for tcat.

.github/workflows/posix.yml

@@ -60,7 +60,7 @@ jobs:
     - name: Bootstrap
       run: |
         sudo apt-get --no-install-recommends install -y expect ninja-build lcov socat
-        pip install bleak
+        pip install bleak 'cryptography==43.0.0'
     - name: Run RCP Mode
       run: |
         ulimit -c unlimited

.github/workflows/simulation-1.1.yml

@@ -247,7 +247,7 @@ jobs:
     - name: Bootstrap
       run: |
         sudo apt-get --no-install-recommends install -y expect ninja-build lcov socat
-        pip install bleak
+        pip install bleak 'cryptography==43.0.0'
     - name: Run
       run: |
         ulimit -c unlimited

.github/workflows/simulation-1.4.yml

@@ -298,7 +298,7 @@ jobs:
     - name: Bootstrap
       run: |
         sudo apt-get --no-install-recommends install -y expect ninja-build lcov socat
-        pip install bleak
+        pip install bleak 'cryptography==43.0.0'
     - name: Run RCP Mode
       run: |
         ulimit -c unlimited

include/openthread/ble_secure.h

@@ -407,6 +407,16 @@ otError otBleSecureSendApplicationTlv(otInstance *aInstance, uint8_t *aBuf, uint
  */
 otError otBleSecureFlush(otInstance *aInstance);
 
+/**
+ * Gets the Install Code Verify Status during the current session.
+ *
+ * @param[in]  aInstance     A pointer to an OpenThread instance.
+ *
+ * @retval TRUE  The install code was correctly verified.
+ * @retval FALSE The install code was not verified.
+ */
+bool otBleSecureGetInstallCodeVerifyStatus(otInstance *aInstance);
+
 /**
  * @}
  */

include/openthread/instance.h

@@ -52,7 +52,7 @@ extern "C" {
  *
  * @note This number versions both OpenThread platform and user APIs.
  */
-#define OPENTHREAD_API_VERSION (451)
+#define OPENTHREAD_API_VERSION (452)
 
 /**
  * @addtogroup api-instance

src/cli/cli_tcat.cpp

@@ -92,8 +92,9 @@ namespace Cli {
 otTcatAdvertisedDeviceId sAdvertisedDeviceIds[OT_TCAT_DEVICE_ID_MAX];
 otTcatGeneralDeviceId    sGeneralDeviceId;
 
-const char kPskdVendor[] = "JJJJJJ";
-const char kUrl[]        = "dummy_url";
+const char kPskdVendor[]    = "JJJJJJ";
+const char kInstallVendor[] = "InstallCode";
+const char kUrl[]           = "dummy_url";
 
 static bool IsDeviceIdSet(void)
 {
@@ -293,6 +294,7 @@ template <> otError Tcat::Process<Cmd("start")>(Arg aArgs[])
     ClearAllBytes(mVendorInfo);
     mVendorInfo.mPskdString      = kPskdVendor;
     mVendorInfo.mProvisioningUrl = kUrl;
+    mVendorInfo.mInstallCode     = kInstallVendor;
 
     if (IsDeviceIdSet())
     {

src/core/api/ble_secure_api.cpp

@@ -186,4 +186,9 @@ otError otBleSecureSendApplicationTlv(otInstance *aInstance, uint8_t *aBuf, uint
 
 otError otBleSecureFlush(otInstance *aInstance) { return AsCoreType(aInstance).Get<Ble::BleSecure>().Flush(); }
 
+bool otBleSecureGetInstallCodeVerifyStatus(otInstance *aInstance)
+{
+    return AsCoreType(aInstance).Get<Ble::BleSecure>().GetInstallCodeVerifyStatus();
+}
+
 #endif // OPENTHREAD_CONFIG_BLE_TCAT_ENABLE

src/core/meshcop/secure_transport.hpp

@@ -301,6 +301,14 @@ class SecureTransport : public InstanceLocator
      * @param[in]  aX509CaCertChainLength   The length of chain.
      */
     void SetCaCertificateChain(const uint8_t *aX509CaCertificateChain, uint32_t aX509CaCertChainLength);
+
+    /**
+     * Extracts public key from it's own certificate.
+     *
+     * @returns Public key from own certificate in form of entire ASN.1 field.
+     */
+    const mbedtls_asn1_buf &GetOwnPublicKey(void) const { return mOwnCert.pk_raw; }
+
 #endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
 
 #if defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)