feat: Enable APS layer encryption for Zigbee Direct cluster operations

[burmistrzak]

As discussed in #1760, we need to enable APS layer encryption to read/write the Zigbee Direct Configuration cluster.

This can be done by checking the destination cluster ID and setting the respective APS frame options.

• Proof-of-Concept (ember)
• Adapter: ember
• Tests

[burmistrzak]

@Nerivec How should we go about this? Especially writing a somewhat useful test...

I'm also only familiar with ember and z-stack adapters. 😬

[Nerivec]

I'm not sure this stuff is available in all adapters. Determining that would be the first order of business I guess. Need to dig into the types for all adapters, see if there are APS options somewhere, and if so, if one is about encryption/security 😅

[burmistrzak]

I'm not sure this stuff is available in all adapters.

True, Silabs is quite ahead.

Determining that would be the first order of business I guess. Need to dig into the types for all adapters, see if there are APS options somewhere, and if so, if one is about encryption/security 😅

I looked through the z-stack code and found

zigbee-herdsman/src/adapter/z-stack/adapter/zStackAdapter.ts

Lines 1149 to 1164 in a62a4d5

	await this.znp.request(
	Subsystem.AF,
	"dataRequest",
	{
	dstaddr: destinationAddress,
	destendpoint: destinationEndpoint,
	srcendpoint: sourceEndpoint,
	clusterid: clusterID,
	transid: transactionID,
	options: 0,
	radius: radius,
	len: data.length,
	data: data,
	},
	response.ID,
	);

According to TI docs, security can be enabled:

Transmit options bit mask according to the following defines
from AF.h: bit 1: sets ‘Wildcard Profile ID’; bit 4: turns on/off
‘APS ACK’; bit 5 sets ‘discover route’; bit 6 sets ‘APS
security’; bit 7 sets ‘skip routing’.

Question is, why is this attribute hardcoded to 0?

Edit: Looks like @Koenkk had a similar question back then 😄

zigbee-herdsman/src/adapter/z-stack/adapter/zStackAdapter.ts

Line 1206 in a62a4d5

options: 0, // TODO: why was this here? Constants.AF.options.DISCV_ROUTE,

Edit 2: Bitmask values defined here:

zigbee-herdsman/src/adapter/z-stack/constants/af.ts

Lines 16 to 23 in a62a4d5

	options: {
	PREPROCESS: 4,
	LIMIT_CONCENTRATOR: 8,
	ACK_REQUEST: 16,
	DISCV_ROUTE: 32,
	EN_SECURITY: 64,
	SKIP_ROUTING: 128,
	},

These transmit options are all disabled and also a bit different from what's available on ember.
So setting options: Constants.AF.options.EN_SECURITY should do the trick.

[Nerivec]

zigbee-herdsman/src/adapter/deconz/adapter/deconzAdapter.ts

Line 379 in fb2b2fe

txOptions,

https://github.com/dresden-elektronik/deconz-lib/blob/3b058797089bddeaac020c038a5cea6fc9862701/deconz/aps.h#L92-L98

cc: @manup

---

zigbee-herdsman/src/adapter/zboss/driver.ts

Line 320 in fb2b2fe

txOptions: 2, // ROUTE DISCOVERY

Based on NCP serial protocol v1.5

TX options bitmap
0x01 = Security enabled transmission
0x02 = Obsolete
0x04 = Acknowledged transmission
0x08 = Fragmentation permitted
0x10 = Include extended nonce in APS security frame.
0x20 = Force mesh route discovery for this request.
0x40 = Send route record for this request.

cc: @kirovilya

---

As long as it's always scoped to the ZD cluster, we should be fine merging this after all these + zstack are handled. Since ZD cluster support is new anyway, and the potential breakage surface is minimal.

[Nerivec]

Need to implement for all four before ready. We have the data, so, should mostly be replicating.

[burmistrzak]

Need to implement for all four before ready. We have the data, so, should mostly be replicating.

Do you want me to implement them as well?
Z-Stack should be fine, but I have zero experience with the other two. 😬

[Nerivec]

Should just be adding the same logic as ember in the two places I linked above (and where you linked for zstack), with the values described (can just hardcode the number for now, if you don't find the appropriate const/enum).
ZD is unicast only, so, that should be all.
zstack will need a test for coverage, the others don't have any.

[burmistrzak]

@Nerivec Would you mind taking a look? 🤞

[Nerivec]

Looks good.
I say we merge after next release.

[burmistrzak]

@Nerivec Thx! But what about ZoH? 👀

[Nerivec]

It's not exposed in ZoH for now. Would need to refactor that side. Haven't had time to finish the big Z4 refactor though, need that one first. Very edge-case feature, it can wait a bit. We'll probably do the support for this on ZoH side, since this is spec.

[burmistrzak]

Looks good. I say we merge after next release.

Good thing that I've already disabled ZD with my locally patched ZH. 😜

[Koenkk]

Thanks!