From be74a3c035247f55b8542b00af3a0026abbb14ab Mon Sep 17 00:00:00 2001
From: Yang Sun <sunytt@google.com>
Date: Wed, 9 Oct 2024 00:18:05 +0800
Subject: [PATCH] [border-agent] add api to disconnect from secure sessions
 (#10754)

---
 include/openthread/border_agent.h | 13 +++++++++++++
 include/openthread/instance.h     |  2 +-
 src/cli/README.md                 |  9 +++++++++
 src/cli/cli.cpp                   | 14 ++++++++++++++
 src/core/api/border_agent_api.cpp |  2 ++
 src/core/meshcop/border_agent.cpp | 10 ++++++++++
 src/core/meshcop/border_agent.hpp | 11 +++++++++++
 tests/scripts/expect/cli-misc.exp |  3 +++
 8 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/include/openthread/border_agent.h b/include/openthread/border_agent.h
index 9e6e717a4..39fdfdc94 100644
--- a/include/openthread/border_agent.h
+++ b/include/openthread/border_agent.h
@@ -282,6 +282,19 @@ void otBorderAgentSetEphemeralKeyCallback(otInstance                       *aIns
                                           otBorderAgentEphemeralKeyCallback aCallback,
                                           void                             *aContext);
 
+/**
+ * Disconnects the Border Agent from any active secure sessions.
+ *
+ * If Border Agent is connected to a commissioner candidate with ephemeral key, calling this API
+ * will cause the ephemeral key to be cleared after the session is disconnected.
+ *
+ * The Border Agent state may not change immediately upon calling this method. The state will be
+ * updated when the connection update is notified with a delay.
+ *
+ * @param[in] aInstance    The OpenThread instance.
+ */
+void otBorderAgentDisconnect(otInstance *aInstance);
+
 /**
  * @}
  */
diff --git a/include/openthread/instance.h b/include/openthread/instance.h
index 56d63bb35..70629db17 100644
--- a/include/openthread/instance.h
+++ b/include/openthread/instance.h
@@ -52,7 +52,7 @@ extern "C" {
  *
  * @note This number versions both OpenThread platform and user APIs.
  */
-#define OPENTHREAD_API_VERSION (452)
+#define OPENTHREAD_API_VERSION (453)
 
 /**
  * @addtogroup api-instance
diff --git a/src/cli/README.md b/src/cli/README.md
index fbf037d96..8853e3839 100644
--- a/src/cli/README.md
+++ b/src/cli/README.md
@@ -373,6 +373,15 @@ Started
 Done
 ```
 
+### ba disconnect
+
+Disconnects border agent from any active secure sessions.
+
+```bash
+> ba disconnect
+Done
+```
+
 ### ba ephemeralkey
 
 Indicates if an ephemeral key is active.
diff --git a/src/cli/cli.cpp b/src/cli/cli.cpp
index 9f1710b0e..b9f27535c 100644
--- a/src/cli/cli.cpp
+++ b/src/cli/cli.cpp
@@ -411,6 +411,20 @@ template <> otError Interpreter::Process<Cmd("ba")>(Arg aArgs[])
 
         OutputLine("%s", Stringify(otBorderAgentGetState(GetInstancePtr()), kStateStrings));
     }
+    /**
+     * @cli ba disconnect
+     * @code
+     * ba disconnect
+     * Done
+     * @endcode
+     * @par
+     * Disconnects the Border Agent from any active secure sessions
+     * @sa otBorderAgentDisconnect
+     */
+    else if (aArgs[0] == "disconnect")
+    {
+        otBorderAgentDisconnect(GetInstancePtr());
+    }
 #if OPENTHREAD_CONFIG_BORDER_AGENT_ID_ENABLE
     /**
      * @cli ba id (get,set)
diff --git a/src/core/api/border_agent_api.cpp b/src/core/api/border_agent_api.cpp
index 117ac6e9e..d517ac4ec 100644
--- a/src/core/api/border_agent_api.cpp
+++ b/src/core/api/border_agent_api.cpp
@@ -115,4 +115,6 @@ const otBorderAgentCounters *otBorderAgentGetCounters(otInstance *aInstance)
     return AsCoreType(aInstance).Get<MeshCoP::BorderAgent>().GetCounters();
 }
 
+void otBorderAgentDisconnect(otInstance *aInstance) { AsCoreType(aInstance).Get<MeshCoP::BorderAgent>().Disconnect(); }
+
 #endif // OPENTHREAD_CONFIG_BORDER_AGENT_ENABLE
diff --git a/src/core/meshcop/border_agent.cpp b/src/core/meshcop/border_agent.cpp
index 7e751c5c2..f98746244 100644
--- a/src/core/meshcop/border_agent.cpp
+++ b/src/core/meshcop/border_agent.cpp
@@ -775,6 +775,16 @@ exit:
     return;
 }
 
+void BorderAgent::Disconnect(void)
+{
+    VerifyOrExit(mState == kStateConnected || mState == kStateAccepted);
+
+    Get<Tmf::SecureAgent>().Disconnect();
+
+exit:
+    return;
+}
+
 #if OPENTHREAD_CONFIG_BORDER_AGENT_EPHEMERAL_KEY_ENABLE
 
 Error BorderAgent::SetEphemeralKey(const char *aKeyString, uint32_t aTimeout, uint16_t aUdpPort)
diff --git a/src/core/meshcop/border_agent.hpp b/src/core/meshcop/border_agent.hpp
index 385bb3fbf..6f1eb0bc3 100644
--- a/src/core/meshcop/border_agent.hpp
+++ b/src/core/meshcop/border_agent.hpp
@@ -157,6 +157,17 @@ public:
      */
     State GetState(void) const { return mState; }
 
+    /**
+     * Disconnects the Border Agent from any active secure sessions.
+     *
+     * If Border Agent is connected to a commissioner candidate with ephemeral key, calling this API
+     * will cause the ephemeral key to be cleared after the session is disconnected.
+     *
+     * The Border Agent state may not change immediately upon calling this method, the state will be
+     * updated when the connection update is notified by `HandleConnected()`.
+     */
+    void Disconnect(void);
+
 #if OPENTHREAD_CONFIG_BORDER_AGENT_EPHEMERAL_KEY_ENABLE
     /**
      * Sets the ephemeral key for a given timeout duration.
diff --git a/tests/scripts/expect/cli-misc.exp b/tests/scripts/expect/cli-misc.exp
index 522a0faac..86433b16c 100755
--- a/tests/scripts/expect/cli-misc.exp
+++ b/tests/scripts/expect/cli-misc.exp
@@ -184,6 +184,9 @@ expect "Done"
 send "ba state\n"
 expect "Done"
 
+send "ba disconnect\n"
+expect "Done"
+
 send "prefix meshlocal fd00:dead:beef:cafe::/96\n"
 expect_line "Error 7: InvalidArgs"
 send "prefix meshlocal fd00:dead:beef:cafe::/64\n"