Changeset 6e8997e
- Timestamp:
- 05/22/12 13:48:44 (12 months ago)
- Branches:
- mei_rt2, mei_rt2_fix_1
- Children:
- 5d06689
- Parents:
- adc0815
- git-author:
- Mei <mei@…> (05/22/12 13:48:44)
- git-committer:
- Mei <mei@…> (05/22/12 13:48:44)
- File:
-
- 1 edited
-
libabac/abac.hh (modified) (76 diffs)
Legend:
- Unmodified
- Added
- Removed
-
libabac/abac.hh
radc0815 r6e8997e 14 14 /*** 15 15 ABAC::Constraint 16 This is a constraint on a data term. It holds a ptr to 17 a abac_condition_t structure 16 Constraint on a data term. 17 There are 3 types: 18 - Role constraint on a principal 19 - Oset constraint on a principal, or a data object 20 - Range/List constraint on a data object 21 It holds a ptr to a abac_condition_t structure 18 22 ***/ 19 23 class Constraint { 20 24 public: 21 25 /*** 22 26 f Constraint() 23 27 default constructor, do not use, for swig only 24 28 f Constraint(const Constraint &) 25 29 copy constructor, used for cloning a constraint 26 30 f ~Constraint() 27 31 default destructor 28 32 ***/ … … 35 39 } 36 40 /*** 37 41 f Constraint(Role &) 38 42 constructor that takes a constraining role 39 43 [role:?R[{role-constraint}] 40 44 f Constraint(Oset &) 41 45 constructor that takes a constraining oset 42 46 [oset:?O[{oset-constraint}] 43 47 [urn:?F[keyid:$alpha_keyid].oset:documents([string:?P])] 44 48 f Constraint(abac_condition_t *) 45 49 constructor that takes an abac_condition_t structure 46 50 f Constraint(char *) 47 51 constructor that takes one of following string 48 52 as its vartype to set up a range constraint: … … 65 69 } 66 70 /*** 67 71 f void add_constraint_integer_max(int) 68 72 void add_constraint_integer_min(int) 69 73 utility routines to setup a integer range constraint 70 74 [integer:?I[10 .. 20]] 71 75 f void add_constraint_integer_target(int) 72 76 utility routine to setup a integer list constraint 73 77 [integer:?I[10,20]] … … 83 87 } 84 88 /*** 85 89 f void add_constraint_float_max(float) 86 90 void add_constraint_float_min(float) 87 91 utility routines to setup a float range constraint 88 92 [float:?F[1.0 .. 2.5]] 89 93 f void add_constraint_float_target(float) 90 94 utility routine to setup a float list constraint 91 95 [float:?F[0.5, 2.5]] … … 101 105 } 102 106 /*** 103 107 f void add_constraint_time_max(char*) 104 108 void add_constraint_time_min(char*) 105 109 utility routines to setup a time range constraint, 106 110 takes quoted string values, beyond T is optional 107 [time:?M["20201101T182930"]] 108 [time:?M["20201101T"]] 109 void add_constraint_time_target(char*) 111 [time:?F["20120228T" .. "20120228T090000"]] 112 f void add_constraint_time_target(char*) 110 113 utility routine to setup a time list constraint 111 [time:? F["20120228T080000" .. "20120228T090000"]]114 [time:?M["20201101T182930","20201101T"]] 112 115 ***/ 113 116 void add_constraint_time_max(char* val) { … … 121 124 } 122 125 /*** 123 126 f void add_constraint_urn_target(char*) 124 127 utility routine to setup a an urn list constraint 125 128 [urn:?U["fileA","http://fileB"]] 126 129 f void add_constraint_string_target(char*) 127 130 utility routine to setup a a string list constraint 128 131 [string:?S["abc",'efg',"hij"]] 129 132 f void add_constraint_boolean_target(char*) 130 133 utility routine to setup a a boolean list constraint 131 134 [boolean:?B['true']] … … 138 141 { abac_condition_add_range_boolean_item(m_constraint,val); } 139 142 /*** 140 143 f char *string() const 141 144 returns literal string of the constraint 142 145 f char *typed_string() const 143 146 returns typed literal string of the constraint 144 147 ***/ … … 148 151 { return abac_condition_typed_string(m_constraint); } 149 152 /*** 150 153 f abac_condition_t *constraint() 151 154 returns internal constraint structure 152 155 ***/ … … 169 172 public: 170 173 /*** 171 174 f DataTerm() 172 175 default constructor, do not use, for swig only 173 176 f DataTerm(const DataTerm &) 174 177 copy constructor, used for cloning a data term 175 178 f ~DataTerm() 176 179 default destructor 177 180 ***/ … … 188 191 } 189 192 /*** ??? 190 193 f DataTerm(abac_term_t *) 191 194 constructor to make data term from abac_term_t structure 192 195 ***/ … … 198 201 } 199 202 /*** 200 203 f DataTerm(char*) 201 204 constructor to make named principal data term for the oset RHS 202 205 f DataTerm(char*, char*, Constraint*) 203 206 constructor for making a variable data term or an instantiated 204 207 data term … … 224 227 } 225 228 /*** 226 229 f char *string() const 227 230 returns literal string of the data term 228 231 f char *typed_string() const 229 232 returns typed literal string of the data term 230 233 ***/ … … 234 237 { return abac_term_typed_string(m_term); } 235 238 /*** 236 239 f bool is_time() const 237 240 bool is_string() const 238 241 bool is_urn() const … … 249 252 { return abac_term_is_integer_type(m_term); } 250 253 /*** 251 254 f int add_constraint(const Contraint&) 252 255 utiltiy routine to add a constraint to this data term 253 256 ***/ … … 257 260 } 258 261 /*** 259 262 f int type() const 260 263 returns subtype of the data term 261 264 f char *name() const 262 265 returns the name of the data term 263 266 ***/ … … 267 270 { return abac_term_name(m_term); } 268 271 /*** ??? value 269 272 f char *value() const 270 273 Not implemented 271 274 ***/ 272 275 char *value() const { } 273 276 /*** 274 277 f abac_term_t *term() 275 278 returns internal data term structure 276 279 f Constraint *constraint() 277 280 returns internal constraint structure to the data term 278 281 ***/ … … 289 292 /*** 290 293 ABAC::Role 291 A Role is role specification of a set of entitities for a principal .294 A Role is role specification of a set of entitities for a principal 292 295 ***/ 293 296 class Role { 294 297 public: 295 298 /*** 296 299 f Role() 297 300 default constructor, do not use, for swig only 298 301 f Role(const Role &) 299 302 copy constructor, used for cloning a role 300 303 f ~Role() 301 304 default destructor 302 305 ***/ … … 309 312 } 310 313 /*** 311 314 f Role(abac_aspect_t*) 312 315 constructor that takes an abac_aspect_t structure 313 316 f Role(char*) 314 317 constructor that builds a bare bone role with just principal's name 315 318 f Role(char*, char*) 316 319 constructor that builds a bare bone role with just principal's name 317 320 and a role name … … 326 329 { } 327 330 /*** 328 331 f bool is_principal() const 329 332 return true if the role is a principal object(made from 330 333 a data term), the right hand side of, … … 334 337 { return abac_aspect_is_principal(m_role); } 335 338 /*** 336 339 f bool is_linking() const 337 340 returns true if the role is a linking role like 338 341 the right hand side of, … … 342 345 { return abac_aspect_is_linking(m_role); } 343 346 /*** 344 347 f char *string() const 345 348 returns literal string of the role 346 349 f char *typed_string() const 347 350 returns typed literal string of the role 348 351 ***/ … … 352 355 { return abac_aspect_typed_string(m_role); } 353 356 /*** 354 357 f char *linked_role() const 355 358 returns linked part of a linking role, for 356 [keyid:A].role:r1.role:r2, it returns r1359 [keyid:A].role:r1.role:r2, it returns r1 357 360 ***/ 358 361 char *linked_role() const 359 362 { return abac_aspect_linked_role_name(m_role); } 360 363 /*** 361 364 f char *role_name() const 362 365 returns the role name of any role (the part after the last dot) 363 [keyid:A].role.r1.role:r2, it returns r2364 [keyid:A].role.r1, it returns r1366 [keyid:A].role.r1.role:r2, it returns r2 367 [keyid:A].role.r1, it returns r1 365 368 ***/ 366 369 char *role_name() const … … 370 373 371 374 /*** 372 375 f int add_data_term(DataTerm&) 373 376 add a data term to the role 374 377 ***/ … … 378 381 } 379 382 /*** 380 383 f std::vector<DataTerm> get_data_terms(bool &) 381 384 return the data terms bound to this role. 382 385 ??? If the role is returned in a proof, these will all have values. … … 399 402 } 400 403 /*** 401 404 f std::vector<DataTerm> get_linked_data_terms(bool &) 402 405 return the data terms bound to this role's linking role. 403 406 ??? If the role is returned in a proof, these will all have values. … … 416 419 } 417 420 /*** 418 421 f abac_aspect_t *role() 419 422 returns the interal libabac representation of this role 420 423 ***/ … … 426 429 /*** 427 430 ABAC::Oset 428 An Oset is oset specification of a set of entitities for a principal .431 An Oset is oset specification of a set of entitities for a principal 429 432 ***/ 430 433 class Oset { 431 434 public: 432 435 /*** 433 436 f Oset() 434 437 default constructor, do not use, for swig only 435 438 f Oset(const Oset &) 436 439 copy constructor, used for cloning an oset 437 440 f ~Oset() 438 441 default destructor 439 442 ***/ … … 444 447 { if(m_oset) abac_aspect_free(m_oset); } 445 448 /*** 446 449 f Oset(abac_aspect_t *) 447 450 constructor that takes abac_aspect_t structure 448 451 f Oset(char *) 449 452 constructor that makes a principal oset, ie [keyid:B] 450 453 f Oset(char *, char *) 451 454 constructor that makes a regular oset, ie. [keyid:B].oset:o 452 455 f Oset(DataTerm&) 453 456 constructor that makes an object oset, ie. [urn:'file/fileA'] 454 457 ***/ … … 465 468 466 469 /*** 467 470 f bool is_object(), ie <- [integer:10] 468 471 return ture if this oset is an object oset 469 472 ***/ … … 471 474 { return abac_aspect_is_object(m_oset); } 472 475 /*** 473 476 f bool is_principal() const 474 477 return true if the oset is a principal object(made from 475 478 a data term), the right hand side of, … … 479 482 { return abac_aspect_is_principal(m_oset); } 480 483 /*** 481 484 f bool is_linking() const 482 485 returns true if the oset is a linking oset like 483 486 the right hand side of, … … 487 490 { return abac_aspect_is_linking(m_oset); } 488 491 /*** 489 492 f char *string() const 490 493 returns literal string of the oset 491 494 f char *typed_string() const 492 495 returns typed literal string of the oset 493 496 ***/ … … 497 500 { return abac_aspect_typed_string(m_oset); } 498 501 /*** 499 502 f char *linked_role() const 500 503 returns linked part of a linking oset, for 501 [keyid:A].role:r1.oset:o1, it returns r1504 [keyid:A].role:r1.oset:o1, it returns r1 502 505 ***/ 503 506 char *linked_role() const 504 507 { return abac_aspect_linked_role_name(m_oset); } 505 508 /*** 506 509 f char *oset_name() const 507 510 returns oset name, 508 [keyid:A].role:r1.oset:o1, it returns o1509 [keyid:A].oset:o1, it returns o1511 [keyid:A].role:r1.oset:o1, it returns o1 512 [keyid:A].oset:o1, it returns o1 510 513 ***/ 511 514 char *oset_name() const 512 515 { return abac_aspect_aspect_name(m_oset); } 513 516 /*** 514 517 f char *principal() const 515 518 returns principal name, 516 [keyid:A].role:r1.oset:o1, it returns A519 [keyid:A].role:r1.oset:o1, it returns A 517 520 ***/ 518 521 char *principal() const 519 522 { return abac_aspect_principal_name(m_oset); } 520 523 /*** 521 524 f char *object() const 522 525 returns object's name when the oset is a principal object 523 [keyid:A].oset:values <- [integer:10], it returns 10526 [keyid:A].oset:values <- [integer:10], it returns 10 524 527 ***/ 525 528 char *object() const 526 529 { return abac_aspect_object_name(m_oset); } 527 530 /*** 528 531 f int add_data_term(DataTerm&) 529 532 add a data term to this oset's parameter set 530 533 always returns 1 … … 535 538 } 536 539 /*** 537 540 f std::vector<DataTerm> get_data_terms(bool &) 538 541 returns the data terms bound to this oset. 539 542 ??? If the oset is returned in a proof, these will all have values. … … 552 555 } 553 556 /*** 554 557 f int add_linking_data_term(DataTerm&) 555 558 add a data term to this oset's linking role's parameter set. 556 559 always returns 1 … … 561 564 } 562 565 /*** 563 566 f std::vector<DataTerm> get_linked_data_terms(bool &) 564 567 returns the data terms bound to this oset's linking role. 565 568 ??? If the oset is returned in a proof, these will all have values. … … 578 581 } 579 582 /*** 580 583 f abac_aspect_t *oset() 581 584 returns the internal libabac representation of the oset 582 585 ***/ … … 596 599 public: 597 600 /*** 598 601 f ID() 599 602 default constructor, do not use, for swig only 600 603 f ID(const ID &) 601 604 copy constructor, used for cloning an ID 602 605 f ~ID() 603 606 default destructor 604 607 ***/ … … 607 610 ~ID() { if(m_id) abac_id_free(m_id); } 608 611 /*** ??? 609 612 f ID(abac_id_t *) 610 613 constructor from abac_id_t 611 614 f ID(abac_id_credential_t *) 612 615 constructor from abac_id_t 613 616 ***/ … … 621 624 622 625 /*** 623 626 f ID(char *) 624 627 load an ID cert from a file, will throw an exception 625 628 if the cert cannot be loaded … … 631 634 } 632 635 /*** 633 636 f ID(char *,int) 634 637 generates a new ID with the supplied CN and validity period 635 638 - CN must be alphanumeric and begin with a letter … … 643 646 } 644 647 /*** 645 648 f void load_privkey(char *) 646 649 loads the private key associated with the ID credential 647 650 will throw an exception if the key cannot be loaded … … 653 656 } 654 657 /*** 655 658 f abac_id_t *id() 656 659 returns the abac_id_t 657 660 returns the interal libabac representation of this id … … 660 663 661 664 /*** 662 665 f char *keyid() 663 666 returns the SHA1 keyid of the id cert 664 667 f char *name() 665 668 returns the CN (the parameter passed to the constructor or the 666 669 CN of the cert). … … 669 672 char *name() { return abac_id_cn(m_id); } 670 673 /*** 671 674 f bool has_privkey() 672 675 returns true if the ID has an associated private key 673 676 ***/ … … 676 679 677 680 /*** 678 681 f void write_cert(FILE *) 679 682 writes a PEM-encoded cert to the file handle 680 683 f void write_cert(char *) 681 684 writes a PEM-encoded cert to a file named out 682 685 ***/ … … 689 692 } 690 693 /*** 691 694 f void write_privkey(FILE *) 692 695 writes a PEM-encoded private key to the file handle 693 696 throws an exception if no private key is loaded 694 697 f void write_privkey(char *) 695 698 writes a PEM-encoded private key a file named out 696 699 throws an exception if no private key is loaded … … 707 710 } 708 711 /*** 709 712 f abac_chunk_t cert_chunk() 710 713 returns a DER-encoded binary representation of the X.509 ID cert 711 714 associated with this ID. … … 715 718 { return abac_id_cert_chunk(m_id); } 716 719 /*** 717 720 f char *string() 718 721 returns literal string of the id credential 719 722 ***/ … … 733 736 ABAC::Attribute 734 737 This is the attribute representation for the access policy rule 735 738 LHS <- RHS 736 739 The sequence of generation is to 737 first, instantiate the object, ie, LHS (head)738 second, adding subject(s) to it, ie, RHS (tail)739 and then baking it.740 first, instantiate the object, ie, LHS (head) 741 second, adding subject(s) to it, ie, RHS (tail) 742 and then baking it. 740 743 Only once it's baked can you access the X.509 cert. 741 744 Once it's been baked you can no longer add subjects to it … … 744 747 public: 745 748 /*** 746 749 f Attribute() 747 750 default constructor, do not use, for swig only 748 751 f Attribute(const Attribute &) 749 752 copy constructor, used for cloning an attribute 750 753 f ~Attribute() 751 754 default destructor 752 755 ***/ … … 757 760 { if(m_attr) abac_attribute_free(m_attr); } 758 761 /*** 759 762 f Attribute(abac_attribute_t *) 760 763 constructor that takes abac_attribute_t, locally used 761 764 f Attribute(abac_credential_t *) 762 765 constructor that takes abac_credential_t, locally used 763 766 ***/ … … 767 770 { m_attr=abac_attribute_dup(abac_credential_attribute(cred)); } 768 771 /*** 769 772 f Attribute(Role&, int) 770 773 constructor that creates an attribute policy to be signed by the issuer 771 774 with the given role with a specified validity period … … 781 784 } 782 785 /*** 783 786 f Attribute(Oset&, int) 784 787 constructor that creates an attribute policy to be signed by the issuer 785 788 with the given oset with a specified validity period … … 795 798 } 796 799 /*** 797 800 f bool add_tail(Role&) 798 801 Add a role tail. Call multiple times for intersections 799 802 f bool add_tail(Oset&) 800 803 Add an oset tail. Call multiple times for intersections 801 804 ***/ … … 811 814 } 812 815 /*** 813 816 f char *head_string() 814 817 returns literal string of head of the attribute 815 818 f char *tail_string() 816 819 returns literal string of tail of the attribute 817 820 ***/ … … 827 830 } 828 831 /*** 829 832 f char *head_typed_string() 830 833 returns typed literal string of head of the attribute 831 834 f char *tail_typed_string() 832 835 returns typed literal string of tail of the attribute 833 836 ***/ … … 843 846 } 844 847 /*** 845 848 f char *string() 846 849 returns literal string of the attribute 847 850 f char *typed_string() 848 851 returns typed literal string of the attribute 849 852 ***/ … … 867 870 } 868 871 /*** ??? not sure about implmentation 869 872 f const Role &role_head() 870 873 returns the head role 871 874 f const Oset &oset_head() 872 875 returns the oset head 873 876 ***/ … … 883 886 } 884 887 /*** ??? 885 888 f std::vector<Role> role_tails(bool &) 886 889 retrieve tail role which maybe more than 1 if intersecting 887 890 f std::vector<Oset> oset_tails(bool &) 888 891 retrieve tail oset which maybe more than 1 if intersecting 889 892 ***/ … … 923 926 } 924 927 /*** 925 928 f abac_attribute_t *attribute() 926 929 return libabac structure for attribute 927 930 ***/ … … 929 932 930 933 /*** 931 934 f bool bake() 932 935 Generate the cert. Call this after you've added subjects to your cert. 933 936 This returns false if there are no subjects … … 943 946 } 944 947 /*** 945 948 f bool baked() 946 949 returns true iff the cert has been baked. 947 950 ***/ … … 950 953 951 954 /*** 952 955 f void write_cert(FILE *) 953 956 write the DER-encoded X.509 attribute cert to the open file handle 954 957 Throws an exception if the cert isn't baked … … 960 963 } 961 964 /*** 962 965 f void write_cert(char *) 963 966 write the DER-encoded X.509 attribute cert to a file named out 964 967 Throws an exception if the cert isn't baked … … 970 973 } 971 974 /*** 972 975 f abac_chunk_t cert_chunk() 973 976 returns a DER-encoded binary representation of the X.509 attribute 974 977 cert associated with this cert … … 980 983 981 984 /*** 982 985 f int consume() 983 986 generate yap clauses and injected into db 984 987 ***/ … … 996 999 /*** 997 1000 ABAC::Context 998 An ABAC Context1001 An ABAC Context 999 1002 ***/ 1000 1003 class Context { 1001 1004 public: 1002 1005 /*** 1003 1006 f Context() 1004 1007 default constructor 1005 1008 f Context(const Context &) 1006 1009 copy constructor, used for cloning the context 1007 1010 f ~Context() 1008 1011 default destructor 1009 1012 ***/ … … 1018 1021 } 1019 1022 /*** 1020 1023 f void dump_yap() 1021 1024 dump the complete yap prolog database 1022 1025 ***/ … … 1025 1028 1026 1029 /*** 1027 1030 f int load_id(ABAC::ID&) 1028 1031 load id cert from ID 1029 1032 f int load_id_file(char *) 1030 1033 load id cert from an idkey combo file. key retrieval will be attempt 1031 1034 but won't fail if not found 1032 1035 f int load_id_file(char *, char *) 1033 1036 load id cert from an id file and a key file 1034 1037 f int load_id_chunk(abac_chunk_t) 1035 1038 load id cert from a chunk structure 1036 returns:1039 returns: 1037 1040 ABAC_CERT_SUCCESS successfully loaded 1038 1041 ABAC_CERT_INVALID invalid certificate (or file not found) … … 1049 1052 1050 1053 /*** 1051 1054 f int load_attribute(ABAC::Attribute&) 1052 1055 load attribute credential from attribute structure 1053 1056 f int load_attribute_file(char *) 1054 1057 load attribute credential from a file 1055 1058 f int load_attribute_chunk(abac_chunk_t) 1056 1059 load attribute credential from a chunk 1057 returns the same values as above, additionally1058 returns ABAC_CERT_MISSING_ISSUER if the issuer1059 certificate has not been loaded1060 f returns the same values as above, additionally 1061 returns ABAC_CERT_MISSING_ISSUER if the issuer 1062 certificate has not been loaded 1060 1063 ***/ 1061 1064 int load_attribute(ABAC::Attribute& a) … … 1067 1070 1068 1071 /*** 1069 1072 f void load_directory(char *) 1070 1073 load a directory full of certificates: 1071 1074 f first: ${path}/*_ID.{der,pem} as identity certificates 1072 1075 implicitly looking for ${path}/*_private.{der,pem} as 1073 1076 the private key file … … 1078 1081 { abac_context_load_directory(m_ctx, path); } 1079 1082 /*** 1080 1083 f std::vector<Attribute> query(char *, char *, bool &) 1081 1084 the string version is for query that is composed by hand with SHA or 1082 1085 in non ABAC_CN mode 1083 1086 f std::vector<Attribute> query(Role &, Role &, bool &) 1084 1087 std::vector<Attribute> query(Oset &, Oset &, bool &) 1085 1086 1088 runs the query: 1087 1089 role <-?- principal 1090 oset <-?- principal/obj 1088 1091 returns true/false in success 1089 returns a proof upon success, partial proof on failure 1092 returns a proof upon success, 1093 partial proof on failure (not implemented yet) 1090 1094 ***/ 1091 1095 std::vector<Attribute> query(char *role, char *principal, bool &success) { … … 1146 1150 1147 1151 /*** 1148 1152 f std::vector<Attribute> context_credentials(bool &) 1149 1153 returns a vector of all the credentials loaded in the context 1150 1154 extracted from the internal data structure … … 1169 1173 1170 1174 /*** 1171 1175 f std::vector<Attribute> context_principals(bool &) 1172 1176 returns a vector of all the principals loaded in the context 1173 1177 extracted from the internal data structure … … 1190 1194 } 1191 1195 /*** 1192 1196 f char *version() 1193 1197 return the version of this interface 1194 1198 ***/
Note: See TracChangeset
for help on using the changeset viewer.
