source: libabac/abac.c @ e97d2e2

/* abac.c using prolog */

#include <assert.h>
#include <err.h>
#include <glob.h>

#include <chunk.h>

#include "abac_internal.h"

#include "abac_pl_yap.h"
#include "abac_util.h"
#include "abac_verifier.h"

static int debug=0;

struct _abac_context_t {
    abac_pl_t *pl;
};

/**
 * Init the library.
 */
void libabac_init(void) {

    if(debug) fprintf(stderr, "libabac_init, calling init\n");
    void libabac_deinit(void);
    static int has_been_init = 0;

    // called every time a context is created, so only do it once
    if (!has_been_init) {
        abac_verifier_init();
        atexit(libabac_deinit);
        has_been_init = 1;
        } else {
           if(debug) fprintf(stderr, "libabac_init, can only be called once\n");
    }
}

/**
 * Deinit the library.
 */
static int has_been_deinit = 0;
void libabac_deinit(void) {
    if(debug) fprintf(stderr, "libabac_deinit, calling take down (%d)\n", has_been_deinit);
    if(!has_been_deinit) {
        abac_verifier_deinit();
        has_been_deinit = 1;
        } else {
           if(debug) fprintf(stderr, "libabac_deinit, can only be called once\n");
    }
}

/**
 * Create a new abac context.
 */
abac_context_t *abac_context_new(void) {
    libabac_init();

    abac_context_t *ctx = abac_xmalloc(sizeof(abac_context_t));
    ctx->pl = abac_pl_new();
    return ctx;
}

/**
 * Deep copy an abac context. -- XXX dummy stub
 */
abac_context_t *abac_context_dup(abac_context_t *ctx) {
    assert(ctx != NULL);
    abac_context_t *dup = abac_xmalloc(sizeof(abac_context_t));
    return dup;
}

/**
 * Free an abac context.
 */
void abac_context_free(abac_context_t *ctx) {
    assert(ctx != NULL);
    abac_pl_free(ctx->pl);
    free(ctx);
}

/* This is only used for swig/jni/abac setup, called from
abac.hh's free_context_now(). Used by other setup actually
could result in segfaults in libstrongswan if not careful */
void abac_context_free_now(abac_context_t *ctx) {
    assert(ctx != NULL);
    abac_pl_free(ctx->pl);
    free(ctx);
    libabac_deinit();
}

/**
 * Load an ID cert from an abac_id_t.
 */
int abac_context_load_id_id(abac_context_t *ctx, abac_id_t *id) {
    assert(ctx != NULL); assert(id);
    abac_id_credential_t *id_cert=NULL;
    int ret = abac_verifier_load_id_id(id,&id_cert);
    if(id_cert) {
        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
    }
    return ret;
}

/**
 * Load an ID cert from a file.
 */
int abac_context_load_id_id_file_key_file(abac_context_t *ctx, char *filename,
char *keyfilename)
{
    assert(ctx != NULL); assert(filename != NULL); assert(keyfilename!=NULL);
    abac_id_credential_t *id_cert=NULL;
    int ret = abac_verifier_load_id_file_key_file(filename,keyfilename,&id_cert);
    if(id_cert) {
        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
    }
    return ret;
}

int abac_context_load_id_enc_id_file_key_file(abac_context_t *ctx, char *filename,
char *keyfilename, char *pfile)
{
    assert(ctx != NULL); assert(filename != NULL); assert(keyfilename!=NULL);
    abac_id_credential_t *id_cert=NULL;
    int ret = abac_verifier_load_enc_id_file_key_file(filename,keyfilename, pfile, &id_cert);
    if(id_cert) {
        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
    }
    return ret;
}

/**
 * Load an ID cert from a file, it may contain key part but not necessary.
 */
int abac_context_load_id_idkey_file(abac_context_t *ctx, char *filename) {
    assert(ctx != NULL); assert(filename != NULL); 
    abac_id_credential_t *id_cert=NULL;
    int ret = abac_verifier_load_idkey_file(filename,&id_cert);
    if(id_cert) {
        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
    }
    return ret;
}

/**
 * Load an ID cert from a file, it may contain encrypted key part but not necessary.
 */
int abac_context_load_id_enc_idkey_file(abac_context_t *ctx, char *filename, char *pfile) {
    assert(ctx != NULL); assert(filename != NULL); 
    abac_id_credential_t *id_cert=NULL;
    int ret = abac_verifier_load_enc_idkey_file(filename, pfile,&id_cert);
    if(id_cert) {
        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
    }
    return ret;
}

/**
 * Load an ID cert from a chunk.
 */
int abac_context_load_id_chunk(abac_context_t *ctx, abac_chunk_t cert) {
    assert(ctx != NULL);
    abac_id_credential_t *id_cert=NULL;
    chunk_t cert_chunk = { cert.ptr, cert.len };
    int ret=abac_verifier_load_id_chunk(cert_chunk,&id_cert);
    if(id_cert) {
        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
    }
    return ret;
}


/**
 * Load an ID cert and privkey from chunks.
 */
int abac_context_load_id_privkey_chunk(abac_context_t *ctx, abac_chunk_t cert, abac_chunk_t privkey) {
    assert(ctx != NULL);
    abac_id_credential_t *id_cert=NULL;
    chunk_t cert_chunk = { cert.ptr, cert.len };
/*A HACK/SWIG, this is to work around the swig's stub that seems to 
  mess up the transformation from abac_chunk_t to chunk_t and calling of 
  load_id_chunks to here */
/* BAD,  chunk_t privkey_chunk = { privkey.ptr, privkey.len }; */
    chunk_t privkey_chunk = { strndup(privkey.ptr,privkey.len), privkey.len };
/* another way,
    chunk_t tmp = { privkey.ptr, privkey.len };
    char *ptr = abac_xmalloc(sizeof(unsigned char) * privkey.len);
    chunk_t privkey_chunk = chunk_create_clone(ptr,tmp);
*/
    if(debug) {
        fprintf(stderr, "abac_context_load_id_privkey_chunk, privkey ptr, loc(%d)\n",
                                                           (int)privkey.ptr);
        fprintf(stderr, "abac_context_load_id_privkey_chunk, privkey_chunk ptr, loc(%d)\n",
                                                           (int)privkey_chunk.ptr);
    }
    int ret=abac_verifier_load_id_privkey_chunk(cert_chunk, privkey_chunk, &id_cert);
    if(id_cert) {
        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
    }
    return ret;
}

/**
 * Load an ID cert and privkey from chunks.
 */
int abac_context_load_id_enc_privkey_chunk(abac_context_t *ctx,
abac_chunk_t cert, abac_chunk_t privkey, char *pfile) {
    assert(ctx != NULL);
    abac_id_credential_t *id_cert=NULL;
    chunk_t cert_chunk = { cert.ptr, cert.len };
/*A HACK/SWIG, this is to work around the swig's stub that seems to 
  mess up the transformation from abac_chunk_t to chunk_t and calling of 
  load_id_chunks to here */
/* BAD,  chunk_t privkey_chunk = { privkey.ptr, privkey.len }; */
    chunk_t privkey_chunk = { strndup(privkey.ptr,privkey.len), privkey.len };
    int ret=abac_verifier_load_id_enc_privkey_chunk(cert_chunk, privkey_chunk, pfile, &id_cert);

    if(id_cert) {
        int add_ret = abac_pl_add_type_credential(ctx->pl, id_cert);
    }
    return ret;
}



/**
 * Load an attribute cert from an abac_attribute_t.
 */
int abac_context_load_attribute_attribute(abac_context_t *ctx, abac_attribute_t *ptr)
{
    int ret, add_ret;
    abac_credential_t *cred=NULL;

    assert(ctx != NULL);

    ret = abac_verifier_load_attribute_cert_attribute(ptr, &cred);
    if (ret == ABAC_CERT_SUCCESS) {
        add_ret = abac_pl_add_credential(ctx->pl, cred);
        assert(add_ret != ABAC_PL_CRED_INVALID);
    }

    return ret;

}

/**
 * Load an attribute cert from a file.
 */
int abac_context_load_attribute_file(abac_context_t *ctx, char *filename) {
    int ret, add_ret;
    abac_credential_t *cred=NULL;

    assert(ctx != NULL); assert(filename != NULL);

    ret = abac_verifier_load_attribute_cert_file(filename, &cred);
    if (ret == ABAC_CERT_SUCCESS) {
        add_ret = abac_pl_add_credential(ctx->pl, cred);
        assert(add_ret != ABAC_PL_CRED_INVALID);
    }

    return ret;
}

/**
 * Load an attribute cert from a chunk.
 */
int abac_context_load_attribute_chunk(abac_context_t *ctx, abac_chunk_t cert) {
    int ret, add_ret;
    abac_credential_t *cred=NULL;

    assert(ctx != NULL);

    chunk_t cert_chunk = { cert.ptr, cert.len };

    ret = abac_verifier_load_attribute_cert_chunk(cert_chunk, &cred);
    if (ret == ABAC_CERT_SUCCESS) {
        add_ret = abac_pl_add_credential(ctx->pl, cred);
        assert(add_ret != ABAC_PL_CRED_INVALID);
    }

    return ret;
}

#define KEY_PAT "/*_private.{der,pem}"
#define ID_PAT "/*_ID.{der,pem}"
#define ATTR_PAT "/*_attr.der"
#define IDKEY_PAT "/*_IDKEY.{der,pem}"

char *_make_key_filename(char *cert_file)
{
    char *p=strstr(cert_file,"_ID.");
    char *head=strndup(cert_file,p-cert_file);
    char *tail=p+4;
    char *keyfile=NULL;
    asprintf(&keyfile,"%s_private.%s",head,tail);
    free(head);
    return keyfile;
}

/**
 * Load a directory full of principal certs.
 */
void abac_context_load_principals(abac_context_t *ctx, char *path) {
    char *glob_pat, *key_pat;
    glob_t glob_buf;
    int i, ret;

    assert(ctx != NULL); assert(path != NULL);

    int dirlen = strlen(path);

    /* make sure pick the larger one */
    glob_pat = abac_xmalloc(dirlen + sizeof(IDKEY_PAT));
    memcpy(glob_pat, path, dirlen);

    // load ID certs
    memcpy(glob_pat + dirlen, ID_PAT, sizeof(ID_PAT));
    glob(glob_pat, GLOB_BRACE, NULL, &glob_buf); // TODO check for error
    for (i = 0; i < glob_buf.gl_pathc; ++i) {
        /* blah_ID.pem */
        char *cert_file = glob_buf.gl_pathv[i];
        /* blah_private.pem */
        char *key_file=_make_key_filename(cert_file);
        if(debug) {
            fprintf(stderr,"--> ID cert... %s\n", cert_file);
            fprintf(stderr,"--> KEY cert... %s\n", key_file);
        }
        ret = abac_context_load_id_id_file_key_file(ctx, cert_file, key_file);
        if (ret != ABAC_CERT_SUCCESS)
            warnx("Couldn't load ID cert %s", cert_file);
    }
    globfree(&glob_buf);

    // next load IDKEY certs
    memcpy(glob_pat + dirlen, IDKEY_PAT, sizeof(IDKEY_PAT));
    glob(glob_pat, GLOB_BRACE, NULL, &glob_buf); // TODO check for error
    for (i = 0; i < glob_buf.gl_pathc; ++i) {
        /* blah_IDKEY.pem */
        char *certkey_file = glob_buf.gl_pathv[i];
        if(debug) fprintf(stderr, "--> IDKEY certkey... %s\n", certkey_file);
        ret = abac_context_load_id_idkey_file(ctx, certkey_file);
        if (ret != ABAC_CERT_SUCCESS)
            warnx("Couldn't load ID/KEY IDKEY cert %s", certkey_file);
    }
    globfree(&glob_buf);

    free(glob_pat);
}

/**
 * Load a directory full of certs.
 */
void abac_context_load_directory(abac_context_t *ctx, char *path) {
    char *glob_pat, *key_pat;
    glob_t glob_buf;
    int i, ret;

    abac_context_load_principals(ctx,path);
    int dirlen = strlen(path);

    /* make sure pick the larger one */
    glob_pat = abac_xmalloc(dirlen + sizeof(IDKEY_PAT));
    memcpy(glob_pat, path, dirlen);

    memcpy(glob_pat + dirlen, ATTR_PAT, sizeof(ATTR_PAT));
    glob(glob_pat, 0, NULL, &glob_buf); // TODO check for error
    for (i = 0; i < glob_buf.gl_pathc; ++i) {
        char *cert_file = glob_buf.gl_pathv[i];

        if(debug) fprintf(stderr,"--> attr file... (%s)\n", cert_file);
        ret = abac_context_load_attribute_file(ctx, cert_file);
        if (ret != ABAC_CERT_SUCCESS)
            warnx("Couldn't load attribute cert --%s", cert_file);
        if(debug) fprintf(stderr,"Loaded.. (%s)\n", cert_file);
    }
    globfree(&glob_buf);

    free(glob_pat);
}

/**
 * Run a query on the data in an abac context. Returns a NULL-terminated array
 * of abac_credential_t. Success/failure in *success.
 * queryfor(either role or oset), with(either keyid or object type)
 */
abac_credential_t **abac_context_query(abac_context_t *ctx, char *queryfor, char *with, int *success) {
    if(debug) fprintf(stderr,"abac_context_query about(%s) with(%s)\n", queryfor, with);
    abac_credential_t **credentials = NULL, *cur;
    assert(ctx != NULL); assert(queryfor != NULL);
    assert(with != NULL); assert(success != NULL);

    abac_stack_t *result = abac_pl_query(ctx->pl, queryfor, with);

    int size = abac_stack_size(result);
    if (size > 0) {
       if(!abac_pl_returning_partial(ctx->pl))
            *success = 1;
            else *success = 0;
    } else {
        *success = 0;
    }

    // make the array (leave space to NULL terminate it)
    //      n.b., even if the list is empty, we still return an array that
    //            only contains the NULL terminator
    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
    int i = 0;
    if(size) {
        while(i<size) { 
            cur=(abac_credential_t *) abac_stack_pop(result);
            credentials[i++] = cur;
        } 
    }
    credentials[i] = NULL;

    if(result)
        abac_stack_free(result);

    return credentials;
}

/**
 * Run a repeated query on the data in an abac context to get the next
 * solution proof. Returns a NULL-terminated array
 * of abac_credential_t. Success/failure in *success.
 */
abac_credential_t **abac_context_query_again(abac_context_t *ctx, int *success)
{
    if(debug) fprintf(stderr,"abac_context_query_again\n");
    abac_credential_t **credentials = NULL, *cur;
    assert(ctx != NULL);
    assert(success != NULL);

    abac_stack_t *result = abac_pl_query_again(ctx->pl);

    int size = abac_stack_size(result);
    if (size > 0) {
        *success = 1;
        } else {
            *success = 0;
    }

    // make the array (leave space to NULL terminate it)
    //      n.b., even if the list is empty, we still return an array that
    //            only contains the NULL terminator
    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
    int i = 0;
    if(size) {
        while(i<size) { 
            cur=(abac_credential_t *) abac_stack_pop(result);
            credentials[i++] = cur;
        } 
    }
    credentials[i] = NULL;

    if(result)
        abac_stack_free(result);

    return credentials;
}


abac_credential_t **abac_context_query_with_structure(abac_context_t *ctx,
abac_aspect_t *queryfor, abac_aspect_t *with, int *success)
{
    if(debug) fprintf(stderr,"abac_context_query_with_structure\n");
    abac_credential_t **credentials = NULL, *cur;
    assert(ctx != NULL); assert(queryfor != NULL);
    assert(with != NULL); assert(success != NULL);

    abac_stack_t *result = abac_pl_query_with_structure(ctx->pl, queryfor, with);

    int size = abac_stack_size(result);
    if (size > 0) {
        *success = 1;
    } else {
    // XXX NOT SURE YET..
    // return partial proof
        *success = 0;
    }

    // make the array (leave space to NULL terminate it)
    //      n.b., even if the list is empty, we still return an array that
    //            only contains the NULL terminator
    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
    int i = 0;
    if(size) {
        while(i<size) { 
            cur=(abac_credential_t *) abac_stack_pop(result);
            credentials[i++] = cur;
        } 
    }
    credentials[i] = NULL;

    if(result)
        abac_stack_free(result);

    return credentials;
}

/**
 * A NULL-terminated array of all the credentials in the context.
 */
abac_credential_t **abac_context_credentials(abac_context_t *ctx) {
    abac_credential_t **credentials = NULL, *cur;
    assert(ctx != NULL);

    abac_stack_t *result = abac_pl_credentials(ctx->pl);
    int size = abac_stack_size(result);

    // make the array (leave space to NULL terminate it)
    //      n.b., even if the list is empty, we still return an array that
    //            only contains the NULL terminator
    credentials = abac_xmalloc(sizeof(abac_credential_t *) * (size + 1));
    int i = 0;
    if(size) {
        while(i<size) { 
            cur=(abac_credential_t *) abac_stack_pop(result);
            /* if not in there yet, add into it */
            credentials[i++] = cur;
        } 
    }
    credentials[i] = NULL;

    if(result)
        abac_stack_free(result);
    return credentials;
}

/**
 * Frees a NULL-terminated list of credentials.
 */
void abac_context_credentials_free(abac_credential_t **credentials) {
    int i;

    if (credentials == NULL)
        return;

    for (i = 0; credentials[i] != NULL; ++i)
        abac_credential_free(credentials[i]);
    free(credentials);
}

/**
 * A NULL-terminated array of all the principals in the context.
 */
abac_id_credential_t **abac_context_principals(abac_context_t *ctx) {
    abac_id_credential_t **principals = NULL, *cur;
    assert(ctx != NULL);

    abac_stack_t *result = abac_pl_principals(ctx->pl);

    int size = abac_stack_size(result);

    // make the array (leave space to NULL terminate it)
    //      n.b., even if the list is empty, we still return an array that
    //            only contains the NULL terminator
    principals = abac_xmalloc(sizeof(abac_id_credential_t *) * (size + 1));
    int i = 0;
    if(size) {
        while(i<size) { 
            cur=(abac_id_credential_t *) abac_stack_pop(result);
            /* if not in there yet, add into it */
            principals[i++] = cur;
        } 
    }
    principals[i] = NULL;

    if(result)
        abac_stack_free(result);
    return principals;
}

/**
 * Frees a NULL-terminated list of principals.
 */
void abac_context_principals_free(abac_id_credential_t **principals) {
    int i;

    if (principals == NULL)
        return;

    for (i = 0; principals[i] != NULL; ++i)
        abac_id_credential_free(principals[i]);
    free(principals);
}

/**
 * 
 */
abac_id_credential_t *abac_context_principal_lookup(abac_context_t *ctx, char *name)
{
    assert(ctx != NULL);
    abac_id_credential_t *principal=abac_id_credential_lookup(name);
    return principal;
}

void abac_context_set_no_partial_proof(abac_context_t *ctx)
{ abac_pl_set_no_partial(ctx->pl); }

void abac_context_set_want_partial_proof(abac_context_t *ctx)
{ abac_pl_set_want_partial(ctx->pl); }