[64fa9ba] | 1 | #ifndef __ABAC_HH__ |
---|
| 2 | #define __ABAC_HH__ |
---|
| 3 | |
---|
[461541a] | 4 | #include <cstdio> |
---|
| 5 | #include <stdexcept> |
---|
[2af3b82] | 6 | #include <string> |
---|
[9dffbd6] | 7 | #include <vector> |
---|
| 8 | |
---|
[3ed053d] | 9 | /* This file is generated from doc/ABAC.hh by doc/extract_doc.c */ |
---|
| 10 | |
---|
[64fa9ba] | 11 | namespace ABAC { |
---|
| 12 | extern "C" { |
---|
| 13 | #include "abac.h" |
---|
| 14 | } |
---|
| 15 | |
---|
[4721618] | 16 | class Attribute; |
---|
| 17 | class ID; |
---|
[94605f2] | 18 | class Role; |
---|
| 19 | class Credential; |
---|
[9dffbd6] | 20 | |
---|
[64fa9ba] | 21 | class Context { |
---|
| 22 | public: |
---|
| 23 | Context() { m_ctx = abac_context_new(); } |
---|
| 24 | Context(const Context &context) { m_ctx = abac_context_dup(context.m_ctx); } |
---|
| 25 | ~Context() { abac_context_free(m_ctx); } |
---|
| 26 | |
---|
| 27 | int load_id_file(char *filename) { return abac_context_load_id_file(m_ctx, filename); } |
---|
| 28 | int load_id_chunk(abac_chunk_t cert) { return abac_context_load_id_chunk(m_ctx, cert); } |
---|
| 29 | int load_attribute_file(char *filename) { return abac_context_load_attribute_file(m_ctx, filename); } |
---|
| 30 | int load_attribute_chunk(abac_chunk_t cert) { return abac_context_load_attribute_chunk(m_ctx, cert); } |
---|
| 31 | |
---|
| 32 | void load_directory(char *path) { abac_context_load_directory(m_ctx, path); } |
---|
| 33 | |
---|
[92661b4] | 34 | |
---|
[9dffbd6] | 35 | /* abac query, returns a vector of credentials on success, NULL on fail */ |
---|
[4e426c9] | 36 | std::vector<Credential> query(char *role, char *principal, bool &success) { |
---|
[a70acc9] | 37 | abac_credential_t **creds, **end; |
---|
[4e426c9] | 38 | int i, success_int; |
---|
[a70acc9] | 39 | creds = abac_context_query(m_ctx, role, principal, &success_int); |
---|
[4e426c9] | 40 | success = success_int; |
---|
[9dffbd6] | 41 | |
---|
[a70acc9] | 42 | for (i = 0; creds[i] != NULL; ++i) |
---|
[9dffbd6] | 43 | ; |
---|
| 44 | |
---|
[a70acc9] | 45 | end = &creds[i]; |
---|
| 46 | std::vector<Credential> credentials = std::vector<Credential>(creds, end); |
---|
| 47 | abac_context_credentials_free(creds); |
---|
[9dffbd6] | 48 | return credentials; |
---|
| 49 | } |
---|
[3c4fd68] | 50 | std::vector<Credential> credentials() { |
---|
| 51 | abac_credential_t **creds, **end; |
---|
| 52 | int i; |
---|
| 53 | |
---|
| 54 | creds = abac_context_credentials(m_ctx); |
---|
| 55 | for (i = 0; creds[i] != NULL; ++i) |
---|
| 56 | ; |
---|
| 57 | |
---|
| 58 | end = &creds[i]; |
---|
| 59 | std::vector<Credential> credentials = std::vector<Credential>(creds, end); |
---|
| 60 | |
---|
| 61 | abac_context_credentials_free(creds); |
---|
| 62 | return credentials; |
---|
| 63 | } |
---|
[34565bf] | 64 | void set_nickname(char *key, char *nick) { |
---|
| 65 | abac_context_set_nickname(m_ctx, key, nick); |
---|
| 66 | } |
---|
[64fa9ba] | 67 | private: |
---|
| 68 | abac_context_t *m_ctx; |
---|
[94605f2] | 69 | friend class Role; |
---|
[afcafea] | 70 | friend class Attribute; |
---|
[64fa9ba] | 71 | }; |
---|
[461541a] | 72 | |
---|
[94605f2] | 73 | class Role { |
---|
| 74 | public: |
---|
| 75 | Role() : m_role(NULL) { } // do not use: here for swig |
---|
| 76 | Role(abac_role_t *role) { m_role = abac_role_dup(role); } |
---|
| 77 | Role(char *role_name) { m_role = abac_role_from_string(role_name); } |
---|
| 78 | Role(const Role &role) { m_role = abac_role_dup(role.m_role); } |
---|
| 79 | ~Role() { abac_role_free(m_role); } |
---|
| 80 | bool is_principal() const { return abac_role_is_principal(m_role); } |
---|
| 81 | bool is_role() const { return abac_role_is_role(m_role); } |
---|
| 82 | bool is_linking() const { return abac_role_is_linking(m_role); } |
---|
| 83 | |
---|
| 84 | char *string() const { return abac_role_string(m_role); } |
---|
| 85 | char *short_string(Context& c) const { |
---|
| 86 | return abac_role_short_string(m_role, c.m_ctx); |
---|
| 87 | } |
---|
| 88 | char *linked_role() const { return abac_role_linked_role(m_role); } |
---|
| 89 | char *role_name() const { return abac_role_role_name(m_role); } |
---|
| 90 | char *principal() const { return abac_role_principal(m_role); } |
---|
| 91 | |
---|
| 92 | private: |
---|
| 93 | abac_role_t *m_role; |
---|
| 94 | }; |
---|
| 95 | |
---|
| 96 | class Credential { |
---|
| 97 | public: |
---|
| 98 | Credential() : m_cred(NULL) { } // do not use: here for swig |
---|
| 99 | Credential(abac_credential_t *cred) : |
---|
| 100 | m_head(abac_credential_head(cred)), |
---|
| 101 | m_tail(abac_credential_tail(cred)), |
---|
| 102 | m_cred(abac_credential_dup(cred)) |
---|
| 103 | { } |
---|
| 104 | Credential(const Credential &cred) : |
---|
| 105 | m_head(cred.m_head), |
---|
| 106 | m_tail(cred.m_tail), |
---|
| 107 | m_cred(abac_credential_dup(cred.m_cred)) |
---|
| 108 | { } |
---|
| 109 | ~Credential() { abac_credential_free(m_cred); } |
---|
| 110 | const Role &head() { return m_head; } |
---|
| 111 | const Role &tail() { return m_tail; } |
---|
| 112 | abac_chunk_t attribute_cert() { return abac_credential_attribute_cert(m_cred); } |
---|
| 113 | abac_chunk_t issuer_cert() { return abac_credential_issuer_cert(m_cred); } |
---|
| 114 | |
---|
| 115 | private: |
---|
| 116 | abac_credential_t *m_cred; |
---|
| 117 | Role m_head, m_tail; |
---|
| 118 | }; |
---|
| 119 | |
---|
| 120 | |
---|
[461541a] | 121 | class ID { |
---|
| 122 | public: |
---|
| 123 | ID() : m_id(NULL) { } // do not use: required by swig |
---|
[92661b4] | 124 | ID(const ID &id) { m_id = abac_id_dup(id.m_id); } |
---|
| 125 | ~ID() { abac_id_free(m_id); } |
---|
[461541a] | 126 | |
---|
| 127 | ID(char *filename) : m_id(NULL) { |
---|
| 128 | m_id = abac_id_from_file(filename); |
---|
| 129 | if (m_id == NULL) |
---|
| 130 | throw std::invalid_argument("Could not load ID cert"); |
---|
| 131 | } |
---|
| 132 | |
---|
| 133 | ID(abac_chunk_t chunk) : m_id(NULL) { |
---|
| 134 | m_id = abac_id_from_chunk(chunk); |
---|
| 135 | if (m_id == NULL) |
---|
[a02c849] | 136 | throw std::invalid_argument("Could not load ID certificate with a chunk"); |
---|
[461541a] | 137 | } |
---|
| 138 | ID(char *cn, int validity) : m_id(NULL) { |
---|
| 139 | int ret = abac_id_generate(&m_id, cn, validity); |
---|
| 140 | if (ret == ABAC_GENERATE_INVALID_CN) |
---|
| 141 | throw std::invalid_argument("CN must be alphanumeric and start with a letter"); |
---|
| 142 | if (ret == ABAC_GENERATE_INVALID_VALIDITY) |
---|
| 143 | throw std::invalid_argument("Validity must be > 0 days"); |
---|
| 144 | } |
---|
| 145 | void load_privkey(char *filename) { |
---|
| 146 | int ret = abac_id_privkey_from_file(m_id, filename); |
---|
[4721618] | 147 | if (ret != ABAC_SUCCESS) |
---|
[461541a] | 148 | throw std::invalid_argument("Could not load private key"); |
---|
| 149 | } |
---|
[a02c849] | 150 | void load_privkey_chunk(abac_chunk_t chunk) { |
---|
| 151 | int ret = abac_id_privkey_from_chunk(m_id, chunk); |
---|
| 152 | if (ret != ABAC_SUCCESS) |
---|
| 153 | throw std::invalid_argument("Could not load private key with a chunk"); |
---|
| 154 | } |
---|
| 155 | int has_privkey() { |
---|
| 156 | int ret= abac_id_has_privkey(m_id); |
---|
| 157 | return ret; |
---|
| 158 | } |
---|
[461541a] | 159 | char *keyid() { return abac_id_keyid(m_id); } |
---|
| 160 | char *cert_filename() { return abac_id_cert_filename(m_id); } |
---|
[4721618] | 161 | void write_cert(FILE *out) { abac_id_write_cert(m_id, out); } |
---|
[461541a] | 162 | void write_cert(const std::string &name) { |
---|
[a02c849] | 163 | FILE *out = fopen(name.c_str(), "a+"); |
---|
[461541a] | 164 | if (out == NULL) |
---|
[92661b4] | 165 | throw std::invalid_argument("Could not open certificate file for writing"); |
---|
[461541a] | 166 | write_cert(out); |
---|
| 167 | fclose(out); |
---|
| 168 | } |
---|
| 169 | // Simplifies access from swig |
---|
[4721618] | 170 | void write_cert_file(const char *n) { |
---|
[461541a] | 171 | write_cert(std::string(n)); |
---|
| 172 | } |
---|
[92661b4] | 173 | void write_cert_name(const char *n) { |
---|
| 174 | write_cert(std::string(n)); |
---|
| 175 | fprintf(stderr,"ABAC::ID::write_cert_name is deprecated, please use ABAC::ID::write_cert_name\n"); |
---|
| 176 | } |
---|
[461541a] | 177 | char *privkey_filename() { return abac_id_privkey_filename(m_id); } |
---|
[4721618] | 178 | void write_privkey(FILE *out) { |
---|
[461541a] | 179 | int ret = abac_id_write_privkey(m_id, out); |
---|
[4721618] | 180 | if (ret!=ABAC_SUCCESS) throw std::logic_error("No private key loaded"); |
---|
[461541a] | 181 | } |
---|
| 182 | void write_privkey(const std::string &name) { |
---|
[a02c849] | 183 | FILE *out = fopen(name.c_str(), "a+"); |
---|
[461541a] | 184 | if (out == NULL) |
---|
| 185 | throw std::invalid_argument("Could not open privkey file for writing"); |
---|
| 186 | write_privkey(out); |
---|
| 187 | fclose(out); |
---|
| 188 | } |
---|
| 189 | // Simplifies access from swig |
---|
[4721618] | 190 | void write_privkey_file(const char *name) { |
---|
[461541a] | 191 | write_privkey(std::string(name)); |
---|
| 192 | } |
---|
[92661b4] | 193 | void write_privkey_name(const char *name) { |
---|
| 194 | write_privkey(std::string(name)); |
---|
| 195 | fprintf(stderr,"ABAC::ID::write_privkey_name is deprecated, please use ABAC::ID::write_privkey_file\n"); |
---|
| 196 | } |
---|
[461541a] | 197 | abac_chunk_t cert_chunk() { return abac_id_cert_chunk(m_id); } |
---|
[92661b4] | 198 | abac_chunk_t privkey_chunk() { return abac_id_privkey_chunk(m_id); } |
---|
[461541a] | 199 | |
---|
| 200 | friend class Attribute; |
---|
| 201 | |
---|
| 202 | private: |
---|
| 203 | abac_id_t *m_id; |
---|
| 204 | }; |
---|
| 205 | |
---|
| 206 | class Attribute { |
---|
| 207 | public: |
---|
| 208 | Attribute() : m_attr(NULL) { } // do not use: required by swig |
---|
[92661b4] | 209 | ~Attribute() { abac_attribute_free(m_attr); } |
---|
[461541a] | 210 | |
---|
| 211 | Attribute(ID &issuer, char *role, int validity) : m_attr(NULL) { |
---|
| 212 | int ret = abac_attribute_create(&m_attr, issuer.m_id, role, validity); |
---|
| 213 | if (ret == ABAC_ATTRIBUTE_ISSUER_NOKEY) |
---|
| 214 | throw std::invalid_argument("Issuer has no private key"); |
---|
| 215 | if (ret == ABAC_ATTRIBUTE_INVALID_ROLE) |
---|
| 216 | throw std::invalid_argument("Role name must be alphanumeric"); |
---|
| 217 | if (ret == ABAC_ATTRIBUTE_INVALID_VALIDITY) |
---|
| 218 | throw std::invalid_argument("Validity must be > 0 days"); |
---|
| 219 | if (ret == ABAC_ATTRIBUTE_INVALID_ISSUER) |
---|
| 220 | throw std::invalid_argument("Issuer's validity expired"); |
---|
| 221 | } |
---|
| 222 | |
---|
| 223 | |
---|
| 224 | bool principal(char *keyid) { |
---|
| 225 | if (baked()) throw std::logic_error("Cert is already baked"); |
---|
| 226 | return abac_attribute_principal(m_attr, keyid); |
---|
| 227 | } |
---|
| 228 | bool role(char *keyid, char *role) { |
---|
| 229 | if (baked()) throw std::logic_error("Cert is already baked"); |
---|
| 230 | return abac_attribute_role(m_attr, keyid, role); |
---|
| 231 | } |
---|
| 232 | bool linking_role(char *keyid, char *role, char *linked) { |
---|
| 233 | if (baked()) throw std::logic_error("Cert is already baked"); |
---|
| 234 | return abac_attribute_linking_role(m_attr, keyid, role, linked); |
---|
| 235 | } |
---|
| 236 | bool bake() { |
---|
| 237 | if (baked()) throw std::logic_error("Cert is already baked"); |
---|
| 238 | return abac_attribute_bake(m_attr); |
---|
| 239 | } |
---|
| 240 | |
---|
[afcafea] | 241 | bool bake(Context& c) { |
---|
| 242 | if (baked()) throw std::logic_error("Cert is already baked"); |
---|
| 243 | return abac_attribute_bake_context(m_attr, c.m_ctx); |
---|
| 244 | } |
---|
| 245 | |
---|
[461541a] | 246 | bool baked() { return abac_attribute_baked(m_attr); } |
---|
| 247 | |
---|
[bc12f3d] | 248 | void set_output_format(char *fmt) { |
---|
| 249 | abac_attribute_set_output_format(m_attr, fmt); |
---|
| 250 | } |
---|
| 251 | |
---|
[34565bf] | 252 | char *get_output_format() { |
---|
| 253 | return abac_attribute_get_output_format(m_attr); |
---|
| 254 | } |
---|
| 255 | |
---|
[4721618] | 256 | void write(FILE *out) { |
---|
[461541a] | 257 | int ret = abac_attribute_write(m_attr, out); |
---|
[4721618] | 258 | if (ret!=ABAC_SUCCESS) throw std::logic_error("Cert is not baked"); |
---|
[461541a] | 259 | } |
---|
| 260 | void write(const std::string &name) { |
---|
[4721618] | 261 | FILE *out = fopen(name.c_str(), "w"); |
---|
[461541a] | 262 | if (out == NULL) |
---|
[92661b4] | 263 | throw std::invalid_argument("Could not open certificate file for writing"); |
---|
[461541a] | 264 | write(out); |
---|
| 265 | fclose(out); |
---|
| 266 | } |
---|
[4721618] | 267 | void write_file(const char *name) { |
---|
| 268 | int ret = abac_attribute_write_file(m_attr, name); |
---|
| 269 | if (ret!=ABAC_SUCCESS) throw std::logic_error("Cert is not baked"); |
---|
[461541a] | 270 | } |
---|
[92661b4] | 271 | void write_name(const char *name) { |
---|
| 272 | write_file(name); |
---|
[3ed053d] | 273 | fprintf(stderr,"ABAC::Attribute::write_name is deprecated, please use ABAC::Attribute::write_name\n"); |
---|
[92661b4] | 274 | } |
---|
[461541a] | 275 | abac_chunk_t cert_chunk() { |
---|
[4721618] | 276 | abac_chunk_t ret=abac_attribute_cert_chunk(m_attr); |
---|
| 277 | if(ret.len == 0) |
---|
| 278 | throw std::logic_error("Cert is not baked"); |
---|
[461541a] | 279 | return ret; |
---|
| 280 | } |
---|
| 281 | |
---|
| 282 | private: |
---|
| 283 | abac_attribute_t *m_attr; |
---|
| 284 | }; |
---|
[64fa9ba] | 285 | } |
---|
| 286 | |
---|
| 287 | #endif /* __ABAC_HH__ */ |
---|