source: libabac/abac_verifier.c @ bc0ce98

/**
**  abac_verifier.c
**/

// include the GNU extension of asprintf
#define _GNU_SOURCE

#include <stdio.h>
#include <sys/types.h>
#include <assert.h>

#include <library.h>

#include <chunk.h>
#include "abac_internal.h"
#include "abac_util.h"
#include "abac_context.h"
#include "abac_list.h"
#include "abac_stack.h"
#include "uthash.h"
#include "abac_id.h"
#include "abac_attribute.h"
#include "abac_pl_yap.h"

static int debug=0;
static int hack=1;

/* need to add locks onto theseXXX */
/* hash table base on sha with a p */
struct _abac_id_credential_t {
    char *hashkeyid;
    abac_id_t *id;
    UT_hash_handle hh;
};

/* can store either role or oset */
struct _abac_credential_t {
    char *hashkeyid;
    abac_attribute_t *attr;
    UT_hash_handle hh;
};

typedef struct _abac_verifier_session_t {
    abac_list_t *contexts;
    char *stub; /* namespace stub */

    abac_id_credential_t *id_creds;
/* linked list of all the ids's hashkeyid */
    abac_list_t *id_hashkeyid_list;

/* hash table base on encoded attr rule */
/* can store either role or oset */
    abac_credential_t *attr_creds;
    abac_list_t *attr_hashkeyid_list;

} abac_verifier_session_t;


/* **GLOBAL** the one and only */
abac_verifier_session_t *abac_session=NULL;

/* local */
abac_id_t *abac_id_credential_id(abac_id_credential_t *ptr);
char *abac_idtype_string(int i);
/****************************************************************/
void show_debug_info(const char *msg)
{
    int ctxt_sz=0;
    int id_sz=0;
    int attr_sz=0;
    if(abac_session !=NULL) {
        ctxt_sz=abac_list_size(abac_session->contexts);
        id_sz=abac_list_size(abac_session->id_hashkeyid_list);
        attr_sz=abac_list_size(abac_session->attr_hashkeyid_list);
    }
    fprintf(stderr,"/* ===== %s ======== */\n",msg);
    fprintf(stderr,"  number of contexts: %d\n",ctxt_sz);
    fprintf(stderr,"  number of principals: %d\n",id_sz);
    fprintf(stderr,"  number of attributes: %d\n",attr_sz);
    
}

static void _check_id_cred(abac_id_credential_t *id_cred)
{
    if(id_cred) {
        printf("checking on this id_cred location %d\n", (int)id_cred);
        printf("  --> sha is (%s)\n", abac_id_keyid(id_cred->id));
        printf("  --> cn is (%s)\n", abac_id_cn(id_cred->id));
    }
}

/* retrieve the cn that is associated with this sha_string, checking
   with just the master list */
char *abac_cn_with_sha(char *sha_string)
{
   // get the issuer based on keyid
    abac_id_credential_t *id_cred;
    HASH_FIND_STR(abac_session->id_creds, sha_string, id_cred);
    if (id_cred == NULL) {
        return NULL;
    }
    if(debug)
        _check_id_cred(id_cred);
    return abac_id_cn(id_cred->id);
}

char *abac_idtype_with_sha(char* sha_string)
{
    // get the issuer based on keyid
    abac_id_credential_t *id_cred;
    HASH_FIND_STR(abac_session->id_creds, sha_string, id_cred);
    if (id_cred == NULL) {
        // this id, sha string is not in the db...
        DEBUG_PRINTF("abac_idtype_with_sha: this id is not in the id_creds list\n");
        return NULL;
    }
    int idtype=abac_id_idtype(id_cred->id);
    return abac_idtype_string(idtype);
}

/****************************************************************/
/**
 * abac_credential_t                                
**/
abac_id_credential_t *abac_id_credential_new(abac_id_t *a_id)
{
    char *keyid=abac_id_keyid(a_id);

    abac_id_credential_t *id_cred = abac_xmalloc(sizeof(abac_id_credential_t));
    id_cred->hashkeyid = abac_xstrdup(keyid);
    id_cred->id=abac_id_dup(a_id);
    return id_cred;
}

abac_id_credential_t *abac_id_credential_dup(abac_id_credential_t *ptr)
{
    assert(ptr != NULL);
    DEBUG_PRINTF("calling abac_id_credential_dup, increment id ref count\n");
    abac_id_dup(ptr->id);
    return ptr;
}

abac_id_t *abac_id_credential_id(abac_id_credential_t *ptr)
{
    assert(ptr);
    return ptr->id;
}

char *abac_id_credential_hashkey(abac_id_credential_t *ptr)
{
    assert(ptr);
    return ptr->hashkeyid;
}

/* XXX needs to lock this !! */
void abac_add_id_cred(abac_id_credential_t *id_cred)
{
    HASH_ADD_KEYPTR(hh, abac_session->id_creds, id_cred->hashkeyid,
                                     strlen(id_cred->hashkeyid), id_cred);
    abac_list_add(abac_session->id_hashkeyid_list,
                                        abac_xstrdup(id_cred->hashkeyid));

    DEBUG_PRINTF("-->adding into master id_creds, key(%s)..idx(%d)sz(%d)\n",
       id_cred->hashkeyid, HASH_COUNT(abac_session->id_creds),
       abac_list_size(abac_session->id_hashkeyid_list));
}

abac_id_credential_t *abac_check_id_cred(char *keyid)
{
    abac_id_credential_t *id_cred=NULL;
    HASH_FIND_STR(abac_session->id_creds, keyid, id_cred);
    return id_cred;
}

void abac_id_credential_free(abac_id_credential_t *ptr)
{
    char *keyid=ptr->hashkeyid;
    int found=0;

    DEBUG_PRINTF("abac_id_credential_free: keyid(%s)\n", keyid);

    char *cur=NULL;
    abac_list_foreach(abac_session->id_hashkeyid_list, cur,
        if(strcmp(cur,keyid)==0) {
            found=1;
            break;
        }
    );
    assert(found==1); // big panic

    // this is very tricky...
    int last=abac_id_lastone(ptr->id);
    if(!last) {
        abac_id_free(ptr->id);
        } else {
            DEBUG_PRINTF("abac_id_credential_free: deleting id (%s)(%s)\n",abac_id_name(ptr->id), cur);
            abac_list_remove(abac_session->id_hashkeyid_list, cur);
            free(cur);

            free(ptr->hashkeyid);
            abac_id_free(ptr->id);
            HASH_DEL(abac_session->id_creds, ptr);
            free(ptr);
    }
}

/****************************************************************/
/**
 * abac_credential_t                                
**/

abac_credential_t *abac_credential_new(abac_attribute_t *attr, char* key)
{
    abac_credential_t *cred = abac_xmalloc(sizeof(abac_credential_t));
    cred->hashkeyid=abac_xstrdup(key);
    cred->attr=abac_attribute_dup(attr);
    return cred;
}

abac_attribute_t *abac_credential_attribute(abac_credential_t *ptr)
{
    assert(ptr!=NULL);
    return ptr->attr;
}

abac_credential_t *abac_credential_dup(abac_credential_t *ptr)
{
    assert(ptr != NULL);
    abac_attribute_dup(ptr->attr);
    return ptr;
}

void abac_add_cred(abac_credential_t *cred)
{
    HASH_ADD_KEYPTR(hh, abac_session->attr_creds, cred->hashkeyid,
                                         strlen(cred->hashkeyid), cred);
    abac_list_add(abac_session->attr_hashkeyid_list,
                                     abac_xstrdup(cred->hashkeyid));

    DEBUG_PRINTF("-->adding into master attr_creds, key(%s)..idx(%d)sz(%d)\n",
          abac_decode_string(cred->hashkeyid), HASH_COUNT(abac_session->attr_creds),
          abac_list_size(abac_session->attr_hashkeyid_list));
}


abac_aspect_t *abac_credential_head(abac_credential_t *cred)
{
    return abac_attribute_head(cred->attr);
}

abac_aspect_t *abac_credential_tail(abac_credential_t *cred) 
{
    return abac_attribute_tail(cred->attr);
}

char *abac_credential_hashkey(abac_credential_t *ptr)
{
    assert(ptr);
    return ptr->hashkeyid;
}

abac_credential_t *abac_check_cred(char *keyid)
{
    abac_credential_t *cred=NULL;
    HASH_FIND_STR(abac_session->attr_creds, keyid, cred);
    return cred;
}

/**
 * Decrease the reference count of a credential, freeing it when it reaches 0.
 */
void abac_credential_free(abac_credential_t *ptr)
{
    /* first make sure it is there */
    char *keyid=ptr->hashkeyid;
    int found=0;

    DEBUG_PRINTF("abac_credential_free: keyid(%s)\n", keyid);

    char *cur;
    abac_list_foreach(abac_session->attr_hashkeyid_list, cur,
        if(strcmp(cur,keyid)==0) {
            found=1;
            break;
        }
    );
    assert(found==1); // big panic

    // this is very tricky...
    int last=abac_attribute_lastone(ptr->attr);
    if(!last) {
        abac_attribute_free(ptr->attr);
        } else {

            abac_list_remove(abac_session->attr_hashkeyid_list, cur);
            free(cur);

            DEBUG_PRINTF("abac_credential_free: real free for (%d)\n",(int) ptr);
            free(ptr->hashkeyid);
            abac_attribute_free(ptr->attr);
            HASH_DEL(abac_session->attr_creds, ptr);
            free(ptr);
    }
}

/****************************************************************/
void abac_print_cred_info(abac_credential_t *cred, FILE *fp)
{
    if(fp == NULL)
        fp=stdout;

    abac_attribute_t *ptr=cred->attr;
    abac_aspect_t *head=abac_attribute_head(ptr);
    abac_aspect_t *tail=abac_attribute_tail(ptr);

    fprintf(fp," ");
    abac_print_aspect_string_with_condition(head,fp);
    fprintf(fp," <- ");
    abac_print_aspect_string_with_condition(tail,fp);
    fprintf(fp,"\n");
}

void abac_print_prin_info(abac_id_credential_t *prin, FILE *fp)
{
    if(fp == NULL)
        fp=stdout;

    abac_id_t *ptr=abac_id_credential_id(prin);
    if(abac_id_has_privkey(ptr))
        fprintf(fp," [%s,%s] #y\n",abac_id_idtype_string(ptr), abac_id_name(ptr));
        else
            fprintf(fp," [%s,%s] #n\n", abac_id_idtype_string(ptr), abac_id_name(ptr));
}

void abac_print_typed_cred_info(abac_credential_t *cred, FILE *fp)
{
    if(fp == NULL)
        fp=stdout;

    abac_attribute_t *ptr=cred->attr;
    abac_aspect_t *head=abac_attribute_head(ptr);
    abac_aspect_t *tail=abac_attribute_tail(ptr);

    fprintf(fp," ");
    abac_print_aspect_typed_string_with_condition(head,fp);
    fprintf(fp," <- ");
    abac_print_aspect_typed_string_with_condition(tail,fp);
    fprintf(fp,"\n");
}


/* not duplicated */
abac_credential_t *abac_credential_lookup(char* cred_string)
{
    assert(cred_string);
    DEBUG_PRINTF("abac_credential_lookup: looking for (%s)\n", cred_string);
    abac_credential_t *attr_cred;
    HASH_FIND_STR(abac_session->attr_creds, cred_string, attr_cred);
    if (attr_cred == NULL) {
        DEBUG_PRINTF("abac_credential_lookup:NOT FOUND..\n");
        return NULL;
    }
    DEBUG_PRINTF("abac_credential_lookup:FOUND, looking for (%s)\n", cred_string);
    abac_credential_t *rt=attr_cred;
    return rt;
}

/* not duplicated */
abac_id_credential_t *abac_id_credential_lookup(char* name)
{
    assert(name);
    DEBUG_PRINTF("abac_id_credential_lookup: looking for (%s)\n", name);
    abac_id_credential_t *id_cred;
    HASH_FIND_STR(abac_session->id_creds, name, id_cred);
    if (id_cred == NULL) {
        DEBUG_PRINTF("abac_id_credential_lookup:NOT FOUND..\n");
        return NULL;
    }
    DEBUG_PRINTF("  --> sha is (%s)\n", abac_id_keyid(id_cred->id));
    DEBUG_PRINTF("  --> cn is (%s)\n", abac_id_cn(id_cred->id));
    return id_cred;
}

/* collect all the creds stored so far for the session */
abac_stack_t *abac_dump_creds()
{
    abac_stack_t *cred_list = abac_stack_new();

    int cnt=0;
    if(abac_session->attr_hashkeyid_list) {
        char *keyid;
        abac_credential_t *cred;
        abac_list_foreach(abac_session->attr_hashkeyid_list, keyid,
            cred=abac_credential_lookup(keyid);
            abac_stack_push(cred_list, cred);
            cnt++;
        );
    }
    DEBUG_PRINTF("abac_dump_cred: %d\n",cnt);
    return cred_list;
}


/* collect all the id creds stored so far for the session */
abac_stack_t *abac_dump_principals()
{
    abac_stack_t *id_list = abac_stack_new();

    int cnt=0;
    if(abac_session->id_hashkeyid_list) {
        char *keyid;
        abac_id_credential_t *id;
        abac_list_foreach(abac_session->id_hashkeyid_list, keyid,
            id=abac_id_credential_lookup(keyid);
            abac_stack_push(id_list, id);
            cnt++;
        );
    }
    DEBUG_PRINTF("abac_dump_principals: %d\n",cnt);
    return id_list;
}

/**
 * Return the encoding of the attribute cert.
 */
abac_chunk_t abac_credential_attribute_cert(abac_credential_t *cred) {
    abac_attribute_t *ptr=cred->attr;
    certificate_t *cert=abac_attribute_cert(ptr);
    chunk_t encoding = chunk_empty;
    int rc=cert->get_encoding(cert,CERT_ASN1_DER,&encoding);
    abac_chunk_t ret = { encoding.ptr, encoding.len };
    return ret;
}

/**
 * Return the encoding of the issuer cert.
 */
abac_chunk_t abac_credential_issuer_cert(abac_credential_t *cred)
{
    certificate_t *issuer_cert=abac_attribute_issuer_cert(cred->attr);
    assert(issuer_cert);
    chunk_t encoding = chunk_empty;
// XXX MEI, not sure ??
    int rc=issuer_cert->get_encoding(issuer_cert,CERT_ASN1_DER,&encoding);
    abac_chunk_t ret = { encoding.ptr, encoding.len };
    return ret;
}


/****************************************************************/

void abac_verifier_session_new() 
{
    assert(abac_session==NULL);
    abac_session = abac_xmalloc(sizeof(abac_verifier_session_t));
    abac_session->stub=abac_xstrdup("abac_");
    abac_session->contexts=abac_list_new();

    abac_session->attr_hashkeyid_list = abac_list_new();
    abac_session->id_hashkeyid_list = abac_list_new();
    abac_session->id_creds=NULL;
    abac_session->attr_creds=NULL;
 
    abac_pl_init();
}

void abac_verifier_session_free() 
{
    DEBUG_PRINTF("abac_verifier_session_free: freeing...\n");
    if(abac_session->stub) free(abac_session->stub);

    int size=abac_list_size(abac_session->contexts);
    if(size) {
        abac_context_t *cur;
        abac_stack_t *tmp=abac_stack_new();
        abac_list_foreach(abac_session->contexts, cur,
            if(cur) abac_stack_push(tmp,cur);
        );
        while(size) {
            cur=(abac_context_t *) abac_stack_pop(tmp);
            abac_context_free(cur);
            size--;
        }
        abac_stack_free(tmp);
    }
    abac_list_free(abac_session->contexts);

    abac_id_credential_t *ptr;
    int id_sz=abac_list_size(abac_session->id_hashkeyid_list);
    DEBUG_PRINTF("abac_verifier_session_free: number of ids(%d)\n",id_sz);
    while ((ptr = abac_session->id_creds) != NULL) {
        DEBUG_PRINTF("abac_verifier_session_free: deleting id (%s)\n",abac_id_name(ptr->id));
        HASH_DEL(abac_session->id_creds, ptr);
        free(ptr->hashkeyid);
        abac_id_free(ptr->id);
        free(ptr);
    }

    abac_credential_t *ptr2;
    int attr_sz=abac_list_size(abac_session->attr_hashkeyid_list);
    DEBUG_PRINTF("abac_verifier_session_free: number of attrs(%d)\n",attr_sz);
    while ((ptr2 = abac_session->attr_creds) != NULL) {
        HASH_DEL(abac_session->attr_creds, ptr2);
        DEBUG_PRINTF("abac_verifier_session_free: deleting attr hashkey(%s)\n",ptr2->hashkeyid);
        free(ptr2->hashkeyid); 
        abac_attribute_free(ptr2->attr); 
        free(ptr2);
    }

    if(abac_session->attr_hashkeyid_list) {
        DEBUG_PRINTF("looking to free attr_hashkeyid_list..\n");
        char *cur;
        abac_list_foreach(abac_session->attr_hashkeyid_list, cur,
            if(cur) free(cur);
        );
        abac_list_free(abac_session->attr_hashkeyid_list);
    }

    if(abac_session->id_hashkeyid_list) {
        DEBUG_PRINTF("looking to free id_hashkeyid_list..\n");
        char *cur;
        abac_list_foreach(abac_session->id_hashkeyid_list, cur,
            if(cur) {
               DEBUG_PRINTF("hum.. id hashkey being freed.. %s\n", cur);
               free(cur);
            }
        );
        abac_list_free(abac_session->id_hashkeyid_list);
    }
    free(abac_session);
    abac_session=NULL;
}

/* long int random(void); */
char *abac_verifier_session_next_namespace()
{
    char *tmp=NULL;
    asprintf(&tmp,"%s_%ld",abac_session->stub,random());
    return tmp;
}

void abac_verifier_session_add_context(abac_context_t *ctx)
{
    abac_list_add(abac_session->contexts, ctx);
}

void abac_verifier_session_dump()
{
     printf("....SESSION....\n");
     int cnt=abac_list_size(abac_session->contexts);
     abac_context_t *cur;
     abac_list_foreach(abac_session->contexts, cur,
        if(cur) abac_context_dump(cur);
     );
}

int abac_verifier_session_remove_context(abac_context_t *ctx)
{
    int rc=abac_list_remove(abac_session->contexts, ctx);
    if(rc!=1) {
        DEBUG_PRINTF("abac_verifier_session_remove_context, ??? did not find context\n");
        exit(ABAC_VERIFIER_UNKNOWN_CONTEXT);
    }
    return rc;
}

abac_context_t *abac_verifier_session_context_lookup(char *namespace)
{
    abac_context_t  *cur;
    abac_list_foreach(abac_session->contexts, cur,
           if(strcmp(abac_context_namespace(cur),namespace)==0)
               return cur;
    );
    return NULL;
}

/****************************************************************/
int abac_verify_idtype_type(char *type) {
    if (type == NULL) return 0;
    return abac_idtype_lookup(type);
}

// verify that cert was issued by issuer
// cert and issuer can be the same, in which case the self-sig is validated
int verify_signature(certificate_t *issuer_cert, certificate_t *cert)
{
/** XXX for strongswan 5.0.1 
    if (cert->issued_by(cert, issuer_cert, NULL))
*/
    if (cert->issued_by(cert, issuer_cert))
        if (cert->get_validity(cert, NULL, NULL, NULL)) {
            return 1;
        }
    return 0;
}

/**
 * Init the verifier subsystem.
 */
void abac_verifier_init(void) {
    // silence all debugging

    DEBUG_PRINTF("abac_verifier_init... init strongswan..\n");
    if (!library_init(NULL))
        exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);

    if (!lib->plugins->load(lib->plugins, NULL,
            lib->settings->get_str(lib->settings, "pki.load", PLUGINS)))
        exit(SS_RC_INITIALIZATION_FAILED);

    abac_verifier_session_new();
}

/**
 * Uninitialize the system, free up any allocated memory.
 */
void abac_verifier_deinit(void) {
    DEBUG_PRINTF("abac_verifier_deinit... being called..\n");
    abac_verifier_session_free();
/* XXX crashs in swig/python?java, it is as some threads before
   getting into library deinit */
    if(!hack) {
        DEBUG_PRINTF("now it is time to deinit strongswan lib..\n");
        library_deinit();
    }
}