common/AccessCondition.cpp

   1 /*
   2  * Copyright (c) 2012, 2013 Samsung Electronics Co., Ltd.
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  * http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 /* standard library header */
  18 #include <stdio.h>
  19
  20 /* SLP library header */
  21
  22 /* local header */
  23 #include "Debug.h"
  24 #include "SimpleTLV.h"
  25 #include "AccessControlList.h"
  26 #include "AccessCondition.h"
  27
  28 namespace smartcard_service_api
  29 {
  30         void AccessRule::addAPDUAccessRule(const ByteArray &apdu,
  31                 const ByteArray &mask)
  32         {
  33                 pair<ByteArray, ByteArray> item(apdu, mask);
  34
  35                 listFilters.push_back(item);
  36         }
  37
  38         bool AccessRule::isAuthorizedAPDUAccess(const ByteArray &command)
  39         {
  40                 bool result = false;
  41
  42                 if (command.getLength() < 4) /* apdu header size */
  43                         return false;
  44
  45                 if (listFilters.size() > 0)
  46                 {
  47                         unsigned int cmd, mask, rule;
  48                         vector<pair<ByteArray, ByteArray> >::iterator item;
  49
  50                         cmd = *(unsigned int *)command.getBuffer();
  51                         for (item = listFilters.begin(); item != listFilters.end(); item++)
  52                         {
  53                                 mask = *(unsigned int *)item->second.getBuffer();
  54                                 rule = *(unsigned int *)item->first.getBuffer();
  55
  56                                 if ((cmd & mask) == rule)
  57                                 {
  58                                         result = true;
  59                                         break;
  60                                 }
  61                         }
  62                 }
  63                 else
  64                 {
  65                         /* no filter entry. if permission is true, all access will be granted, if not, all access will be denied */
  66                         result = apduRule;
  67                 }
  68
  69                 return result;
  70         }
  71
  72         void AccessRule::printAccessRules()
  73         {
  74                 if (listFilters.size() > 0)
  75                 {
  76                         vector<pair<ByteArray, ByteArray> >::iterator item;
  77
  78                         _DBG("         +---- Granted APDUs");
  79
  80                         for (item = listFilters.begin(); item != listFilters.end(); item++)
  81                         {
  82                                 _DBG("         +----- APDU : %s, Mask : %s", item->first.toString(), item->second.toString());
  83                         }
  84                 }
  85                 else
  86                 {
  87                         _DBG("         +---- APDU Access ALLOW : %s", apduRule ? "ALWAYS" : "NEVER");
  88                 }
  89
  90                 _DBG("         +---- NFC  Access ALLOW : %s", nfcRule ? "ALWAYS" : "NEVER");
  91         }
  92
  93         bool AccessRule::isAuthorizedNFCAccess(void)
  94         {
  95                 return nfcRule;
  96         }
  97
  98         AccessRule *AccessCondition::getAccessRule(const ByteArray &certHash)
  99         {
 100                 AccessRule *result = NULL;
 101                 map<ByteArray, AccessRule>::iterator item;
 102
 103                 item = mapRules.find(certHash);
 104                 if (item != mapRules.end()) {
 105                         result = &item->second;
 106                 }
 107
 108                 return result;
 109         }
 110
 111         void AccessCondition::addAccessRule(const ByteArray &hash)
 112         {
 113                 AccessRule rule;
 114
 115                 pair<ByteArray, AccessRule> item(hash, rule);
 116
 117                 mapRules.insert(item);
 118         }
 119
 120         bool AccessCondition::isAuthorizedAccess(const ByteArray &certHash)
 121         {
 122                 bool result = false;
 123                 map<ByteArray, AccessRule>::iterator item;
 124
 125                 item = mapRules.find(certHash);
 126                 if (item != mapRules.end())
 127                 {
 128                         result = true;
 129                 }
 130                 else
 131                 {
 132                         /* TODO */
 133                         result = permission;
 134                 }
 135
 136                 return result;
 137         }
 138
 139         void AccessCondition::printAccessConditions()
 140         {
 141                 _DBG("   +-- Access Condition");
 142
 143                 if (mapRules.size() > 0)
 144                 {
 145                         map<ByteArray, AccessRule>::iterator item;
 146
 147                         for (item = mapRules.begin(); item != mapRules.end(); item++)
 148                         {
 149                                 ByteArray temp = item->first;
 150
 151                                 _DBG("   +--- hash : %s", (temp == AccessControlList::ALL_DEVICE_APPS) ? "All device applications" : temp.toString());
 152                                 item->second.printAccessRules();
 153                         }
 154                 }
 155                 else
 156                 {
 157                         _DBG("   +--- permission : %s", permission ? "granted all" : "denied all");
 158                 }
 159         }
 160
 161         void AccessCondition::setAPDUAccessRule(const ByteArray &certHash,
 162                 bool rule)
 163         {
 164                 AccessRule *access = getAccessRule(certHash);
 165
 166                 if (access != NULL) {
 167                         access->setAPDUAccessRule(rule);
 168                 }
 169         }
 170
 171         void AccessCondition::addAPDUAccessRule(const ByteArray &certHash,
 172                 const ByteArray &apdu, const ByteArray &mask)
 173         {
 174                 AccessRule *access = getAccessRule(certHash);
 175
 176                 if (access != NULL) {
 177                         access->addAPDUAccessRule(apdu, mask);
 178                 }
 179         }
 180
 181         void AccessCondition::addAPDUAccessRule(const ByteArray &certHash,
 182                 const ByteArray &rule)
 183         {
 184                 if (rule.getLength() != 8)
 185                         return;
 186
 187                 addAPDUAccessRule(certHash, rule.sub(0, 4), rule.sub(4, 4));
 188         }
 189
 190         void AccessCondition::setNFCAccessRule(const ByteArray &certHash,
 191                         bool rule)
 192         {
 193                 AccessRule *access = getAccessRule(certHash);
 194
 195                 if (access != NULL) {
 196                         access->setNFCAccessRule(rule);
 197                 }
 198         }
 199
 200         bool AccessCondition::isAuthorizedAPDUAccess(const ByteArray &certHash,
 201                 const ByteArray &command)
 202         {
 203                 bool result = false;
 204                 AccessRule *access = getAccessRule(certHash);
 205
 206                 if (access != NULL) {
 207                         result = access->isAuthorizedAPDUAccess(command);
 208                 }
 209
 210                 return result;
 211         }
 212
 213         bool AccessCondition::isAuthorizedNFCAccess(const ByteArray &certHash)
 214         {
 215                 bool result = false;
 216                 AccessRule *access = getAccessRule(certHash);
 217
 218                 if (access != NULL) {
 219                         result = access->isAuthorizedNFCAccess();
 220                 }
 221
 222                 return result;
 223         }
 224 } /* namespace smartcard_service_api */