resource/csdk/security/src/aclresource.c

   1 //******************************************************************
   2 //
   3 // Copyright 2015 Intel Mobile Communications GmbH All Rights Reserved.
   4 //
   5 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   6 //
   7 // Licensed under the Apache License, Version 2.0 (the "License");
   8 // you may not use this file except in compliance with the License.
   9 // You may obtain a copy of the License at
  10 //
  11 //      http://www.apache.org/licenses/LICENSE-2.0
  12 //
  13 // Unless required by applicable law or agreed to in writing, software
  14 // distributed under the License is distributed on an "AS IS" BASIS,
  15 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16 // See the License for the specific language governing permissions and
  17 // limitations under the License.
  18 //
  19 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  20
  21 #include "iotivity_config.h"
  22 #ifdef HAVE_STRING_H
  23 #include <string.h>
  24 #elif defined(HAVE_STRINGS_H)
  25 #include <strings.h>
  26 #endif
  27 #include <stdlib.h>
  28
  29 #include "utlist.h"
  30 #include "ocstack.h"
  31 #include "octypes.h"
  32 #include "ocserverrequest.h"
  33 #include "oic_malloc.h"
  34 #include "oic_string.h"
  35 #include "ocrandom.h"
  36 #include "ocpayload.h"
  37 #include "utlist.h"
  38 #include "payload_logging.h"
  39 #include "srmresourcestrings.h"
  40 #include "aclresource.h"
  41 #include "doxmresource.h"
  42 #include "resourcemanager.h"
  43 #include "srmutility.h"
  44 #include "psinterface.h"
  45 #include "ocpayloadcbor.h"
  46
  47 #include "security_internals.h"
  48
  49 #define TAG  "SRM-ACL"
  50 #define NUMBER_OF_SEC_PROV_RSCS 4
  51 #define NUMBER_OF_DEFAULT_SEC_RSCS 2
  52 #define STRING_UUID_SIZE (UUID_LENGTH * 2 + 5)
  53
  54 static const uint8_t ACL_MAP_SIZE = 4;
  55 static const uint8_t ACL_ACLIST_MAP_SIZE = 1;
  56 static const uint8_t ACL_ACES_MAP_SIZE = 3;
  57 static const uint8_t ACL_RESOURCE_MAP_SIZE = 3;
  58
  59
  60 // CborSize is the default cbor payload size being used.
  61 static const uint16_t CBOR_SIZE = 2048*8;
  62
  63 static OicSecAcl_t *gAcl = NULL;
  64 static OCResourceHandle gAclHandle = NULL;
  65
  66 void FreeRsrc(OicSecRsrc_t *rsrc)
  67 {
  68     //Clean each member of resource
  69     OICFree(rsrc->href);
  70     OICFree(rsrc->rel);
  71     //Clean "rt"
  72     if(0 < rsrc->typeLen && rsrc->types)
  73     {
  74         for(size_t i = 0; i < rsrc->typeLen; i++)
  75         {
  76             OICFree(rsrc->types[i]);
  77         }
  78         OICFree(rsrc->types);
  79         rsrc->types = NULL;
  80     }
  81     //Clean "if"
  82     if(0 < rsrc->interfaceLen && rsrc->interfaces)
  83     {
  84         for(size_t i = 0; i < rsrc->interfaceLen; i++)
  85         {
  86             OICFree(rsrc->interfaces[i]);
  87         }
  88         OICFree(rsrc->interfaces);
  89         rsrc->interfaces = NULL;
  90     }
  91     OICFree(rsrc);
  92     rsrc = NULL;
  93 }
  94
  95 /**
  96  * This function frees OicSecAcl_t object's fields and object itself.
  97  */
  98 static void FreeACE(OicSecAce_t *ace)
  99 {
 100     if (NULL == ace)
 101     {
 102         OIC_LOG(ERROR, TAG, "Invalid Parameter");
 103         return;
 104     }
 105
 106     //Clean Resources
 107     OicSecRsrc_t* rsrc = NULL;
 108     OicSecRsrc_t* tmpRsrc = NULL;
 109     LL_FOREACH_SAFE(ace->resources, rsrc, tmpRsrc)
 110     {
 111         LL_DELETE(ace->resources, rsrc);
 112         FreeRsrc(rsrc);
 113     }
 114
 115     //Clean Validities
 116     OicSecValidity_t *validity = NULL;
 117     OicSecValidity_t *tmpValidity = NULL;
 118     LL_FOREACH_SAFE(ace->validities, validity, tmpValidity)
 119     {
 120         LL_DELETE(ace->validities, validity);
 121
 122         //Clean period
 123         OICFree(validity->period);
 124
 125         //Clean recurrence
 126         for(size_t i = 0; i < validity->recurrenceLen; i++)
 127         {
 128             OICFree(validity->recurrences[i]);
 129         }
 130         OICFree(validity->recurrences);
 131         OICFree(validity);
 132         validity = NULL;
 133     }
 134
 135     //Clean ACE
 136     OICFree(ace);
 137     ace = NULL;
 138 }
 139
 140 void DeleteACLList(OicSecAcl_t* acl)
 141 {
 142     if (acl)
 143     {
 144         OicSecAce_t *ace = NULL;
 145         OicSecAce_t *tmpAce = NULL;
 146         LL_FOREACH_SAFE(acl->aces, ace, tmpAce)
 147         {
 148             LL_DELETE(acl->aces, ace);
 149             FreeACE(ace);
 150         }
 151         acl->aces = NULL;
 152         OICFree(acl);
 153     }
 154 }
 155
 156 OicSecAce_t* DuplicateACE(const OicSecAce_t* ace)
 157 {
 158     OicSecAce_t* newAce = NULL;
 159     size_t allocateSize = 0;
 160
 161     if(ace)
 162     {
 163         newAce = (OicSecAce_t*)OICCalloc(1, sizeof(OicSecAce_t));
 164         VERIFY_NON_NULL(TAG, newAce, ERROR);
 165
 166         //Subject uuid
 167         memcpy(&newAce->subjectuuid, &ace->subjectuuid, sizeof(OicUuid_t));
 168
 169         OicSecRsrc_t* rsrc = NULL;
 170         LL_FOREACH(ace->resources, rsrc)
 171         {
 172             OicSecRsrc_t* newRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
 173             VERIFY_NON_NULL(TAG, newRsrc, ERROR);
 174             LL_APPEND(newAce->resources, newRsrc);
 175
 176             //href is mandatory
 177             VERIFY_NON_NULL(TAG, rsrc->href, ERROR);
 178             allocateSize = strlen(rsrc->href) + 1;
 179             newRsrc->href = (char*)OICMalloc(sizeof(char) * allocateSize);
 180             VERIFY_NON_NULL(TAG, newRsrc->href, ERROR);
 181             OICStrcpy(newRsrc->href, allocateSize, rsrc->href);
 182
 183             if(rsrc->rel)
 184             {
 185                 allocateSize = strlen(rsrc->rel) + 1;
 186                 newRsrc->rel = (char*)OICMalloc(sizeof(char) * allocateSize);
 187                 VERIFY_NON_NULL(TAG, newRsrc->rel, ERROR);
 188                 OICStrcpy(newRsrc->rel, allocateSize, rsrc->rel);
 189             }
 190
 191             if(rsrc->types && 0 < rsrc->typeLen)
 192             {
 193                 newRsrc->typeLen = rsrc->typeLen;
 194                 newRsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
 195                 VERIFY_NON_NULL(TAG, (newRsrc->types), ERROR);
 196                 for(size_t i = 0; i < rsrc->typeLen; i++)
 197                 {
 198                     newRsrc->types[i] = OICStrdup(rsrc->types[i]);
 199                     VERIFY_NON_NULL(TAG, (newRsrc->types[i]), ERROR);
 200                 }
 201             }
 202
 203             if(rsrc->interfaces && 0 < rsrc->interfaceLen)
 204             {
 205                 newRsrc->interfaceLen = rsrc->interfaceLen;
 206                 newRsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
 207                 VERIFY_NON_NULL(TAG, (newRsrc->interfaces), ERROR);
 208                 for(size_t i = 0; i < rsrc->interfaceLen; i++)
 209                 {
 210                     newRsrc->interfaces[i] = OICStrdup(rsrc->interfaces[i]);
 211                     VERIFY_NON_NULL(TAG, (newRsrc->interfaces[i]), ERROR);
 212                 }
 213             }
 214         }
 215
 216         //Permission
 217         newAce->permission = ace->permission;
 218
 219         //Validity
 220         if(ace->validities)
 221         {
 222             OicSecValidity_t* validity = NULL;
 223             LL_FOREACH(ace->validities, validity)
 224             {
 225                 OicSecValidity_t* newValidity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
 226                 VERIFY_NON_NULL(TAG, newValidity, ERROR);
 227                 LL_APPEND(newAce->validities, newValidity);
 228
 229                 if(validity->period)
 230                 {
 231                     allocateSize = strlen(validity->period) + 1;
 232                     newValidity->period = (char*)OICMalloc(sizeof(char) * allocateSize);
 233                     VERIFY_NON_NULL(TAG, newValidity->period, ERROR);
 234                     OICStrcpy(newValidity->period, allocateSize, validity->period);
 235                 }
 236
 237                 if(validity->recurrences && 0 < validity->recurrenceLen)
 238                 {
 239                     newValidity->recurrenceLen = validity->recurrenceLen;
 240
 241                     newValidity->recurrences = (char**)OICMalloc(sizeof(char*) * validity->recurrenceLen);
 242                     VERIFY_NON_NULL(TAG, newValidity->recurrences, ERROR);
 243
 244                     for(size_t i = 0; i < validity->recurrenceLen; i++)
 245                     {
 246                         allocateSize = strlen(validity->recurrences[i]) + 1;
 247                         newValidity->recurrences[i] = (char*)OICMalloc(sizeof(char) * allocateSize);
 248                         VERIFY_NON_NULL(TAG, (newValidity->recurrences[i]), ERROR);
 249                         OICStrcpy(newValidity->recurrences[i], allocateSize, validity->recurrences[i]);
 250                     }
 251                 }
 252             }
 253         }
 254
 255         newAce->next = NULL;
 256     }
 257
 258     return newAce;
 259
 260 exit:
 261     FreeACE(newAce);
 262     return NULL;
 263 }
 264
 265 static size_t OicSecAclSize(const OicSecAcl_t *secAcl)
 266 {
 267     if (!secAcl)
 268     {
 269         return 0;
 270     }
 271     OicSecAce_t *ace= (OicSecAce_t *)secAcl->aces;
 272     size_t size = 0;
 273     while (ace)
 274     {
 275        size++;
 276        ace = ace->next;
 277     }
 278     return size;
 279 }
 280
 281 OCStackResult AclToCBORPayload(const OicSecAcl_t *secAcl, uint8_t **payload, size_t *size)
 282 {
 283      if (NULL == secAcl || NULL == payload || NULL != *payload || NULL == size)
 284     {
 285         return OC_STACK_INVALID_PARAM;
 286     }
 287
 288     OCStackResult ret = OC_STACK_ERROR;
 289     CborError cborEncoderResult = CborNoError;
 290     OicSecAcl_t *acl = (OicSecAcl_t *)secAcl;
 291     OicSecAce_t* ace = NULL;
 292     CborEncoder encoder;
 293     CborEncoder aclMap;
 294     CborEncoder aclListMap;
 295     CborEncoder acesArray;
 296     uint8_t *outPayload = NULL;
 297     size_t cborLen = *size;
 298     *size = 0;
 299     *payload = NULL;
 300
 301     if (cborLen == 0)
 302     {
 303         cborLen = CBOR_SIZE;
 304     }
 305
 306     outPayload = (uint8_t *)OICCalloc(1, cborLen);
 307     VERIFY_NON_NULL(TAG, outPayload, ERROR);
 308     cbor_encoder_init(&encoder, outPayload, cborLen, 0);
 309
 310     // Create ACL Map (aclist, rownerid)
 311     cborEncoderResult = cbor_encoder_create_map(&encoder, &aclMap, ACL_MAP_SIZE);
 312     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACL Map.");
 313
 314     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_ACLIST_NAME,
 315         strlen(OIC_JSON_ACLIST_NAME));
 316     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding aclist Name Tag.");
 317
 318     // Create ACLIST Map (aces)
 319     cborEncoderResult = cbor_encoder_create_map(&aclMap, &aclListMap, ACL_ACLIST_MAP_SIZE);
 320     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACLIST Map.");
 321
 322     cborEncoderResult = cbor_encode_text_string(&aclListMap, OIC_JSON_ACES_NAME,
 323         strlen(OIC_JSON_ACES_NAME));
 324     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding ACES Name Tag.");
 325
 326     // Create ACES Array
 327     cborEncoderResult = cbor_encoder_create_array(&aclListMap, &acesArray, OicSecAclSize(secAcl));
 328     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACES Array.");
 329
 330     ace = NULL;
 331     LL_FOREACH (acl->aces, ace)
 332     {
 333         CborEncoder oicSecAclMap;
 334         // ACL Map size - Number of mandatory items
 335         uint8_t aclMapSize = ACL_ACES_MAP_SIZE;
 336         size_t inLen = 0;
 337
 338         OicSecValidity_t* validityElts = ace->validities;
 339         while(validityElts)
 340         {
 341             if(validityElts->period)
 342             {
 343                 aclMapSize++;
 344             }
 345             if(validityElts->recurrences)
 346             {
 347                 aclMapSize++;
 348             }
 349         }
 350
 351 #ifdef _ENABLE_MULTIPLE_OWNER_
 352         if(ace->eownerID)
 353         {
 354             aclMapSize++;
 355         }
 356 #endif //_ENABLE_MULTIPLE_OWNER_
 357
 358         cborEncoderResult = cbor_encoder_create_map(&acesArray, &oicSecAclMap, aclMapSize);
 359         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACES Map");
 360
 361         // Subject -- Mandatory
 362         cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_SUBJECTID_NAME,
 363             strlen(OIC_JSON_SUBJECTID_NAME));
 364         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Subject Name Tag.");
 365         inLen = (memcmp(&(ace->subjectuuid), &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t)) == 0) ?
 366             WILDCARD_SUBJECT_ID_LEN : sizeof(OicUuid_t);
 367         if(inLen == WILDCARD_SUBJECT_ID_LEN)
 368         {
 369             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, WILDCARD_RESOURCE_URI,
 370                 strlen(WILDCARD_RESOURCE_URI));
 371             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Subject Id wildcard Value.");
 372         }
 373         else
 374         {
 375             char *subject = NULL;
 376             ret = ConvertUuidToStr(&ace->subjectuuid, &subject);
 377             VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 378             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, subject, strlen(subject));
 379             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Subject UUID Value.");
 380             OICFree(subject);
 381         }
 382
 383         // Resources
 384         {
 385             CborEncoder resources;
 386             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_RESOURCES_NAME,
 387                 strlen(OIC_JSON_RESOURCES_NAME));
 388             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Resource Name Tag.");
 389
 390             size_t rsrcLen = 0;
 391             OicSecRsrc_t* rsrcElts = NULL;
 392             LL_FOREACH(ace->resources, rsrcElts)
 393             {
 394                 rsrcLen++;
 395             }
 396
 397             cborEncoderResult = cbor_encoder_create_array(&oicSecAclMap, &resources, rsrcLen);
 398             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Resource Name Array.");
 399
 400             OicSecRsrc_t* rsrc = NULL;
 401             LL_FOREACH(ace->resources, rsrc)
 402             {
 403
 404                 CborEncoder rMap;
 405                 size_t rsrcMapSize = ACL_RESOURCE_MAP_SIZE;
 406                 if(rsrc->rel)
 407                 {
 408                     rsrcMapSize++;
 409                 }
 410
 411                 cborEncoderResult = cbor_encoder_create_map(&resources, &rMap, rsrcMapSize);
 412                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Resource Map.");
 413
 414                 //href -- Mandatory
 415                 VERIFY_NON_NULL(TAG, rsrc->href, ERROR);
 416                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_HREF_NAME,
 417                         strlen(OIC_JSON_HREF_NAME));
 418                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding HREF Name Tag.");
 419                 cborEncoderResult = cbor_encode_text_string(&rMap, rsrc->href, strlen(rsrc->href));
 420                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding HREF Value in Map.");
 421
 422                 //resource type -- Mandatory
 423                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_RT_NAME,
 424                         strlen(OIC_JSON_RT_NAME));
 425                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Name Tag.");
 426
 427                 CborEncoder resourceTypes;
 428                 cborEncoderResult = cbor_encoder_create_array(&rMap, &resourceTypes, rsrc->typeLen);
 429                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding RT Array.");
 430                 for(size_t i = 0; i < rsrc->typeLen; i++)
 431                 {
 432                     cborEncoderResult = cbor_encode_text_string(&resourceTypes, rsrc->types[i], strlen(rsrc->types[i]));
 433                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Value.");
 434                 }
 435                 cborEncoderResult = cbor_encoder_close_container(&rMap, &resourceTypes);
 436                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing resourceTypes.");
 437
 438                 //interface -- Mandatory
 439                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_IF_NAME,
 440                         strlen(OIC_JSON_IF_NAME));
 441                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Name Tag.");
 442
 443                 CborEncoder interfaces;
 444                 cborEncoderResult = cbor_encoder_create_array(&rMap, &interfaces, rsrc->interfaceLen);
 445                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding IF Array.");
 446                 for(size_t i = 0; i < rsrc->interfaceLen; i++)
 447                 {
 448                     cborEncoderResult = cbor_encode_text_string(&interfaces, rsrc->interfaces[i], strlen(rsrc->interfaces[i]));
 449                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Value.");
 450                 }
 451                 cborEncoderResult = cbor_encoder_close_container(&rMap, &interfaces);
 452                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing interfaces.");
 453
 454                 //rel
 455                 if(rsrc->rel)
 456                 {
 457                     cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_REL_NAME,
 458                             strlen(OIC_JSON_REL_NAME));
 459                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding REL Name Tag.");
 460                     cborEncoderResult = cbor_encode_text_string(&rMap, rsrc->rel, strlen(rsrc->rel));
 461                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding REL Value.");
 462                 }
 463
 464                 cborEncoderResult = cbor_encoder_close_container(&resources, &rMap);
 465                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Resource Map.");
 466             }
 467             cborEncoderResult = cbor_encoder_close_container(&oicSecAclMap, &resources);
 468             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Resource Name Array.");
 469         }
 470
 471         // Permissions -- Mandatory
 472         cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_PERMISSION_NAME,
 473             strlen(OIC_JSON_PERMISSION_NAME));
 474         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Permission Name Tag.");
 475         cborEncoderResult = cbor_encode_int(&oicSecAclMap, ace->permission);
 476         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Permission Name Value.");
 477
 478         // TODO: Need to verfication for validity
 479         // Validity(Time-interval) -- Not Mandatory
 480         if(ace->validities)
 481         {
 482             size_t validityLen = 0;
 483             validityElts = NULL;
 484             LL_FOREACH(ace->validities, validityElts)
 485             {
 486                 validityLen++;
 487             }
 488
 489             CborEncoder validities;
 490             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_VALIDITY_NAME,
 491                 strlen(OIC_JSON_VALIDITY_NAME));
 492             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validity Tag.");
 493             cborEncoderResult = cbor_encoder_create_array(&oicSecAclMap, &validities, validityLen);
 494             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validities Array.");
 495
 496             //How to add the value w/o "title" using tinycobr...? :(
 497
 498             validityElts = NULL;
 499             LL_FOREACH(ace->validities, validityElts)
 500             {
 501                  CborEncoder validity;
 502                  size_t validitySize = 0;
 503                  if(validityElts->period)
 504                 {
 505                     validitySize++;
 506                 }
 507                 if(validityElts->recurrences)
 508                 {
 509                     validitySize++;
 510                 }
 511
 512                 cborEncoderResult = cbor_encoder_create_array(&validities, &validity, validitySize);
 513                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validity Array.");
 514
 515                 // Period
 516                 if (validityElts->period)
 517                 {
 518                     cborEncoderResult = cbor_encode_text_string(&validity, validityElts->period,
 519                         strlen(validityElts->period));
 520                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Period Value.");
 521                 }
 522
 523                 // Recurrence
 524                 if (validityElts->recurrences)
 525                 {
 526                     CborEncoder recurrences;
 527                     cborEncoderResult = cbor_encoder_create_array(&validity, &recurrences, validityElts->recurrenceLen);
 528                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Recurrence Array.");
 529
 530                     for (size_t i = 0; i < validityElts->recurrenceLen; i++)
 531                     {
 532                         cborEncoderResult = cbor_encode_text_string(&recurrences, validityElts->recurrences[i],
 533                             strlen(validityElts->recurrences[i]));
 534                         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Recurrence Array Value.");
 535                     }
 536                     cborEncoderResult = cbor_encoder_close_container(&validity, &recurrences);
 537                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Recurrence Array");
 538                 }
 539
 540                 cborEncoderResult = cbor_encoder_close_container(&validities, &validity);
 541                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Validity Array.");
 542             }
 543
 544             cborEncoderResult = cbor_encoder_close_container(&oicSecAclMap, &validities);
 545             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Validities Array.");
 546         }
 547
 548 #ifdef _ENABLE_MULTIPLE_OWNER_
 549         // Eownerid -- Not Mandatory
 550         if(ace->eownerID)
 551         {
 552             char *eowner = NULL;
 553             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_EOWNERID_NAME,
 554                 strlen(OIC_JSON_EOWNERID_NAME));
 555             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding eownerId Name Tag.");
 556             ret = ConvertUuidToStr(ace->eownerID, &eowner);
 557             VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 558             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, eowner, strlen(eowner));
 559             OICFree(eowner);
 560             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding eownerId Value.");
 561         }
 562 #endif //_ENABLE_MULTIPLE_OWNER_
 563
 564         cborEncoderResult = cbor_encoder_close_container(&acesArray, &oicSecAclMap);
 565         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACES Map.");
 566     }
 567
 568     // Close ACES Array
 569     cborEncoderResult = cbor_encoder_close_container(&aclListMap, &acesArray);
 570     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACES Array.");
 571
 572     // Close ACLIST Map
 573     cborEncoderResult = cbor_encoder_close_container(&aclMap, &aclListMap);
 574     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACLIST Map.");
 575
 576     // Rownerid
 577     {
 578         char *rowner = NULL;
 579         cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_ROWNERID_NAME,
 580             strlen(OIC_JSON_ROWNERID_NAME));
 581         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding rownerid Name.");
 582         ret = ConvertUuidToStr(&secAcl->rownerID, &rowner);
 583         VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 584         cborEncoderResult = cbor_encode_text_string(&aclMap, rowner, strlen(rowner));
 585         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding rownerid Value.");
 586         OICFree(rowner);
 587     }
 588
 589     //RT -- Mandatory
 590     CborEncoder rtArray;
 591     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_RT_NAME,
 592             strlen(OIC_JSON_RT_NAME));
 593     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Name Tag.");
 594     cborEncoderResult = cbor_encoder_create_array(&aclMap, &rtArray, 1);
 595     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Value.");
 596     for (size_t i = 0; i < 1; i++)
 597     {
 598         cborEncoderResult = cbor_encode_text_string(&rtArray, OIC_RSRC_TYPE_SEC_ACL,
 599                 strlen(OIC_RSRC_TYPE_SEC_ACL));
 600         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding RT Value.");
 601     }
 602     cborEncoderResult = cbor_encoder_close_container(&aclMap, &rtArray);
 603     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing RT.");
 604
 605     //IF-- Mandatory
 606     CborEncoder ifArray;
 607     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_IF_NAME,
 608              strlen(OIC_JSON_IF_NAME));
 609     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Name Tag.");
 610     cborEncoderResult = cbor_encoder_create_array(&aclMap, &ifArray, 1);
 611     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Value.");
 612     for (size_t i = 0; i < 1; i++)
 613     {
 614         cborEncoderResult = cbor_encode_text_string(&ifArray, OC_RSRVD_INTERFACE_DEFAULT,
 615                 strlen(OC_RSRVD_INTERFACE_DEFAULT));
 616         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding IF Value.");
 617     }
 618     cborEncoderResult = cbor_encoder_close_container(&aclMap, &ifArray);
 619     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing IF.");
 620
 621     // Close ACL Map
 622     cborEncoderResult = cbor_encoder_close_container(&encoder, &aclMap);
 623     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACL Map.");
 624
 625     if (CborNoError == cborEncoderResult)
 626     {
 627         OIC_LOG(DEBUG, TAG, "AclToCBORPayload Successed");
 628         *size = encoder.ptr - outPayload;
 629         *payload = outPayload;
 630         ret = OC_STACK_OK;
 631     }
 632 exit:
 633     if (CborErrorOutOfMemory == cborEncoderResult)
 634     {
 635         OIC_LOG(DEBUG, TAG, "AclToCBORPayload:CborErrorOutOfMemory : retry with more memory");
 636
 637         // reallocate and try again!
 638         OICFree(outPayload);
 639         // Since the allocated initial memory failed, double the memory.
 640         cborLen += encoder.ptr - encoder.end;
 641         cborEncoderResult = CborNoError;
 642         ret = AclToCBORPayload(secAcl, payload, &cborLen);
 643         *size = cborLen;
 644     }
 645     else if (cborEncoderResult != CborNoError)
 646     {
 647         OIC_LOG(ERROR, TAG, "Failed to AclToCBORPayload");
 648         OICFree(outPayload);
 649         outPayload = NULL;
 650         *size = 0;
 651         *payload = NULL;
 652         ret = OC_STACK_ERROR;
 653     }
 654
 655     return ret;
 656 }
 657
 658 // This function converts CBOR format to ACL data.
 659 // Caller needs to invoke 'free' when done using
 660 // It parses { "aclist" : [ { ... } ] } instead of { "aclist" : { "aces" : [ ] } }
 661 OicSecAcl_t* CBORPayloadToAcl2(const uint8_t *cborPayload, const size_t size)
 662 {
 663     if (NULL == cborPayload || 0 == size)
 664     {
 665         return NULL;
 666     }
 667     OCStackResult ret = OC_STACK_ERROR;
 668     CborValue aclCbor = { .parser = NULL };
 669     CborParser parser = { .end = NULL };
 670     CborError cborFindResult = CborNoError;
 671     cbor_parser_init(cborPayload, size, 0, &parser, &aclCbor);
 672
 673     OicSecAcl_t *acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
 674
 675     // Enter ACL Map
 676     CborValue aclMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 677     cborFindResult = cbor_value_enter_container(&aclCbor, &aclMap);
 678     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACL Map.");
 679
 680     while (cbor_value_is_valid(&aclMap))
 681     {
 682         char* tagName = NULL;
 683         size_t len = 0;
 684         CborType type = cbor_value_get_type(&aclMap);
 685         if (type == CborTextStringType)
 686         {
 687             cborFindResult = cbor_value_dup_text_string(&aclMap, &tagName, &len, NULL);
 688             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACL Map.");
 689             cborFindResult = cbor_value_advance(&aclMap);
 690             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACL Map.");
 691         }
 692         if(tagName)
 693         {
 694             if (strcmp(tagName, OIC_JSON_ACLIST_NAME)  == 0)
 695             {
 696                 // Enter ACES Array
 697                 CborValue acesArray = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 698                 cborFindResult = cbor_value_enter_container(&aclMap, &acesArray);
 699                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACES Array.");
 700
 701                 int acesCount = 0;
 702                 while (cbor_value_is_valid(&acesArray))
 703                 {
 704                     acesCount++;
 705                     CborValue aceMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 706                     cborFindResult = cbor_value_enter_container(&acesArray, &aceMap);
 707                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACE Map.");
 708
 709                     OicSecAce_t *ace = NULL;
 710                     ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
 711                     VERIFY_NON_NULL(TAG, ace, ERROR);
 712                     LL_APPEND(acl->aces, ace);
 713
 714                     VERIFY_NON_NULL(TAG, acl, ERROR);
 715
 716                     while (cbor_value_is_valid(&aceMap))
 717                     {
 718                         char* name = NULL;
 719                         size_t len = 0;
 720                         CborType type = cbor_value_get_type(&aceMap);
 721                         if (type == CborTextStringType)
 722                         {
 723                             cborFindResult = cbor_value_dup_text_string(&aceMap, &name, &len, NULL);
 724                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACE Map.");
 725                             cborFindResult = cbor_value_advance(&aceMap);
 726                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACE Map.");
 727                         }
 728                         if (name)
 729                         {
 730                             // Subject -- Mandatory
 731                             if (strcmp(name, OIC_JSON_SUBJECTID_NAME)  == 0)
 732                             {
 733                                 char *subject = NULL;
 734                                 cborFindResult = cbor_value_dup_text_string(&aceMap, &subject, &len, NULL);
 735                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding subject Value.");
 736                                 if(strcmp(subject, WILDCARD_RESOURCE_URI) == 0)
 737                                 {
 738                                     ace->subjectuuid.id[0] = '*';
 739                                 }
 740                                 else
 741                                 {
 742                                     OIC_LOG_V(DEBUG, TAG, "Converting subjectuuid = %s to uuid...", subject);
 743                                     ret = ConvertStrToUuid(subject, &ace->subjectuuid);
 744                                     VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 745                                 }
 746                                 OICFree(subject);
 747                             }
 748
 749                             // Resources -- Mandatory
 750                             if (strcmp(name, OIC_JSON_RESOURCES_NAME) == 0)
 751                             {
 752                                 CborValue resources = { .parser = NULL };
 753                                 cborFindResult = cbor_value_enter_container(&aceMap, &resources);
 754                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering a Resource Array.");
 755
 756                                 while (cbor_value_is_valid(&resources))
 757                                 {
 758                                     // rMap
 759                                     CborValue rMap = { .parser = NULL  };
 760                                     cborFindResult = cbor_value_enter_container(&resources, &rMap);
 761                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering Resource Map");
 762
 763                                     OicSecRsrc_t* rsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
 764                                     VERIFY_NON_NULL(TAG, rsrc, ERROR);
 765                                     LL_APPEND(ace->resources, rsrc);
 766
 767                                     while(cbor_value_is_valid(&rMap))
 768                                     {
 769                                         char *rMapName = NULL;
 770                                         size_t rMapNameLen = 0;
 771                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rMapName, &rMapNameLen, NULL);
 772                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Name Tag.");
 773                                         cborFindResult = cbor_value_advance(&rMap);
 774                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Value.");
 775
 776                                         // "href"
 777                                         if (0 == strcmp(OIC_JSON_HREF_NAME, rMapName))
 778                                         {
 779                                             cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->href, &len, NULL);
 780                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Href Value.");
 781                                         }
 782
 783                                         // "rt"
 784                                         if (0 == strcmp(OIC_JSON_RT_NAME, rMapName) && cbor_value_is_array(&rMap))
 785                                         {
 786                                             cbor_value_get_array_length(&rMap, &rsrc->typeLen);
 787                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RT array length.");
 788                                             VERIFY_SUCCESS(TAG, (0 != rsrc->typeLen), ERROR);
 789
 790                                             rsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
 791                                             VERIFY_NON_NULL(TAG, rsrc->types, ERROR);
 792
 793                                             CborValue resourceTypes;
 794                                             cborFindResult = cbor_value_enter_container(&rMap, &resourceTypes);
 795                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering RT Array.");
 796
 797                                             for(size_t i = 0; cbor_value_is_valid(&resourceTypes) && cbor_value_is_text_string(&resourceTypes); i++)
 798                                             {
 799                                                 size_t readLen = 0;
 800                                                 cborFindResult = cbor_value_dup_text_string(&resourceTypes, &(rsrc->types[i]), &readLen, NULL);
 801                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding resource type.");
 802                                                 cborFindResult = cbor_value_advance(&resourceTypes);
 803                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing resource type.");
 804                                             }
 805                                         }
 806
 807                                         // "if"
 808                                         if (0 == strcmp(OIC_JSON_IF_NAME, rMapName) && cbor_value_is_array(&rMap))
 809                                         {
 810                                             cbor_value_get_array_length(&rMap, &rsrc->interfaceLen);
 811                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF array length.");
 812                                             VERIFY_SUCCESS(TAG, (0 != rsrc->interfaceLen), ERROR);
 813
 814                                             rsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
 815                                             VERIFY_NON_NULL(TAG, rsrc->interfaces, ERROR);
 816
 817                                             CborValue interfaces;
 818                                             cborFindResult = cbor_value_enter_container(&rMap, &interfaces);
 819                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering IF Array.");
 820
 821                                             for(size_t i = 0; cbor_value_is_valid(&interfaces) && cbor_value_is_text_string(&interfaces); i++)
 822                                             {
 823                                                 size_t readLen = 0;
 824                                                 cborFindResult = cbor_value_dup_text_string(&interfaces, &(rsrc->interfaces[i]), &readLen, NULL);
 825                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF type.");
 826                                                 cborFindResult = cbor_value_advance(&interfaces);
 827                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing IF type.");
 828                                             }
 829                                         }
 830
 831                                         // "rel"
 832                                         if (0 == strcmp(OIC_JSON_REL_NAME, rMapName))
 833                                         {
 834                                             cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->rel, &len, NULL);
 835                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding REL Value.");
 836                                         }
 837
 838                                         if (cbor_value_is_valid(&rMap))
 839                                         {
 840                                             cborFindResult = cbor_value_advance(&rMap);
 841                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Rlist Map.");
 842                                         }
 843                                         OICFree(rMapName);
 844                                     }
 845
 846                                     if (cbor_value_is_valid(&resources))
 847                                     {
 848                                         cborFindResult = cbor_value_advance(&resources);
 849                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Resource Array.");
 850                                     }
 851                                 }
 852                             }
 853
 854                             // Permissions -- Mandatory
 855                             if (strcmp(name, OIC_JSON_PERMISSION_NAME) == 0)
 856                             {
 857                                 uint64_t tmp64;
 858                                 cborFindResult = cbor_value_get_uint64(&aceMap, &tmp64);
 859                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a PERM Value.");
 860                                 ace->permission = (uint16_t)tmp64;
 861                             }
 862
 863                             // TODO: Need to verfication for validity
 864                             // Validity -- Not mandatory
 865                             if(strcmp(name, OIC_JSON_VALIDITY_NAME) == 0)
 866                             {
 867                                 CborValue validitiesMap = {.parser = NULL};
 868                                 size_t validitySize = 0;
 869
 870                                 cborFindResult = cbor_value_get_array_length(&aceMap, &validitySize);
 871                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Validity Array Length.");
 872
 873                                 cborFindResult = cbor_value_enter_container(&aceMap, &validitiesMap);
 874                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Array Map.");
 875
 876                                 while(cbor_value_is_valid(&validitiesMap))
 877                                 {
 878                                     OicSecValidity_t* validity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
 879                                     VERIFY_NON_NULL(TAG, validity, ERROR);
 880                                     LL_APPEND(ace->validities, validity);
 881
 882                                     CborValue validityMap  = {.parser = NULL};
 883                                     //period (string)
 884                                     cborFindResult = cbor_value_enter_container(&validitiesMap, &validityMap);
 885                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Map.");
 886
 887                                     size_t len = 0;
 888                                     cborFindResult =cbor_value_dup_text_string(&validityMap, &validity->period, &len, NULL);
 889                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Period value.");
 890
 891                                     //recurrence (string array)
 892                                     CborValue recurrenceMap  = {.parser = NULL};
 893                                     cborFindResult = cbor_value_enter_container(&validityMap, &recurrenceMap);
 894                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence array.");
 895
 896                                     cborFindResult = cbor_value_get_array_length(&recurrenceMap, &validity->recurrenceLen);
 897                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Adding Recurrence Array.");
 898
 899                                     validity->recurrences = (char**)OICCalloc(validity->recurrenceLen, sizeof(char*));
 900                                     VERIFY_NON_NULL(TAG, validity->recurrences, ERROR);
 901
 902                                     for(size_t i = 0; cbor_value_is_text_string(&recurrenceMap) && i < validity->recurrenceLen; i++)
 903                                     {
 904                                         cborFindResult = cbor_value_dup_text_string(&recurrenceMap, &validity->recurrences[i], &len, NULL);
 905                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence Value.");
 906
 907                                         cborFindResult = cbor_value_advance(&recurrenceMap);
 908                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a recurrences Array.");
 909                                     }
 910
 911                                     cborFindResult = cbor_value_advance(&validitiesMap);
 912                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a validities Array.");
 913                                 }
 914                             }
 915                             OICFree(name);
 916                         }
 917
 918                         if (type != CborMapType && cbor_value_is_valid(&aceMap))
 919                         {
 920                             cborFindResult = cbor_value_advance(&aceMap);
 921                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing the Array.");
 922                         }
 923                     }
 924
 925                     if (cbor_value_is_valid(&acesArray))
 926                     {
 927                         cborFindResult = cbor_value_advance(&acesArray);
 928                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Array.");
 929                     }
 930                 }
 931             }
 932
 933             //rownerID -- Mandatory
 934             if (strcmp(tagName, OIC_JSON_ROWNERID_NAME)  == 0)
 935             {
 936                 char *stRowner = NULL;
 937                 cborFindResult = cbor_value_dup_text_string(&aclMap, &stRowner, &len, NULL);
 938                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Rownerid Value.");
 939                 OIC_LOG_V(DEBUG, TAG, "Converting rownerid = %s to uuid...", stRowner);
 940                 ret = ConvertStrToUuid(stRowner, &acl->rownerID);
 941                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 942                 OICFree(stRowner);
 943             }
 944             OICFree(tagName);
 945         }
 946         if (cbor_value_is_valid(&aclMap))
 947         {
 948             cborFindResult = cbor_value_advance(&aclMap);
 949             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Map.");
 950         }
 951     }
 952
 953 exit:
 954     if (cborFindResult != CborNoError)
 955     {
 956         OIC_LOG(ERROR, TAG, "Failed to CBORPayloadToAcl");
 957         DeleteACLList(acl);
 958         acl = NULL;
 959     }
 960
 961     return acl;
 962 }
 963
 964 // This function converts CBOR format to ACL data.
 965 // Caller needs to invoke 'free' when done using
 966 // note: This function is used in unit test hence not declared static,
 967 OicSecAcl_t* CBORPayloadToAcl(const uint8_t *cborPayload, const size_t size)
 968 {
 969     if (NULL == cborPayload || 0 == size)
 970     {
 971         return NULL;
 972     }
 973     OCStackResult ret = OC_STACK_ERROR;
 974     CborValue aclMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 975     CborValue aclCbor = { .parser = NULL };
 976     CborParser parser = { .end = NULL };
 977     CborError cborFindResult = CborNoError;
 978
 979     cbor_parser_init(cborPayload, size, 0, &parser, &aclCbor);
 980
 981     OicSecAcl_t *acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
 982     VERIFY_NON_NULL(TAG, acl, ERROR);
 983
 984     // Enter ACL Map
 985     cborFindResult = cbor_value_enter_container(&aclCbor, &aclMap);
 986     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACL Map.");
 987
 988     while (cbor_value_is_valid(&aclMap))
 989     {
 990         char* tagName = NULL;
 991         size_t len = 0;
 992         CborType type = cbor_value_get_type(&aclMap);
 993         if (type == CborTextStringType)
 994         {
 995             cborFindResult = cbor_value_dup_text_string(&aclMap, &tagName, &len, NULL);
 996             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACL Map.");
 997             cborFindResult = cbor_value_advance(&aclMap);
 998             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACL Map.");
 999         }
1000         if(tagName)
1001         {
1002             if (strcmp(tagName, OIC_JSON_ACLIST_NAME)  == 0)
1003             {
1004                 // Enter ACLIST Map
1005                 CborValue aclistMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1006                 cborFindResult = cbor_value_enter_container(&aclMap, &aclistMap);
1007                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACLIST Map.");
1008
1009                 while (cbor_value_is_valid(&aclistMap))
1010                 {
1011                     char* acName = NULL;
1012                     size_t readLen = 0;
1013                     CborType acType = cbor_value_get_type(&aclistMap);
1014                     if (acType == CborTextStringType)
1015                     {
1016                         cborFindResult = cbor_value_dup_text_string(&aclistMap, &acName, &readLen, NULL);
1017                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACLIST Map.");
1018                         cborFindResult = cbor_value_advance(&aclistMap);
1019                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACLIST Map.");
1020                     }
1021
1022                     if(acName)
1023                     {
1024                         if (strcmp(acName, OIC_JSON_ACES_NAME)  == 0)
1025                         {
1026                             // Enter ACES Array
1027                             CborValue acesArray = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1028                             cborFindResult = cbor_value_enter_container(&aclistMap, &acesArray);
1029                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACES Array.");
1030
1031                             int acesCount = 0;
1032                             while (cbor_value_is_valid(&acesArray))
1033                             {
1034                                 acesCount++;
1035                                 CborValue aceMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1036                                 cborFindResult = cbor_value_enter_container(&acesArray, &aceMap);
1037                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACE Map.");
1038
1039                                 OicSecAce_t *ace = NULL;
1040                                 ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
1041                                 VERIFY_NON_NULL(TAG, ace, ERROR);
1042                                 LL_APPEND(acl->aces, ace);
1043
1044                                 while (cbor_value_is_valid(&aceMap))
1045                                 {
1046                                     char* name = NULL;
1047                                     size_t len = 0;
1048                                     CborType type = cbor_value_get_type(&aceMap);
1049                                     if (type == CborTextStringType)
1050                                     {
1051                                         cborFindResult = cbor_value_dup_text_string(&aceMap, &name, &len, NULL);
1052                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACE Map.");
1053                                         cborFindResult = cbor_value_advance(&aceMap);
1054                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACE Map.");
1055                                     }
1056                                     if (name)
1057                                     {
1058                                         // Subject -- Mandatory
1059                                         if (strcmp(name, OIC_JSON_SUBJECTID_NAME)  == 0)
1060                                         {
1061                                             char *subject = NULL;
1062                                             cborFindResult = cbor_value_dup_text_string(&aceMap, &subject, &len, NULL);
1063                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding subject Value.");
1064                                             if(strcmp(subject, WILDCARD_RESOURCE_URI) == 0)
1065                                             {
1066                                                 ace->subjectuuid.id[0] = '*';
1067                                             }
1068                                             else
1069                                             {
1070                                                 ret = ConvertStrToUuid(subject, &ace->subjectuuid);
1071                                                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
1072                                             }
1073                                             OICFree(subject);
1074                                         }
1075
1076                                         // Resources -- Mandatory
1077                                         if (strcmp(name, OIC_JSON_RESOURCES_NAME) == 0)
1078                                         {
1079                                             CborValue resources = { .parser = NULL };
1080                                             cborFindResult = cbor_value_enter_container(&aceMap, &resources);
1081                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering a Resource Array.");
1082
1083                                             while (cbor_value_is_valid(&resources))
1084                                             {
1085                                                 // rMap
1086                                                 CborValue rMap = { .parser = NULL  };
1087                                                 cborFindResult = cbor_value_enter_container(&resources, &rMap);
1088                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering Resource Map");
1089
1090                                                 OicSecRsrc_t* rsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
1091                                                 VERIFY_NON_NULL(TAG, rsrc, ERROR);
1092                                                 LL_APPEND(ace->resources, rsrc);
1093
1094                                                 while(cbor_value_is_valid(&rMap))
1095                                                 {
1096                                                     char *rMapName = NULL;
1097                                                     size_t rMapNameLen = 0;
1098                                                     cborFindResult = cbor_value_dup_text_string(&rMap, &rMapName, &rMapNameLen, NULL);
1099                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Name Tag.");
1100                                                     cborFindResult = cbor_value_advance(&rMap);
1101                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Value.");
1102
1103                                                     // "href"
1104                                                     if (0 == strcmp(OIC_JSON_HREF_NAME, rMapName))
1105                                                     {
1106                                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->href, &len, NULL);
1107                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Href Value.");
1108                                                     }
1109
1110                                                     // "rt"
1111                                                     if (0 == strcmp(OIC_JSON_RT_NAME, rMapName) && cbor_value_is_array(&rMap))
1112                                                     {
1113                                                         cbor_value_get_array_length(&rMap, &rsrc->typeLen);
1114                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RT array length.");
1115                                                         VERIFY_SUCCESS(TAG, (0 != rsrc->typeLen), ERROR);
1116
1117                                                         rsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
1118                                                         VERIFY_NON_NULL(TAG, rsrc->types, ERROR);
1119
1120                                                         CborValue resourceTypes;
1121                                                         cborFindResult = cbor_value_enter_container(&rMap, &resourceTypes);
1122                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering RT Array.");
1123
1124                                                         for(size_t i = 0; cbor_value_is_valid(&resourceTypes) && cbor_value_is_text_string(&resourceTypes); i++)
1125                                                         {
1126                                                             cborFindResult = cbor_value_dup_text_string(&resourceTypes, &(rsrc->types[i]), &readLen, NULL);
1127                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding resource type.");
1128                                                             cborFindResult = cbor_value_advance(&resourceTypes);
1129                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing resource type.");
1130                                                         }
1131                                                     }
1132
1133                                                     // "if"
1134                                                     if (0 == strcmp(OIC_JSON_IF_NAME, rMapName) && cbor_value_is_array(&rMap))
1135                                                     {
1136                                                         cbor_value_get_array_length(&rMap, &rsrc->interfaceLen);
1137                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF array length.");
1138                                                         VERIFY_SUCCESS(TAG, (0 != rsrc->interfaceLen), ERROR);
1139
1140                                                         rsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
1141                                                         VERIFY_NON_NULL(TAG, rsrc->interfaces, ERROR);
1142
1143                                                         CborValue interfaces;
1144                                                         cborFindResult = cbor_value_enter_container(&rMap, &interfaces);
1145                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering IF Array.");
1146
1147                                                         for(size_t i = 0; cbor_value_is_valid(&interfaces) && cbor_value_is_text_string(&interfaces); i++)
1148                                                         {
1149                                                             cborFindResult = cbor_value_dup_text_string(&interfaces, &(rsrc->interfaces[i]), &readLen, NULL);
1150                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF type.");
1151                                                             cborFindResult = cbor_value_advance(&interfaces);
1152                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing IF type.");
1153                                                         }
1154                                                     }
1155
1156                                                     // "rel"
1157                                                     if (0 == strcmp(OIC_JSON_REL_NAME, rMapName))
1158                                                     {
1159                                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->rel, &len, NULL);
1160                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding REL Value.");
1161                                                     }
1162
1163                                                     if (cbor_value_is_valid(&rMap))
1164                                                     {
1165                                                         cborFindResult = cbor_value_advance(&rMap);
1166                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Rlist Map.");
1167                                                     }
1168                                                     OICFree(rMapName);
1169                                                 }
1170
1171                                                 if (cbor_value_is_valid(&resources))
1172                                                 {
1173                                                     cborFindResult = cbor_value_advance(&resources);
1174                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Resource Array.");
1175                                                 }
1176                                             }
1177                                         }
1178
1179                                         // Permissions -- Mandatory
1180                                         if (strcmp(name, OIC_JSON_PERMISSION_NAME) == 0)
1181                                         {
1182                                             uint64_t tmp64;
1183                                             cborFindResult = cbor_value_get_uint64(&aceMap, &tmp64);
1184                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a PERM Value.");
1185                                             ace->permission = (uint16_t)tmp64;
1186                                         }
1187
1188                                         // TODO: Need to verfication for validity
1189                                         // Validity -- Not mandatory
1190                                         if(strcmp(name, OIC_JSON_VALIDITY_NAME) == 0)
1191                                         {
1192                                             CborValue validitiesMap = {.parser = NULL};
1193                                             size_t validitySize = 0;
1194
1195                                             cborFindResult = cbor_value_get_array_length(&aceMap, &validitySize);
1196                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Validity Array Length.");
1197
1198                                             cborFindResult = cbor_value_enter_container(&aceMap, &validitiesMap);
1199                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Array Map.");
1200
1201                                             while(cbor_value_is_valid(&validitiesMap))
1202                                             {
1203                                                 OicSecValidity_t* validity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
1204                                                 VERIFY_NON_NULL(TAG, validity, ERROR);
1205                                                 LL_APPEND(ace->validities, validity);
1206
1207                                                 CborValue validityMap  = {.parser = NULL};
1208                                                 //period (string)
1209                                                 cborFindResult = cbor_value_enter_container(&validitiesMap, &validityMap);
1210                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Map.");
1211
1212                                                 size_t len = 0;
1213                                                 cborFindResult =cbor_value_dup_text_string(&validityMap, &validity->period, &len, NULL);
1214                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Period value.");
1215
1216                                                 //recurrence (string array)
1217                                                 CborValue recurrenceMap  = {.parser = NULL};
1218                                                 cborFindResult = cbor_value_enter_container(&validityMap, &recurrenceMap);
1219                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence array.");
1220
1221                                                 cborFindResult = cbor_value_get_array_length(&recurrenceMap, &validity->recurrenceLen);
1222                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Adding Recurrence Array.");
1223
1224                                                 validity->recurrences = (char**)OICCalloc(validity->recurrenceLen, sizeof(char*));
1225                                                 VERIFY_NON_NULL(TAG, validity->recurrences, ERROR);
1226
1227                                                 for(size_t i = 0; cbor_value_is_text_string(&recurrenceMap) && i < validity->recurrenceLen; i++)
1228                                                 {
1229                                                     cborFindResult = cbor_value_dup_text_string(&recurrenceMap, &validity->recurrences[i], &len, NULL);
1230                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence Value.");
1231
1232                                                     cborFindResult = cbor_value_advance(&recurrenceMap);
1233                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a recurrences Array.");
1234                                                 }
1235
1236                                                 cborFindResult = cbor_value_advance(&validitiesMap);
1237                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a validities Array.");
1238                                             }
1239                                         }
1240
1241 #ifdef _ENABLE_MULTIPLE_OWNER_
1242                                         // eowner uuid -- Not Mandatory
1243                                         if (strcmp(name, OIC_JSON_EOWNERID_NAME)  == 0)
1244                                         {
1245                                             char *eowner = NULL;
1246                                             cborFindResult = cbor_value_dup_text_string(&aceMap, &eowner, &len, NULL);
1247                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding eownerId Value.");
1248                                             if(NULL == ace->eownerID)
1249                                             {
1250                                                 ace->eownerID = (OicUuid_t*)OICCalloc(1, sizeof(OicUuid_t));
1251                                                 VERIFY_NON_NULL(TAG, ace->eownerID, ERROR);
1252                                             }
1253                                             ret = ConvertStrToUuid(eowner, ace->eownerID);
1254                                             OICFree(eowner);
1255                                             VERIFY_SUCCESS(TAG, OC_STACK_OK == ret , ERROR);
1256                                         }
1257 #endif //_ENABLE_MULTIPLE_OWNER_
1258                                         OICFree(name);
1259                                     }
1260
1261                                     if (type != CborMapType && cbor_value_is_valid(&aceMap))
1262                                     {
1263                                         cborFindResult = cbor_value_advance(&aceMap);
1264                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing the Array.");
1265                                     }
1266                                 }
1267
1268                                 if (cbor_value_is_valid(&acesArray))
1269                                 {
1270                                     cborFindResult = cbor_value_advance(&acesArray);
1271                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Array.");
1272                                 }
1273                             }
1274                         }
1275                         OICFree(acName);
1276                     }
1277
1278                     if (cbor_value_is_valid(&aclistMap))
1279                     {
1280                         cborFindResult = cbor_value_advance(&aclistMap);
1281                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACLIST Map.");
1282                     }
1283                 }
1284             }
1285
1286             //rownerID -- Mandatory
1287             if (strcmp(tagName, OIC_JSON_ROWNERID_NAME)  == 0)
1288             {
1289                 char *stRowner = NULL;
1290                 cborFindResult = cbor_value_dup_text_string(&aclMap, &stRowner, &len, NULL);
1291                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Rownerid Value.");
1292                 ret = ConvertStrToUuid(stRowner, &acl->rownerID);
1293                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
1294                 OICFree(stRowner);
1295             }
1296             else if (NULL != gAcl)
1297             {
1298                 memcpy(&(acl->rownerID), &(gAcl->rownerID), sizeof(OicUuid_t));
1299             }
1300             OICFree(tagName);
1301         }
1302         if (cbor_value_is_valid(&aclMap))
1303         {
1304             cborFindResult = cbor_value_advance(&aclMap);
1305             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Map.");
1306         }
1307     }
1308
1309 exit:
1310     if (cborFindResult != CborNoError)
1311     {
1312         OIC_LOG(ERROR, TAG, "Failed to CBORPayloadToAcl");
1313         DeleteACLList(acl);
1314         acl = NULL;
1315     }
1316
1317     return acl;
1318 }
1319
1320 #ifdef _ENABLE_MULTIPLE_OWNER_
1321 bool IsValidAclAccessForSubOwner(const OicUuid_t* uuid, const uint8_t *cborPayload, const size_t size)
1322 {
1323     bool retValue = false;
1324     OicSecAcl_t* acl = NULL;
1325
1326     VERIFY_NON_NULL(TAG, uuid, ERROR);
1327     VERIFY_NON_NULL(TAG, cborPayload, ERROR);
1328     VERIFY_SUCCESS(TAG, 0 != size, ERROR);
1329
1330     acl = CBORPayloadToAcl(cborPayload, size);
1331     VERIFY_NON_NULL(TAG, acl, ERROR);
1332
1333     OicSecAce_t* ace = NULL;
1334     OicSecAce_t* tempAce = NULL;
1335     LL_FOREACH_SAFE(acl->aces, ace, tempAce)
1336     {
1337         OicSecRsrc_t* rsrc = NULL;
1338         OicSecRsrc_t* tempRsrc = NULL;
1339
1340         VERIFY_NON_NULL(TAG, ace->eownerID, ERROR);
1341         VERIFY_SUCCESS(TAG, memcmp(ace->eownerID->id, uuid->id, sizeof(uuid->id)) == 0, ERROR);
1342
1343         LL_FOREACH_SAFE(ace->resources, rsrc, tempRsrc)
1344         {
1345             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_DOXM) != 0, ERROR);
1346             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_CRED) != 0, ERROR);
1347             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_ACL) != 0, ERROR);
1348             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_PSTAT) != 0, ERROR);
1349             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_CRL) != 0, ERROR);
1350         }
1351     }
1352
1353     retValue = true;
1354
1355 exit:
1356     DeleteACLList(acl);
1357
1358     return retValue;
1359 }
1360 #endif //_ENABLE_MULTIPLE_OWNER_
1361
1362 /**
1363  * This method removes ACE for the subject and resource from the ACL
1364  *
1365  * @param subject of the ACE
1366  * @param resource of the ACE
1367  *
1368  * @return
1369  *     ::OC_STACK_RESOURCE_DELETED on success
1370  *     ::OC_STACK_NO_RESOURCE on failure to find the appropriate ACE
1371  *     ::OC_STACK_INVALID_PARAM on invalid parameter
1372  */
1373 OCStackResult RemoveACE(const OicUuid_t * subject, const char * resource)
1374 {
1375     OIC_LOG(DEBUG, TAG, "IN RemoveACE");
1376
1377     OicSecAce_t *ace = NULL;
1378     OicSecAce_t *tempAce = NULL;
1379     bool deleteFlag = false;
1380     OCStackResult ret = OC_STACK_NO_RESOURCE;
1381
1382     if (memcmp(subject->id, &WILDCARD_SUBJECT_ID, sizeof(subject->id)) == 0)
1383     {
1384         OIC_LOG_V(ERROR, TAG, "%s received invalid parameter", __func__ );
1385         return  OC_STACK_INVALID_PARAM;
1386     }
1387
1388     //If resource is NULL then delete all the ACE for the subject.
1389     if (NULL == resource || resource[0] == '\0')
1390     {
1391         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
1392         {
1393             if (memcmp(ace->subjectuuid.id, subject->id, sizeof(subject->id)) == 0)
1394             {
1395                 LL_DELETE(gAcl->aces, ace);
1396                 FreeACE(ace);
1397                 deleteFlag = true;
1398             }
1399         }
1400     }
1401     else
1402     {
1403         //Looping through ACL to find the right ACE to delete. If the required resource is the only
1404         //resource in the ACE for the subject then delete the whole ACE. If there are more resources
1405         //than the required resource in the ACE, for the subject then just delete the resource from
1406         //the resource array
1407         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
1408         {
1409             if (memcmp(ace->subjectuuid.id, subject->id, sizeof(subject->id)) == 0)
1410             {
1411                 OicSecRsrc_t* rsrc = NULL;
1412                 OicSecRsrc_t* tempRsrc = NULL;
1413                 LL_FOREACH_SAFE(ace->resources, rsrc, tempRsrc)
1414                 {
1415                     if(strcmp(rsrc->href, resource) == 0)
1416                     {
1417                         LL_DELETE(ace->resources, rsrc);
1418                         FreeRsrc(rsrc);
1419                         deleteFlag = true;
1420                     }
1421                 }
1422
1423                 //If resource list is empty
1424                 if(NULL == ace->resources && true == deleteFlag)
1425                 {
1426                     //Remove the ACE from ACL
1427                     LL_DELETE(gAcl->aces, ace);
1428                     FreeACE(ace);
1429                 }
1430             }
1431         }
1432     }
1433
1434     if (deleteFlag)
1435     {
1436         // In case of unit test do not update persistant storage.
1437         if (memcmp(subject->id, &WILDCARD_SUBJECT_B64_ID, sizeof(subject->id)) == 0)
1438         {
1439             ret = OC_STACK_RESOURCE_DELETED;
1440         }
1441         else
1442         {
1443             uint8_t *payload = NULL;
1444             size_t size = 0;
1445             if (OC_STACK_OK == AclToCBORPayload(gAcl, &payload, &size))
1446             {
1447                 if (OC_STACK_OK == UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size))
1448                 {
1449                     ret = OC_STACK_RESOURCE_DELETED;
1450                 }
1451                 OICFree(payload);
1452             }
1453         }
1454     }
1455     return ret;
1456 }
1457
1458 /**
1459  * This method parses the query string received for REST requests and
1460  * retrieves the 'subject' field.
1461  *
1462  * @param query querystring passed in REST request
1463  * @param subject subject UUID parsed from query string
1464  *
1465  * @return true if query parsed successfully and found 'subject', else false.
1466  */
1467 static bool GetSubjectFromQueryString(const char *query, OicUuid_t *subject)
1468 {
1469     OicParseQueryIter_t parseIter = { .attrPos = NULL };
1470
1471     ParseQueryIterInit((unsigned char *) query, &parseIter);
1472
1473     while (GetNextQuery (&parseIter))
1474     {
1475         if (strncasecmp((char *) parseIter.attrPos, OIC_JSON_SUBJECTID_NAME, parseIter.attrLen) == 0)
1476         {
1477             char strUuid[STRING_UUID_SIZE] = {0};
1478             VERIFY_SUCCESS(TAG, 0 != parseIter.valLen, ERROR);
1479             memcpy(strUuid, parseIter.valPos, parseIter.valLen);
1480             OCStackResult res = ConvertStrToUuid(strUuid, subject);
1481             VERIFY_SUCCESS(TAG, OC_STACK_OK == res, ERROR);
1482             return true;
1483         }
1484     }
1485
1486 exit:
1487     return false;
1488 }
1489
1490 /**
1491  * This method parses the query string received for REST requests and
1492  * retrieves the 'resource' field.
1493  *
1494  * @param query querystring passed in REST request
1495  * @param resource resource parsed from query string
1496  * @param resourceSize size of the memory pointed to resource
1497  *
1498  * @return true if query parsed successfully and found 'resource', else false.
1499  */
1500 static bool GetResourceFromQueryString(const char *query, char *resource, size_t resourceSize)
1501 {
1502     OicParseQueryIter_t parseIter = { .attrPos = NULL };
1503
1504     ParseQueryIterInit((unsigned char *) query, &parseIter);
1505
1506     while (GetNextQuery (&parseIter))
1507     {
1508         if (strncasecmp((char *) parseIter.attrPos, OIC_JSON_RESOURCES_NAME, parseIter.attrLen)
1509                 == 0)
1510         {
1511             VERIFY_SUCCESS(TAG, 0 != parseIter.valLen, ERROR);
1512             OICStrcpy(resource, resourceSize, (char *) parseIter.valPos);
1513
1514             return true;
1515         }
1516     }
1517
1518 exit:
1519    return false;
1520 }
1521
1522 static size_t GetNumberOfResource(OicSecRsrc_t* resources)
1523 {
1524     size_t ret = 0;
1525     if(resources)
1526     {
1527         OicSecRsrc_t* rsrc = NULL;
1528         LL_FOREACH(resources, rsrc)
1529         {
1530             ret++;
1531         }
1532     }
1533     return ret;
1534 }
1535
1536 static size_t GetNumberOfValidity(OicSecValidity_t* val)
1537 {
1538     size_t ret = 0;
1539
1540     if(val)
1541     {
1542         OicSecValidity_t* temp = NULL;
1543         LL_FOREACH(val, temp)
1544         {
1545             ret++;
1546         }
1547     }
1548     return ret;
1549 }
1550
1551
1552 static bool IsSameStringArray(char** strArr1, size_t strArr1Len,
1553                               char** strArr2, size_t strArr2Len)
1554 {
1555
1556     if(NULL == strArr1 && NULL == strArr2)
1557     {
1558         return true;
1559     }
1560
1561     if(strArr1 && strArr2 && NULL == *strArr1 && NULL == *strArr2)
1562     {
1563         return true;
1564     }
1565
1566     if(strArr1 && strArr2)
1567     {
1568         if(*strArr1 && *strArr2 && strArr1Len == strArr2Len)
1569         {
1570             size_t matchedStr = 0;
1571             for(size_t i = 0; i < strArr1Len; i++)
1572             {
1573                 for(size_t j = 0; j < strArr2Len; j++)
1574                 {
1575                     if(strcmp(strArr1[i], strArr2[j]) == 0)
1576                     {
1577                         matchedStr++;
1578                     }
1579                 }
1580             }
1581             if(matchedStr == strArr1Len)
1582             {
1583                 return true;
1584             }
1585         }
1586     }
1587
1588     return false;
1589 }
1590
1591 static bool IsSameResources(OicSecRsrc_t* resources1, OicSecRsrc_t* resources2)
1592 {
1593     size_t numOfRsrc1 = 0;
1594     size_t numOfRsrc2 = 0;
1595     size_t numOfMatchedRsrc = 0;
1596     OicSecRsrc_t* rsrc1 = NULL;
1597     OicSecRsrc_t* rsrc2 = NULL;
1598
1599     if(NULL == resources1 && NULL == resources2)
1600     {
1601         return true;
1602     }
1603
1604     if(resources1 && resources2)
1605     {
1606         numOfRsrc1 = GetNumberOfResource(resources1);
1607         numOfRsrc2 = GetNumberOfResource(resources2);
1608
1609         if(0 == numOfRsrc1 && 0 == numOfRsrc2)
1610         {
1611             return true;
1612         }
1613
1614         LL_FOREACH(resources1, rsrc1)
1615         {
1616             rsrc2 = NULL;
1617             LL_FOREACH(resources2, rsrc2)
1618             {
1619                 if(rsrc1 && rsrc2)
1620                 {
1621                     if(strcmp(rsrc1->href, rsrc2->href) == 0 &&
1622                         IsSameStringArray(rsrc1->interfaces, rsrc1->interfaceLen,
1623                                           rsrc2->interfaces, rsrc2->interfaceLen) &&
1624                         IsSameStringArray(rsrc1->types, rsrc1->typeLen,
1625                                           rsrc2->types, rsrc2->typeLen))
1626                     {
1627                         // TODO: Update codes to compare 'rel' property
1628                         numOfMatchedRsrc++;
1629                     }
1630                 }
1631             }
1632         }
1633
1634         if(numOfMatchedRsrc == numOfRsrc1)
1635         {
1636             return true;
1637         }
1638     }
1639
1640     return false;
1641 }
1642
1643 static bool IsSameValidities(OicSecValidity_t* validities1, OicSecValidity_t* validities2)
1644 {
1645     size_t numOfVal1 = 0;
1646     size_t numOfVal2 = 0;
1647     size_t numOfMatchedVal = 0;
1648     OicSecValidity_t* val1 = NULL;
1649     OicSecValidity_t* val2 = NULL;
1650
1651     if(NULL == validities1 && NULL == validities2)
1652     {
1653         return true;
1654     }
1655
1656     if(validities1 && validities2)
1657     {
1658         numOfVal1 = GetNumberOfValidity(validities1);
1659         numOfVal2 = GetNumberOfValidity(validities2);
1660         if(0 == numOfVal1 && 0 == numOfVal2)
1661         {
1662             return true;
1663         }
1664
1665         if(numOfVal1 == numOfVal2)
1666         {
1667             LL_FOREACH(validities1, val1)
1668             {
1669                 LL_FOREACH(validities2, val2)
1670                 {
1671                     if(strcmp(val1->period, val2->period) == 0 &&
1672                         IsSameStringArray(val1->recurrences, val1->recurrenceLen,
1673                                           val2->recurrences, val2->recurrenceLen))
1674                     {
1675                         numOfMatchedVal++;
1676                     }
1677                 }
1678             }
1679             if(numOfVal1 == numOfMatchedVal)
1680             {
1681                 return true;
1682             }
1683         }
1684     }
1685
1686     return false;
1687 }
1688
1689 static bool IsSameACE(OicSecAce_t* ace1, OicSecAce_t* ace2)
1690 {
1691     if(ace1 && ace2)
1692     {
1693         if(memcmp(ace1->subjectuuid.id, ace2->subjectuuid.id, sizeof(ace1->subjectuuid.id)) != 0)
1694         {
1695             return false;
1696         }
1697
1698         if(false == IsSameResources(ace1->resources, ace2->resources))
1699         {
1700             return false;
1701         }
1702
1703         if(ace1->permission != ace2->permission)
1704         {
1705             return false;
1706         }
1707
1708         if(false == IsSameValidities(ace1->validities, ace2->validities))
1709         {
1710             return false;
1711         }
1712
1713         return true;
1714     }
1715
1716     return false;
1717 }
1718
1719 /**
1720  * Internal function to remove all ACL data on ACL resource and persistent storage
1721  *
1722  * @retval
1723  *     OC_STACK_RESOURCE_DELETED  - no errors
1724  *     Otherwise                  - error
1725  */
1726 static OCStackResult RemoveAllAce(void)
1727 {
1728     OCStackResult ret = OC_STACK_ERROR;
1729     uint8_t* aclBackup = NULL;
1730     size_t backupSize = 0;
1731     uint8_t* payload = NULL;
1732     size_t size = 0;
1733     OicSecAce_t* aceItem = NULL;
1734     OicSecAce_t* tempAce = NULL;
1735
1736     OIC_LOG(INFO, TAG, "IN RemoveAllAce");
1737
1738     //Backup the current ACL
1739     ret = AclToCBORPayload(gAcl, &aclBackup, &backupSize);
1740     if(OC_STACK_OK == ret)
1741     {
1742         // Remove all ACE from ACL
1743         LL_FOREACH_SAFE(gAcl->aces, aceItem, tempAce)
1744         {
1745             LL_DELETE(gAcl->aces, aceItem);
1746             FreeACE(aceItem);
1747         }
1748
1749         //Generate empty ACL payload
1750         ret = AclToCBORPayload(gAcl, &payload, &size);
1751         if (OC_STACK_OK == ret )
1752         {
1753             //Update the PS.
1754             ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size);
1755             if (OC_STACK_OK != ret)
1756             {
1757                 OIC_LOG_V(ERROR, TAG, "Error in UpdateSecureResourceInPS : %d", ret);
1758             }
1759         }
1760
1761         if(OC_STACK_OK != ret)
1762         {
1763             OIC_LOG_V(ERROR, TAG, "Error while DELETE ACE : %d", ret);
1764
1765             //If some erorr is occured, revert back.
1766             OicSecAcl_t* originAcl = CBORPayloadToAcl(aclBackup, backupSize);
1767             if( originAcl )
1768             {
1769                 ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, aclBackup, backupSize);
1770                 if (OC_STACK_OK == ret)
1771                 {
1772                     DeleteACLList(gAcl);
1773                     gAcl = originAcl;
1774                 }
1775                 else
1776                 {
1777                     OIC_LOG_V(ERROR, TAG, "Error in UpdateSecureResourceInPS : %d", ret);
1778                 }
1779             }
1780             else
1781             {
1782                 OIC_LOG(FATAL, TAG, "Error in CBORPayloadToAcl");
1783                 ret = OC_STACK_ERROR;
1784             }
1785         }
1786     }
1787
1788     OICFree(aclBackup);
1789     OICFree(payload);
1790
1791     OIC_LOG(INFO, TAG, "OUT RemoveAllAce");
1792
1793     return (OC_STACK_OK == ret ? OC_STACK_RESOURCE_DELETED : ret);
1794 }
1795
1796 static OCEntityHandlerResult HandleACLGetRequest(const OCEntityHandlerRequest *ehRequest)
1797 {
1798     OIC_LOG(INFO, TAG, "HandleACLGetRequest processing the request");
1799     uint8_t* payload = NULL;
1800     size_t size = 0;
1801     OCEntityHandlerResult ehRet;
1802
1803     OicUuid_t subject = {.id= { 0 } };
1804
1805     // In case, 'subject' field is included in REST request.
1806     if (ehRequest->query && GetSubjectFromQueryString(ehRequest->query, &subject))
1807     {
1808         OIC_LOG(DEBUG,TAG,"'subject' field is inculded in REST request.");
1809         OIC_LOG(DEBUG, TAG, "HandleACLGetRequest processing query");
1810
1811         char resource[MAX_URI_LENGTH] = { 0 };
1812
1813         OicSecAce_t *savePtr = NULL;
1814         const OicSecAce_t *currentAce = NULL;
1815         OicSecAcl_t targetAcl;
1816
1817         memcpy(&targetAcl.rownerID, &gAcl->rownerID, sizeof(OicUuid_t));
1818         targetAcl.aces = NULL;
1819
1820         // 'Subject' field is MUST for processing a querystring in REST request.
1821         GetResourceFromQueryString(ehRequest->query, resource, sizeof(resource));
1822
1823         /*
1824          * TODO : Currently, this code only provides one ACE for a Subject.
1825          * Below code needs to be updated for scenarios when Subject have
1826          * multiple ACE's in ACL resource.
1827          */
1828         while ((currentAce = GetACLResourceData(&subject, &savePtr)))
1829         {
1830             targetAcl.aces = (OicSecAce_t*)currentAce;
1831
1832             /*
1833              * If REST querystring contains a specific resource, we need
1834              * to search for that resource in ACE.
1835              */
1836             if (resource[0] != '\0')
1837             {
1838                 OicSecRsrc_t *rsrc = NULL;
1839                 LL_FOREACH(currentAce->resources, rsrc)
1840                 {
1841                     if(0 == strcmp(rsrc->href, resource) ||
1842                         0 == strcmp(WILDCARD_RESOURCE_URI, rsrc->href))
1843                     {
1844                         // Convert ACL data into CBOR format for transmission
1845                         if (OC_STACK_OK != AclToCBORPayload(&targetAcl, &payload, &size))
1846                         {
1847                             ehRet = OC_EH_ERROR;
1848                         }
1849                         goto exit;
1850                     }
1851                 }
1852             }
1853             else
1854             {
1855                 // Convert ACL data into CBOR format for transmission
1856                 if (OC_STACK_OK != AclToCBORPayload(&targetAcl, &payload, &size))
1857                 {
1858                     ehRet = OC_EH_ERROR;
1859                 }
1860                 goto exit;
1861             }
1862         }
1863     }
1864     // In case, 'subject' field is not included in REST request.
1865     else
1866     {
1867         OIC_LOG(DEBUG,TAG,"'subject' field is not inculded in REST request.");
1868         // Convert ACL data into CBOR format for transmission.
1869         if (OC_STACK_OK != AclToCBORPayload(gAcl, &payload, &size))
1870         {
1871             ehRet = OC_EH_ERROR;
1872         }
1873     }
1874 exit:
1875     // A device should always have a default acl. Therefore, payload should never be NULL.
1876     ehRet = (payload ? OC_EH_OK : OC_EH_ERROR);
1877     OIC_LOG(DEBUG, TAG, "ACL payload with GET response");
1878     OIC_LOG_BUFFER(DEBUG, TAG, payload, size);
1879
1880     //Send payload to request originator
1881     ehRet = ((SendSRMResponse(ehRequest, ehRet, payload, size)) == OC_STACK_OK) ?
1882                    OC_EH_OK : OC_EH_ERROR;
1883
1884     OICFree(payload);
1885
1886     OIC_LOG_V(DEBUG, TAG, "%s RetVal %d", __func__, ehRet);
1887     return ehRet;
1888 }
1889
1890 static OCEntityHandlerResult HandleACLPostRequest(const OCEntityHandlerRequest *ehRequest)
1891 {
1892     OIC_LOG(INFO, TAG, "HandleACLPostRequest processing the request");
1893     OCEntityHandlerResult ehRet = OC_EH_OK;
1894
1895     // Convert CBOR into ACL data and update to SVR buffers. This will also validate the ACL data received.
1896     uint8_t *payload = ((OCSecurityPayload *) ehRequest->payload)->securityData;
1897     size_t size = ((OCSecurityPayload *) ehRequest->payload)->payloadSize;
1898     if (payload)
1899     {
1900         OicSecAcl_t *newAcl = NULL;
1901         OIC_LOG(DEBUG, TAG, "ACL payload from POST request << ");
1902         OIC_LOG_BUFFER(DEBUG, TAG, payload, size);
1903
1904         newAcl = CBORPayloadToAcl(payload, size);
1905         if (newAcl)
1906         {
1907             bool isNewAce = true;
1908             OicSecAce_t* existAce = NULL;
1909             OicSecAce_t* newAce = NULL;
1910             OicSecAce_t* tempAce1 = NULL;
1911             OicSecAce_t* tempAce2 = NULL;
1912
1913             LL_FOREACH_SAFE(newAcl->aces, newAce, tempAce1)
1914             {
1915                 isNewAce = true;
1916                 LL_FOREACH_SAFE(gAcl->aces, existAce, tempAce2)
1917                 {
1918                     if(IsSameACE(newAce, existAce))
1919                     {
1920                         isNewAce = false;
1921                     }
1922                 }
1923                 if(isNewAce)
1924                 {
1925                     OIC_LOG(DEBUG, TAG, "NEW ACE dectected.");
1926
1927                     OicSecAce_t* insertAce = DuplicateACE(newAce);
1928                     if(insertAce)
1929                     {
1930                         OIC_LOG(DEBUG, TAG, "Appending new ACE..");
1931                         LL_PREPEND(gAcl->aces, insertAce);
1932                     }
1933                     else
1934                     {
1935                         OIC_LOG(ERROR, TAG, "Failed to duplicate ACE.");
1936                         ehRet = OC_EH_ERROR;
1937                     }
1938                 }
1939             }
1940             memcpy(&(gAcl->rownerID), &(newAcl->rownerID), sizeof(OicUuid_t));
1941
1942             DeleteACLList(newAcl);
1943
1944             if(OC_EH_OK == ehRet)
1945             {
1946                 size_t size = 0;
1947                 uint8_t *cborPayload = NULL;
1948
1949                 if (OC_STACK_OK == AclToCBORPayload(gAcl, &cborPayload, &size))
1950                 {
1951                     if (UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, cborPayload, size) == OC_STACK_OK)
1952                     {
1953                         ehRet = OC_EH_CHANGED;
1954                     }
1955                     OICFree(cborPayload);
1956                 }
1957
1958                 if(OC_EH_CHANGED != ehRet)
1959                 {
1960                     ehRet = OC_EH_ERROR;
1961                 }
1962             }
1963         }
1964     }
1965
1966     //Send response to request originator
1967     ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
1968                    OC_EH_OK : OC_EH_ERROR;
1969
1970     OIC_LOG_V(DEBUG, TAG, "%s RetVal %d", __func__, ehRet);
1971     return ehRet;
1972 }
1973
1974 static OCEntityHandlerResult HandleACLDeleteRequest(const OCEntityHandlerRequest *ehRequest)
1975 {
1976     OIC_LOG(DEBUG, TAG, "Processing ACLDeleteRequest");
1977     OCEntityHandlerResult ehRet = OC_EH_ERROR;
1978     OicUuid_t subject = { .id= { 0 } };
1979     char resource[MAX_URI_LENGTH] = { 0 };
1980
1981     VERIFY_NON_NULL(TAG, ehRequest->query, ERROR);
1982
1983     // If 'Subject' field exist, processing a querystring in REST request.
1984     if(GetSubjectFromQueryString(ehRequest->query, &subject))
1985     {
1986         GetResourceFromQueryString(ehRequest->query, resource, sizeof(resource));
1987
1988         if (OC_STACK_RESOURCE_DELETED == RemoveACE(&subject, resource))
1989         {
1990             ehRet = OC_EH_RESOURCE_DELETED;
1991         }
1992     }
1993     // If 'subject field not exist, remove all ACL data from ACL resource
1994     else
1995     {
1996         OIC_LOG(WARNING, TAG, "Can not find the 'subject' in querystring, All ACL list will be removed.");
1997
1998         if(OC_STACK_RESOURCE_DELETED == RemoveAllAce())
1999         {
2000             ehRet = OC_EH_RESOURCE_DELETED;
2001         }
2002     }
2003
2004 exit:
2005     //Send response to request originator
2006     ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2007                    OC_EH_OK : OC_EH_ERROR;
2008
2009     return ehRet;
2010 }
2011
2012 OCEntityHandlerResult ACLEntityHandler(OCEntityHandlerFlag flag, OCEntityHandlerRequest * ehRequest,
2013         void* callbackParameter)
2014 {
2015     OIC_LOG(DEBUG, TAG, "Received request ACLEntityHandler");
2016     (void)callbackParameter;
2017     OCEntityHandlerResult ehRet = OC_EH_ERROR;
2018
2019     if (!ehRequest)
2020     {
2021         return ehRet;
2022     }
2023
2024     if (flag & OC_REQUEST_FLAG)
2025     {
2026         // TODO :  Handle PUT method
2027         OIC_LOG(DEBUG, TAG, "Flag includes OC_REQUEST_FLAG");
2028         switch (ehRequest->method)
2029         {
2030             case OC_REST_GET:
2031                 ehRet = HandleACLGetRequest(ehRequest);
2032                 break;
2033
2034             case OC_REST_POST:
2035                 ehRet = HandleACLPostRequest(ehRequest);
2036                 break;
2037
2038             case OC_REST_DELETE:
2039                 ehRet = HandleACLDeleteRequest(ehRequest);
2040                 break;
2041
2042             default:
2043                 ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2044                                OC_EH_OK : OC_EH_ERROR;
2045         }
2046     }
2047
2048     return ehRet;
2049 }
2050
2051 /**
2052  * This internal method is used to create '/oic/sec/acl' resource.
2053  */
2054 static OCStackResult CreateACLResource()
2055 {
2056     OCStackResult ret;
2057
2058     ret = OCCreateResource(&gAclHandle,
2059                            OIC_RSRC_TYPE_SEC_ACL,
2060                            OC_RSRVD_INTERFACE_DEFAULT,
2061                            OIC_RSRC_ACL_URI,
2062                            ACLEntityHandler,
2063                            NULL,
2064                            OC_SECURE);
2065
2066     if (OC_STACK_OK != ret)
2067     {
2068         OIC_LOG(FATAL, TAG, "Unable to instantiate ACL resource");
2069         DeInitACLResource();
2070     }
2071     return ret;
2072 }
2073
2074 // This function sets the default ACL and is defined for the unit test only.
2075 OCStackResult SetDefaultACL(OicSecAcl_t *acl)
2076 {
2077     gAcl = acl;
2078     return OC_STACK_OK;
2079 }
2080
2081 OCStackResult GetDefaultACL(OicSecAcl_t** defaultAcl)
2082 {
2083     OCStackResult ret = OC_STACK_ERROR;
2084     OicUuid_t ownerId = { .id = { 0 } };
2085     OicSecAcl_t *acl = NULL;
2086     OicSecAce_t *ace = NULL;
2087     OicSecRsrc_t* resRsrc = NULL;
2088     OicSecRsrc_t* deviceRsrc = NULL;
2089     OicSecRsrc_t* platformRsrc = NULL;
2090     OicSecRsrc_t* aclRsrc = NULL;
2091     OicSecRsrc_t* doxmRsrc = NULL;
2092     OicSecRsrc_t* pstatRsrc = NULL;
2093
2094     /*
2095      * TODO In future, when new virtual resources will be added in OIC
2096      * specification, Iotivity stack should be able to add them in
2097      * existing SVR database. To support this, we need to add 'versioning'
2098      * mechanism in SVR database.
2099      */
2100
2101     if (!defaultAcl)
2102     {
2103         return OC_STACK_INVALID_PARAM;
2104     }
2105
2106     acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
2107     VERIFY_NON_NULL(TAG, acl, ERROR);
2108
2109     ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
2110     VERIFY_NON_NULL(TAG, ace, ERROR);
2111
2112     LL_APPEND(acl->aces, ace);
2113
2114     // Subject -- Mandatory
2115     memcpy(ace->subjectuuid.id, &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t));
2116
2117     // Resources -- Mandatory
2118     // /oic/res
2119     resRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2120     VERIFY_NON_NULL(TAG, resRsrc, ERROR);
2121     LL_APPEND(ace->resources, resRsrc);
2122     resRsrc->href = OICStrdup(OC_RSRVD_WELL_KNOWN_URI);
2123     VERIFY_NON_NULL(TAG, (resRsrc->href), ERROR);
2124     resRsrc->typeLen = 1;
2125     resRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2126     VERIFY_NON_NULL(TAG, resRsrc->types, ERROR);
2127     resRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_RES);
2128     VERIFY_NON_NULL(TAG, resRsrc->types[0], ERROR);
2129     resRsrc->interfaceLen = 2;
2130     resRsrc->interfaces = (char**)OICCalloc(resRsrc->interfaceLen, sizeof(char*));
2131     VERIFY_NON_NULL(TAG, resRsrc->interfaces, ERROR);
2132     resRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2133     VERIFY_NON_NULL(TAG, resRsrc->interfaces[0], ERROR);
2134     resRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2135     VERIFY_NON_NULL(TAG, resRsrc->interfaces[1], ERROR);
2136
2137     // /oic/d
2138     deviceRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2139     VERIFY_NON_NULL(TAG, deviceRsrc, ERROR);
2140     LL_APPEND(ace->resources, deviceRsrc);
2141     deviceRsrc->href = OICStrdup(OC_RSRVD_DEVICE_URI);
2142     VERIFY_NON_NULL(TAG, (deviceRsrc->href), ERROR);
2143     deviceRsrc->typeLen = 1;
2144     deviceRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2145     VERIFY_NON_NULL(TAG, deviceRsrc->types, ERROR);
2146     deviceRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_DEVICE);
2147     VERIFY_NON_NULL(TAG, deviceRsrc->types[0], ERROR);
2148     deviceRsrc->interfaceLen = 2;
2149     deviceRsrc->interfaces = (char**)OICCalloc(deviceRsrc->interfaceLen, sizeof(char*));
2150     VERIFY_NON_NULL(TAG, deviceRsrc->interfaces, ERROR);
2151     deviceRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2152     VERIFY_NON_NULL(TAG, deviceRsrc->interfaces[0], ERROR);
2153     deviceRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2154     VERIFY_NON_NULL(TAG, deviceRsrc->interfaces[1], ERROR);
2155
2156     // /oic/p
2157     platformRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2158     VERIFY_NON_NULL(TAG, platformRsrc, ERROR);
2159     LL_APPEND(ace->resources, platformRsrc);
2160     platformRsrc->href = OICStrdup(OC_RSRVD_PLATFORM_URI);
2161     VERIFY_NON_NULL(TAG, (platformRsrc->href), ERROR);
2162     platformRsrc->typeLen = 1;
2163     platformRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2164     VERIFY_NON_NULL(TAG, platformRsrc->types, ERROR);
2165     platformRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_PLATFORM);
2166     VERIFY_NON_NULL(TAG, platformRsrc->types[0], ERROR);
2167     platformRsrc->interfaceLen = 2;
2168     platformRsrc->interfaces = (char**)OICCalloc(platformRsrc->interfaceLen, sizeof(char*));
2169     VERIFY_NON_NULL(TAG, platformRsrc->interfaces, ERROR);
2170     platformRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2171     VERIFY_NON_NULL(TAG, platformRsrc->interfaces[0], ERROR);
2172     platformRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2173     VERIFY_NON_NULL(TAG, platformRsrc->interfaces[1], ERROR);
2174
2175     // /oic/sec/acl
2176     aclRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2177     VERIFY_NON_NULL(TAG, aclRsrc, ERROR);
2178     LL_APPEND(ace->resources, aclRsrc);
2179     aclRsrc->href = OICStrdup(OIC_RSRC_ACL_URI);
2180     VERIFY_NON_NULL(TAG, (aclRsrc->href), ERROR);
2181     aclRsrc->typeLen = 1;
2182     aclRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2183     VERIFY_NON_NULL(TAG, aclRsrc->types, ERROR);
2184     aclRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_ACL);
2185     VERIFY_NON_NULL(TAG, aclRsrc->types[0], ERROR);
2186     aclRsrc->interfaceLen = 1;
2187     aclRsrc->interfaces = (char**)OICCalloc(aclRsrc->interfaceLen, sizeof(char*));
2188     VERIFY_NON_NULL(TAG, aclRsrc->interfaces, ERROR);
2189     aclRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2190     VERIFY_NON_NULL(TAG, aclRsrc->interfaces[0], ERROR);
2191
2192     // /oic/sec/doxm
2193     doxmRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2194     VERIFY_NON_NULL(TAG, doxmRsrc, ERROR);
2195     LL_APPEND(ace->resources, doxmRsrc);
2196     doxmRsrc->href = OICStrdup(OIC_RSRC_DOXM_URI);
2197     VERIFY_NON_NULL(TAG, (doxmRsrc->href), ERROR);
2198     doxmRsrc->typeLen = 1;
2199     doxmRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2200     VERIFY_NON_NULL(TAG, doxmRsrc->types, ERROR);
2201     doxmRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_DOXM);
2202     VERIFY_NON_NULL(TAG, doxmRsrc->types[0], ERROR);
2203     doxmRsrc->interfaceLen = 1;
2204     doxmRsrc->interfaces = (char**)OICCalloc(doxmRsrc->interfaceLen, sizeof(char*));
2205     VERIFY_NON_NULL(TAG, doxmRsrc->interfaces, ERROR);
2206     doxmRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2207     VERIFY_NON_NULL(TAG, doxmRsrc->interfaces[0], ERROR);
2208
2209     // /oic/sec/pstat
2210     pstatRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2211     VERIFY_NON_NULL(TAG, pstatRsrc, ERROR);
2212     LL_APPEND(ace->resources, pstatRsrc);
2213     pstatRsrc->href = OICStrdup(OIC_RSRC_PSTAT_URI);
2214     VERIFY_NON_NULL(TAG, (pstatRsrc->href), ERROR);
2215     pstatRsrc->typeLen = 1;
2216     pstatRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2217     VERIFY_NON_NULL(TAG, pstatRsrc->types, ERROR);
2218     pstatRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_PSTAT);
2219     VERIFY_NON_NULL(TAG, pstatRsrc->types[0], ERROR);
2220     pstatRsrc->interfaceLen = 1;
2221     pstatRsrc->interfaces = (char**)OICCalloc(pstatRsrc->interfaceLen, sizeof(char*));
2222     VERIFY_NON_NULL(TAG, pstatRsrc->interfaces, ERROR);
2223     pstatRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2224     VERIFY_NON_NULL(TAG, pstatRsrc->interfaces[0], ERROR);
2225
2226     ace->permission = PERMISSION_READ;
2227     ace->validities = NULL;
2228
2229     // Device ID is the owner of this default ACL
2230     if (GetDoxmResourceData() != NULL)
2231     {
2232         ret = GetDoxmDeviceID(&ownerId);
2233         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, FATAL);
2234     }
2235     else
2236     {
2237         OCRandomUuidResult rdm = OCGenerateUuid(ownerId.id);
2238         VERIFY_SUCCESS(TAG, RAND_UUID_OK == rdm, FATAL);
2239     }
2240
2241     memcpy(&acl->rownerID, &ownerId, sizeof(OicUuid_t));
2242
2243     *defaultAcl = acl;
2244     ret = OC_STACK_OK;
2245
2246 exit:
2247
2248     if (ret != OC_STACK_OK)
2249     {
2250         DeleteACLList(acl);
2251         acl = NULL;
2252     }
2253
2254     return ret;
2255 }
2256
2257 OCStackResult InitACLResource()
2258 {
2259     OCStackResult ret = OC_STACK_ERROR;
2260
2261     uint8_t *data = NULL;
2262     size_t size = 0;
2263     ret = GetSecureVirtualDatabaseFromPS(OIC_JSON_ACL_NAME, &data, &size);
2264     // If database read failed
2265     if (OC_STACK_OK != ret)
2266     {
2267         OIC_LOG(DEBUG, TAG, "ReadSVDataFromPS failed");
2268     }
2269     if (data)
2270     {
2271         // Read ACL resource from PS
2272         gAcl = CBORPayloadToAcl(data, size);
2273         OICFree(data);
2274     }
2275     /*
2276      * If SVR database in persistent storage got corrupted or
2277      * is not available for some reason, a default ACL is created
2278      * which allows user to initiate ACL provisioning again.
2279      */
2280     if (!gAcl)
2281     {
2282         ret = GetDefaultACL(&gAcl);
2283         if (OC_STACK_OK != ret)
2284         {
2285             OIC_LOG(ERROR, TAG, "Failed to create default ACL");
2286         }
2287         // TODO Needs to update persistent storage
2288     }
2289     VERIFY_NON_NULL(TAG, gAcl, FATAL);
2290
2291     // Instantiate 'oic.sec.acl'
2292     ret = CreateACLResource();
2293
2294 exit:
2295     if (OC_STACK_OK != ret)
2296     {
2297         DeInitACLResource();
2298     }
2299     return ret;
2300 }
2301
2302 OCStackResult DeInitACLResource()
2303 {
2304     OCStackResult ret =  OCDeleteResource(gAclHandle);
2305     gAclHandle = NULL;
2306
2307     if (gAcl)
2308     {
2309         DeleteACLList(gAcl);
2310         gAcl = NULL;
2311     }
2312     return ret;
2313 }
2314
2315 const OicSecAce_t* GetACLResourceData(const OicUuid_t* subjectId, OicSecAce_t **savePtr)
2316 {
2317     OicSecAce_t *ace = NULL;
2318     OicSecAce_t *begin = NULL;
2319
2320     if (NULL == subjectId)
2321     {
2322         return NULL;
2323     }
2324
2325     /*
2326      * savePtr MUST point to NULL if this is the 'first' call to retrieve ACL for
2327      * subjectID.
2328      */
2329     if (NULL == *savePtr)
2330     {
2331         begin = gAcl->aces;
2332     }
2333     else
2334     {
2335         /*
2336          * If this is a 'successive' call, search for location pointed by
2337          * savePtr and assign 'begin' to the next ACL after it in the linked
2338          * list and start searching from there.
2339          */
2340         LL_FOREACH(gAcl->aces, ace)
2341         {
2342             if (ace == *savePtr)
2343             {
2344                 begin = ace->next;
2345             }
2346         }
2347     }
2348
2349     // Find the next ACL corresponding to the 'subjectID' and return it.
2350     LL_FOREACH(begin, ace)
2351     {
2352         if (memcmp(&(ace->subjectuuid), subjectId, sizeof(OicUuid_t)) == 0)
2353         {
2354             *savePtr = ace;
2355             return ace;
2356         }
2357     }
2358
2359     // Cleanup in case no ACL is found
2360     *savePtr = NULL;
2361     return NULL;
2362 }
2363
2364 void printACL(const OicSecAcl_t* acl)
2365 {
2366     OIC_LOG(INFO, TAG, "Print ACL:");
2367
2368     if (NULL == acl)
2369     {
2370         OIC_LOG(INFO, TAG, "Received NULL acl");
2371         return;
2372     }
2373
2374     char *rowner = NULL;
2375     if (OC_STACK_OK == ConvertUuidToStr(&acl->rownerID, &rowner))
2376     {
2377         OIC_LOG_V(INFO, TAG, "rowner id = %s", rowner);
2378     }
2379     else
2380     {
2381         OIC_LOG(ERROR, TAG, "Can't convert rowner uuid to string");
2382     }
2383     OICFree(rowner);
2384
2385     const OicSecAce_t *ace = acl->aces;
2386     int ace_count = 0;
2387     while (ace)
2388     {
2389         ace_count++;
2390         OIC_LOG_V(INFO, TAG, "Print ace[%d]:", ace_count);
2391
2392         OIC_LOG_V(INFO, TAG, "ace permission = %d", ace->permission);
2393
2394         char *subjectuuid = NULL;
2395         if (OC_STACK_OK == ConvertUuidToStr(&ace->subjectuuid, &subjectuuid))
2396         {
2397             OIC_LOG_V(INFO, TAG, "ace subject uuid = %s", subjectuuid);
2398         }
2399         else
2400         {
2401             OIC_LOG(ERROR, TAG, "Can't convert subjectuuid to string");
2402         }
2403         OICFree(subjectuuid);
2404
2405         OicSecRsrc_t *res = ace->resources;
2406         int res_count = 0;
2407         while (res)
2408         {
2409             res_count++;
2410             OIC_LOG_V(INFO, TAG, "Print resources[%d]:", res_count);
2411
2412             OIC_LOG_V(INFO, TAG, "href = %s", res->href);
2413
2414             for (size_t i = 0; i < res->typeLen; i++)
2415             {
2416                 OIC_LOG_V(INFO, TAG, "if[%zu] = %s", i, res->types[i]);
2417             }
2418             for (size_t i = 0; i < res->interfaceLen; i++)
2419             {
2420                 OIC_LOG_V(INFO, TAG, "if[%zu] = %s", i, res->interfaces[i]);
2421             }
2422
2423             res= res->next;
2424         }
2425
2426         OicSecValidity_t *vals = ace->validities;
2427         int vals_count = 0;
2428         while (vals)
2429         {
2430             vals_count++;
2431             OIC_LOG_V(INFO, TAG, "Print validities[%d]:", vals_count);
2432
2433             OIC_LOG_V(INFO, TAG, "period = %s", vals->period);
2434             for (size_t i = 0; i < vals->recurrenceLen; i++)
2435             {
2436                 OIC_LOG_V(INFO, TAG, "recurrences[%zu] = %s", i, vals->recurrences[i]);
2437             }
2438         }
2439
2440         ace = ace->next;
2441     }
2442 }
2443
2444 OCStackResult AppendACL2(const OicSecAcl_t* acl)
2445 {
2446     OCStackResult ret = OC_STACK_ERROR;
2447
2448     if (!acl)
2449     {
2450         return OC_STACK_INVALID_PARAM;
2451     }
2452
2453     // Append the new ACE to existing ACE list
2454     // Can't use LL_APPEND because it sets ace->next to NULL
2455     OicSecAce_t* ace = gAcl->aces;
2456     if (ace)
2457     {
2458         while (ace->next)
2459         {
2460             ace = ace->next;
2461         }
2462         ace->next = acl->aces;
2463     }
2464     else
2465     {
2466         gAcl->aces = acl->aces;
2467     }
2468
2469     printACL(gAcl);
2470
2471     size_t size = 0;
2472     uint8_t *payload = NULL;
2473     ret = AclToCBORPayload(gAcl, &payload, &size);
2474     if (OC_STACK_OK == ret)
2475     {
2476         ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size);
2477         OICFree(payload);
2478     }
2479
2480     return ret;
2481 }
2482
2483 OCStackResult AppendACL(const uint8_t *cborPayload, const size_t size)
2484 {
2485     // Convert CBOR format to ACL data. This will also validate the ACL data received.
2486     OicSecAcl_t* newAcl = CBORPayloadToAcl(cborPayload, size);
2487
2488     return AppendACL2(newAcl);
2489 }
2490
2491 OCStackResult InstallACL(const OicSecAcl_t* acl)
2492 {
2493     OCStackResult ret = OC_STACK_ERROR;
2494
2495     if (!acl)
2496     {
2497         return OC_STACK_INVALID_PARAM;
2498     }
2499
2500     bool isNewAce = true;
2501     OicSecAce_t* existAce = NULL;
2502     OicSecAce_t* newAce = NULL;
2503     OicSecAce_t* tempAce1 = NULL;
2504     OicSecAce_t* tempAce2 = NULL;
2505     OicSecAcl_t* newInstallAcl = NULL;
2506
2507     LL_FOREACH_SAFE(acl->aces, newAce, tempAce1)
2508     {
2509         isNewAce = true;
2510         LL_FOREACH_SAFE(gAcl->aces, existAce, tempAce2)
2511         {
2512             if(IsSameACE(newAce, existAce))
2513             {
2514                 OIC_LOG(DEBUG, TAG, "Duplicated ACE dectected.");
2515                 ret = OC_STACK_DUPLICATE_REQUEST;
2516                 isNewAce = false;
2517             }
2518         }
2519         if(isNewAce)
2520         {
2521             // Append new ACE to existing ACL
2522             OIC_LOG(DEBUG, TAG, "NEW ACE dectected.");
2523
2524             OicSecAce_t* insertAce = DuplicateACE(newAce);
2525             if(insertAce)
2526             {
2527                 OIC_LOG(DEBUG, TAG, "Appending new ACE..");
2528
2529                 if (!newInstallAcl)
2530                 {
2531                     newInstallAcl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
2532                     if (NULL == newInstallAcl)
2533                     {
2534                         OIC_LOG(ERROR, TAG, "Failed to acllocate ACL");
2535                         return OC_STACK_NO_MEMORY;
2536                     }
2537                 }
2538                 LL_PREPEND(newInstallAcl->aces, insertAce);
2539             }
2540             else
2541             {
2542                 OIC_LOG(ERROR, TAG, "Failed to duplicate ACE");
2543                 DeleteACLList(newInstallAcl);
2544                 return OC_STACK_ERROR;
2545             }
2546         }
2547     }
2548
2549     if (newInstallAcl)
2550     {
2551         ret = AppendACL2(newInstallAcl);
2552         if (OC_STACK_OK != ret)
2553         {
2554             OIC_LOG(ERROR, TAG, "Failed to append ACL");
2555         }
2556         OICFree(newInstallAcl);
2557     }
2558
2559     return ret;
2560 }
2561
2562 /**
2563  * This function generates default ACE for security resource in case of owned status.
2564  *
2565  * @return Default ACE for security resource.
2566  */
2567 static OicSecAce_t* GetSecDefaultACE()
2568 {
2569     const int NUM_OF_DOXM_RT = 1;
2570     const int NUM_OF_DOXM_IF  = 1;
2571     const int NUM_OF_PSTAT_RT = 1;
2572     const int NUM_OF_PSTAT_IF = 1;
2573     const char *doxmRt[] = { OIC_RSRC_TYPE_SEC_DOXM };
2574     const char *pstatRt[] = { OIC_RSRC_TYPE_SEC_PSTAT };
2575     const char *doxmIf[] = { OC_RSRVD_INTERFACE_DEFAULT };
2576     const char *pstatIf[] = { OC_RSRVD_INTERFACE_DEFAULT };
2577     OicSecRsrc_t* doxmRsrc = NULL;
2578     OicSecRsrc_t* pstatRsrc = NULL;
2579
2580     //Generate default ACE
2581     OicSecAce_t* newAce = (OicSecAce_t*)OICCalloc(1, sizeof(OicSecAce_t));
2582     VERIFY_NON_NULL(TAG, newAce, ERROR);
2583
2584     // Subject -- Mandatory
2585     memcpy(newAce->subjectuuid.id, &WILDCARD_SUBJECT_ID, WILDCARD_SUBJECT_ID_LEN);
2586
2587     //Resources -- Mandatory
2588     //Add doxm
2589     doxmRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2590     VERIFY_NON_NULL(TAG, doxmRsrc, ERROR);
2591     LL_APPEND(newAce->resources, doxmRsrc);
2592     // pstat-href
2593     doxmRsrc->href = OICStrdup(OIC_RSRC_DOXM_URI);
2594     VERIFY_NON_NULL(TAG, (doxmRsrc->href), ERROR);
2595     // pstat-rt
2596     doxmRsrc->typeLen = NUM_OF_DOXM_RT;
2597     doxmRsrc->types = (char**)OICCalloc(NUM_OF_DOXM_RT, sizeof(char*));
2598     VERIFY_NON_NULL(TAG, (doxmRsrc->types), ERROR);
2599     for(int i = 0; i < NUM_OF_DOXM_RT; i++)
2600     {
2601         doxmRsrc->types[i] = OICStrdup(doxmRt[i]);
2602         VERIFY_NON_NULL(TAG, (doxmRsrc->types[i]), ERROR);
2603     }
2604     // pstat-if
2605     doxmRsrc->interfaceLen = NUM_OF_DOXM_IF;
2606     doxmRsrc->interfaces = (char**)OICCalloc(NUM_OF_DOXM_IF, sizeof(char*));
2607     VERIFY_NON_NULL(TAG, (doxmRsrc->interfaces), ERROR);
2608     for(int i = 0; i < NUM_OF_DOXM_IF; i++)
2609     {
2610         doxmRsrc->interfaces[i] = OICStrdup(doxmIf[i]);
2611         VERIFY_NON_NULL(TAG, (doxmRsrc->interfaces[i]), ERROR);
2612     }
2613
2614     //Add pstat
2615     pstatRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2616     VERIFY_NON_NULL(TAG, pstatRsrc, ERROR);
2617     LL_APPEND(newAce->resources, pstatRsrc);
2618     //pstat-href
2619     pstatRsrc->href = OICStrdup(OIC_RSRC_PSTAT_URI);
2620     VERIFY_NON_NULL(TAG, (pstatRsrc->href), ERROR);
2621     //pstat-rt
2622     pstatRsrc->typeLen = NUM_OF_PSTAT_RT;
2623     pstatRsrc->types = (char**)OICCalloc(NUM_OF_PSTAT_RT, sizeof(char*));
2624     VERIFY_NON_NULL(TAG, (pstatRsrc->types), ERROR);
2625     for(int i = 0; i < NUM_OF_PSTAT_RT; i++)
2626     {
2627         pstatRsrc->types[i] = OICStrdup(pstatRt[i]);
2628         VERIFY_NON_NULL(TAG, (pstatRsrc->types[i]), ERROR);
2629     }
2630     // pstat-if
2631     pstatRsrc->interfaceLen = NUM_OF_PSTAT_IF;
2632     pstatRsrc->interfaces = (char**)OICCalloc(NUM_OF_PSTAT_IF, sizeof(char*));
2633     VERIFY_NON_NULL(TAG, (pstatRsrc->interfaces), ERROR);
2634     for(int i = 0; i < NUM_OF_PSTAT_IF; i++)
2635     {
2636         pstatRsrc->interfaces[i] = OICStrdup(pstatIf[i]);
2637         VERIFY_NON_NULL(TAG, (pstatRsrc->interfaces[i]), ERROR);
2638     }
2639
2640     // Permissions -- Mandatory
2641     newAce->permission = PERMISSION_READ;
2642
2643     //Period -- Not Mandatory
2644     newAce->validities = NULL;
2645
2646     return newAce;
2647 exit:
2648     FreeACE(newAce);
2649     return NULL;
2650
2651 }
2652
2653 OCStackResult UpdateDefaultSecProvACE()
2654 {
2655     OCStackResult ret = OC_STACK_OK;
2656     OicSecAce_t *ace = NULL;
2657     OicSecAce_t *tempAce = NULL;
2658
2659     if(gAcl)
2660     {
2661         int matchedRsrc = 0;
2662         bool isRemoved = false;
2663
2664         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
2665         {
2666             //Find default security resource ACL
2667             if(memcmp(&ace->subjectuuid, &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t)) == 0 &&
2668                 ((PERMISSION_READ | PERMISSION_WRITE) == ace->permission))
2669             {
2670                 matchedRsrc = 0;
2671
2672                 OicSecRsrc_t* rsrc = NULL;
2673                 LL_FOREACH(ace->resources, rsrc)
2674                 {
2675                     if(strncmp(rsrc->href, OIC_RSRC_DOXM_URI,
2676                                strlen(OIC_RSRC_DOXM_URI) + 1) == 0 ||
2677                        strncmp(rsrc->href, OIC_RSRC_CRED_URI,
2678                                strlen(OIC_RSRC_CRED_URI) + 1) == 0 ||
2679                        strncmp(rsrc->href, OIC_RSRC_ACL_URI,
2680                                strlen(OIC_RSRC_ACL_URI) + 1) == 0 ||
2681                        strncmp(rsrc->href, OIC_RSRC_PSTAT_URI,
2682                                strlen(OIC_RSRC_PSTAT_URI) + 1) == 0)
2683                     {
2684                         matchedRsrc++;
2685                     }
2686                 }
2687
2688                 //If default security resource ACL is detected, delete it.
2689                 if(NUMBER_OF_SEC_PROV_RSCS == matchedRsrc)
2690                 {
2691                     LL_DELETE(gAcl->aces, ace);
2692                     FreeACE(ace);
2693                     isRemoved = true;
2694                 }
2695             }
2696         }
2697
2698         if(isRemoved)
2699         {
2700             /*
2701              * Generate new security resource ACE as follows :
2702              *      subject : "*"
2703              *      resources :  '/oic/sec/doxm', '/oic/sec/pstat'
2704              *      permission : READ
2705              */
2706             OicSecAce_t *secDefaultAce = GetSecDefaultACE();
2707             if (secDefaultAce)
2708             {
2709                 LL_APPEND(gAcl->aces, secDefaultAce);
2710
2711                 size_t size = 0;
2712                 uint8_t *payload = NULL;
2713                 if (OC_STACK_OK == AclToCBORPayload(gAcl, &payload, &size))
2714                 {
2715                     if (UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size) == OC_STACK_OK)
2716                     {
2717                         ret = OC_STACK_OK;
2718                     }
2719                     OICFree(payload);
2720                 }
2721             }
2722         }
2723     }
2724
2725     return ret;
2726 }
2727
2728 OCStackResult SetAclRownerId(const OicUuid_t* newROwner)
2729 {
2730     OCStackResult ret = OC_STACK_ERROR;
2731     uint8_t *cborPayload = NULL;
2732     size_t size = 0;
2733     OicUuid_t prevId = {.id={0}};
2734
2735     if(NULL == newROwner)
2736     {
2737         ret = OC_STACK_INVALID_PARAM;
2738     }
2739     if(NULL == gAcl)
2740     {
2741         ret = OC_STACK_NO_RESOURCE;
2742     }
2743
2744     if(newROwner && gAcl)
2745     {
2746         memcpy(prevId.id, gAcl->rownerID.id, sizeof(prevId.id));
2747         memcpy(gAcl->rownerID.id, newROwner->id, sizeof(newROwner->id));
2748
2749         ret = AclToCBORPayload(gAcl, &cborPayload, &size);
2750         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, ERROR);
2751
2752         ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, cborPayload, size);
2753         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, ERROR);
2754
2755         OICFree(cborPayload);
2756     }
2757
2758     return ret;
2759
2760 exit:
2761     OICFree(cborPayload);
2762     memcpy(gAcl->rownerID.id, prevId.id, sizeof(prevId.id));
2763     return ret;
2764 }
2765
2766 OCStackResult GetAclRownerId(OicUuid_t *rowneruuid)
2767 {
2768     OCStackResult retVal = OC_STACK_ERROR;
2769     if (gAcl)
2770     {
2771         *rowneruuid = gAcl->rownerID;
2772         retVal = OC_STACK_OK;
2773     }
2774     return retVal;
2775 }