resource/csdk/security/src/aclresource.c

   1 //******************************************************************
   2 //
   3 // Copyright 2015 Intel Mobile Communications GmbH All Rights Reserved.
   4 //
   5 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   6 //
   7 // Licensed under the Apache License, Version 2.0 (the "License");
   8 // you may not use this file except in compliance with the License.
   9 // You may obtain a copy of the License at
  10 //
  11 //      http://www.apache.org/licenses/LICENSE-2.0
  12 //
  13 // Unless required by applicable law or agreed to in writing, software
  14 // distributed under the License is distributed on an "AS IS" BASIS,
  15 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16 // See the License for the specific language governing permissions and
  17 // limitations under the License.
  18 //
  19 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  20
  21 #include "iotivity_config.h"
  22 #ifdef HAVE_STRING_H
  23 #include <string.h>
  24 #elif defined(HAVE_STRINGS_H)
  25 #include <strings.h>
  26 #endif
  27 #include <stdlib.h>
  28
  29 #include "utlist.h"
  30 #include "ocstack.h"
  31 #include "octypes.h"
  32 #include "ocserverrequest.h"
  33 #include "oic_malloc.h"
  34 #include "oic_string.h"
  35 #include "ocrandom.h"
  36 #include "ocpayload.h"
  37 #include "utlist.h"
  38 #include "payload_logging.h"
  39 #include "srmresourcestrings.h"
  40 #include "aclresource.h"
  41 #include "doxmresource.h"
  42 #include "resourcemanager.h"
  43 #include "srmutility.h"
  44 #include "psinterface.h"
  45 #include "ocpayloadcbor.h"
  46
  47 #include "security_internals.h"
  48
  49 #define TAG  "OIC_SRM_ACL"
  50 #define NUMBER_OF_SEC_PROV_RSCS 4
  51 #define NUMBER_OF_DEFAULT_SEC_RSCS 2
  52 #define STRING_UUID_SIZE (UUID_LENGTH * 2 + 5)
  53
  54 static const uint8_t ACL_MAP_SIZE = 4;
  55 static const uint8_t ACL_ACLIST_MAP_SIZE = 1;
  56 static const uint8_t ACL_ACES_MAP_SIZE = 3;
  57 static const uint8_t ACL_RESOURCE_MAP_SIZE = 3;
  58
  59
  60 // CborSize is the default cbor payload size being used.
  61 static const uint16_t CBOR_SIZE = 2048*8;
  62
  63 static OicSecAcl_t *gAcl = NULL;
  64 static OCResourceHandle gAclHandle = NULL;
  65
  66 void FreeRsrc(OicSecRsrc_t *rsrc)
  67 {
  68     //Clean each member of resource
  69     OICFree(rsrc->href);
  70     OICFree(rsrc->rel);
  71     //Clean "rt"
  72     if(0 < rsrc->typeLen && rsrc->types)
  73     {
  74         for(size_t i = 0; i < rsrc->typeLen; i++)
  75         {
  76             OICFree(rsrc->types[i]);
  77         }
  78         OICFree(rsrc->types);
  79         rsrc->types = NULL;
  80     }
  81     //Clean "if"
  82     if(0 < rsrc->interfaceLen && rsrc->interfaces)
  83     {
  84         for(size_t i = 0; i < rsrc->interfaceLen; i++)
  85         {
  86             OICFree(rsrc->interfaces[i]);
  87         }
  88         OICFree(rsrc->interfaces);
  89         rsrc->interfaces = NULL;
  90     }
  91     OICFree(rsrc);
  92     rsrc = NULL;
  93 }
  94
  95 /**
  96  * This function frees OicSecAcl_t object's fields and object itself.
  97  */
  98 static void FreeACE(OicSecAce_t *ace)
  99 {
 100     if (NULL == ace)
 101     {
 102         OIC_LOG(ERROR, TAG, "Invalid Parameter");
 103         return;
 104     }
 105
 106     //Clean Resources
 107     OicSecRsrc_t* rsrc = NULL;
 108     OicSecRsrc_t* tmpRsrc = NULL;
 109     LL_FOREACH_SAFE(ace->resources, rsrc, tmpRsrc)
 110     {
 111         LL_DELETE(ace->resources, rsrc);
 112         FreeRsrc(rsrc);
 113     }
 114
 115     //Clean Validities
 116     OicSecValidity_t *validity = NULL;
 117     OicSecValidity_t *tmpValidity = NULL;
 118     LL_FOREACH_SAFE(ace->validities, validity, tmpValidity)
 119     {
 120         LL_DELETE(ace->validities, validity);
 121
 122         //Clean period
 123         OICFree(validity->period);
 124
 125         //Clean recurrence
 126         for(size_t i = 0; i < validity->recurrenceLen; i++)
 127         {
 128             OICFree(validity->recurrences[i]);
 129         }
 130         OICFree(validity->recurrences);
 131         OICFree(validity);
 132         validity = NULL;
 133     }
 134
 135 #ifdef _ENABLE_MULTIPLE_OWNER_
 136     OICFree(ace->eownerID);
 137 #endif
 138
 139     //Clean ACE
 140     OICFree(ace);
 141     ace = NULL;
 142 }
 143
 144 void DeleteACLList(OicSecAcl_t* acl)
 145 {
 146     if (acl)
 147     {
 148         OicSecAce_t *ace = NULL;
 149         OicSecAce_t *tmpAce = NULL;
 150         LL_FOREACH_SAFE(acl->aces, ace, tmpAce)
 151         {
 152             LL_DELETE(acl->aces, ace);
 153             FreeACE(ace);
 154         }
 155         acl->aces = NULL;
 156         OICFree(acl);
 157     }
 158 }
 159
 160 OicSecAce_t* DuplicateACE(const OicSecAce_t* ace)
 161 {
 162     OicSecAce_t* newAce = NULL;
 163     size_t allocateSize = 0;
 164
 165     if(ace)
 166     {
 167         newAce = (OicSecAce_t*)OICCalloc(1, sizeof(OicSecAce_t));
 168         VERIFY_NON_NULL(TAG, newAce, ERROR);
 169
 170         //Subject uuid
 171         memcpy(&newAce->subjectuuid, &ace->subjectuuid, sizeof(OicUuid_t));
 172
 173         OicSecRsrc_t* rsrc = NULL;
 174         LL_FOREACH(ace->resources, rsrc)
 175         {
 176             OicSecRsrc_t* newRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
 177             VERIFY_NON_NULL(TAG, newRsrc, ERROR);
 178             LL_APPEND(newAce->resources, newRsrc);
 179
 180             //href is mandatory
 181             VERIFY_NON_NULL(TAG, rsrc->href, ERROR);
 182             allocateSize = strlen(rsrc->href) + 1;
 183             newRsrc->href = (char*)OICMalloc(sizeof(char) * allocateSize);
 184             VERIFY_NON_NULL(TAG, newRsrc->href, ERROR);
 185             OICStrcpy(newRsrc->href, allocateSize, rsrc->href);
 186
 187             if(rsrc->rel)
 188             {
 189                 allocateSize = strlen(rsrc->rel) + 1;
 190                 newRsrc->rel = (char*)OICMalloc(sizeof(char) * allocateSize);
 191                 VERIFY_NON_NULL(TAG, newRsrc->rel, ERROR);
 192                 OICStrcpy(newRsrc->rel, allocateSize, rsrc->rel);
 193             }
 194
 195             if(rsrc->types && 0 < rsrc->typeLen)
 196             {
 197                 newRsrc->typeLen = rsrc->typeLen;
 198                 newRsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
 199                 VERIFY_NON_NULL(TAG, (newRsrc->types), ERROR);
 200                 for(size_t i = 0; i < rsrc->typeLen; i++)
 201                 {
 202                     newRsrc->types[i] = OICStrdup(rsrc->types[i]);
 203                     VERIFY_NON_NULL(TAG, (newRsrc->types[i]), ERROR);
 204                 }
 205             }
 206
 207             if(rsrc->interfaces && 0 < rsrc->interfaceLen)
 208             {
 209                 newRsrc->interfaceLen = rsrc->interfaceLen;
 210                 newRsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
 211                 VERIFY_NON_NULL(TAG, (newRsrc->interfaces), ERROR);
 212                 for(size_t i = 0; i < rsrc->interfaceLen; i++)
 213                 {
 214                     newRsrc->interfaces[i] = OICStrdup(rsrc->interfaces[i]);
 215                     VERIFY_NON_NULL(TAG, (newRsrc->interfaces[i]), ERROR);
 216                 }
 217             }
 218         }
 219
 220         //Permission
 221         newAce->permission = ace->permission;
 222
 223         //Validity
 224         if(ace->validities)
 225         {
 226             OicSecValidity_t* validity = NULL;
 227             LL_FOREACH(ace->validities, validity)
 228             {
 229                 OicSecValidity_t* newValidity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
 230                 VERIFY_NON_NULL(TAG, newValidity, ERROR);
 231                 LL_APPEND(newAce->validities, newValidity);
 232
 233                 if(validity->period)
 234                 {
 235                     allocateSize = strlen(validity->period) + 1;
 236                     newValidity->period = (char*)OICMalloc(sizeof(char) * allocateSize);
 237                     VERIFY_NON_NULL(TAG, newValidity->period, ERROR);
 238                     OICStrcpy(newValidity->period, allocateSize, validity->period);
 239                 }
 240
 241                 if(validity->recurrences && 0 < validity->recurrenceLen)
 242                 {
 243                     newValidity->recurrenceLen = validity->recurrenceLen;
 244
 245                     newValidity->recurrences = (char**)OICMalloc(sizeof(char*) * validity->recurrenceLen);
 246                     VERIFY_NON_NULL(TAG, newValidity->recurrences, ERROR);
 247
 248                     for(size_t i = 0; i < validity->recurrenceLen; i++)
 249                     {
 250                         allocateSize = strlen(validity->recurrences[i]) + 1;
 251                         newValidity->recurrences[i] = (char*)OICMalloc(sizeof(char) * allocateSize);
 252                         VERIFY_NON_NULL(TAG, (newValidity->recurrences[i]), ERROR);
 253                         OICStrcpy(newValidity->recurrences[i], allocateSize, validity->recurrences[i]);
 254                     }
 255                 }
 256             }
 257         }
 258
 259 #ifdef _ENABLE_MULTIPLE_OWNER_
 260         if (ace->eownerID)
 261         {
 262             if (NULL == newAce->eownerID)
 263             {
 264                 newAce->eownerID = (OicUuid_t*)OICCalloc(1, sizeof(OicUuid_t));
 265                 VERIFY_NON_NULL(TAG, (newAce->eownerID), ERROR);
 266             }
 267             memcpy(newAce->eownerID->id, ace->eownerID->id, sizeof(ace->eownerID->id));
 268         }
 269 #endif
 270
 271         newAce->next = NULL;
 272     }
 273
 274     return newAce;
 275
 276 exit:
 277     FreeACE(newAce);
 278     return NULL;
 279 }
 280
 281 static size_t OicSecAclSize(const OicSecAcl_t *secAcl)
 282 {
 283     if (!secAcl)
 284     {
 285         return 0;
 286     }
 287     OicSecAce_t *ace= (OicSecAce_t *)secAcl->aces;
 288     size_t size = 0;
 289     while (ace)
 290     {
 291        size++;
 292        ace = ace->next;
 293     }
 294     return size;
 295 }
 296
 297 OCStackResult AclToCBORPayload(const OicSecAcl_t *secAcl, uint8_t **payload, size_t *size)
 298 {
 299      if (NULL == secAcl || NULL == payload || NULL != *payload || NULL == size)
 300     {
 301         return OC_STACK_INVALID_PARAM;
 302     }
 303
 304     OCStackResult ret = OC_STACK_ERROR;
 305     CborError cborEncoderResult = CborNoError;
 306     OicSecAcl_t *acl = (OicSecAcl_t *)secAcl;
 307     OicSecAce_t* ace = NULL;
 308     CborEncoder encoder;
 309     CborEncoder aclMap;
 310     CborEncoder aclListMap;
 311     CborEncoder acesArray;
 312     uint8_t *outPayload = NULL;
 313     size_t cborLen = *size;
 314     *size = 0;
 315     *payload = NULL;
 316
 317     if (cborLen == 0)
 318     {
 319         cborLen = CBOR_SIZE;
 320     }
 321
 322     outPayload = (uint8_t *)OICCalloc(1, cborLen);
 323     VERIFY_NON_NULL(TAG, outPayload, ERROR);
 324     cbor_encoder_init(&encoder, outPayload, cborLen, 0);
 325
 326     // Create ACL Map (aclist, rownerid)
 327     cborEncoderResult = cbor_encoder_create_map(&encoder, &aclMap, ACL_MAP_SIZE);
 328     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACL Map.");
 329
 330     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_ACLIST_NAME,
 331         strlen(OIC_JSON_ACLIST_NAME));
 332     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding aclist Name Tag.");
 333
 334     // Create ACLIST Map (aces)
 335     cborEncoderResult = cbor_encoder_create_map(&aclMap, &aclListMap, ACL_ACLIST_MAP_SIZE);
 336     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACLIST Map.");
 337
 338     cborEncoderResult = cbor_encode_text_string(&aclListMap, OIC_JSON_ACES_NAME,
 339         strlen(OIC_JSON_ACES_NAME));
 340     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding ACES Name Tag.");
 341
 342     // Create ACES Array
 343     cborEncoderResult = cbor_encoder_create_array(&aclListMap, &acesArray, OicSecAclSize(secAcl));
 344     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACES Array.");
 345
 346     ace = NULL;
 347     LL_FOREACH (acl->aces, ace)
 348     {
 349         CborEncoder oicSecAclMap;
 350         // ACL Map size - Number of mandatory items
 351         uint8_t aclMapSize = ACL_ACES_MAP_SIZE;
 352         size_t inLen = 0;
 353
 354         OicSecValidity_t* validityElts = ace->validities;
 355         while(validityElts)
 356         {
 357             if(validityElts->period)
 358             {
 359                 aclMapSize++;
 360             }
 361             if(validityElts->recurrences)
 362             {
 363                 aclMapSize++;
 364             }
 365         }
 366
 367 #ifdef _ENABLE_MULTIPLE_OWNER_
 368         if(ace->eownerID)
 369         {
 370             aclMapSize++;
 371         }
 372 #endif //_ENABLE_MULTIPLE_OWNER_
 373
 374         cborEncoderResult = cbor_encoder_create_map(&acesArray, &oicSecAclMap, aclMapSize);
 375         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACES Map");
 376
 377         // Subject -- Mandatory
 378         cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_SUBJECTID_NAME,
 379             strlen(OIC_JSON_SUBJECTID_NAME));
 380         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Subject Name Tag.");
 381         inLen = (memcmp(&(ace->subjectuuid), &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t)) == 0) ?
 382             WILDCARD_SUBJECT_ID_LEN : sizeof(OicUuid_t);
 383         if(inLen == WILDCARD_SUBJECT_ID_LEN)
 384         {
 385             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, WILDCARD_RESOURCE_URI,
 386                 strlen(WILDCARD_RESOURCE_URI));
 387             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Subject Id wildcard Value.");
 388         }
 389         else
 390         {
 391             char *subject = NULL;
 392             ret = ConvertUuidToStr(&ace->subjectuuid, &subject);
 393             VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 394             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, subject, strlen(subject));
 395             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Subject UUID Value.");
 396             OICFree(subject);
 397         }
 398
 399         // Resources
 400         {
 401             CborEncoder resources;
 402             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_RESOURCES_NAME,
 403                 strlen(OIC_JSON_RESOURCES_NAME));
 404             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Resource Name Tag.");
 405
 406             size_t rsrcLen = 0;
 407             OicSecRsrc_t* rsrcElts = NULL;
 408             LL_FOREACH(ace->resources, rsrcElts)
 409             {
 410                 rsrcLen++;
 411             }
 412
 413             cborEncoderResult = cbor_encoder_create_array(&oicSecAclMap, &resources, rsrcLen);
 414             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Resource Name Array.");
 415
 416             OicSecRsrc_t* rsrc = NULL;
 417             LL_FOREACH(ace->resources, rsrc)
 418             {
 419
 420                 CborEncoder rMap;
 421                 size_t rsrcMapSize = ACL_RESOURCE_MAP_SIZE;
 422                 if(rsrc->rel)
 423                 {
 424                     rsrcMapSize++;
 425                 }
 426
 427                 cborEncoderResult = cbor_encoder_create_map(&resources, &rMap, rsrcMapSize);
 428                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Resource Map.");
 429
 430                 //href -- Mandatory
 431                 VERIFY_NON_NULL(TAG, rsrc->href, ERROR);
 432                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_HREF_NAME,
 433                         strlen(OIC_JSON_HREF_NAME));
 434                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding HREF Name Tag.");
 435                 cborEncoderResult = cbor_encode_text_string(&rMap, rsrc->href, strlen(rsrc->href));
 436                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding HREF Value in Map.");
 437
 438                 //resource type -- Mandatory
 439                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_RT_NAME,
 440                         strlen(OIC_JSON_RT_NAME));
 441                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Name Tag.");
 442
 443                 CborEncoder resourceTypes;
 444                 cborEncoderResult = cbor_encoder_create_array(&rMap, &resourceTypes, rsrc->typeLen);
 445                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding RT Array.");
 446                 for(size_t i = 0; i < rsrc->typeLen; i++)
 447                 {
 448                     cborEncoderResult = cbor_encode_text_string(&resourceTypes, rsrc->types[i], strlen(rsrc->types[i]));
 449                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Value.");
 450                 }
 451                 cborEncoderResult = cbor_encoder_close_container(&rMap, &resourceTypes);
 452                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing resourceTypes.");
 453
 454                 //interface -- Mandatory
 455                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_IF_NAME,
 456                         strlen(OIC_JSON_IF_NAME));
 457                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Name Tag.");
 458
 459                 CborEncoder interfaces;
 460                 cborEncoderResult = cbor_encoder_create_array(&rMap, &interfaces, rsrc->interfaceLen);
 461                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding IF Array.");
 462                 for(size_t i = 0; i < rsrc->interfaceLen; i++)
 463                 {
 464                     cborEncoderResult = cbor_encode_text_string(&interfaces, rsrc->interfaces[i], strlen(rsrc->interfaces[i]));
 465                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Value.");
 466                 }
 467                 cborEncoderResult = cbor_encoder_close_container(&rMap, &interfaces);
 468                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing interfaces.");
 469
 470                 //rel
 471                 if(rsrc->rel)
 472                 {
 473                     cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_REL_NAME,
 474                             strlen(OIC_JSON_REL_NAME));
 475                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding REL Name Tag.");
 476                     cborEncoderResult = cbor_encode_text_string(&rMap, rsrc->rel, strlen(rsrc->rel));
 477                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding REL Value.");
 478                 }
 479
 480                 cborEncoderResult = cbor_encoder_close_container(&resources, &rMap);
 481                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Resource Map.");
 482             }
 483             cborEncoderResult = cbor_encoder_close_container(&oicSecAclMap, &resources);
 484             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Resource Name Array.");
 485         }
 486
 487         // Permissions -- Mandatory
 488         cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_PERMISSION_NAME,
 489             strlen(OIC_JSON_PERMISSION_NAME));
 490         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Permission Name Tag.");
 491         cborEncoderResult = cbor_encode_int(&oicSecAclMap, ace->permission);
 492         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Permission Name Value.");
 493
 494         // TODO: Need to verfication for validity
 495         // Validity(Time-interval) -- Not Mandatory
 496         if(ace->validities)
 497         {
 498             size_t validityLen = 0;
 499             validityElts = NULL;
 500             LL_FOREACH(ace->validities, validityElts)
 501             {
 502                 validityLen++;
 503             }
 504
 505             CborEncoder validities;
 506             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_VALIDITY_NAME,
 507                 strlen(OIC_JSON_VALIDITY_NAME));
 508             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validity Tag.");
 509             cborEncoderResult = cbor_encoder_create_array(&oicSecAclMap, &validities, validityLen);
 510             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validities Array.");
 511
 512             //How to add the value w/o "title" using tinycobr...? :(
 513
 514             validityElts = NULL;
 515             LL_FOREACH(ace->validities, validityElts)
 516             {
 517                  CborEncoder validity;
 518                  size_t validitySize = 0;
 519                  if(validityElts->period)
 520                 {
 521                     validitySize++;
 522                 }
 523                 if(validityElts->recurrences)
 524                 {
 525                     validitySize++;
 526                 }
 527
 528                 cborEncoderResult = cbor_encoder_create_array(&validities, &validity, validitySize);
 529                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validity Array.");
 530
 531                 // Period
 532                 if (validityElts->period)
 533                 {
 534                     cborEncoderResult = cbor_encode_text_string(&validity, validityElts->period,
 535                         strlen(validityElts->period));
 536                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Period Value.");
 537                 }
 538
 539                 // Recurrence
 540                 if (validityElts->recurrences)
 541                 {
 542                     CborEncoder recurrences;
 543                     cborEncoderResult = cbor_encoder_create_array(&validity, &recurrences, validityElts->recurrenceLen);
 544                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Recurrence Array.");
 545
 546                     for (size_t i = 0; i < validityElts->recurrenceLen; i++)
 547                     {
 548                         cborEncoderResult = cbor_encode_text_string(&recurrences, validityElts->recurrences[i],
 549                             strlen(validityElts->recurrences[i]));
 550                         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Recurrence Array Value.");
 551                     }
 552                     cborEncoderResult = cbor_encoder_close_container(&validity, &recurrences);
 553                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Recurrence Array");
 554                 }
 555
 556                 cborEncoderResult = cbor_encoder_close_container(&validities, &validity);
 557                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Validity Array.");
 558             }
 559
 560             cborEncoderResult = cbor_encoder_close_container(&oicSecAclMap, &validities);
 561             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Validities Array.");
 562         }
 563
 564 #ifdef _ENABLE_MULTIPLE_OWNER_
 565         // Eownerid -- Not Mandatory
 566         if(ace->eownerID)
 567         {
 568             char *eowner = NULL;
 569             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_EOWNERID_NAME,
 570                 strlen(OIC_JSON_EOWNERID_NAME));
 571             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding eownerId Name Tag.");
 572             ret = ConvertUuidToStr(ace->eownerID, &eowner);
 573             VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 574             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, eowner, strlen(eowner));
 575             OICFree(eowner);
 576             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding eownerId Value.");
 577         }
 578 #endif //_ENABLE_MULTIPLE_OWNER_
 579
 580         cborEncoderResult = cbor_encoder_close_container(&acesArray, &oicSecAclMap);
 581         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACES Map.");
 582     }
 583
 584     // Close ACES Array
 585     cborEncoderResult = cbor_encoder_close_container(&aclListMap, &acesArray);
 586     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACES Array.");
 587
 588     // Close ACLIST Map
 589     cborEncoderResult = cbor_encoder_close_container(&aclMap, &aclListMap);
 590     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACLIST Map.");
 591
 592     // Rownerid
 593     {
 594         char *rowner = NULL;
 595         cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_ROWNERID_NAME,
 596             strlen(OIC_JSON_ROWNERID_NAME));
 597         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding rownerid Name.");
 598         ret = ConvertUuidToStr(&secAcl->rownerID, &rowner);
 599         VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 600         cborEncoderResult = cbor_encode_text_string(&aclMap, rowner, strlen(rowner));
 601         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding rownerid Value.");
 602         OICFree(rowner);
 603     }
 604
 605     //RT -- Mandatory
 606     CborEncoder rtArray;
 607     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_RT_NAME,
 608             strlen(OIC_JSON_RT_NAME));
 609     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Name Tag.");
 610     cborEncoderResult = cbor_encoder_create_array(&aclMap, &rtArray, 1);
 611     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Value.");
 612     for (size_t i = 0; i < 1; i++)
 613     {
 614         cborEncoderResult = cbor_encode_text_string(&rtArray, OIC_RSRC_TYPE_SEC_ACL,
 615                 strlen(OIC_RSRC_TYPE_SEC_ACL));
 616         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding RT Value.");
 617     }
 618     cborEncoderResult = cbor_encoder_close_container(&aclMap, &rtArray);
 619     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing RT.");
 620
 621     //IF-- Mandatory
 622     CborEncoder ifArray;
 623     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_IF_NAME,
 624              strlen(OIC_JSON_IF_NAME));
 625     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Name Tag.");
 626     cborEncoderResult = cbor_encoder_create_array(&aclMap, &ifArray, 1);
 627     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Value.");
 628     for (size_t i = 0; i < 1; i++)
 629     {
 630         cborEncoderResult = cbor_encode_text_string(&ifArray, OC_RSRVD_INTERFACE_DEFAULT,
 631                 strlen(OC_RSRVD_INTERFACE_DEFAULT));
 632         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding IF Value.");
 633     }
 634     cborEncoderResult = cbor_encoder_close_container(&aclMap, &ifArray);
 635     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing IF.");
 636
 637     // Close ACL Map
 638     cborEncoderResult = cbor_encoder_close_container(&encoder, &aclMap);
 639     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACL Map.");
 640
 641     if (CborNoError == cborEncoderResult)
 642     {
 643         OIC_LOG(DEBUG, TAG, "AclToCBORPayload Successed");
 644         *size = cbor_encoder_get_buffer_size(&encoder, outPayload);
 645         *payload = outPayload;
 646         ret = OC_STACK_OK;
 647     }
 648 exit:
 649     if (CborErrorOutOfMemory == cborEncoderResult)
 650     {
 651         OIC_LOG(DEBUG, TAG, "AclToCBORPayload:CborErrorOutOfMemory : retry with more memory");
 652
 653         // reallocate and try again!
 654         OICFree(outPayload);
 655         // Since the allocated initial memory failed, double the memory.
 656         cborLen += cbor_encoder_get_buffer_size(&encoder, encoder.end);
 657         cborEncoderResult = CborNoError;
 658         ret = AclToCBORPayload(secAcl, payload, &cborLen);
 659         *size = cborLen;
 660     }
 661     else if (cborEncoderResult != CborNoError)
 662     {
 663         OIC_LOG(ERROR, TAG, "Failed to AclToCBORPayload");
 664         OICFree(outPayload);
 665         outPayload = NULL;
 666         *size = 0;
 667         *payload = NULL;
 668         ret = OC_STACK_ERROR;
 669     }
 670
 671     return ret;
 672 }
 673
 674 // This function converts CBOR format to ACL data.
 675 // Caller needs to invoke 'free' when done using
 676 // It parses { "aclist" : [ { ... } ] } instead of { "aclist" : { "aces" : [ ] } }
 677 OicSecAcl_t* CBORPayloadToAcl2(const uint8_t *cborPayload, const size_t size)
 678 {
 679     if (NULL == cborPayload || 0 == size)
 680     {
 681         return NULL;
 682     }
 683     OCStackResult ret = OC_STACK_ERROR;
 684     CborValue aclCbor = { .parser = NULL };
 685     CborParser parser = { .end = NULL };
 686     CborError cborFindResult = CborNoError;
 687     cbor_parser_init(cborPayload, size, 0, &parser, &aclCbor);
 688
 689     OicSecAcl_t *acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
 690
 691     // Enter ACL Map
 692     CborValue aclMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 693     cborFindResult = cbor_value_enter_container(&aclCbor, &aclMap);
 694     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACL Map.");
 695
 696     while (cbor_value_is_valid(&aclMap))
 697     {
 698         char* tagName = NULL;
 699         size_t len = 0;
 700         CborType type = cbor_value_get_type(&aclMap);
 701         if (type == CborTextStringType)
 702         {
 703             cborFindResult = cbor_value_dup_text_string(&aclMap, &tagName, &len, NULL);
 704             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACL Map.");
 705             cborFindResult = cbor_value_advance(&aclMap);
 706             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACL Map.");
 707         }
 708         if(tagName)
 709         {
 710             if (strcmp(tagName, OIC_JSON_ACLIST_NAME)  == 0)
 711             {
 712                 // Enter ACES Array
 713                 CborValue acesArray = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 714                 cborFindResult = cbor_value_enter_container(&aclMap, &acesArray);
 715                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACES Array.");
 716
 717                 int acesCount = 0;
 718                 while (cbor_value_is_valid(&acesArray))
 719                 {
 720                     acesCount++;
 721                     CborValue aceMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 722                     cborFindResult = cbor_value_enter_container(&acesArray, &aceMap);
 723                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACE Map.");
 724
 725                     OicSecAce_t *ace = NULL;
 726                     ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
 727                     VERIFY_NON_NULL(TAG, ace, ERROR);
 728                     LL_APPEND(acl->aces, ace);
 729
 730                     VERIFY_NON_NULL(TAG, acl, ERROR);
 731
 732                     while (cbor_value_is_valid(&aceMap))
 733                     {
 734                         char* name = NULL;
 735                         size_t len = 0;
 736                         CborType type = cbor_value_get_type(&aceMap);
 737                         if (type == CborTextStringType)
 738                         {
 739                             cborFindResult = cbor_value_dup_text_string(&aceMap, &name, &len, NULL);
 740                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACE Map.");
 741                             cborFindResult = cbor_value_advance(&aceMap);
 742                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACE Map.");
 743                         }
 744                         if (name)
 745                         {
 746                             // Subject -- Mandatory
 747                             if (strcmp(name, OIC_JSON_SUBJECTID_NAME)  == 0)
 748                             {
 749                                 char *subject = NULL;
 750                                 cborFindResult = cbor_value_dup_text_string(&aceMap, &subject, &len, NULL);
 751                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding subject Value.");
 752                                 if(strcmp(subject, WILDCARD_RESOURCE_URI) == 0)
 753                                 {
 754                                     ace->subjectuuid.id[0] = '*';
 755                                 }
 756                                 else
 757                                 {
 758                                     OIC_LOG_V(DEBUG, TAG, "Converting subjectuuid = %s to uuid...", subject);
 759                                     ret = ConvertStrToUuid(subject, &ace->subjectuuid);
 760                                     VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 761                                 }
 762                                 OICFree(subject);
 763                             }
 764
 765                             // Resources -- Mandatory
 766                             if (strcmp(name, OIC_JSON_RESOURCES_NAME) == 0)
 767                             {
 768                                 CborValue resources = { .parser = NULL };
 769                                 cborFindResult = cbor_value_enter_container(&aceMap, &resources);
 770                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering a Resource Array.");
 771
 772                                 while (cbor_value_is_valid(&resources))
 773                                 {
 774                                     // rMap
 775                                     CborValue rMap = { .parser = NULL  };
 776                                     cborFindResult = cbor_value_enter_container(&resources, &rMap);
 777                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering Resource Map");
 778
 779                                     OicSecRsrc_t* rsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
 780                                     VERIFY_NON_NULL(TAG, rsrc, ERROR);
 781                                     LL_APPEND(ace->resources, rsrc);
 782
 783                                     while(cbor_value_is_valid(&rMap))
 784                                     {
 785                                         char *rMapName = NULL;
 786                                         size_t rMapNameLen = 0;
 787                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rMapName, &rMapNameLen, NULL);
 788                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Name Tag.");
 789                                         cborFindResult = cbor_value_advance(&rMap);
 790                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Value.");
 791
 792                                         // "href"
 793                                         if (0 == strcmp(OIC_JSON_HREF_NAME, rMapName))
 794                                         {
 795                                             cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->href, &len, NULL);
 796                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Href Value.");
 797                                         }
 798
 799                                         // "rt"
 800                                         if (0 == strcmp(OIC_JSON_RT_NAME, rMapName) && cbor_value_is_array(&rMap))
 801                                         {
 802                                             cbor_value_get_array_length(&rMap, &rsrc->typeLen);
 803                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RT array length.");
 804                                             VERIFY_SUCCESS(TAG, (0 != rsrc->typeLen), ERROR);
 805
 806                                             rsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
 807                                             VERIFY_NON_NULL(TAG, rsrc->types, ERROR);
 808
 809                                             CborValue resourceTypes;
 810                                             cborFindResult = cbor_value_enter_container(&rMap, &resourceTypes);
 811                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering RT Array.");
 812
 813                                             for(size_t i = 0; cbor_value_is_valid(&resourceTypes) && cbor_value_is_text_string(&resourceTypes); i++)
 814                                             {
 815                                                 size_t readLen = 0;
 816                                                 cborFindResult = cbor_value_dup_text_string(&resourceTypes, &(rsrc->types[i]), &readLen, NULL);
 817                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding resource type.");
 818                                                 cborFindResult = cbor_value_advance(&resourceTypes);
 819                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing resource type.");
 820                                             }
 821                                         }
 822
 823                                         // "if"
 824                                         if (0 == strcmp(OIC_JSON_IF_NAME, rMapName) && cbor_value_is_array(&rMap))
 825                                         {
 826                                             cbor_value_get_array_length(&rMap, &rsrc->interfaceLen);
 827                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF array length.");
 828                                             VERIFY_SUCCESS(TAG, (0 != rsrc->interfaceLen), ERROR);
 829
 830                                             rsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
 831                                             VERIFY_NON_NULL(TAG, rsrc->interfaces, ERROR);
 832
 833                                             CborValue interfaces;
 834                                             cborFindResult = cbor_value_enter_container(&rMap, &interfaces);
 835                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering IF Array.");
 836
 837                                             for(size_t i = 0; cbor_value_is_valid(&interfaces) && cbor_value_is_text_string(&interfaces); i++)
 838                                             {
 839                                                 size_t readLen = 0;
 840                                                 cborFindResult = cbor_value_dup_text_string(&interfaces, &(rsrc->interfaces[i]), &readLen, NULL);
 841                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF type.");
 842                                                 cborFindResult = cbor_value_advance(&interfaces);
 843                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing IF type.");
 844                                             }
 845                                         }
 846
 847                                         // "rel"
 848                                         if (0 == strcmp(OIC_JSON_REL_NAME, rMapName))
 849                                         {
 850                                             cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->rel, &len, NULL);
 851                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding REL Value.");
 852                                         }
 853
 854                                         if (cbor_value_is_valid(&rMap))
 855                                         {
 856                                             cborFindResult = cbor_value_advance(&rMap);
 857                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Rlist Map.");
 858                                         }
 859                                         OICFree(rMapName);
 860                                     }
 861
 862                                     if (cbor_value_is_valid(&resources))
 863                                     {
 864                                         cborFindResult = cbor_value_advance(&resources);
 865                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Resource Array.");
 866                                     }
 867                                 }
 868                             }
 869
 870                             // Permissions -- Mandatory
 871                             if (strcmp(name, OIC_JSON_PERMISSION_NAME) == 0)
 872                             {
 873                                 uint64_t tmp64;
 874                                 cborFindResult = cbor_value_get_uint64(&aceMap, &tmp64);
 875                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a PERM Value.");
 876                                 ace->permission = (uint16_t)tmp64;
 877                             }
 878
 879                             // TODO: Need to verfication for validity
 880                             // Validity -- Not mandatory
 881                             if(strcmp(name, OIC_JSON_VALIDITY_NAME) == 0)
 882                             {
 883                                 CborValue validitiesMap = {.parser = NULL};
 884                                 size_t validitySize = 0;
 885
 886                                 cborFindResult = cbor_value_get_array_length(&aceMap, &validitySize);
 887                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Validity Array Length.");
 888
 889                                 cborFindResult = cbor_value_enter_container(&aceMap, &validitiesMap);
 890                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Array Map.");
 891
 892                                 while(cbor_value_is_valid(&validitiesMap))
 893                                 {
 894                                     OicSecValidity_t* validity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
 895                                     VERIFY_NON_NULL(TAG, validity, ERROR);
 896                                     LL_APPEND(ace->validities, validity);
 897
 898                                     CborValue validityMap  = {.parser = NULL};
 899                                     //period (string)
 900                                     cborFindResult = cbor_value_enter_container(&validitiesMap, &validityMap);
 901                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Map.");
 902
 903                                     size_t len = 0;
 904                                     cborFindResult =cbor_value_dup_text_string(&validityMap, &validity->period, &len, NULL);
 905                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Period value.");
 906
 907                                     //recurrence (string array)
 908                                     CborValue recurrenceMap  = {.parser = NULL};
 909                                     cborFindResult = cbor_value_enter_container(&validityMap, &recurrenceMap);
 910                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence array.");
 911
 912                                     cborFindResult = cbor_value_get_array_length(&recurrenceMap, &validity->recurrenceLen);
 913                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Adding Recurrence Array.");
 914
 915                                     validity->recurrences = (char**)OICCalloc(validity->recurrenceLen, sizeof(char*));
 916                                     VERIFY_NON_NULL(TAG, validity->recurrences, ERROR);
 917
 918                                     for(size_t i = 0; cbor_value_is_text_string(&recurrenceMap) && i < validity->recurrenceLen; i++)
 919                                     {
 920                                         cborFindResult = cbor_value_dup_text_string(&recurrenceMap, &validity->recurrences[i], &len, NULL);
 921                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence Value.");
 922
 923                                         cborFindResult = cbor_value_advance(&recurrenceMap);
 924                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a recurrences Array.");
 925                                     }
 926
 927                                     cborFindResult = cbor_value_advance(&validitiesMap);
 928                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a validities Array.");
 929                                 }
 930                             }
 931                             OICFree(name);
 932                         }
 933
 934                         if (type != CborMapType && cbor_value_is_valid(&aceMap))
 935                         {
 936                             cborFindResult = cbor_value_advance(&aceMap);
 937                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing the Array.");
 938                         }
 939                     }
 940
 941                     if (cbor_value_is_valid(&acesArray))
 942                     {
 943                         cborFindResult = cbor_value_advance(&acesArray);
 944                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Array.");
 945                     }
 946                 }
 947             }
 948
 949             //rownerID -- Mandatory
 950             if (strcmp(tagName, OIC_JSON_ROWNERID_NAME)  == 0)
 951             {
 952                 char *stRowner = NULL;
 953                 cborFindResult = cbor_value_dup_text_string(&aclMap, &stRowner, &len, NULL);
 954                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Rownerid Value.");
 955                 OIC_LOG_V(DEBUG, TAG, "Converting rownerid = %s to uuid...", stRowner);
 956                 ret = ConvertStrToUuid(stRowner, &acl->rownerID);
 957                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 958                 OICFree(stRowner);
 959             }
 960             OICFree(tagName);
 961         }
 962         if (cbor_value_is_valid(&aclMap))
 963         {
 964             cborFindResult = cbor_value_advance(&aclMap);
 965             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Map.");
 966         }
 967     }
 968
 969 exit:
 970     if (cborFindResult != CborNoError)
 971     {
 972         OIC_LOG(ERROR, TAG, "Failed to CBORPayloadToAcl");
 973         DeleteACLList(acl);
 974         acl = NULL;
 975     }
 976
 977     return acl;
 978 }
 979
 980 // This function converts CBOR format to ACL data.
 981 // Caller needs to invoke 'free' when done using
 982 // note: This function is used in unit test hence not declared static,
 983 OicSecAcl_t* CBORPayloadToAcl(const uint8_t *cborPayload, const size_t size)
 984 {
 985     if (NULL == cborPayload || 0 == size)
 986     {
 987         return NULL;
 988     }
 989     OCStackResult ret = OC_STACK_ERROR;
 990     CborValue aclMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 991     CborValue aclCbor = { .parser = NULL };
 992     CborParser parser = { .end = NULL };
 993     CborError cborFindResult = CborNoError;
 994
 995     cbor_parser_init(cborPayload, size, 0, &parser, &aclCbor);
 996
 997     OicSecAcl_t *acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
 998     VERIFY_NON_NULL(TAG, acl, ERROR);
 999
1000     // Enter ACL Map
1001     cborFindResult = cbor_value_enter_container(&aclCbor, &aclMap);
1002     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACL Map.");
1003
1004     while (cbor_value_is_valid(&aclMap))
1005     {
1006         char* tagName = NULL;
1007         size_t len = 0;
1008         CborType type = cbor_value_get_type(&aclMap);
1009         if (type == CborTextStringType)
1010         {
1011             cborFindResult = cbor_value_dup_text_string(&aclMap, &tagName, &len, NULL);
1012             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACL Map.");
1013             cborFindResult = cbor_value_advance(&aclMap);
1014             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACL Map.");
1015         }
1016         if(tagName)
1017         {
1018             if (strcmp(tagName, OIC_JSON_ACLIST_NAME)  == 0)
1019             {
1020                 // Enter ACLIST Map
1021                 CborValue aclistMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1022                 cborFindResult = cbor_value_enter_container(&aclMap, &aclistMap);
1023                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACLIST Map.");
1024
1025                 while (cbor_value_is_valid(&aclistMap))
1026                 {
1027                     char* acName = NULL;
1028                     size_t readLen = 0;
1029                     CborType acType = cbor_value_get_type(&aclistMap);
1030                     if (acType == CborTextStringType)
1031                     {
1032                         cborFindResult = cbor_value_dup_text_string(&aclistMap, &acName, &readLen, NULL);
1033                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACLIST Map.");
1034                         cborFindResult = cbor_value_advance(&aclistMap);
1035                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACLIST Map.");
1036                     }
1037
1038                     if(acName)
1039                     {
1040                         if (strcmp(acName, OIC_JSON_ACES_NAME)  == 0)
1041                         {
1042                             // Enter ACES Array
1043                             CborValue acesArray = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1044                             cborFindResult = cbor_value_enter_container(&aclistMap, &acesArray);
1045                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACES Array.");
1046
1047                             int acesCount = 0;
1048                             while (cbor_value_is_valid(&acesArray))
1049                             {
1050                                 acesCount++;
1051                                 CborValue aceMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1052                                 cborFindResult = cbor_value_enter_container(&acesArray, &aceMap);
1053                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACE Map.");
1054
1055                                 OicSecAce_t *ace = NULL;
1056                                 ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
1057                                 VERIFY_NON_NULL(TAG, ace, ERROR);
1058                                 LL_APPEND(acl->aces, ace);
1059
1060                                 while (cbor_value_is_valid(&aceMap))
1061                                 {
1062                                     char* name = NULL;
1063                                     size_t len = 0;
1064                                     CborType type = cbor_value_get_type(&aceMap);
1065                                     if (type == CborTextStringType)
1066                                     {
1067                                         cborFindResult = cbor_value_dup_text_string(&aceMap, &name, &len, NULL);
1068                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACE Map.");
1069                                         cborFindResult = cbor_value_advance(&aceMap);
1070                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACE Map.");
1071                                     }
1072                                     if (name)
1073                                     {
1074                                         // Subject -- Mandatory
1075                                         if (strcmp(name, OIC_JSON_SUBJECTID_NAME)  == 0)
1076                                         {
1077                                             char *subject = NULL;
1078                                             cborFindResult = cbor_value_dup_text_string(&aceMap, &subject, &len, NULL);
1079                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding subject Value.");
1080                                             if(strcmp(subject, WILDCARD_RESOURCE_URI) == 0)
1081                                             {
1082                                                 ace->subjectuuid.id[0] = '*';
1083                                             }
1084                                             else
1085                                             {
1086                                                 ret = ConvertStrToUuid(subject, &ace->subjectuuid);
1087                                                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
1088                                             }
1089                                             OICFree(subject);
1090                                         }
1091
1092                                         // Resources -- Mandatory
1093                                         if (strcmp(name, OIC_JSON_RESOURCES_NAME) == 0)
1094                                         {
1095                                             CborValue resources = { .parser = NULL };
1096                                             cborFindResult = cbor_value_enter_container(&aceMap, &resources);
1097                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering a Resource Array.");
1098
1099                                             while (cbor_value_is_valid(&resources))
1100                                             {
1101                                                 // rMap
1102                                                 CborValue rMap = { .parser = NULL  };
1103                                                 cborFindResult = cbor_value_enter_container(&resources, &rMap);
1104                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering Resource Map");
1105
1106                                                 OicSecRsrc_t* rsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
1107                                                 VERIFY_NON_NULL(TAG, rsrc, ERROR);
1108                                                 LL_APPEND(ace->resources, rsrc);
1109
1110                                                 while(cbor_value_is_valid(&rMap))
1111                                                 {
1112                                                     char *rMapName = NULL;
1113                                                     size_t rMapNameLen = 0;
1114                                                     cborFindResult = cbor_value_dup_text_string(&rMap, &rMapName, &rMapNameLen, NULL);
1115                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Name Tag.");
1116                                                     cborFindResult = cbor_value_advance(&rMap);
1117                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Value.");
1118
1119                                                     // "href"
1120                                                     if (0 == strcmp(OIC_JSON_HREF_NAME, rMapName))
1121                                                     {
1122                                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->href, &len, NULL);
1123                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Href Value.");
1124                                                     }
1125
1126                                                     // "rt"
1127                                                     if (0 == strcmp(OIC_JSON_RT_NAME, rMapName) && cbor_value_is_array(&rMap))
1128                                                     {
1129                                                         cbor_value_get_array_length(&rMap, &rsrc->typeLen);
1130                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RT array length.");
1131                                                         VERIFY_SUCCESS(TAG, (0 != rsrc->typeLen), ERROR);
1132
1133                                                         rsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
1134                                                         VERIFY_NON_NULL(TAG, rsrc->types, ERROR);
1135
1136                                                         CborValue resourceTypes;
1137                                                         cborFindResult = cbor_value_enter_container(&rMap, &resourceTypes);
1138                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering RT Array.");
1139
1140                                                         for(size_t i = 0; cbor_value_is_valid(&resourceTypes) && cbor_value_is_text_string(&resourceTypes); i++)
1141                                                         {
1142                                                             cborFindResult = cbor_value_dup_text_string(&resourceTypes, &(rsrc->types[i]), &readLen, NULL);
1143                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding resource type.");
1144                                                             cborFindResult = cbor_value_advance(&resourceTypes);
1145                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing resource type.");
1146                                                         }
1147                                                     }
1148
1149                                                     // "if"
1150                                                     if (0 == strcmp(OIC_JSON_IF_NAME, rMapName) && cbor_value_is_array(&rMap))
1151                                                     {
1152                                                         cbor_value_get_array_length(&rMap, &rsrc->interfaceLen);
1153                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF array length.");
1154                                                         VERIFY_SUCCESS(TAG, (0 != rsrc->interfaceLen), ERROR);
1155
1156                                                         rsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
1157                                                         VERIFY_NON_NULL(TAG, rsrc->interfaces, ERROR);
1158
1159                                                         CborValue interfaces;
1160                                                         cborFindResult = cbor_value_enter_container(&rMap, &interfaces);
1161                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering IF Array.");
1162
1163                                                         for(size_t i = 0; cbor_value_is_valid(&interfaces) && cbor_value_is_text_string(&interfaces); i++)
1164                                                         {
1165                                                             cborFindResult = cbor_value_dup_text_string(&interfaces, &(rsrc->interfaces[i]), &readLen, NULL);
1166                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF type.");
1167                                                             cborFindResult = cbor_value_advance(&interfaces);
1168                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing IF type.");
1169                                                         }
1170                                                     }
1171
1172                                                     // "rel"
1173                                                     if (0 == strcmp(OIC_JSON_REL_NAME, rMapName))
1174                                                     {
1175                                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->rel, &len, NULL);
1176                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding REL Value.");
1177                                                     }
1178
1179                                                     if (cbor_value_is_valid(&rMap))
1180                                                     {
1181                                                         cborFindResult = cbor_value_advance(&rMap);
1182                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Rlist Map.");
1183                                                     }
1184                                                     OICFree(rMapName);
1185                                                 }
1186
1187                                                 if (cbor_value_is_valid(&resources))
1188                                                 {
1189                                                     cborFindResult = cbor_value_advance(&resources);
1190                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Resource Array.");
1191                                                 }
1192                                             }
1193                                         }
1194
1195                                         // Permissions -- Mandatory
1196                                         if (strcmp(name, OIC_JSON_PERMISSION_NAME) == 0)
1197                                         {
1198                                             uint64_t tmp64;
1199                                             cborFindResult = cbor_value_get_uint64(&aceMap, &tmp64);
1200                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a PERM Value.");
1201                                             ace->permission = (uint16_t)tmp64;
1202                                         }
1203
1204                                         // TODO: Need to verfication for validity
1205                                         // Validity -- Not mandatory
1206                                         if(strcmp(name, OIC_JSON_VALIDITY_NAME) == 0)
1207                                         {
1208                                             CborValue validitiesMap = {.parser = NULL};
1209                                             size_t validitySize = 0;
1210
1211                                             cborFindResult = cbor_value_get_array_length(&aceMap, &validitySize);
1212                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Validity Array Length.");
1213
1214                                             cborFindResult = cbor_value_enter_container(&aceMap, &validitiesMap);
1215                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Array Map.");
1216
1217                                             while(cbor_value_is_valid(&validitiesMap))
1218                                             {
1219                                                 OicSecValidity_t* validity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
1220                                                 VERIFY_NON_NULL(TAG, validity, ERROR);
1221                                                 LL_APPEND(ace->validities, validity);
1222
1223                                                 CborValue validityMap  = {.parser = NULL};
1224                                                 //period (string)
1225                                                 cborFindResult = cbor_value_enter_container(&validitiesMap, &validityMap);
1226                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Map.");
1227
1228                                                 size_t len = 0;
1229                                                 cborFindResult =cbor_value_dup_text_string(&validityMap, &validity->period, &len, NULL);
1230                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Period value.");
1231
1232                                                 //recurrence (string array)
1233                                                 CborValue recurrenceMap  = {.parser = NULL};
1234                                                 cborFindResult = cbor_value_enter_container(&validityMap, &recurrenceMap);
1235                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence array.");
1236
1237                                                 cborFindResult = cbor_value_get_array_length(&recurrenceMap, &validity->recurrenceLen);
1238                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Adding Recurrence Array.");
1239
1240                                                 validity->recurrences = (char**)OICCalloc(validity->recurrenceLen, sizeof(char*));
1241                                                 VERIFY_NON_NULL(TAG, validity->recurrences, ERROR);
1242
1243                                                 for(size_t i = 0; cbor_value_is_text_string(&recurrenceMap) && i < validity->recurrenceLen; i++)
1244                                                 {
1245                                                     cborFindResult = cbor_value_dup_text_string(&recurrenceMap, &validity->recurrences[i], &len, NULL);
1246                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence Value.");
1247
1248                                                     cborFindResult = cbor_value_advance(&recurrenceMap);
1249                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a recurrences Array.");
1250                                                 }
1251
1252                                                 cborFindResult = cbor_value_advance(&validitiesMap);
1253                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a validities Array.");
1254                                             }
1255                                         }
1256
1257 #ifdef _ENABLE_MULTIPLE_OWNER_
1258                                         // eowner uuid -- Not Mandatory
1259                                         if (strcmp(name, OIC_JSON_EOWNERID_NAME)  == 0)
1260                                         {
1261                                             char *eowner = NULL;
1262                                             cborFindResult = cbor_value_dup_text_string(&aceMap, &eowner, &len, NULL);
1263                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding eownerId Value.");
1264                                             if(NULL == ace->eownerID)
1265                                             {
1266                                                 ace->eownerID = (OicUuid_t*)OICCalloc(1, sizeof(OicUuid_t));
1267                                                 VERIFY_NON_NULL(TAG, ace->eownerID, ERROR);
1268                                             }
1269                                             ret = ConvertStrToUuid(eowner, ace->eownerID);
1270                                             OICFree(eowner);
1271                                             VERIFY_SUCCESS(TAG, OC_STACK_OK == ret , ERROR);
1272                                         }
1273 #endif //_ENABLE_MULTIPLE_OWNER_
1274                                         OICFree(name);
1275                                     }
1276
1277                                     if (type != CborMapType && cbor_value_is_valid(&aceMap))
1278                                     {
1279                                         cborFindResult = cbor_value_advance(&aceMap);
1280                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing the Array.");
1281                                     }
1282                                 }
1283
1284                                 if (cbor_value_is_valid(&acesArray))
1285                                 {
1286                                     cborFindResult = cbor_value_advance(&acesArray);
1287                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Array.");
1288                                 }
1289                             }
1290                         }
1291                         OICFree(acName);
1292                     }
1293
1294                     if (cbor_value_is_valid(&aclistMap))
1295                     {
1296                         cborFindResult = cbor_value_advance(&aclistMap);
1297                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACLIST Map.");
1298                     }
1299                 }
1300             }
1301
1302             //rownerID -- Mandatory
1303             if (strcmp(tagName, OIC_JSON_ROWNERID_NAME)  == 0)
1304             {
1305                 char *stRowner = NULL;
1306                 cborFindResult = cbor_value_dup_text_string(&aclMap, &stRowner, &len, NULL);
1307                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Rownerid Value.");
1308                 ret = ConvertStrToUuid(stRowner, &acl->rownerID);
1309                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
1310                 OICFree(stRowner);
1311             }
1312             else if (NULL != gAcl)
1313             {
1314                 memcpy(&(acl->rownerID), &(gAcl->rownerID), sizeof(OicUuid_t));
1315             }
1316             OICFree(tagName);
1317         }
1318         if (cbor_value_is_valid(&aclMap))
1319         {
1320             cborFindResult = cbor_value_advance(&aclMap);
1321             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Map.");
1322         }
1323     }
1324
1325 exit:
1326     if (cborFindResult != CborNoError)
1327     {
1328         OIC_LOG(ERROR, TAG, "Failed to CBORPayloadToAcl");
1329         DeleteACLList(acl);
1330         acl = NULL;
1331     }
1332
1333     return acl;
1334 }
1335
1336 #ifdef _ENABLE_MULTIPLE_OWNER_
1337 bool IsValidAclAccessForSubOwner(const OicUuid_t* uuid, const uint8_t *cborPayload, const size_t size)
1338 {
1339     bool retValue = false;
1340     OicSecAcl_t* acl = NULL;
1341
1342     VERIFY_NON_NULL(TAG, uuid, ERROR);
1343     VERIFY_NON_NULL(TAG, cborPayload, ERROR);
1344     VERIFY_SUCCESS(TAG, 0 != size, ERROR);
1345
1346     acl = CBORPayloadToAcl(cborPayload, size);
1347     VERIFY_NON_NULL(TAG, acl, ERROR);
1348
1349     OicSecAce_t* ace = NULL;
1350     OicSecAce_t* tempAce = NULL;
1351     LL_FOREACH_SAFE(acl->aces, ace, tempAce)
1352     {
1353         OicSecRsrc_t* rsrc = NULL;
1354         OicSecRsrc_t* tempRsrc = NULL;
1355
1356         VERIFY_NON_NULL(TAG, ace->eownerID, ERROR);
1357         VERIFY_SUCCESS(TAG, memcmp(ace->eownerID->id, uuid->id, sizeof(uuid->id)) == 0, ERROR);
1358
1359         LL_FOREACH_SAFE(ace->resources, rsrc, tempRsrc)
1360         {
1361             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_DOXM) != 0, ERROR);
1362             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_CRED) != 0, ERROR);
1363             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_ACL) != 0, ERROR);
1364             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_PSTAT) != 0, ERROR);
1365             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_CRL) != 0, ERROR);
1366         }
1367     }
1368
1369     retValue = true;
1370
1371 exit:
1372     DeleteACLList(acl);
1373
1374     return retValue;
1375 }
1376 #endif //_ENABLE_MULTIPLE_OWNER_
1377
1378 /**
1379  * This method removes ACE for the subject and resource from the ACL
1380  *
1381  * @param subject of the ACE
1382  * @param resource of the ACE
1383  *
1384  * @return
1385  *     ::OC_STACK_RESOURCE_DELETED on success
1386  *     ::OC_STACK_NO_RESOURCE on failure to find the appropriate ACE
1387  *     ::OC_STACK_INVALID_PARAM on invalid parameter
1388  */
1389 OCStackResult RemoveACE(const OicUuid_t * subject, const char * resource)
1390 {
1391     OIC_LOG(DEBUG, TAG, "IN RemoveACE");
1392
1393     OicSecAce_t *ace = NULL;
1394     OicSecAce_t *tempAce = NULL;
1395     bool deleteFlag = false;
1396     OCStackResult ret = OC_STACK_NO_RESOURCE;
1397
1398     if (memcmp(subject->id, &WILDCARD_SUBJECT_ID, sizeof(subject->id)) == 0)
1399     {
1400         OIC_LOG_V(ERROR, TAG, "%s received invalid parameter", __func__ );
1401         return  OC_STACK_INVALID_PARAM;
1402     }
1403
1404     //If resource is NULL then delete all the ACE for the subject.
1405     if (NULL == resource || resource[0] == '\0')
1406     {
1407         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
1408         {
1409             if (memcmp(ace->subjectuuid.id, subject->id, sizeof(subject->id)) == 0)
1410             {
1411                 LL_DELETE(gAcl->aces, ace);
1412                 FreeACE(ace);
1413                 deleteFlag = true;
1414             }
1415         }
1416     }
1417     else
1418     {
1419         //Looping through ACL to find the right ACE to delete. If the required resource is the only
1420         //resource in the ACE for the subject then delete the whole ACE. If there are more resources
1421         //than the required resource in the ACE, for the subject then just delete the resource from
1422         //the resource array
1423         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
1424         {
1425             if (memcmp(ace->subjectuuid.id, subject->id, sizeof(subject->id)) == 0)
1426             {
1427                 OicSecRsrc_t* rsrc = NULL;
1428                 OicSecRsrc_t* tempRsrc = NULL;
1429                 LL_FOREACH_SAFE(ace->resources, rsrc, tempRsrc)
1430                 {
1431                     if(strcmp(rsrc->href, resource) == 0)
1432                     {
1433                         LL_DELETE(ace->resources, rsrc);
1434                         FreeRsrc(rsrc);
1435                         deleteFlag = true;
1436                     }
1437                 }
1438
1439                 //If resource list is empty
1440                 if(NULL == ace->resources && true == deleteFlag)
1441                 {
1442                     //Remove the ACE from ACL
1443                     LL_DELETE(gAcl->aces, ace);
1444                     FreeACE(ace);
1445                 }
1446             }
1447         }
1448     }
1449
1450     if (deleteFlag)
1451     {
1452         // In case of unit test do not update persistant storage.
1453         if (memcmp(subject->id, &WILDCARD_SUBJECT_B64_ID, sizeof(subject->id)) == 0)
1454         {
1455             ret = OC_STACK_RESOURCE_DELETED;
1456         }
1457         else
1458         {
1459             uint8_t *payload = NULL;
1460             size_t size = 0;
1461             if (OC_STACK_OK == AclToCBORPayload(gAcl, &payload, &size))
1462             {
1463                 if (OC_STACK_OK == UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size))
1464                 {
1465                     ret = OC_STACK_RESOURCE_DELETED;
1466                 }
1467                 OICFree(payload);
1468             }
1469         }
1470     }
1471     return ret;
1472 }
1473
1474 /**
1475  * This method parses the query string received for REST requests and
1476  * retrieves the 'subject' field.
1477  *
1478  * @param query querystring passed in REST request
1479  * @param subject subject UUID parsed from query string
1480  *
1481  * @return true if query parsed successfully and found 'subject', else false.
1482  */
1483 static bool GetSubjectFromQueryString(const char *query, OicUuid_t *subject)
1484 {
1485     OicParseQueryIter_t parseIter = { .attrPos = NULL };
1486
1487     ParseQueryIterInit((unsigned char *) query, &parseIter);
1488
1489     while (GetNextQuery (&parseIter))
1490     {
1491         if (strncasecmp((char *) parseIter.attrPos, OIC_JSON_SUBJECTID_NAME, parseIter.attrLen) == 0)
1492         {
1493             char strUuid[STRING_UUID_SIZE] = {0};
1494             VERIFY_SUCCESS(TAG, 0 != parseIter.valLen, ERROR);
1495             memcpy(strUuid, parseIter.valPos, parseIter.valLen);
1496             OCStackResult res = ConvertStrToUuid(strUuid, subject);
1497             VERIFY_SUCCESS(TAG, OC_STACK_OK == res, ERROR);
1498             return true;
1499         }
1500     }
1501
1502 exit:
1503     return false;
1504 }
1505
1506 /**
1507  * This method parses the query string received for REST requests and
1508  * retrieves the 'resource' field.
1509  *
1510  * @param query querystring passed in REST request
1511  * @param resource resource parsed from query string
1512  * @param resourceSize size of the memory pointed to resource
1513  *
1514  * @return true if query parsed successfully and found 'resource', else false.
1515  */
1516 static bool GetResourceFromQueryString(const char *query, char *resource, size_t resourceSize)
1517 {
1518     OicParseQueryIter_t parseIter = { .attrPos = NULL };
1519
1520     ParseQueryIterInit((unsigned char *) query, &parseIter);
1521
1522     while (GetNextQuery (&parseIter))
1523     {
1524         if (strncasecmp((char *) parseIter.attrPos, OIC_JSON_RESOURCES_NAME, parseIter.attrLen)
1525                 == 0)
1526         {
1527             VERIFY_SUCCESS(TAG, 0 != parseIter.valLen, ERROR);
1528             OICStrcpy(resource, resourceSize, (char *) parseIter.valPos);
1529
1530             return true;
1531         }
1532     }
1533
1534 exit:
1535    return false;
1536 }
1537
1538 static size_t GetNumberOfResource(OicSecRsrc_t* resources)
1539 {
1540     size_t ret = 0;
1541     if(resources)
1542     {
1543         OicSecRsrc_t* rsrc = NULL;
1544         LL_FOREACH(resources, rsrc)
1545         {
1546             ret++;
1547         }
1548     }
1549     return ret;
1550 }
1551
1552 static size_t GetNumberOfValidity(OicSecValidity_t* val)
1553 {
1554     size_t ret = 0;
1555
1556     if(val)
1557     {
1558         OicSecValidity_t* temp = NULL;
1559         LL_FOREACH(val, temp)
1560         {
1561             ret++;
1562         }
1563     }
1564     return ret;
1565 }
1566
1567
1568 static bool IsSameStringArray(char** strArr1, size_t strArr1Len,
1569                               char** strArr2, size_t strArr2Len)
1570 {
1571
1572     if(NULL == strArr1 && NULL == strArr2)
1573     {
1574         return true;
1575     }
1576
1577     if(strArr1 && strArr2 && NULL == *strArr1 && NULL == *strArr2)
1578     {
1579         return true;
1580     }
1581
1582     if(strArr1 && strArr2)
1583     {
1584         if(*strArr1 && *strArr2 && strArr1Len == strArr2Len)
1585         {
1586             size_t matchedStr = 0;
1587             for(size_t i = 0; i < strArr1Len; i++)
1588             {
1589                 for(size_t j = 0; j < strArr2Len; j++)
1590                 {
1591                     if(strcmp(strArr1[i], strArr2[j]) == 0)
1592                     {
1593                         matchedStr++;
1594                     }
1595                 }
1596             }
1597             if(matchedStr == strArr1Len)
1598             {
1599                 return true;
1600             }
1601         }
1602     }
1603
1604     return false;
1605 }
1606
1607 static bool IsSameResources(OicSecRsrc_t* resources1, OicSecRsrc_t* resources2)
1608 {
1609     size_t numOfRsrc1 = 0;
1610     size_t numOfRsrc2 = 0;
1611     size_t numOfMatchedRsrc = 0;
1612     OicSecRsrc_t* rsrc1 = NULL;
1613     OicSecRsrc_t* rsrc2 = NULL;
1614
1615     if(NULL == resources1 && NULL == resources2)
1616     {
1617         return true;
1618     }
1619
1620     if(resources1 && resources2)
1621     {
1622         numOfRsrc1 = GetNumberOfResource(resources1);
1623         numOfRsrc2 = GetNumberOfResource(resources2);
1624
1625         if(0 == numOfRsrc1 && 0 == numOfRsrc2)
1626         {
1627             return true;
1628         }
1629
1630         LL_FOREACH(resources1, rsrc1)
1631         {
1632             rsrc2 = NULL;
1633             LL_FOREACH(resources2, rsrc2)
1634             {
1635                 if(rsrc1 && rsrc2)
1636                 {
1637                     if(strcmp(rsrc1->href, rsrc2->href) == 0 &&
1638                         IsSameStringArray(rsrc1->interfaces, rsrc1->interfaceLen,
1639                                           rsrc2->interfaces, rsrc2->interfaceLen) &&
1640                         IsSameStringArray(rsrc1->types, rsrc1->typeLen,
1641                                           rsrc2->types, rsrc2->typeLen))
1642                     {
1643                         // TODO: Update codes to compare 'rel' property
1644                         numOfMatchedRsrc++;
1645                     }
1646                 }
1647             }
1648         }
1649
1650         if(numOfMatchedRsrc == numOfRsrc1)
1651         {
1652             return true;
1653         }
1654     }
1655
1656     return false;
1657 }
1658
1659 static bool IsSameValidities(OicSecValidity_t* validities1, OicSecValidity_t* validities2)
1660 {
1661     size_t numOfVal1 = 0;
1662     size_t numOfVal2 = 0;
1663     size_t numOfMatchedVal = 0;
1664     OicSecValidity_t* val1 = NULL;
1665     OicSecValidity_t* val2 = NULL;
1666
1667     if(NULL == validities1 && NULL == validities2)
1668     {
1669         return true;
1670     }
1671
1672     if(validities1 && validities2)
1673     {
1674         numOfVal1 = GetNumberOfValidity(validities1);
1675         numOfVal2 = GetNumberOfValidity(validities2);
1676         if(0 == numOfVal1 && 0 == numOfVal2)
1677         {
1678             return true;
1679         }
1680
1681         if(numOfVal1 == numOfVal2)
1682         {
1683             LL_FOREACH(validities1, val1)
1684             {
1685                 LL_FOREACH(validities2, val2)
1686                 {
1687                     if(strcmp(val1->period, val2->period) == 0 &&
1688                         IsSameStringArray(val1->recurrences, val1->recurrenceLen,
1689                                           val2->recurrences, val2->recurrenceLen))
1690                     {
1691                         numOfMatchedVal++;
1692                     }
1693                 }
1694             }
1695             if(numOfVal1 == numOfMatchedVal)
1696             {
1697                 return true;
1698             }
1699         }
1700     }
1701
1702     return false;
1703 }
1704
1705 #ifdef _ENABLE_MULTIPLE_OWNER_
1706 static bool IsSameEowner(OicUuid_t* eowner1, OicUuid_t* eowner2)
1707 {
1708     if(NULL != eowner1 && NULL != eowner2)
1709     {
1710         if (memcmp(eowner1->id, eowner2->id, sizeof(eowner1->id)) == 0)
1711         {
1712             return true;
1713         }
1714     }
1715
1716     return false;
1717 }
1718 #endif
1719
1720 static bool IsSameACE(OicSecAce_t* ace1, OicSecAce_t* ace2)
1721 {
1722     if(ace1 && ace2)
1723     {
1724         if(memcmp(ace1->subjectuuid.id, ace2->subjectuuid.id, sizeof(ace1->subjectuuid.id)) != 0)
1725         {
1726             return false;
1727         }
1728
1729         if(false == IsSameResources(ace1->resources, ace2->resources))
1730         {
1731             return false;
1732         }
1733
1734         if(ace1->permission != ace2->permission)
1735         {
1736             return false;
1737         }
1738
1739         if(false == IsSameValidities(ace1->validities, ace2->validities))
1740         {
1741             return false;
1742         }
1743
1744 #ifdef _ENABLE_MULTIPLE_OWNER_
1745         if(false == IsSameEowner(ace1->eownerID, ace2->eownerID))
1746         {
1747             return false;
1748         }
1749 #endif
1750
1751         return true;
1752     }
1753
1754     return false;
1755 }
1756
1757 /**
1758  * Internal function to remove all ACL data on ACL resource and persistent storage
1759  *
1760  * @retval
1761  *     OC_STACK_RESOURCE_DELETED  - no errors
1762  *     Otherwise                  - error
1763  */
1764 static OCStackResult RemoveAllAce(void)
1765 {
1766     OCStackResult ret = OC_STACK_ERROR;
1767     uint8_t* aclBackup = NULL;
1768     size_t backupSize = 0;
1769     uint8_t* payload = NULL;
1770     size_t size = 0;
1771     OicSecAce_t* aceItem = NULL;
1772     OicSecAce_t* tempAce = NULL;
1773
1774     OIC_LOG(INFO, TAG, "IN RemoveAllAce");
1775
1776     //Backup the current ACL
1777     ret = AclToCBORPayload(gAcl, &aclBackup, &backupSize);
1778     if(OC_STACK_OK == ret)
1779     {
1780         // Remove all ACE from ACL
1781         LL_FOREACH_SAFE(gAcl->aces, aceItem, tempAce)
1782         {
1783             LL_DELETE(gAcl->aces, aceItem);
1784             FreeACE(aceItem);
1785         }
1786
1787         //Generate empty ACL payload
1788         ret = AclToCBORPayload(gAcl, &payload, &size);
1789         if (OC_STACK_OK == ret )
1790         {
1791             //Update the PS.
1792             ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size);
1793             if (OC_STACK_OK != ret)
1794             {
1795                 OIC_LOG_V(ERROR, TAG, "Error in UpdateSecureResourceInPS : %d", ret);
1796             }
1797         }
1798
1799         if(OC_STACK_OK != ret)
1800         {
1801             OIC_LOG_V(ERROR, TAG, "Error while DELETE ACE : %d", ret);
1802
1803             //If some erorr is occured, revert back.
1804             OicSecAcl_t* originAcl = CBORPayloadToAcl(aclBackup, backupSize);
1805             if( originAcl )
1806             {
1807                 ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, aclBackup, backupSize);
1808                 if (OC_STACK_OK == ret)
1809                 {
1810                     DeleteACLList(gAcl);
1811                     gAcl = originAcl;
1812                 }
1813                 else
1814                 {
1815                     OIC_LOG_V(ERROR, TAG, "Error in UpdateSecureResourceInPS : %d", ret);
1816                 }
1817             }
1818             else
1819             {
1820                 OIC_LOG(FATAL, TAG, "Error in CBORPayloadToAcl");
1821                 ret = OC_STACK_ERROR;
1822             }
1823         }
1824     }
1825
1826     OICFree(aclBackup);
1827     OICFree(payload);
1828
1829     OIC_LOG(INFO, TAG, "OUT RemoveAllAce");
1830
1831     return (OC_STACK_OK == ret ? OC_STACK_RESOURCE_DELETED : ret);
1832 }
1833
1834 static OCEntityHandlerResult HandleACLGetRequest(const OCEntityHandlerRequest *ehRequest)
1835 {
1836     OIC_LOG(INFO, TAG, "HandleACLGetRequest processing the request");
1837     uint8_t* payload = NULL;
1838     size_t size = 0;
1839     OCEntityHandlerResult ehRet;
1840
1841     OicUuid_t subject = {.id= { 0 } };
1842
1843     // In case, 'subject' field is included in REST request.
1844     if (ehRequest->query && GetSubjectFromQueryString(ehRequest->query, &subject))
1845     {
1846         OIC_LOG(DEBUG,TAG,"'subject' field is inculded in REST request.");
1847         OIC_LOG(DEBUG, TAG, "HandleACLGetRequest processing query");
1848
1849         char resource[MAX_URI_LENGTH] = { 0 };
1850
1851         OicSecAce_t *savePtr = NULL;
1852         const OicSecAce_t *currentAce = NULL;
1853         OicSecAcl_t targetAcl;
1854
1855         memcpy(&targetAcl.rownerID, &gAcl->rownerID, sizeof(OicUuid_t));
1856         targetAcl.aces = NULL;
1857
1858         // 'Subject' field is MUST for processing a querystring in REST request.
1859         GetResourceFromQueryString(ehRequest->query, resource, sizeof(resource));
1860
1861         /*
1862          * TODO : Currently, this code only provides one ACE for a Subject.
1863          * Below code needs to be updated for scenarios when Subject have
1864          * multiple ACE's in ACL resource.
1865          */
1866         while ((currentAce = GetACLResourceData(&subject, &savePtr)))
1867         {
1868             targetAcl.aces = (OicSecAce_t*)currentAce;
1869
1870             /*
1871              * If REST querystring contains a specific resource, we need
1872              * to search for that resource in ACE.
1873              */
1874             if (resource[0] != '\0')
1875             {
1876                 OicSecRsrc_t *rsrc = NULL;
1877                 LL_FOREACH(currentAce->resources, rsrc)
1878                 {
1879                     if(0 == strcmp(rsrc->href, resource) ||
1880                         0 == strcmp(WILDCARD_RESOURCE_URI, rsrc->href))
1881                     {
1882                         // Convert ACL data into CBOR format for transmission
1883                         if (OC_STACK_OK != AclToCBORPayload(&targetAcl, &payload, &size))
1884                         {
1885                             ehRet = OC_EH_ERROR;
1886                         }
1887                         goto exit;
1888                     }
1889                 }
1890             }
1891             else
1892             {
1893                 // Convert ACL data into CBOR format for transmission
1894                 if (OC_STACK_OK != AclToCBORPayload(&targetAcl, &payload, &size))
1895                 {
1896                     ehRet = OC_EH_ERROR;
1897                 }
1898                 goto exit;
1899             }
1900         }
1901     }
1902     // In case, 'subject' field is not included in REST request.
1903     else
1904     {
1905         OIC_LOG(DEBUG,TAG,"'subject' field is not inculded in REST request.");
1906         // Convert ACL data into CBOR format for transmission.
1907         if (OC_STACK_OK != AclToCBORPayload(gAcl, &payload, &size))
1908         {
1909             ehRet = OC_EH_ERROR;
1910         }
1911     }
1912 exit:
1913     // A device should always have a default acl. Therefore, payload should never be NULL.
1914     ehRet = (payload ? OC_EH_OK : OC_EH_ERROR);
1915     OIC_LOG(DEBUG, TAG, "ACL payload with GET response");
1916     OIC_LOG_BUFFER(DEBUG, TAG, payload, size);
1917
1918     //Send payload to request originator
1919     ehRet = ((SendSRMResponse(ehRequest, ehRet, payload, size)) == OC_STACK_OK) ?
1920                    OC_EH_OK : OC_EH_ERROR;
1921
1922     OICFree(payload);
1923
1924     OIC_LOG_V(DEBUG, TAG, "%s RetVal %d", __func__, ehRet);
1925     return ehRet;
1926 }
1927
1928 static OCEntityHandlerResult HandleACLPostRequest(const OCEntityHandlerRequest *ehRequest)
1929 {
1930     OIC_LOG(INFO, TAG, "HandleACLPostRequest processing the request");
1931     OCEntityHandlerResult ehRet = OC_EH_OK;
1932
1933     // Convert CBOR into ACL data and update to SVR buffers. This will also validate the ACL data received.
1934     uint8_t *payload = ((OCSecurityPayload *) ehRequest->payload)->securityData;
1935     size_t size = ((OCSecurityPayload *) ehRequest->payload)->payloadSize;
1936     if (payload)
1937     {
1938         OicSecAcl_t *newAcl = NULL;
1939         OIC_LOG(DEBUG, TAG, "ACL payload from POST request << ");
1940         OIC_LOG_BUFFER(DEBUG, TAG, payload, size);
1941
1942         newAcl = CBORPayloadToAcl(payload, size);
1943         if (newAcl)
1944         {
1945             bool isNewAce = true;
1946             OicSecAce_t* existAce = NULL;
1947             OicSecAce_t* newAce = NULL;
1948             OicSecAce_t* tempAce1 = NULL;
1949             OicSecAce_t* tempAce2 = NULL;
1950
1951             LL_FOREACH_SAFE(newAcl->aces, newAce, tempAce1)
1952             {
1953                 isNewAce = true;
1954                 LL_FOREACH_SAFE(gAcl->aces, existAce, tempAce2)
1955                 {
1956                     if(IsSameACE(newAce, existAce))
1957                     {
1958                         isNewAce = false;
1959                     }
1960                 }
1961                 if(isNewAce)
1962                 {
1963                     OIC_LOG(DEBUG, TAG, "NEW ACE dectected.");
1964
1965                     OicSecAce_t* insertAce = DuplicateACE(newAce);
1966                     if(insertAce)
1967                     {
1968                         OIC_LOG(DEBUG, TAG, "Appending new ACE..");
1969                         LL_PREPEND(gAcl->aces, insertAce);
1970                     }
1971                     else
1972                     {
1973                         OIC_LOG(ERROR, TAG, "Failed to duplicate ACE.");
1974                         ehRet = OC_EH_ERROR;
1975                     }
1976                 }
1977             }
1978             memcpy(&(gAcl->rownerID), &(newAcl->rownerID), sizeof(OicUuid_t));
1979
1980             DeleteACLList(newAcl);
1981
1982             if(OC_EH_OK == ehRet)
1983             {
1984                 size_t size = 0;
1985                 uint8_t *cborPayload = NULL;
1986
1987                 if (OC_STACK_OK == AclToCBORPayload(gAcl, &cborPayload, &size))
1988                 {
1989                     if (UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, cborPayload, size) == OC_STACK_OK)
1990                     {
1991                         ehRet = OC_EH_CHANGED;
1992                     }
1993                     OICFree(cborPayload);
1994                 }
1995
1996                 if(OC_EH_CHANGED != ehRet)
1997                 {
1998                     ehRet = OC_EH_ERROR;
1999                 }
2000             }
2001         }
2002     }
2003
2004     //Send response to request originator
2005     ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2006                    OC_EH_OK : OC_EH_ERROR;
2007
2008     OIC_LOG_V(DEBUG, TAG, "%s RetVal %d", __func__, ehRet);
2009     return ehRet;
2010 }
2011
2012 static OCEntityHandlerResult HandleACLDeleteRequest(const OCEntityHandlerRequest *ehRequest)
2013 {
2014     OIC_LOG(DEBUG, TAG, "Processing ACLDeleteRequest");
2015     OCEntityHandlerResult ehRet = OC_EH_ERROR;
2016     OicUuid_t subject = { .id= { 0 } };
2017     char resource[MAX_URI_LENGTH] = { 0 };
2018
2019     VERIFY_NON_NULL(TAG, ehRequest->query, ERROR);
2020
2021     // If 'Subject' field exist, processing a querystring in REST request.
2022     if(GetSubjectFromQueryString(ehRequest->query, &subject))
2023     {
2024         GetResourceFromQueryString(ehRequest->query, resource, sizeof(resource));
2025
2026         if (OC_STACK_RESOURCE_DELETED == RemoveACE(&subject, resource))
2027         {
2028             ehRet = OC_EH_RESOURCE_DELETED;
2029         }
2030     }
2031     // If 'subject field not exist, remove all ACL data from ACL resource
2032     else
2033     {
2034         OIC_LOG(WARNING, TAG, "Can not find the 'subject' in querystring, All ACL list will be removed.");
2035
2036         if(OC_STACK_RESOURCE_DELETED == RemoveAllAce())
2037         {
2038             ehRet = OC_EH_RESOURCE_DELETED;
2039         }
2040     }
2041
2042 exit:
2043     //Send response to request originator
2044     ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2045                    OC_EH_OK : OC_EH_ERROR;
2046
2047     return ehRet;
2048 }
2049
2050 OCEntityHandlerResult ACLEntityHandler(OCEntityHandlerFlag flag, OCEntityHandlerRequest * ehRequest,
2051         void* callbackParameter)
2052 {
2053     OIC_LOG(DEBUG, TAG, "Received request ACLEntityHandler");
2054     (void)callbackParameter;
2055     OCEntityHandlerResult ehRet = OC_EH_ERROR;
2056
2057     if (!ehRequest)
2058     {
2059         return ehRet;
2060     }
2061
2062     if (flag & OC_REQUEST_FLAG)
2063     {
2064         // TODO :  Handle PUT method
2065         OIC_LOG(DEBUG, TAG, "Flag includes OC_REQUEST_FLAG");
2066         switch (ehRequest->method)
2067         {
2068             case OC_REST_GET:
2069                 ehRet = HandleACLGetRequest(ehRequest);
2070                 break;
2071
2072             case OC_REST_POST:
2073                 ehRet = HandleACLPostRequest(ehRequest);
2074                 break;
2075
2076             case OC_REST_DELETE:
2077                 ehRet = HandleACLDeleteRequest(ehRequest);
2078                 break;
2079
2080             default:
2081                 ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2082                                OC_EH_OK : OC_EH_ERROR;
2083         }
2084     }
2085
2086     return ehRet;
2087 }
2088
2089 /**
2090  * This internal method is used to create '/oic/sec/acl' resource.
2091  */
2092 static OCStackResult CreateACLResource()
2093 {
2094     OCStackResult ret;
2095
2096     ret = OCCreateResource(&gAclHandle,
2097                            OIC_RSRC_TYPE_SEC_ACL,
2098                            OC_RSRVD_INTERFACE_DEFAULT,
2099                            OIC_RSRC_ACL_URI,
2100                            ACLEntityHandler,
2101                            NULL,
2102                            OC_SECURE);
2103
2104     if (OC_STACK_OK != ret)
2105     {
2106         OIC_LOG(FATAL, TAG, "Unable to instantiate ACL resource");
2107         DeInitACLResource();
2108     }
2109     return ret;
2110 }
2111
2112 // This function sets the default ACL and is defined for the unit test only.
2113 OCStackResult SetDefaultACL(OicSecAcl_t *acl)
2114 {
2115     gAcl = acl;
2116     return OC_STACK_OK;
2117 }
2118
2119 OCStackResult GetDefaultACL(OicSecAcl_t** defaultAcl)
2120 {
2121     OCStackResult ret = OC_STACK_ERROR;
2122     OicUuid_t ownerId = { .id = { 0 } };
2123     OicSecAcl_t *acl = NULL;
2124     OicSecAce_t *ace = NULL;
2125     OicSecRsrc_t* resRsrc = NULL;
2126     OicSecRsrc_t* deviceRsrc = NULL;
2127     OicSecRsrc_t* platformRsrc = NULL;
2128     OicSecRsrc_t* aclRsrc = NULL;
2129     OicSecRsrc_t* doxmRsrc = NULL;
2130     OicSecRsrc_t* pstatRsrc = NULL;
2131
2132     /*
2133      * TODO In future, when new virtual resources will be added in OIC
2134      * specification, Iotivity stack should be able to add them in
2135      * existing SVR database. To support this, we need to add 'versioning'
2136      * mechanism in SVR database.
2137      */
2138
2139     if (!defaultAcl)
2140     {
2141         return OC_STACK_INVALID_PARAM;
2142     }
2143
2144     acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
2145     VERIFY_NON_NULL(TAG, acl, ERROR);
2146
2147     ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
2148     VERIFY_NON_NULL(TAG, ace, ERROR);
2149
2150     LL_APPEND(acl->aces, ace);
2151
2152     // Subject -- Mandatory
2153     memcpy(ace->subjectuuid.id, &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t));
2154
2155     // Resources -- Mandatory
2156     // /oic/res
2157     resRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2158     VERIFY_NON_NULL(TAG, resRsrc, ERROR);
2159     LL_APPEND(ace->resources, resRsrc);
2160     resRsrc->href = OICStrdup(OC_RSRVD_WELL_KNOWN_URI);
2161     VERIFY_NON_NULL(TAG, (resRsrc->href), ERROR);
2162     resRsrc->typeLen = 1;
2163     resRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2164     VERIFY_NON_NULL(TAG, resRsrc->types, ERROR);
2165     resRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_RES);
2166     VERIFY_NON_NULL(TAG, resRsrc->types[0], ERROR);
2167     resRsrc->interfaceLen = 2;
2168     resRsrc->interfaces = (char**)OICCalloc(resRsrc->interfaceLen, sizeof(char*));
2169     VERIFY_NON_NULL(TAG, resRsrc->interfaces, ERROR);
2170     resRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2171     VERIFY_NON_NULL(TAG, resRsrc->interfaces[0], ERROR);
2172     resRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2173     VERIFY_NON_NULL(TAG, resRsrc->interfaces[1], ERROR);
2174
2175     // /oic/d
2176     deviceRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2177     VERIFY_NON_NULL(TAG, deviceRsrc, ERROR);
2178     LL_APPEND(ace->resources, deviceRsrc);
2179     deviceRsrc->href = OICStrdup(OC_RSRVD_DEVICE_URI);
2180     VERIFY_NON_NULL(TAG, (deviceRsrc->href), ERROR);
2181     deviceRsrc->typeLen = 1;
2182     deviceRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2183     VERIFY_NON_NULL(TAG, deviceRsrc->types, ERROR);
2184     deviceRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_DEVICE);
2185     VERIFY_NON_NULL(TAG, deviceRsrc->types[0], ERROR);
2186     deviceRsrc->interfaceLen = 2;
2187     deviceRsrc->interfaces = (char**)OICCalloc(deviceRsrc->interfaceLen, sizeof(char*));
2188     VERIFY_NON_NULL(TAG, deviceRsrc->interfaces, ERROR);
2189     deviceRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2190     VERIFY_NON_NULL(TAG, deviceRsrc->interfaces[0], ERROR);
2191     deviceRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2192     VERIFY_NON_NULL(TAG, deviceRsrc->interfaces[1], ERROR);
2193
2194     // /oic/p
2195     platformRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2196     VERIFY_NON_NULL(TAG, platformRsrc, ERROR);
2197     LL_APPEND(ace->resources, platformRsrc);
2198     platformRsrc->href = OICStrdup(OC_RSRVD_PLATFORM_URI);
2199     VERIFY_NON_NULL(TAG, (platformRsrc->href), ERROR);
2200     platformRsrc->typeLen = 1;
2201     platformRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2202     VERIFY_NON_NULL(TAG, platformRsrc->types, ERROR);
2203     platformRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_PLATFORM);
2204     VERIFY_NON_NULL(TAG, platformRsrc->types[0], ERROR);
2205     platformRsrc->interfaceLen = 2;
2206     platformRsrc->interfaces = (char**)OICCalloc(platformRsrc->interfaceLen, sizeof(char*));
2207     VERIFY_NON_NULL(TAG, platformRsrc->interfaces, ERROR);
2208     platformRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2209     VERIFY_NON_NULL(TAG, platformRsrc->interfaces[0], ERROR);
2210     platformRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2211     VERIFY_NON_NULL(TAG, platformRsrc->interfaces[1], ERROR);
2212
2213     // /oic/sec/acl
2214     aclRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2215     VERIFY_NON_NULL(TAG, aclRsrc, ERROR);
2216     LL_APPEND(ace->resources, aclRsrc);
2217     aclRsrc->href = OICStrdup(OIC_RSRC_ACL_URI);
2218     VERIFY_NON_NULL(TAG, (aclRsrc->href), ERROR);
2219     aclRsrc->typeLen = 1;
2220     aclRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2221     VERIFY_NON_NULL(TAG, aclRsrc->types, ERROR);
2222     aclRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_ACL);
2223     VERIFY_NON_NULL(TAG, aclRsrc->types[0], ERROR);
2224     aclRsrc->interfaceLen = 1;
2225     aclRsrc->interfaces = (char**)OICCalloc(aclRsrc->interfaceLen, sizeof(char*));
2226     VERIFY_NON_NULL(TAG, aclRsrc->interfaces, ERROR);
2227     aclRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2228     VERIFY_NON_NULL(TAG, aclRsrc->interfaces[0], ERROR);
2229
2230     // /oic/sec/doxm
2231     doxmRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2232     VERIFY_NON_NULL(TAG, doxmRsrc, ERROR);
2233     LL_APPEND(ace->resources, doxmRsrc);
2234     doxmRsrc->href = OICStrdup(OIC_RSRC_DOXM_URI);
2235     VERIFY_NON_NULL(TAG, (doxmRsrc->href), ERROR);
2236     doxmRsrc->typeLen = 1;
2237     doxmRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2238     VERIFY_NON_NULL(TAG, doxmRsrc->types, ERROR);
2239     doxmRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_DOXM);
2240     VERIFY_NON_NULL(TAG, doxmRsrc->types[0], ERROR);
2241     doxmRsrc->interfaceLen = 1;
2242     doxmRsrc->interfaces = (char**)OICCalloc(doxmRsrc->interfaceLen, sizeof(char*));
2243     VERIFY_NON_NULL(TAG, doxmRsrc->interfaces, ERROR);
2244     doxmRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2245     VERIFY_NON_NULL(TAG, doxmRsrc->interfaces[0], ERROR);
2246
2247     // /oic/sec/pstat
2248     pstatRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2249     VERIFY_NON_NULL(TAG, pstatRsrc, ERROR);
2250     LL_APPEND(ace->resources, pstatRsrc);
2251     pstatRsrc->href = OICStrdup(OIC_RSRC_PSTAT_URI);
2252     VERIFY_NON_NULL(TAG, (pstatRsrc->href), ERROR);
2253     pstatRsrc->typeLen = 1;
2254     pstatRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2255     VERIFY_NON_NULL(TAG, pstatRsrc->types, ERROR);
2256     pstatRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_PSTAT);
2257     VERIFY_NON_NULL(TAG, pstatRsrc->types[0], ERROR);
2258     pstatRsrc->interfaceLen = 1;
2259     pstatRsrc->interfaces = (char**)OICCalloc(pstatRsrc->interfaceLen, sizeof(char*));
2260     VERIFY_NON_NULL(TAG, pstatRsrc->interfaces, ERROR);
2261     pstatRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2262     VERIFY_NON_NULL(TAG, pstatRsrc->interfaces[0], ERROR);
2263
2264     ace->permission = PERMISSION_READ;
2265     ace->validities = NULL;
2266
2267     // Device ID is the owner of this default ACL
2268     if (GetDoxmResourceData() != NULL)
2269     {
2270         ret = GetDoxmDeviceID(&ownerId);
2271         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, FATAL);
2272     }
2273     else
2274     {
2275         OCRandomUuidResult rdm = OCGenerateUuid(ownerId.id);
2276         VERIFY_SUCCESS(TAG, RAND_UUID_OK == rdm, FATAL);
2277     }
2278
2279     memcpy(&acl->rownerID, &ownerId, sizeof(OicUuid_t));
2280
2281     *defaultAcl = acl;
2282     ret = OC_STACK_OK;
2283
2284 exit:
2285
2286     if (ret != OC_STACK_OK)
2287     {
2288         DeleteACLList(acl);
2289         acl = NULL;
2290     }
2291
2292     return ret;
2293 }
2294
2295 OCStackResult InitACLResource()
2296 {
2297     OCStackResult ret = OC_STACK_ERROR;
2298
2299     uint8_t *data = NULL;
2300     size_t size = 0;
2301     ret = GetSecureVirtualDatabaseFromPS(OIC_JSON_ACL_NAME, &data, &size);
2302     // If database read failed
2303     if (OC_STACK_OK != ret)
2304     {
2305         OIC_LOG(DEBUG, TAG, "ReadSVDataFromPS failed");
2306     }
2307     if (data)
2308     {
2309         // Read ACL resource from PS
2310         gAcl = CBORPayloadToAcl(data, size);
2311         OICFree(data);
2312     }
2313     /*
2314      * If SVR database in persistent storage got corrupted or
2315      * is not available for some reason, a default ACL is created
2316      * which allows user to initiate ACL provisioning again.
2317      */
2318     if (!gAcl)
2319     {
2320         ret = GetDefaultACL(&gAcl);
2321         if (OC_STACK_OK != ret)
2322         {
2323             OIC_LOG(ERROR, TAG, "Failed to create default ACL");
2324         }
2325         // TODO Needs to update persistent storage
2326     }
2327     VERIFY_NON_NULL(TAG, gAcl, FATAL);
2328
2329     // Instantiate 'oic.sec.acl'
2330     ret = CreateACLResource();
2331
2332 exit:
2333     if (OC_STACK_OK != ret)
2334     {
2335         DeInitACLResource();
2336     }
2337     return ret;
2338 }
2339
2340 OCStackResult DeInitACLResource()
2341 {
2342     OCStackResult ret =  OCDeleteResource(gAclHandle);
2343     gAclHandle = NULL;
2344
2345     if (gAcl)
2346     {
2347         DeleteACLList(gAcl);
2348         gAcl = NULL;
2349     }
2350     return ret;
2351 }
2352
2353 const OicSecAce_t* GetACLResourceData(const OicUuid_t* subjectId, OicSecAce_t **savePtr)
2354 {
2355     OicSecAce_t *ace = NULL;
2356     OicSecAce_t *begin = NULL;
2357
2358     if (NULL == subjectId || NULL == savePtr || NULL == gAcl)
2359     {
2360         return NULL;
2361     }
2362
2363     /*
2364      * savePtr MUST point to NULL if this is the 'first' call to retrieve ACL for
2365      * subjectID.
2366      */
2367     if (NULL == *savePtr)
2368     {
2369         begin = gAcl->aces;
2370     }
2371     else
2372     {
2373         /*
2374          * If this is a 'successive' call, search for location pointed by
2375          * savePtr and assign 'begin' to the next ACL after it in the linked
2376          * list and start searching from there.
2377          */
2378         LL_FOREACH(gAcl->aces, ace)
2379         {
2380             if (ace == *savePtr)
2381             {
2382                 begin = ace->next;
2383             }
2384         }
2385     }
2386
2387     // Find the next ACL corresponding to the 'subjectID' and return it.
2388     LL_FOREACH(begin, ace)
2389     {
2390         if (memcmp(&(ace->subjectuuid), subjectId, sizeof(OicUuid_t)) == 0)
2391         {
2392             *savePtr = ace;
2393             return ace;
2394         }
2395     }
2396
2397     // Cleanup in case no ACL is found
2398     *savePtr = NULL;
2399     return NULL;
2400 }
2401
2402 void printACL(const OicSecAcl_t* acl)
2403 {
2404     OIC_LOG(INFO, TAG, "Print ACL:");
2405
2406     if (NULL == acl)
2407     {
2408         OIC_LOG(INFO, TAG, "Received NULL acl");
2409         return;
2410     }
2411
2412     char *rowner = NULL;
2413     if (OC_STACK_OK == ConvertUuidToStr(&acl->rownerID, &rowner))
2414     {
2415         OIC_LOG_V(INFO, TAG, "rowner id = %s", rowner);
2416     }
2417     else
2418     {
2419         OIC_LOG(ERROR, TAG, "Can't convert rowner uuid to string");
2420     }
2421     OICFree(rowner);
2422
2423     const OicSecAce_t *ace = acl->aces;
2424     int ace_count = 0;
2425     while (ace)
2426     {
2427         ace_count++;
2428         OIC_LOG_V(INFO, TAG, "Print ace[%d]:", ace_count);
2429
2430         OIC_LOG_V(INFO, TAG, "ace permission = %d", ace->permission);
2431
2432         char *subjectuuid = NULL;
2433         if (OC_STACK_OK == ConvertUuidToStr(&ace->subjectuuid, &subjectuuid))
2434         {
2435             OIC_LOG_V(INFO, TAG, "ace subject uuid = %s", subjectuuid);
2436         }
2437         else
2438         {
2439             OIC_LOG(ERROR, TAG, "Can't convert subjectuuid to string");
2440         }
2441         OICFree(subjectuuid);
2442
2443         OicSecRsrc_t *res = ace->resources;
2444         int res_count = 0;
2445         while (res)
2446         {
2447             res_count++;
2448             OIC_LOG_V(INFO, TAG, "Print resources[%d]:", res_count);
2449
2450             OIC_LOG_V(INFO, TAG, "href = %s", res->href);
2451
2452             for (size_t i = 0; i < res->typeLen; i++)
2453             {
2454                 OIC_LOG_V(INFO, TAG, "if[%zu] = %s", i, res->types[i]);
2455             }
2456             for (size_t i = 0; i < res->interfaceLen; i++)
2457             {
2458                 OIC_LOG_V(INFO, TAG, "if[%zu] = %s", i, res->interfaces[i]);
2459             }
2460
2461             res= res->next;
2462         }
2463
2464         OicSecValidity_t *vals = ace->validities;
2465         int vals_count = 0;
2466         while (vals)
2467         {
2468             vals_count++;
2469             OIC_LOG_V(INFO, TAG, "Print validities[%d]:", vals_count);
2470
2471             OIC_LOG_V(INFO, TAG, "period = %s", vals->period);
2472             for (size_t i = 0; i < vals->recurrenceLen; i++)
2473             {
2474                 OIC_LOG_V(INFO, TAG, "recurrences[%zu] = %s", i, vals->recurrences[i]);
2475             }
2476         }
2477
2478         ace = ace->next;
2479     }
2480 }
2481
2482 OCStackResult AppendACL2(const OicSecAcl_t* acl)
2483 {
2484     OCStackResult ret = OC_STACK_ERROR;
2485
2486     if (!acl)
2487     {
2488         return OC_STACK_INVALID_PARAM;
2489     }
2490
2491     // Append the new ACE to existing ACE list
2492     // Can't use LL_APPEND because it sets ace->next to NULL
2493     OicSecAce_t* ace = gAcl->aces;
2494     if (ace)
2495     {
2496         while (ace->next)
2497         {
2498             ace = ace->next;
2499         }
2500         ace->next = acl->aces;
2501     }
2502     else
2503     {
2504         gAcl->aces = acl->aces;
2505     }
2506
2507     printACL(gAcl);
2508
2509     size_t size = 0;
2510     uint8_t *payload = NULL;
2511     ret = AclToCBORPayload(gAcl, &payload, &size);
2512     if (OC_STACK_OK == ret)
2513     {
2514         ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size);
2515         OICFree(payload);
2516     }
2517
2518     return ret;
2519 }
2520
2521 OCStackResult AppendACL(const uint8_t *cborPayload, const size_t size)
2522 {
2523     // Convert CBOR format to ACL data. This will also validate the ACL data received.
2524     OicSecAcl_t* newAcl = CBORPayloadToAcl(cborPayload, size);
2525
2526     return AppendACL2(newAcl);
2527 }
2528
2529 OCStackResult InstallACL(const OicSecAcl_t* acl)
2530 {
2531     OCStackResult ret = OC_STACK_ERROR;
2532
2533     if (!acl)
2534     {
2535         return OC_STACK_INVALID_PARAM;
2536     }
2537
2538     bool isNewAce = true;
2539     OicSecAce_t* existAce = NULL;
2540     OicSecAce_t* newAce = NULL;
2541     OicSecAce_t* tempAce1 = NULL;
2542     OicSecAce_t* tempAce2 = NULL;
2543     OicSecAcl_t* newInstallAcl = NULL;
2544
2545     LL_FOREACH_SAFE(acl->aces, newAce, tempAce1)
2546     {
2547         isNewAce = true;
2548         LL_FOREACH_SAFE(gAcl->aces, existAce, tempAce2)
2549         {
2550             if(IsSameACE(newAce, existAce))
2551             {
2552                 OIC_LOG(DEBUG, TAG, "Duplicated ACE dectected.");
2553                 ret = OC_STACK_DUPLICATE_REQUEST;
2554                 isNewAce = false;
2555             }
2556         }
2557         if(isNewAce)
2558         {
2559             // Append new ACE to existing ACL
2560             OIC_LOG(DEBUG, TAG, "NEW ACE dectected.");
2561
2562             OicSecAce_t* insertAce = DuplicateACE(newAce);
2563             if(insertAce)
2564             {
2565                 OIC_LOG(DEBUG, TAG, "Appending new ACE..");
2566
2567                 if (!newInstallAcl)
2568                 {
2569                     newInstallAcl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
2570                     if (NULL == newInstallAcl)
2571                     {
2572                         OIC_LOG(ERROR, TAG, "Failed to acllocate ACL");
2573                         return OC_STACK_NO_MEMORY;
2574                     }
2575                 }
2576                 LL_PREPEND(newInstallAcl->aces, insertAce);
2577             }
2578             else
2579             {
2580                 OIC_LOG(ERROR, TAG, "Failed to duplicate ACE");
2581                 DeleteACLList(newInstallAcl);
2582                 return OC_STACK_ERROR;
2583             }
2584         }
2585     }
2586
2587     if (newInstallAcl)
2588     {
2589         ret = AppendACL2(newInstallAcl);
2590         if (OC_STACK_OK != ret)
2591         {
2592             OIC_LOG(ERROR, TAG, "Failed to append ACL");
2593         }
2594         OICFree(newInstallAcl);
2595     }
2596
2597     return ret;
2598 }
2599
2600 /**
2601  * This function generates default ACE for security resource in case of owned status.
2602  *
2603  * @return Default ACE for security resource.
2604  */
2605 static OicSecAce_t* GetSecDefaultACE()
2606 {
2607     const int NUM_OF_DOXM_RT = 1;
2608     const int NUM_OF_DOXM_IF  = 1;
2609     const int NUM_OF_PSTAT_RT = 1;
2610     const int NUM_OF_PSTAT_IF = 1;
2611     const char *doxmRt[] = { OIC_RSRC_TYPE_SEC_DOXM };
2612     const char *pstatRt[] = { OIC_RSRC_TYPE_SEC_PSTAT };
2613     const char *doxmIf[] = { OC_RSRVD_INTERFACE_DEFAULT };
2614     const char *pstatIf[] = { OC_RSRVD_INTERFACE_DEFAULT };
2615     OicSecRsrc_t* doxmRsrc = NULL;
2616     OicSecRsrc_t* pstatRsrc = NULL;
2617
2618     //Generate default ACE
2619     OicSecAce_t* newAce = (OicSecAce_t*)OICCalloc(1, sizeof(OicSecAce_t));
2620     VERIFY_NON_NULL(TAG, newAce, ERROR);
2621
2622     // Subject -- Mandatory
2623     memcpy(newAce->subjectuuid.id, &WILDCARD_SUBJECT_ID, WILDCARD_SUBJECT_ID_LEN);
2624
2625     //Resources -- Mandatory
2626     //Add doxm
2627     doxmRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2628     VERIFY_NON_NULL(TAG, doxmRsrc, ERROR);
2629     LL_APPEND(newAce->resources, doxmRsrc);
2630     // pstat-href
2631     doxmRsrc->href = OICStrdup(OIC_RSRC_DOXM_URI);
2632     VERIFY_NON_NULL(TAG, (doxmRsrc->href), ERROR);
2633     // pstat-rt
2634     doxmRsrc->typeLen = NUM_OF_DOXM_RT;
2635     doxmRsrc->types = (char**)OICCalloc(NUM_OF_DOXM_RT, sizeof(char*));
2636     VERIFY_NON_NULL(TAG, (doxmRsrc->types), ERROR);
2637     for(int i = 0; i < NUM_OF_DOXM_RT; i++)
2638     {
2639         doxmRsrc->types[i] = OICStrdup(doxmRt[i]);
2640         VERIFY_NON_NULL(TAG, (doxmRsrc->types[i]), ERROR);
2641     }
2642     // pstat-if
2643     doxmRsrc->interfaceLen = NUM_OF_DOXM_IF;
2644     doxmRsrc->interfaces = (char**)OICCalloc(NUM_OF_DOXM_IF, sizeof(char*));
2645     VERIFY_NON_NULL(TAG, (doxmRsrc->interfaces), ERROR);
2646     for(int i = 0; i < NUM_OF_DOXM_IF; i++)
2647     {
2648         doxmRsrc->interfaces[i] = OICStrdup(doxmIf[i]);
2649         VERIFY_NON_NULL(TAG, (doxmRsrc->interfaces[i]), ERROR);
2650     }
2651
2652     //Add pstat
2653     pstatRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2654     VERIFY_NON_NULL(TAG, pstatRsrc, ERROR);
2655     LL_APPEND(newAce->resources, pstatRsrc);
2656     //pstat-href
2657     pstatRsrc->href = OICStrdup(OIC_RSRC_PSTAT_URI);
2658     VERIFY_NON_NULL(TAG, (pstatRsrc->href), ERROR);
2659     //pstat-rt
2660     pstatRsrc->typeLen = NUM_OF_PSTAT_RT;
2661     pstatRsrc->types = (char**)OICCalloc(NUM_OF_PSTAT_RT, sizeof(char*));
2662     VERIFY_NON_NULL(TAG, (pstatRsrc->types), ERROR);
2663     for(int i = 0; i < NUM_OF_PSTAT_RT; i++)
2664     {
2665         pstatRsrc->types[i] = OICStrdup(pstatRt[i]);
2666         VERIFY_NON_NULL(TAG, (pstatRsrc->types[i]), ERROR);
2667     }
2668     // pstat-if
2669     pstatRsrc->interfaceLen = NUM_OF_PSTAT_IF;
2670     pstatRsrc->interfaces = (char**)OICCalloc(NUM_OF_PSTAT_IF, sizeof(char*));
2671     VERIFY_NON_NULL(TAG, (pstatRsrc->interfaces), ERROR);
2672     for(int i = 0; i < NUM_OF_PSTAT_IF; i++)
2673     {
2674         pstatRsrc->interfaces[i] = OICStrdup(pstatIf[i]);
2675         VERIFY_NON_NULL(TAG, (pstatRsrc->interfaces[i]), ERROR);
2676     }
2677
2678     // Permissions -- Mandatory
2679     newAce->permission = PERMISSION_READ;
2680
2681     //Period -- Not Mandatory
2682     newAce->validities = NULL;
2683
2684     return newAce;
2685 exit:
2686     FreeACE(newAce);
2687     return NULL;
2688
2689 }
2690
2691 OCStackResult UpdateDefaultSecProvACE()
2692 {
2693     OCStackResult ret = OC_STACK_OK;
2694     OicSecAce_t *ace = NULL;
2695     OicSecAce_t *tempAce = NULL;
2696
2697     if(gAcl)
2698     {
2699         int matchedRsrc = 0;
2700         bool isRemoved = false;
2701
2702         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
2703         {
2704             //Find default security resource ACL
2705             if(memcmp(&ace->subjectuuid, &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t)) == 0 &&
2706                 ((PERMISSION_READ | PERMISSION_WRITE) == ace->permission))
2707             {
2708                 matchedRsrc = 0;
2709
2710                 OicSecRsrc_t* rsrc = NULL;
2711                 LL_FOREACH(ace->resources, rsrc)
2712                 {
2713                     if(strncmp(rsrc->href, OIC_RSRC_DOXM_URI,
2714                                strlen(OIC_RSRC_DOXM_URI) + 1) == 0 ||
2715                        strncmp(rsrc->href, OIC_RSRC_CRED_URI,
2716                                strlen(OIC_RSRC_CRED_URI) + 1) == 0 ||
2717                        strncmp(rsrc->href, OIC_RSRC_ACL_URI,
2718                                strlen(OIC_RSRC_ACL_URI) + 1) == 0 ||
2719                        strncmp(rsrc->href, OIC_RSRC_PSTAT_URI,
2720                                strlen(OIC_RSRC_PSTAT_URI) + 1) == 0)
2721                     {
2722                         matchedRsrc++;
2723                     }
2724                 }
2725
2726                 //If default security resource ACL is detected, delete it.
2727                 if(NUMBER_OF_SEC_PROV_RSCS == matchedRsrc)
2728                 {
2729                     LL_DELETE(gAcl->aces, ace);
2730                     FreeACE(ace);
2731                     isRemoved = true;
2732                 }
2733             }
2734         }
2735
2736         if(isRemoved)
2737         {
2738             /*
2739              * Generate new security resource ACE as follows :
2740              *      subject : "*"
2741              *      resources :  '/oic/sec/doxm', '/oic/sec/pstat'
2742              *      permission : READ
2743              */
2744             OicSecAce_t *secDefaultAce = GetSecDefaultACE();
2745             if (secDefaultAce)
2746             {
2747                 LL_APPEND(gAcl->aces, secDefaultAce);
2748
2749                 size_t size = 0;
2750                 uint8_t *payload = NULL;
2751                 if (OC_STACK_OK == AclToCBORPayload(gAcl, &payload, &size))
2752                 {
2753                     if (UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size) == OC_STACK_OK)
2754                     {
2755                         ret = OC_STACK_OK;
2756                     }
2757                     OICFree(payload);
2758                 }
2759             }
2760         }
2761     }
2762
2763     return ret;
2764 }
2765
2766 OCStackResult SetAclRownerId(const OicUuid_t* newROwner)
2767 {
2768     OCStackResult ret = OC_STACK_ERROR;
2769     uint8_t *cborPayload = NULL;
2770     size_t size = 0;
2771     OicUuid_t prevId = {.id={0}};
2772
2773     if(NULL == newROwner)
2774     {
2775         ret = OC_STACK_INVALID_PARAM;
2776     }
2777     if(NULL == gAcl)
2778     {
2779         ret = OC_STACK_NO_RESOURCE;
2780     }
2781
2782     if(newROwner && gAcl)
2783     {
2784         memcpy(prevId.id, gAcl->rownerID.id, sizeof(prevId.id));
2785         memcpy(gAcl->rownerID.id, newROwner->id, sizeof(newROwner->id));
2786
2787         ret = AclToCBORPayload(gAcl, &cborPayload, &size);
2788         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, ERROR);
2789
2790         ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, cborPayload, size);
2791         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, ERROR);
2792
2793         OICFree(cborPayload);
2794     }
2795
2796     return ret;
2797
2798 exit:
2799     OICFree(cborPayload);
2800     memcpy(gAcl->rownerID.id, prevId.id, sizeof(prevId.id));
2801     return ret;
2802 }
2803
2804 OCStackResult GetAclRownerId(OicUuid_t *rowneruuid)
2805 {
2806     OCStackResult retVal = OC_STACK_ERROR;
2807     if (gAcl)
2808     {
2809         *rowneruuid = gAcl->rownerID;
2810         retVal = OC_STACK_OK;
2811     }
2812     return retVal;
2813 }