resource/csdk/security/src/aclresource.c

   1 //******************************************************************
   2 //
   3 // Copyright 2015 Intel Mobile Communications GmbH All Rights Reserved.
   4 //
   5 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   6 //
   7 // Licensed under the Apache License, Version 2.0 (the "License");
   8 // you may not use this file except in compliance with the License.
   9 // You may obtain a copy of the License at
  10 //
  11 //      http://www.apache.org/licenses/LICENSE-2.0
  12 //
  13 // Unless required by applicable law or agreed to in writing, software
  14 // distributed under the License is distributed on an "AS IS" BASIS,
  15 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16 // See the License for the specific language governing permissions and
  17 // limitations under the License.
  18 //
  19 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  20
  21 #include "iotivity_config.h"
  22 #ifdef HAVE_STRING_H
  23 #include <string.h>
  24 #elif defined(HAVE_STRINGS_H)
  25 #include <strings.h>
  26 #endif
  27 #include <stdlib.h>
  28
  29 #include "utlist.h"
  30 #include "ocstack.h"
  31 #include "octypes.h"
  32 #include "ocserverrequest.h"
  33 #include "oic_malloc.h"
  34 #include "oic_string.h"
  35 #include "ocrandom.h"
  36 #include "ocpayload.h"
  37 #include "utlist.h"
  38 #include "payload_logging.h"
  39 #include "srmresourcestrings.h"
  40 #include "aclresource.h"
  41 #include "doxmresource.h"
  42 #include "resourcemanager.h"
  43 #include "srmutility.h"
  44 #include "psinterface.h"
  45 #include "ocpayloadcbor.h"
  46
  47 #include "security_internals.h"
  48
  49 #define TAG  "OIC_SRM_ACL"
  50 #define NUMBER_OF_SEC_PROV_RSCS 4
  51 #define NUMBER_OF_DEFAULT_SEC_RSCS 2
  52 #define STRING_UUID_SIZE (UUID_LENGTH * 2 + 5)
  53
  54 static const uint8_t ACL_MAP_SIZE = 4;
  55 static const uint8_t ACL_ACLIST_MAP_SIZE = 1;
  56 static const uint8_t ACL_ACES_MAP_SIZE = 3;
  57 static const uint8_t ACL_RESOURCE_MAP_SIZE = 3;
  58
  59
  60 // CborSize is the default cbor payload size being used.
  61 static const uint16_t CBOR_SIZE = 2048*8;
  62
  63 static OicSecAcl_t *gAcl = NULL;
  64 static OCResourceHandle gAclHandle = NULL;
  65
  66 void FreeRsrc(OicSecRsrc_t *rsrc)
  67 {
  68     //Clean each member of resource
  69     OICFree(rsrc->href);
  70     OICFree(rsrc->rel);
  71     //Clean "rt"
  72     if(0 < rsrc->typeLen && rsrc->types)
  73     {
  74         for(size_t i = 0; i < rsrc->typeLen; i++)
  75         {
  76             OICFree(rsrc->types[i]);
  77         }
  78         OICFree(rsrc->types);
  79         rsrc->types = NULL;
  80     }
  81     //Clean "if"
  82     if(0 < rsrc->interfaceLen && rsrc->interfaces)
  83     {
  84         for(size_t i = 0; i < rsrc->interfaceLen; i++)
  85         {
  86             OICFree(rsrc->interfaces[i]);
  87         }
  88         OICFree(rsrc->interfaces);
  89         rsrc->interfaces = NULL;
  90     }
  91     OICFree(rsrc);
  92     rsrc = NULL;
  93 }
  94
  95 /**
  96  * This function frees OicSecAcl_t object's fields and object itself.
  97  */
  98 static void FreeACE(OicSecAce_t *ace)
  99 {
 100     if (NULL == ace)
 101     {
 102         OIC_LOG(ERROR, TAG, "Invalid Parameter");
 103         return;
 104     }
 105
 106     //Clean Resources
 107     OicSecRsrc_t* rsrc = NULL;
 108     OicSecRsrc_t* tmpRsrc = NULL;
 109     LL_FOREACH_SAFE(ace->resources, rsrc, tmpRsrc)
 110     {
 111         LL_DELETE(ace->resources, rsrc);
 112         FreeRsrc(rsrc);
 113     }
 114
 115     //Clean Validities
 116     OicSecValidity_t *validity = NULL;
 117     OicSecValidity_t *tmpValidity = NULL;
 118     LL_FOREACH_SAFE(ace->validities, validity, tmpValidity)
 119     {
 120         LL_DELETE(ace->validities, validity);
 121
 122         //Clean period
 123         OICFree(validity->period);
 124
 125         //Clean recurrence
 126         for(size_t i = 0; i < validity->recurrenceLen; i++)
 127         {
 128             OICFree(validity->recurrences[i]);
 129         }
 130         OICFree(validity->recurrences);
 131         OICFree(validity);
 132         validity = NULL;
 133     }
 134
 135 #ifdef _ENABLE_MULTIPLE_OWNER_
 136     OICFree(ace->eownerID);
 137 #endif
 138
 139     //Clean ACE
 140     OICFree(ace);
 141     ace = NULL;
 142 }
 143
 144 void DeleteACLList(OicSecAcl_t* acl)
 145 {
 146     if (acl)
 147     {
 148         OicSecAce_t *ace = NULL;
 149         OicSecAce_t *tmpAce = NULL;
 150         LL_FOREACH_SAFE(acl->aces, ace, tmpAce)
 151         {
 152             LL_DELETE(acl->aces, ace);
 153             FreeACE(ace);
 154         }
 155         acl->aces = NULL;
 156         OICFree(acl);
 157     }
 158 }
 159
 160 OicSecAce_t* DuplicateACE(const OicSecAce_t* ace)
 161 {
 162     OicSecAce_t* newAce = NULL;
 163     size_t allocateSize = 0;
 164
 165     if(ace)
 166     {
 167         newAce = (OicSecAce_t*)OICCalloc(1, sizeof(OicSecAce_t));
 168         VERIFY_NON_NULL(TAG, newAce, ERROR);
 169
 170         //Subject uuid
 171         memcpy(&newAce->subjectuuid, &ace->subjectuuid, sizeof(OicUuid_t));
 172
 173         OicSecRsrc_t* rsrc = NULL;
 174         LL_FOREACH(ace->resources, rsrc)
 175         {
 176             OicSecRsrc_t* newRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
 177             VERIFY_NON_NULL(TAG, newRsrc, ERROR);
 178             LL_APPEND(newAce->resources, newRsrc);
 179
 180             //href is mandatory
 181             VERIFY_NON_NULL(TAG, rsrc->href, ERROR);
 182             allocateSize = strlen(rsrc->href) + 1;
 183             newRsrc->href = (char*)OICMalloc(sizeof(char) * allocateSize);
 184             VERIFY_NON_NULL(TAG, newRsrc->href, ERROR);
 185             OICStrcpy(newRsrc->href, allocateSize, rsrc->href);
 186
 187             if(rsrc->rel)
 188             {
 189                 allocateSize = strlen(rsrc->rel) + 1;
 190                 newRsrc->rel = (char*)OICMalloc(sizeof(char) * allocateSize);
 191                 VERIFY_NON_NULL(TAG, newRsrc->rel, ERROR);
 192                 OICStrcpy(newRsrc->rel, allocateSize, rsrc->rel);
 193             }
 194
 195             if(rsrc->types && 0 < rsrc->typeLen)
 196             {
 197                 newRsrc->typeLen = rsrc->typeLen;
 198                 newRsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
 199                 VERIFY_NON_NULL(TAG, (newRsrc->types), ERROR);
 200                 for(size_t i = 0; i < rsrc->typeLen; i++)
 201                 {
 202                     newRsrc->types[i] = OICStrdup(rsrc->types[i]);
 203                     VERIFY_NON_NULL(TAG, (newRsrc->types[i]), ERROR);
 204                 }
 205             }
 206
 207             if(rsrc->interfaces && 0 < rsrc->interfaceLen)
 208             {
 209                 newRsrc->interfaceLen = rsrc->interfaceLen;
 210                 newRsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
 211                 VERIFY_NON_NULL(TAG, (newRsrc->interfaces), ERROR);
 212                 for(size_t i = 0; i < rsrc->interfaceLen; i++)
 213                 {
 214                     newRsrc->interfaces[i] = OICStrdup(rsrc->interfaces[i]);
 215                     VERIFY_NON_NULL(TAG, (newRsrc->interfaces[i]), ERROR);
 216                 }
 217             }
 218         }
 219
 220         //Permission
 221         newAce->permission = ace->permission;
 222
 223         //Validity
 224         if(ace->validities)
 225         {
 226             OicSecValidity_t* validity = NULL;
 227             LL_FOREACH(ace->validities, validity)
 228             {
 229                 OicSecValidity_t* newValidity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
 230                 VERIFY_NON_NULL(TAG, newValidity, ERROR);
 231                 LL_APPEND(newAce->validities, newValidity);
 232
 233                 if(validity->period)
 234                 {
 235                     allocateSize = strlen(validity->period) + 1;
 236                     newValidity->period = (char*)OICMalloc(sizeof(char) * allocateSize);
 237                     VERIFY_NON_NULL(TAG, newValidity->period, ERROR);
 238                     OICStrcpy(newValidity->period, allocateSize, validity->period);
 239                 }
 240
 241                 if(validity->recurrences && 0 < validity->recurrenceLen)
 242                 {
 243                     newValidity->recurrenceLen = validity->recurrenceLen;
 244
 245                     newValidity->recurrences = (char**)OICMalloc(sizeof(char*) * validity->recurrenceLen);
 246                     VERIFY_NON_NULL(TAG, newValidity->recurrences, ERROR);
 247
 248                     for(size_t i = 0; i < validity->recurrenceLen; i++)
 249                     {
 250                         allocateSize = strlen(validity->recurrences[i]) + 1;
 251                         newValidity->recurrences[i] = (char*)OICMalloc(sizeof(char) * allocateSize);
 252                         VERIFY_NON_NULL(TAG, (newValidity->recurrences[i]), ERROR);
 253                         OICStrcpy(newValidity->recurrences[i], allocateSize, validity->recurrences[i]);
 254                     }
 255                 }
 256             }
 257         }
 258
 259 #ifdef _ENABLE_MULTIPLE_OWNER_
 260         if (ace->eownerID)
 261         {
 262             if (NULL == newAce->eownerID)
 263             {
 264                 newAce->eownerID = (OicUuid_t*)OICCalloc(1, sizeof(OicUuid_t));
 265                 VERIFY_NON_NULL(TAG, (newAce->eownerID), ERROR);
 266             }
 267             memcpy(newAce->eownerID->id, ace->eownerID->id, sizeof(ace->eownerID->id));
 268         }
 269 #endif
 270
 271         newAce->next = NULL;
 272     }
 273
 274     return newAce;
 275
 276 exit:
 277     FreeACE(newAce);
 278     return NULL;
 279 }
 280
 281 static size_t OicSecAclSize(const OicSecAcl_t *secAcl)
 282 {
 283     if (!secAcl)
 284     {
 285         return 0;
 286     }
 287     OicSecAce_t *ace= (OicSecAce_t *)secAcl->aces;
 288     size_t size = 0;
 289     while (ace)
 290     {
 291        size++;
 292        ace = ace->next;
 293     }
 294     return size;
 295 }
 296
 297 OCStackResult AclToCBORPayload(const OicSecAcl_t *secAcl, uint8_t **payload, size_t *size)
 298 {
 299      if (NULL == secAcl || NULL == payload || NULL != *payload || NULL == size)
 300     {
 301         return OC_STACK_INVALID_PARAM;
 302     }
 303
 304     OCStackResult ret = OC_STACK_ERROR;
 305     CborError cborEncoderResult = CborNoError;
 306     OicSecAcl_t *acl = (OicSecAcl_t *)secAcl;
 307     OicSecAce_t* ace = NULL;
 308     CborEncoder encoder;
 309     CborEncoder aclMap;
 310     CborEncoder aclListMap;
 311     CborEncoder acesArray;
 312     uint8_t *outPayload = NULL;
 313     size_t cborLen = *size;
 314     *size = 0;
 315     *payload = NULL;
 316
 317     if (cborLen == 0)
 318     {
 319         cborLen = CBOR_SIZE;
 320     }
 321
 322     outPayload = (uint8_t *)OICCalloc(1, cborLen);
 323     VERIFY_NON_NULL(TAG, outPayload, ERROR);
 324     cbor_encoder_init(&encoder, outPayload, cborLen, 0);
 325
 326     // Create ACL Map (aclist, rownerid)
 327     cborEncoderResult = cbor_encoder_create_map(&encoder, &aclMap, ACL_MAP_SIZE);
 328     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACL Map.");
 329
 330     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_ACLIST_NAME,
 331         strlen(OIC_JSON_ACLIST_NAME));
 332     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding aclist Name Tag.");
 333
 334     // Create ACLIST Map (aces)
 335     cborEncoderResult = cbor_encoder_create_map(&aclMap, &aclListMap, ACL_ACLIST_MAP_SIZE);
 336     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACLIST Map.");
 337
 338     cborEncoderResult = cbor_encode_text_string(&aclListMap, OIC_JSON_ACES_NAME,
 339         strlen(OIC_JSON_ACES_NAME));
 340     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding ACES Name Tag.");
 341
 342     // Create ACES Array
 343     cborEncoderResult = cbor_encoder_create_array(&aclListMap, &acesArray, OicSecAclSize(secAcl));
 344     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACES Array.");
 345
 346     ace = NULL;
 347     LL_FOREACH (acl->aces, ace)
 348     {
 349         CborEncoder oicSecAclMap;
 350         // ACL Map size - Number of mandatory items
 351         uint8_t aclMapSize = ACL_ACES_MAP_SIZE;
 352         size_t inLen = 0;
 353
 354         OicSecValidity_t* validityElts = ace->validities;
 355         while(validityElts)
 356         {
 357             if(validityElts->period)
 358             {
 359                 aclMapSize++;
 360             }
 361             if(validityElts->recurrences)
 362             {
 363                 aclMapSize++;
 364             }
 365         }
 366
 367 #ifdef _ENABLE_MULTIPLE_OWNER_
 368         if(ace->eownerID)
 369         {
 370             aclMapSize++;
 371         }
 372 #endif //_ENABLE_MULTIPLE_OWNER_
 373
 374         cborEncoderResult = cbor_encoder_create_map(&acesArray, &oicSecAclMap, aclMapSize);
 375         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACES Map");
 376
 377         // Subject -- Mandatory
 378         cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_SUBJECTID_NAME,
 379             strlen(OIC_JSON_SUBJECTID_NAME));
 380         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Subject Name Tag.");
 381         inLen = (memcmp(&(ace->subjectuuid), &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t)) == 0) ?
 382             WILDCARD_SUBJECT_ID_LEN : sizeof(OicUuid_t);
 383         if(inLen == WILDCARD_SUBJECT_ID_LEN)
 384         {
 385             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, WILDCARD_RESOURCE_URI,
 386                 strlen(WILDCARD_RESOURCE_URI));
 387             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Subject Id wildcard Value.");
 388         }
 389         else
 390         {
 391             char *subject = NULL;
 392             ret = ConvertUuidToStr(&ace->subjectuuid, &subject);
 393             VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 394             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, subject, strlen(subject));
 395             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Subject UUID Value.");
 396             OICFree(subject);
 397         }
 398
 399         // Resources
 400         {
 401             CborEncoder resources;
 402             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_RESOURCES_NAME,
 403                 strlen(OIC_JSON_RESOURCES_NAME));
 404             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Resource Name Tag.");
 405
 406             size_t rsrcLen = 0;
 407             OicSecRsrc_t* rsrcElts = NULL;
 408             LL_FOREACH(ace->resources, rsrcElts)
 409             {
 410                 rsrcLen++;
 411             }
 412
 413             cborEncoderResult = cbor_encoder_create_array(&oicSecAclMap, &resources, rsrcLen);
 414             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Resource Name Array.");
 415
 416             OicSecRsrc_t* rsrc = NULL;
 417             LL_FOREACH(ace->resources, rsrc)
 418             {
 419
 420                 CborEncoder rMap;
 421                 size_t rsrcMapSize = ACL_RESOURCE_MAP_SIZE;
 422                 if(rsrc->rel)
 423                 {
 424                     rsrcMapSize++;
 425                 }
 426
 427                 cborEncoderResult = cbor_encoder_create_map(&resources, &rMap, rsrcMapSize);
 428                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Resource Map.");
 429
 430                 //href -- Mandatory
 431                 VERIFY_NON_NULL(TAG, rsrc->href, ERROR);
 432                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_HREF_NAME,
 433                         strlen(OIC_JSON_HREF_NAME));
 434                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding HREF Name Tag.");
 435                 cborEncoderResult = cbor_encode_text_string(&rMap, rsrc->href, strlen(rsrc->href));
 436                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding HREF Value in Map.");
 437
 438                 //resource type -- Mandatory
 439                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_RT_NAME,
 440                         strlen(OIC_JSON_RT_NAME));
 441                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Name Tag.");
 442
 443                 CborEncoder resourceTypes;
 444                 cborEncoderResult = cbor_encoder_create_array(&rMap, &resourceTypes, rsrc->typeLen);
 445                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding RT Array.");
 446                 for(size_t i = 0; i < rsrc->typeLen; i++)
 447                 {
 448                     cborEncoderResult = cbor_encode_text_string(&resourceTypes, rsrc->types[i], strlen(rsrc->types[i]));
 449                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Value.");
 450                 }
 451                 cborEncoderResult = cbor_encoder_close_container(&rMap, &resourceTypes);
 452                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing resourceTypes.");
 453
 454                 //interface -- Mandatory
 455                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_IF_NAME,
 456                         strlen(OIC_JSON_IF_NAME));
 457                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Name Tag.");
 458
 459                 CborEncoder interfaces;
 460                 cborEncoderResult = cbor_encoder_create_array(&rMap, &interfaces, rsrc->interfaceLen);
 461                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding IF Array.");
 462                 for(size_t i = 0; i < rsrc->interfaceLen; i++)
 463                 {
 464                     cborEncoderResult = cbor_encode_text_string(&interfaces, rsrc->interfaces[i], strlen(rsrc->interfaces[i]));
 465                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Value.");
 466                 }
 467                 cborEncoderResult = cbor_encoder_close_container(&rMap, &interfaces);
 468                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing interfaces.");
 469
 470                 //rel
 471                 if(rsrc->rel)
 472                 {
 473                     cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_REL_NAME,
 474                             strlen(OIC_JSON_REL_NAME));
 475                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding REL Name Tag.");
 476                     cborEncoderResult = cbor_encode_text_string(&rMap, rsrc->rel, strlen(rsrc->rel));
 477                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding REL Value.");
 478                 }
 479
 480                 cborEncoderResult = cbor_encoder_close_container(&resources, &rMap);
 481                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Resource Map.");
 482             }
 483             cborEncoderResult = cbor_encoder_close_container(&oicSecAclMap, &resources);
 484             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Resource Name Array.");
 485         }
 486
 487         // Permissions -- Mandatory
 488         cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_PERMISSION_NAME,
 489             strlen(OIC_JSON_PERMISSION_NAME));
 490         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Permission Name Tag.");
 491         cborEncoderResult = cbor_encode_int(&oicSecAclMap, ace->permission);
 492         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Permission Name Value.");
 493
 494         // TODO: Need to verfication for validity
 495         // Validity(Time-interval) -- Not Mandatory
 496         if(ace->validities)
 497         {
 498             size_t validityLen = 0;
 499             validityElts = NULL;
 500             LL_FOREACH(ace->validities, validityElts)
 501             {
 502                 validityLen++;
 503             }
 504
 505             CborEncoder validities;
 506             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_VALIDITY_NAME,
 507                 strlen(OIC_JSON_VALIDITY_NAME));
 508             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validity Tag.");
 509             cborEncoderResult = cbor_encoder_create_array(&oicSecAclMap, &validities, validityLen);
 510             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validities Array.");
 511
 512             //How to add the value w/o "title" using tinycobr...? :(
 513
 514             validityElts = NULL;
 515             LL_FOREACH(ace->validities, validityElts)
 516             {
 517                  CborEncoder validity;
 518                  size_t validitySize = 0;
 519                  if(validityElts->period)
 520                 {
 521                     validitySize++;
 522                 }
 523                 if(validityElts->recurrences)
 524                 {
 525                     validitySize++;
 526                 }
 527
 528                 cborEncoderResult = cbor_encoder_create_array(&validities, &validity, validitySize);
 529                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validity Array.");
 530
 531                 // Period
 532                 if (validityElts->period)
 533                 {
 534                     cborEncoderResult = cbor_encode_text_string(&validity, validityElts->period,
 535                         strlen(validityElts->period));
 536                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Period Value.");
 537                 }
 538
 539                 // Recurrence
 540                 if (validityElts->recurrences)
 541                 {
 542                     CborEncoder recurrences;
 543                     cborEncoderResult = cbor_encoder_create_array(&validity, &recurrences, validityElts->recurrenceLen);
 544                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Recurrence Array.");
 545
 546                     for (size_t i = 0; i < validityElts->recurrenceLen; i++)
 547                     {
 548                         cborEncoderResult = cbor_encode_text_string(&recurrences, validityElts->recurrences[i],
 549                             strlen(validityElts->recurrences[i]));
 550                         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Recurrence Array Value.");
 551                     }
 552                     cborEncoderResult = cbor_encoder_close_container(&validity, &recurrences);
 553                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Recurrence Array");
 554                 }
 555
 556                 cborEncoderResult = cbor_encoder_close_container(&validities, &validity);
 557                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Validity Array.");
 558             }
 559
 560             cborEncoderResult = cbor_encoder_close_container(&oicSecAclMap, &validities);
 561             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Validities Array.");
 562         }
 563
 564 #ifdef _ENABLE_MULTIPLE_OWNER_
 565         // Eownerid -- Not Mandatory
 566         if(ace->eownerID)
 567         {
 568             char *eowner = NULL;
 569             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_EOWNERID_NAME,
 570                 strlen(OIC_JSON_EOWNERID_NAME));
 571             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding eownerId Name Tag.");
 572             ret = ConvertUuidToStr(ace->eownerID, &eowner);
 573             VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 574             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, eowner, strlen(eowner));
 575             OICFree(eowner);
 576             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding eownerId Value.");
 577         }
 578 #endif //_ENABLE_MULTIPLE_OWNER_
 579
 580         cborEncoderResult = cbor_encoder_close_container(&acesArray, &oicSecAclMap);
 581         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACES Map.");
 582     }
 583
 584     // Close ACES Array
 585     cborEncoderResult = cbor_encoder_close_container(&aclListMap, &acesArray);
 586     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACES Array.");
 587
 588     // Close ACLIST Map
 589     cborEncoderResult = cbor_encoder_close_container(&aclMap, &aclListMap);
 590     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACLIST Map.");
 591
 592     // Rownerid
 593     {
 594         char *rowner = NULL;
 595         cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_ROWNERID_NAME,
 596             strlen(OIC_JSON_ROWNERID_NAME));
 597         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding rownerid Name.");
 598         ret = ConvertUuidToStr(&secAcl->rownerID, &rowner);
 599         VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 600         cborEncoderResult = cbor_encode_text_string(&aclMap, rowner, strlen(rowner));
 601         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding rownerid Value.");
 602         OICFree(rowner);
 603     }
 604
 605     //RT -- Mandatory
 606     CborEncoder rtArray;
 607     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_RT_NAME,
 608             strlen(OIC_JSON_RT_NAME));
 609     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Name Tag.");
 610     cborEncoderResult = cbor_encoder_create_array(&aclMap, &rtArray, 1);
 611     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Value.");
 612     for (size_t i = 0; i < 1; i++)
 613     {
 614         cborEncoderResult = cbor_encode_text_string(&rtArray, OIC_RSRC_TYPE_SEC_ACL,
 615                 strlen(OIC_RSRC_TYPE_SEC_ACL));
 616         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding RT Value.");
 617     }
 618     cborEncoderResult = cbor_encoder_close_container(&aclMap, &rtArray);
 619     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing RT.");
 620
 621     //IF-- Mandatory
 622     CborEncoder ifArray;
 623     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_IF_NAME,
 624              strlen(OIC_JSON_IF_NAME));
 625     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Name Tag.");
 626     cborEncoderResult = cbor_encoder_create_array(&aclMap, &ifArray, 1);
 627     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Value.");
 628     for (size_t i = 0; i < 1; i++)
 629     {
 630         cborEncoderResult = cbor_encode_text_string(&ifArray, OC_RSRVD_INTERFACE_DEFAULT,
 631                 strlen(OC_RSRVD_INTERFACE_DEFAULT));
 632         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding IF Value.");
 633     }
 634     cborEncoderResult = cbor_encoder_close_container(&aclMap, &ifArray);
 635     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing IF.");
 636
 637     // Close ACL Map
 638     cborEncoderResult = cbor_encoder_close_container(&encoder, &aclMap);
 639     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACL Map.");
 640
 641     if (CborNoError == cborEncoderResult)
 642     {
 643         OIC_LOG(DEBUG, TAG, "AclToCBORPayload Successed");
 644         *size = cbor_encoder_get_buffer_size(&encoder, outPayload);
 645         *payload = outPayload;
 646         ret = OC_STACK_OK;
 647     }
 648 exit:
 649     if (CborErrorOutOfMemory == cborEncoderResult)
 650     {
 651         OIC_LOG(DEBUG, TAG, "AclToCBORPayload:CborErrorOutOfMemory : retry with more memory");
 652
 653         // reallocate and try again!
 654         OICFree(outPayload);
 655         // Since the allocated initial memory failed, double the memory.
 656         cborLen += cbor_encoder_get_buffer_size(&encoder, encoder.end);
 657         cborEncoderResult = CborNoError;
 658         ret = AclToCBORPayload(secAcl, payload, &cborLen);
 659         *size = cborLen;
 660     }
 661     else if (cborEncoderResult != CborNoError)
 662     {
 663         OIC_LOG(ERROR, TAG, "Failed to AclToCBORPayload");
 664         OICFree(outPayload);
 665         outPayload = NULL;
 666         *size = 0;
 667         *payload = NULL;
 668         ret = OC_STACK_ERROR;
 669     }
 670
 671     return ret;
 672 }
 673
 674 // This function converts CBOR format to ACL data.
 675 // Caller needs to invoke 'free' when done using
 676 // It parses { "aclist" : [ { ... } ] } instead of { "aclist" : { "aces" : [ ] } }
 677 OicSecAcl_t* CBORPayloadToAcl2(const uint8_t *cborPayload, const size_t size)
 678 {
 679     if (NULL == cborPayload || 0 == size)
 680     {
 681         return NULL;
 682     }
 683     OCStackResult ret = OC_STACK_ERROR;
 684     CborValue aclCbor = { .parser = NULL };
 685     CborParser parser = { .end = NULL };
 686     CborError cborFindResult = CborNoError;
 687     cbor_parser_init(cborPayload, size, 0, &parser, &aclCbor);
 688
 689     OicSecAcl_t *acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
 690
 691     // Enter ACL Map
 692     CborValue aclMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 693     cborFindResult = cbor_value_enter_container(&aclCbor, &aclMap);
 694     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACL Map.");
 695
 696     while (cbor_value_is_valid(&aclMap))
 697     {
 698         char* tagName = NULL;
 699         size_t len = 0;
 700         CborType type = cbor_value_get_type(&aclMap);
 701         if (type == CborTextStringType)
 702         {
 703             cborFindResult = cbor_value_dup_text_string(&aclMap, &tagName, &len, NULL);
 704             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACL Map.");
 705             cborFindResult = cbor_value_advance(&aclMap);
 706             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACL Map.");
 707         }
 708         if(tagName)
 709         {
 710             if (strcmp(tagName, OIC_JSON_ACLIST_NAME)  == 0)
 711             {
 712                 // Enter ACES Array
 713                 CborValue acesArray = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 714                 cborFindResult = cbor_value_enter_container(&aclMap, &acesArray);
 715                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACES Array.");
 716
 717                 int acesCount = 0;
 718                 while (cbor_value_is_valid(&acesArray))
 719                 {
 720                     acesCount++;
 721                     CborValue aceMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 722                     cborFindResult = cbor_value_enter_container(&acesArray, &aceMap);
 723                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACE Map.");
 724
 725                     OicSecAce_t *ace = NULL;
 726                     ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
 727                     VERIFY_NON_NULL(TAG, ace, ERROR);
 728                     LL_APPEND(acl->aces, ace);
 729
 730                     VERIFY_NON_NULL(TAG, acl, ERROR);
 731
 732                     while (cbor_value_is_valid(&aceMap))
 733                     {
 734                         char* name = NULL;
 735                         size_t len = 0;
 736                         CborType type = cbor_value_get_type(&aceMap);
 737                         if (type == CborTextStringType)
 738                         {
 739                             cborFindResult = cbor_value_dup_text_string(&aceMap, &name, &len, NULL);
 740                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACE Map.");
 741                             cborFindResult = cbor_value_advance(&aceMap);
 742                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACE Map.");
 743                         }
 744                         if (name)
 745                         {
 746                             // Subject -- Mandatory
 747                             if (strcmp(name, OIC_JSON_SUBJECTID_NAME)  == 0)
 748                             {
 749                                 char *subject = NULL;
 750                                 cborFindResult = cbor_value_dup_text_string(&aceMap, &subject, &len, NULL);
 751                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding subject Value.");
 752                                 if(strcmp(subject, WILDCARD_RESOURCE_URI) == 0)
 753                                 {
 754                                     ace->subjectuuid.id[0] = '*';
 755                                 }
 756                                 else
 757                                 {
 758                                     OIC_LOG_V(DEBUG, TAG, "Converting subjectuuid = %s to uuid...", subject);
 759                                     ret = ConvertStrToUuid(subject, &ace->subjectuuid);
 760                                     VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 761                                 }
 762                                 OICFree(subject);
 763                             }
 764
 765                             // Resources -- Mandatory
 766                             if (strcmp(name, OIC_JSON_RESOURCES_NAME) == 0)
 767                             {
 768                                 CborValue resources = { .parser = NULL };
 769                                 cborFindResult = cbor_value_enter_container(&aceMap, &resources);
 770                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering a Resource Array.");
 771
 772                                 while (cbor_value_is_valid(&resources))
 773                                 {
 774                                     // rMap
 775                                     CborValue rMap = { .parser = NULL  };
 776                                     cborFindResult = cbor_value_enter_container(&resources, &rMap);
 777                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering Resource Map");
 778
 779                                     OicSecRsrc_t* rsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
 780                                     VERIFY_NON_NULL(TAG, rsrc, ERROR);
 781                                     LL_APPEND(ace->resources, rsrc);
 782
 783                                     while(cbor_value_is_valid(&rMap))
 784                                     {
 785                                         char *rMapName = NULL;
 786                                         size_t rMapNameLen = 0;
 787                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rMapName, &rMapNameLen, NULL);
 788                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Name Tag.");
 789                                         cborFindResult = cbor_value_advance(&rMap);
 790                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Value.");
 791
 792                                         // "href"
 793                                         if (0 == strcmp(OIC_JSON_HREF_NAME, rMapName))
 794                                         {
 795                                             cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->href, &len, NULL);
 796                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Href Value.");
 797                                         }
 798
 799                                         // "rt"
 800                                         if (0 == strcmp(OIC_JSON_RT_NAME, rMapName) && cbor_value_is_array(&rMap))
 801                                         {
 802                                             cbor_value_get_array_length(&rMap, &rsrc->typeLen);
 803                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RT array length.");
 804                                             VERIFY_SUCCESS(TAG, (0 != rsrc->typeLen), ERROR);
 805
 806                                             rsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
 807                                             VERIFY_NON_NULL(TAG, rsrc->types, ERROR);
 808
 809                                             CborValue resourceTypes;
 810                                             cborFindResult = cbor_value_enter_container(&rMap, &resourceTypes);
 811                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering RT Array.");
 812
 813                                             for(size_t i = 0; cbor_value_is_valid(&resourceTypes) && cbor_value_is_text_string(&resourceTypes); i++)
 814                                             {
 815                                                 size_t readLen = 0;
 816                                                 cborFindResult = cbor_value_dup_text_string(&resourceTypes, &(rsrc->types[i]), &readLen, NULL);
 817                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding resource type.");
 818                                                 cborFindResult = cbor_value_advance(&resourceTypes);
 819                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing resource type.");
 820                                             }
 821                                         }
 822
 823                                         // "if"
 824                                         if (0 == strcmp(OIC_JSON_IF_NAME, rMapName) && cbor_value_is_array(&rMap))
 825                                         {
 826                                             cbor_value_get_array_length(&rMap, &rsrc->interfaceLen);
 827                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF array length.");
 828                                             VERIFY_SUCCESS(TAG, (0 != rsrc->interfaceLen), ERROR);
 829
 830                                             rsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
 831                                             VERIFY_NON_NULL(TAG, rsrc->interfaces, ERROR);
 832
 833                                             CborValue interfaces;
 834                                             cborFindResult = cbor_value_enter_container(&rMap, &interfaces);
 835                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering IF Array.");
 836
 837                                             for(size_t i = 0; cbor_value_is_valid(&interfaces) && cbor_value_is_text_string(&interfaces); i++)
 838                                             {
 839                                                 size_t readLen = 0;
 840                                                 cborFindResult = cbor_value_dup_text_string(&interfaces, &(rsrc->interfaces[i]), &readLen, NULL);
 841                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF type.");
 842                                                 cborFindResult = cbor_value_advance(&interfaces);
 843                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing IF type.");
 844                                             }
 845                                         }
 846
 847                                         // "rel"
 848                                         if (0 == strcmp(OIC_JSON_REL_NAME, rMapName))
 849                                         {
 850                                             cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->rel, &len, NULL);
 851                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding REL Value.");
 852                                         }
 853
 854                                         if (cbor_value_is_valid(&rMap))
 855                                         {
 856                                             cborFindResult = cbor_value_advance(&rMap);
 857                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Rlist Map.");
 858                                         }
 859                                         OICFree(rMapName);
 860                                     }
 861
 862                                     if (cbor_value_is_valid(&resources))
 863                                     {
 864                                         cborFindResult = cbor_value_advance(&resources);
 865                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Resource Array.");
 866                                     }
 867                                 }
 868                             }
 869
 870                             // Permissions -- Mandatory
 871                             if (strcmp(name, OIC_JSON_PERMISSION_NAME) == 0)
 872                             {
 873                                 uint64_t tmp64;
 874                                 cborFindResult = cbor_value_get_uint64(&aceMap, &tmp64);
 875                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a PERM Value.");
 876                                 ace->permission = (uint16_t)tmp64;
 877                             }
 878
 879                             // TODO: Need to verfication for validity
 880                             // Validity -- Not mandatory
 881                             if(strcmp(name, OIC_JSON_VALIDITY_NAME) == 0)
 882                             {
 883                                 CborValue validitiesMap = {.parser = NULL};
 884                                 size_t validitySize = 0;
 885
 886                                 cborFindResult = cbor_value_get_array_length(&aceMap, &validitySize);
 887                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Validity Array Length.");
 888
 889                                 cborFindResult = cbor_value_enter_container(&aceMap, &validitiesMap);
 890                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Array Map.");
 891
 892                                 while(cbor_value_is_valid(&validitiesMap))
 893                                 {
 894                                     OicSecValidity_t* validity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
 895                                     VERIFY_NON_NULL(TAG, validity, ERROR);
 896                                     LL_APPEND(ace->validities, validity);
 897
 898                                     CborValue validityMap  = {.parser = NULL};
 899                                     //period (string)
 900                                     cborFindResult = cbor_value_enter_container(&validitiesMap, &validityMap);
 901                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Map.");
 902
 903                                     size_t len = 0;
 904                                     cborFindResult =cbor_value_dup_text_string(&validityMap, &validity->period, &len, NULL);
 905                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Period value.");
 906
 907                                     //recurrence (string array)
 908                                     CborValue recurrenceMap  = {.parser = NULL};
 909                                     cborFindResult = cbor_value_enter_container(&validityMap, &recurrenceMap);
 910                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence array.");
 911
 912                                     cborFindResult = cbor_value_get_array_length(&recurrenceMap, &validity->recurrenceLen);
 913                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Adding Recurrence Array.");
 914
 915                                     validity->recurrences = (char**)OICCalloc(validity->recurrenceLen, sizeof(char*));
 916                                     VERIFY_NON_NULL(TAG, validity->recurrences, ERROR);
 917
 918                                     for(size_t i = 0; cbor_value_is_text_string(&recurrenceMap) && i < validity->recurrenceLen; i++)
 919                                     {
 920                                         cborFindResult = cbor_value_dup_text_string(&recurrenceMap, &validity->recurrences[i], &len, NULL);
 921                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence Value.");
 922
 923                                         cborFindResult = cbor_value_advance(&recurrenceMap);
 924                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a recurrences Array.");
 925                                     }
 926
 927                                     cborFindResult = cbor_value_advance(&validitiesMap);
 928                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a validities Array.");
 929                                 }
 930                             }
 931                             OICFree(name);
 932                         }
 933
 934                         if (type != CborMapType && cbor_value_is_valid(&aceMap))
 935                         {
 936                             cborFindResult = cbor_value_advance(&aceMap);
 937                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing the Array.");
 938                         }
 939                     }
 940
 941                     if (cbor_value_is_valid(&acesArray))
 942                     {
 943                         cborFindResult = cbor_value_advance(&acesArray);
 944                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Array.");
 945                     }
 946                 }
 947             }
 948
 949             //rownerID -- Mandatory
 950             if (strcmp(tagName, OIC_JSON_ROWNERID_NAME)  == 0)
 951             {
 952                 char *stRowner = NULL;
 953                 cborFindResult = cbor_value_dup_text_string(&aclMap, &stRowner, &len, NULL);
 954                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Rownerid Value.");
 955                 OIC_LOG_V(DEBUG, TAG, "Converting rownerid = %s to uuid...", stRowner);
 956                 ret = ConvertStrToUuid(stRowner, &acl->rownerID);
 957                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
 958                 OICFree(stRowner);
 959             }
 960             OICFree(tagName);
 961         }
 962         if (cbor_value_is_valid(&aclMap))
 963         {
 964             cborFindResult = cbor_value_advance(&aclMap);
 965             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Map.");
 966         }
 967     }
 968
 969 exit:
 970     if (cborFindResult != CborNoError)
 971     {
 972         OIC_LOG(ERROR, TAG, "Failed to CBORPayloadToAcl");
 973         DeleteACLList(acl);
 974         acl = NULL;
 975     }
 976
 977     return acl;
 978 }
 979
 980 // This function converts CBOR format to ACL data.
 981 // Caller needs to invoke 'free' when done using
 982 // note: This function is used in unit test hence not declared static,
 983 OicSecAcl_t* CBORPayloadToAcl(const uint8_t *cborPayload, const size_t size)
 984 {
 985     if (NULL == cborPayload || 0 == size)
 986     {
 987         return NULL;
 988     }
 989     OCStackResult ret = OC_STACK_ERROR;
 990     CborValue aclMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
 991     CborValue aclCbor = { .parser = NULL };
 992     CborParser parser = { .end = NULL };
 993     CborError cborFindResult = CborNoError;
 994
 995     cbor_parser_init(cborPayload, size, 0, &parser, &aclCbor);
 996
 997     OicSecAcl_t *acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
 998     VERIFY_NON_NULL(TAG, acl, ERROR);
 999
1000     // Enter ACL Map
1001     cborFindResult = cbor_value_enter_container(&aclCbor, &aclMap);
1002     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACL Map.");
1003
1004     while (cbor_value_is_valid(&aclMap))
1005     {
1006         char* tagName = NULL;
1007         size_t len = 0;
1008         CborType type = cbor_value_get_type(&aclMap);
1009         if (type == CborTextStringType)
1010         {
1011             cborFindResult = cbor_value_dup_text_string(&aclMap, &tagName, &len, NULL);
1012             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACL Map.");
1013             cborFindResult = cbor_value_advance(&aclMap);
1014             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACL Map.");
1015         }
1016         if(tagName)
1017         {
1018             if (strcmp(tagName, OIC_JSON_ACLIST_NAME)  == 0)
1019             {
1020                 // Enter ACLIST Map
1021                 CborValue aclistMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1022                 cborFindResult = cbor_value_enter_container(&aclMap, &aclistMap);
1023                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACLIST Map.");
1024
1025                 while (cbor_value_is_valid(&aclistMap))
1026                 {
1027                     char* acName = NULL;
1028                     size_t readLen = 0;
1029                     CborType acType = cbor_value_get_type(&aclistMap);
1030                     if (acType == CborTextStringType)
1031                     {
1032                         cborFindResult = cbor_value_dup_text_string(&aclistMap, &acName, &readLen, NULL);
1033                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACLIST Map.");
1034                         cborFindResult = cbor_value_advance(&aclistMap);
1035                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACLIST Map.");
1036                     }
1037
1038                     if(acName)
1039                     {
1040                         if (strcmp(acName, OIC_JSON_ACES_NAME)  == 0)
1041                         {
1042                             // Enter ACES Array
1043                             CborValue acesArray = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1044                             cborFindResult = cbor_value_enter_container(&aclistMap, &acesArray);
1045                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACES Array.");
1046
1047                             int acesCount = 0;
1048                             while (cbor_value_is_valid(&acesArray))
1049                             {
1050                                 acesCount++;
1051                                 CborValue aceMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1052                                 cborFindResult = cbor_value_enter_container(&acesArray, &aceMap);
1053                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACE Map.");
1054
1055                                 OicSecAce_t *ace = NULL;
1056                                 ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
1057                                 VERIFY_NON_NULL(TAG, ace, ERROR);
1058                                 LL_APPEND(acl->aces, ace);
1059
1060                                 while (cbor_value_is_valid(&aceMap))
1061                                 {
1062                                     char* name = NULL;
1063                                     size_t len = 0;
1064                                     CborType type = cbor_value_get_type(&aceMap);
1065                                     if (type == CborTextStringType)
1066                                     {
1067                                         cborFindResult = cbor_value_dup_text_string(&aceMap, &name, &len, NULL);
1068                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACE Map.");
1069                                         cborFindResult = cbor_value_advance(&aceMap);
1070                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACE Map.");
1071                                     }
1072                                     if (name)
1073                                     {
1074                                         // Subject -- Mandatory
1075                                         if (strcmp(name, OIC_JSON_SUBJECTID_NAME)  == 0)
1076                                         {
1077                                             char *subject = NULL;
1078                                             cborFindResult = cbor_value_dup_text_string(&aceMap, &subject, &len, NULL);
1079                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding subject Value.");
1080                                             if(strcmp(subject, WILDCARD_RESOURCE_URI) == 0)
1081                                             {
1082                                                 ace->subjectuuid.id[0] = '*';
1083                                             }
1084                                             else
1085                                             {
1086                                                 ret = ConvertStrToUuid(subject, &ace->subjectuuid);
1087                                                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
1088                                             }
1089                                             OICFree(subject);
1090                                         }
1091
1092                                         // Resources -- Mandatory
1093                                         if (strcmp(name, OIC_JSON_RESOURCES_NAME) == 0)
1094                                         {
1095                                             CborValue resources = { .parser = NULL };
1096                                             cborFindResult = cbor_value_enter_container(&aceMap, &resources);
1097                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering a Resource Array.");
1098
1099                                             while (cbor_value_is_valid(&resources))
1100                                             {
1101                                                 // rMap
1102                                                 CborValue rMap = { .parser = NULL  };
1103                                                 cborFindResult = cbor_value_enter_container(&resources, &rMap);
1104                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering Resource Map");
1105
1106                                                 OicSecRsrc_t* rsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
1107                                                 VERIFY_NON_NULL(TAG, rsrc, ERROR);
1108                                                 LL_APPEND(ace->resources, rsrc);
1109
1110                                                 while(cbor_value_is_valid(&rMap))
1111                                                 {
1112                                                     char *rMapName = NULL;
1113                                                     size_t rMapNameLen = 0;
1114                                                     cborFindResult = cbor_value_dup_text_string(&rMap, &rMapName, &rMapNameLen, NULL);
1115                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Name Tag.");
1116                                                     cborFindResult = cbor_value_advance(&rMap);
1117                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Value.");
1118
1119                                                     // "href"
1120                                                     if (0 == strcmp(OIC_JSON_HREF_NAME, rMapName))
1121                                                     {
1122                                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->href, &len, NULL);
1123                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Href Value.");
1124                                                     }
1125
1126                                                     // "rt"
1127                                                     if (0 == strcmp(OIC_JSON_RT_NAME, rMapName) && cbor_value_is_array(&rMap))
1128                                                     {
1129                                                         cbor_value_get_array_length(&rMap, &rsrc->typeLen);
1130                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RT array length.");
1131                                                         VERIFY_SUCCESS(TAG, (0 != rsrc->typeLen), ERROR);
1132
1133                                                         rsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
1134                                                         VERIFY_NON_NULL(TAG, rsrc->types, ERROR);
1135
1136                                                         CborValue resourceTypes;
1137                                                         cborFindResult = cbor_value_enter_container(&rMap, &resourceTypes);
1138                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering RT Array.");
1139
1140                                                         for(size_t i = 0; cbor_value_is_valid(&resourceTypes) && cbor_value_is_text_string(&resourceTypes); i++)
1141                                                         {
1142                                                             cborFindResult = cbor_value_dup_text_string(&resourceTypes, &(rsrc->types[i]), &readLen, NULL);
1143                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding resource type.");
1144                                                             cborFindResult = cbor_value_advance(&resourceTypes);
1145                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing resource type.");
1146                                                         }
1147                                                     }
1148
1149                                                     // "if"
1150                                                     if (0 == strcmp(OIC_JSON_IF_NAME, rMapName) && cbor_value_is_array(&rMap))
1151                                                     {
1152                                                         cbor_value_get_array_length(&rMap, &rsrc->interfaceLen);
1153                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF array length.");
1154                                                         VERIFY_SUCCESS(TAG, (0 != rsrc->interfaceLen), ERROR);
1155
1156                                                         rsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
1157                                                         VERIFY_NON_NULL(TAG, rsrc->interfaces, ERROR);
1158
1159                                                         CborValue interfaces;
1160                                                         cborFindResult = cbor_value_enter_container(&rMap, &interfaces);
1161                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering IF Array.");
1162
1163                                                         for(size_t i = 0; cbor_value_is_valid(&interfaces) && cbor_value_is_text_string(&interfaces); i++)
1164                                                         {
1165                                                             cborFindResult = cbor_value_dup_text_string(&interfaces, &(rsrc->interfaces[i]), &readLen, NULL);
1166                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF type.");
1167                                                             cborFindResult = cbor_value_advance(&interfaces);
1168                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing IF type.");
1169                                                         }
1170                                                     }
1171
1172                                                     // "rel"
1173                                                     if (0 == strcmp(OIC_JSON_REL_NAME, rMapName))
1174                                                     {
1175                                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->rel, &len, NULL);
1176                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding REL Value.");
1177                                                     }
1178
1179                                                     if (cbor_value_is_valid(&rMap))
1180                                                     {
1181                                                         cborFindResult = cbor_value_advance(&rMap);
1182                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Rlist Map.");
1183                                                     }
1184                                                     OICFree(rMapName);
1185                                                 }
1186
1187                                                 if (cbor_value_is_valid(&resources))
1188                                                 {
1189                                                     cborFindResult = cbor_value_advance(&resources);
1190                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Resource Array.");
1191                                                 }
1192                                             }
1193                                         }
1194
1195                                         // Permissions -- Mandatory
1196                                         if (strcmp(name, OIC_JSON_PERMISSION_NAME) == 0)
1197                                         {
1198                                             uint64_t tmp64;
1199                                             cborFindResult = cbor_value_get_uint64(&aceMap, &tmp64);
1200                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a PERM Value.");
1201                                             ace->permission = (uint16_t)tmp64;
1202                                         }
1203
1204                                         // TODO: Need to verfication for validity
1205                                         // Validity -- Not mandatory
1206                                         if(strcmp(name, OIC_JSON_VALIDITY_NAME) == 0)
1207                                         {
1208                                             CborValue validitiesMap = {.parser = NULL};
1209                                             size_t validitySize = 0;
1210
1211                                             cborFindResult = cbor_value_get_array_length(&aceMap, &validitySize);
1212                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Validity Array Length.");
1213
1214                                             cborFindResult = cbor_value_enter_container(&aceMap, &validitiesMap);
1215                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Array Map.");
1216
1217                                             while(cbor_value_is_valid(&validitiesMap))
1218                                             {
1219                                                 OicSecValidity_t* validity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
1220                                                 VERIFY_NON_NULL(TAG, validity, ERROR);
1221                                                 LL_APPEND(ace->validities, validity);
1222
1223                                                 CborValue validityMap  = {.parser = NULL};
1224                                                 //period (string)
1225                                                 cborFindResult = cbor_value_enter_container(&validitiesMap, &validityMap);
1226                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Map.");
1227
1228                                                 size_t len = 0;
1229                                                 cborFindResult =cbor_value_dup_text_string(&validityMap, &validity->period, &len, NULL);
1230                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Period value.");
1231
1232                                                 //recurrence (string array)
1233                                                 CborValue recurrenceMap  = {.parser = NULL};
1234                                                 cborFindResult = cbor_value_enter_container(&validityMap, &recurrenceMap);
1235                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence array.");
1236
1237                                                 cborFindResult = cbor_value_get_array_length(&recurrenceMap, &validity->recurrenceLen);
1238                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Adding Recurrence Array.");
1239
1240                                                 validity->recurrences = (char**)OICCalloc(validity->recurrenceLen, sizeof(char*));
1241                                                 VERIFY_NON_NULL(TAG, validity->recurrences, ERROR);
1242
1243                                                 for(size_t i = 0; cbor_value_is_text_string(&recurrenceMap) && i < validity->recurrenceLen; i++)
1244                                                 {
1245                                                     cborFindResult = cbor_value_dup_text_string(&recurrenceMap, &validity->recurrences[i], &len, NULL);
1246                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence Value.");
1247
1248                                                     cborFindResult = cbor_value_advance(&recurrenceMap);
1249                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a recurrences Array.");
1250                                                 }
1251
1252                                                 cborFindResult = cbor_value_advance(&validitiesMap);
1253                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a validities Array.");
1254                                             }
1255                                         }
1256
1257 #ifdef _ENABLE_MULTIPLE_OWNER_
1258                                         // eowner uuid -- Not Mandatory
1259                                         if (strcmp(name, OIC_JSON_EOWNERID_NAME)  == 0)
1260                                         {
1261                                             char *eowner = NULL;
1262                                             cborFindResult = cbor_value_dup_text_string(&aceMap, &eowner, &len, NULL);
1263                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding eownerId Value.");
1264                                             if(NULL == ace->eownerID)
1265                                             {
1266                                                 ace->eownerID = (OicUuid_t*)OICCalloc(1, sizeof(OicUuid_t));
1267                                                 VERIFY_NON_NULL(TAG, ace->eownerID, ERROR);
1268                                             }
1269                                             ret = ConvertStrToUuid(eowner, ace->eownerID);
1270                                             OICFree(eowner);
1271                                             VERIFY_SUCCESS(TAG, OC_STACK_OK == ret , ERROR);
1272                                         }
1273 #endif //_ENABLE_MULTIPLE_OWNER_
1274                                         OICFree(name);
1275                                     }
1276
1277                                     if (type != CborMapType && cbor_value_is_valid(&aceMap))
1278                                     {
1279                                         cborFindResult = cbor_value_advance(&aceMap);
1280                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing the Array.");
1281                                     }
1282                                 }
1283
1284                                 if (cbor_value_is_valid(&acesArray))
1285                                 {
1286                                     cborFindResult = cbor_value_advance(&acesArray);
1287                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Array.");
1288                                 }
1289                             }
1290                         }
1291                         OICFree(acName);
1292                     }
1293
1294                     if (cbor_value_is_valid(&aclistMap))
1295                     {
1296                         cborFindResult = cbor_value_advance(&aclistMap);
1297                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACLIST Map.");
1298                     }
1299                 }
1300             }
1301
1302             //rownerID -- Mandatory
1303             if (strcmp(tagName, OIC_JSON_ROWNERID_NAME)  == 0)
1304             {
1305                 char *stRowner = NULL;
1306                 cborFindResult = cbor_value_dup_text_string(&aclMap, &stRowner, &len, NULL);
1307                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Rownerid Value.");
1308                 ret = ConvertStrToUuid(stRowner, &acl->rownerID);
1309                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
1310                 OICFree(stRowner);
1311             }
1312             else if (NULL != gAcl)
1313             {
1314                 memcpy(&(acl->rownerID), &(gAcl->rownerID), sizeof(OicUuid_t));
1315             }
1316             OICFree(tagName);
1317         }
1318         if (cbor_value_is_valid(&aclMap))
1319         {
1320             cborFindResult = cbor_value_advance(&aclMap);
1321             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Map.");
1322         }
1323     }
1324
1325 exit:
1326     if (cborFindResult != CborNoError)
1327     {
1328         OIC_LOG(ERROR, TAG, "Failed to CBORPayloadToAcl");
1329         DeleteACLList(acl);
1330         acl = NULL;
1331     }
1332
1333     return acl;
1334 }
1335
1336 #ifdef _ENABLE_MULTIPLE_OWNER_
1337 bool IsValidAclAccessForSubOwner(const OicUuid_t* uuid, const uint8_t *cborPayload, const size_t size)
1338 {
1339     bool retValue = false;
1340     OicSecAcl_t* acl = NULL;
1341
1342     VERIFY_NON_NULL(TAG, uuid, ERROR);
1343     VERIFY_NON_NULL(TAG, cborPayload, ERROR);
1344     VERIFY_SUCCESS(TAG, 0 != size, ERROR);
1345
1346     acl = CBORPayloadToAcl(cborPayload, size);
1347     VERIFY_NON_NULL(TAG, acl, ERROR);
1348
1349     OicSecAce_t* ace = NULL;
1350     OicSecAce_t* tempAce = NULL;
1351     LL_FOREACH_SAFE(acl->aces, ace, tempAce)
1352     {
1353         OicSecRsrc_t* rsrc = NULL;
1354         OicSecRsrc_t* tempRsrc = NULL;
1355
1356         VERIFY_NON_NULL(TAG, ace->eownerID, ERROR);
1357         VERIFY_SUCCESS(TAG, memcmp(ace->eownerID->id, uuid->id, sizeof(uuid->id)) == 0, ERROR);
1358
1359         LL_FOREACH_SAFE(ace->resources, rsrc, tempRsrc)
1360         {
1361             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_DOXM) != 0, ERROR);
1362             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_CRED) != 0, ERROR);
1363             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_ACL) != 0, ERROR);
1364             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_PSTAT) != 0, ERROR);
1365             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_CRL) != 0, ERROR);
1366         }
1367     }
1368
1369     retValue = true;
1370
1371 exit:
1372     DeleteACLList(acl);
1373
1374     return retValue;
1375 }
1376 #endif //_ENABLE_MULTIPLE_OWNER_
1377
1378 /**
1379  * This method removes ACE for the subject and resource from the ACL
1380  *
1381  * @param subject of the ACE
1382  * @param resource of the ACE
1383  *
1384  * @return
1385  *     ::OC_STACK_RESOURCE_DELETED on success
1386  *     ::OC_STACK_NO_RESOURCE on failure to find the appropriate ACE
1387  *     ::OC_STACK_INVALID_PARAM on invalid parameter
1388  */
1389 OCStackResult RemoveACE(const OicUuid_t * subject, const char * resource)
1390 {
1391     OIC_LOG(DEBUG, TAG, "IN RemoveACE");
1392
1393     OicSecAce_t *ace = NULL;
1394     OicSecAce_t *tempAce = NULL;
1395     bool deleteFlag = false;
1396     OCStackResult ret = OC_STACK_NO_RESOURCE;
1397
1398     if (memcmp(subject->id, &WILDCARD_SUBJECT_ID, sizeof(subject->id)) == 0)
1399     {
1400         OIC_LOG_V(ERROR, TAG, "%s received invalid parameter", __func__ );
1401         return  OC_STACK_INVALID_PARAM;
1402     }
1403
1404     //If resource is NULL then delete all the ACE for the subject.
1405     if (NULL == resource || resource[0] == '\0')
1406     {
1407         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
1408         {
1409             if (memcmp(ace->subjectuuid.id, subject->id, sizeof(subject->id)) == 0)
1410             {
1411                 LL_DELETE(gAcl->aces, ace);
1412                 FreeACE(ace);
1413                 deleteFlag = true;
1414             }
1415         }
1416     }
1417     else
1418     {
1419         //Looping through ACL to find the right ACE to delete. If the required resource is the only
1420         //resource in the ACE for the subject then delete the whole ACE. If there are more resources
1421         //than the required resource in the ACE, for the subject then just delete the resource from
1422         //the resource array
1423         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
1424         {
1425             if (memcmp(ace->subjectuuid.id, subject->id, sizeof(subject->id)) == 0)
1426             {
1427                 OicSecRsrc_t* rsrc = NULL;
1428                 OicSecRsrc_t* tempRsrc = NULL;
1429                 LL_FOREACH_SAFE(ace->resources, rsrc, tempRsrc)
1430                 {
1431                     if(strcmp(rsrc->href, resource) == 0)
1432                     {
1433                         LL_DELETE(ace->resources, rsrc);
1434                         FreeRsrc(rsrc);
1435                         deleteFlag = true;
1436                     }
1437                 }
1438
1439                 //If resource list is empty
1440                 if(NULL == ace->resources && true == deleteFlag)
1441                 {
1442                     //Remove the ACE from ACL
1443                     LL_DELETE(gAcl->aces, ace);
1444                     FreeACE(ace);
1445                 }
1446             }
1447         }
1448     }
1449
1450     if (deleteFlag)
1451     {
1452         // In case of unit test do not update persistant storage.
1453         if (memcmp(subject->id, &WILDCARD_SUBJECT_B64_ID, sizeof(subject->id)) == 0)
1454         {
1455             ret = OC_STACK_RESOURCE_DELETED;
1456         }
1457         else
1458         {
1459             uint8_t *payload = NULL;
1460             size_t size = 0;
1461             if (OC_STACK_OK == AclToCBORPayload(gAcl, &payload, &size))
1462             {
1463                 if (OC_STACK_OK == UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size))
1464                 {
1465                     ret = OC_STACK_RESOURCE_DELETED;
1466                 }
1467                 OICFree(payload);
1468             }
1469         }
1470     }
1471     return ret;
1472 }
1473
1474 /**
1475  * This method parses the query string received for REST requests and
1476  * retrieves the 'subject' field.
1477  *
1478  * @param query querystring passed in REST request
1479  * @param subject subject UUID parsed from query string
1480  *
1481  * @return true if query parsed successfully and found 'subject', else false.
1482  */
1483 static bool GetSubjectFromQueryString(const char *query, OicUuid_t *subject)
1484 {
1485     OicParseQueryIter_t parseIter = { .attrPos = NULL };
1486
1487     ParseQueryIterInit((unsigned char *) query, &parseIter);
1488
1489     while (GetNextQuery (&parseIter))
1490     {
1491         if (strncasecmp((char *) parseIter.attrPos, OIC_JSON_SUBJECTID_NAME, parseIter.attrLen) == 0)
1492         {
1493             char strUuid[STRING_UUID_SIZE] = {0};
1494             VERIFY_SUCCESS(TAG, 0 != parseIter.valLen, ERROR);
1495             memcpy(strUuid, parseIter.valPos, parseIter.valLen);
1496             OCStackResult res = ConvertStrToUuid(strUuid, subject);
1497             VERIFY_SUCCESS(TAG, OC_STACK_OK == res, ERROR);
1498             return true;
1499         }
1500     }
1501
1502 exit:
1503     return false;
1504 }
1505
1506 /**
1507  * This method parses the query string received for REST requests and
1508  * retrieves the 'resource' field.
1509  *
1510  * @param query querystring passed in REST request
1511  * @param resource resource parsed from query string
1512  * @param resourceSize size of the memory pointed to resource
1513  *
1514  * @return true if query parsed successfully and found 'resource', else false.
1515  */
1516 static bool GetResourceFromQueryString(const char *query, char *resource, size_t resourceSize)
1517 {
1518     OicParseQueryIter_t parseIter = { .attrPos = NULL };
1519
1520     ParseQueryIterInit((unsigned char *) query, &parseIter);
1521
1522     while (GetNextQuery (&parseIter))
1523     {
1524         if (strncasecmp((char *) parseIter.attrPos, OIC_JSON_RESOURCES_NAME, parseIter.attrLen)
1525                 == 0)
1526         {
1527             VERIFY_SUCCESS(TAG, 0 != parseIter.valLen, ERROR);
1528             OICStrcpy(resource, resourceSize, (char *) parseIter.valPos);
1529
1530             return true;
1531         }
1532     }
1533
1534 exit:
1535    return false;
1536 }
1537
1538 static size_t GetNumberOfResource(OicSecRsrc_t* resources)
1539 {
1540     size_t ret = 0;
1541     if(resources)
1542     {
1543         OicSecRsrc_t* rsrc = NULL;
1544         LL_FOREACH(resources, rsrc)
1545         {
1546             ret++;
1547         }
1548     }
1549     return ret;
1550 }
1551
1552 static size_t GetNumberOfValidity(OicSecValidity_t* val)
1553 {
1554     size_t ret = 0;
1555
1556     if(val)
1557     {
1558         OicSecValidity_t* temp = NULL;
1559         LL_FOREACH(val, temp)
1560         {
1561             ret++;
1562         }
1563     }
1564     return ret;
1565 }
1566
1567
1568 static bool IsSameStringArray(char** strArr1, size_t strArr1Len,
1569                               char** strArr2, size_t strArr2Len)
1570 {
1571
1572     if(NULL == strArr1 && NULL == strArr2)
1573     {
1574         return true;
1575     }
1576
1577     if(strArr1 && strArr2 && NULL == *strArr1 && NULL == *strArr2)
1578     {
1579         return true;
1580     }
1581
1582     if(strArr1 && strArr2)
1583     {
1584         if(*strArr1 && *strArr2 && strArr1Len == strArr2Len)
1585         {
1586             size_t matchedStr = 0;
1587             for(size_t i = 0; i < strArr1Len; i++)
1588             {
1589                 for(size_t j = 0; j < strArr2Len; j++)
1590                 {
1591                     if(strcmp(strArr1[i], strArr2[j]) == 0)
1592                     {
1593                         matchedStr++;
1594                     }
1595                 }
1596             }
1597             if(matchedStr == strArr1Len)
1598             {
1599                 return true;
1600             }
1601         }
1602     }
1603
1604     return false;
1605 }
1606
1607 static bool IsSameResources(OicSecRsrc_t* resources1, OicSecRsrc_t* resources2)
1608 {
1609     size_t numOfRsrc1 = 0;
1610     size_t numOfRsrc2 = 0;
1611     size_t numOfMatchedRsrc = 0;
1612     OicSecRsrc_t* rsrc1 = NULL;
1613     OicSecRsrc_t* rsrc2 = NULL;
1614
1615     if(NULL == resources1 && NULL == resources2)
1616     {
1617         return true;
1618     }
1619
1620     if(resources1 && resources2)
1621     {
1622         numOfRsrc1 = GetNumberOfResource(resources1);
1623         numOfRsrc2 = GetNumberOfResource(resources2);
1624
1625         if(0 == numOfRsrc1 && 0 == numOfRsrc2)
1626         {
1627             return true;
1628         }
1629
1630         LL_FOREACH(resources1, rsrc1)
1631         {
1632             rsrc2 = NULL;
1633             LL_FOREACH(resources2, rsrc2)
1634             {
1635                 if(rsrc1 && rsrc2)
1636                 {
1637                     if(strcmp(rsrc1->href, rsrc2->href) == 0 &&
1638                         IsSameStringArray(rsrc1->interfaces, rsrc1->interfaceLen,
1639                                           rsrc2->interfaces, rsrc2->interfaceLen) &&
1640                         IsSameStringArray(rsrc1->types, rsrc1->typeLen,
1641                                           rsrc2->types, rsrc2->typeLen))
1642                     {
1643                         // TODO: Update codes to compare 'rel' property
1644                         numOfMatchedRsrc++;
1645                     }
1646                 }
1647             }
1648         }
1649
1650         if(numOfMatchedRsrc == numOfRsrc1)
1651         {
1652             return true;
1653         }
1654     }
1655
1656     return false;
1657 }
1658
1659 static bool IsSameValidities(OicSecValidity_t* validities1, OicSecValidity_t* validities2)
1660 {
1661     size_t numOfVal1 = 0;
1662     size_t numOfVal2 = 0;
1663     size_t numOfMatchedVal = 0;
1664     OicSecValidity_t* val1 = NULL;
1665     OicSecValidity_t* val2 = NULL;
1666
1667     if(NULL == validities1 && NULL == validities2)
1668     {
1669         return true;
1670     }
1671
1672     if(validities1 && validities2)
1673     {
1674         numOfVal1 = GetNumberOfValidity(validities1);
1675         numOfVal2 = GetNumberOfValidity(validities2);
1676         if(0 == numOfVal1 && 0 == numOfVal2)
1677         {
1678             return true;
1679         }
1680
1681         if(numOfVal1 == numOfVal2)
1682         {
1683             LL_FOREACH(validities1, val1)
1684             {
1685                 LL_FOREACH(validities2, val2)
1686                 {
1687                     if(strcmp(val1->period, val2->period) == 0 &&
1688                         IsSameStringArray(val1->recurrences, val1->recurrenceLen,
1689                                           val2->recurrences, val2->recurrenceLen))
1690                     {
1691                         numOfMatchedVal++;
1692                     }
1693                 }
1694             }
1695             if(numOfVal1 == numOfMatchedVal)
1696             {
1697                 return true;
1698             }
1699         }
1700     }
1701
1702     return false;
1703 }
1704
1705 #ifdef _ENABLE_MULTIPLE_OWNER_
1706 static bool IsSameEowner(OicUuid_t* eowner1, OicUuid_t* eowner2)
1707 {
1708     if (NULL != eowner1 && NULL != eowner2)
1709     {
1710         if (memcmp(eowner1->id, eowner2->id, sizeof(eowner1->id)) == 0)
1711         {
1712             return true;
1713         }
1714     }
1715     else if (NULL == eowner1 && NULL == eowner2)
1716     {
1717         OIC_LOG(DEBUG, TAG, "Both eowner1 and eowner2 are NULL");
1718         return true;
1719     }
1720
1721     return false;
1722 }
1723 #endif
1724
1725 static bool IsSameACE(OicSecAce_t* ace1, OicSecAce_t* ace2)
1726 {
1727     if(ace1 && ace2)
1728     {
1729         if(memcmp(ace1->subjectuuid.id, ace2->subjectuuid.id, sizeof(ace1->subjectuuid.id)) != 0)
1730         {
1731             return false;
1732         }
1733
1734         if(false == IsSameResources(ace1->resources, ace2->resources))
1735         {
1736             return false;
1737         }
1738
1739         if(ace1->permission != ace2->permission)
1740         {
1741             return false;
1742         }
1743
1744         if(false == IsSameValidities(ace1->validities, ace2->validities))
1745         {
1746             return false;
1747         }
1748
1749 #ifdef _ENABLE_MULTIPLE_OWNER_
1750         if(false == IsSameEowner(ace1->eownerID, ace2->eownerID))
1751         {
1752             return false;
1753         }
1754 #endif
1755
1756         return true;
1757     }
1758
1759     return false;
1760 }
1761
1762 /**
1763  * Internal function to remove all ACL data on ACL resource and persistent storage
1764  *
1765  * @retval
1766  *     OC_STACK_RESOURCE_DELETED  - no errors
1767  *     Otherwise                  - error
1768  */
1769 static OCStackResult RemoveAllAce(void)
1770 {
1771     OCStackResult ret = OC_STACK_ERROR;
1772     uint8_t* aclBackup = NULL;
1773     size_t backupSize = 0;
1774     uint8_t* payload = NULL;
1775     size_t size = 0;
1776     OicSecAce_t* aceItem = NULL;
1777     OicSecAce_t* tempAce = NULL;
1778
1779     OIC_LOG(INFO, TAG, "IN RemoveAllAce");
1780
1781     //Backup the current ACL
1782     ret = AclToCBORPayload(gAcl, &aclBackup, &backupSize);
1783     if(OC_STACK_OK == ret)
1784     {
1785         // Remove all ACE from ACL
1786         LL_FOREACH_SAFE(gAcl->aces, aceItem, tempAce)
1787         {
1788             LL_DELETE(gAcl->aces, aceItem);
1789             FreeACE(aceItem);
1790         }
1791
1792         //Generate empty ACL payload
1793         ret = AclToCBORPayload(gAcl, &payload, &size);
1794         if (OC_STACK_OK == ret )
1795         {
1796             //Update the PS.
1797             ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size);
1798             if (OC_STACK_OK != ret)
1799             {
1800                 OIC_LOG_V(ERROR, TAG, "Error in UpdateSecureResourceInPS : %d", ret);
1801             }
1802         }
1803
1804         if(OC_STACK_OK != ret)
1805         {
1806             OIC_LOG_V(ERROR, TAG, "Error while DELETE ACE : %d", ret);
1807
1808             //If some erorr is occured, revert back.
1809             OicSecAcl_t* originAcl = CBORPayloadToAcl(aclBackup, backupSize);
1810             if( originAcl )
1811             {
1812                 ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, aclBackup, backupSize);
1813                 if (OC_STACK_OK == ret)
1814                 {
1815                     DeleteACLList(gAcl);
1816                     gAcl = originAcl;
1817                 }
1818                 else
1819                 {
1820                     OIC_LOG_V(ERROR, TAG, "Error in UpdateSecureResourceInPS : %d", ret);
1821                 }
1822             }
1823             else
1824             {
1825                 OIC_LOG(FATAL, TAG, "Error in CBORPayloadToAcl");
1826                 ret = OC_STACK_ERROR;
1827             }
1828         }
1829     }
1830
1831     OICFree(aclBackup);
1832     OICFree(payload);
1833
1834     OIC_LOG(INFO, TAG, "OUT RemoveAllAce");
1835
1836     return (OC_STACK_OK == ret ? OC_STACK_RESOURCE_DELETED : ret);
1837 }
1838
1839 static OCEntityHandlerResult HandleACLGetRequest(const OCEntityHandlerRequest *ehRequest)
1840 {
1841     OIC_LOG(INFO, TAG, "HandleACLGetRequest processing the request");
1842     uint8_t* payload = NULL;
1843     size_t size = 0;
1844     OCEntityHandlerResult ehRet;
1845
1846     OicUuid_t subject = {.id= { 0 } };
1847
1848     // In case, 'subject' field is included in REST request.
1849     if (ehRequest->query && GetSubjectFromQueryString(ehRequest->query, &subject))
1850     {
1851         OIC_LOG(DEBUG,TAG,"'subject' field is inculded in REST request.");
1852         OIC_LOG(DEBUG, TAG, "HandleACLGetRequest processing query");
1853
1854         char resource[MAX_URI_LENGTH] = { 0 };
1855
1856         OicSecAce_t *savePtr = NULL;
1857         const OicSecAce_t *currentAce = NULL;
1858         OicSecAcl_t targetAcl;
1859
1860         memcpy(&targetAcl.rownerID, &gAcl->rownerID, sizeof(OicUuid_t));
1861         targetAcl.aces = NULL;
1862
1863         // 'Subject' field is MUST for processing a querystring in REST request.
1864         GetResourceFromQueryString(ehRequest->query, resource, sizeof(resource));
1865
1866         /*
1867          * TODO : Currently, this code only provides one ACE for a Subject.
1868          * Below code needs to be updated for scenarios when Subject have
1869          * multiple ACE's in ACL resource.
1870          */
1871         while ((currentAce = GetACLResourceData(&subject, &savePtr)))
1872         {
1873             targetAcl.aces = (OicSecAce_t*)currentAce;
1874
1875             /*
1876              * If REST querystring contains a specific resource, we need
1877              * to search for that resource in ACE.
1878              */
1879             if (resource[0] != '\0')
1880             {
1881                 OicSecRsrc_t *rsrc = NULL;
1882                 LL_FOREACH(currentAce->resources, rsrc)
1883                 {
1884                     if(0 == strcmp(rsrc->href, resource) ||
1885                         0 == strcmp(WILDCARD_RESOURCE_URI, rsrc->href))
1886                     {
1887                         // Convert ACL data into CBOR format for transmission
1888                         if (OC_STACK_OK != AclToCBORPayload(&targetAcl, &payload, &size))
1889                         {
1890                             ehRet = OC_EH_ERROR;
1891                         }
1892                         goto exit;
1893                     }
1894                 }
1895             }
1896             else
1897             {
1898                 // Convert ACL data into CBOR format for transmission
1899                 if (OC_STACK_OK != AclToCBORPayload(&targetAcl, &payload, &size))
1900                 {
1901                     ehRet = OC_EH_ERROR;
1902                 }
1903                 goto exit;
1904             }
1905         }
1906     }
1907     // In case, 'subject' field is not included in REST request.
1908     else
1909     {
1910         OIC_LOG(DEBUG,TAG,"'subject' field is not inculded in REST request.");
1911         // Convert ACL data into CBOR format for transmission.
1912         if (OC_STACK_OK != AclToCBORPayload(gAcl, &payload, &size))
1913         {
1914             ehRet = OC_EH_ERROR;
1915         }
1916     }
1917 exit:
1918     // A device should always have a default acl. Therefore, payload should never be NULL.
1919     ehRet = (payload ? OC_EH_OK : OC_EH_ERROR);
1920     OIC_LOG(DEBUG, TAG, "ACL payload with GET response");
1921     OIC_LOG_BUFFER(DEBUG, TAG, payload, size);
1922
1923     //Send payload to request originator
1924     ehRet = ((SendSRMResponse(ehRequest, ehRet, payload, size)) == OC_STACK_OK) ?
1925                    OC_EH_OK : OC_EH_ERROR;
1926
1927     OICFree(payload);
1928
1929     OIC_LOG_V(DEBUG, TAG, "%s RetVal %d", __func__, ehRet);
1930     return ehRet;
1931 }
1932
1933 static OCEntityHandlerResult HandleACLPostRequest(const OCEntityHandlerRequest *ehRequest)
1934 {
1935     OIC_LOG(INFO, TAG, "HandleACLPostRequest processing the request");
1936     OCEntityHandlerResult ehRet = OC_EH_OK;
1937
1938     // Convert CBOR into ACL data and update to SVR buffers. This will also validate the ACL data received.
1939     uint8_t *payload = ((OCSecurityPayload *) ehRequest->payload)->securityData;
1940     size_t size = ((OCSecurityPayload *) ehRequest->payload)->payloadSize;
1941     if (payload)
1942     {
1943         OicSecAcl_t *newAcl = NULL;
1944         OIC_LOG(DEBUG, TAG, "ACL payload from POST request << ");
1945         OIC_LOG_BUFFER(DEBUG, TAG, payload, size);
1946
1947         newAcl = CBORPayloadToAcl(payload, size);
1948         if (newAcl)
1949         {
1950             bool isNewAce = true;
1951             OicSecAce_t* existAce = NULL;
1952             OicSecAce_t* newAce = NULL;
1953             OicSecAce_t* tempAce1 = NULL;
1954             OicSecAce_t* tempAce2 = NULL;
1955
1956             LL_FOREACH_SAFE(newAcl->aces, newAce, tempAce1)
1957             {
1958                 isNewAce = true;
1959                 LL_FOREACH_SAFE(gAcl->aces, existAce, tempAce2)
1960                 {
1961                     if(IsSameACE(newAce, existAce))
1962                     {
1963                         isNewAce = false;
1964                     }
1965                 }
1966                 if(isNewAce)
1967                 {
1968                     OIC_LOG(DEBUG, TAG, "NEW ACE dectected.");
1969
1970                     OicSecAce_t* insertAce = DuplicateACE(newAce);
1971                     if(insertAce)
1972                     {
1973                         OIC_LOG(DEBUG, TAG, "Appending new ACE..");
1974                         LL_PREPEND(gAcl->aces, insertAce);
1975                     }
1976                     else
1977                     {
1978                         OIC_LOG(ERROR, TAG, "Failed to duplicate ACE.");
1979                         ehRet = OC_EH_ERROR;
1980                     }
1981                 }
1982             }
1983             memcpy(&(gAcl->rownerID), &(newAcl->rownerID), sizeof(OicUuid_t));
1984
1985             DeleteACLList(newAcl);
1986
1987             if(OC_EH_OK == ehRet)
1988             {
1989                 size_t size = 0;
1990                 uint8_t *cborPayload = NULL;
1991
1992                 if (OC_STACK_OK == AclToCBORPayload(gAcl, &cborPayload, &size))
1993                 {
1994                     if (UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, cborPayload, size) == OC_STACK_OK)
1995                     {
1996                         ehRet = OC_EH_CHANGED;
1997                     }
1998                     OICFree(cborPayload);
1999                 }
2000
2001                 if(OC_EH_CHANGED != ehRet)
2002                 {
2003                     ehRet = OC_EH_ERROR;
2004                 }
2005             }
2006         }
2007     }
2008
2009     //Send response to request originator
2010     ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2011                    OC_EH_OK : OC_EH_ERROR;
2012
2013     OIC_LOG_V(DEBUG, TAG, "%s RetVal %d", __func__, ehRet);
2014     return ehRet;
2015 }
2016
2017 static OCEntityHandlerResult HandleACLDeleteRequest(const OCEntityHandlerRequest *ehRequest)
2018 {
2019     OIC_LOG(DEBUG, TAG, "Processing ACLDeleteRequest");
2020     OCEntityHandlerResult ehRet = OC_EH_ERROR;
2021     OicUuid_t subject = { .id= { 0 } };
2022     char resource[MAX_URI_LENGTH] = { 0 };
2023
2024     VERIFY_NON_NULL(TAG, ehRequest->query, ERROR);
2025
2026     // If 'Subject' field exist, processing a querystring in REST request.
2027     if(GetSubjectFromQueryString(ehRequest->query, &subject))
2028     {
2029         GetResourceFromQueryString(ehRequest->query, resource, sizeof(resource));
2030
2031         if (OC_STACK_RESOURCE_DELETED == RemoveACE(&subject, resource))
2032         {
2033             ehRet = OC_EH_RESOURCE_DELETED;
2034         }
2035     }
2036     // If 'subject field not exist, remove all ACL data from ACL resource
2037     else
2038     {
2039         OIC_LOG(WARNING, TAG, "Can not find the 'subject' in querystring, All ACL list will be removed.");
2040
2041         if(OC_STACK_RESOURCE_DELETED == RemoveAllAce())
2042         {
2043             ehRet = OC_EH_RESOURCE_DELETED;
2044         }
2045     }
2046
2047 exit:
2048     //Send response to request originator
2049     ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2050                    OC_EH_OK : OC_EH_ERROR;
2051
2052     return ehRet;
2053 }
2054
2055 OCEntityHandlerResult ACLEntityHandler(OCEntityHandlerFlag flag, OCEntityHandlerRequest * ehRequest,
2056         void* callbackParameter)
2057 {
2058     OIC_LOG(DEBUG, TAG, "Received request ACLEntityHandler");
2059     (void)callbackParameter;
2060     OCEntityHandlerResult ehRet = OC_EH_ERROR;
2061
2062     if (!ehRequest)
2063     {
2064         return ehRet;
2065     }
2066
2067     if (flag & OC_REQUEST_FLAG)
2068     {
2069         // TODO :  Handle PUT method
2070         OIC_LOG(DEBUG, TAG, "Flag includes OC_REQUEST_FLAG");
2071         switch (ehRequest->method)
2072         {
2073             case OC_REST_GET:
2074                 ehRet = HandleACLGetRequest(ehRequest);
2075                 break;
2076
2077             case OC_REST_POST:
2078                 ehRet = HandleACLPostRequest(ehRequest);
2079                 break;
2080
2081             case OC_REST_DELETE:
2082                 ehRet = HandleACLDeleteRequest(ehRequest);
2083                 break;
2084
2085             default:
2086                 ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2087                                OC_EH_OK : OC_EH_ERROR;
2088         }
2089     }
2090
2091     return ehRet;
2092 }
2093
2094 /**
2095  * This internal method is used to create '/oic/sec/acl' resource.
2096  */
2097 static OCStackResult CreateACLResource()
2098 {
2099     OCStackResult ret;
2100
2101     ret = OCCreateResource(&gAclHandle,
2102                            OIC_RSRC_TYPE_SEC_ACL,
2103                            OC_RSRVD_INTERFACE_DEFAULT,
2104                            OIC_RSRC_ACL_URI,
2105                            ACLEntityHandler,
2106                            NULL,
2107                            OC_SECURE);
2108
2109     if (OC_STACK_OK != ret)
2110     {
2111         OIC_LOG(FATAL, TAG, "Unable to instantiate ACL resource");
2112         DeInitACLResource();
2113     }
2114     return ret;
2115 }
2116
2117 // This function sets the default ACL and is defined for the unit test only.
2118 OCStackResult SetDefaultACL(OicSecAcl_t *acl)
2119 {
2120     gAcl = acl;
2121     return OC_STACK_OK;
2122 }
2123
2124 OCStackResult GetDefaultACL(OicSecAcl_t** defaultAcl)
2125 {
2126     OCStackResult ret = OC_STACK_ERROR;
2127     OicUuid_t ownerId = { .id = { 0 } };
2128     OicSecAcl_t *acl = NULL;
2129     OicSecAce_t *ace = NULL;
2130     OicSecRsrc_t* resRsrc = NULL;
2131     OicSecRsrc_t* deviceRsrc = NULL;
2132     OicSecRsrc_t* platformRsrc = NULL;
2133     OicSecRsrc_t* aclRsrc = NULL;
2134     OicSecRsrc_t* doxmRsrc = NULL;
2135     OicSecRsrc_t* pstatRsrc = NULL;
2136
2137     /*
2138      * TODO In future, when new virtual resources will be added in OIC
2139      * specification, Iotivity stack should be able to add them in
2140      * existing SVR database. To support this, we need to add 'versioning'
2141      * mechanism in SVR database.
2142      */
2143
2144     if (!defaultAcl)
2145     {
2146         return OC_STACK_INVALID_PARAM;
2147     }
2148
2149     acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
2150     VERIFY_NON_NULL(TAG, acl, ERROR);
2151
2152     ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
2153     VERIFY_NON_NULL(TAG, ace, ERROR);
2154
2155     LL_APPEND(acl->aces, ace);
2156
2157     // Subject -- Mandatory
2158     memcpy(ace->subjectuuid.id, &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t));
2159
2160     // Resources -- Mandatory
2161     // /oic/res
2162     resRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2163     VERIFY_NON_NULL(TAG, resRsrc, ERROR);
2164     LL_APPEND(ace->resources, resRsrc);
2165     resRsrc->href = OICStrdup(OC_RSRVD_WELL_KNOWN_URI);
2166     VERIFY_NON_NULL(TAG, (resRsrc->href), ERROR);
2167     resRsrc->typeLen = 1;
2168     resRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2169     VERIFY_NON_NULL(TAG, resRsrc->types, ERROR);
2170     resRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_RES);
2171     VERIFY_NON_NULL(TAG, resRsrc->types[0], ERROR);
2172     resRsrc->interfaceLen = 2;
2173     resRsrc->interfaces = (char**)OICCalloc(resRsrc->interfaceLen, sizeof(char*));
2174     VERIFY_NON_NULL(TAG, resRsrc->interfaces, ERROR);
2175     resRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2176     VERIFY_NON_NULL(TAG, resRsrc->interfaces[0], ERROR);
2177     resRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2178     VERIFY_NON_NULL(TAG, resRsrc->interfaces[1], ERROR);
2179
2180     // /oic/d
2181     deviceRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2182     VERIFY_NON_NULL(TAG, deviceRsrc, ERROR);
2183     LL_APPEND(ace->resources, deviceRsrc);
2184     deviceRsrc->href = OICStrdup(OC_RSRVD_DEVICE_URI);
2185     VERIFY_NON_NULL(TAG, (deviceRsrc->href), ERROR);
2186     deviceRsrc->typeLen = 1;
2187     deviceRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2188     VERIFY_NON_NULL(TAG, deviceRsrc->types, ERROR);
2189     deviceRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_DEVICE);
2190     VERIFY_NON_NULL(TAG, deviceRsrc->types[0], ERROR);
2191     deviceRsrc->interfaceLen = 2;
2192     deviceRsrc->interfaces = (char**)OICCalloc(deviceRsrc->interfaceLen, sizeof(char*));
2193     VERIFY_NON_NULL(TAG, deviceRsrc->interfaces, ERROR);
2194     deviceRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2195     VERIFY_NON_NULL(TAG, deviceRsrc->interfaces[0], ERROR);
2196     deviceRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2197     VERIFY_NON_NULL(TAG, deviceRsrc->interfaces[1], ERROR);
2198
2199     // /oic/p
2200     platformRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2201     VERIFY_NON_NULL(TAG, platformRsrc, ERROR);
2202     LL_APPEND(ace->resources, platformRsrc);
2203     platformRsrc->href = OICStrdup(OC_RSRVD_PLATFORM_URI);
2204     VERIFY_NON_NULL(TAG, (platformRsrc->href), ERROR);
2205     platformRsrc->typeLen = 1;
2206     platformRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2207     VERIFY_NON_NULL(TAG, platformRsrc->types, ERROR);
2208     platformRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_PLATFORM);
2209     VERIFY_NON_NULL(TAG, platformRsrc->types[0], ERROR);
2210     platformRsrc->interfaceLen = 2;
2211     platformRsrc->interfaces = (char**)OICCalloc(platformRsrc->interfaceLen, sizeof(char*));
2212     VERIFY_NON_NULL(TAG, platformRsrc->interfaces, ERROR);
2213     platformRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2214     VERIFY_NON_NULL(TAG, platformRsrc->interfaces[0], ERROR);
2215     platformRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2216     VERIFY_NON_NULL(TAG, platformRsrc->interfaces[1], ERROR);
2217
2218     // /oic/sec/acl
2219     aclRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2220     VERIFY_NON_NULL(TAG, aclRsrc, ERROR);
2221     LL_APPEND(ace->resources, aclRsrc);
2222     aclRsrc->href = OICStrdup(OIC_RSRC_ACL_URI);
2223     VERIFY_NON_NULL(TAG, (aclRsrc->href), ERROR);
2224     aclRsrc->typeLen = 1;
2225     aclRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2226     VERIFY_NON_NULL(TAG, aclRsrc->types, ERROR);
2227     aclRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_ACL);
2228     VERIFY_NON_NULL(TAG, aclRsrc->types[0], ERROR);
2229     aclRsrc->interfaceLen = 1;
2230     aclRsrc->interfaces = (char**)OICCalloc(aclRsrc->interfaceLen, sizeof(char*));
2231     VERIFY_NON_NULL(TAG, aclRsrc->interfaces, ERROR);
2232     aclRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2233     VERIFY_NON_NULL(TAG, aclRsrc->interfaces[0], ERROR);
2234
2235     // /oic/sec/doxm
2236     doxmRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2237     VERIFY_NON_NULL(TAG, doxmRsrc, ERROR);
2238     LL_APPEND(ace->resources, doxmRsrc);
2239     doxmRsrc->href = OICStrdup(OIC_RSRC_DOXM_URI);
2240     VERIFY_NON_NULL(TAG, (doxmRsrc->href), ERROR);
2241     doxmRsrc->typeLen = 1;
2242     doxmRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2243     VERIFY_NON_NULL(TAG, doxmRsrc->types, ERROR);
2244     doxmRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_DOXM);
2245     VERIFY_NON_NULL(TAG, doxmRsrc->types[0], ERROR);
2246     doxmRsrc->interfaceLen = 1;
2247     doxmRsrc->interfaces = (char**)OICCalloc(doxmRsrc->interfaceLen, sizeof(char*));
2248     VERIFY_NON_NULL(TAG, doxmRsrc->interfaces, ERROR);
2249     doxmRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2250     VERIFY_NON_NULL(TAG, doxmRsrc->interfaces[0], ERROR);
2251
2252     // /oic/sec/pstat
2253     pstatRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2254     VERIFY_NON_NULL(TAG, pstatRsrc, ERROR);
2255     LL_APPEND(ace->resources, pstatRsrc);
2256     pstatRsrc->href = OICStrdup(OIC_RSRC_PSTAT_URI);
2257     VERIFY_NON_NULL(TAG, (pstatRsrc->href), ERROR);
2258     pstatRsrc->typeLen = 1;
2259     pstatRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2260     VERIFY_NON_NULL(TAG, pstatRsrc->types, ERROR);
2261     pstatRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_PSTAT);
2262     VERIFY_NON_NULL(TAG, pstatRsrc->types[0], ERROR);
2263     pstatRsrc->interfaceLen = 1;
2264     pstatRsrc->interfaces = (char**)OICCalloc(pstatRsrc->interfaceLen, sizeof(char*));
2265     VERIFY_NON_NULL(TAG, pstatRsrc->interfaces, ERROR);
2266     pstatRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2267     VERIFY_NON_NULL(TAG, pstatRsrc->interfaces[0], ERROR);
2268
2269     ace->permission = PERMISSION_READ;
2270     ace->validities = NULL;
2271
2272     // Device ID is the owner of this default ACL
2273     if (GetDoxmResourceData() != NULL)
2274     {
2275         ret = GetDoxmDeviceID(&ownerId);
2276         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, FATAL);
2277     }
2278     else
2279     {
2280         OCRandomUuidResult rdm = OCGenerateUuid(ownerId.id);
2281         VERIFY_SUCCESS(TAG, RAND_UUID_OK == rdm, FATAL);
2282     }
2283
2284     memcpy(&acl->rownerID, &ownerId, sizeof(OicUuid_t));
2285
2286     *defaultAcl = acl;
2287     ret = OC_STACK_OK;
2288
2289 exit:
2290
2291     if (ret != OC_STACK_OK)
2292     {
2293         DeleteACLList(acl);
2294         acl = NULL;
2295     }
2296
2297     return ret;
2298 }
2299
2300 OCStackResult InitACLResource()
2301 {
2302     OCStackResult ret = OC_STACK_ERROR;
2303
2304     uint8_t *data = NULL;
2305     size_t size = 0;
2306     ret = GetSecureVirtualDatabaseFromPS(OIC_JSON_ACL_NAME, &data, &size);
2307     // If database read failed
2308     if (OC_STACK_OK != ret)
2309     {
2310         OIC_LOG(DEBUG, TAG, "ReadSVDataFromPS failed");
2311     }
2312     if (data)
2313     {
2314         // Read ACL resource from PS
2315         gAcl = CBORPayloadToAcl(data, size);
2316         OICFree(data);
2317     }
2318     /*
2319      * If SVR database in persistent storage got corrupted or
2320      * is not available for some reason, a default ACL is created
2321      * which allows user to initiate ACL provisioning again.
2322      */
2323     if (!gAcl)
2324     {
2325         ret = GetDefaultACL(&gAcl);
2326         if (OC_STACK_OK != ret)
2327         {
2328             OIC_LOG(ERROR, TAG, "Failed to create default ACL");
2329         }
2330         // TODO Needs to update persistent storage
2331     }
2332     VERIFY_NON_NULL(TAG, gAcl, FATAL);
2333
2334     // Instantiate 'oic.sec.acl'
2335     ret = CreateACLResource();
2336
2337 exit:
2338     if (OC_STACK_OK != ret)
2339     {
2340         DeInitACLResource();
2341     }
2342     return ret;
2343 }
2344
2345 OCStackResult DeInitACLResource()
2346 {
2347     OCStackResult ret =  OCDeleteResource(gAclHandle);
2348     gAclHandle = NULL;
2349
2350     if (gAcl)
2351     {
2352         DeleteACLList(gAcl);
2353         gAcl = NULL;
2354     }
2355     return ret;
2356 }
2357
2358 const OicSecAce_t* GetACLResourceData(const OicUuid_t* subjectId, OicSecAce_t **savePtr)
2359 {
2360     OicSecAce_t *ace = NULL;
2361     OicSecAce_t *begin = NULL;
2362
2363     if (NULL == subjectId || NULL == savePtr || NULL == gAcl)
2364     {
2365         return NULL;
2366     }
2367
2368     /*
2369      * savePtr MUST point to NULL if this is the 'first' call to retrieve ACL for
2370      * subjectID.
2371      */
2372     if (NULL == *savePtr)
2373     {
2374         begin = gAcl->aces;
2375     }
2376     else
2377     {
2378         /*
2379          * If this is a 'successive' call, search for location pointed by
2380          * savePtr and assign 'begin' to the next ACL after it in the linked
2381          * list and start searching from there.
2382          */
2383         LL_FOREACH(gAcl->aces, ace)
2384         {
2385             if (ace == *savePtr)
2386             {
2387                 begin = ace->next;
2388             }
2389         }
2390     }
2391
2392     // Find the next ACL corresponding to the 'subjectID' and return it.
2393     LL_FOREACH(begin, ace)
2394     {
2395         if (memcmp(&(ace->subjectuuid), subjectId, sizeof(OicUuid_t)) == 0)
2396         {
2397             *savePtr = ace;
2398             return ace;
2399         }
2400     }
2401
2402     // Cleanup in case no ACL is found
2403     *savePtr = NULL;
2404     return NULL;
2405 }
2406
2407 void printACL(const OicSecAcl_t* acl)
2408 {
2409     OIC_LOG(INFO, TAG, "Print ACL:");
2410
2411     if (NULL == acl)
2412     {
2413         OIC_LOG(INFO, TAG, "Received NULL acl");
2414         return;
2415     }
2416
2417     char *rowner = NULL;
2418     if (OC_STACK_OK == ConvertUuidToStr(&acl->rownerID, &rowner))
2419     {
2420         OIC_LOG_V(INFO, TAG, "rowner id = %s", rowner);
2421     }
2422     else
2423     {
2424         OIC_LOG(ERROR, TAG, "Can't convert rowner uuid to string");
2425     }
2426     OICFree(rowner);
2427
2428     const OicSecAce_t *ace = acl->aces;
2429     int ace_count = 0;
2430     while (ace)
2431     {
2432         ace_count++;
2433         OIC_LOG_V(INFO, TAG, "Print ace[%d]:", ace_count);
2434
2435         OIC_LOG_V(INFO, TAG, "ace permission = %d", ace->permission);
2436
2437         char *subjectuuid = NULL;
2438         if (OC_STACK_OK == ConvertUuidToStr(&ace->subjectuuid, &subjectuuid))
2439         {
2440             OIC_LOG_V(INFO, TAG, "ace subject uuid = %s", subjectuuid);
2441         }
2442         else
2443         {
2444             OIC_LOG(ERROR, TAG, "Can't convert subjectuuid to string");
2445         }
2446         OICFree(subjectuuid);
2447
2448         OicSecRsrc_t *res = ace->resources;
2449         int res_count = 0;
2450         while (res)
2451         {
2452             res_count++;
2453             OIC_LOG_V(INFO, TAG, "Print resources[%d]:", res_count);
2454
2455             OIC_LOG_V(INFO, TAG, "href = %s", res->href);
2456
2457             for (size_t i = 0; i < res->typeLen; i++)
2458             {
2459                 OIC_LOG_V(INFO, TAG, "if[%zu] = %s", i, res->types[i]);
2460             }
2461             for (size_t i = 0; i < res->interfaceLen; i++)
2462             {
2463                 OIC_LOG_V(INFO, TAG, "if[%zu] = %s", i, res->interfaces[i]);
2464             }
2465
2466             res= res->next;
2467         }
2468
2469         OicSecValidity_t *vals = ace->validities;
2470         int vals_count = 0;
2471         while (vals)
2472         {
2473             vals_count++;
2474             OIC_LOG_V(INFO, TAG, "Print validities[%d]:", vals_count);
2475
2476             OIC_LOG_V(INFO, TAG, "period = %s", vals->period);
2477             for (size_t i = 0; i < vals->recurrenceLen; i++)
2478             {
2479                 OIC_LOG_V(INFO, TAG, "recurrences[%zu] = %s", i, vals->recurrences[i]);
2480             }
2481         }
2482
2483         ace = ace->next;
2484     }
2485 }
2486
2487 OCStackResult AppendACL2(const OicSecAcl_t* acl)
2488 {
2489     OCStackResult ret = OC_STACK_ERROR;
2490
2491     if (!acl)
2492     {
2493         return OC_STACK_INVALID_PARAM;
2494     }
2495
2496     // Append the new ACE to existing ACE list
2497     // Can't use LL_APPEND because it sets ace->next to NULL
2498     OicSecAce_t* ace = gAcl->aces;
2499     if (ace)
2500     {
2501         while (ace->next)
2502         {
2503             ace = ace->next;
2504         }
2505         ace->next = acl->aces;
2506     }
2507     else
2508     {
2509         gAcl->aces = acl->aces;
2510     }
2511
2512     printACL(gAcl);
2513
2514     size_t size = 0;
2515     uint8_t *payload = NULL;
2516     ret = AclToCBORPayload(gAcl, &payload, &size);
2517     if (OC_STACK_OK == ret)
2518     {
2519         ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size);
2520         OICFree(payload);
2521     }
2522
2523     return ret;
2524 }
2525
2526 OCStackResult AppendACL(const uint8_t *cborPayload, const size_t size)
2527 {
2528     // Convert CBOR format to ACL data. This will also validate the ACL data received.
2529     OicSecAcl_t* newAcl = CBORPayloadToAcl(cborPayload, size);
2530
2531     return AppendACL2(newAcl);
2532 }
2533
2534 OCStackResult InstallACL(const OicSecAcl_t* acl)
2535 {
2536     OCStackResult ret = OC_STACK_ERROR;
2537
2538     if (!acl)
2539     {
2540         return OC_STACK_INVALID_PARAM;
2541     }
2542
2543     bool isNewAce = true;
2544     OicSecAce_t* existAce = NULL;
2545     OicSecAce_t* newAce = NULL;
2546     OicSecAce_t* tempAce1 = NULL;
2547     OicSecAce_t* tempAce2 = NULL;
2548     OicSecAcl_t* newInstallAcl = NULL;
2549
2550     LL_FOREACH_SAFE(acl->aces, newAce, tempAce1)
2551     {
2552         isNewAce = true;
2553         LL_FOREACH_SAFE(gAcl->aces, existAce, tempAce2)
2554         {
2555             if(IsSameACE(newAce, existAce))
2556             {
2557                 OIC_LOG(DEBUG, TAG, "Duplicated ACE dectected.");
2558                 ret = OC_STACK_DUPLICATE_REQUEST;
2559                 isNewAce = false;
2560             }
2561         }
2562         if(isNewAce)
2563         {
2564             // Append new ACE to existing ACL
2565             OIC_LOG(DEBUG, TAG, "NEW ACE dectected.");
2566
2567             OicSecAce_t* insertAce = DuplicateACE(newAce);
2568             if(insertAce)
2569             {
2570                 OIC_LOG(DEBUG, TAG, "Appending new ACE..");
2571
2572                 if (!newInstallAcl)
2573                 {
2574                     newInstallAcl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
2575                     if (NULL == newInstallAcl)
2576                     {
2577                         OIC_LOG(ERROR, TAG, "Failed to acllocate ACL");
2578                         return OC_STACK_NO_MEMORY;
2579                     }
2580                 }
2581                 LL_PREPEND(newInstallAcl->aces, insertAce);
2582             }
2583             else
2584             {
2585                 OIC_LOG(ERROR, TAG, "Failed to duplicate ACE");
2586                 DeleteACLList(newInstallAcl);
2587                 return OC_STACK_ERROR;
2588             }
2589         }
2590     }
2591
2592     if (newInstallAcl)
2593     {
2594         ret = AppendACL2(newInstallAcl);
2595         if (OC_STACK_OK != ret)
2596         {
2597             OIC_LOG(ERROR, TAG, "Failed to append ACL");
2598         }
2599         OICFree(newInstallAcl);
2600     }
2601
2602     return ret;
2603 }
2604
2605 /**
2606  * This function generates default ACE for security resource in case of owned status.
2607  *
2608  * @return Default ACE for security resource.
2609  */
2610 static OicSecAce_t* GetSecDefaultACE()
2611 {
2612     const int NUM_OF_DOXM_RT = 1;
2613     const int NUM_OF_DOXM_IF  = 1;
2614     const int NUM_OF_PSTAT_RT = 1;
2615     const int NUM_OF_PSTAT_IF = 1;
2616     const char *doxmRt[] = { OIC_RSRC_TYPE_SEC_DOXM };
2617     const char *pstatRt[] = { OIC_RSRC_TYPE_SEC_PSTAT };
2618     const char *doxmIf[] = { OC_RSRVD_INTERFACE_DEFAULT };
2619     const char *pstatIf[] = { OC_RSRVD_INTERFACE_DEFAULT };
2620     OicSecRsrc_t* doxmRsrc = NULL;
2621     OicSecRsrc_t* pstatRsrc = NULL;
2622
2623     //Generate default ACE
2624     OicSecAce_t* newAce = (OicSecAce_t*)OICCalloc(1, sizeof(OicSecAce_t));
2625     VERIFY_NON_NULL(TAG, newAce, ERROR);
2626
2627     // Subject -- Mandatory
2628     memcpy(newAce->subjectuuid.id, &WILDCARD_SUBJECT_ID, WILDCARD_SUBJECT_ID_LEN);
2629
2630     //Resources -- Mandatory
2631     //Add doxm
2632     doxmRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2633     VERIFY_NON_NULL(TAG, doxmRsrc, ERROR);
2634     LL_APPEND(newAce->resources, doxmRsrc);
2635     // pstat-href
2636     doxmRsrc->href = OICStrdup(OIC_RSRC_DOXM_URI);
2637     VERIFY_NON_NULL(TAG, (doxmRsrc->href), ERROR);
2638     // pstat-rt
2639     doxmRsrc->typeLen = NUM_OF_DOXM_RT;
2640     doxmRsrc->types = (char**)OICCalloc(NUM_OF_DOXM_RT, sizeof(char*));
2641     VERIFY_NON_NULL(TAG, (doxmRsrc->types), ERROR);
2642     for(int i = 0; i < NUM_OF_DOXM_RT; i++)
2643     {
2644         doxmRsrc->types[i] = OICStrdup(doxmRt[i]);
2645         VERIFY_NON_NULL(TAG, (doxmRsrc->types[i]), ERROR);
2646     }
2647     // pstat-if
2648     doxmRsrc->interfaceLen = NUM_OF_DOXM_IF;
2649     doxmRsrc->interfaces = (char**)OICCalloc(NUM_OF_DOXM_IF, sizeof(char*));
2650     VERIFY_NON_NULL(TAG, (doxmRsrc->interfaces), ERROR);
2651     for(int i = 0; i < NUM_OF_DOXM_IF; i++)
2652     {
2653         doxmRsrc->interfaces[i] = OICStrdup(doxmIf[i]);
2654         VERIFY_NON_NULL(TAG, (doxmRsrc->interfaces[i]), ERROR);
2655     }
2656
2657     //Add pstat
2658     pstatRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2659     VERIFY_NON_NULL(TAG, pstatRsrc, ERROR);
2660     LL_APPEND(newAce->resources, pstatRsrc);
2661     //pstat-href
2662     pstatRsrc->href = OICStrdup(OIC_RSRC_PSTAT_URI);
2663     VERIFY_NON_NULL(TAG, (pstatRsrc->href), ERROR);
2664     //pstat-rt
2665     pstatRsrc->typeLen = NUM_OF_PSTAT_RT;
2666     pstatRsrc->types = (char**)OICCalloc(NUM_OF_PSTAT_RT, sizeof(char*));
2667     VERIFY_NON_NULL(TAG, (pstatRsrc->types), ERROR);
2668     for(int i = 0; i < NUM_OF_PSTAT_RT; i++)
2669     {
2670         pstatRsrc->types[i] = OICStrdup(pstatRt[i]);
2671         VERIFY_NON_NULL(TAG, (pstatRsrc->types[i]), ERROR);
2672     }
2673     // pstat-if
2674     pstatRsrc->interfaceLen = NUM_OF_PSTAT_IF;
2675     pstatRsrc->interfaces = (char**)OICCalloc(NUM_OF_PSTAT_IF, sizeof(char*));
2676     VERIFY_NON_NULL(TAG, (pstatRsrc->interfaces), ERROR);
2677     for(int i = 0; i < NUM_OF_PSTAT_IF; i++)
2678     {
2679         pstatRsrc->interfaces[i] = OICStrdup(pstatIf[i]);
2680         VERIFY_NON_NULL(TAG, (pstatRsrc->interfaces[i]), ERROR);
2681     }
2682
2683     // Permissions -- Mandatory
2684     newAce->permission = PERMISSION_READ;
2685
2686     //Period -- Not Mandatory
2687     newAce->validities = NULL;
2688
2689     return newAce;
2690 exit:
2691     FreeACE(newAce);
2692     return NULL;
2693
2694 }
2695
2696 OCStackResult UpdateDefaultSecProvACE()
2697 {
2698     OCStackResult ret = OC_STACK_OK;
2699     OicSecAce_t *ace = NULL;
2700     OicSecAce_t *tempAce = NULL;
2701
2702     if(gAcl)
2703     {
2704         int matchedRsrc = 0;
2705         bool isRemoved = false;
2706
2707         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
2708         {
2709             //Find default security resource ACL
2710             if(memcmp(&ace->subjectuuid, &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t)) == 0 &&
2711                 ((PERMISSION_READ | PERMISSION_WRITE) == ace->permission))
2712             {
2713                 matchedRsrc = 0;
2714
2715                 OicSecRsrc_t* rsrc = NULL;
2716                 LL_FOREACH(ace->resources, rsrc)
2717                 {
2718                     if(strncmp(rsrc->href, OIC_RSRC_DOXM_URI,
2719                                strlen(OIC_RSRC_DOXM_URI) + 1) == 0 ||
2720                        strncmp(rsrc->href, OIC_RSRC_CRED_URI,
2721                                strlen(OIC_RSRC_CRED_URI) + 1) == 0 ||
2722                        strncmp(rsrc->href, OIC_RSRC_ACL_URI,
2723                                strlen(OIC_RSRC_ACL_URI) + 1) == 0 ||
2724                        strncmp(rsrc->href, OIC_RSRC_PSTAT_URI,
2725                                strlen(OIC_RSRC_PSTAT_URI) + 1) == 0)
2726                     {
2727                         matchedRsrc++;
2728                     }
2729                 }
2730
2731                 //If default security resource ACL is detected, delete it.
2732                 if(NUMBER_OF_SEC_PROV_RSCS == matchedRsrc)
2733                 {
2734                     LL_DELETE(gAcl->aces, ace);
2735                     FreeACE(ace);
2736                     isRemoved = true;
2737                 }
2738             }
2739         }
2740
2741         if(isRemoved)
2742         {
2743             /*
2744              * Generate new security resource ACE as follows :
2745              *      subject : "*"
2746              *      resources :  '/oic/sec/doxm', '/oic/sec/pstat'
2747              *      permission : READ
2748              */
2749             OicSecAce_t *secDefaultAce = GetSecDefaultACE();
2750             if (secDefaultAce)
2751             {
2752                 LL_APPEND(gAcl->aces, secDefaultAce);
2753
2754                 size_t size = 0;
2755                 uint8_t *payload = NULL;
2756                 if (OC_STACK_OK == AclToCBORPayload(gAcl, &payload, &size))
2757                 {
2758                     if (UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size) == OC_STACK_OK)
2759                     {
2760                         ret = OC_STACK_OK;
2761                     }
2762                     OICFree(payload);
2763                 }
2764             }
2765         }
2766     }
2767
2768     return ret;
2769 }
2770
2771 OCStackResult SetAclRownerId(const OicUuid_t* newROwner)
2772 {
2773     OCStackResult ret = OC_STACK_ERROR;
2774     uint8_t *cborPayload = NULL;
2775     size_t size = 0;
2776     OicUuid_t prevId = {.id={0}};
2777
2778     if(NULL == newROwner)
2779     {
2780         ret = OC_STACK_INVALID_PARAM;
2781     }
2782     if(NULL == gAcl)
2783     {
2784         ret = OC_STACK_NO_RESOURCE;
2785     }
2786
2787     if(newROwner && gAcl)
2788     {
2789         memcpy(prevId.id, gAcl->rownerID.id, sizeof(prevId.id));
2790         memcpy(gAcl->rownerID.id, newROwner->id, sizeof(newROwner->id));
2791
2792         ret = AclToCBORPayload(gAcl, &cborPayload, &size);
2793         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, ERROR);
2794
2795         ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, cborPayload, size);
2796         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, ERROR);
2797
2798         OICFree(cborPayload);
2799     }
2800
2801     return ret;
2802
2803 exit:
2804     OICFree(cborPayload);
2805     memcpy(gAcl->rownerID.id, prevId.id, sizeof(prevId.id));
2806     return ret;
2807 }
2808
2809 OCStackResult GetAclRownerId(OicUuid_t *rowneruuid)
2810 {
2811     OCStackResult retVal = OC_STACK_ERROR;
2812     if (gAcl)
2813     {
2814         *rowneruuid = gAcl->rownerID;
2815         retVal = OC_STACK_OK;
2816     }
2817     return retVal;
2818 }