resource/csdk/security/src/credresource.c

   1 //******************************************************************
   2 //
   3 // Copyright 2015 Intel Mobile Communications GmbH All Rights Reserved.
   4 //
   5 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   6 //
   7 // Licensed under the Apache License, Version 2.0 (the "License");
   8 // you may not use this file except in compliance with the License.
   9 // You may obtain a copy of the License at
  10 //
  11 //      http://www.apache.org/licenses/LICENSE-2.0
  12 //
  13 // Unless required by applicable law or agreed to in writing, software
  14 // distributed under the License is distributed on an "AS IS" BASIS,
  15 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16 // See the License for the specific language governing permissions and
  17 // limitations under the License.
  18 //
  19 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  20
  21 #define __STDC_LIMIT_MACROS
  22 #include "ocstack.h"
  23 #include "logger.h"
  24 #include "oic_malloc.h"
  25 #include "cJSON.h"
  26 #include "resourcemanager.h"
  27 #include "psinterface.h"
  28 #include "utlist.h"
  29 #include "srmresourcestrings.h"
  30 #include "credresource.h"
  31 #include "ocrandom.h"
  32 #include "doxmresource.h"
  33 #include "base64.h"
  34 #include "srmutility.h"
  35 #include "cainterface.h"
  36 #include <stdlib.h>
  37 #ifdef WITH_ARDUINO
  38 #include <string.h>
  39 #else
  40 #include <strings.h>
  41 #endif
  42 #include <stdint.h>
  43
  44
  45 #define TAG  PCF("SRM-CREDL")
  46
  47 static OicSecCred_t        *gCred = NULL;
  48 static OCResourceHandle    gCredHandle = NULL;
  49
  50 /**
  51  * This function frees OicSecCred_t object's fields and object itself.
  52  */
  53 static void FreeCred(OicSecCred_t *cred)
  54 {
  55     if(NULL == cred)
  56     {
  57         OC_LOG (INFO, TAG, PCF("Invalid Parameter"));
  58         return;
  59     }
  60     //Note: Need further clarification on roleID data type
  61 #if 0
  62     //Clean roleIds
  63     OICFree(cred->roleIds);
  64 #endif
  65
  66     //Clean PublicData
  67     OICFree(cred->publicData.data);
  68
  69     //Clean PrivateData
  70     OICFree(cred->privateData.data);
  71
  72     //Clean Period
  73     OICFree(cred->period);
  74
  75     //Clean Owners
  76     OICFree(cred->owners);
  77
  78     //Clean Cred node itself
  79     OICFree(cred);
  80 }
  81
  82 void DeleteCredList(OicSecCred_t* cred)
  83 {
  84     if (cred)
  85     {
  86         OicSecCred_t *credTmp1 = NULL, *credTmp2 = NULL;
  87         LL_FOREACH_SAFE(cred, credTmp1, credTmp2)
  88         {
  89             LL_DELETE(cred, credTmp1);
  90             FreeCred(credTmp1);
  91         }
  92     }
  93 }
  94
  95 /**
  96  * This function converts credential data into JSON format.
  97  * Caller needs to invoke 'free' when done using
  98  * returned string.
  99  * @param cred  pointer to instance of OicSecCred_t structure.
 100  *
 101  * @retval
 102  *      pointer to JSON credential representation - if credential for subjectId found
 103  *      NULL                                      - if credential for subjectId not found
 104  */
 105 char * BinToCredJSON(const OicSecCred_t * cred)
 106 {
 107     cJSON *jsonRoot = NULL;
 108     char *jsonStr = NULL;
 109
 110     if (cred)
 111     {
 112         char base64Buff[B64ENCODE_OUT_SAFESIZE(sizeof(((OicUuid_t*)0)->id)) + 1] = {};
 113         uint32_t outLen = 0;
 114         B64Result b64Ret = B64_OK;
 115
 116         jsonRoot = cJSON_CreateObject();
 117         VERIFY_NON_NULL(TAG, jsonRoot, ERROR);
 118
 119         cJSON *jsonCredArray = NULL;
 120         cJSON_AddItemToObject(jsonRoot, OIC_JSON_CRED_NAME,
 121                 jsonCredArray = cJSON_CreateArray());
 122         VERIFY_NON_NULL(TAG, jsonCredArray, ERROR);
 123
 124         while(cred)
 125         {
 126             cJSON *jsonCred = cJSON_CreateObject();
 127             VERIFY_NON_NULL(TAG, jsonCred, ERROR);
 128
 129             //CredID -- Mandatory
 130             cJSON_AddNumberToObject(jsonCred, OIC_JSON_CREDID_NAME, (int)cred->credId);
 131
 132             //Subject -- Mandatory
 133             outLen = 0;
 134             memset(base64Buff, 0, sizeof(base64Buff));
 135             b64Ret = b64Encode(cred->subject.id, sizeof(cred->subject.id), base64Buff,
 136                    sizeof(base64Buff), &outLen);
 137             VERIFY_SUCCESS(TAG, b64Ret == B64_OK, ERROR);
 138             cJSON_AddStringToObject(jsonCred, OIC_JSON_SUBJECT_NAME, base64Buff);
 139
 140             //Note: Need further clarification on roleID data type
 141 #if 0
 142             //RoleId -- Not Mandatory
 143             if(cred->roleIdsLen > 0)
 144             {
 145                 cJSON *jsonRoleIdsArray = NULL;
 146                 cJSON_AddItemToObject (jsonCred, OIC_JSON_ROLEIDS_NAME,
 147                                          jsonRoleIdsArray = cJSON_CreateArray());
 148                 VERIFY_NON_NULL(TAG, jsonRoleIdsArray, ERROR);
 149                 for (size_t i = 0; i < cred->roleIdsLen; i++)
 150                 {
 151                     cJSON_AddItemToArray (jsonRoleIdsArray,
 152                             cJSON_CreateString((char *)cred->roleIds[i].id));
 153                 }
 154             }
 155 #endif
 156
 157             //CredType -- Mandatory
 158             cJSON_AddNumberToObject(jsonCred, OIC_JSON_CREDTYPE_NAME,(int)cred->credType);
 159
 160 #if 0
 161             //PublicData -- Not Mandatory
 162             if(cred->publicData.data)
 163             {
 164                 cJSON_AddStringToObject(jsonCred, OIC_JSON_PUBLICDATA_NAME, cred->publicData.data);
 165             }
 166 #endif
 167             //PrivateData -- Not Mandatory
 168             if(cred->privateData.data)
 169             {
 170                 cJSON_AddStringToObject(jsonCred, OIC_JSON_PRIVATEDATA_NAME, cred->privateData.data);
 171             }
 172
 173             //Period -- Not Mandatory
 174             if(cred->period)
 175             {
 176                 cJSON_AddStringToObject(jsonCred, OIC_JSON_PERIOD_NAME,
 177                                         cred->period);
 178             }
 179
 180             //Owners -- Mandatory
 181             cJSON *jsonOwnrArray = NULL;
 182             cJSON_AddItemToObject (jsonCred, OIC_JSON_OWNERS_NAME,
 183                                              jsonOwnrArray = cJSON_CreateArray());
 184             VERIFY_NON_NULL(TAG, jsonOwnrArray, ERROR);
 185             for (size_t i = 0; i < cred->ownersLen; i++)
 186             {
 187                 outLen = 0;
 188                 memset(base64Buff, 0, sizeof(base64Buff));
 189                 b64Ret = b64Encode(cred->owners[i].id, sizeof(cred->owners[i].id),
 190                         base64Buff, sizeof(base64Buff), &outLen);
 191                 VERIFY_SUCCESS(TAG, b64Ret == B64_OK, ERROR);
 192                 cJSON_AddItemToArray (jsonOwnrArray,
 193                                        cJSON_CreateString((char *)(base64Buff)));
 194             }
 195
 196             /* Attach current cred node to cred Array */
 197             cJSON_AddItemToArray(jsonCredArray, jsonCred);
 198             cred = cred->next;
 199         }
 200
 201         jsonStr = cJSON_PrintUnformatted(jsonRoot);
 202     }
 203
 204 exit:
 205     if (jsonRoot)
 206     {
 207         cJSON_Delete(jsonRoot);
 208     }
 209     return jsonStr;
 210 }
 211
 212 /*
 213  * This internal method converts JSON cred into binary cred.
 214  */
 215 OicSecCred_t * JSONToCredBin(const char * jsonStr)
 216 {
 217     OCStackResult ret = OC_STACK_ERROR;
 218     OicSecCred_t * headCred = NULL;
 219     OicSecCred_t * prevCred = NULL;
 220     cJSON *jsonCredArray = NULL;
 221
 222     cJSON *jsonRoot = cJSON_Parse(jsonStr);
 223     VERIFY_NON_NULL(TAG, jsonRoot, ERROR);
 224
 225     jsonCredArray = cJSON_GetObjectItem(jsonRoot, OIC_JSON_CRED_NAME);
 226     VERIFY_NON_NULL(TAG, jsonCredArray, ERROR);
 227     if (cJSON_Array == jsonCredArray->type)
 228     {
 229         int numCred = cJSON_GetArraySize(jsonCredArray);
 230         int idx = 0;
 231
 232         unsigned char base64Buff[sizeof(((OicUuid_t*)0)->id)] = {};
 233         uint32_t outLen = 0;
 234         B64Result b64Ret = B64_OK;
 235
 236         VERIFY_SUCCESS(TAG, numCred > 0, ERROR);
 237         do
 238         {
 239             cJSON *jsonCred = cJSON_GetArrayItem(jsonCredArray, idx);
 240             VERIFY_NON_NULL(TAG, jsonCred, ERROR);
 241
 242             OicSecCred_t *cred = (OicSecCred_t*)OICCalloc(1, sizeof(OicSecCred_t));
 243             VERIFY_NON_NULL(TAG, cred, ERROR);
 244
 245             headCred = (headCred) ? headCred : cred;
 246             if (prevCred)
 247             {
 248                 prevCred->next = cred;
 249             }
 250             size_t jsonObjLen = 0;
 251             cJSON *jsonObj = NULL;
 252
 253             //CredId -- Mandatory
 254             jsonObj = cJSON_GetObjectItem(jsonCred, OIC_JSON_CREDID_NAME);
 255             if(jsonObj)
 256             {
 257                 VERIFY_SUCCESS(TAG, cJSON_Number == jsonObj->type, ERROR);
 258                 cred->credId = jsonObj->valueint;
 259             }
 260
 261             //subject -- Mandatory
 262             jsonObj = cJSON_GetObjectItem(jsonCred, OIC_JSON_SUBJECT_NAME);
 263             VERIFY_NON_NULL(TAG, jsonObj, ERROR);
 264             VERIFY_SUCCESS(TAG, cJSON_String == jsonObj->type, ERROR);
 265             outLen = 0;
 266             memset(base64Buff, 0, sizeof(base64Buff));
 267             b64Ret = b64Decode(jsonObj->valuestring, strlen(jsonObj->valuestring),
 268                     base64Buff, sizeof(base64Buff), &outLen);
 269             VERIFY_SUCCESS(TAG, (b64Ret == B64_OK && outLen <= sizeof(cred->subject.id)),
 270                            ERROR);
 271             memcpy(cred->subject.id, base64Buff, outLen);
 272
 273             //CredType -- Mandatory
 274             jsonObj = cJSON_GetObjectItem(jsonCred, OIC_JSON_CREDTYPE_NAME);
 275             VERIFY_NON_NULL(TAG, jsonObj, ERROR);
 276             VERIFY_SUCCESS(TAG, cJSON_Number == jsonObj->type, ERROR);
 277             cred->credType = jsonObj->valueint;
 278
 279             //PrivateData is mandatory for some of the credential types listed below.
 280             jsonObj = cJSON_GetObjectItem(jsonCred, OIC_JSON_PRIVATEDATA_NAME);
 281             if ((cred->credType & SYMMETRIC_PAIR_WISE_KEY) ||
 282                 (cred->credType & SYMMETRIC_GROUP_KEY) ||
 283                 (cred->credType & PIN_PASSWORD))
 284             {
 285                 VERIFY_NON_NULL(TAG, jsonObj, ERROR);
 286                 VERIFY_SUCCESS(TAG, cJSON_String == jsonObj->type, ERROR);
 287             }
 288             if(jsonObj && cJSON_String == jsonObj->type)
 289             {
 290                 jsonObjLen = strlen(jsonObj->valuestring) + 1;
 291                 cred->privateData.data = (char *)OICMalloc(jsonObjLen);
 292                 VERIFY_NON_NULL(TAG, (cred->privateData.data), ERROR);
 293                 strncpy((char *)cred->privateData.data, (char *)jsonObj->valuestring, jsonObjLen);
 294             }
 295
 296             //Period -- Not Mandatory
 297             jsonObj = cJSON_GetObjectItem(jsonCred, OIC_JSON_PERIOD_NAME);
 298             if(jsonObj && cJSON_String == jsonObj->type)
 299             {
 300                 jsonObjLen = strlen(jsonObj->valuestring) + 1;
 301                 cred->period = (char *)OICMalloc(jsonObjLen);
 302                 VERIFY_NON_NULL(TAG, cred->period, ERROR);
 303                 strncpy(cred->period, jsonObj->valuestring, jsonObjLen);
 304             }
 305
 306             //Owners -- Mandatory
 307             jsonObj = cJSON_GetObjectItem(jsonCred, OIC_JSON_OWNERS_NAME);
 308             VERIFY_NON_NULL(TAG, jsonObj, ERROR);
 309             VERIFY_SUCCESS(TAG, cJSON_Array == jsonObj->type, ERROR)
 310             cred->ownersLen = cJSON_GetArraySize(jsonObj);
 311             VERIFY_SUCCESS(TAG, cred->ownersLen > 0, ERROR);
 312             cred->owners = (OicUuid_t*)OICCalloc(cred->ownersLen, sizeof(OicUuid_t));
 313             VERIFY_NON_NULL(TAG, (cred->owners), ERROR);
 314             for(size_t i = 0; i < cred->ownersLen; i++)
 315             {
 316                 cJSON *jsonOwnr = cJSON_GetArrayItem(jsonObj, i);
 317                 VERIFY_NON_NULL(TAG, jsonOwnr, ERROR);
 318                 VERIFY_SUCCESS(TAG, cJSON_String == jsonOwnr->type, ERROR);
 319                 outLen = 0;
 320                 memset(base64Buff, 0, sizeof(base64Buff));
 321                 b64Ret = b64Decode(jsonOwnr->valuestring, strlen(jsonOwnr->valuestring),
 322                          base64Buff, sizeof(base64Buff), &outLen);
 323                 VERIFY_SUCCESS(TAG, (b64Ret == B64_OK &&
 324                                outLen <= sizeof(cred->owners[i].id)), ERROR);
 325                 memcpy(cred->owners[i].id, base64Buff, outLen);
 326             }
 327             prevCred = cred;
 328         } while( ++idx < numCred);
 329     }
 330
 331     ret = OC_STACK_OK;
 332
 333 exit:
 334     cJSON_Delete(jsonRoot);
 335     if (OC_STACK_OK != ret)
 336     {
 337         DeleteCredList(headCred);
 338         headCred = NULL;
 339     }
 340     return headCred;
 341 }
 342
 343 /**
 344  * This function generates the bin credential data.
 345  *
 346  * @param subject pointer to subject of this credential.
 347  * @param credType credential type.
 348  * @param publicData public data such as public key.
 349  * @param privateData private data such as private key.
 350  *        The privateData is expected in base64 encoded format.
 351  * @param ownersLen length of owners array
 352  * @param owners array of owners.
 353  *
 354  * @retval
 355  *      pointer to instance of OicSecCred_t  - success
 356  *      NULL                                 - error
 357  */
 358 OicSecCred_t * GenerateCredential(const OicUuid_t * subject, OicSecCredType_t credType,
 359                                  const char * publicData, const char * privateData,
 360                                  size_t ownersLen, const OicUuid_t * owners)
 361 {
 362     OCStackResult ret = OC_STACK_ERROR;
 363
 364     OicSecCred_t *cred = (OicSecCred_t*)OICCalloc(1, sizeof(OicSecCred_t));
 365     VERIFY_NON_NULL(TAG, cred, ERROR);
 366
 367     //CredId is assigned before appending new cred to the existing
 368     //credential list and updating svr database in AddCredential().
 369     cred->credId = 0;
 370
 371     VERIFY_NON_NULL(TAG, subject, ERROR);
 372     memcpy(cred->subject.id, subject->id , sizeof(cred->subject.id));
 373
 374     VERIFY_SUCCESS(TAG, credType < (NO_SECURITY_MODE | SYMMETRIC_PAIR_WISE_KEY |
 375             SYMMETRIC_GROUP_KEY | ASYMMETRIC_KEY | SIGNED_ASYMMETRIC_KEY | PIN_PASSWORD), ERROR);
 376     cred->credType = credType;
 377
 378 #if 0
 379     if(publicData)
 380     {
 381         cred->publicData.data = (char *)OICMalloc(strlen(publicData)+1);
 382         VERIFY_NON_NULL(TAG, cred->publicData.data, ERROR);
 383         strncpy((char *)cred->publicData.data, publicData, strlen(publicData)+1);
 384     }
 385 #endif
 386
 387     if(privateData)
 388     {
 389         cred->privateData.data = (char *)OICMalloc(strlen(privateData)+1);
 390         VERIFY_NON_NULL(TAG, cred->privateData.data, ERROR);
 391         strncpy((char *)cred->privateData.data, privateData, strlen(privateData)+1);
 392     }
 393
 394     VERIFY_SUCCESS(TAG, ownersLen > 0, ERROR);
 395     cred->ownersLen = ownersLen;
 396
 397     cred->owners = (OicUuid_t*)OICCalloc(cred->ownersLen, sizeof(OicUuid_t));
 398     VERIFY_NON_NULL(TAG, cred->owners, ERROR);
 399     for(size_t i = 0; i < cred->ownersLen; i++)
 400     {
 401         memcpy(cred->owners[i].id, owners[i].id, sizeof(cred->owners[i].id));
 402     }
 403
 404     ret = OC_STACK_OK;
 405 exit:
 406     if (OC_STACK_OK != ret)
 407     {
 408         DeleteCredList(cred);
 409         cred = NULL;
 410     }
 411     return cred;
 412 }
 413
 414 static bool UpdatePersistentStorage(const OicSecCred_t *cred)
 415 {
 416     bool ret = false;
 417
 418     // Convert Cred data into JSON for update to persistent storage
 419     char *jsonStr = BinToCredJSON(cred);
 420     if (jsonStr)
 421     {
 422         cJSON *jsonCred = cJSON_Parse(jsonStr);
 423         OICFree(jsonStr);
 424
 425         if ((jsonCred) &&
 426           (OC_STACK_OK == UpdateSVRDatabase(OIC_JSON_CRED_NAME, jsonCred)))
 427         {
 428             ret = true;
 429         }
 430         cJSON_Delete(jsonCred );
 431     }
 432     else //Empty cred list
 433     {
 434         if (OC_STACK_OK == UpdateSVRDatabase(OIC_JSON_CRED_NAME, NULL))
 435         {
 436             ret = true;
 437         }
 438     }
 439     return ret;
 440 }
 441
 442 /**
 443  * Compare function used LL_SORT for sorting credentials
 444  *
 445  * @param first   pointer to OicSecCred_t struct
 446  * @param second  pointer to OicSecCred_t struct
 447  *
 448  *@retval
 449  *  -1    if credId of first is less than credId of second
 450  *   0    if credId of first is equal to credId of second
 451  *   1    if credId of first is greater than credId of second
 452  */
 453 static int CmpCredId(const OicSecCred_t * first, const OicSecCred_t *second)
 454 {
 455     if(first->credId < second->credId)
 456     {
 457         return -1;
 458     }
 459     else if(first->credId > second->credId)
 460     {
 461         return 1;
 462     }
 463     else
 464         return 0;
 465 }
 466
 467 /**
 468  * GetCredId goes through the cred list and returns the next
 469  * available credId. The next credId could be the credId that is
 470  * available due deletion of OicSecCred_t object or one more than
 471  * credId of last credential in the list.
 472  *
 473  * @retval
 474  *      next available credId  - success
 475  *      0                      - error
 476  */
 477
 478 static uint16_t GetCredId()
 479 {
 480     //Sorts credential list in incremental order of credId
 481     LL_SORT(gCred, CmpCredId);
 482
 483
 484     OicSecCred_t *currentCred = NULL, *credTmp = NULL;
 485     uint16_t nextCredId = 1;
 486
 487     LL_FOREACH_SAFE(gCred, currentCred, credTmp)
 488     {
 489         if(currentCred->credId == nextCredId)
 490         {
 491             nextCredId += 1;
 492         }
 493         else
 494         {
 495             break;
 496         }
 497     }
 498
 499     VERIFY_SUCCESS(TAG, nextCredId < UINT16_MAX, ERROR);
 500     return nextCredId;
 501
 502 exit:
 503     return 0;
 504 }
 505
 506
 507 /**
 508  * This function adds the new cred to the credential list.
 509  *
 510  * @param cred pointer to new credential.
 511  *
 512  * @retval
 513  *      OC_STACK_OK     - cred not NULL and persistent storage gets updated
 514  *      OC_STACK_ERROR  - cred is NULL or fails to update persistent storage
 515  */
 516 OCStackResult AddCredential(OicSecCred_t * newCred)
 517 {
 518     OCStackResult ret = OC_STACK_ERROR;
 519     char * jsonStr = NULL;
 520
 521     VERIFY_SUCCESS(TAG, NULL != newCred, ERROR);
 522
 523     //Assigning credId to the newCred
 524     newCred->credId = GetCredId();
 525
 526     VERIFY_SUCCESS(TAG, newCred->credId != 0, ERROR);
 527
 528     //Append the new Cred to existing list
 529     LL_APPEND(gCred, newCred);
 530
 531     if(UpdatePersistentStorage(gCred))
 532     {
 533         ret = OC_STACK_OK;
 534     }
 535
 536 exit:
 537     return ret;
 538 }
 539
 540 OCStackResult RemoveCredential(const OicUuid_t *subject)
 541 {
 542     OCStackResult ret = OC_STACK_ERROR;
 543     OicSecCred_t *cred = NULL;
 544     OicSecCred_t *tempCred = NULL;
 545     bool deleteFlag = false;
 546
 547     LL_FOREACH_SAFE(gCred, cred, tempCred)
 548     {
 549         if(memcmp(cred->subject.id, subject->id, sizeof(subject->id)) == 0)
 550         {
 551             LL_DELETE(gCred, cred);
 552             FreeCred(cred);
 553             deleteFlag = 1;
 554         }
 555     }
 556
 557     if(deleteFlag)
 558     {
 559         if(UpdatePersistentStorage(gCred))
 560         {
 561             ret = OC_STACK_RESOURCE_DELETED;
 562         }
 563     }
 564     return ret;
 565
 566 }
 567
 568 static OCEntityHandlerResult HandlePostRequest(const OCEntityHandlerRequest * ehRequest)
 569 {
 570     OCEntityHandlerResult ret = OC_EH_ERROR;
 571
 572     //Get binary representation of json
 573     OicSecCred_t * cred  = JSONToCredBin(((OCSecurityPayload*)ehRequest->payload)->securityData);
 574
 575     if(cred)
 576     {
 577         //If the Post request credential has credId, it will be
 578         //discarded and the next available credId will be assigned
 579         //to it before getting appended to the existing credential
 580         //list and updating svr database.
 581         ret = (OC_STACK_OK == AddCredential(cred))? OC_EH_RESOURCE_CREATED : OC_EH_ERROR;
 582     }
 583
 584     return ret;
 585 }
 586
 587 static OCEntityHandlerResult HandleDeleteRequest(const OCEntityHandlerRequest *ehRequest)
 588 {
 589     OC_LOG_V (INFO, TAG, PCF("Processing CredDeleteRequest"));
 590
 591     OCEntityHandlerResult ehRet = OC_EH_ERROR;
 592
 593     if(NULL == ehRequest->query)
 594    {
 595        return ehRet;
 596    }
 597
 598    OicParseQueryIter_t parseIter = {.attrPos=NULL};
 599    OicUuid_t subject = {.id={0}};
 600
 601    //Parsing REST query to get the subject
 602    ParseQueryIterInit((unsigned char *)ehRequest->query, &parseIter);
 603    while(GetNextQuery(&parseIter))
 604    {
 605        if(strncasecmp((char *)parseIter.attrPos, OIC_JSON_SUBJECT_NAME,
 606                parseIter.attrLen) == 0)
 607        {
 608            unsigned char base64Buff[sizeof(((OicUuid_t*)0)->id)] = {};
 609            uint32_t outLen = 0;
 610            B64Result b64Ret = B64_OK;
 611
 612            b64Ret = b64Decode((char *)parseIter.valPos, parseIter.valLen,
 613                    base64Buff, sizeof(base64Buff), &outLen);
 614
 615            VERIFY_SUCCESS(TAG, (b64Ret == B64_OK && outLen <= sizeof(subject.id)), ERROR);
 616            memcpy(subject.id, base64Buff, outLen);
 617        }
 618    }
 619
 620    if(OC_STACK_RESOURCE_DELETED == RemoveCredential(&subject))
 621    {
 622        ehRet = OC_EH_RESOURCE_DELETED;
 623    }
 624
 625 exit:
 626     return ehRet;
 627 }
 628
 629
 630 /*
 631  * This internal method is the entity handler for Cred resources
 632  * to handle REST request (PUT/POST/DEL)
 633  */
 634 OCEntityHandlerResult CredEntityHandler (OCEntityHandlerFlag flag,
 635                                         OCEntityHandlerRequest * ehRequest,
 636                                         void* callbackParameter)
 637 {
 638     OCEntityHandlerResult ret = OC_EH_ERROR;
 639
 640     if(!ehRequest)
 641     {
 642         return OC_EH_ERROR;
 643     }
 644     if (flag & OC_REQUEST_FLAG)
 645     {
 646         OC_LOG (INFO, TAG, PCF("Flag includes OC_REQUEST_FLAG"));
 647         //TODO :  Handle PUT/DEL methods
 648         switch(ehRequest->method)
 649         {
 650             case OC_REST_GET:
 651                 ret = OC_EH_FORBIDDEN;
 652                 break;
 653             case OC_REST_POST:
 654                 ret = HandlePostRequest(ehRequest);
 655                 break;
 656             case OC_REST_DELETE:
 657                 ret = HandleDeleteRequest(ehRequest);
 658                 break;
 659             default:
 660                 ret = OC_EH_ERROR;
 661                 break;
 662         }
 663     }
 664
 665     //Send payload to request originator
 666     ret = (SendSRMResponse(ehRequest, ret, NULL) == OC_STACK_OK ?
 667                        ret : OC_EH_ERROR);
 668
 669     return ret;
 670 }
 671
 672 /*
 673  * This internal method is used to create '/oic/sec/Cred' resource.
 674  */
 675 OCStackResult CreateCredResource()
 676 {
 677     OCStackResult ret;
 678
 679     ret = OCCreateResource(&gCredHandle,
 680                            OIC_RSRC_TYPE_SEC_CRED,
 681                            OIC_MI_DEF,
 682                            OIC_RSRC_CRED_URI,
 683                            CredEntityHandler,
 684                            NULL,
 685                            OC_RES_PROP_NONE);
 686
 687     if (OC_STACK_OK != ret)
 688     {
 689         OC_LOG (FATAL, TAG, PCF("Unable to instantiate Cred resource"));
 690         DeInitCredResource();
 691     }
 692     return ret;
 693 }
 694
 695 /**
 696  * Get the default value
 697  * @retval  NULL for now. Update it when we finalize the default info.
 698  */
 699 static OicSecCred_t* GetCredDefault()
 700 {
 701     return NULL;
 702 }
 703
 704 /**
 705  * Initialize Cred resource by loading data from persistent storage.
 706  *
 707  * @retval
 708  *     OC_STACK_OK    - no errors
 709  *     OC_STACK_ERROR - stack process error
 710  */
 711 OCStackResult InitCredResource()
 712 {
 713     OCStackResult ret = OC_STACK_ERROR;
 714
 715     //Read Cred resource from PS
 716     char* jsonSVRDatabase = GetSVRDatabase();
 717
 718     if (jsonSVRDatabase)
 719     {
 720         //Convert JSON Cred into binary format
 721         gCred = JSONToCredBin(jsonSVRDatabase);
 722     }
 723     /*
 724      * If SVR database in persistent storage got corrupted or
 725      * is not available for some reason, a default Cred is created
 726      * which allows user to initiate Cred provisioning again.
 727      */
 728     if (!jsonSVRDatabase || !gCred)
 729     {
 730         gCred = GetCredDefault();
 731     }
 732     //Instantiate 'oic.sec.cred'
 733     ret = CreateCredResource();
 734     OICFree(jsonSVRDatabase);
 735     return ret;
 736 }
 737
 738 /**
 739  * Perform cleanup for Cred resources.
 740  *
 741  * @return
 742  *     OC_STACK_OK              - no errors
 743  *     OC_STACK_ERROR           - stack process error
 744  *     OC_STACK_NO_RESOURCE     - resource not found
 745  *     OC_STACK_INVALID_PARAM   - invalid param
 746  */
 747 OCStackResult DeInitCredResource()
 748 {
 749     OCStackResult result = OCDeleteResource(gCredHandle);
 750     DeleteCredList(gCred);
 751     gCred = NULL;
 752     return result;
 753 }
 754
 755 /**
 756  * This method is used by tinydtls/SRM to retrieve credential for given Subject.
 757  *
 758  * @param subject - subject for which credential is required.
 759  *
 760  * @retval
 761  *     reference to OicSecCred_t - if credential is found
 762  *     NULL                      - if credential not found
 763  */
 764 const OicSecCred_t* GetCredResourceData(const OicUuid_t* subject)
 765 {
 766     OicSecCred_t *cred = NULL;
 767
 768    if ( NULL == subject)
 769     {
 770        return NULL;
 771     }
 772
 773     LL_FOREACH(gCred, cred)
 774     {
 775         if(memcmp(cred->subject.id, subject->id, sizeof(subject->id)) == 0)
 776         {
 777             return cred;
 778         }
 779     }
 780     return NULL;
 781 }
 782
 783
 784 #if defined(__WITH_DTLS__)
 785 /**
 786  * This internal callback is used by lower stack (i.e. CA layer) to
 787  * retrieve PSK credentials from RI security layer.
 788  *
 789  * Note: When finished, caller should initialize memory to zeros and
 790  * invoke OICFree to delete @p credInfo.
 791  *
 792  * @param credInfo
 793  *     binary blob containing PSK credentials
 794  *
 795  * @retval none
 796  */
 797 void GetDtlsPskCredentials(CADtlsPskCredsBlob_t **credInfo)
 798 {
 799     CADtlsPskCredsBlob_t * caBlob = NULL;
 800     if(credInfo)
 801     {
 802         caBlob = (CADtlsPskCredsBlob_t *)OICCalloc(sizeof(CADtlsPskCredsBlob_t), 1);
 803         if (caBlob)
 804         {
 805             OicUuid_t deviceID = {};
 806
 807             // Retrieve Device ID from doxm resource and copy in PSK creds blob
 808             VERIFY_SUCCESS(TAG, GetDoxmDeviceID(&deviceID) == OC_STACK_OK, ERROR);
 809             memcpy(caBlob->identity, deviceID.id, sizeof(caBlob->identity));
 810
 811             OicSecCred_t *cred = NULL;
 812             size_t count = 0;
 813             LL_FOREACH(gCred, cred)
 814             {
 815                 // Currently, Iotivity supports only symmetric pair wise key credentials
 816                 if (cred->credType == SYMMETRIC_PAIR_WISE_KEY)
 817                 {
 818                     ++count;
 819                 }
 820             }
 821             caBlob->num = count;
 822             if (caBlob->num)
 823             {
 824                 caBlob->creds =
 825                     (OCDtlsPskCreds*) OICMalloc(caBlob->num * sizeof(OCDtlsPskCreds));
 826                 VERIFY_NON_NULL(TAG, caBlob->creds, ERROR);
 827
 828                 unsigned int i = 0;
 829                 LL_FOREACH(gCred, cred)
 830                 {
 831                     if ((cred->credType == SYMMETRIC_PAIR_WISE_KEY) &&
 832                             (i < count))
 833
 834                     {
 835                         // Copy subject ID
 836                         memcpy(caBlob->creds[i].id, cred->subject.id,
 837                                 sizeof(caBlob->creds[i].id));
 838
 839                         // Convert PSK from JSON to binary before copying
 840                         uint32_t outLen = 0;
 841                         B64Result b64Ret = b64Decode(cred->privateData.data,
 842                                 strlen(cred->privateData.data), caBlob->creds[i].psk,
 843                                 sizeof(caBlob->creds[i].psk), &outLen);
 844                         VERIFY_SUCCESS(TAG, b64Ret == B64_OK, ERROR);
 845                         i++;
 846                     }
 847                 }
 848             }
 849         }
 850         *credInfo = caBlob;
 851         // Return from here after making the credential list
 852         return;
 853     }
 854
 855 exit:
 856     if (caBlob)
 857     {
 858         memset(caBlob->creds, 0, caBlob->num * sizeof(OCDtlsPskCreds));
 859         OICFree(caBlob->creds);
 860     }
 861     OICFree(caBlob);
 862 }
 863 #endif /* __WITH_DTLS__ */