Prepare service for database corruption handling

[platform/core/security/cynara.git] / src / service / logic / Logic.cpp

diff --git a/src/service/logic/Logic.cpp b/src/service/logic/Logic.cpp
index 5e3f82a..a6e3c12 100644 (file)
--- a/src/service/logic/Logic.cpp
+++ b/src/service/logic/Logic.cpp
@@ -16,6 +16,8 @@
 /**
  * @file        src/service/logic/Logic.cpp
  * @author      Lukasz Wojciechowski <l.wojciechow@partner.samsung.com>
+ * @author      Zofia Abramowska <z.abramowska@samsung.com>
+ * @author      Pawel Wieczorek <p.wieczorek2@samsung.com>
  * @version     1.0
  * @brief       This file implements main class of logic layer in cynara service
  */
@@ -51,6 +53,7 @@
 #include <request/RequestContext.h>
 #include <request/SetPoliciesRequest.h>
 #include <request/SignalRequest.h>
+#include <request/SimpleCheckRequest.h>
 #include <response/AdminCheckResponse.h>
 #include <response/AgentRegisterResponse.h>
 #include <response/CancelResponse.h>
@@ -58,6 +61,7 @@
 #include <response/CodeResponse.h>
 #include <response/DescriptionListResponse.h>
 #include <response/ListResponse.h>
+#include <response/SimpleCheckResponse.h>
 #include <types/Policy.h>
 
 #include <main/Cynara.h>
@@ -73,7 +77,7 @@
 
 namespace Cynara {
 
-Logic::Logic() {
+Logic::Logic() : m_dbCorrupted(false) {
 }
 
 Logic::~Logic() {
@@ -93,15 +97,20 @@ void Logic::execute(RequestContextPtr context UNUSED, SignalRequestPtr request)
 void Logic::execute(RequestContextPtr context, AdminCheckRequestPtr request) {
     PolicyResult result;
     bool bucketValid = true;
-    try {
-        result = m_storage->checkPolicy(request->key(), request->startBucket(),
-                                        request->recursive());
-    } catch (const BucketNotExistsException &ex) {
+
+    if (m_dbCorrupted) {
         bucketValid = false;
+    } else {
+        try {
+            result = m_storage->checkPolicy(request->key(), request->startBucket(),
+                                            request->recursive());
+        } catch (const BucketNotExistsException &ex) {
+            bucketValid = false;
+        }
     }
 
     context->returnResponse(context, std::make_shared<AdminCheckResponse>(result, bucketValid,
-                            request->sequenceNumber()));
+                            m_dbCorrupted, request->sequenceNumber()));
 }
 
 void Logic::execute(RequestContextPtr context, AgentActionRequestPtr request) {
@@ -166,6 +175,7 @@ void Logic::execute(RequestContextPtr context, CancelRequestPtr request) {
 void Logic::execute(RequestContextPtr context, CheckRequestPtr request) {
     PolicyResult result(PredefinedPolicyType::DENY);
     if (check(context, request->key(), request->sequenceNumber(), result)) {
+        m_auditLog.log(request->key(), result);
         context->returnResponse(context, std::make_shared<CheckResponse>(result,
                                 request->sequenceNumber()));
     }
@@ -179,7 +189,7 @@ bool Logic::check(const RequestContextPtr &context, const PolicyKey &key,
         return false;
     }
 
-    result = m_storage->checkPolicy(key);
+    result = (m_dbCorrupted ? PredefinedPolicyType::DENY : m_storage->checkPolicy(key));
 
     switch (result.policyType()) {
         case PredefinedPolicyType::ALLOW :
@@ -207,8 +217,9 @@ bool Logic::pluginCheck(const RequestContextPtr &context, const PolicyKey &key,
 
     ServicePluginInterfacePtr servicePlugin =
             std::dynamic_pointer_cast<ServicePluginInterface>(plugin);
-    if (!plugin) {
-        throw PluginNotFoundException(result);
+    if (!servicePlugin) {
+        result = PolicyResult(PredefinedPolicyType::DENY);
+        return true;
     }
 
     AgentType requiredAgent;
@@ -240,7 +251,8 @@ bool Logic::pluginCheck(const RequestContextPtr &context, const PolicyKey &key,
             }
             return false;
         default:
-            throw PluginErrorException(key); // This 'throw' should be removed or handled properly.
+            result = PolicyResult(PredefinedPolicyType::DENY);
+            return true;
     }
 }
 
@@ -267,6 +279,7 @@ bool Logic::update(const PolicyKey &key, ProtocolFrameSequenceNumber checkId,
     }
 
     if (answerReady && context->responseQueue()) {
+        m_auditLog.log(key, result);
         context->returnResponse(context, std::make_shared<CheckResponse>(result, checkId));
         return true;
     }
@@ -279,19 +292,23 @@ void Logic::execute(RequestContextPtr context, DescriptionListRequestPtr request
     descriptions.insert(descriptions.begin(), predefinedPolicyDescr.begin(),
                         predefinedPolicyDescr.end());
     context->returnResponse(context, std::make_shared<DescriptionListResponse>(descriptions,
-                            request->sequenceNumber()));
+                            m_dbCorrupted, request->sequenceNumber()));
 }
 
 void Logic::execute(RequestContextPtr context, EraseRequestPtr request) {
     auto code = CodeResponse::Code::OK;
 
-    try {
-        m_storage->erasePolicies(request->startBucket(), request->recursive(), request->filter());
-        onPoliciesChanged();
-    } catch (const DatabaseException &ex) {
-        code = CodeResponse::Code::FAILED;
-    } catch (const BucketNotExistsException &ex) {
-        code = CodeResponse::Code::NO_BUCKET;
+    if (m_dbCorrupted) {
+        code = CodeResponse::Code::DB_CORRUPTED;
+    } else {
+        try {
+            m_storage->erasePolicies(request->startBucket(), request->recursive(), request->filter());
+            onPoliciesChanged();
+        } catch (const DatabaseException &ex) {
+            code = CodeResponse::Code::FAILED;
+        } catch (const BucketNotExistsException &ex) {
+            code = CodeResponse::Code::NO_BUCKET;
+        }
     }
 
     context->returnResponse(context, std::make_shared<CodeResponse>(code,
@@ -301,18 +318,22 @@ void Logic::execute(RequestContextPtr context, EraseRequestPtr request) {
 void Logic::execute(RequestContextPtr context, InsertOrUpdateBucketRequestPtr request) {
     auto code = CodeResponse::Code::OK;
 
-    try {
-        checkSinglePolicyType(request->result().policyType(), true, true);
-        m_storage->addOrUpdateBucket(request->bucketId(), request->result());
-        onPoliciesChanged();
-    } catch (const DatabaseException &ex) {
-        code = CodeResponse::Code::FAILED;
-    } catch (const DefaultBucketSetNoneException &ex) {
-        code = CodeResponse::Code::NOT_ALLOWED;
-    } catch (const InvalidBucketIdException &ex) {
-        code = CodeResponse::Code::NOT_ALLOWED;
-    } catch (const UnknownPolicyTypeException &ex) {
-        code = CodeResponse::Code::NO_POLICY_TYPE;
+    if (m_dbCorrupted) {
+        code = CodeResponse::Code::DB_CORRUPTED;
+    } else {
+        try {
+            checkSinglePolicyType(request->result().policyType(), true, true);
+            m_storage->addOrUpdateBucket(request->bucketId(), request->result());
+            onPoliciesChanged();
+        } catch (const DatabaseException &ex) {
+            code = CodeResponse::Code::FAILED;
+        } catch (const DefaultBucketSetNoneException &ex) {
+            code = CodeResponse::Code::NOT_ALLOWED;
+        } catch (const InvalidBucketIdException &ex) {
+            code = CodeResponse::Code::NOT_ALLOWED;
+        } catch (const UnknownPolicyTypeException &ex) {
+            code = CodeResponse::Code::NO_POLICY_TYPE;
+        }
     }
 
     context->returnResponse(context, std::make_shared<CodeResponse>(code,
@@ -321,52 +342,123 @@ void Logic::execute(RequestContextPtr context, InsertOrUpdateBucketRequestPtr re
 
 void Logic::execute(RequestContextPtr context, ListRequestPtr request) {
     bool bucketValid = true;
-
     std::vector<Policy> policies;
-    try {
-        policies = m_storage->listPolicies(request->bucket(), request->filter());
-    } catch (const BucketNotExistsException &ex) {
+
+    if (m_dbCorrupted) {
         bucketValid = false;
+    } else {
+        try {
+            policies = m_storage->listPolicies(request->bucket(), request->filter());
+        } catch (const BucketNotExistsException &ex) {
+            bucketValid = false;
+        }
     }
 
     context->returnResponse(context, std::make_shared<ListResponse>(policies, bucketValid,
-                            request->sequenceNumber()));
+                            m_dbCorrupted, request->sequenceNumber()));
 }
 
 void Logic::execute(RequestContextPtr context, RemoveBucketRequestPtr request) {
     auto code = CodeResponse::Code::OK;
-    try {
-        m_storage->deleteBucket(request->bucketId());
-        onPoliciesChanged();
-    } catch (const DatabaseException &ex) {
-        code = CodeResponse::Code::FAILED;
-    } catch (const BucketNotExistsException &ex) {
-        code = CodeResponse::Code::NO_BUCKET;
-    } catch (const DefaultBucketDeletionException &ex) {
-        code = CodeResponse::Code::NOT_ALLOWED;
+
+    if (m_dbCorrupted) {
+        code = CodeResponse::Code::DB_CORRUPTED;
+    } else {
+        try {
+            m_storage->deleteBucket(request->bucketId());
+            onPoliciesChanged();
+        } catch (const DatabaseException &ex) {
+            code = CodeResponse::Code::FAILED;
+        } catch (const BucketNotExistsException &ex) {
+            code = CodeResponse::Code::NO_BUCKET;
+        } catch (const DefaultBucketDeletionException &ex) {
+            code = CodeResponse::Code::NOT_ALLOWED;
+        }
     }
+
     context->returnResponse(context, std::make_shared<CodeResponse>(code,
                             request->sequenceNumber()));
 }
 
 void Logic::execute(RequestContextPtr context, SetPoliciesRequestPtr request) {
     auto code = CodeResponse::Code::OK;
-    try {
-        checkPoliciesTypes(request->policiesToBeInsertedOrUpdated(), true, false);
-        m_storage->insertPolicies(request->policiesToBeInsertedOrUpdated());
-        m_storage->deletePolicies(request->policiesToBeRemoved());
-        onPoliciesChanged();
-    } catch (const DatabaseException &ex) {
-        code = CodeResponse::Code::FAILED;
-    } catch (const BucketNotExistsException &ex) {
-        code = CodeResponse::Code::NO_BUCKET;
-    } catch (const UnknownPolicyTypeException &ex) {
-        code = CodeResponse::Code::NO_POLICY_TYPE;
+
+    if (m_dbCorrupted) {
+        code = CodeResponse::Code::DB_CORRUPTED;
+    } else {
+        try {
+            checkPoliciesTypes(request->policiesToBeInsertedOrUpdated(), true, false);
+            m_storage->insertPolicies(request->policiesToBeInsertedOrUpdated());
+            m_storage->deletePolicies(request->policiesToBeRemoved());
+            onPoliciesChanged();
+        } catch (const DatabaseException &ex) {
+            code = CodeResponse::Code::FAILED;
+        } catch (const BucketNotExistsException &ex) {
+            code = CodeResponse::Code::NO_BUCKET;
+        } catch (const UnknownPolicyTypeException &ex) {
+            code = CodeResponse::Code::NO_POLICY_TYPE;
+        }
     }
+
     context->returnResponse(context, std::make_shared<CodeResponse>(code,
                             request->sequenceNumber()));
 }
 
+void Logic::execute(RequestContextPtr context, SimpleCheckRequestPtr request) {
+    int retValue = CYNARA_API_SUCCESS;
+    PolicyResult result;
+    PolicyKey key = request->key();
+    result = m_storage->checkPolicy(key);
+
+    switch (result.policyType()) {
+    case PredefinedPolicyType::ALLOW:
+        LOGD("simple check of policy key <%s> returned ALLOW", key.toString().c_str());
+        break;
+    case PredefinedPolicyType::DENY:
+        LOGD("simple check of policy key <%s> returned DENY", key.toString().c_str());
+        break;
+    default: {
+        ExternalPluginPtr plugin = m_pluginManager->getPlugin(result.policyType());
+        if (!plugin) {
+            LOGE("Plugin not found for policy: [0x%x]", result.policyType());
+            result = PolicyResult(PredefinedPolicyType::DENY);
+            retValue = CYNARA_API_SUCCESS;
+            break;
+        }
+
+        ServicePluginInterfacePtr servicePlugin =
+                std::dynamic_pointer_cast<ServicePluginInterface>(plugin);
+        if (!servicePlugin) {
+            LOGE("Couldn't cast plugin pointer to ServicePluginInterface");
+            result = PolicyResult(PredefinedPolicyType::DENY);
+            retValue = CYNARA_API_SUCCESS;
+            break;
+        }
+
+        AgentType requiredAgent;
+        PluginData pluginData;
+        auto ret = servicePlugin->check(key.client().toString(), key.user().toString(),
+                                        key.privilege().toString(), result, requiredAgent,
+                                        pluginData);
+        switch (ret) {
+        case ServicePluginInterface::PluginStatus::ANSWER_READY:
+            LOGD("simple check of policy key <%s> in plugin returned [" PRIu16 "]",
+                 key.toString().c_str(), result.policyType());
+            break;
+        case ServicePluginInterface::PluginStatus::ANSWER_NOTREADY:
+            retValue = CYNARA_API_ACCESS_NOT_RESOLVED;
+            break;
+        default:
+            result = PolicyResult(PredefinedPolicyType::DENY);
+            retValue = CYNARA_API_SUCCESS;
+        }
+    }
+    }
+    m_auditLog.log(request->key(), result);
+    context->returnResponse(context, std::make_shared<SimpleCheckResponse>(retValue, result,
+                                                                  request->sequenceNumber()));
+}
+
 void Logic::checkPoliciesTypes(const std::map<PolicyBucketId, std::vector<Policy>> &policies,
                                bool allowBucket, bool allowNone) {
     for (const auto &group : policies) {
@@ -417,6 +509,7 @@ void Logic::handleAgentTalkerDisconnection(const AgentTalkerPtr &agentTalkerPtr)
 
     if (!checkContextPtr->cancelled() && checkContextPtr->m_requestContext->responseQueue()) {
         PolicyResult result(PredefinedPolicyType::DENY);
+        m_auditLog.log(checkContextPtr->m_key, result);
         checkContextPtr->m_requestContext->returnResponse(checkContextPtr->m_requestContext,
                 std::make_shared<CheckResponse>(result, checkContextPtr->m_checkId));
     }