[IOT-1595] Change Policy Engine to us ACE Union behavior.
authorNathan Heldt-Sheller <nathan.heldt-sheller@intel.com>
Wed, 23 Nov 2016 20:20:52 +0000 (12:20 -0800)
committerRandeep Singh <randeep.s@samsung.com>
Thu, 24 Nov 2016 07:05:06 +0000 (07:05 +0000)
commit6678ceb51b2b9411cab88a5d031a71d4bc97199a
treeb5735a553eca3149b7dfcab08fad16578bdef5b6
parente6911f6be4fbfd2d32426348e8f84c450d9f591c
[IOT-1595] Change Policy Engine to us ACE Union behavior.

The current Policy Engine logic is to assess the permissions on the first matching ACE for a
request (matched via Subject and Resource), and respond to the request (Grant or Deny) based on
that ACE.

The new OCF 1.0 behavior specifies that if any ACE allows a request, it should be Granted (so-called "Union" behavior).

To allow consistency we must fix this in 1.2.1.

This patch changes the Policy Engine to keep searching for an ACE that Grants the request,
until either the request is granted, or the end of the ACL is reached.

Change-Id: Idd4e90c37c7e0fcf963105b34b3e82dfde2ccfd2
Signed-off-by: Nathan Heldt-Sheller <nathan.heldt-sheller@intel.com>
Reviewed-on: https://gerrit.iotivity.org/gerrit/14701
Reviewed-by: Kevin Kane <kkane@microsoft.com>
Tested-by: jenkins-iotivity <jenkins-iotivity@opendaylight.org>
Reviewed-by: Greg Zaverucha <gregz@microsoft.com>
(cherry picked from commit 9524976da93a87f1b74e550a672a431e63e858f3)
Reviewed-on: https://gerrit.iotivity.org/gerrit/14717
Reviewed-by: Randeep Singh <randeep.s@samsung.com>
resource/csdk/security/include/internal/policyengine.h
resource/csdk/security/src/amsmgr.c
resource/csdk/security/src/policyengine.c
resource/csdk/security/unittest/policyengine.cpp