Remove restrict mechanism.

Restrict mechanism will be replaced with ACL (access control list).

Change-Id: I383d6ff1a74d15189c6219e8c800c7a992a71537

diff --git a/src/include/ckm/ckm-type.h b/src/include/ckm/ckm-type.h
index cac447a..a5e038d 100644 (file)
--- a/src/include/ckm/ckm-type.h
+++ b/src/include/ckm/ckm-type.h
@@ -61,15 +61,13 @@ enum class CertificateFieldId : int {
 };
 
 struct Policy {
-    Policy(const Password &pass = Password(), bool extract = true, bool rest = false)
+    Policy(const Password &pass = Password(), bool extract = true)
       : password(pass)
       , extractable(extract)
-      , restricted(rest)
     {}
     virtual ~Policy(){}
     Password password;  // byte array used to encrypt data inside CKM
-    bool extractable;  // if true key may be extracted from storage
-    bool restricted;   // if true only key owner may see data
+    bool extractable;   // if true key may be extracted from storage
 };
 
 // Added by Dongsun Lee

diff --git a/src/include/ckmc/ckmc-type.h b/src/include/ckmc/ckmc-type.h
index 709d13f..9011d37 100644 (file)
--- a/src/include/ckmc/ckmc-type.h
+++ b/src/include/ckmc/ckmc-type.h
@@ -105,7 +105,6 @@ typedef struct __ckmc_raw_buff {
 typedef struct __ckmc_policy {
        char* password;   /**< Byte array used to encrypt data inside CKM. If it is not null, the data(or key, or certificate) is stored encrypted with this password inside key manager */
        bool extractable; /**< If true key may be extracted from storage */
-       bool restricted;  /**< If true only key owner may see data */
 } ckmc_policy_s;
 
 /**

diff --git a/src/manager/client-capi/ckmc-manager.cpp b/src/manager/client-capi/ckmc-manager.cpp
index 8a1233f..77819c0 100644 (file)
--- a/src/manager/client-capi/ckmc-manager.cpp
+++ b/src/manager/client-capi/ckmc-manager.cpp
@@ -94,7 +94,7 @@ int ckmc_save_key(const char *alias, const ckmc_key_s key, const ckmc_policy_s p
         return CKMC_ERROR_INVALID_FORMAT;
     }
 
-    CKM::Policy storePolicy(_tostring(policy.password), policy.extractable, policy.restricted);
+    CKM::Policy storePolicy(_tostring(policy.password), policy.extractable);
 
     int ret =  mgr->saveKey(ckmAlias, ckmKey, storePolicy);
     return to_ckmc_error(ret);
@@ -193,7 +193,7 @@ int ckmc_save_cert(const char *alias, const ckmc_cert_s cert, const ckmc_policy_
         return CKMC_ERROR_INVALID_FORMAT;
     }
 
-    CKM::Policy storePolicy(_tostring(policy.password), policy.extractable, policy.restricted);
+    CKM::Policy storePolicy(_tostring(policy.password), policy.extractable);
 
     CKM::ManagerShPtr mgr = CKM::Manager::create();
     int ret = mgr->saveCertificate(ckmAlias, ckmCert, storePolicy);
@@ -288,7 +288,7 @@ int ckmc_save_data(const char *alias, ckmc_raw_buffer_s data, const ckmc_policy_
     }
     CKM::RawBuffer buffer(data.data, data.data + data.size);
 
-    CKM::Policy storePolicy(_tostring(policy.password), policy.extractable, policy.restricted);
+    CKM::Policy storePolicy(_tostring(policy.password), policy.extractable);
 
     CKM::ManagerShPtr mgr = CKM::Manager::create();
     int ret = mgr->saveData(ckmAlias, buffer, storePolicy);
@@ -385,8 +385,8 @@ int ckmc_create_key_pair_rsa(const size_t size,
 
     CKM::Alias ckmPrivakeKeyAlias(private_key_alias);
     CKM::Alias ckmPublicKeyAlias(public_key_alias);
-    CKM::Policy ckmPrivateKeyPolicy(_tostring(policy_private_key.password), policy_private_key.extractable, policy_private_key.restricted);
-    CKM::Policy ckmPublicKeyPolicy(_tostring(policy_public_key.password), policy_public_key.extractable, policy_public_key.restricted);
+    CKM::Policy ckmPrivateKeyPolicy(_tostring(policy_private_key.password), policy_private_key.extractable);
+    CKM::Policy ckmPublicKeyPolicy(_tostring(policy_public_key.password), policy_public_key.extractable);
 
     ret = mgr->createKeyPairRSA(size, ckmPrivakeKeyAlias, ckmPublicKeyAlias, ckmPrivateKeyPolicy, ckmPublicKeyPolicy);
     return to_ckmc_error(ret);
@@ -408,8 +408,8 @@ int ckmc_create_key_pair_ecdsa(const ckmc_ec_type_e type,
     CKM::ElipticCurve ckmType = static_cast<CKM::ElipticCurve>(static_cast<int>(type));
     CKM::Alias ckmPrivakeKeyAlias(private_key_alias);
     CKM::Alias ckmPublicKeyAlias(public_key_alias);
-    CKM::Policy ckmPrivateKeyPolicy(_tostring(policy_private_key.password), policy_private_key.extractable, policy_private_key.restricted);
-    CKM::Policy ckmPublicKeyPolicy(_tostring(policy_public_key.password), policy_public_key.extractable, policy_public_key.restricted);
+    CKM::Policy ckmPrivateKeyPolicy(_tostring(policy_private_key.password), policy_private_key.extractable);
+    CKM::Policy ckmPublicKeyPolicy(_tostring(policy_public_key.password), policy_public_key.extractable);
 
     int ret = mgr->createKeyPairECDSA(ckmType, ckmPrivakeKeyAlias, ckmPublicKeyAlias, ckmPrivateKeyPolicy, ckmPublicKeyPolicy);
     return to_ckmc_error(ret);

diff --git a/src/manager/common/protocols.cpp b/src/manager/common/protocols.cpp
index d4fc5d4..ed94794 100644 (file)
--- a/src/manager/common/protocols.cpp
+++ b/src/manager/common/protocols.cpp
@@ -70,13 +70,11 @@ PolicySerializable::PolicySerializable(const Policy &policy)
 PolicySerializable::PolicySerializable(IStream &stream) {
     Deserialization::Deserialize(stream, password);
     Deserialization::Deserialize(stream, extractable);
-    Deserialization::Deserialize(stream, restricted);
 }
 
 void PolicySerializable::Serialize(IStream &stream) const {
     Serialization::Serialize(stream, password);
     Serialization::Serialize(stream, extractable);
-    Serialization::Serialize(stream, restricted);
 }
 
 } // namespace CKM

diff --git a/src/manager/service/ckm-logic.cpp b/src/manager/service/ckm-logic.cpp
index f74ea05..e2309a6 100644 (file)
--- a/src/manager/service/ckm-logic.cpp
+++ b/src/manager/service/ckm-logic.cpp
@@ -213,7 +213,7 @@ int CKMLogic::saveDataHelper(
     if (0 == m_userDataMap.count(cred.uid))
         return CKM_API_ERROR_DB_LOCKED;
 
-    DBRow row = { alias, cred.smackLabel, policy.restricted,
+    DBRow row = { alias, cred.smackLabel,
          policy.extractable, dataType, DBCMAlgType::NONE,
          0, RawBuffer(), static_cast<int>(key.size()), key, RawBuffer() };
 

diff --git a/src/manager/service/db-crypto.cpp b/src/manager/service/db-crypto.cpp
index 09d490e..d401d4e 100644 (file)
--- a/src/manager/service/db-crypto.cpp
+++ b/src/manager/service/db-crypto.cpp
@@ -39,7 +39,6 @@ namespace {
             "CREATE TABLE CKM_TABLE("
             "   alias TEXT NOT NULL,"
             "   label TEXT NOT NULL,"
-            "   restricted INTEGER NOT NULL,"
             "   exportable INTEGER NOT NULL,"
             "   dataType INTEGER NOT NULL,"
             "   algorithmType INTEGER NOT NULL,"
@@ -49,35 +48,32 @@ namespace {
             "   data BLOB NOT NULL,"
             "   tag BLOB NOT NULL,"
             "   PRIMARY KEY(alias, label),"
-            "   UNIQUE(alias, restricted)"
+            "   UNIQUE(alias)"
             ");";
 
 
     const char *insert_main_cmd =
             "INSERT INTO CKM_TABLE("
-            //      1   2       3           4
-            "   alias, label, restricted, exportable,"
-            //      5           6           7
+            //      1   2       3
+            "   alias, label, exportable,"
+            //      4           5           6
             "   dataType, algorithmType, encryptionScheme,"
-            //  8       9      10   11
+            //  7       8       9    10
             "   iv, dataSize, data, tag) "
             "VALUES("
-            "   ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);";
+            "   ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);";
 
     const char *select_alias_cmd =
-            //                                   1              2                            3
-            "SELECT * FROM CKM_TABLE WHERE alias=? AND dataType=? AND restricted=1 AND label=? "
-            " UNION ALL "
-            //                                    4              5
-            " SELECT * FROM CKM_TABLE WHERE alias=? AND dataType=?  AND restricted=0;";
+            //                                   1              2        3
+            "SELECT * FROM CKM_TABLE WHERE alias=? AND dataType=? AND label=?; ";
 
     const char *select_check_alias_cmd =
             //                                          1           2
-            "SELECT dataType FROM CKM_TABLE WHERE alias=? AND label=? AND restricted=1; ";
+            "SELECT dataType FROM CKM_TABLE WHERE alias=? AND label=?; ";
 
     const char *select_check_global_alias_cmd =
             //                                       1
-            "SELECT label FROM CKM_TABLE WHERE alias=? AND restricted=0;";
+            "SELECT label FROM CKM_TABLE WHERE alias=? ;";
 
     const char *select_count_rows_cmd =
             //                                   1           2
@@ -88,8 +84,8 @@ namespace {
             "SELECT * FROM CKM_TABLE WHERE alias=?"
             //                     2     3
             " AND dataType BETWEEN ? AND ? "
-            //                           4
-            " AND (restricted=0 OR label=?);";
+            //          4
+            " AND label=? ;";
 
     const char *select_key_type_cmd =
             "SELECT alias FROM CKM_TABLE WHERE "
@@ -97,15 +93,12 @@ namespace {
                 " dataType >= ? AND "
             //                2
                 " dataType <= ? AND "
-            //                           3
-                " (restricted=0 OR label=?)";
+            //        3
+                " label=?;";
 
     const char *select_type_cmd =
-            //                                          1
-            "SELECT alias FROM CKM_TABLE WHERE dataType=? AND restricted=0 "
-            "UNION ALL "
-            //                                          2                            3
-            "SELECT alias FROM CKM_TABLE WHERE dataType=? AND restricted=1 AND label=?;";
+            //                                     1            2
+            "SELECT alias FROM CKM_TABLE WHERE dataType=? AND label=?;";
 
     const char *delete_alias_cmd =
             //                                 1           2
@@ -240,8 +233,7 @@ using namespace DB;
             //Sqlite does not support partial index in our version,
             //so we do it by hand
             Transaction transaction(this);
-            if((row.restricted == 1 && checkAliasExist(row.alias, row.smackLabel)) ||
-                    (row.restricted == 0 && checkGlobalAliasExist(row.alias))) {
+            if(checkAliasExist(row.alias, row.smackLabel)) {
                 ThrowMsg(DBCrypto::Exception::AliasExists,
                         "Alias exists for alias: " << row.alias
                         << ", label: " << row.smackLabel);
@@ -251,15 +243,14 @@ using namespace DB;
                     m_connection->PrepareDataCommand(insert_main_cmd);
             insertCommand->BindString(1, row.alias.c_str());
             insertCommand->BindString(2, row.smackLabel.c_str());
-            insertCommand->BindInteger(3, row.restricted);
-            insertCommand->BindInteger(4, row.exportable);
-            insertCommand->BindInteger(5, static_cast<int>(row.dataType));
-            insertCommand->BindInteger(6, static_cast<int>(row.algorithmType));
-            insertCommand->BindInteger(7, row.encryptionScheme);
-            insertCommand->BindBlob(8, row.iv);
-            insertCommand->BindInteger(9, row.dataSize);
-            insertCommand->BindBlob(10, row.data);
-            insertCommand->BindBlob(11, row.tag);
+            insertCommand->BindInteger(3, row.exportable);
+            insertCommand->BindInteger(4, static_cast<int>(row.dataType));
+            insertCommand->BindInteger(5, static_cast<int>(row.algorithmType));
+            insertCommand->BindInteger(6, row.encryptionScheme);
+            insertCommand->BindBlob(7, row.iv);
+            insertCommand->BindInteger(8, row.dataSize);
+            insertCommand->BindBlob(9, row.data);
+            insertCommand->BindBlob(10, row.tag);
 
             insertCommand->Step();
             transaction.commit();
@@ -278,15 +269,14 @@ using namespace DB;
         DBRow row;
         row.alias = selectCommand->GetColumnString(0);
         row.smackLabel = selectCommand->GetColumnString(1);
-        row.restricted = selectCommand->GetColumnInteger(2);
-        row.exportable = selectCommand->GetColumnInteger(3);
-        row.dataType = static_cast<DBDataType>(selectCommand->GetColumnInteger(4));
-        row.algorithmType = static_cast<DBCMAlgType>(selectCommand->GetColumnInteger(5));
-        row.encryptionScheme = selectCommand->GetColumnInteger(6);
-        row.iv = selectCommand->GetColumnBlob(7);
-        row.dataSize = selectCommand->GetColumnInteger(8);
-        row.data = selectCommand->GetColumnBlob(9);
-        row.tag = selectCommand->GetColumnBlob(10);
+        row.exportable = selectCommand->GetColumnInteger(2);
+        row.dataType = static_cast<DBDataType>(selectCommand->GetColumnInteger(3));
+        row.algorithmType = static_cast<DBCMAlgType>(selectCommand->GetColumnInteger(4));
+        row.encryptionScheme = selectCommand->GetColumnInteger(5);
+        row.iv = selectCommand->GetColumnBlob(6);
+        row.dataSize = selectCommand->GetColumnInteger(7);
+        row.data = selectCommand->GetColumnBlob(8);
+        row.tag = selectCommand->GetColumnBlob(9);
         return row;
     }
 
@@ -302,8 +292,6 @@ using namespace DB;
             selectCommand->BindString(1, alias.c_str());
             selectCommand->BindInteger(2, static_cast<int>(type));
             selectCommand->BindString(3, label.c_str());
-            selectCommand->BindString(4, alias.c_str());
-            selectCommand->BindInteger(5, static_cast<int>(type));
 
             if(selectCommand->Step()) {
                 transaction.commit();
@@ -363,8 +351,7 @@ using namespace DB;
             SqlConnection::DataCommandUniquePtr selectCommand =
                             m_connection->PrepareDataCommand(select_type_cmd);
             selectCommand->BindInteger(1, static_cast<int>(type));
-            selectCommand->BindInteger(2, static_cast<int>(type));
-            selectCommand->BindString(3, label.c_str());
+            selectCommand->BindString(2, label.c_str());
 
             while(selectCommand->Step()) {
                 Alias alias;

diff --git a/src/manager/service/db-row.h b/src/manager/service/db-row.h
index ecb1ccd..9e95aa2 100644 (file)
--- a/src/manager/service/db-row.h
+++ b/src/manager/service/db-row.h
@@ -9,7 +9,6 @@ namespace CKM {
     struct DBRow {
         std::string alias;
         std::string smackLabel;
-        int restricted;
         int exportable;
         DBDataType dataType;        // cert/key/data
         DBCMAlgType algorithmType;  // Algorithm type used for row data encryption

diff --git a/tests/test_db_crypto.cpp b/tests/test_db_crypto.cpp
index 2f3009c..d933f42 100644 (file)
--- a/tests/test_db_crypto.cpp
+++ b/tests/test_db_crypto.cpp
@@ -20,13 +20,11 @@ const char* crypto_db = "/tmp/testme.db";
 const int restricted_local = 1;
 const int restricted_global = 0;
 
-DBRow createDefaultRow(int restricted = restricted_local,
-        DBDataType type = DBDataType::BINARY_DATA) {
+DBRow createDefaultRow(DBDataType type = DBDataType::BINARY_DATA) {
     DBRow row;
     row.alias = default_alias;
     row.smackLabel = default_label;
     row.exportable = 1;
-    row.restricted = restricted;
     row.algorithmType = DBCMAlgType::AES_GCM_256;
     row.dataType = type;
     row.iv = createDefaultPass();
@@ -45,10 +43,6 @@ void compareDBRow(const DBRow &lhs, const DBRow &rhs) {
             "smackLabel didn't match! Got: " << rhs.smackLabel
                 << " , expected : " << lhs.smackLabel);
 
-    BOOST_CHECK_MESSAGE(lhs.restricted == rhs.restricted,
-            "restricted didn't match! Got: " << rhs.restricted
-                << " , expected : " << lhs.restricted);
-
     BOOST_CHECK_MESSAGE(lhs.exportable == rhs.exportable,
             "exportable didn't match! Got: " << rhs.exportable
                 << " , expected : " << lhs.exportable);
@@ -115,7 +109,7 @@ BOOST_AUTO_TEST_CASE(DBtestGlobal) {
     DBCrypto db;
     BOOST_REQUIRE_NO_THROW(db = DBCrypto(crypto_db, defaultPass));
 
-    DBRow rowPattern = createDefaultRow(restricted_global);
+    DBRow rowPattern = createDefaultRow();
     rowPattern.data = RawBuffer(1024, 2);
     rowPattern.dataSize = rowPattern.data.size();
 
@@ -132,7 +126,7 @@ BOOST_AUTO_TEST_CASE(DBtestTransaction) {
     DBCrypto db;
     BOOST_REQUIRE_NO_THROW(db = DBCrypto(crypto_db, defaultPass));
 
-    DBRow rowPattern = createDefaultRow(0);
+    DBRow rowPattern = createDefaultRow();
     rowPattern.data = RawBuffer(100, 20);
     rowPattern.dataSize = rowPattern.data.size();
     DBCrypto::Transaction transaction(&db);