validation-policy-config.cpp
Go to the documentation of this file.
1 /* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
2 /*
3  * Copyright (c) 2013-2022 Regents of the University of California.
4  *
5  * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
6  *
7  * ndn-cxx library is free software: you can redistribute it and/or modify it under the
8  * terms of the GNU Lesser General Public License as published by the Free Software
9  * Foundation, either version 3 of the License, or (at your option) any later version.
10  *
11  * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
12  * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
13  * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
14  *
15  * You should have received copies of the GNU General Public License and GNU Lesser
16  * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see
17  * <http://www.gnu.org/licenses/>.
18  *
19  * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
20  */
21 
24 #include "ndn-cxx/util/io.hpp"
25 
26 #include <boost/algorithm/string/predicate.hpp>
27 #include <boost/filesystem/operations.hpp>
28 #include <boost/filesystem/path.hpp>
29 #include <boost/lexical_cast.hpp>
30 #include <boost/property_tree/info_parser.hpp>
31 
32 #include <fstream>
33 
34 namespace ndn {
35 namespace security {
36 inline namespace v2 {
37 namespace validator_config {
38 
39 void
40 ValidationPolicyConfig::load(const std::string& filename)
41 {
42  std::ifstream inputFile(filename);
43  if (!inputFile) {
44  NDN_THROW(Error("Failed to read configuration file: " + filename));
45  }
46  load(inputFile, filename);
47 }
48 
49 void
50 ValidationPolicyConfig::load(const std::string& input, const std::string& filename)
51 {
52  std::istringstream inputStream(input);
53  load(inputStream, filename);
54 }
55 
56 void
57 ValidationPolicyConfig::load(std::istream& input, const std::string& filename)
58 {
59  ConfigSection tree;
60  try {
61  boost::property_tree::read_info(input, tree);
62  }
63  catch (const boost::property_tree::info_parser_error& e) {
64  NDN_THROW(Error("Failed to parse configuration file " + filename +
65  " line " + to_string(e.line()) + ": " + e.message()));
66  }
67  load(tree, filename);
68 }
69 
70 void
71 ValidationPolicyConfig::load(const ConfigSection& configSection, const std::string& filename)
72 {
73  BOOST_ASSERT(!filename.empty());
74 
75  if (m_validator == nullptr) {
76  NDN_THROW(Error("Validator instance not assigned on the policy"));
77  }
78  if (m_isConfigured) {
79  m_shouldBypass = false;
80  m_dataRules.clear();
81  m_interestRules.clear();
84  }
85  m_isConfigured = true;
86 
87  for (const auto& subSection : configSection) {
88  const std::string& sectionName = subSection.first;
89  const ConfigSection& section = subSection.second;
90 
91  if (boost::iequals(sectionName, "rule")) {
92  auto rule = Rule::create(section, filename);
93  if (rule->getPktType() == tlv::Data) {
94  m_dataRules.push_back(std::move(rule));
95  }
96  else if (rule->getPktType() == tlv::Interest) {
97  m_interestRules.push_back(std::move(rule));
98  }
99  }
100  else if (boost::iequals(sectionName, "trust-anchor")) {
101  processConfigTrustAnchor(section, filename);
102  }
103  else {
104  NDN_THROW(Error("Error processing configuration file " + filename +
105  ": unrecognized section " + sectionName));
106  }
107  }
108 }
109 
110 void
111 ValidationPolicyConfig::processConfigTrustAnchor(const ConfigSection& configSection,
112  const std::string& filename)
113 {
114  using namespace boost::filesystem;
115 
116  auto propertyIt = configSection.begin();
117 
118  // Get trust-anchor.type
119  if (propertyIt == configSection.end() || !boost::iequals(propertyIt->first, "type")) {
120  NDN_THROW(Error("Expecting <trust-anchor.type>"));
121  }
122 
123  std::string type = propertyIt->second.data();
124  propertyIt++;
125 
126  if (boost::iequals(type, "file")) {
127  // Get trust-anchor.file
128  if (propertyIt == configSection.end() || !boost::iequals(propertyIt->first, "file-name")) {
129  NDN_THROW(Error("Expecting <trust-anchor.file-name>"));
130  }
131 
132  std::string file = propertyIt->second.data();
133  propertyIt++;
134 
135  time::nanoseconds refresh = getRefreshPeriod(propertyIt, configSection.end());
136  if (propertyIt != configSection.end())
137  NDN_THROW(Error("Expecting end of <trust-anchor>"));
138 
139  m_validator->loadAnchor(file, absolute(file, path(filename).parent_path()).string(),
140  refresh, false);
141  }
142  else if (boost::iequals(type, "base64")) {
143  // Get trust-anchor.base64-string
144  if (propertyIt == configSection.end() || !boost::iequals(propertyIt->first, "base64-string"))
145  NDN_THROW(Error("Expecting <trust-anchor.base64-string>"));
146 
147  std::stringstream ss(propertyIt->second.data());
148  propertyIt++;
149 
150  if (propertyIt != configSection.end())
151  NDN_THROW(Error("Expecting end of <trust-anchor>"));
152 
153  auto idCert = io::load<Certificate>(ss);
154  if (idCert != nullptr) {
155  m_validator->loadAnchor("", std::move(*idCert));
156  }
157  else {
158  NDN_THROW(Error("Cannot decode certificate from base64-string"));
159  }
160  }
161  else if (boost::iequals(type, "dir")) {
162  if (propertyIt == configSection.end() || !boost::iequals(propertyIt->first, "dir"))
163  NDN_THROW(Error("Expecting <trust-anchor.dir>"));
164 
165  std::string dirString(propertyIt->second.data());
166  propertyIt++;
167 
168  time::nanoseconds refresh = getRefreshPeriod(propertyIt, configSection.end());
169  if (propertyIt != configSection.end())
170  NDN_THROW(Error("Expecting end of <trust-anchor>"));
171 
172  path dirPath = absolute(dirString, path(filename).parent_path());
173  m_validator->loadAnchor(dirString, dirPath.string(), refresh, true);
174  }
175  else if (boost::iequals(type, "any")) {
176  m_shouldBypass = true;
177  }
178  else {
179  NDN_THROW(Error("Unrecognized <trust-anchor.type>: " + type));
180  }
181 }
182 
184 ValidationPolicyConfig::getRefreshPeriod(ConfigSection::const_iterator& it,
185  const ConfigSection::const_iterator& end)
186 {
187  auto refresh = time::nanoseconds::max();
188  if (it == end) {
189  return refresh;
190  }
191 
192  if (!boost::iequals(it->first, "refresh")) {
193  NDN_THROW(Error("Expecting <trust-anchor.refresh>"));
194  }
195 
196  std::string inputString = it->second.data();
197  ++it;
198  char unit = inputString[inputString.size() - 1];
199  std::string refreshString = inputString.substr(0, inputString.size() - 1);
200 
201  int32_t refreshPeriod = -1;
202  try {
203  refreshPeriod = boost::lexical_cast<int32_t>(refreshString);
204  }
205  catch (const boost::bad_lexical_cast&) {
206  // pass
207  }
208  if (refreshPeriod < 0) {
209  NDN_THROW(Error("Bad refresh value: " + refreshString));
210  }
211 
212  if (refreshPeriod == 0) {
213  return getDefaultRefreshPeriod();
214  }
215 
216  switch (unit) {
217  case 'h':
218  return time::hours(refreshPeriod);
219  case 'm':
220  return time::minutes(refreshPeriod);
221  case 's':
222  return time::seconds(refreshPeriod);
223  default:
224  NDN_THROW(Error("Bad refresh time unit: "s + unit));
225  }
226 }
227 
229 ValidationPolicyConfig::getDefaultRefreshPeriod()
230 {
231  return 1_h;
232 }
233 
234 void
235 ValidationPolicyConfig::checkPolicy(const Data& data, const shared_ptr<ValidationState>& state,
236  const ValidationContinuation& continueValidation)
237 {
238  BOOST_ASSERT_MSG(!hasInnerPolicy(), "ValidationPolicyConfig must be a terminal inner policy");
239 
240  if (m_shouldBypass) {
241  return continueValidation(nullptr, state);
242  }
243 
244  Name klName = getKeyLocatorName(data.getSignatureInfo(), *state);
245  if (!state->getOutcome()) { // already failed
246  return;
247  }
248 
249  auto sigType = tlv::SignatureTypeValue(data.getSignatureType());
250 
251  for (const auto& rule : m_dataRules) {
252  if (rule->match(tlv::Data, data.getName(), state)) {
253  if (rule->check(tlv::Data, sigType, data.getName(), klName, state)) {
254  return continueValidation(make_shared<CertificateRequest>(klName), state);
255  }
256  // rule->check calls state->fail(...) if the check fails
257  return;
258  }
259  }
260 
261  return state->fail({ValidationError::POLICY_ERROR,
262  "No rule matched for data `" + data.getName().toUri() + "`"});
263 }
264 
265 void
266 ValidationPolicyConfig::checkPolicy(const Interest& interest, const shared_ptr<ValidationState>& state,
267  const ValidationContinuation& continueValidation)
268 {
269  BOOST_ASSERT_MSG(!hasInnerPolicy(), "ValidationPolicyConfig must be a terminal inner policy");
270 
271  if (m_shouldBypass) {
272  return continueValidation(nullptr, state);
273  }
274 
275  auto sigInfo = getSignatureInfo(interest, *state);
276  if (!state->getOutcome()) { // already failed
277  return;
278  }
279 
280  Name klName = getKeyLocatorName(sigInfo, *state);
281  if (!state->getOutcome()) { // already failed
282  return;
283  }
284 
285  auto sigType = tlv::SignatureTypeValue(sigInfo.getSignatureType());
286 
287  for (const auto& rule : m_interestRules) {
288  if (rule->match(tlv::Interest, interest.getName(), state)) {
289  if (rule->check(tlv::Interest, sigType, interest.getName(), klName, state)) {
290  return continueValidation(make_shared<CertificateRequest>(klName), state);
291  }
292  // rule->check calls state->fail(...) if the check fails
293  return;
294  }
295  }
296 
297  return state->fail({ValidationError::POLICY_ERROR,
298  "No rule matched for interest `" + interest.getName().toUri() + "`"});
299 }
300 
301 } // namespace validator_config
302 } // inline namespace v2
303 } // namespace security
304 } // namespace ndn
Represents a Data packet.
Definition: data.hpp:39
int32_t getSignatureType() const noexcept
Get the SignatureType.
Definition: data.hpp:317
const SignatureInfo & getSignatureInfo() const noexcept
Get the SignatureInfo element.
Definition: data.hpp:224
const Name & getName() const noexcept
Get the data name.
Definition: data.hpp:129
Represents an Interest packet.
Definition: interest.hpp:50
const Name & getName() const noexcept
Definition: interest.hpp:173
Represents an absolute name.
Definition: name.hpp:44
@ POLICY_ERROR
The packet violates the validation rules enforced by the policy.
std::function< void(const shared_ptr< CertificateRequest > &certRequest, const shared_ptr< ValidationState > &state)> ValidationContinuation
bool hasInnerPolicy() const
Check if inner policy is set.
void resetAnchors()
Remove any previously loaded static or dynamic trust anchor.
Definition: validator.cpp:184
void resetVerifiedCertificates()
Remove any cached verified certificates.
Definition: validator.cpp:196
void loadAnchor(const std::string &groupId, Certificate &&cert)
Load static trust anchor.
Definition: validator.cpp:171
static unique_ptr< Rule > create(const ConfigSection &configSection, const std::string &configFilename)
Create a rule from configuration section.
Definition: rule.cpp:107
void load(const std::string &filename)
Load policy from file filename.
void checkPolicy(const Data &data, const shared_ptr< ValidationState > &state, const ValidationContinuation &continueValidation) override
Check data against the policy.
#define NDN_THROW(e)
Definition: exception.hpp:61
std::string to_string(const errinfo_stacktrace &x)
Definition: exception.cpp:31
boost::property_tree::ptree ConfigSection
Definition: common.hpp:36
Name getKeyLocatorName(const SignatureInfo &si, ValidationState &state)
Extract the KeyLocator name from a SignatureInfo element.
SignatureInfo getSignatureInfo(const Interest &interest, ValidationState &state)
Extract SignatureInfo from a signed Interest.
boost::chrono::minutes minutes
Definition: time.hpp:46
boost::chrono::nanoseconds nanoseconds
Definition: time.hpp:50
boost::chrono::hours hours
Definition: time.hpp:45
boost::chrono::seconds seconds
Definition: time.hpp:47
@ Data
Definition: tlv.hpp:69
@ Interest
Definition: tlv.hpp:68
SignatureTypeValue
SignatureType values.
Definition: tlv.hpp:127
Definition: data.cpp:25