1 |
|
|
2 |
|
|
3 |
|
|
4 |
|
|
5 |
|
|
6 |
|
|
7 |
|
|
8 |
|
|
9 |
|
|
10 |
|
|
11 |
|
|
12 |
|
|
13 |
|
|
14 |
|
|
15 |
|
|
16 |
|
|
17 |
|
|
18 |
|
|
19 |
|
|
20 |
|
|
21 |
|
|
22 |
|
|
23 |
|
|
24 |
|
|
25 |
|
|
26 |
|
|
27 |
|
|
28 |
|
|
29 |
|
|
30 |
|
|
31 |
|
|
32 |
|
|
33 |
|
|
34 |
|
|
35 |
|
|
36 |
|
|
37 |
|
|
38 |
|
|
39 |
|
|
40 |
|
|
41 |
|
|
42 |
|
|
43 |
|
|
44 |
|
|
45 |
|
|
46 |
|
|
47 |
|
package issrg.pba.rbac.policies; |
48 |
|
|
49 |
|
import issrg.pba.PbaException; |
50 |
|
import issrg.pba.rbac.xmlpolicy.XMLPolicyParser; |
51 |
|
import issrg.pba.rbac.*; |
52 |
|
import issrg.pba.*; |
53 |
|
|
54 |
|
import iaik.asn1.*; |
55 |
|
import iaik.asn1.structures.AlgorithmID; |
56 |
|
import iaik.utils.Util; |
57 |
|
|
58 |
|
import java.io.*; |
59 |
|
import java.util.*; |
60 |
|
import java.lang.*; |
61 |
|
import java.math.*; |
62 |
|
import java.text.*; |
63 |
|
|
64 |
|
|
65 |
|
import issrg.pba.rbac.RetainedADI; |
66 |
|
import issrg.SAWS.*; |
67 |
|
|
68 |
|
|
69 |
|
|
70 |
|
|
71 |
|
|
72 |
|
@author |
73 |
|
@version |
74 |
|
|
75 |
|
|
|
|
| 92.7% |
Uncovered Elements: 12 (164) |
Complexity: 21 |
Complexity Density: 0.21 |
|
76 |
|
public class MSoDPolicySet { |
77 |
|
|
78 |
|
protected java.util.Vector msodRules; |
79 |
|
protected RetainedADI retainedADI; |
80 |
|
private SAWSServer sawsServer; |
81 |
|
private PolicyParser pp; |
82 |
|
|
|
|
| - |
Uncovered Elements: 0 (0) |
Complexity: 1 |
Complexity Density: - |
|
83 |
0
|
protected MSoDPolicySet(){}... |
84 |
|
|
85 |
|
|
86 |
|
|
87 |
|
|
88 |
|
|
89 |
|
|
90 |
|
|
91 |
|
|
92 |
|
|
93 |
|
|
|
|
| 77.8% |
Uncovered Elements: 2 (9) |
Complexity: 2 |
Complexity Density: 0.29 |
|
94 |
4
|
public MSoDPolicySet(Vector m, RetainedADI r, SAWSServer sawsServer, PolicyParser pp){... |
95 |
4
|
msodRules = m; |
96 |
4
|
retainedADI = r; |
97 |
4
|
this.sawsServer = sawsServer; |
98 |
4
|
this.pp = pp; |
99 |
4
|
Vector v1 = null; |
100 |
|
|
101 |
0
|
while ( (v1 = sawsServer.sawsReadOneLogFile()) != null) { |
102 |
14
|
addRecords(v1); |
103 |
|
} |
104 |
|
|
105 |
|
|
106 |
|
} |
107 |
|
|
108 |
|
|
109 |
|
|
110 |
|
|
111 |
|
|
112 |
|
@param |
113 |
|
|
114 |
|
@return |
115 |
|
|
116 |
|
|
|
|
| 96.3% |
Uncovered Elements: 1 (27) |
Complexity: 7 |
Complexity Density: 0.41 |
|
117 |
14
|
private void addRecords(Vector v){ ... |
118 |
94
|
for (int i=0; i<v.size() ; ++i ) { |
119 |
80
|
DecisionRecord dr = toDecisionRecord( ((RecordBlock) v.get(i)).getRecord() ); |
120 |
80
|
ContextNamePrincipal instanceDN = null; |
121 |
|
|
122 |
80
|
if(dr==null) |
123 |
59
|
continue; |
124 |
21
|
try { |
125 |
21
|
instanceDN = new ContextNamePrincipal(dr.getContextInstance()); |
126 |
|
} |
127 |
|
catch (Exception e) { |
128 |
0
|
e.printStackTrace(); |
129 |
|
} |
130 |
21
|
int size = msodRules.size(); |
131 |
21
|
MSoDRule aMSoDRule = null; |
132 |
163
|
for (int j = 0; j< size; ++j){ |
133 |
143
|
aMSoDRule = (MSoDRule) msodRules.get(j); |
134 |
143
|
if ( aMSoDRule.contains(instanceDN) ) { |
135 |
17
|
if (aMSoDRule.isLastStep(dr.getAction(), dr.getTarget() ) ) { |
136 |
1
|
retainedADI.removeContext(aMSoDRule.getPolicyContext(), instanceDN); |
137 |
1
|
break; |
138 |
|
} else |
139 |
16
|
retainedADI.add(dr); |
140 |
|
} |
141 |
|
|
142 |
|
} |
143 |
|
} |
144 |
|
} |
145 |
|
|
146 |
|
|
147 |
|
|
148 |
|
|
149 |
|
@param |
150 |
|
|
151 |
|
@return |
152 |
|
|
153 |
|
|
154 |
|
|
155 |
|
|
156 |
|
|
157 |
|
|
158 |
|
|
|
|
| 97.7% |
Uncovered Elements: 1 (44) |
Complexity: 4 |
Complexity Density: 0.1 |
|
159 |
80
|
private issrg.pba.rbac.DecisionRecord toDecisionRecord(byte[] recordBlock){... |
160 |
80
|
DateFormat df = DateFormat.getDateInstance(); |
161 |
80
|
issrg.pba.rbac.DecisionRecord dr = null; |
162 |
80
|
try{ |
163 |
80
|
ASN1 asn1 = new ASN1(recordBlock); |
164 |
|
|
165 |
80
|
IA5String sType = (IA5String)asn1.getComponentAt(0); |
166 |
80
|
String type=(String)sType.getValue(); |
167 |
|
|
168 |
80
|
if(type.compareTo("PermisMSoDType")!=0) |
169 |
59
|
return null; |
170 |
21
|
IA5String s0 = (IA5String)asn1.getComponentAt(1); |
171 |
21
|
String userID = (String)s0.getValue(); |
172 |
|
|
173 |
21
|
s0 = (IA5String)asn1.getComponentAt(2); |
174 |
21
|
String action = (String)s0.getValue(); |
175 |
|
|
176 |
21
|
s0 = (IA5String)asn1.getComponentAt(3); |
177 |
21
|
String Target = (String)s0.getValue(); |
178 |
|
|
179 |
21
|
s0 = (IA5String)asn1.getComponentAt(4); |
180 |
21
|
String contextInstance = (String)s0.getValue(); |
181 |
|
|
182 |
21
|
s0 = (IA5String)asn1.getComponentAt(5); |
183 |
21
|
Date dateTime = df.parse((String)s0.getValue()) ; |
184 |
|
|
185 |
21
|
Vector CredsVec = new Vector(); |
186 |
21
|
INTEGER i0 = (INTEGER)asn1.getComponentAt(6) ; |
187 |
21
|
int roleCount = ((BigInteger)i0.getValue()).intValue(); |
188 |
46
|
for (int j = 0; j< roleCount ; ++j ) { |
189 |
25
|
s0 = (IA5String)asn1.getComponentAt(7+j*4); |
190 |
25
|
String roleValue = (String)s0.getValue(); |
191 |
|
|
192 |
25
|
s0 = (IA5String)asn1.getComponentAt(7+j*4+1); |
193 |
25
|
String roleType = (String)s0.getValue(); |
194 |
|
|
195 |
25
|
s0 = (IA5String)asn1.getComponentAt(7+j*4+2); |
196 |
25
|
String d1s = (String)s0.getValue(); |
197 |
25
|
Date d1 = df.parse(d1s); |
198 |
|
|
199 |
25
|
s0 = (IA5String)asn1.getComponentAt(7+j*4+3); |
200 |
25
|
String d2s = (String)s0.getValue(); |
201 |
25
|
Date d2 = df.parse(d2s); |
202 |
|
|
203 |
25
|
AbsoluteValidityPeriod avp = new AbsoluteValidityPeriod(d1, d2); |
204 |
25
|
Credentials pc = new PermisCredentials( ((XMLPolicyParser) pp).getRole(roleType, roleValue)); |
205 |
25
|
ExpirableCredentials ec = new ExpirableCredentials(pc, (ValidityPeriod) avp); |
206 |
25
|
CredsVec.add(ec); |
207 |
|
} |
208 |
21
|
Credentials creds = new SetOfSubsetsCredentials (CredsVec); |
209 |
|
|
210 |
21
|
dr = new DecisionRecord(userID, creds, action, Target, contextInstance, dateTime); |
211 |
|
|
212 |
|
} catch (Exception e) { |
213 |
0
|
e.printStackTrace(System.err); |
214 |
|
} |
215 |
21
|
return dr; |
216 |
|
} |
217 |
|
|
218 |
|
|
219 |
|
|
220 |
|
|
221 |
|
|
222 |
|
@param |
223 |
|
|
224 |
|
@return |
225 |
|
|
|
|
| 100% |
Uncovered Elements: 0 (29) |
Complexity: 2 |
Complexity Density: 0.07 |
|
226 |
18
|
private byte[] toBytes(issrg.pba.rbac.DecisionRecord dr){... |
227 |
18
|
DateFormat df = DateFormat.getDateInstance(); |
228 |
18
|
SEQUENCE ASN1Seq = new SEQUENCE(); |
229 |
|
|
230 |
18
|
ASN1Seq.addComponent(new IA5String("PermisMSoDType")); |
231 |
|
|
232 |
18
|
ASN1Seq.addComponent(new IA5String(dr.getUserID())); |
233 |
18
|
ASN1Seq.addComponent(new IA5String(dr.getAction())); |
234 |
18
|
ASN1Seq.addComponent(new IA5String(dr.getTarget())); |
235 |
18
|
ASN1Seq.addComponent(new IA5String(dr.getContextInstance())); |
236 |
18
|
ASN1Seq.addComponent(new IA5String(df.format(dr.getDateTime()))); |
237 |
|
|
238 |
18
|
Credentials creds = dr.getCreds(); |
239 |
18
|
int credsNumber = 0; |
240 |
18
|
Vector credsV = ((SetOfSubsetsCredentials)creds).getValue(); |
241 |
18
|
credsNumber = credsV.size() ; |
242 |
18
|
ASN1Seq.addComponent(new INTEGER(credsNumber)); |
243 |
|
|
244 |
38
|
for (int i=0; i< credsNumber; ++i){ |
245 |
20
|
ExpirableCredentials ec = (ExpirableCredentials) credsV.get(i); |
246 |
20
|
PermisCredentials pc = (PermisCredentials) ec.getExpirable(); |
247 |
20
|
ValidityPeriod vp = (ValidityPeriod) ec.getValidityPeriod(); |
248 |
20
|
String roleValue =(String) pc.getRoleValue(); |
249 |
20
|
String roleType = (String) pc.getRoleType(); |
250 |
20
|
ASN1Seq.addComponent(new IA5String(roleValue)); |
251 |
20
|
ASN1Seq.addComponent(new IA5String(roleType)); |
252 |
20
|
Date d1 = ( (IntersectionValidityPeriod) vp ).getNotBefore(); |
253 |
20
|
Date d2 = ( (IntersectionValidityPeriod) vp ).getNotAfter(); |
254 |
20
|
ASN1Seq.addComponent(new IA5String( df.format(d1) )); |
255 |
20
|
ASN1Seq.addComponent(new IA5String( df.format(d2) )); |
256 |
|
} |
257 |
|
|
258 |
18
|
byte[] arrayASN = DerCoder.encode(ASN1Seq); |
259 |
18
|
return arrayASN; |
260 |
|
} |
261 |
|
|
262 |
|
|
263 |
|
|
264 |
|
|
265 |
|
|
266 |
|
|
267 |
|
|
268 |
|
@param |
269 |
|
@param |
270 |
|
@param |
271 |
|
@param |
272 |
|
|
273 |
|
@return |
274 |
|
|
|
|
| 85.7% |
Uncovered Elements: 7 (49) |
Complexity: 10 |
Complexity Density: 0.3 |
|
275 |
34
|
public boolean separationOfDutiesApplies(issrg.pba.Credentials creds, ... |
276 |
|
issrg.pba.Action a, |
277 |
|
issrg.pba.Target t, java.util.Map environment) { |
278 |
|
|
279 |
|
|
280 |
34
|
String contextInstance = (String) environment.get("ContextInstance"); |
281 |
34
|
if ( contextInstance == null) { |
282 |
0
|
return false; |
283 |
|
} |
284 |
34
|
ContextNamePrincipal instanceDN = null, maskDN = null, lastMaskDN = null; |
285 |
34
|
try { |
286 |
34
|
instanceDN = new ContextNamePrincipal(contextInstance); |
287 |
|
} |
288 |
|
catch (issrg.utils.RFC2253ParsingException e) { |
289 |
|
|
290 |
|
} |
291 |
|
|
292 |
34
|
issrg.pba.Subject subject = (issrg.pba.rbac.PermisSubject) environment.get("Subject"); |
293 |
|
|
294 |
34
|
String actionName = a.getActionName(); |
295 |
34
|
String userID = (String) ((issrg.pba.rbac.PermisSubject)subject).getName(); |
296 |
34
|
String targetName = ((PermisTarget)t).getName(); |
297 |
34
|
Vector historyVector = null; |
298 |
|
|
299 |
34
|
int size = msodRules.size(); |
300 |
34
|
MSoDRule aMSoDRule = null; |
301 |
34
|
boolean lastStepFlag = false; |
302 |
209
|
for (int i = 0; i< size; ++i){ |
303 |
191
|
aMSoDRule = (MSoDRule) msodRules.get(i); |
304 |
191
|
if ( aMSoDRule.contains(instanceDN) ) { |
305 |
32
|
boolean result = |
306 |
|
aMSoDRule.separationOfDutiesApplies( retainedADI, creds, subject, a, t, environment, |
307 |
|
instanceDN) ; |
308 |
32
|
if ( !result) { |
309 |
16
|
if (aMSoDRule.isLastStep(actionName, targetName) ) { |
310 |
2
|
lastStepFlag = true; |
311 |
2
|
maskDN = aMSoDRule.getPolicyContext(); |
312 |
2
|
if (lastMaskDN== null) { |
313 |
2
|
lastMaskDN = maskDN; |
314 |
|
} else { |
315 |
0
|
if (maskDN.contains(lastMaskDN) ) { |
316 |
0
|
lastMaskDN = maskDN; |
317 |
|
} |
318 |
|
} |
319 |
|
} |
320 |
|
|
321 |
|
} else { |
322 |
16
|
return true; |
323 |
|
} |
324 |
|
|
325 |
|
} |
326 |
|
|
327 |
|
} |
328 |
|
|
329 |
18
|
issrg.pba.rbac.DecisionRecord dr = new issrg.pba.rbac.DecisionRecord(userID, creds, |
330 |
|
actionName, targetName, contextInstance, |
331 |
|
CustomisePERMIS.getSystemClock().getTime()); |
332 |
18
|
if ( lastStepFlag) { |
333 |
2
|
retainedADI.removeContext(lastMaskDN, instanceDN); |
334 |
|
} else { |
335 |
16
|
retainedADI.add(dr); |
336 |
|
} |
337 |
18
|
sawsServer.sendLogRecord(toBytes(dr) ); |
338 |
18
|
return false; |
339 |
|
|
340 |
|
} |
341 |
|
|
342 |
|
|
343 |
|
} |
344 |
|
|
345 |
|
|