1 |
|
|
2 |
|
|
3 |
|
|
4 |
|
|
5 |
|
|
6 |
|
|
7 |
|
|
8 |
|
|
9 |
|
|
10 |
|
|
11 |
|
|
12 |
|
|
13 |
|
|
14 |
|
|
15 |
|
|
16 |
|
|
17 |
|
|
18 |
|
|
19 |
|
|
20 |
|
|
21 |
|
|
22 |
|
|
23 |
|
|
24 |
|
|
25 |
|
|
26 |
|
|
27 |
|
|
28 |
|
|
29 |
|
|
30 |
|
|
31 |
|
|
32 |
|
|
33 |
|
|
34 |
|
|
35 |
|
|
36 |
|
|
37 |
|
|
38 |
|
|
39 |
|
|
40 |
|
|
41 |
|
|
42 |
|
|
43 |
|
|
44 |
|
|
45 |
|
package issrg.pba.rbac.x509; |
46 |
|
|
47 |
|
import issrg.pba.*; |
48 |
|
import issrg.pba.rbac.*; |
49 |
|
import java.security.Principal; |
50 |
|
import org.apache.log4j.Logger; |
51 |
|
import issrg.SAWS.*; |
52 |
|
|
53 |
|
|
54 |
|
|
55 |
|
|
56 |
|
|
57 |
|
|
58 |
|
|
59 |
|
@author |
60 |
|
|
|
|
| 60.9% |
Uncovered Elements: 59 (151) |
Complexity: 32 |
Complexity Density: 0.38 |
|
61 |
|
public class SimplePERMISACPolicyFinder extends PolicyFinder{ |
62 |
|
private Logger logger = Logger.getLogger("issrg.pba.rbac.x509.SimplePERMISACPolicyFinder"); |
63 |
|
private issrg.pba.AuthzTokenParser tokenParser=CustomisePERMIS.getAuthTokenParser(); |
64 |
|
|
|
|
| 100% |
Uncovered Elements: 0 (1) |
Complexity: 1 |
Complexity Density: 1 |
|
65 |
14
|
protected SimplePERMISACPolicyFinder(){... |
66 |
14
|
super(); |
67 |
|
} |
68 |
|
|
69 |
|
|
70 |
|
|
71 |
|
|
72 |
|
|
73 |
|
|
74 |
|
|
75 |
|
|
76 |
|
@param |
77 |
|
|
78 |
|
@param |
79 |
|
@param |
80 |
|
|
81 |
|
@param |
82 |
|
|
83 |
|
|
|
|
| 0% |
Uncovered Elements: 2 (2) |
Complexity: 1 |
Complexity Density: 0.5 |
|
84 |
0
|
public SimplePERMISACPolicyFinder(byte[] acBinary, String PolicyId, Principal SOA,... |
85 |
|
SignatureVerifier SV) throws PbaException { |
86 |
0
|
this(); |
87 |
0
|
initPolicyFromACArray(new byte[][]{acBinary}, PolicyId, SOA, SV); |
88 |
|
} |
89 |
|
|
90 |
|
|
|
|
| 0% |
Uncovered Elements: 3 (3) |
Complexity: 1 |
Complexity Density: 0.33 |
|
91 |
0
|
public SimplePERMISACPolicyFinder(byte[] acBinary, String PolicyId, Principal SOA,... |
92 |
|
SignatureVerifier SV, int SATLevel) throws PbaException { |
93 |
0
|
this(); |
94 |
0
|
satLevel=SATLevel; |
95 |
0
|
initPolicyFromACArray(new byte[][]{acBinary}, PolicyId, SOA, SV); |
96 |
|
} |
97 |
|
|
98 |
|
|
99 |
|
|
100 |
|
|
101 |
|
|
102 |
|
|
103 |
|
@param |
104 |
|
|
105 |
|
@param |
106 |
|
@param |
107 |
|
|
108 |
|
@param |
109 |
|
|
110 |
|
|
111 |
|
|
|
|
| 63.1% |
Uncovered Elements: 52 (141) |
Complexity: 32 |
Complexity Density: 0.37 |
|
112 |
14
|
protected void initPolicyFromACArray(byte[][] acBinary, String policyID, Principal SOA,... |
113 |
|
SignatureVerifier SV) throws PbaException{ |
114 |
14
|
this.policyOID=policyID.intern(); |
115 |
14
|
this.sv=SV; |
116 |
|
|
117 |
|
|
118 |
14
|
this.soa=SOA.getName(); |
119 |
|
|
120 |
|
|
121 |
14
|
if(sawsServer==null){ |
122 |
10
|
if(satLevel>SAWSLogLevelConstant.NO_INFO){ |
123 |
|
|
124 |
0
|
System.out.println("creating a saws server in simpleACpolicyFinder because of loglevels"); |
125 |
0
|
sawsServer = new SAWSServer(); |
126 |
|
} |
127 |
|
} |
128 |
|
|
129 |
|
|
130 |
|
|
131 |
14
|
issrg.utils.repository.TokenLocator soaTokenLocator=new issrg.pba.repository.UserEntry(SOA); |
132 |
|
|
133 |
14
|
try{ |
134 |
14
|
issrg.pba.PolicyParser pp = null; |
135 |
14
|
Throwable lastError = null; |
136 |
|
|
137 |
14
|
String message = "No ACs have been provided"; |
138 |
|
|
139 |
14
|
boolean selfSignedExists = false; |
140 |
14
|
boolean signatureVerified = false; |
141 |
14
|
boolean policyAttrExists = false; |
142 |
14
|
boolean correctPolicyOID = false; |
143 |
14
|
byte[] byteAC=null; |
144 |
14
|
issrg.ac.AttributeCertificate ac=null; |
145 |
|
|
146 |
14
|
if (acBinary!=null && acBinary.length>0){ |
147 |
|
|
148 |
14
|
policy_found: |
149 |
14
|
for (int i=0; i<acBinary.length; i++){ |
150 |
14
|
try{ |
151 |
14
|
byteAC=acBinary[i]; |
152 |
14
|
ac = issrg.ac.AttributeCertificate.guessEncoding(byteAC); |
153 |
|
|
154 |
14
|
if (!(SOA.equals(new LDAPDNPrincipal(issrg.ac.Util.generalNamesToString(ac.getACInfo().getHolder().getEntityName()))) |
155 |
14
|
&& SOA.equals(new LDAPDNPrincipal(issrg.ac.Util.generalNamesToString(ac.getACInfo().getIssuer().getV1Form()==null?ac.getACInfo().getIssuer().getV2Form().getIssuerName():ac.getACInfo().getIssuer().getV1Form()))))){ |
156 |
|
|
157 |
0
|
continue; |
158 |
|
} |
159 |
|
}catch(Exception e){ |
160 |
|
|
161 |
0
|
lastError=lastError==null ? e : new issrg.utils.ExceptionPairException(lastError, e); |
162 |
0
|
continue; |
163 |
|
} |
164 |
|
|
165 |
14
|
if((satLevel>SAWSLogLevelConstant.NO_INFO)&& (sawsServer!=null)){ |
166 |
|
|
167 |
4
|
StartedRecord rec2=new StartedRecord(ac.toString()); |
168 |
4
|
sawsServer.sendLogRecord(rec2.toBytes()); |
169 |
|
|
170 |
|
} |
171 |
14
|
selfSignedExists = true; |
172 |
14
|
signatureVerified = false; |
173 |
14
|
if (SV!=null) { |
174 |
9
|
try{ |
175 |
9
|
if (!SV.checkSignature(ac.getToBeSignedByteArray(byteAC), |
176 |
|
(byte[])ac.getSignatureValue().getValue(), |
177 |
|
ac.getSignatureAlgorithm().getAlgorithm().getID(), |
178 |
0
|
soaTokenLocator)) continue; |
179 |
|
}catch(PbaException pe){ |
180 |
0
|
lastError=lastError==null ? (Exception)pe : (Exception)new issrg.utils.ExceptionPairException(lastError, pe); |
181 |
0
|
continue; |
182 |
|
} |
183 |
|
} |
184 |
|
|
185 |
14
|
signatureVerified = true; |
186 |
|
|
187 |
14
|
policyAttrExists = false; |
188 |
|
|
189 |
14
|
java.util.Vector attributes = ac.getACInfo().getAttributes(); |
190 |
14
|
for (int j=attributes.size(); j-->0; ){ |
191 |
14
|
issrg.ac.Attribute a = (issrg.ac.Attribute)attributes.get(j); |
192 |
14
|
if (a.getType().intern() == issrg.ac.attributes.PMIXMLPolicy.PMI_XML_POLICY_ATTRIBUTE_OID){ |
193 |
14
|
policyAttrExists = true; |
194 |
14
|
correctPolicyOID = false; |
195 |
|
|
196 |
14
|
java.util.Vector values = a.getValues(); |
197 |
14
|
for (int k=values.size(); k-->0; ){ |
198 |
14
|
try{ |
199 |
14
|
issrg.ac.attributes.PMIXMLPolicy pmiPolicy = new issrg.ac.attributes.PMIXMLPolicy((issrg.ac.AttributeValue)values.get(k)); |
200 |
14
|
pp = new issrg.pba.rbac.xmlpolicy.XMLPolicyParser(removeSystemTag(pmiPolicy.getPolicy())); |
201 |
14
|
if (pp.getPolicyID().intern()==policyOID){ |
202 |
|
|
203 |
14
|
correctPolicyOID = true; |
204 |
14
|
if (logger.isDebugEnabled()){ |
205 |
0
|
logger.debug("Policy Finder Policy:\n"+pmiPolicy.getPolicy()); |
206 |
|
} |
207 |
14
|
break policy_found; |
208 |
|
} |
209 |
|
}catch (Throwable th){ |
210 |
0
|
lastError=lastError==null ? th : new issrg.utils.ExceptionPairException(lastError, th); |
211 |
|
} |
212 |
|
} |
213 |
|
|
214 |
|
} |
215 |
0
|
pp=null; |
216 |
|
} |
217 |
|
} |
218 |
|
|
219 |
0
|
if (!correctPolicyOID) message = "No valid AC with a pmiXMLPolicy attribute has a policy with OID "+policyOID; |
220 |
0
|
if (!policyAttrExists) message = "Found no valid AC with a pmiXMLPolicy attribute"; |
221 |
0
|
if (!signatureVerified) message = "Signature verification failed on all self-signed ACs"; |
222 |
0
|
if (!selfSignedExists) message = "Found no self-signed AC (issuer=holder=SOA)"; |
223 |
|
} |
224 |
|
|
225 |
14
|
if (pp==null){ |
226 |
0
|
PbaException exx= new PbaException(message, lastError); |
227 |
|
|
228 |
0
|
if((satLevel>SAWSLogLevelConstant.POLICY_CHANGE)&& sawsServer!=null) |
229 |
0
|
sawsServer.sendLogRecord(new ExceptionSAWSRecord(exx).toBytes()); |
230 |
0
|
throw exx; |
231 |
|
} |
232 |
|
|
233 |
14
|
this.parsedPolicy=pp; |
234 |
|
|
235 |
|
|
236 |
|
|
237 |
|
|
238 |
|
|
239 |
14
|
if (pp.getMSoDSet() != null) { |
240 |
4
|
RetainedADI retainedADI = new RetainedADI(); |
241 |
|
|
242 |
4
|
if(sawsServer==null){ |
243 |
0
|
System.out.println("creating a saws server in simpleACpolicyFinder because of MSoDPolicy"); |
244 |
0
|
sawsServer = new SAWSServer(); |
245 |
|
} |
246 |
|
|
247 |
4
|
msodPolicySet = new issrg.pba.rbac.policies.MSoDPolicySet(pp.getMSoDSet(), retainedADI, sawsServer, pp); |
248 |
|
} |
249 |
|
|
250 |
14
|
allocationPolicy=new issrg.pba.rbac.policies.AllocationPolicy(pp.getAssignmentRules()); |
251 |
|
|
252 |
|
|
253 |
14
|
if (msodPolicySet == null) |
254 |
10
|
accessPolicy = new issrg.pba.rbac.policies.AccessPolicy(pp.getAccessRules()); |
255 |
|
else |
256 |
4
|
accessPolicy = new issrg.pba.rbac.policies.AccessPolicy(pp.getAccessRules(), msodPolicySet); |
257 |
|
|
258 |
|
|
259 |
|
}catch (Throwable th){ |
260 |
0
|
PbaException exx= new PbaException(" Policy finder Could not initialise", th); |
261 |
|
|
262 |
0
|
if((satLevel>SAWSLogLevelConstant.POLICY_CHANGE)&& sawsServer!=null){ |
263 |
0
|
sawsServer.sendLogRecord(new ExceptionSAWSRecord(exx).toBytes()); |
264 |
|
|
265 |
0
|
sawsServer.closeLog(); |
266 |
|
} |
267 |
0
|
throw exx; |
268 |
|
} |
269 |
|
} |
270 |
|
} |