OpenDDS::Security::Permissions Struct Reference

#include <Permissions.h>

Inheritance diagram for OpenDDS::Security::Permissions:

Collaboration diagram for OpenDDS::Security::Permissions:

Classes
struct	Action
struct	Grant
struct	Rule
struct	Validity_t

Public Types
enum	AllowDeny_t { ALLOW, DENY }
enum	PublishSubscribe_t { PUBLISH, SUBSCRIBE }
typedef DCPS::RcHandle< Permissions >	shared_ptr
typedef std::vector< Action >	Actions
typedef std::vector< Rule >	Rules
typedef DCPS::RcHandle< Grant >	Grant_rch
typedef std::vector< Grant_rch >	Grants

Public Member Functions
int	load (const SSL::SignedDocument &doc)
bool	has_grant (const SSL::SubjectName &name) const
Grant_rch	find_grant (const SSL::SubjectName &name) const
Public Member Functions inherited from OpenDDS::DCPS::RcObject
virtual	~RcObject ()
virtual void	_add_ref ()
virtual void	_remove_ref ()
long	ref_count () const
WeakObject *	_get_weak_object () const

Public Attributes
Grants	grants_
DDS::Security::PermissionsToken	perm_token_
DDS::Security::PermissionsCredentialToken	perm_cred_token_

Additional Inherited Members
Protected Member Functions inherited from OpenDDS::DCPS::RcObject
	RcObject ()

Detailed Description

Definition at line 29 of file Permissions.h.

Member Typedef Documentation

Actions

typedef std::vector<Action> OpenDDS::Security::Permissions::Actions

Definition at line 56 of file Permissions.h.

Grant_rch

typedef DCPS::RcHandle<Grant> OpenDDS::Security::Permissions::Grant_rch

Definition at line 74 of file Permissions.h.

Grants

typedef std::vector<Grant_rch> OpenDDS::Security::Permissions::Grants

Definition at line 76 of file Permissions.h.

Rules

typedef std::vector<Rule> OpenDDS::Security::Permissions::Rules

Definition at line 64 of file Permissions.h.

shared_ptr

typedef DCPS::RcHandle<Permissions> OpenDDS::Security::Permissions::shared_ptr

Definition at line 30 of file Permissions.h.

Member Enumeration Documentation

AllowDeny_t

enum OpenDDS::Security::Permissions::AllowDeny_t

Enumerator
ALLOW
DENY

Definition at line 32 of file Permissions.h.

                   {
    ALLOW,
    DENY
  };

PublishSubscribe_t

enum OpenDDS::Security::Permissions::PublishSubscribe_t

Enumerator
PUBLISH
SUBSCRIBE

Definition at line 37 of file Permissions.h.

                          {
    PUBLISH,
    SUBSCRIBE
  };

Member Function Documentation

find_grant()

Permissions::Grant_rch OpenDDS::Security::Permissions::find_grant

(

const SSL::SubjectName &

name

)

const

Definition at line 208 of file Permissions.cpp.

References grants_.

Referenced by load().

{
  for (Grants::const_iterator it = grants_.begin(); it != grants_.end(); ++it) {
    if (name == (*it)->subject) {
      return *it;
    }
  }
  return Grant_rch();
}

has_grant()

bool OpenDDS::Security::Permissions::has_grant

(

const SSL::SubjectName &

name

)

const

Definition at line 198 of file Permissions.cpp.

References grants_.

{
  for (Grants::const_iterator it = grants_.begin(); it != grants_.end(); ++it) {
    if (name == (*it)->subject) {
      return true;
    }
  }
  return false;
}

load()

int OpenDDS::Security::Permissions::load

(

const SSL::SignedDocument &

doc

)

Definition at line 19 of file Permissions.cpp.

References OpenDDS::DCPS::SecurityDebug::access_error, OpenDDS::DCPS::SecurityDebug::access_warn, ACE_DEBUG, ACE_ERROR, ACE_TEXT(), OpenDDS::Security::Permissions::Rule::actions, OpenDDS::Security::Permissions::Rule::ad_type, ALLOW, OpenDDS::Security::SSL::SignedDocument::content(), DENY, OpenDDS::Security::Permissions::Rule::domains, OpenDDS::Security::SSL::SignedDocument::filename(), find_grant(), OpenDDS::Security::XmlUtils::get_parser(), grants_, LM_ERROR, LM_WARNING, OpenDDS::Security::XmlUtils::parse_domain_id_set(), OpenDDS::Security::XmlUtils::parse_time(), OpenDDS::Security::Permissions::Action::partitions, OpenDDS::Security::Permissions::Action::ps_type, PUBLISH, OpenDDS::DCPS::security_debug, SUBSCRIBE, OpenDDS::DCPS::to_string(), and OpenDDS::Security::Permissions::Action::topics.

{
  using XML::XStr;
  using namespace XmlUtils;

  const std::string& xml = doc.content();
  ParserPtr parser;
  if (!get_parser(parser, doc.filename(), xml)) {
    if (security_debug.access_error) {
      ACE_ERROR((LM_ERROR, "(%P|%t) ERROR: {access_error} Permissions::load: "
        "get_parser failed\n"));
    }
    return -1;
  }

  // Find the validity rules
  const xercesc::DOMNodeList* const grantRules =
    parser->getDocument()->getElementsByTagName(XStr(ACE_TEXT("grant")));

  for (XMLSize_t r = 0, r_len = grantRules->getLength(); r < r_len; ++r) {
    Grant_rch grant = DCPS::make_rch<Grant>();
    const xercesc::DOMNode* const grantRule = grantRules->item(r);

    // Pull out the grant name for this grant
    xercesc::DOMNamedNodeMap* rattrs = grantRule->getAttributes();
    grant->name = to_string(rattrs->item(0));

    // Pull out subject name, validity, and default
    const xercesc::DOMNodeList* grantNodes = grantRule->getChildNodes();

    bool valid_subject = false, valid_default = false;
    for (XMLSize_t gn = 0, gn_len = grantNodes->getLength(); gn < gn_len; ++gn) {

      const xercesc::DOMNode* grantNode = grantNodes->item(gn);

      const XStr g_tag = grantNode->getNodeName();

      if (g_tag == ACE_TEXT("subject_name")) {
        valid_subject = grant->subject.parse(to_string(grantNode)) == 0;

      } else if (g_tag == ACE_TEXT("validity")) {
        const xercesc::DOMNodeList* validityNodes = grantNode->getChildNodes();
        for (XMLSize_t vn = 0, vn_len = validityNodes->getLength(); vn < vn_len; ++vn) {
          const xercesc::DOMNode* validityNode = validityNodes->item(vn);
          const XStr v_tag = validityNode->getNodeName();
          if (v_tag == ACE_TEXT("not_before")) {
            if (!parse_time(validityNode->getTextContent(), grant->validity.not_before)) {
              if (security_debug.access_error) {
                ACE_ERROR((LM_ERROR, "(%P|%t) ERROR: {access_error} Permissions::load: "
                  "invalid datetime in not_before\n"));
              }
              return -1;
            }
          } else if (v_tag == ACE_TEXT("not_after")) {
            if (!parse_time(validityNode->getTextContent(), grant->validity.not_after)) {
              if (security_debug.access_error) {
                ACE_ERROR((LM_ERROR, "(%P|%t) ERROR: {access_error} Permissions::load: "
                  "invalid datetime in not_after\n"));
              }
              return -1;
            }
          }
        }

      } else if (g_tag == ACE_TEXT("default")) {
        const std::string def = to_string(grantNode);
        valid_default = true;
        if (def == "ALLOW") {
          grant->default_permission = ALLOW;
        } else if (def == "DENY") {
          grant->default_permission = DENY;
        } else {
          if (security_debug.access_error) {
            ACE_ERROR((LM_ERROR, "(%P|%t) ERROR: {access_error} Permissions::load: "
              "<default> must be ALLOW or DENY\n"));
          }
          return -1;
        }
      }
    }

    if (!valid_default) {
      if (security_debug.access_error) {
        ACE_ERROR((LM_ERROR, "(%P|%t) ERROR: {access_error} Permissions::load: "
          "<default> is required\n"));
      }
      return -1;
    }

    // Pull out allow/deny rules
    const xercesc::DOMNodeList* adGrantNodes = grantRule->getChildNodes();

    for (XMLSize_t gn = 0, gn_len = adGrantNodes->getLength(); gn < gn_len; ++gn) {

      const xercesc::DOMNode* adGrantNode = adGrantNodes->item(gn);

      const XStr g_tag = adGrantNode->getNodeName();

      if (g_tag == ACE_TEXT("allow_rule") || g_tag == ACE_TEXT("deny_rule")) {
        Rule rule;

        rule.ad_type = (g_tag == ACE_TEXT("allow_rule")) ? ALLOW : DENY;

        const xercesc::DOMNodeList* adNodeChildren = adGrantNode->getChildNodes();

        for (XMLSize_t anc = 0, anc_len = adNodeChildren->getLength(); anc < anc_len; ++anc) {
          const xercesc::DOMNode* const adNodeChild = adNodeChildren->item(anc);
          const XStr anc_tag = adNodeChild->getNodeName();
          if (anc_tag == ACE_TEXT("domains")) {
            if (!parse_domain_id_set(adNodeChild, rule.domains)) {
              if (security_debug.access_error) {
                ACE_ERROR((LM_ERROR, "(%P|%t) ERROR: {access_error} Permissions::load: "
                  "failed to parse domain set\n"));
              }
              return -1;
            }

          } else if (anc_tag == ACE_TEXT("publish") || anc_tag == ACE_TEXT("subscribe")) {
            Action action;

            action.ps_type = (anc_tag == ACE_TEXT("publish")) ? PUBLISH : SUBSCRIBE;
            const xercesc::DOMNodeList* topicListNodes = adNodeChild->getChildNodes();

            for (XMLSize_t tln = 0, tln_len = topicListNodes->getLength(); tln < tln_len; ++tln) {

              const xercesc::DOMNode* topicListNode = topicListNodes->item(tln);

              if (ACE_TEXT("topics") == XStr(topicListNode->getNodeName())) {
                const xercesc::DOMNodeList* topicNodes = topicListNode->getChildNodes();

                for (XMLSize_t tn = 0, tn_len = topicNodes->getLength(); tn < tn_len; ++tn) {

                  const xercesc::DOMNode* topicNode = topicNodes->item(tn);

                  if (ACE_TEXT("topic") == XStr(topicNode->getNodeName())) {
                    action.topics.push_back(to_string(topicNode));
                  }
                }

              } else if (ACE_TEXT("partitions") == XStr(topicListNode->getNodeName())) {
                const xercesc::DOMNodeList* partitionNodes = topicListNode->getChildNodes();

                for (XMLSize_t pn = 0, pn_len = partitionNodes->getLength(); pn < pn_len; ++pn) {

                  const xercesc::DOMNode* partitionNode = partitionNodes->item(pn);

                  if (ACE_TEXT("partition") == XStr(partitionNode->getNodeName())) {
                    action.partitions.push_back(to_string(partitionNode));
                  }
                }
              }
            }

            rule.actions.push_back(action);
          }
        }

        grant->rules.push_back(rule);
      }
    }

    if (!valid_subject) {
      if (security_debug.access_warn) {
        ACE_DEBUG((LM_WARNING, ACE_TEXT("(%P|%t) WARNING: {access_warn} Permissions::load: ")
          ACE_TEXT("Unable to parse subject name, ignoring grant.\n")));
      }
    } else if (find_grant(grant->subject)) {
      if (security_debug.access_warn) {
        ACE_DEBUG((LM_WARNING, ACE_TEXT("(%P|%t) WARNING: {access_warn} Permissions::load: ")
          ACE_TEXT("Ignoring grant with duplicate subject name.\n")));
      }
    } else {
      grants_.push_back(grant);
    }
  } // grant_rules

  return 0;
}

Member Data Documentation

grants_

Grants OpenDDS::Security::Permissions::grants_

Definition at line 83 of file Permissions.h.

Referenced by find_grant(), has_grant(), and load().

perm_cred_token_

DDS::Security::PermissionsCredentialToken OpenDDS::Security::Permissions::perm_cred_token_

Definition at line 85 of file Permissions.h.

perm_token_

DDS::Security::PermissionsToken OpenDDS::Security::Permissions::perm_token_

Definition at line 84 of file Permissions.h.

---

The documentation for this struct was generated from the following files:

• Permissions.h
• Permissions.cpp