config-policy-manager.hpp

/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil -*- */
#ifndef NDN_CONFIG_POLICY_MANAGER_HPP
#define NDN_CONFIG_POLICY_MANAGER_HPP

#include <string>
#include <vector>
#include <map>
#include "certificate-cache.hpp"
#include "../v2/certificate-cache-v2.hpp"
#include "policy-manager.hpp"

// Give friend access to the tests.
class TestVerificationRules_NameRelation_Test;
class TestVerificationRules_SimpleRegex_Test;
class TestVerificationRules_Hierarchical_Test;
class TestVerificationRules_HyperRelation_Test;

namespace ndn {

class BoostInfoTree;
class BoostInfoParser;
class IdentityCertificate;

class ConfigPolicyManager : public PolicyManager {
public:
  ConfigPolicyManager
    (const std::string& configFileName = "",
     const ptr_lib::shared_ptr<CertificateCache>& certificateCache =
     ptr_lib::shared_ptr<CertificateCache>(), int searchDepth = 5,
     Milliseconds graceInterval = 3000, Milliseconds keyTimestampTtl = 3600000,
     int maxTrackedKeys = 1000);

  ConfigPolicyManager
    (const std::string& configFileName,
     const ptr_lib::shared_ptr<CertificateCacheV2>& certificateCache,
     int searchDepth = 5, Milliseconds graceInterval = 3000,
     Milliseconds keyTimestampTtl = 3600000, int maxTrackedKeys = 1000);

  virtual
  ~ConfigPolicyManager();

  void
  reset();

  void
  load(const std::string& configFileName);

  void
  load(const std::string& input, const std::string& inputName);

  virtual bool
  skipVerifyAndTrust(const Data& data);

  virtual bool
  skipVerifyAndTrust(const Interest& interest);

  virtual bool
  requireVerify(const Data& data);

  virtual bool
  requireVerify(const Interest& interest);

  virtual ptr_lib::shared_ptr<ValidationRequest>
  checkVerificationPolicy
    (const ptr_lib::shared_ptr<Data>& data, int stepCount,
     const OnVerified& onVerified,
     const OnDataValidationFailed& onValidationFailed);

  virtual ptr_lib::shared_ptr<ValidationRequest>
  checkVerificationPolicy
    (const ptr_lib::shared_ptr<Interest>& interest, int stepCount,
     const OnVerifiedInterest& onVerified,
     const OnInterestValidationFailed& onValidationFailed,
     WireFormat& wireFormat);

  virtual bool
  checkSigningPolicy(const Name& dataName, const Name& certificateName);

  virtual Name
  inferSigningIdentity(const Name& dataName);

private:
  // Give friend access to the tests.
  friend TestVerificationRules_NameRelation_Test;
  friend TestVerificationRules_SimpleRegex_Test;
  friend TestVerificationRules_Hierarchical_Test;
  friend TestVerificationRules_HyperRelation_Test;

  class TrustAnchorRefreshManager {
  public:
    TrustAnchorRefreshManager(bool isSecurityV1)
    : isSecurityV1_(isSecurityV1)
    {
    }

    static ptr_lib::shared_ptr<IdentityCertificate>
    loadIdentityCertificateFromFile(const std::string& filename);

    static ptr_lib::shared_ptr<CertificateV2>
    loadCertificateV2FromFile(const std::string& filename);

    ptr_lib::shared_ptr<IdentityCertificate>
    getCertificate(Name certificateName) const;

    ptr_lib::shared_ptr<CertificateV2>
    getCertificateV2(Name certificateName) const;

    void
    addDirectory(const std::string& directoryName, Milliseconds refreshPeriod);

    void
    refreshAnchors();

  private:
    class DirectoryInfo {
    public:
      DirectoryInfo
        (const std::vector<std::string>& certificateNames,
         MillisecondsSince1970 nextRefresh, Milliseconds refreshPeriod)
      : certificateNames_(certificateNames), nextRefresh_(nextRefresh),
        refreshPeriod_(refreshPeriod)
      {
      }

      std::vector<std::string> certificateNames_;
      MillisecondsSince1970 nextRefresh_;
      Milliseconds refreshPeriod_;
    };

    bool isSecurityV1_;
    CertificateCache certificateCache_;
    CertificateCacheV2 certificateCacheV2_;
    // refreshDirectories_ maps the directory name to certificate names so they
    //   can be deleted when necessary, and the next refresh time.
    std::map<std::string, ptr_lib::shared_ptr<DirectoryInfo> > refreshDirectories_;
  };

  void
  loadTrustAnchorCertificates();

  bool
  checkSignatureMatch
    (const Name& signatureName, const Name& objectName,
     const BoostInfoTree& rule, std::string& failureReason);

  ptr_lib::shared_ptr<IdentityCertificate>
  lookupCertificate(const std::string& certID, bool isPath);

  ptr_lib::shared_ptr<CertificateV2>
  lookupCertificateV2(const std::string& certID, bool isPath);

  const BoostInfoTree*
  findMatchingRule(const Name& objName, const std::string& matchType) const;

  static bool
  matchesRelation
    (const Name& name, const Name& matchName, const std::string& matchRelation);

  static ptr_lib::shared_ptr<Signature>
  extractSignature
    (const Interest& interest, WireFormat& wireFormat,
     std::string& failureReason);

  bool
  interestTimestampIsFresh
    (const Name& keyName, MillisecondsSince1970 timestamp,
     std::string& failureReason) const;

  void
  updateTimestampForKey(const Name& keyName, MillisecondsSince1970 timestamp);

  bool
  verify
    (const Signature* signatureInfo, const SignedBlob& signedBlob,
     std::string& failureReason) const;

  ptr_lib::shared_ptr<Interest>
  getCertificateInterest
    (int stepCount, const std::string& matchType, const Name& objectName,
     const Signature* signature, std::string& failureReason);

  void
  onCertificateDownloadComplete
    (const ptr_lib::shared_ptr<Data> &data,
     const ptr_lib::shared_ptr<Data> &originalData, int stepCount,
     const OnVerified& onVerified,
     const OnDataValidationFailed& onValidationFailed);

  void
  onCertificateDownloadCompleteForInterest
    (const ptr_lib::shared_ptr<Data> &data,
     const ptr_lib::shared_ptr<Interest> &originalInterest, int stepCount,
     const OnVerifiedInterest& onVerified,
     const OnInterestValidationFailed& onValidationFailed,
     WireFormat& wireFormat);

  bool isSecurityV1_;
  ptr_lib::shared_ptr<CertificateCache> certificateCache_;
  ptr_lib::shared_ptr<CertificateCacheV2> certificateCacheV2_;
  int maxDepth_;
  Milliseconds keyGraceInterval_;
  Milliseconds keyTimestampTtl_;
  int maxTrackedKeys_;
  // fixedCertificateCache_ stores the fixed-signer certificate name associated with
  //    validation rules so we don't keep loading from files.
  std::map<std::string, std::string> fixedCertificateCache_;
  // keyTimestamps_ stores the timestamps for each public key used in command
  //   interests to avoid replay attacks.
  // key is the public key name, value is the last timestamp.
  std::map<std::string, MillisecondsSince1970> keyTimestamps_;
  ptr_lib::shared_ptr<BoostInfoParser> config_;
  bool requiresVerification_;
  ptr_lib::shared_ptr<TrustAnchorRefreshManager> refreshManager_;
};

}

#endif