Groupcast Access Control: EXPERIMENTAL

src/access/BUILD.gn

@@ -59,6 +59,10 @@ static_library("access") {
     "examples/ExampleAccessControlDelegate.h",
     "examples/PermissiveAccessControlDelegate.cpp",
     "examples/PermissiveAccessControlDelegate.h",
+    "examples/ExtendedAccessControlDelegate.cpp",
+    "examples/ExtendedAccessControlDelegate.h",
+    "examples/GroupcastAccessControlDelegate.cpp",
+    "examples/GroupcastAccessControlDelegate.h",
   ]
 
   cflags = [ "-Wconversion" ]

src/access/ExtendedAccessControlDelegate.cpp

@@ -0,0 +1,153 @@
+#include "ExtendedAccessControlDelegate.h"
+#include <access/AccessControl.h>
+#include <access/AuthMode.h>
+#include <lib/support/PersistentArray.h>
+#include <lib/support/DefaultStorageKeyAllocator.h>
+#include <lib/support/Pool.h>
+
+// using namespace chip::Access;
+// using Entry         = AccessControl::Entry;
+// using EntryIterator = AccessControl::EntryIterator;
+// using Target        = AccessControl::Entry::Target;
+
+namespace chip {
+namespace Access {
+
+static constexpr size_t kIteratorsMax = 2;
+static ObjectPool<EntryIteratorDelegate, kIteratorsMax> sEntryIterators;
+
+void EntryIteratorDelegate::Release() {
+    if(mFirst) {
+        mFirst->Release();
+    }
+    if(mSecond) {
+        mSecond->Release();
+    }
+    sEntryIterators.ReleaseObject(this);
+}
+
+CHIP_ERROR EntryIteratorDelegate::Next(AccessControl::Entry & entry) {
+    VerifyOrReturnError(nullptr != mFirst, CHIP_ERROR_INCORRECT_STATE);
+    if(CHIP_NO_ERROR == mError) {
+        mError = mFirst->Next(entry);
+    }
+    if(mSecond && (CHIP_ERROR_SENTINEL == mError)) {
+        return mSecond->Next(entry);
+    }
+    return mError;
+}
+
+
+void ExtendedAccessControlDelegate::Release() {}
+
+CHIP_ERROR ExtendedAccessControlDelegate::Init(AccessControl::Delegate *primary, AccessControl::Delegate *secondary)
+{
+    VerifyOrReturnError((nullptr != primary) && (nullptr != secondary), CHIP_ERROR_INCORRECT_STATE);
+    // Primary
+    mPrimary = primary;
+    ReturnErrorOnFailure(mPrimary->Init());
+    // Secondary
+    mSecondary = secondary;
+    return mSecondary->Init();
+}
+
+void ExtendedAccessControlDelegate::Finish() {
+    if(mPrimary) {
+        mPrimary->Finish();
+    }
+    if(mSecondary) {
+        mSecondary->Finish();
+    }
+}
+
+// Capabilities
+CHIP_ERROR ExtendedAccessControlDelegate::GetMaxEntriesPerFabric(size_t & value) const
+{
+    ChipLogDetail(DeviceLayer, "~~~ ExtendedAccessControlDelegate::GetMaxEntriesPerFabric: #%p/%p\n", mPrimary, mSecondary);
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->GetMaxEntriesPerFabric(value);
+}
+
+CHIP_ERROR ExtendedAccessControlDelegate::GetMaxSubjectsPerEntry(size_t & value) const
+{
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->GetMaxSubjectsPerEntry(value);
+}
+
+CHIP_ERROR ExtendedAccessControlDelegate::GetMaxTargetsPerEntry(size_t & value) const
+{
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->GetMaxTargetsPerEntry(value);
+}
+
+CHIP_ERROR ExtendedAccessControlDelegate::GetMaxEntryCount(size_t & value) const
+{
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->GetMaxEntryCount(value);
+}
+
+// Actualities
+CHIP_ERROR ExtendedAccessControlDelegate::GetEntryCount(FabricIndex fabric, size_t & value) const
+{
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->GetEntryCount(fabric, value);
+}
+
+CHIP_ERROR ExtendedAccessControlDelegate::GetEntryCount(size_t & value) const
+{
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->GetEntryCount(value);
+}
+
+// Preparation
+CHIP_ERROR ExtendedAccessControlDelegate::PrepareEntry(AccessControl::Entry & entry) {
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->PrepareEntry(entry);
+}
+
+// CRUD
+CHIP_ERROR ExtendedAccessControlDelegate::CreateEntry(size_t * index, const AccessControl::Entry & entry, FabricIndex * fabricIndex) {
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->CreateEntry(index, entry, fabricIndex);
+}
+
+CHIP_ERROR ExtendedAccessControlDelegate::ReadEntry(size_t index, AccessControl::Entry & entry, const FabricIndex * fabricIndex) const {
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->ReadEntry(index, entry, fabricIndex);
+}
+
+CHIP_ERROR ExtendedAccessControlDelegate::UpdateEntry(size_t index, const AccessControl::Entry & entry, const FabricIndex * fabricIndex) {
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->UpdateEntry(index, entry, fabricIndex);
+}
+
+CHIP_ERROR ExtendedAccessControlDelegate::DeleteEntry(size_t index, const FabricIndex * fabricIndex) {
+    VerifyOrReturnError(nullptr != mPrimary, CHIP_ERROR_INCORRECT_STATE);
+    return mPrimary->DeleteEntry(index, fabricIndex);
+}
+
+// Iteration
+CHIP_ERROR ExtendedAccessControlDelegate::Entries(AccessControl::EntryIterator & iterator, const FabricIndex * fabricIndex) const {
+    VerifyOrReturnError(nullptr != mPrimary || nullptr != mSecondary, CHIP_ERROR_INCORRECT_STATE);
+    ChipLogDetail(DeviceLayer, "~~~ ExtendedAccessControlDelegate::Entries: #%p/%p\n", mPrimary, mSecondary);
+    // Primary
+    AccessControl::EntryIterator first;
+    ReturnErrorOnFailure(mPrimary->Entries(first, fabricIndex)); // TODO: OPTIONAL fabricIndex
+    AccessControl::EntryIterator::Delegate *it1 = &first.GetDelegate();
+    // Secondary
+    AccessControl::EntryIterator second;
+    ReturnErrorOnFailure(mSecondary->Entries(second, fabricIndex)); 
+    AccessControl::EntryIterator::Delegate *it2 = &second.GetDelegate();
+    // Delegate
+    AccessControl::EntryIterator::Delegate *delegate = sEntryIterators.CreateObject(it1, it2);
+    VerifyOrReturnError(delegate != nullptr, CHIP_ERROR_NO_MEMORY);
+    iterator.SetDelegate(*delegate);
+    return CHIP_NO_ERROR;
+}
+
+CHIP_ERROR ExtendedAccessControlDelegate::Check(const SubjectDescriptor & subjectDescriptor, const RequestPath & requestPath, Privilege requestPrivilege) {
+    return CHIP_ERROR_NOT_IMPLEMENTED;
+}
+
+} // namespace Access
+} // namespace chip

src/access/ExtendedAccessControlDelegate.h

@@ -0,0 +1,85 @@
+/*
+ *
+ *    Copyright (c) 2021 Project CHIP Authors
+ *
+ *    Licensed under the Apache License, Version 2.0 (the "License");
+ *    you may not use this file except in compliance with the License.
+ *    You may obtain a copy of the License at
+ *
+ *        http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *    Unless required by applicable law or agreed to in writing, software
+ *    distributed under the License is distributed on an "AS IS" BASIS,
+ *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *    See the License for the specific language governing permissions and
+ *    limitations under the License.
+ */
+#pragma once
+
+#include <access/AccessControl.h>
+
+namespace chip {
+namespace Access {
+
+class EntryIteratorDelegate: public AccessControl::EntryIterator::Delegate
+{
+public:
+    EntryIteratorDelegate(AccessControl::EntryIterator::Delegate *first, AccessControl::EntryIterator::Delegate *second):
+        mFirst(first), mSecond(second) {}
+
+    EntryIteratorDelegate(const Delegate &)             = delete;
+    EntryIteratorDelegate & operator=(const Delegate &) = delete;
+    virtual ~EntryIteratorDelegate() = default;
+
+    virtual void Release();
+    virtual CHIP_ERROR Next(AccessControl::Entry & entry);
+
+    CHIP_ERROR mError = CHIP_NO_ERROR;
+    AccessControl::EntryIterator::Delegate *mFirst = nullptr;
+    AccessControl::EntryIterator::Delegate *mSecond = nullptr;
+};
+
+class ExtendedAccessControlDelegate : public AccessControl::Delegate
+{
+public:
+    ExtendedAccessControlDelegate() = default;
+
+    ExtendedAccessControlDelegate(const Delegate &)             = delete;
+    ExtendedAccessControlDelegate & operator=(const Delegate &) = delete;
+    virtual ~ExtendedAccessControlDelegate() = default;
+
+    void Release() override;
+    using AccessControl::Delegate::Init;
+    CHIP_ERROR Init(AccessControl::Delegate *primary, AccessControl::Delegate *seconday);
+    virtual CHIP_ERROR Init() override { return CHIP_ERROR_NOT_IMPLEMENTED; }
+    virtual void Finish() override;
+
+    // Capabilities
+    CHIP_ERROR GetMaxEntriesPerFabric(size_t & value) const override;
+    CHIP_ERROR GetMaxSubjectsPerEntry(size_t & value) const override;
+    CHIP_ERROR GetMaxTargetsPerEntry(size_t & value) const override;
+    CHIP_ERROR GetMaxEntryCount(size_t & value) const override;
+
+    // Actualities
+    CHIP_ERROR GetEntryCount(FabricIndex fabric, size_t & value) const override;
+    CHIP_ERROR GetEntryCount(size_t & value) const override;
+
+    // CRUD
+    CHIP_ERROR PrepareEntry(AccessControl::Entry & entry) override;
+    CHIP_ERROR CreateEntry(size_t * index, const AccessControl::Entry & entry, FabricIndex * fabricIndex) override;
+    CHIP_ERROR ReadEntry(size_t index, AccessControl::Entry & entry, const FabricIndex * fabricIndex) const override;
+    CHIP_ERROR UpdateEntry(size_t index, const AccessControl::Entry & entry, const FabricIndex * fabricIndex) override;
+    CHIP_ERROR DeleteEntry(size_t index, const FabricIndex * fabricIndex) override;
+
+    // Iteration
+    CHIP_ERROR Entries(AccessControl::EntryIterator & iterator, const FabricIndex * fabricIndex) const override;
+
+    CHIP_ERROR Check(const SubjectDescriptor & subjectDescriptor, const RequestPath & requestPath, Privilege requestPrivilege) override;
+
+private:
+    AccessControl::Delegate *mPrimary = nullptr;
+    AccessControl::Delegate *mSecondary = nullptr;
+};
+
+} // namespace Access
+} // namespace chip