net.named_data.jndn.security.policy.ConfigPolicyManager Maven / Gradle / Ivy
/**
* Copyright (C) 2015-2018 Regents of the University of California.
* @author: Jeff Thompson
* From PyNDN config_policy_manager.py by Adeola Bannis.
* Originally from Yingdi Yu anchors = config_.getRoot().get("validator/trust-anchor");
for (int i = 0; i < anchors.size(); ++i) {
BoostInfoTree anchor = anchors.get(i);
String typeName = anchor.getFirstValue("type");
boolean isPath = false;
String certID = null;
if (typeName.equals("file")) {
certID = anchor.getFirstValue("file-name");
isPath = true;
}
else if (typeName.equals("base64")) {
certID = anchor.getFirstValue("base64-string");
isPath = false;
}
else if (typeName.equals("dir")) {
String dirName = anchor.getFirstValue("dir");
double refreshPeriod = 0;
ArrayList refreshTrees = anchor.get("refresh");
if (refreshTrees.size() >= 1) {
String refreshPeriodStr = refreshTrees.get(0).getValue();
Pattern regex1 = Pattern.compile("(\\d+)([hms])");
Matcher refreshMatch = regex1.matcher(refreshPeriodStr);
if (!refreshMatch.find())
refreshPeriod = 0;
else {
refreshPeriod = Integer.parseInt(refreshMatch.group(1));
if (!refreshMatch.group(2).equals("s")) {
refreshPeriod *= 60;
if (!refreshMatch.group(2).equals("m"))
refreshPeriod *= 60;
}
}
}
// Convert refreshPeriod from seconds to milliseconds.
refreshManager_.addDirectory(dirName, refreshPeriod * 1000);
continue;
}
else if (typeName.equals("any")) {
// This disables all security!
requiresVerification_ = false;
break;
}
if (isSecurityV1_)
lookupCertificate(certID, isPath);
else
lookupCertificateV2(certID, isPath);
}
}
/**
* Once a rule is found to match data or a signed interest, the name in the
* KeyLocator must satisfy the condition in the 'checker' section of the rule,
* else the data or interest is rejected.
* @param signatureName The certificate name from the KeyLocator.
* @param objectName The name of the data packet or interest. In the case of
* signed interests, this excludes the timestamp, nonce and signature
* components.
* @param rule The rule from the configuration file that matches the data or
* interest.
* @param failureReason If matching fails, set failureReason[0] to the
* failure reason.
* @return True if matches.
*/
private boolean
checkSignatureMatch
(Name signatureName, Name objectName, BoostInfoTree rule,
String[] failureReason)
throws SecurityException, NdnRegexMatcherBase.Error, CertificateV2.Error
{
BoostInfoTree checker = rule.get("checker").get(0);
String checkerType = checker.getFirstValue("type");
if (checkerType.equals("fixed-signer")) {
BoostInfoTree signerInfo = checker.get("signer").get(0);
String signerType = signerInfo.getFirstValue("type");
Name certificateName;
if (signerType.equals("file")) {
if (isSecurityV1_) {
Certificate cert = lookupCertificate
(signerInfo.getFirstValue("file-name"), true);
if (cert == null) {
failureReason[0] = "Can't find fixed-signer certificate file: " +
signerInfo.getFirstValue("file-name");
return false;
}
certificateName = cert.getName();
}
else {
CertificateV2 cert = lookupCertificateV2
(signerInfo.getFirstValue("file-name"), true);
if (cert == null) {
failureReason[0] = "Can't find fixed-signer certificate file: " +
signerInfo.getFirstValue("file-name");
return false;
}
certificateName = cert.getName();
}
}
else if (signerType.equals("base64")) {
if (isSecurityV1_) {
Certificate cert = lookupCertificate
(signerInfo.getFirstValue("base64-string"), false);
if (cert == null) {
failureReason[0] = "Can't find fixed-signer certificate base64: " +
signerInfo.getFirstValue("base64-string");
return false;
}
certificateName = cert.getName();
}
else {
CertificateV2 cert = lookupCertificateV2
(signerInfo.getFirstValue("base64-string"), false);
if (cert == null) {
failureReason[0] = "Can't find fixed-signer certificate base64: " +
signerInfo.getFirstValue("base64-string");
return false;
}
certificateName = cert.getName();
}
}
else {
failureReason[0] = "Unrecognized fixed-signer signerType: " + signerType;
return false;
}
if (certificateName.equals(signatureName))
return true;
else {
failureReason[0] = "fixed-signer cert name \"" + certificateName.toUri() +
"\" does not equal signatureName \"" + signatureName.toUri() + "\"";
return false;
}
}
else if (checkerType.equals("hierarchical")) {
// This just means the data/interest name has the signing identity as a prefix.
// That means everything before "ksk-?" in the key name.
String identityRegex = "^([^]*)(<>*)";
NdnRegexTopMatcher identityMatch = new NdnRegexTopMatcher
(identityRegex);
if (identityMatch.match(signatureName)) {
Name identityPrefix = identityMatch.expand("\\1")
.append(identityMatch.expand("\\2"));
if (matchesRelation(objectName, identityPrefix, "is-prefix-of"))
return true;
else {
failureReason[0] = "The hierarchical objectName \"" + objectName.toUri() +
"\" is not a prefix of \"" + identityPrefix + "\"";
return false;
}
}
if (!isSecurityV1_) {
// Check for a security v2 key name.
String identityRegex2 = "^(<>*)<>$";
NdnRegexTopMatcher identityMatch2 = new NdnRegexTopMatcher
(identityRegex2);
if (identityMatch2.match(signatureName)) {
Name identityPrefix = identityMatch2.expand("\\1");
if (matchesRelation(objectName, identityPrefix, "is-prefix-of"))
return true;
else {
failureReason[0] = "The hierarchical objectName \"" + objectName.toUri() +
"\" is not a prefix of \"" + identityPrefix + "\"";
return false;
}
}
}
failureReason[0] = "The hierarchical identityRegex \"" + identityRegex +
"\" does not match signatureName \"" + signatureName.toUri() + "\"";
return false;
}
else if (checkerType.equals("customized")) {
BoostInfoTree keyLocatorInfo = checker.get("key-locator").get(0);
// Not checking type - only name is supported.
// Is this a simple relation?
String simpleRelationType = keyLocatorInfo.getFirstValue("relation");
if (simpleRelationType != null) {
Name matchName = new Name(keyLocatorInfo.getFirstValue("name"));
if (matchesRelation(signatureName, matchName, simpleRelationType))
return true;
else {
failureReason[0] = "The custom signatureName \"" + signatureName.toUri() +
"\" does not match matchName \"" + matchName.toUri() +
"\" using relation " + simpleRelationType;
return false;
}
}
// Is this a simple regex?
String simpleKeyRegex = keyLocatorInfo.getFirstValue("regex");
if (simpleKeyRegex != null) {
if (new NdnRegexTopMatcher(simpleKeyRegex).match(signatureName))
return true;
else {
failureReason[0] = "The custom signatureName \"" + signatureName.toUri() +
"\" does not regex match simpleKeyRegex \"" + simpleKeyRegex + "\"";
return false;
}
}
// Is this a hyper-relation?
ArrayList hyperRelationList = keyLocatorInfo.get("hyper-relation");
if (hyperRelationList.size() >= 1) {
BoostInfoTree hyperRelation = hyperRelationList.get(0);
String keyRegex = hyperRelation.getFirstValue("k-regex");
String keyExpansion = hyperRelation.getFirstValue("k-expand");
String nameRegex = hyperRelation.getFirstValue("p-regex");
String nameExpansion = hyperRelation.getFirstValue("p-expand");
String relationType = hyperRelation.getFirstValue("h-relation");
if (keyRegex != null && keyExpansion != null && nameRegex != null &&
nameExpansion != null && relationType != null) {
NdnRegexTopMatcher keyMatch = new NdnRegexTopMatcher(keyRegex);
if (!keyMatch.match(signatureName)) {
failureReason[0] = "The custom hyper-relation signatureName \"" +
signatureName.toUri() + "\" does not match the keyRegex \"" +
keyRegex + "\"";
return false;
}
Name keyMatchPrefix = keyMatch.expand(keyExpansion);
NdnRegexTopMatcher nameMatch = new NdnRegexTopMatcher(nameRegex);
if (!nameMatch.match(objectName)) {
failureReason[0] = "The custom hyper-relation objectName \"" +
objectName.toUri() + "\" does not match the nameRegex \"" +
nameRegex + "\"";
return false;
}
Name nameMatchExpansion = nameMatch.expand(nameExpansion);
if (matchesRelation(nameMatchExpansion, keyMatchPrefix, relationType))
return true;
else {
failureReason[0] = "The custom hyper-relation nameMatch \"" +
nameMatchExpansion.toUri() + "\" does not match the keyMatchPrefix \"" +
keyMatchPrefix + "\" using relation " + relationType;
return false;
}
}
}
}
failureReason[0] = "Unrecognized checkerType: " + checkerType;
return false;
}
/**
* Similar to Python expand, return expansion where every \1, \2, etc. is
* replaced by match.group(1), match.group(2), etc. Note: Even though this is
* a general utility function, we define it locally because it is only tested
* to work in the cases used by this class.
* @param match The match object from String.match.
* @param expansion The string with \1, \2, etc. to replace from match.
* @return The expanded string.
*/
private static String
expand(Matcher match, String expansion)
{
String result = "";
int beginIndex = 0;
Pattern regex = Pattern.compile("\\\\(\\d)");
Matcher expansionMatcher = regex.matcher(expansion);
while (expansionMatcher.find()) {
result += expansion.substring(beginIndex, expansionMatcher.start());
result += match.group(Integer.parseInt(expansionMatcher.group(1)));
beginIndex = expansionMatcher.end();
}
// Add the substring after the last match.
result += expansion.substring(beginIndex, expansion.length());
return result;
}
/**
* This looks up certificates specified as base64-encoded data or file names.
* These are cached by filename or encoding to avoid repeated reading of files
* or decoding.
* @param certID
* @param isPath
* @return The IdentityCertificate or null if not found.
*/
private IdentityCertificate
lookupCertificate(String certID, boolean isPath) throws SecurityException
{
if (!isSecurityV1_)
throw new SecurityException
("lookupCertificate: For security v2, use lookupCertificateV2()");
IdentityCertificate cert;
if (!fixedCertificateCache_.containsKey(certID)) {
if (isPath)
// Load the certificate data (base64 encoded IdentityCertificate)
cert = TrustAnchorRefreshManager.loadIdentityCertificateFromFile(certID);
else {
byte[] certData = Common.base64Decode(certID);
cert = new IdentityCertificate();
try {
cert.wireDecode(new Blob(certData, false));
} catch (EncodingException ex) {
throw new SecurityException("Cannot base64 decode the cert data: " +
ex.getMessage());
}
}
String certUri = cert.getName().getPrefix(-1).toUri();
fixedCertificateCache_.put(certID, certUri);
certificateCache_.insertCertificate(cert);
}
else
cert = certificateCache_.getCertificate
(new Name((String)fixedCertificateCache_.get(certID)));
return cert;
}
/**
* This looks up certificates specified as base64-encoded data or file names.
* These are cached by filename or encoding to avoid repeated reading of files
* or decoding.
* @param certID
* @param isPath
* @return The CertificateV2 or null if not found.
*/
private CertificateV2
lookupCertificateV2(String certID, boolean isPath)
throws SecurityException, CertificateV2.Error
{
if (isSecurityV1_)
throw new SecurityException
("lookupCertificateV2: For security v1, use lookupCertificate()");
CertificateV2 cert;
if (!fixedCertificateCache_.containsKey(certID)) {
if (isPath)
// Load the certificate data (base64 encoded IdentityCertificate)
cert = TrustAnchorRefreshManager.loadCertificateV2FromFile(certID);
else {
byte[] certData = Common.base64Decode(certID);
cert = new CertificateV2();
try {
cert.wireDecode(new Blob(certData, false));
} catch (EncodingException ex) {
throw new SecurityException("Cannot base64 decode the cert data: " +
ex.getMessage());
}
}
String certUri = cert.getName().getPrefix(-1).toUri();
fixedCertificateCache_.put(certID, certUri);
certificateCacheV2_.insert(cert);
}
else
cert = certificateCacheV2_.find
(new Name((String)fixedCertificateCache_.get(certID)));
return cert;
}
/**
* Search the configuration file for the first rule that matches the data or
* signed interest name. In the case of interests, the name to match should
* exclude the timestamp, nonce, and signature components.
* @param objName The name to be matched.
* @param matchType The rule type to match, "data" or "interest".
* @return The BoostInfoTree for the matching rule, or null if not found.
*/
private BoostInfoTree
findMatchingRule(Name objName, String matchType)
throws NdnRegexMatcherBase.Error
{
ArrayList rules = config_.getRoot().get("validator/rule");
for (int iRule = 0; iRule < rules.size(); ++iRule) {
BoostInfoTree r = rules.get(iRule);
if (r.getFirstValue("for").equals(matchType)) {
boolean passed = true;
ArrayList filters = r.get("filter");
if (filters.isEmpty())
// no filters means we pass!
return r;
else {
for (int iFilter = 0; iFilter < filters.size(); ++iFilter) {
BoostInfoTree f = filters.get(iFilter);
// Don't check the type - it can only be name for now.
// We need to see if this is a regex or a relation.
String regexPattern = f.getFirstValue("regex");
if (regexPattern == null) {
String matchRelation = f.getFirstValue("relation");
String matchUri = f.getFirstValue("name");
Name matchName = new Name(matchUri);
passed = matchesRelation(objName, matchName, matchRelation);
}
else
passed = new NdnRegexTopMatcher(regexPattern).match(objName);
if (!passed)
break;
}
if (passed)
return r;
}
}
}
return null;
}
/**
* Determines if a name satisfies the relation to another name, based on
* matchRelation.
* @param name
* @param matchName
* @param matchRelation Can be one of:
"is-prefix-of" - passes if the name is equal to or has the other
name as a prefix
"is-strict-prefix-of" - passes if the name has the other name as a
prefix, and is not equal
"equal" - passes if the two names are equal
* @return True if matches.
*/
private static boolean
matchesRelation(Name name, Name matchName, String matchRelation)
{
boolean passed = false;
if (matchRelation.equals("is-strict-prefix-of")) {
if (matchName.size() == name.size())
passed = false;
else if (matchName.match(name))
passed = true;
}
else if (matchRelation.equals("is-prefix-of")) {
if (matchName.match(name))
passed = true;
}
else if (matchRelation.equals("equal")) {
if (matchName.equals(name))
passed = true;
}
return passed;
}
/**
* Extract the signature information from the interest name.
* @param interest The interest whose signature is needed.
* @param wireFormat The wire format used to decode signature information
* from the interest name.
* @param failureReason If can't decode, set failureReason[0] to the failure
* reason.
* @return A shared_ptr for the Signature object. This is null if can't decode.
*/
private static Signature
extractSignature
(Interest interest, WireFormat wireFormat, String[] failureReason)
{
if (interest.getName().size() < 2) {
failureReason[0] = "The signed interest has less than 2 components: " +
interest.getName().toUri();
return null;
}
try {
return wireFormat.decodeSignatureInfoAndValue
(interest.getName().get(-2).getValue().buf(),
interest.getName().get(-1).getValue().buf(), false);
} catch (EncodingException ex) {
failureReason[0] = "Error decoding the signed interest signature: " + ex;
return null;
}
}
/**
* Determine whether the timestamp from the interest is newer than the last
* use of this key, or within the grace interval on first use.
* @param keyName The name of the public key used to sign the interest.
* @param timestamp The timestamp extracted from the interest name.
* @param failureReason If timestamp is not fresh, set failureReason[0] to the
* failure reason.
* @return True if timestamp is fresh as described above.
*/
private boolean
interestTimestampIsFresh(Name keyName, double timestamp, String[] failureReason)
{
String keyNameUri = keyName.toUri();
if (!keyTimestamps_.containsKey(keyNameUri)) {
double now = Common.getNowMilliseconds();
double notBefore = now - keyGraceInterval_;
double notAfter = now + keyGraceInterval_;
if (!(timestamp > notBefore && timestamp < notAfter)) {
failureReason[0] =
"The command interest timestamp is not within the first use grace period of " +
keyGraceInterval_ + " milliseconds.";
return false;
}
else
return true;
}
else {
double lastTimestamp = (double)(Double)keyTimestamps_.get(keyNameUri);
if (timestamp <= lastTimestamp) {
failureReason[0] =
"The command interest timestamp is not newer than the previous timestamp";
return false;
}
return true;
}
}
/**
* Trim the table size down if necessary, and insert/update the latest
* interest signing timestamp for the key. Any key which has not been used
* within the TTL period is purged. If the table is still too large, the
* oldest key is purged.
* @param keyName The name of the public key used to sign the interest.
* @param timestamp The timestamp extracted from the interest name.
*/
private void
updateTimestampForKey(Name keyName, double timestamp)
{
keyTimestamps_.put(keyName.toUri(), timestamp);
if (keyTimestamps_.size() >= maxTrackedKeys_) {
double now = Common.getNowMilliseconds();
double oldestTimestamp = now;
String oldestKey = "";
// Get the keys to erase without disturbing the map.
// Use ArrayList without generics so it works with older Java compilers.
ArrayList keysToErase = new ArrayList();
Object[] keys = keyTimestamps_.keySet().toArray();
for (int i = 0; i < keys.length; ++i) {
String keyUri = (String)keys[i];
double ts = (double)(Double)keyTimestamps_.get(keyUri);
if (now - ts > keyTimestampTtl_)
keysToErase.add(keyUri);
else if (ts < oldestTimestamp) {
oldestTimestamp = ts;
oldestKey = keyUri;
}
}
// Now erase.
for (int i = 0; i < keysToErase.size(); ++i)
keyTimestamps_.remove(keysToErase.get(i));
if (keyTimestamps_.size() > maxTrackedKeys_ && oldestKey.length() != 0)
// have not removed enough
keyTimestamps_.remove(oldestKey);
}
}
/**
* Check the type of signatureInfo to get the KeyLocator. Look in the
* IdentityStorage for the public key with the name in the KeyLocator and use
* it to verify the signedBlob. If the public key can't be found, return
* false. (This is a generalized method which can verify both a Data packet
* and an interest.)
* @param signatureInfo An object of a subclass of Signature, e.g.
* Sha256WithRsaSignature.
* @param signedBlob the SignedBlob with the signed portion to verify.
* @param failureReason If verification fails, set failureReason[0] to the
* failure reason.
* @return True if the signature verifies, False if not.
*/
private boolean
verify(Signature signatureInfo, SignedBlob signedBlob, String[] failureReason)
throws SecurityException
{
// We have already checked once that there is a key locator.
KeyLocator keyLocator = KeyLocator.getFromSignature(signatureInfo);
if (keyLocator.getType() == KeyLocatorType.KEYNAME) {
// Assume the key name is a certificate name.
Name signatureName = keyLocator.getKeyName();
Blob publicKeyDer;
if (isSecurityV1_) {
IdentityCertificate certificate =
refreshManager_.getCertificate(signatureName);
if (certificate == null)
certificate = certificateCache_.getCertificate(signatureName);
if (certificate == null) {
failureReason[0] = "Cannot find a certificate with name " +
signatureName.toUri();
return false;
}
publicKeyDer = certificate.getPublicKeyInfo().getKeyDer();
if (publicKeyDer.isNull()) {
// We don't expect this to happen.
failureReason[0] = "There is no public key in the certificate with name " +
certificate.getName().toUri();
return false;
}
}
else {
CertificateV2 certificate =
refreshManager_.getCertificateV2(signatureName);
if (certificate == null)
certificate = certificateCacheV2_.find(signatureName);
if (certificate == null) {
failureReason[0] = "Cannot find a certificate with name " +
signatureName.toUri();
return false;
}
try {
publicKeyDer = certificate.getPublicKey();
} catch (CertificateV2.Error ex) {
// We don't expect this to happen.
failureReason[0] = "There is no public key in the certificate with name " +
certificate.getName().toUri();
return false;
}
}
if (verifySignature(signatureInfo, signedBlob, publicKeyDer))
return true;
else {
failureReason[0] = "The signature did not verify with the given public key";
return false;
}
}
else {
failureReason[0] = "The KeyLocator does not have a key name";
return false;
}
}
/**
* This is a helper for checkVerificationPolicy to verify the rule and return
* a certificate interest to fetch the next certificate in the hierarchy if
* needed.
* @param stepCount The number of verification steps that have been done, used
* to track the verification progress.
* @param matchType Either "data" or "interest".
* @param objectName The name of the data or interest packet.
* @param signature The Signature object for the data or interest packet.
* @param failureReason If can't determine the interest, set failureReason[0]
* to the failure reason.
* @return null if can't determine the interest, otherwise the interest for the
* ValidationRequest to fetch the next certificate. However, if the interest
* has an empty name, the validation succeeded and no need to fetch a
* certificate.
*/
private Interest
getCertificateInterest
(int stepCount, String matchType, Name objectName, Signature signature,
String[] failureReason)
throws SecurityException, NdnRegexMatcherBase.Error, CertificateV2.Error
{
if (stepCount > maxDepth_) {
failureReason[0] = "The verification stepCount " + stepCount +
" exceeded the maxDepth " + maxDepth_;
return null;
}
// first see if we can find a rule to match this packet
BoostInfoTree matchedRule = findMatchingRule(objectName, matchType);
// No matching rule -> fail.
if (matchedRule == null) {
failureReason[0] = "No matching rule found for " + objectName.toUri();
return null;
}
// TODO: Do a quick check if this is sig-type sha256.
if (!KeyLocator.canGetFromSignature(signature)) {
// We only support signature types with key locators.
failureReason[0] = "The signature type does not support a KeyLocator";
return null;
}
KeyLocator keyLocator = KeyLocator.getFromSignature(signature);
Name signatureName = keyLocator.getKeyName();
// No key name in KeyLocator -> fail.
if (signatureName.size() == 0) {
failureReason[0] = "The signature KeyLocator doesn't have a key name";
return null;
}
boolean signatureMatches = checkSignatureMatch
(signatureName, objectName, matchedRule, failureReason);
if (!signatureMatches)
return null;
// Before we look up keys, refresh any certificate directories.
refreshManager_.refreshAnchors();
// If we don't actually have the certificate yet, return a certificateInterest
// for it.
if (isSecurityV1_) {
IdentityCertificate foundCert = refreshManager_.getCertificate(signatureName);
if (foundCert == null)
foundCert = certificateCache_.getCertificate(signatureName);
if (foundCert == null)
return new Interest(signatureName);
}
else {
CertificateV2 foundCert = refreshManager_.getCertificateV2(signatureName);
if (foundCert == null)
foundCert = certificateCacheV2_.find(signatureName);
if (foundCert == null)
return new Interest(signatureName);
}
return new Interest();
}
/**
* The onVerified method of this inner class is called by KeyChain.verifyData
* because checkVerificationPolicy returned a ValidationRequest to fetch a
* certificate and verify a certificate, through a separate call to
* KeyChain.verifyData. When it verifies the data, it calls onVerified which
* is this method.
* @param data The fetched data packet containing the certificate which has
* already been verified.
* @param originalData The original data from checkVerificationPolicy.
* @param stepCount The value from checkVerificationPolicy.
* @param onVerified The value from checkVerificationPolicy.
* @param onValidationFailed The value from checkVerificationPolicy.
*/
private class OnCertificateDownloadComplete implements OnVerified {
public OnCertificateDownloadComplete
(Data originalData, int stepCount, OnVerified onVerified,
OnDataValidationFailed onValidationFailed)
{
originalData_ = originalData;
stepCount_ = stepCount;
onVerified_ = onVerified;
onValidationFailed_ = onValidationFailed;
}
public final void
onVerified(Data data)
{
if (isSecurityV1_) {
IdentityCertificate certificate;
try {
certificate = new IdentityCertificate(data);
} catch (DerDecodingException ex) {
try {
onValidationFailed_.onDataValidationFailed
(originalData_, "Cannot decode certificate " + data.getName().toUri());
} catch (Throwable exception) {
logger_.log(Level.SEVERE, "Error in onDataValidationFailed", exception);
}
return;
}
certificateCache_.insertCertificate(certificate);
}
else {
CertificateV2 certificate;
try {
certificate = new CertificateV2(data);
} catch (CertificateV2.Error ex) {
try {
onValidationFailed_.onDataValidationFailed
(originalData_, "Cannot decode certificate " + data.getName().toUri());
} catch (Throwable exception) {
logger_.log(Level.SEVERE, "Error in onDataValidationFailed", exception);
}
return;
}
try {
certificateCacheV2_.insert(certificate);
} catch (CertificateV2.Error ex) {
try {
onValidationFailed_.onDataValidationFailed
(originalData_, "Cannot insert certificate " + data.getName().toUri());
} catch (Throwable exception) {
logger_.log(Level.SEVERE, "Error in onDataValidationFailed", exception);
}
return;
}
}
try {
// Now that we stored the needed certificate, increment stepCount and try again
// to verify the originalData.
checkVerificationPolicy
(originalData_, stepCount_ + 1, onVerified_, onValidationFailed_);
} catch (Exception ex) {
try {
onValidationFailed_.onDataValidationFailed
(originalData_, "Error in checkVerificationPolicy: " + ex);
} catch (Throwable exception) {
logger_.log(Level.SEVERE, "Error in onDataValidationFailed", exception);
}
}
}
private final Data originalData_;
private final int stepCount_;
private final OnVerified onVerified_;
private final OnDataValidationFailed onValidationFailed_;
}
/**
* The onVerified method of this inner class is called by KeyChain.verifyData
* because checkVerificationPolicy returned a ValidationRequest to fetch a
* certificate and verify a certificate, through a separate call to
* KeyChain.verifyData. When it verifies the data, it calls onVerified which
* is this method.
* @param data The fetched data packet containing the certificate which has
* already been verified.
* @param originalInterest The original interest from checkVerificationPolicy.
* @param stepCount The value from checkVerificationPolicy.
* @param onVerified The value from checkVerificationPolicy.
* @param onValidationFailed The value from checkVerificationPolicy.
*/
private class OnCertificateDownloadCompleteForInterest implements OnVerified {
public OnCertificateDownloadCompleteForInterest
(Interest originalInterest, int stepCount,
OnVerifiedInterest onVerified,
OnInterestValidationFailed onValidationFailed, WireFormat wireFormat)
{
originalInterest_ = originalInterest;
stepCount_ = stepCount;
onVerified_ = onVerified;
onValidationFailed_ = onValidationFailed;
wireFormat_ = wireFormat;
}
public final void
onVerified(Data data)
{
if (isSecurityV1_) {
IdentityCertificate certificate;
try {
certificate = new IdentityCertificate(data);
} catch (DerDecodingException ex) {
try {
onValidationFailed_.onInterestValidationFailed
(originalInterest_, "Cannot decode certificate " + data.getName().toUri());
} catch (Throwable exception) {
logger_.log(Level.SEVERE, "Error in onInterestValidationFailed", exception);
}
return;
}
certificateCache_.insertCertificate(certificate);
}
else {
CertificateV2 certificate;
try {
certificate = new CertificateV2(data);
} catch (CertificateV2.Error ex) {
try {
onValidationFailed_.onInterestValidationFailed
(originalInterest_, "Cannot decode certificate " + data.getName().toUri());
} catch (Throwable exception) {
logger_.log(Level.SEVERE, "Error in onInterestValidationFailed", exception);
}
return;
}
try {
certificateCacheV2_.insert(certificate);
} catch (CertificateV2.Error ex) {
try {
onValidationFailed_.onInterestValidationFailed
(originalInterest_, "Cannot insert certificate " + data.getName().toUri());
} catch (Throwable exception) {
logger_.log(Level.SEVERE, "Error in onDataValidationFailed", exception);
}
return;
}
}
try {
// Now that we stored the needed certificate, increment stepCount and try again
// to verify the originalInterest.
checkVerificationPolicy
(originalInterest_, stepCount_ + 1, onVerified_, onValidationFailed_,
wireFormat_);
} catch (Exception ex) {
try {
onValidationFailed_.onInterestValidationFailed
(originalInterest_, "Error in checkVerificationPolicy: " + ex);
} catch (Throwable exception) {
logger_.log(Level.SEVERE, "Error in onInterestValidationFailed", exception);
}
}
}
private final Interest originalInterest_;
private final int stepCount_;
private final OnVerifiedInterest onVerified_;
private final OnInterestValidationFailed onValidationFailed_;
private final WireFormat wireFormat_;
}
/**
* Ignore data and call onInterestValidationFailed(interest, reason). This is
* so that an OnInterestValidationFailed can be passed as an
* OnDataValidationFailed.
*/
private class OnVerifyInterestFailedWrapper implements OnDataValidationFailed {
public OnVerifyInterestFailedWrapper
(OnInterestValidationFailed onValidationFailed, Interest interest)
{
onValidationFailed_ = onValidationFailed;
interest_ = interest;
}
public final void
onDataValidationFailed(Data data, String reason)
{
onValidationFailed_.onInterestValidationFailed(interest_, reason);
}
private final OnInterestValidationFailed onValidationFailed_;
private final Interest interest_;
}
/**
* A class implements Friend if it has a method
* setConfigPolicyManagerFriendAccess which setFriendAccess calls to set
* the FriendAccess object.
*/
public interface Friend {
void setConfigPolicyManagerFriendAccess(FriendAccess friendAccess);
}
/**
* Call friend.setConfigPolicyManagerFriendAccess to pass an instance of
* a FriendAccess class to allow a friend class to call private methods.
* @param friend The friend class for calling setConfigPolicyManagerFriendAccess.
* This uses friend.getClass() to make sure that it is a friend class.
* Therefore, only a friend class gets an implementation of FriendAccess.
*/
public static void setFriendAccess(Friend friend)
{
if (friend.getClass().getName().endsWith
("net.named_data.jndn.tests.integration_tests.TestPolicyManager") ||
friend.getClass().getName().endsWith
("net.named_data.jndn.tests.integration_tests.TestVerificationRules"))
{
friend.setConfigPolicyManagerFriendAccess(new FriendAccessImpl());
}
}
/**
* A friend class can call the methods of FriendAccess to access private
* methods. This abstract class is public, but setFriendAccess passes an
* instance of a private class which implements the methods.
*/
public abstract static class FriendAccess {
public abstract BoostInfoTree
findMatchingRule
(ConfigPolicyManager policyManager, Name objName, String matchType)
throws NdnRegexMatcherBase.Error;
public abstract boolean
checkSignatureMatch
(ConfigPolicyManager policyManager, Name signatureName, Name objectName,
BoostInfoTree rule, String[] failureReason)
throws SecurityException, NdnRegexMatcherBase.Error, CertificateV2.Error;
}
/**
* setFriendAccess passes an instance of this private class which implements
* the FriendAccess methods.
*/
private static class FriendAccessImpl extends FriendAccess {
public BoostInfoTree
findMatchingRule
(ConfigPolicyManager policyManager, Name objName, String matchType)
throws NdnRegexMatcherBase.Error
{
return policyManager.findMatchingRule(objName, matchType);
}
public boolean
checkSignatureMatch
(ConfigPolicyManager policyManager, Name signatureName, Name objectName,
BoostInfoTree rule, String[] failureReason)
throws SecurityException, NdnRegexMatcherBase.Error, CertificateV2.Error
{
return policyManager.checkSignatureMatch
(signatureName, objectName, rule, failureReason);
}
}
private final boolean isSecurityV1_;
private CertificateCache certificateCache_ = new CertificateCache();
private CertificateCacheV2 certificateCacheV2_ = new CertificateCacheV2();
private int maxDepth_ = 5;
private double keyGraceInterval_ = 3000;
private double keyTimestampTtl_ = 3600000;
private int maxTrackedKeys_ = 1000;
// fixedCertificateCache_ stores the fixed-signer certificate name associated with
// validation rules so we don't keep loading from files.
// Use HashMap without generics so it works with older Java compilers.
private final HashMap fixedCertificateCache_ = new HashMap();
// keyTimestamps_ stores the timestamps for each public key used in command
// interests to avoid replay attacks.
// key is the public key name, value is the last timestamp.
private final HashMap keyTimestamps_ = new HashMap();
private BoostInfoParser config_ = new BoostInfoParser();
private boolean requiresVerification_ = true;
private TrustAnchorRefreshManager refreshManager_;
private static final Logger logger_ = Logger.getLogger
(ConfigPolicyManager.class.getName());
}
© 2015 - 2025 Weber Informatics LLC | Privacy Policy