Star24
78
代码
代码
Issues37
Pull Requests10
项目讨论
Wiki
分析
Star24
78
已开启
新增Acl访问控制记录 #217
xulidc创建于 4 天前
新增Acl访问控制记录 #217
已开启
xulidc创建于 4 天前
从gcw_57lpmRFM/communication_iot_connectOpenHarmony-5.1.0-Release合入到ohos-oneconnect/communication_iot_connectOpenHarmony-5.1.0-Release
共 2 个文件变更+245-52
Mcore/security/service/sec_svc_manage.c+157-52
@@ -19,11 +19,16 @@
19#include "sec_utils_conf.h"19#include "sec_utils_conf.h"
20#include "iotc_errcode.h"20#include "iotc_errcode.h"
21#include "iotc_log.h"21#include "iotc_log.h"
22+#include "securec.h"
22#include "iotc_oh_device.h"23#include "iotc_oh_device.h"
23#include "utils_assert.h"24#include "utils_assert.h"
24#include "utils_common.h"25#include "utils_common.h"
25#include "utils_ecdsa.h"26#include "utils_ecdsa.h"
26 27 
28+static int32_t UpdatePskAclConfig(const SecPskAcl *acl);
29+static int32_t RemovePskAclConfigByPskId(const char *pskId);
30+static int32_t UpdateTerminalPskAcl(const SecPsk *secPsk);
31+ 
27static int32_t AddCertUpdateSign(const char *pvtKey, IotcJson *objCertUpdate, IotcJson *respJson)32static int32_t AddCertUpdateSign(const char *pvtKey, IotcJson *objCertUpdate, IotcJson *respJson)
28{33{
29 CHECK_RETURN_LOGW(objCertUpdate != NULL, IOTC_ERR_INVALID_PARAM, "param invalid");34 CHECK_RETURN_LOGW(objCertUpdate != NULL, IOTC_ERR_INVALID_PARAM, "param invalid");
@@ -187,54 +192,67 @@ IotcJson *SecSvcRecvUpdateCert(const IotcJson *json)
187 return UtilsJsonCreateCodeDesc(ret, NULL);192 return UtilsJsonCreateCodeDesc(ret, NULL);
188}193}
189 194 
195+static int32_t ParseSetPskRequest(const IotcJson *json, bool isAccess, SecPsk *secPsk)
196+{
197+ CHECK_RETURN_LOGW(json != NULL && secPsk != NULL, IOTC_ERR_INVALID_PARAM, "param invalid");
198+ char pskHex[HEXIFY_LEN(sizeof(secPsk->psk)) + 1] = {0};
199+ UtilsJsonStrBufItem strItem[] = {
200+ {STR_JSON_PSK_ID, secPsk->pskId, sizeof(secPsk->pskId)},
201+ {STR_JSON_PSK, pskHex, sizeof(pskHex)},
202+ {STR_JSON_VALID, secPsk->valid, sizeof(secPsk->valid)},
203+ };
204+ int32_t ret = UtilsJsonParseStrTable(json, strItem, ARRAY_SIZE(strItem));
205+ if (ret != IOTC_OK) {
206+ IOTC_LOGE("parse provisionPsk error %d", ret);
207+ return ret;
208+ }
209+ if (!UtilsUnhexify(pskHex, HEXIFY_LEN(sizeof(secPsk->psk)), secPsk->psk, sizeof(secPsk->psk))) {
210+ IOTC_LOGE("unhexify psk error");
211+ return IOTC_CORE_COMM_UTILS_ERR_UNHEXIFY;
212+ }
213+ 
214+ int32_t pskType = 0;
215+ ret = UtilsJsonGetNum(json, STR_JSON_PSK_TYPE, &pskType);
216+ if (ret != IOTC_OK) {
217+ IOTC_LOGE("get pskType error %d", ret);
218+ return ret;
219+ }
220+ /* 暂时只支持一个管理员级别terminal psk */
221+ bool isValidPskType = isAccess ?
222+ (pskType >= SEC_PSK_TYPE_MANAGE && pskType <= SEC_PSK_TYPE_OPERATE) :
223+ (pskType == SEC_PSK_TYPE_ADMIN);
224+ if (!isValidPskType) {
225+ IOTC_LOGE("pskType[%d] invalid", pskType);
226+ return IOTC_ERR_INVALID_PARAM;
227+ }
228+ secPsk->pskType = (uint8_t)pskType;
229+ return IOTC_OK;
230+}
231+ 
190static int32_t SecSvcSetPskInner(const IotcJson *json, bool isAccess)232static int32_t SecSvcSetPskInner(const IotcJson *json, bool isAccess)
191{233{
192- int32_t ret = IOTC_OK;234+ SecPsk secPsk = {0};
193- do {235+ int32_t ret = ParseSetPskRequest(json, isAccess, &secPsk);
194- SecPsk secPsk = {0};236+ if (ret != IOTC_OK) {
195- char pskHex[HEXIFY_LEN(sizeof(secPsk.psk)) + 1] = {0};237+ return ret;
196- UtilsJsonStrBufItem strItem[] = {238+ }
197- {STR_JSON_PSK_ID, secPsk.pskId, sizeof(secPsk.pskId)},239+ 
198- {STR_JSON_PSK, pskHex, sizeof(pskHex)},240+ ret = SecUtilsConfSetPsk(&secPsk, isAccess);
199- {STR_JSON_VALID, secPsk.valid, sizeof(secPsk.valid)},241+ if (ret != IOTC_OK) {
200- };242+ IOTC_LOGE("config error %d", ret);
201- ret = UtilsJsonParseStrTable(json, strItem, ARRAY_SIZE(strItem));243+ return ret;
244+ }
245+ if (!isAccess) {
246+ ret = UpdateTerminalPskAcl(&secPsk);
202 if (ret != IOTC_OK) {247 if (ret != IOTC_OK) {
203- IOTC_LOGE("parse provisionPsk error %d", ret);248+ IOTC_LOGE("update psk acl error %d", ret);
204- break;249+ return ret;
205 }250 }
206- if (!UtilsUnhexify(pskHex, HEXIFY_LEN(sizeof(secPsk.psk)), secPsk.psk, sizeof(secPsk.psk))) {251+ }
207- IOTC_LOGE("unhexify psk error");252+ ret = SecConfInfoSave();
208- ret = IOTC_CORE_COMM_UTILS_ERR_UNHEXIFY;253+ if (ret != IOTC_OK) {
209- break;254+ IOTC_LOGE("save error %d", ret);
210- }255+ }
211- int32_t pskType = 0;
212- ret = UtilsJsonGetNum(json, STR_JSON_PSK_TYPE, &pskType);
213- if (ret != IOTC_OK) {
214- IOTC_LOGE("get pskType error %d", ret);
215- break;
216- }
217- /* 暂时只支持一个管理员级别terminal psk */
218- bool isValidPskType = isAccess ?
219- (pskType >= SEC_PSK_TYPE_MANAGE && pskType <= SEC_PSK_TYPE_OPERATE) :
220- (pskType == SEC_PSK_TYPE_ADMIN);
221- if (!isValidPskType) {
222- IOTC_LOGE("pskType[%d] invalid", pskType);
223- ret = IOTC_ERR_INVALID_PARAM;
224- break;
225- }
226- secPsk.pskType = (uint8_t)pskType;
227- ret = SecUtilsConfSetPsk(&secPsk, isAccess);
228- if (ret != IOTC_OK) {
229- IOTC_LOGE("config error %d", ret);
230- break;
231- }
232- ret = SecConfInfoSave();
233- if (ret != IOTC_OK) {
234- IOTC_LOGE("save error %d", ret);
235- break;
236- }
237- } while (0);
238 return ret;256 return ret;
239}257}
240 258 
@@ -318,11 +336,9 @@ static int32_t AddPsksToJson(const SecPsk *psks, uint32_t pskNum, IotcJson *resp
318 return ret;336 return ret;
319}337}
320 338 
321-#define SEC_QUERY_ALL_PSK_ID "FFFF"
322- 
323static bool IsQueryAllPskId(const char *pskId)339static bool IsQueryAllPskId(const char *pskId)
324{340{
325- return pskId != NULL && strcmp(pskId, SEC_QUERY_ALL_PSK_ID) == 0;341+ return UtilsIsEmptyStr(pskId);
326}342}
327 343 
328static const SecPsk *FindPskById(const SecPsk *psks, uint32_t pskNum, const char *pskId)344static const SecPsk *FindPskById(const SecPsk *psks, uint32_t pskNum, const char *pskId)
@@ -380,9 +396,8 @@ static inline IotcJson *SecSvcQueryPsk(const IotcJson *json, bool isAccess)
380 CHECK_RETURN_LOGW(json != NULL, UtilsJsonCreateCodeDesc(IOTC_ERR_INVALID_PARAM, NULL), "param invalid");396 CHECK_RETURN_LOGW(json != NULL, UtilsJsonCreateCodeDesc(IOTC_ERR_INVALID_PARAM, NULL), "param invalid");
381 char pskId[SEC_PSK_ID_LEN + 1] = {0};397 char pskId[SEC_PSK_ID_LEN + 1] = {0};
382 int32_t ret = UtilsJsonGetString(json, STR_JSON_PSK_ID, pskId, sizeof(pskId));398 int32_t ret = UtilsJsonGetString(json, STR_JSON_PSK_ID, pskId, sizeof(pskId));
383- if (ret != IOTC_OK || UtilsIsEmptyStr(pskId)) {399+ if (ret != IOTC_OK) {
384 IOTC_LOGE("get pskId error %d", ret);400 IOTC_LOGE("get pskId error %d", ret);
385- return UtilsJsonCreateCodeDesc(ret == IOTC_OK ? IOTC_ERR_INVALID_PARAM : ret, NULL);
386 }401 }
387 return SecSvcQueryPskInner(pskId, isAccess);402 return SecSvcQueryPskInner(pskId, isAccess);
388}403}
@@ -407,6 +422,13 @@ static int32_t SecSvcRemovePskInner(const IotcJson *json, bool isAccess)
407 IOTC_LOGE("config error %d", ret);422 IOTC_LOGE("config error %d", ret);
408 break;423 break;
409 }424 }
425+ if (!isAccess) {
426+ ret = RemovePskAclConfigByPskId(pskId);
427+ if (ret != IOTC_OK) {
428+ IOTC_LOGE("remove psk acl error %d", ret);
429+ break;
430+ }
431+ }
410 ret = SecConfInfoSave();432 ret = SecConfInfoSave();
411 if (ret != IOTC_OK) {433 if (ret != IOTC_OK) {
412 IOTC_LOGE("save error %d", ret);434 IOTC_LOGE("save error %d", ret);
@@ -545,10 +567,16 @@ static int32_t SetCertAclConfig(const SecCertAcl *acl)
545 if (ret != IOTC_OK) {567 if (ret != IOTC_OK) {
546 return ret;568 return ret;
547 }569 }
548- return SecConfInfoSave();570+ ret = SecConfInfoSave();
571+ if (ret != IOTC_OK) {
572+ return ret;
573+ }
574+ IOTC_LOGI("cert acl saved serialNumber=%s interface=%s privilege=%u securityLevel=%d aclNum=%u",
575+ acl->serialNumber, acl->interface, acl->privilege, acl->securityLevel, aclNum);
576+ return IOTC_OK;
549}577}
550 578 
551-static int32_t SetPskAclConfig(const SecPskAcl *acl)579+static int32_t UpdatePskAclConfig(const SecPskAcl *acl)
552{580{
553 CHECK_RETURN_LOGW(acl != NULL, IOTC_ERR_INVALID_PARAM, "param invalid");581 CHECK_RETURN_LOGW(acl != NULL, IOTC_ERR_INVALID_PARAM, "param invalid");
554 SecPskAcl acls[SEC_ACL_MAX_NUM] = {0};582 SecPskAcl acls[SEC_ACL_MAX_NUM] = {0};
@@ -591,7 +619,84 @@ static int32_t SetPskAclConfig(const SecPskAcl *acl)
591 if (ret != IOTC_OK) {619 if (ret != IOTC_OK) {
592 return ret;620 return ret;
593 }621 }
594- return SecConfInfoSave();622+ IOTC_LOGI("psk acl updated pskId=%s interface=%s privilege=%u aclNum=%u",
623+ acl->pskId, acl->interface, acl->privilege, aclNum);
624+ return IOTC_OK;
625+}
626+ 
627+static int32_t SetPskAclConfig(const SecPskAcl *acl)
628+{
629+ int32_t ret = UpdatePskAclConfig(acl);
630+ if (ret != IOTC_OK) {
631+ return ret;
632+ }
633+ ret = SecConfInfoSave();
634+ if (ret != IOTC_OK) {
635+ return ret;
636+ }
637+ return IOTC_OK;
638+}
639+ 
640+static int32_t UpdateTerminalPskAcl(const SecPsk *secPsk)
641+{
642+ CHECK_RETURN_LOGW(secPsk != NULL, IOTC_ERR_INVALID_PARAM, "param invalid");
643+ SecPskAcl acl = {0};
644+ int32_t ret = memcpy_s(acl.pskId, sizeof(acl.pskId), secPsk->pskId, strlen(secPsk->pskId) + 1);
645+ if (ret != EOK) {
646+ IOTC_LOGE("copy pskId error %d", ret);
647+ return IOTC_ERR_SECUREC_MEMCPY;
648+ }
649+ acl.privilege = SEC_ACL_PRIVILEGE_ADMIN;
650+ return UpdatePskAclConfig(&acl);
651+}
652+ 
653+static int32_t RemovePskAclConfigByPskId(const char *pskId)
654+{
655+ CHECK_RETURN_LOGW(!UtilsIsEmptyStr(pskId), IOTC_ERR_INVALID_PARAM, "pskId invalid");
656+ SecPskAcl acls[SEC_ACL_MAX_NUM] = {0};
657+ uint16_t aclNum = 0;
658+ uint32_t aclNumLen = sizeof(aclNum);
659+ int32_t ret = SecConfInfoGet(SEC_CONF_INFO_KEY_PSK_ACL_NUM, (uint8_t *)&aclNum, &aclNumLen);
660+ if (ret != IOTC_OK) {
661+ return ret;
662+ }
663+ if (aclNum > SEC_ACL_MAX_NUM) {
664+ return IOTC_ERR_INVALID_PARAM;
665+ }
666+ uint32_t aclsLen = sizeof(acls);
667+ ret = SecConfInfoGet(SEC_CONF_INFO_KEY_PSK_ACLS, (uint8_t *)acls, &aclsLen);
668+ if (ret != IOTC_OK) {
669+ return ret;
670+ }
671+ 
672+ uint16_t newAclNum = 0;
673+ bool found = false;
674+ for (uint16_t idx = 0; idx < aclNum; ++idx) {
675+ if (strcmp(acls[idx].pskId, pskId) == 0) {
676+ found = true;
677+ continue;
678+ }
679+ if (newAclNum != idx) {
680+ acls[newAclNum] = acls[idx];
681+ }
682+ ++newAclNum;
683+ }
684+ 
685+ if (!found) {
686+ IOTC_LOGI("psk acl not found for remove pskId=%s", pskId);
687+ return IOTC_OK;
688+ }
689+ 
690+ ret = SecConfInfoSet(SEC_CONF_INFO_KEY_PSK_ACLS, (const uint8_t *)acls, sizeof(acls));
691+ if (ret != IOTC_OK) {
692+ return ret;
693+ }
694+ ret = SecConfInfoSet(SEC_CONF_INFO_KEY_PSK_ACL_NUM, (const uint8_t *)&newAclNum, sizeof(newAclNum));
695+ if (ret != IOTC_OK) {
696+ return ret;
697+ }
698+ IOTC_LOGI("psk acl removed pskId=%s aclNum=%u", pskId, newAclNum);
699+ return IOTC_OK;
595}700}
596 701 
597IotcJson *SecSvcRecvSetAccessPsk(const IotcJson *json)702IotcJson *SecSvcRecvSetAccessPsk(const IotcJson *json)
Mcore/security/service/sec_svc_provision.c+88-0
@@ -17,6 +17,8 @@
17#include "sec_conf_key_cert.h"17#include "sec_conf_key_cert.h"
18#include "sec_conf_provision_data.h"18#include "sec_conf_provision_data.h"
19#include "sec_utils_conf.h"19#include "sec_utils_conf.h"
20+#include "sec_svc_manage.h"
21+#include "comm_def.h"
20#include "iotc_errcode.h"22#include "iotc_errcode.h"
21#include "iotc_log.h"23#include "iotc_log.h"
22#include "product_adapter.h"24#include "product_adapter.h"
@@ -434,6 +436,82 @@ IotcJson *SecSvcRecvGetProvisionRequest(const IotcJson *json)
434 return respJson;436 return respJson;
435}437}
436 438 
439+static int32_t SaveProvisionAclBySerialNumber(const char *serialNumber)
440+{
441+ CHECK_RETURN_LOGW(!UtilsIsEmptyStr(serialNumber), IOTC_ERR_INVALID_PARAM, "serialNumber invalid");
442+ IotcJson *aclJson = IotcJsonCreate();
443+ CHECK_RETURN_LOGW(aclJson != NULL, IOTC_ADAPTER_JSON_ERR_CREATE, "create acl json error");
444+ 
445+ UtilsJsonStrItem strItem[] = {
446+ {STR_JSON_SERIAL_NUMBER, serialNumber},
447+ {STR_JSON_INTERFACE, ""},
448+ };
449+ int32_t ret = UtilsJsonAddStrTable(aclJson, strItem, ARRAY_SIZE(strItem));
450+ if (ret != IOTC_OK) {
451+ IotcJsonDelete(aclJson);
452+ return ret;
453+ }
454+ ret = IotcJsonAddNum2Obj(aclJson, STR_JSON_PRIVILEGE, SEC_ACL_PRIVILEGE_ADMIN);
455+ if (ret != IOTC_OK) {
456+ IotcJsonDelete(aclJson);
457+ return ret;
458+ }
459+ ret = IotcJsonAddNum2Obj(aclJson, STR_JSON_SECURITY_LEVEL, 0);
460+ if (ret != IOTC_OK) {
461+ IotcJsonDelete(aclJson);
462+ return ret;
463+ }
464+ 
465+ IotcJson *aclResp = SecSvcRecvSetAcl(aclJson);
466+ IotcJsonDelete(aclJson);
467+ if (aclResp == NULL) {
468+ return IOTC_CORE_SECURITY_ERR_SAVE_PROVISION_DATA;
469+ }
470+ 
471+ int32_t code = IOTC_OK;
472+ ret = UtilsJsonGetNum(aclResp, STR_JSON_CODE, &code);
473+ IotcJsonDelete(aclResp);
474+ if (ret != IOTC_OK) {
475+ return ret;
476+ }
477+ return code;
478+}
479+ 
480+static int32_t SaveProvisionAclByPskId(const char *pskId)
481+{
482+ CHECK_RETURN_LOGW(!UtilsIsEmptyStr(pskId), IOTC_ERR_INVALID_PARAM, "pskId invalid");
483+ IotcJson *aclJson = IotcJsonCreate();
484+ CHECK_RETURN_LOGW(aclJson != NULL, IOTC_ADAPTER_JSON_ERR_CREATE, "create acl json error");
485+ 
486+ UtilsJsonStrItem strItem[] = {
487+ {STR_JSON_PSK_ID, pskId},
488+ {STR_JSON_INTERFACE, ""},
489+ };
490+ int32_t ret = UtilsJsonAddStrTable(aclJson, strItem, ARRAY_SIZE(strItem));
491+ if (ret != IOTC_OK) {
492+ IotcJsonDelete(aclJson);
493+ return ret;
494+ }
495+ ret = IotcJsonAddNum2Obj(aclJson, STR_JSON_PRIVILEGE, SEC_ACL_PRIVILEGE_ADMIN);
496+ if (ret != IOTC_OK) {
497+ IotcJsonDelete(aclJson);
498+ return ret;
499+ }
500+ 
501+ IotcJson *aclResp = SecSvcRecvSetAcl(aclJson);
502+ IotcJsonDelete(aclJson);
503+ if (aclResp == NULL) {
504+ return IOTC_CORE_SECURITY_ERR_SAVE_PROVISION_DATA;
505+ }
506+ 
507+ int32_t code = IOTC_OK;
508+ ret = UtilsJsonGetNum(aclResp, STR_JSON_CODE, &code);
509+ IotcJsonDelete(aclResp);
510+ if (ret != IOTC_OK) {
511+ return ret;
512+ }
513+ return code;
514+}
437static int32_t SaveProvisionCertData(const char *domainId, uint32_t domainIdLen,515static int32_t SaveProvisionCertData(const char *domainId, uint32_t domainIdLen,
438 const char *adminSerialNumber, uint32_t adminSerialNumberLen, const SecKeyCert *keyCert)516 const char *adminSerialNumber, uint32_t adminSerialNumberLen, const SecKeyCert *keyCert)
439{517{
@@ -459,6 +537,11 @@ static int32_t SaveProvisionCertData(const char *domainId, uint32_t domainIdLen,
459 IOTC_LOGE("save provisionCert error %d", ret);537 IOTC_LOGE("save provisionCert error %d", ret);
460 break;538 break;
461 }539 }
540+ ret = SaveProvisionAclBySerialNumber(adminSerialNumber);
541+ if (ret != IOTC_OK) {
542+ IOTC_LOGE("save provision cert acl error %d", ret);
543+ break;
544+ }
462 } while (0);545 } while (0);
463 return ret;546 return ret;
464}547}
@@ -537,6 +620,11 @@ IotcJson *SecSvcRecvProvisionPsk(const IotcJson *json)
537 IOTC_LOGE("save provisionPsk error %d", ret);620 IOTC_LOGE("save provisionPsk error %d", ret);
538 break;621 break;
539 }622 }
623+ ret = SaveProvisionAclByPskId(secPsk.pskId);
624+ if (ret != IOTC_OK) {
625+ IOTC_LOGE("save provision psk acl error %d", ret);
626+ break;
627+ }
540 } while (0);628 } while (0);
541 return UtilsJsonCreateCodeDesc(ret, NULL);629 return UtilsJsonCreateCodeDesc(ret, NULL);
542}630}