source: fedd/abac-src/ttg/credential/RtmlFrontier.java @ eec716b

package com.nailabs.abac.credential;

import java.util.*;

import com.nailabs.abac.process.FrontierManager;
import com.nailabs.abac.process.AckPolicy;
import com.nailabs.abac.process.AckFact;
import com.nailabs.abac.process.ACPolicy;
import com.nailabs.abac.process.ResourcePolicy;
import edu.stanford.peer.rbtm.credential.Entity;
import edu.stanford.peer.rbtm.credential.EntityExpression;
import edu.stanford.peer.rbtm.credential.RoleName;
import edu.stanford.peer.rbtm.credential.SimpleRoleName;
import edu.stanford.peer.rbtm.credential.StaticCredential;
import edu.stanford.peer.rbtm.engine.Simp;
import edu.stanford.peer.rbtm.engine.Sens;
import edu.stanford.peer.rbtm.engine.Oppo;
import edu.stanford.rt.credential.*;
import edu.stanford.rt.parser.RTParser;
import edu.stanford.rt.util.Constants;

/** 
 * A frontier manager class which uses the application specification 
 * domain for determining whether a rol is issuer traces all, issuer
 * traces def, etc.
 */
public class RtmlFrontier extends FrontierManager implements Constants {
    protected HashMap discoveryConfig;

    protected ApplicationDomain domain;

    protected CredentialStore store;

    protected RTContext context;

    protected HashID id  = null;

    //protected HashSet issuerTracesAll = new HashSet();

    protected HashSet issuerTraces = new HashSet();

    //protected HashSet issuerTracesDef  = new HashSet();

    protected ResourcePolicy resourcePolicy = null;

    public RtmlFrontier(HashMap config) {
        String domainName = getApplicationDomainName(config);
        discoveryConfig = new HashMap(2); // needed for constructing a DDEngine
        discoveryConfig.put("DDEParser", config.get("DDEParser"));
        discoveryConfig.put("PrepInfo", config.get("PrepInfo"));
        discoveryConfig.put("DDEContext", config.get("DDEContext"));
        store = (CredentialStore)config.get("CredentialStore");
        context = (RTContext)config.get("RTContext");
        id = new HashID(HashID.APPLICATION_DOMAIN, domainName);
        domain = context.getApplicationDomain(id);
        init(config);
    }

    /** specialized init method for accessing the credential store backends */
    public void init(HashMap config) {
        // (0) get the configurations entity identifier
        this.self =(Entity) config.get("EntityID");
        
        // (1) load acknowledgement(ACK) policy
        ackPolicy = (AckPolicy)config.get("AckPolicy");
        
        // (2) load access control (AC) policy 
        acPolicy = (ACPolicy)config.get("AccessControl");
        // (2 and 1/2) load the resource policy
        resourcePolicy = (ResourcePolicy)config.get("ResourcePolicy");

        // (3) load issuer traceable roles
        // (4) load subject traceale roles
        parseRoleDeclarations(config);

        // (5) construct sensitive roles predicate from the ack policy
        Sens sens = new Sens(ackPolicy.getSensitiveRoles());

        // (6) construct opponent predicate from the issuer traceable roles
        Oppo oppo = new Oppo(new Vector(issuerTracesDef));
        oppo.addSubjects(new Vector(issuerTracesAll));
        
        // TBD: Does this really need to be separated into two mutually 
        //      exclusive credential sets? And in this case we have three
        //      credential stores (the primordial, issuer-traces, and 
        //      subject-traces).
        
        // (8) separate policy reachable credentials
        // (9) separate self reachable credentials
        CredentialStore store = (CredentialStore)config.get("CredentialStore");
        CredentialStore subjectStore = null, issuerStore = null;
        try {
            RTParser parser = new RTParser();
            subjectStore = new CredentialStore(parser);
            issuerStore = new CredentialStore(parser);
            Iterator domains = 
                store.getCredentialDomains().values().iterator();
            while(domains.hasNext()) {
                CredentialDomain domain = (CredentialDomain)domains.next();
                RoleDefinition def = 
                    (RoleDefinition)domain.roleDefinitionIterator().next();
                RoleName roleName = 
                    new SimpleRoleName(def.getHead().getName());
                if(isIssuerTraceable(roleName)) {
                    issuerStore.addCredentialDomain(domain.getHashID(),domain);
                } else {
                    //if(isSubjectTraceable(roleName)) {
                    subjectStore.addCredentialDomain(domain.getHashID(),domain);
                }
                // It is possible that credential may fall through to here. We 
                // propbably just remove the second if-statement...
            }
        } catch (Exception ex) {
            ex.printStackTrace();
        }

        // (7) construct the frontier functions with their predicates
        oppoLocal = new RtmlEngine(issuerStore);
        System.out.println("------> Sensitive Graph");
        sensFrontier = new RtmlEngine(subjectStore, sens);
        System.out.println("------> Opponent Graph");
        oppoFrontier = new RtmlEngine(issuerStore, oppo);
        System.out.println("------> Simple Graph");
        simpFrontier = new RtmlEngine(subjectStore, new Simp());

        // perform credential discovery here
        DDEngine selfTraceable = discoverSelfTraceable();
        DDEngine policyTraceable = discoverPolicyTraceable();
        // TBD: add backwards compatibility check in here if necessary
        //      which would avoid discovery
        ((RtmlEngine)oppoLocal).importDomains(policyTraceable);
        ((RtmlEngine)sensFrontier).importDomains(selfTraceable);
        ((RtmlEngine)oppoFrontier).importDomains(policyTraceable);
        ((RtmlEngine)simpFrontier).importDomains(selfTraceable);
    }


    protected String getApplicationDomainName(HashMap config) {
        Properties props = (Properties)config.get("RTML");
        return props.getProperty("ApplicationDomain");
    }
    
    protected OrderedMap getRoleDeclarations() {
        try {
            return domain.getRoleDeclarations();
        } catch(Exception ex) {
            ex.printStackTrace();
        }
        return null;
    }


    public DDEngine discoverPolicyTraceable() {
        Iterator ackValues = ackPolicy.getRequiredRoles().iterator();
        Iterator acValues = acPolicy.getRequiredRoles().iterator();
        Iterator resourceValues = resourcePolicy.getRequiredRoles().iterator();
        DDEngine discoveryEngine = new DDEngine(discoveryConfig);
        HashSet policySet = new HashSet();
        
        while(ackValues.hasNext()) {
            AckFact ackVal = (AckFact)ackValues.next();
            policySet.add(ackVal.getRequirement());
        }
        while(acValues.hasNext()) {
            EntityExpression acVal = (EntityExpression)acValues.next();
            policySet.add(acVal);
        }
        while(resourceValues.hasNext()) {
            EntityExpression resourceVal = 
                (EntityExpression)resourceValues.next();
            policySet.add(resourceVal);
        }
        Iterator randomRoles = policySet.iterator();
        while(randomRoles.hasNext()) {
            EntityExpression random = (EntityExpression)randomRoles.next();
            discoveryEngine.backwardSearch(random);
        }
        return discoveryEngine;
    }

    public DDEngine discoverSelfTraceable() {
        HashSet selfSet = new HashSet();
        Iterator mySensRoles = ackPolicy.getSensitiveRoles().iterator();
        DDEngine discoveryEngine = new DDEngine(discoveryConfig);
        //RtmlEngine local = new RtmlEngine(store);

        //find all the credentials which have roles that map directly to self
        Iterator myRoles = oppoFrontier.findCredentialsBySubject(self);
        while(myRoles.hasNext()) {
            RtmlCredential cred = (RtmlCredential)myRoles.next();
            EntityExpression me = cred.getDefinedRole();
            selfSet.add(me);
        }
        myRoles = sensFrontier.findCredentialsBySubject(self);
        while(myRoles.hasNext()) {
            RtmlCredential cred = (RtmlCredential)myRoles.next();
            EntityExpression me = cred.getDefinedRole();
            selfSet.add(me);
        }
        //add the sensitive roles to the initial search set
        while(mySensRoles.hasNext()) {
            EntityExpression sense = (EntityExpression)mySensRoles.next();
            selfSet.add(sense);
        }
        //perform forward searches on the pseudo-random set of roles
        Iterator randomRoles = selfSet.iterator();
        while(randomRoles.hasNext()) {
            EntityExpression random = (EntityExpression)randomRoles.next();
                discoveryEngine.forwardSearch(random);
        }
        return discoveryEngine;
    } 


    protected void parseRoleDeclarations(HashMap config) {
        // TBD: revisit to make this more robust in case an error occurs.
        //      it should not necessarily bail out of all role processing
        try {
            OrderedMap map = getRoleDeclarations();
            Iterator keys = map.keyIterator();
            System.out.println("Frontier parsing role declaratons");
            while(keys.hasNext()) {
                RoleDeclaration role = (RoleDeclaration)map.get(keys.next());
                System.out.println("role = " + role.getName());
                parseRoleDeclaration(role);
                System.out.println();
            }
        } catch(Exception ex) {
            ex.printStackTrace();
        }
        System.out.println("End declaration parsing!");
        config.put("IssuerTracesAll", issuerTracesAll);
        config.put("IssuerTracesDef", issuerTracesDef);
        config.put("SubjectTraceable", subjectTraces);
    }

    protected void parseRoleDeclaration(RoleDeclaration declaration) {
        int issuerValue = declaration.getIssuerTracesType();
        int subjectValue = declaration.getSubjectTracesType();

        if(issuerValue == ISSUER_TRACES_ALL) {
            issuerTracesAll.add(declaration.getName());
            System.out.print("issuer_traces_all");
        } 
        if(issuerValue == ISSUER_TRACES_DEF) {
            issuerTracesDef.add(declaration.getName());
            System.out.print("issuer_traces_def");
        }
        if(subjectValue == SUBJECT_TRACES_ALL) {
            subjectTraces.add(declaration.getName());
            System.out.print("subject_traces_all");
        }
    }

    private RoleDeclaration getRoleDeclaration(RoleName role) {
        try {
            System.out.println("id = " + id);
            return domain.lookupRoleDeclaration(role.getName());
        } catch(Exception ex) {
            ex.printStackTrace();
        }
        return null;
    }

    /** Is the specified credential policy traceable? */
    public boolean isPolicyTraceable(StaticCredential cred) {
        return isIssuerTraceable(cred.getDefinedRole().getName());
    }

    /** Can the specified credential be traced back to this negotiator? */
    public boolean isSelfReachable(StaticCredential cred) {
        return isSubjectTraceable(cred.getDefinedRole().getName());
    }

    public boolean isIssuerTraceable(RoleName role) {
        int value = getRoleDeclaration(role).getIssuerTracesType();
        return (value == ISSUER_TRACES_ALL || value == ISSUER_TRACES_DEF);
    }

    public boolean isIssuerTracesAll(RoleName role) {
        int value = getRoleDeclaration(role).getIssuerTracesType();
        return (value == ISSUER_TRACES_ALL);
    }

    public boolean isIssuerTracesDef(RoleName role) {
        int value = getRoleDeclaration(role).getIssuerTracesType();
        return (value == ISSUER_TRACES_DEF);
    }

    public boolean isSubjectTraceable(RoleName role) {
        int value = getRoleDeclaration(role).getSubjectTracesType();
        return (value == SUBJECT_TRACES_ALL);
    }
     
    public boolean subjectTracesAll(RoleName role) {
        int value = getRoleDeclaration(role).getSubjectTracesType();
        return (value == SUBJECT_TRACES_ALL);
    }
           

}