IOT-1583: Removing /W3 warning from resource/csdk/security.
[iotivity.git] / resource / csdk / security / src / aclresource.c
1 //******************************************************************
2 //
3 // Copyright 2015 Intel Mobile Communications GmbH All Rights Reserved.
4 //
5 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
6 //
7 // Licensed under the Apache License, Version 2.0 (the "License");
8 // you may not use this file except in compliance with the License.
9 // You may obtain a copy of the License at
10 //
11 //      http://www.apache.org/licenses/LICENSE-2.0
12 //
13 // Unless required by applicable law or agreed to in writing, software
14 // distributed under the License is distributed on an "AS IS" BASIS,
15 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 // See the License for the specific language governing permissions and
17 // limitations under the License.
18 //
19 //-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
20
21 #include "iotivity_config.h"
22 #ifdef HAVE_STRING_H
23 #include <string.h>
24 #elif defined(HAVE_STRINGS_H)
25 #include <strings.h>
26 #endif
27 #include <stdlib.h>
28
29 #include "utlist.h"
30 #include "ocstack.h"
31 #include "octypes.h"
32 #include "ocserverrequest.h"
33 #include "oic_malloc.h"
34 #include "oic_string.h"
35 #include "ocrandom.h"
36 #include "ocpayload.h"
37 #include "utlist.h"
38 #include "payload_logging.h"
39 #include "srmresourcestrings.h"
40 #include "aclresource.h"
41 #include "doxmresource.h"
42 #include "resourcemanager.h"
43 #include "srmutility.h"
44 #include "psinterface.h"
45 #include "ocpayloadcbor.h"
46
47 #include "security_internals.h"
48
49 #define TAG  "OIC_SRM_ACL"
50 #define NUMBER_OF_SEC_PROV_RSCS 4
51 #define NUMBER_OF_DEFAULT_SEC_RSCS 2
52 #define STRING_UUID_SIZE (UUID_LENGTH * 2 + 5)
53
54 static const uint8_t ACL_MAP_SIZE = 4;
55 static const uint8_t ACL_ACLIST_MAP_SIZE = 1;
56 static const uint8_t ACL_ACES_MAP_SIZE = 3;
57 static const uint8_t ACL_RESOURCE_MAP_SIZE = 3;
58
59
60 // CborSize is the default cbor payload size being used.
61 static const uint16_t CBOR_SIZE = 2048*8;
62
63 static OicSecAcl_t *gAcl = NULL;
64 static OCResourceHandle gAclHandle = NULL;
65
66 void FreeRsrc(OicSecRsrc_t *rsrc)
67 {
68     //Clean each member of resource
69     OICFree(rsrc->href);
70     OICFree(rsrc->rel);
71     //Clean "rt"
72     if(0 < rsrc->typeLen && rsrc->types)
73     {
74         for(size_t i = 0; i < rsrc->typeLen; i++)
75         {
76             OICFree(rsrc->types[i]);
77         }
78         OICFree(rsrc->types);
79         rsrc->types = NULL;
80     }
81     //Clean "if"
82     if(0 < rsrc->interfaceLen && rsrc->interfaces)
83     {
84         for(size_t i = 0; i < rsrc->interfaceLen; i++)
85         {
86             OICFree(rsrc->interfaces[i]);
87         }
88         OICFree(rsrc->interfaces);
89         rsrc->interfaces = NULL;
90     }
91     OICFree(rsrc);
92     rsrc = NULL;
93 }
94
95 /**
96  * This function frees OicSecAcl_t object's fields and object itself.
97  */
98 static void FreeACE(OicSecAce_t *ace)
99 {
100     if (NULL == ace)
101     {
102         OIC_LOG(ERROR, TAG, "Invalid Parameter");
103         return;
104     }
105
106     //Clean Resources
107     OicSecRsrc_t* rsrc = NULL;
108     OicSecRsrc_t* tmpRsrc = NULL;
109     LL_FOREACH_SAFE(ace->resources, rsrc, tmpRsrc)
110     {
111         LL_DELETE(ace->resources, rsrc);
112         FreeRsrc(rsrc);
113     }
114
115     //Clean Validities
116     OicSecValidity_t *validity = NULL;
117     OicSecValidity_t *tmpValidity = NULL;
118     LL_FOREACH_SAFE(ace->validities, validity, tmpValidity)
119     {
120         LL_DELETE(ace->validities, validity);
121
122         //Clean period
123         OICFree(validity->period);
124
125         //Clean recurrence
126         for(size_t i = 0; i < validity->recurrenceLen; i++)
127         {
128             OICFree(validity->recurrences[i]);
129         }
130         OICFree(validity->recurrences);
131         OICFree(validity);
132         validity = NULL;
133     }
134
135 #ifdef MULTIPLE_OWNER
136     OICFree(ace->eownerID);
137 #endif
138
139     //Clean ACE
140     OICFree(ace);
141     ace = NULL;
142 }
143
144 void DeleteACLList(OicSecAcl_t* acl)
145 {
146     if (acl)
147     {
148         OicSecAce_t *ace = NULL;
149         OicSecAce_t *tmpAce = NULL;
150         LL_FOREACH_SAFE(acl->aces, ace, tmpAce)
151         {
152             LL_DELETE(acl->aces, ace);
153             FreeACE(ace);
154         }
155         acl->aces = NULL;
156         OICFree(acl);
157     }
158 }
159
160 OicSecAce_t* DuplicateACE(const OicSecAce_t* ace)
161 {
162     OicSecAce_t* newAce = NULL;
163     size_t allocateSize = 0;
164
165     if(ace)
166     {
167         newAce = (OicSecAce_t*)OICCalloc(1, sizeof(OicSecAce_t));
168         VERIFY_NOT_NULL(TAG, newAce, ERROR);
169
170         //Subject uuid
171         memcpy(&newAce->subjectuuid, &ace->subjectuuid, sizeof(OicUuid_t));
172
173         OicSecRsrc_t* rsrc = NULL;
174         LL_FOREACH(ace->resources, rsrc)
175         {
176             OicSecRsrc_t* newRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
177             VERIFY_NOT_NULL(TAG, newRsrc, ERROR);
178             LL_APPEND(newAce->resources, newRsrc);
179
180             //href is mandatory
181             VERIFY_NOT_NULL(TAG, rsrc->href, ERROR);
182             allocateSize = strlen(rsrc->href) + 1;
183             newRsrc->href = (char*)OICMalloc(sizeof(char) * allocateSize);
184             VERIFY_NOT_NULL(TAG, newRsrc->href, ERROR);
185             OICStrcpy(newRsrc->href, allocateSize, rsrc->href);
186
187             if(rsrc->rel)
188             {
189                 allocateSize = strlen(rsrc->rel) + 1;
190                 newRsrc->rel = (char*)OICMalloc(sizeof(char) * allocateSize);
191                 VERIFY_NOT_NULL(TAG, newRsrc->rel, ERROR);
192                 OICStrcpy(newRsrc->rel, allocateSize, rsrc->rel);
193             }
194
195             if(rsrc->types && 0 < rsrc->typeLen)
196             {
197                 newRsrc->typeLen = rsrc->typeLen;
198                 newRsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
199                 VERIFY_NOT_NULL(TAG, (newRsrc->types), ERROR);
200                 for(size_t i = 0; i < rsrc->typeLen; i++)
201                 {
202                     newRsrc->types[i] = OICStrdup(rsrc->types[i]);
203                     VERIFY_NOT_NULL(TAG, (newRsrc->types[i]), ERROR);
204                 }
205             }
206
207             if(rsrc->interfaces && 0 < rsrc->interfaceLen)
208             {
209                 newRsrc->interfaceLen = rsrc->interfaceLen;
210                 newRsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
211                 VERIFY_NOT_NULL(TAG, (newRsrc->interfaces), ERROR);
212                 for(size_t i = 0; i < rsrc->interfaceLen; i++)
213                 {
214                     newRsrc->interfaces[i] = OICStrdup(rsrc->interfaces[i]);
215                     VERIFY_NOT_NULL(TAG, (newRsrc->interfaces[i]), ERROR);
216                 }
217             }
218         }
219
220         //Permission
221         newAce->permission = ace->permission;
222
223         //Validity
224         if(ace->validities)
225         {
226             OicSecValidity_t* validity = NULL;
227             LL_FOREACH(ace->validities, validity)
228             {
229                 OicSecValidity_t* newValidity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
230                 VERIFY_NOT_NULL(TAG, newValidity, ERROR);
231                 LL_APPEND(newAce->validities, newValidity);
232
233                 if(validity->period)
234                 {
235                     allocateSize = strlen(validity->period) + 1;
236                     newValidity->period = (char*)OICMalloc(sizeof(char) * allocateSize);
237                     VERIFY_NOT_NULL(TAG, newValidity->period, ERROR);
238                     OICStrcpy(newValidity->period, allocateSize, validity->period);
239                 }
240
241                 if(validity->recurrences && 0 < validity->recurrenceLen)
242                 {
243                     newValidity->recurrenceLen = validity->recurrenceLen;
244
245                     newValidity->recurrences = (char**)OICMalloc(sizeof(char*) * validity->recurrenceLen);
246                     VERIFY_NOT_NULL(TAG, newValidity->recurrences, ERROR);
247
248                     for(size_t i = 0; i < validity->recurrenceLen; i++)
249                     {
250                         allocateSize = strlen(validity->recurrences[i]) + 1;
251                         newValidity->recurrences[i] = (char*)OICMalloc(sizeof(char) * allocateSize);
252                         VERIFY_NOT_NULL(TAG, (newValidity->recurrences[i]), ERROR);
253                         OICStrcpy(newValidity->recurrences[i], allocateSize, validity->recurrences[i]);
254                     }
255                 }
256             }
257         }
258
259 #ifdef MULTIPLE_OWNER
260         if (ace->eownerID)
261         {
262             if (NULL == newAce->eownerID)
263             {
264                 newAce->eownerID = (OicUuid_t*)OICCalloc(1, sizeof(OicUuid_t));
265                 VERIFY_NOT_NULL(TAG, (newAce->eownerID), ERROR);
266             }
267             memcpy(newAce->eownerID->id, ace->eownerID->id, sizeof(ace->eownerID->id));
268         }
269 #endif
270
271         newAce->next = NULL;
272     }
273
274     return newAce;
275
276 exit:
277     FreeACE(newAce);
278     return NULL;
279 }
280
281 static size_t OicSecAclSize(const OicSecAcl_t *secAcl)
282 {
283     if (!secAcl)
284     {
285         return 0;
286     }
287     OicSecAce_t *ace= (OicSecAce_t *)secAcl->aces;
288     size_t size = 0;
289     while (ace)
290     {
291        size++;
292        ace = ace->next;
293     }
294     return size;
295 }
296
297 OCStackResult AclToCBORPayload(const OicSecAcl_t *secAcl, uint8_t **payload, size_t *size)
298 {
299      if (NULL == secAcl || NULL == payload || NULL != *payload || NULL == size)
300     {
301         return OC_STACK_INVALID_PARAM;
302     }
303
304     OCStackResult ret = OC_STACK_ERROR;
305     CborError cborEncoderResult = CborNoError;
306     OicSecAcl_t *acl = (OicSecAcl_t *)secAcl;
307     OicSecAce_t* ace = NULL;
308     CborEncoder encoder;
309     CborEncoder aclMap;
310     CborEncoder aclListMap;
311     CborEncoder acesArray;
312     uint8_t *outPayload = NULL;
313     size_t cborLen = *size;
314     *size = 0;
315     *payload = NULL;
316
317     if (cborLen == 0)
318     {
319         cborLen = CBOR_SIZE;
320     }
321
322     outPayload = (uint8_t *)OICCalloc(1, cborLen);
323     VERIFY_NOT_NULL(TAG, outPayload, ERROR);
324     cbor_encoder_init(&encoder, outPayload, cborLen, 0);
325
326     // Create ACL Map (aclist, rownerid)
327     cborEncoderResult = cbor_encoder_create_map(&encoder, &aclMap, ACL_MAP_SIZE);
328     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACL Map.");
329
330     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_ACLIST_NAME,
331         strlen(OIC_JSON_ACLIST_NAME));
332     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding aclist Name Tag.");
333
334     // Create ACLIST Map (aces)
335     cborEncoderResult = cbor_encoder_create_map(&aclMap, &aclListMap, ACL_ACLIST_MAP_SIZE);
336     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACLIST Map.");
337
338     cborEncoderResult = cbor_encode_text_string(&aclListMap, OIC_JSON_ACES_NAME,
339         strlen(OIC_JSON_ACES_NAME));
340     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding ACES Name Tag.");
341
342     // Create ACES Array
343     cborEncoderResult = cbor_encoder_create_array(&aclListMap, &acesArray, OicSecAclSize(secAcl));
344     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACES Array.");
345
346     ace = NULL;
347     LL_FOREACH (acl->aces, ace)
348     {
349         CborEncoder oicSecAclMap;
350         // ACL Map size - Number of mandatory items
351         uint8_t aclMapSize = ACL_ACES_MAP_SIZE;
352         size_t inLen = 0;
353
354         OicSecValidity_t* validityElts = ace->validities;
355         while(validityElts)
356         {
357             if(validityElts->period)
358             {
359                 aclMapSize++;
360             }
361             if(validityElts->recurrences)
362             {
363                 aclMapSize++;
364             }
365         }
366
367 #ifdef MULTIPLE_OWNER
368         if(ace->eownerID)
369         {
370             aclMapSize++;
371         }
372 #endif //MULTIPLE_OWNER
373
374         cborEncoderResult = cbor_encoder_create_map(&acesArray, &oicSecAclMap, aclMapSize);
375         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Creating ACES Map");
376
377         // Subject -- Mandatory
378         cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_SUBJECTID_NAME,
379             strlen(OIC_JSON_SUBJECTID_NAME));
380         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Subject Name Tag.");
381         inLen = (memcmp(&(ace->subjectuuid), &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t)) == 0) ?
382             WILDCARD_SUBJECT_ID_LEN : sizeof(OicUuid_t);
383         if(inLen == WILDCARD_SUBJECT_ID_LEN)
384         {
385             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, WILDCARD_RESOURCE_URI,
386                 strlen(WILDCARD_RESOURCE_URI));
387             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Subject Id wildcard Value.");
388         }
389         else
390         {
391             char *subject = NULL;
392             ret = ConvertUuidToStr(&ace->subjectuuid, &subject);
393             VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
394             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, subject, strlen(subject));
395             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Subject UUID Value.");
396             OICFree(subject);
397         }
398
399         // Resources
400         {
401             CborEncoder resources;
402             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_RESOURCES_NAME,
403                 strlen(OIC_JSON_RESOURCES_NAME));
404             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Resource Name Tag.");
405
406             size_t rsrcLen = 0;
407             OicSecRsrc_t* rsrcElts = NULL;
408             LL_FOREACH(ace->resources, rsrcElts)
409             {
410                 rsrcLen++;
411             }
412
413             cborEncoderResult = cbor_encoder_create_array(&oicSecAclMap, &resources, rsrcLen);
414             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Resource Name Array.");
415
416             OicSecRsrc_t* rsrc = NULL;
417             LL_FOREACH(ace->resources, rsrc)
418             {
419
420                 CborEncoder rMap;
421                 size_t rsrcMapSize = ACL_RESOURCE_MAP_SIZE;
422                 if(rsrc->rel)
423                 {
424                     rsrcMapSize++;
425                 }
426
427                 cborEncoderResult = cbor_encoder_create_map(&resources, &rMap, rsrcMapSize);
428                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding Resource Map.");
429
430                 //href -- Mandatory
431                 VERIFY_NOT_NULL(TAG, rsrc->href, ERROR);
432                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_HREF_NAME,
433                         strlen(OIC_JSON_HREF_NAME));
434                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding HREF Name Tag.");
435                 cborEncoderResult = cbor_encode_text_string(&rMap, rsrc->href, strlen(rsrc->href));
436                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding HREF Value in Map.");
437
438                 //resource type -- Mandatory
439                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_RT_NAME,
440                         strlen(OIC_JSON_RT_NAME));
441                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Name Tag.");
442
443                 CborEncoder resourceTypes;
444                 cborEncoderResult = cbor_encoder_create_array(&rMap, &resourceTypes, rsrc->typeLen);
445                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding RT Array.");
446                 for(size_t i = 0; i < rsrc->typeLen; i++)
447                 {
448                     cborEncoderResult = cbor_encode_text_string(&resourceTypes, rsrc->types[i], strlen(rsrc->types[i]));
449                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Value.");
450                 }
451                 cborEncoderResult = cbor_encoder_close_container(&rMap, &resourceTypes);
452                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing resourceTypes.");
453
454                 //interface -- Mandatory
455                 cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_IF_NAME,
456                         strlen(OIC_JSON_IF_NAME));
457                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Name Tag.");
458
459                 CborEncoder interfaces;
460                 cborEncoderResult = cbor_encoder_create_array(&rMap, &interfaces, rsrc->interfaceLen);
461                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding IF Array.");
462                 for(size_t i = 0; i < rsrc->interfaceLen; i++)
463                 {
464                     cborEncoderResult = cbor_encode_text_string(&interfaces, rsrc->interfaces[i], strlen(rsrc->interfaces[i]));
465                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Value.");
466                 }
467                 cborEncoderResult = cbor_encoder_close_container(&rMap, &interfaces);
468                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing interfaces.");
469
470                 //rel
471                 if(rsrc->rel)
472                 {
473                     cborEncoderResult = cbor_encode_text_string(&rMap, OIC_JSON_REL_NAME,
474                             strlen(OIC_JSON_REL_NAME));
475                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding REL Name Tag.");
476                     cborEncoderResult = cbor_encode_text_string(&rMap, rsrc->rel, strlen(rsrc->rel));
477                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding REL Value.");
478                 }
479
480                 cborEncoderResult = cbor_encoder_close_container(&resources, &rMap);
481                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Resource Map.");
482             }
483             cborEncoderResult = cbor_encoder_close_container(&oicSecAclMap, &resources);
484             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Resource Name Array.");
485         }
486
487         // Permissions -- Mandatory
488         cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_PERMISSION_NAME,
489             strlen(OIC_JSON_PERMISSION_NAME));
490         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Permission Name Tag.");
491         cborEncoderResult = cbor_encode_int(&oicSecAclMap, ace->permission);
492         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Permission Name Value.");
493
494         // TODO: Need to verfication for validity
495         // Validity(Time-interval) -- Not Mandatory
496         if(ace->validities)
497         {
498             size_t validityLen = 0;
499             validityElts = NULL;
500             LL_FOREACH(ace->validities, validityElts)
501             {
502                 validityLen++;
503             }
504
505             CborEncoder validities;
506             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_VALIDITY_NAME,
507                 strlen(OIC_JSON_VALIDITY_NAME));
508             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validity Tag.");
509             cborEncoderResult = cbor_encoder_create_array(&oicSecAclMap, &validities, validityLen);
510             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validities Array.");
511
512             //How to add the value w/o "title" using tinycobr...? :(
513
514             validityElts = NULL;
515             LL_FOREACH(ace->validities, validityElts)
516             {
517                  CborEncoder validity;
518                  size_t validitySize = 0;
519                  if(validityElts->period)
520                 {
521                     validitySize++;
522                 }
523                 if(validityElts->recurrences)
524                 {
525                     validitySize++;
526                 }
527
528                 cborEncoderResult = cbor_encoder_create_array(&validities, &validity, validitySize);
529                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Validity Array.");
530
531                 // Period
532                 if (validityElts->period)
533                 {
534                     cborEncoderResult = cbor_encode_text_string(&validity, validityElts->period,
535                         strlen(validityElts->period));
536                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Period Value.");
537                 }
538
539                 // Recurrence
540                 if (validityElts->recurrences)
541                 {
542                     CborEncoder recurrences;
543                     cborEncoderResult = cbor_encoder_create_array(&validity, &recurrences, validityElts->recurrenceLen);
544                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Recurrence Array.");
545
546                     for (size_t i = 0; i < validityElts->recurrenceLen; i++)
547                     {
548                         cborEncoderResult = cbor_encode_text_string(&recurrences, validityElts->recurrences[i],
549                             strlen(validityElts->recurrences[i]));
550                         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding Recurrence Array Value.");
551                     }
552                     cborEncoderResult = cbor_encoder_close_container(&validity, &recurrences);
553                     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Recurrence Array");
554                 }
555
556                 cborEncoderResult = cbor_encoder_close_container(&validities, &validity);
557                 VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Validity Array.");
558             }
559
560             cborEncoderResult = cbor_encoder_close_container(&oicSecAclMap, &validities);
561             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing Validities Array.");
562         }
563
564 #ifdef MULTIPLE_OWNER
565         // Eownerid -- Not Mandatory
566         if(ace->eownerID)
567         {
568             char *eowner = NULL;
569             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, OIC_JSON_EOWNERID_NAME,
570                 strlen(OIC_JSON_EOWNERID_NAME));
571             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding eownerId Name Tag.");
572             ret = ConvertUuidToStr(ace->eownerID, &eowner);
573             VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
574             cborEncoderResult = cbor_encode_text_string(&oicSecAclMap, eowner, strlen(eowner));
575             OICFree(eowner);
576             VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding eownerId Value.");
577         }
578 #endif //MULTIPLE_OWNER
579
580         cborEncoderResult = cbor_encoder_close_container(&acesArray, &oicSecAclMap);
581         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACES Map.");
582     }
583
584     // Close ACES Array
585     cborEncoderResult = cbor_encoder_close_container(&aclListMap, &acesArray);
586     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACES Array.");
587
588     // Close ACLIST Map
589     cborEncoderResult = cbor_encoder_close_container(&aclMap, &aclListMap);
590     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACLIST Map.");
591
592     // Rownerid
593     {
594         char *rowner = NULL;
595         cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_ROWNERID_NAME,
596             strlen(OIC_JSON_ROWNERID_NAME));
597         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding rownerid Name.");
598         ret = ConvertUuidToStr(&secAcl->rownerID, &rowner);
599         VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
600         cborEncoderResult = cbor_encode_text_string(&aclMap, rowner, strlen(rowner));
601         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding rownerid Value.");
602         OICFree(rowner);
603     }
604
605     //RT -- Mandatory
606     CborEncoder rtArray;
607     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_RT_NAME,
608             strlen(OIC_JSON_RT_NAME));
609     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Name Tag.");
610     cborEncoderResult = cbor_encoder_create_array(&aclMap, &rtArray, 1);
611     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding RT Value.");
612     for (size_t i = 0; i < 1; i++)
613     {
614         cborEncoderResult = cbor_encode_text_string(&rtArray, OIC_RSRC_TYPE_SEC_ACL,
615                 strlen(OIC_RSRC_TYPE_SEC_ACL));
616         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding RT Value.");
617     }
618     cborEncoderResult = cbor_encoder_close_container(&aclMap, &rtArray);
619     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing RT.");
620
621     //IF-- Mandatory
622     CborEncoder ifArray;
623     cborEncoderResult = cbor_encode_text_string(&aclMap, OIC_JSON_IF_NAME,
624              strlen(OIC_JSON_IF_NAME));
625     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Name Tag.");
626     cborEncoderResult = cbor_encoder_create_array(&aclMap, &ifArray, 1);
627     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Addding IF Value.");
628     for (size_t i = 0; i < 1; i++)
629     {
630         cborEncoderResult = cbor_encode_text_string(&ifArray, OC_RSRVD_INTERFACE_DEFAULT,
631                 strlen(OC_RSRVD_INTERFACE_DEFAULT));
632         VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Adding IF Value.");
633     }
634     cborEncoderResult = cbor_encoder_close_container(&aclMap, &ifArray);
635     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing IF.");
636
637     // Close ACL Map
638     cborEncoderResult = cbor_encoder_close_container(&encoder, &aclMap);
639     VERIFY_CBOR_SUCCESS(TAG, cborEncoderResult, "Failed Closing ACL Map.");
640
641     if (CborNoError == cborEncoderResult)
642     {
643         OIC_LOG(DEBUG, TAG, "AclToCBORPayload Successed");
644         *size = cbor_encoder_get_buffer_size(&encoder, outPayload);
645         *payload = outPayload;
646         ret = OC_STACK_OK;
647     }
648 exit:
649     if (CborErrorOutOfMemory == cborEncoderResult)
650     {
651         OIC_LOG(DEBUG, TAG, "AclToCBORPayload:CborErrorOutOfMemory : retry with more memory");
652
653         // reallocate and try again!
654         OICFree(outPayload);
655         // Since the allocated initial memory failed, double the memory.
656         cborLen += cbor_encoder_get_buffer_size(&encoder, encoder.end);
657         cborEncoderResult = CborNoError;
658         ret = AclToCBORPayload(secAcl, payload, &cborLen);
659         *size = cborLen;
660     }
661     else if (cborEncoderResult != CborNoError)
662     {
663         OIC_LOG(ERROR, TAG, "Failed to AclToCBORPayload");
664         OICFree(outPayload);
665         outPayload = NULL;
666         *size = 0;
667         *payload = NULL;
668         ret = OC_STACK_ERROR;
669     }
670
671     return ret;
672 }
673
674 // This function converts CBOR format to ACL data.
675 // Caller needs to invoke 'free' when done using
676 // It parses { "aclist" : [ { ... } ] } instead of { "aclist" : { "aces" : [ ] } }
677 OicSecAcl_t* CBORPayloadToAcl2(const uint8_t *cborPayload, const size_t size)
678 {
679     if (NULL == cborPayload || 0 == size)
680     {
681         return NULL;
682     }
683     OCStackResult ret = OC_STACK_ERROR;
684     CborValue aclCbor = { .parser = NULL };
685     CborParser parser = { .end = NULL };
686     CborError cborFindResult = CborNoError;
687     cbor_parser_init(cborPayload, size, 0, &parser, &aclCbor);
688
689     OicSecAcl_t *acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
690
691     // Enter ACL Map
692     CborValue aclMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
693     cborFindResult = cbor_value_enter_container(&aclCbor, &aclMap);
694     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACL Map.");
695
696     while (cbor_value_is_valid(&aclMap))
697     {
698         char* tagName = NULL;
699         size_t len = 0;
700         CborType type = cbor_value_get_type(&aclMap);
701         if (type == CborTextStringType)
702         {
703             cborFindResult = cbor_value_dup_text_string(&aclMap, &tagName, &len, NULL);
704             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACL Map.");
705             cborFindResult = cbor_value_advance(&aclMap);
706             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACL Map.");
707         }
708         if(tagName)
709         {
710             if (strcmp(tagName, OIC_JSON_ACLIST_NAME)  == 0)
711             {
712                 // Enter ACES Array
713                 CborValue acesArray = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
714                 cborFindResult = cbor_value_enter_container(&aclMap, &acesArray);
715                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACES Array.");
716
717                 int acesCount = 0;
718                 while (cbor_value_is_valid(&acesArray))
719                 {
720                     acesCount++;
721                     CborValue aceMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
722                     cborFindResult = cbor_value_enter_container(&acesArray, &aceMap);
723                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACE Map.");
724
725                     OicSecAce_t *ace = NULL;
726                     ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
727                     VERIFY_NOT_NULL(TAG, ace, ERROR);
728                     LL_APPEND(acl->aces, ace);
729
730                     VERIFY_NOT_NULL(TAG, acl, ERROR);
731
732                     while (cbor_value_is_valid(&aceMap))
733                     {
734                         char* name = NULL;
735                         size_t len = 0;
736                         CborType type = cbor_value_get_type(&aceMap);
737                         if (type == CborTextStringType)
738                         {
739                             cborFindResult = cbor_value_dup_text_string(&aceMap, &name, &len, NULL);
740                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACE Map.");
741                             cborFindResult = cbor_value_advance(&aceMap);
742                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACE Map.");
743                         }
744                         if (name)
745                         {
746                             // Subject -- Mandatory
747                             if (strcmp(name, OIC_JSON_SUBJECTID_NAME)  == 0)
748                             {
749                                 char *subject = NULL;
750                                 cborFindResult = cbor_value_dup_text_string(&aceMap, &subject, &len, NULL);
751                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding subject Value.");
752                                 if(strcmp(subject, WILDCARD_RESOURCE_URI) == 0)
753                                 {
754                                     ace->subjectuuid.id[0] = '*';
755                                 }
756                                 else
757                                 {
758                                     OIC_LOG_V(DEBUG, TAG, "Converting subjectuuid = %s to uuid...", subject);
759                                     ret = ConvertStrToUuid(subject, &ace->subjectuuid);
760                                     VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
761                                 }
762                                 OICFree(subject);
763                             }
764
765                             // Resources -- Mandatory
766                             if (strcmp(name, OIC_JSON_RESOURCES_NAME) == 0)
767                             {
768                                 CborValue resources = { .parser = NULL };
769                                 cborFindResult = cbor_value_enter_container(&aceMap, &resources);
770                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering a Resource Array.");
771
772                                 while (cbor_value_is_valid(&resources))
773                                 {
774                                     // rMap
775                                     CborValue rMap = { .parser = NULL  };
776                                     cborFindResult = cbor_value_enter_container(&resources, &rMap);
777                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering Resource Map");
778
779                                     OicSecRsrc_t* rsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
780                                     VERIFY_NOT_NULL(TAG, rsrc, ERROR);
781                                     LL_APPEND(ace->resources, rsrc);
782
783                                     while(cbor_value_is_valid(&rMap))
784                                     {
785                                         char *rMapName = NULL;
786                                         size_t rMapNameLen = 0;
787                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rMapName, &rMapNameLen, NULL);
788                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Name Tag.");
789                                         cborFindResult = cbor_value_advance(&rMap);
790                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Value.");
791
792                                         // "href"
793                                         if (0 == strcmp(OIC_JSON_HREF_NAME, rMapName))
794                                         {
795                                             cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->href, &len, NULL);
796                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Href Value.");
797                                         }
798
799                                         // "rt"
800                                         if (0 == strcmp(OIC_JSON_RT_NAME, rMapName) && cbor_value_is_array(&rMap))
801                                         {
802                                             cbor_value_get_array_length(&rMap, &rsrc->typeLen);
803                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RT array length.");
804                                             VERIFY_SUCCESS(TAG, (0 != rsrc->typeLen), ERROR);
805
806                                             rsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
807                                             VERIFY_NOT_NULL(TAG, rsrc->types, ERROR);
808
809                                             CborValue resourceTypes;
810                                             cborFindResult = cbor_value_enter_container(&rMap, &resourceTypes);
811                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering RT Array.");
812
813                                             for(size_t i = 0; cbor_value_is_valid(&resourceTypes) && cbor_value_is_text_string(&resourceTypes); i++)
814                                             {
815                                                 size_t readLen = 0;
816                                                 cborFindResult = cbor_value_dup_text_string(&resourceTypes, &(rsrc->types[i]), &readLen, NULL);
817                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding resource type.");
818                                                 cborFindResult = cbor_value_advance(&resourceTypes);
819                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing resource type.");
820                                             }
821                                         }
822
823                                         // "if"
824                                         if (0 == strcmp(OIC_JSON_IF_NAME, rMapName) && cbor_value_is_array(&rMap))
825                                         {
826                                             cbor_value_get_array_length(&rMap, &rsrc->interfaceLen);
827                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF array length.");
828                                             VERIFY_SUCCESS(TAG, (0 != rsrc->interfaceLen), ERROR);
829
830                                             rsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
831                                             VERIFY_NOT_NULL(TAG, rsrc->interfaces, ERROR);
832
833                                             CborValue interfaces;
834                                             cborFindResult = cbor_value_enter_container(&rMap, &interfaces);
835                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering IF Array.");
836
837                                             for(size_t i = 0; cbor_value_is_valid(&interfaces) && cbor_value_is_text_string(&interfaces); i++)
838                                             {
839                                                 size_t readLen = 0;
840                                                 cborFindResult = cbor_value_dup_text_string(&interfaces, &(rsrc->interfaces[i]), &readLen, NULL);
841                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF type.");
842                                                 cborFindResult = cbor_value_advance(&interfaces);
843                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing IF type.");
844                                             }
845                                         }
846
847                                         // "rel"
848                                         if (0 == strcmp(OIC_JSON_REL_NAME, rMapName))
849                                         {
850                                             cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->rel, &len, NULL);
851                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding REL Value.");
852                                         }
853
854                                         if (cbor_value_is_valid(&rMap))
855                                         {
856                                             cborFindResult = cbor_value_advance(&rMap);
857                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Rlist Map.");
858                                         }
859                                         OICFree(rMapName);
860                                     }
861
862                                     if (cbor_value_is_valid(&resources))
863                                     {
864                                         cborFindResult = cbor_value_advance(&resources);
865                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Resource Array.");
866                                     }
867                                 }
868                             }
869
870                             // Permissions -- Mandatory
871                             if (strcmp(name, OIC_JSON_PERMISSION_NAME) == 0)
872                             {
873                                 uint64_t tmp64;
874                                 cborFindResult = cbor_value_get_uint64(&aceMap, &tmp64);
875                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a PERM Value.");
876                                 ace->permission = (uint16_t)tmp64;
877                             }
878
879                             // TODO: Need to verfication for validity
880                             // Validity -- Not mandatory
881                             if(strcmp(name, OIC_JSON_VALIDITY_NAME) == 0)
882                             {
883                                 CborValue validitiesMap = {.parser = NULL};
884                                 size_t validitySize = 0;
885
886                                 cborFindResult = cbor_value_get_array_length(&aceMap, &validitySize);
887                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Validity Array Length.");
888
889                                 cborFindResult = cbor_value_enter_container(&aceMap, &validitiesMap);
890                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Array Map.");
891
892                                 while(cbor_value_is_valid(&validitiesMap))
893                                 {
894                                     OicSecValidity_t* validity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
895                                     VERIFY_NOT_NULL(TAG, validity, ERROR);
896                                     LL_APPEND(ace->validities, validity);
897
898                                     CborValue validityMap  = {.parser = NULL};
899                                     //period (string)
900                                     cborFindResult = cbor_value_enter_container(&validitiesMap, &validityMap);
901                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Map.");
902
903                                     size_t len = 0;
904                                     cborFindResult =cbor_value_dup_text_string(&validityMap, &validity->period, &len, NULL);
905                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Period value.");
906
907                                     //recurrence (string array)
908                                     CborValue recurrenceMap  = {.parser = NULL};
909                                     cborFindResult = cbor_value_enter_container(&validityMap, &recurrenceMap);
910                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence array.");
911
912                                     cborFindResult = cbor_value_get_array_length(&recurrenceMap, &validity->recurrenceLen);
913                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Adding Recurrence Array.");
914
915                                     validity->recurrences = (char**)OICCalloc(validity->recurrenceLen, sizeof(char*));
916                                     VERIFY_NOT_NULL(TAG, validity->recurrences, ERROR);
917
918                                     for(size_t i = 0; cbor_value_is_text_string(&recurrenceMap) && i < validity->recurrenceLen; i++)
919                                     {
920                                         cborFindResult = cbor_value_dup_text_string(&recurrenceMap, &validity->recurrences[i], &len, NULL);
921                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence Value.");
922
923                                         cborFindResult = cbor_value_advance(&recurrenceMap);
924                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a recurrences Array.");
925                                     }
926
927                                     cborFindResult = cbor_value_advance(&validitiesMap);
928                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a validities Array.");
929                                 }
930                             }
931                             OICFree(name);
932                         }
933
934                         if (type != CborMapType && cbor_value_is_valid(&aceMap))
935                         {
936                             cborFindResult = cbor_value_advance(&aceMap);
937                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing the Array.");
938                         }
939                     }
940
941                     if (cbor_value_is_valid(&acesArray))
942                     {
943                         cborFindResult = cbor_value_advance(&acesArray);
944                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Array.");
945                     }
946                 }
947             }
948
949             //rownerID -- Mandatory
950             if (strcmp(tagName, OIC_JSON_ROWNERID_NAME)  == 0)
951             {
952                 char *stRowner = NULL;
953                 cborFindResult = cbor_value_dup_text_string(&aclMap, &stRowner, &len, NULL);
954                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Rownerid Value.");
955                 OIC_LOG_V(DEBUG, TAG, "Converting rownerid = %s to uuid...", stRowner);
956                 ret = ConvertStrToUuid(stRowner, &acl->rownerID);
957                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
958                 OICFree(stRowner);
959             }
960             OICFree(tagName);
961         }
962         if (cbor_value_is_valid(&aclMap))
963         {
964             cborFindResult = cbor_value_advance(&aclMap);
965             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Map.");
966         }
967     }
968
969 exit:
970     if (cborFindResult != CborNoError)
971     {
972         OIC_LOG(ERROR, TAG, "Failed to CBORPayloadToAcl");
973         DeleteACLList(acl);
974         acl = NULL;
975     }
976
977     return acl;
978 }
979
980 // This function converts CBOR format to ACL data.
981 // Caller needs to invoke 'free' when done using
982 // note: This function is used in unit test hence not declared static,
983 OicSecAcl_t* CBORPayloadToAcl(const uint8_t *cborPayload, const size_t size)
984 {
985     if (NULL == cborPayload || 0 == size)
986     {
987         return NULL;
988     }
989     OCStackResult ret = OC_STACK_ERROR;
990     CborValue aclMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
991     CborValue aclCbor = { .parser = NULL };
992     CborParser parser = { .end = NULL };
993     CborError cborFindResult = CborNoError;
994
995     cbor_parser_init(cborPayload, size, 0, &parser, &aclCbor);
996
997     OicSecAcl_t *acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
998     VERIFY_NOT_NULL(TAG, acl, ERROR);
999
1000     // Enter ACL Map
1001     cborFindResult = cbor_value_enter_container(&aclCbor, &aclMap);
1002     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACL Map.");
1003
1004     while (cbor_value_is_valid(&aclMap))
1005     {
1006         char* tagName = NULL;
1007         size_t len = 0;
1008         CborType type = cbor_value_get_type(&aclMap);
1009         if (type == CborTextStringType)
1010         {
1011             cborFindResult = cbor_value_dup_text_string(&aclMap, &tagName, &len, NULL);
1012             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACL Map.");
1013             cborFindResult = cbor_value_advance(&aclMap);
1014             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACL Map.");
1015         }
1016         if(tagName)
1017         {
1018             if (strcmp(tagName, OIC_JSON_ACLIST_NAME)  == 0)
1019             {
1020                 // Enter ACLIST Map
1021                 CborValue aclistMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1022                 cborFindResult = cbor_value_enter_container(&aclMap, &aclistMap);
1023                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACLIST Map.");
1024
1025                 while (cbor_value_is_valid(&aclistMap))
1026                 {
1027                     char* acName = NULL;
1028                     size_t readLen = 0;
1029                     CborType acType = cbor_value_get_type(&aclistMap);
1030                     if (acType == CborTextStringType)
1031                     {
1032                         cborFindResult = cbor_value_dup_text_string(&aclistMap, &acName, &readLen, NULL);
1033                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACLIST Map.");
1034                         cborFindResult = cbor_value_advance(&aclistMap);
1035                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACLIST Map.");
1036                     }
1037
1038                     if(acName)
1039                     {
1040                         if (strcmp(acName, OIC_JSON_ACES_NAME)  == 0)
1041                         {
1042                             // Enter ACES Array
1043                             CborValue acesArray = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1044                             cborFindResult = cbor_value_enter_container(&aclistMap, &acesArray);
1045                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACES Array.");
1046
1047                             int acesCount = 0;
1048                             while (cbor_value_is_valid(&acesArray))
1049                             {
1050                                 acesCount++;
1051                                 CborValue aceMap = { .parser = NULL, .ptr = NULL, .remaining = 0, .extra = 0, .type = 0, .flags = 0 };
1052                                 cborFindResult = cbor_value_enter_container(&acesArray, &aceMap);
1053                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering ACE Map.");
1054
1055                                 OicSecAce_t *ace = NULL;
1056                                 ace = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
1057                                 VERIFY_NOT_NULL(TAG, ace, ERROR);
1058                                 LL_APPEND(acl->aces, ace);
1059
1060                                 while (cbor_value_is_valid(&aceMap))
1061                                 {
1062                                     char* name = NULL;
1063                                     size_t len = 0;
1064                                     CborType type = cbor_value_get_type(&aceMap);
1065                                     if (type == CborTextStringType)
1066                                     {
1067                                         cborFindResult = cbor_value_dup_text_string(&aceMap, &name, &len, NULL);
1068                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Name in ACE Map.");
1069                                         cborFindResult = cbor_value_advance(&aceMap);
1070                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Value in ACE Map.");
1071                                     }
1072                                     if (name)
1073                                     {
1074                                         // Subject -- Mandatory
1075                                         if (strcmp(name, OIC_JSON_SUBJECTID_NAME)  == 0)
1076                                         {
1077                                             char *subject = NULL;
1078                                             cborFindResult = cbor_value_dup_text_string(&aceMap, &subject, &len, NULL);
1079                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding subject Value.");
1080                                             if(strcmp(subject, WILDCARD_RESOURCE_URI) == 0)
1081                                             {
1082                                                 ace->subjectuuid.id[0] = '*';
1083                                             }
1084                                             else
1085                                             {
1086                                                 ret = ConvertStrToUuid(subject, &ace->subjectuuid);
1087                                                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
1088                                             }
1089                                             OICFree(subject);
1090                                         }
1091
1092                                         // Resources -- Mandatory
1093                                         if (strcmp(name, OIC_JSON_RESOURCES_NAME) == 0)
1094                                         {
1095                                             CborValue resources = { .parser = NULL };
1096                                             cborFindResult = cbor_value_enter_container(&aceMap, &resources);
1097                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering a Resource Array.");
1098
1099                                             while (cbor_value_is_valid(&resources))
1100                                             {
1101                                                 // rMap
1102                                                 CborValue rMap = { .parser = NULL  };
1103                                                 cborFindResult = cbor_value_enter_container(&resources, &rMap);
1104                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering Resource Map");
1105
1106                                                 OicSecRsrc_t* rsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
1107                                                 VERIFY_NOT_NULL(TAG, rsrc, ERROR);
1108                                                 LL_APPEND(ace->resources, rsrc);
1109
1110                                                 while(cbor_value_is_valid(&rMap))
1111                                                 {
1112                                                     char *rMapName = NULL;
1113                                                     size_t rMapNameLen = 0;
1114                                                     cborFindResult = cbor_value_dup_text_string(&rMap, &rMapName, &rMapNameLen, NULL);
1115                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Name Tag.");
1116                                                     cborFindResult = cbor_value_advance(&rMap);
1117                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RMap Data Value.");
1118
1119                                                     // "href"
1120                                                     if (0 == strcmp(OIC_JSON_HREF_NAME, rMapName))
1121                                                     {
1122                                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->href, &len, NULL);
1123                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Href Value.");
1124                                                     }
1125
1126                                                     // "rt"
1127                                                     if (0 == strcmp(OIC_JSON_RT_NAME, rMapName) && cbor_value_is_array(&rMap))
1128                                                     {
1129                                                         cbor_value_get_array_length(&rMap, &rsrc->typeLen);
1130                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding RT array length.");
1131                                                         VERIFY_SUCCESS(TAG, (0 != rsrc->typeLen), ERROR);
1132
1133                                                         rsrc->types = (char**)OICCalloc(rsrc->typeLen, sizeof(char*));
1134                                                         VERIFY_NOT_NULL(TAG, rsrc->types, ERROR);
1135
1136                                                         CborValue resourceTypes;
1137                                                         cborFindResult = cbor_value_enter_container(&rMap, &resourceTypes);
1138                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering RT Array.");
1139
1140                                                         for(size_t i = 0; cbor_value_is_valid(&resourceTypes) && cbor_value_is_text_string(&resourceTypes); i++)
1141                                                         {
1142                                                             cborFindResult = cbor_value_dup_text_string(&resourceTypes, &(rsrc->types[i]), &readLen, NULL);
1143                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding resource type.");
1144                                                             cborFindResult = cbor_value_advance(&resourceTypes);
1145                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing resource type.");
1146                                                         }
1147                                                     }
1148
1149                                                     // "if"
1150                                                     if (0 == strcmp(OIC_JSON_IF_NAME, rMapName) && cbor_value_is_array(&rMap))
1151                                                     {
1152                                                         cbor_value_get_array_length(&rMap, &rsrc->interfaceLen);
1153                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF array length.");
1154                                                         VERIFY_SUCCESS(TAG, (0 != rsrc->interfaceLen), ERROR);
1155
1156                                                         rsrc->interfaces = (char**)OICCalloc(rsrc->interfaceLen, sizeof(char*));
1157                                                         VERIFY_NOT_NULL(TAG, rsrc->interfaces, ERROR);
1158
1159                                                         CborValue interfaces;
1160                                                         cborFindResult = cbor_value_enter_container(&rMap, &interfaces);
1161                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Entering IF Array.");
1162
1163                                                         for(size_t i = 0; cbor_value_is_valid(&interfaces) && cbor_value_is_text_string(&interfaces); i++)
1164                                                         {
1165                                                             cborFindResult = cbor_value_dup_text_string(&interfaces, &(rsrc->interfaces[i]), &readLen, NULL);
1166                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding IF type.");
1167                                                             cborFindResult = cbor_value_advance(&interfaces);
1168                                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing IF type.");
1169                                                         }
1170                                                     }
1171
1172                                                     // "rel"
1173                                                     if (0 == strcmp(OIC_JSON_REL_NAME, rMapName))
1174                                                     {
1175                                                         cborFindResult = cbor_value_dup_text_string(&rMap, &rsrc->rel, &len, NULL);
1176                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding REL Value.");
1177                                                     }
1178
1179                                                     if (cbor_value_is_valid(&rMap))
1180                                                     {
1181                                                         cborFindResult = cbor_value_advance(&rMap);
1182                                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Rlist Map.");
1183                                                     }
1184                                                     OICFree(rMapName);
1185                                                 }
1186
1187                                                 if (cbor_value_is_valid(&resources))
1188                                                 {
1189                                                     cborFindResult = cbor_value_advance(&resources);
1190                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing Resource Array.");
1191                                                 }
1192                                             }
1193                                         }
1194
1195                                         // Permissions -- Mandatory
1196                                         if (strcmp(name, OIC_JSON_PERMISSION_NAME) == 0)
1197                                         {
1198                                             uint64_t tmp64;
1199                                             cborFindResult = cbor_value_get_uint64(&aceMap, &tmp64);
1200                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a PERM Value.");
1201                                             ace->permission = (uint16_t)tmp64;
1202                                         }
1203
1204                                         // TODO: Need to verfication for validity
1205                                         // Validity -- Not mandatory
1206                                         if(strcmp(name, OIC_JSON_VALIDITY_NAME) == 0)
1207                                         {
1208                                             CborValue validitiesMap = {.parser = NULL};
1209                                             size_t validitySize = 0;
1210
1211                                             cborFindResult = cbor_value_get_array_length(&aceMap, &validitySize);
1212                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Validity Array Length.");
1213
1214                                             cborFindResult = cbor_value_enter_container(&aceMap, &validitiesMap);
1215                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Array Map.");
1216
1217                                             while(cbor_value_is_valid(&validitiesMap))
1218                                             {
1219                                                 OicSecValidity_t* validity = (OicSecValidity_t*)OICCalloc(1, sizeof(OicSecValidity_t));
1220                                                 VERIFY_NOT_NULL(TAG, validity, ERROR);
1221                                                 LL_APPEND(ace->validities, validity);
1222
1223                                                 CborValue validityMap  = {.parser = NULL};
1224                                                 //period (string)
1225                                                 cborFindResult = cbor_value_enter_container(&validitiesMap, &validityMap);
1226                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a validity Map.");
1227
1228                                                 size_t len = 0;
1229                                                 cborFindResult =cbor_value_dup_text_string(&validityMap, &validity->period, &len, NULL);
1230                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a Period value.");
1231
1232                                                 //recurrence (string array)
1233                                                 CborValue recurrenceMap  = {.parser = NULL};
1234                                                 cborFindResult = cbor_value_enter_container(&validityMap, &recurrenceMap);
1235                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence array.");
1236
1237                                                 cborFindResult = cbor_value_get_array_length(&recurrenceMap, &validity->recurrenceLen);
1238                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Adding Recurrence Array.");
1239
1240                                                 validity->recurrences = (char**)OICCalloc(validity->recurrenceLen, sizeof(char*));
1241                                                 VERIFY_NOT_NULL(TAG, validity->recurrences, ERROR);
1242
1243                                                 for(size_t i = 0; cbor_value_is_text_string(&recurrenceMap) && i < validity->recurrenceLen; i++)
1244                                                 {
1245                                                     cborFindResult = cbor_value_dup_text_string(&recurrenceMap, &validity->recurrences[i], &len, NULL);
1246                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding a recurrence Value.");
1247
1248                                                     cborFindResult = cbor_value_advance(&recurrenceMap);
1249                                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a recurrences Array.");
1250                                                 }
1251
1252                                                 cborFindResult = cbor_value_advance(&validitiesMap);
1253                                                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing a validities Array.");
1254                                             }
1255                                         }
1256
1257 #ifdef MULTIPLE_OWNER
1258                                         // eowner uuid -- Not Mandatory
1259                                         if (strcmp(name, OIC_JSON_EOWNERID_NAME)  == 0)
1260                                         {
1261                                             char *eowner = NULL;
1262                                             cborFindResult = cbor_value_dup_text_string(&aceMap, &eowner, &len, NULL);
1263                                             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding eownerId Value.");
1264                                             if(NULL == ace->eownerID)
1265                                             {
1266                                                 ace->eownerID = (OicUuid_t*)OICCalloc(1, sizeof(OicUuid_t));
1267                                                 VERIFY_NOT_NULL(TAG, ace->eownerID, ERROR);
1268                                             }
1269                                             ret = ConvertStrToUuid(eowner, ace->eownerID);
1270                                             OICFree(eowner);
1271                                             VERIFY_SUCCESS(TAG, OC_STACK_OK == ret , ERROR);
1272                                         }
1273 #endif //MULTIPLE_OWNER
1274                                         OICFree(name);
1275                                     }
1276
1277                                     if (type != CborMapType && cbor_value_is_valid(&aceMap))
1278                                     {
1279                                         cborFindResult = cbor_value_advance(&aceMap);
1280                                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing the Array.");
1281                                     }
1282                                 }
1283
1284                                 if (cbor_value_is_valid(&acesArray))
1285                                 {
1286                                     cborFindResult = cbor_value_advance(&acesArray);
1287                                     VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Array.");
1288                                 }
1289                             }
1290                         }
1291                         OICFree(acName);
1292                     }
1293
1294                     if (cbor_value_is_valid(&aclistMap))
1295                     {
1296                         cborFindResult = cbor_value_advance(&aclistMap);
1297                         VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACLIST Map.");
1298                     }
1299                 }
1300             }
1301
1302             //rownerID -- Mandatory
1303             if (strcmp(tagName, OIC_JSON_ROWNERID_NAME)  == 0)
1304             {
1305                 char *stRowner = NULL;
1306                 cborFindResult = cbor_value_dup_text_string(&aclMap, &stRowner, &len, NULL);
1307                 VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Finding Rownerid Value.");
1308                 ret = ConvertStrToUuid(stRowner, &acl->rownerID);
1309                 VERIFY_SUCCESS(TAG, ret == OC_STACK_OK, ERROR);
1310                 OICFree(stRowner);
1311             }
1312             else if (NULL != gAcl)
1313             {
1314                 memcpy(&(acl->rownerID), &(gAcl->rownerID), sizeof(OicUuid_t));
1315             }
1316             OICFree(tagName);
1317         }
1318         if (cbor_value_is_valid(&aclMap))
1319         {
1320             cborFindResult = cbor_value_advance(&aclMap);
1321             VERIFY_CBOR_SUCCESS(TAG, cborFindResult, "Failed Advancing ACL Map.");
1322         }
1323     }
1324
1325 exit:
1326     if (cborFindResult != CborNoError)
1327     {
1328         OIC_LOG(ERROR, TAG, "Failed to CBORPayloadToAcl");
1329         DeleteACLList(acl);
1330         acl = NULL;
1331     }
1332
1333     return acl;
1334 }
1335
1336 #ifdef MULTIPLE_OWNER
1337 bool IsValidAclAccessForSubOwner(const OicUuid_t* uuid, const uint8_t *cborPayload, const size_t size)
1338 {
1339     bool retValue = false;
1340     OicSecAcl_t* acl = NULL;
1341
1342     VERIFY_NOT_NULL(TAG, uuid, ERROR);
1343     VERIFY_NOT_NULL(TAG, cborPayload, ERROR);
1344     VERIFY_SUCCESS(TAG, 0 != size, ERROR);
1345
1346     acl = CBORPayloadToAcl(cborPayload, size);
1347     VERIFY_NOT_NULL(TAG, acl, ERROR);
1348
1349     OicSecAce_t* ace = NULL;
1350     OicSecAce_t* tempAce = NULL;
1351     LL_FOREACH_SAFE(acl->aces, ace, tempAce)
1352     {
1353         OicSecRsrc_t* rsrc = NULL;
1354         OicSecRsrc_t* tempRsrc = NULL;
1355
1356         VERIFY_NOT_NULL(TAG, ace->eownerID, ERROR);
1357         VERIFY_SUCCESS(TAG, memcmp(ace->eownerID->id, uuid->id, sizeof(uuid->id)) == 0, ERROR);
1358
1359         LL_FOREACH_SAFE(ace->resources, rsrc, tempRsrc)
1360         {
1361             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_DOXM) != 0, ERROR);
1362             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_CRED) != 0, ERROR);
1363             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_ACL) != 0, ERROR);
1364             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_PSTAT) != 0, ERROR);
1365             VERIFY_SUCCESS(TAG, strcmp(rsrc->href, OIC_RSRC_TYPE_SEC_CRL) != 0, ERROR);
1366         }
1367     }
1368
1369     retValue = true;
1370
1371 exit:
1372     DeleteACLList(acl);
1373
1374     return retValue;
1375 }
1376 #endif //MULTIPLE_OWNER
1377
1378 /**
1379  * This method removes ACE for the subject and resource from the ACL
1380  *
1381  * @param subject of the ACE
1382  * @param resource of the ACE
1383  *
1384  * @return
1385  *     ::OC_STACK_RESOURCE_DELETED on success
1386  *     ::OC_STACK_NO_RESOURCE on failure to find the appropriate ACE
1387  *     ::OC_STACK_INVALID_PARAM on invalid parameter
1388  */
1389 OCStackResult RemoveACE(const OicUuid_t * subject, const char * resource)
1390 {
1391     OIC_LOG(DEBUG, TAG, "IN RemoveACE");
1392
1393     OicSecAce_t *ace = NULL;
1394     OicSecAce_t *tempAce = NULL;
1395     bool deleteFlag = false;
1396     OCStackResult ret = OC_STACK_NO_RESOURCE;
1397
1398     if (memcmp(subject->id, &WILDCARD_SUBJECT_ID, sizeof(subject->id)) == 0)
1399     {
1400         OIC_LOG_V(ERROR, TAG, "%s received invalid parameter", __func__ );
1401         return  OC_STACK_INVALID_PARAM;
1402     }
1403
1404     //If resource is NULL then delete all the ACE for the subject.
1405     if (NULL == resource || resource[0] == '\0')
1406     {
1407         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
1408         {
1409             if (memcmp(ace->subjectuuid.id, subject->id, sizeof(subject->id)) == 0)
1410             {
1411                 LL_DELETE(gAcl->aces, ace);
1412                 FreeACE(ace);
1413                 deleteFlag = true;
1414             }
1415         }
1416     }
1417     else
1418     {
1419         //Looping through ACL to find the right ACE to delete. If the required resource is the only
1420         //resource in the ACE for the subject then delete the whole ACE. If there are more resources
1421         //than the required resource in the ACE, for the subject then just delete the resource from
1422         //the resource array
1423         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
1424         {
1425             if (memcmp(ace->subjectuuid.id, subject->id, sizeof(subject->id)) == 0)
1426             {
1427                 OicSecRsrc_t* rsrc = NULL;
1428                 OicSecRsrc_t* tempRsrc = NULL;
1429                 LL_FOREACH_SAFE(ace->resources, rsrc, tempRsrc)
1430                 {
1431                     if(strcmp(rsrc->href, resource) == 0)
1432                     {
1433                         LL_DELETE(ace->resources, rsrc);
1434                         FreeRsrc(rsrc);
1435                         deleteFlag = true;
1436                     }
1437                 }
1438
1439                 //If resource list is empty
1440                 if(NULL == ace->resources && true == deleteFlag)
1441                 {
1442                     //Remove the ACE from ACL
1443                     LL_DELETE(gAcl->aces, ace);
1444                     FreeACE(ace);
1445                 }
1446             }
1447         }
1448     }
1449
1450     if (deleteFlag)
1451     {
1452         // In case of unit test do not update persistant storage.
1453         if (memcmp(subject->id, &WILDCARD_SUBJECT_B64_ID, sizeof(subject->id)) == 0)
1454         {
1455             ret = OC_STACK_RESOURCE_DELETED;
1456         }
1457         else
1458         {
1459             uint8_t *payload = NULL;
1460             size_t size = 0;
1461             if (OC_STACK_OK == AclToCBORPayload(gAcl, &payload, &size))
1462             {
1463                 if (OC_STACK_OK == UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size))
1464                 {
1465                     ret = OC_STACK_RESOURCE_DELETED;
1466                 }
1467                 OICFree(payload);
1468             }
1469         }
1470     }
1471     return ret;
1472 }
1473
1474 /**
1475  * This method parses the query string received for REST requests and
1476  * retrieves the 'subject' field.
1477  *
1478  * @param query querystring passed in REST request
1479  * @param subject subject UUID parsed from query string
1480  *
1481  * @return true if query parsed successfully and found 'subject', else false.
1482  */
1483 static bool GetSubjectFromQueryString(const char *query, OicUuid_t *subject)
1484 {
1485     OicParseQueryIter_t parseIter = { .attrPos = NULL };
1486
1487     ParseQueryIterInit((unsigned char *) query, &parseIter);
1488
1489     while (GetNextQuery (&parseIter))
1490     {
1491         if (strncasecmp((char *) parseIter.attrPos, OIC_JSON_SUBJECTID_NAME, parseIter.attrLen) == 0)
1492         {
1493             char strUuid[STRING_UUID_SIZE] = {0};
1494             VERIFY_SUCCESS(TAG, 0 != parseIter.valLen, ERROR);
1495             memcpy(strUuid, parseIter.valPos, parseIter.valLen);
1496             OCStackResult res = ConvertStrToUuid(strUuid, subject);
1497             VERIFY_SUCCESS(TAG, OC_STACK_OK == res, ERROR);
1498             return true;
1499         }
1500     }
1501
1502 exit:
1503     return false;
1504 }
1505
1506 /**
1507  * This method parses the query string received for REST requests and
1508  * retrieves the 'resource' field.
1509  *
1510  * @param query querystring passed in REST request
1511  * @param resource resource parsed from query string
1512  * @param resourceSize size of the memory pointed to resource
1513  *
1514  * @return true if query parsed successfully and found 'resource', else false.
1515  */
1516 static bool GetResourceFromQueryString(const char *query, char *resource, size_t resourceSize)
1517 {
1518     OicParseQueryIter_t parseIter = { .attrPos = NULL };
1519
1520     ParseQueryIterInit((unsigned char *) query, &parseIter);
1521
1522     while (GetNextQuery (&parseIter))
1523     {
1524         if (strncasecmp((char *) parseIter.attrPos, OIC_JSON_RESOURCES_NAME, parseIter.attrLen)
1525                 == 0)
1526         {
1527             VERIFY_SUCCESS(TAG, 0 != parseIter.valLen, ERROR);
1528             OICStrcpy(resource, resourceSize, (char *) parseIter.valPos);
1529
1530             return true;
1531         }
1532     }
1533
1534 exit:
1535    return false;
1536 }
1537
1538 static size_t GetNumberOfResource(OicSecRsrc_t* resources)
1539 {
1540     size_t ret = 0;
1541     if(resources)
1542     {
1543         OicSecRsrc_t* rsrc = NULL;
1544         LL_FOREACH(resources, rsrc)
1545         {
1546             ret++;
1547         }
1548     }
1549     return ret;
1550 }
1551
1552 static size_t GetNumberOfValidity(OicSecValidity_t* val)
1553 {
1554     size_t ret = 0;
1555
1556     if(val)
1557     {
1558         OicSecValidity_t* temp = NULL;
1559         LL_FOREACH(val, temp)
1560         {
1561             ret++;
1562         }
1563     }
1564     return ret;
1565 }
1566
1567
1568 static bool IsSameStringArray(char** strArr1, size_t strArr1Len,
1569                               char** strArr2, size_t strArr2Len)
1570 {
1571
1572     if(NULL == strArr1 && NULL == strArr2)
1573     {
1574         return true;
1575     }
1576
1577     if(strArr1 && strArr2 && NULL == *strArr1 && NULL == *strArr2)
1578     {
1579         return true;
1580     }
1581
1582     if(strArr1 && strArr2)
1583     {
1584         if(*strArr1 && *strArr2 && strArr1Len == strArr2Len)
1585         {
1586             size_t matchedStr = 0;
1587             for(size_t i = 0; i < strArr1Len; i++)
1588             {
1589                 for(size_t j = 0; j < strArr2Len; j++)
1590                 {
1591                     if(strcmp(strArr1[i], strArr2[j]) == 0)
1592                     {
1593                         matchedStr++;
1594                     }
1595                 }
1596             }
1597             if(matchedStr == strArr1Len)
1598             {
1599                 return true;
1600             }
1601         }
1602     }
1603
1604     return false;
1605 }
1606
1607 static bool IsSameResources(OicSecRsrc_t* resources1, OicSecRsrc_t* resources2)
1608 {
1609     size_t numOfRsrc1 = 0;
1610     size_t numOfRsrc2 = 0;
1611     size_t numOfMatchedRsrc = 0;
1612     OicSecRsrc_t* rsrc1 = NULL;
1613     OicSecRsrc_t* rsrc2 = NULL;
1614
1615     if(NULL == resources1 && NULL == resources2)
1616     {
1617         return true;
1618     }
1619
1620     if(resources1 && resources2)
1621     {
1622         numOfRsrc1 = GetNumberOfResource(resources1);
1623         numOfRsrc2 = GetNumberOfResource(resources2);
1624
1625         if(0 == numOfRsrc1 && 0 == numOfRsrc2)
1626         {
1627             return true;
1628         }
1629
1630         LL_FOREACH(resources1, rsrc1)
1631         {
1632             rsrc2 = NULL;
1633             LL_FOREACH(resources2, rsrc2)
1634             {
1635                 if(rsrc1 && rsrc2)
1636                 {
1637                     if(strcmp(rsrc1->href, rsrc2->href) == 0 &&
1638                         IsSameStringArray(rsrc1->interfaces, rsrc1->interfaceLen,
1639                                           rsrc2->interfaces, rsrc2->interfaceLen) &&
1640                         IsSameStringArray(rsrc1->types, rsrc1->typeLen,
1641                                           rsrc2->types, rsrc2->typeLen))
1642                     {
1643                         // TODO: Update codes to compare 'rel' property
1644                         numOfMatchedRsrc++;
1645                     }
1646                 }
1647             }
1648         }
1649
1650         if(numOfMatchedRsrc == numOfRsrc1)
1651         {
1652             return true;
1653         }
1654     }
1655
1656     return false;
1657 }
1658
1659 static bool IsSameValidities(OicSecValidity_t* validities1, OicSecValidity_t* validities2)
1660 {
1661     size_t numOfVal1 = 0;
1662     size_t numOfVal2 = 0;
1663     size_t numOfMatchedVal = 0;
1664     OicSecValidity_t* val1 = NULL;
1665     OicSecValidity_t* val2 = NULL;
1666
1667     if(NULL == validities1 && NULL == validities2)
1668     {
1669         return true;
1670     }
1671
1672     if(validities1 && validities2)
1673     {
1674         numOfVal1 = GetNumberOfValidity(validities1);
1675         numOfVal2 = GetNumberOfValidity(validities2);
1676         if(0 == numOfVal1 && 0 == numOfVal2)
1677         {
1678             return true;
1679         }
1680
1681         if(numOfVal1 == numOfVal2)
1682         {
1683             LL_FOREACH(validities1, val1)
1684             {
1685                 LL_FOREACH(validities2, val2)
1686                 {
1687                     if(strcmp(val1->period, val2->period) == 0 &&
1688                         IsSameStringArray(val1->recurrences, val1->recurrenceLen,
1689                                           val2->recurrences, val2->recurrenceLen))
1690                     {
1691                         numOfMatchedVal++;
1692                     }
1693                 }
1694             }
1695             if(numOfVal1 == numOfMatchedVal)
1696             {
1697                 return true;
1698             }
1699         }
1700     }
1701
1702     return false;
1703 }
1704
1705 #ifdef MULTIPLE_OWNER
1706 static bool IsSameEowner(OicUuid_t* eowner1, OicUuid_t* eowner2)
1707 {
1708     if (NULL != eowner1 && NULL != eowner2)
1709     {
1710         if (memcmp(eowner1->id, eowner2->id, sizeof(eowner1->id)) == 0)
1711         {
1712             return true;
1713         }
1714     }
1715     else if (NULL == eowner1 && NULL == eowner2)
1716     {
1717         OIC_LOG(DEBUG, TAG, "Both eowner1 and eowner2 are NULL");
1718         return true;
1719     }
1720
1721     return false;
1722 }
1723 #endif
1724
1725 static bool IsSameACE(OicSecAce_t* ace1, OicSecAce_t* ace2)
1726 {
1727     if(ace1 && ace2)
1728     {
1729         if(memcmp(ace1->subjectuuid.id, ace2->subjectuuid.id, sizeof(ace1->subjectuuid.id)) != 0)
1730         {
1731             return false;
1732         }
1733
1734         if(false == IsSameResources(ace1->resources, ace2->resources))
1735         {
1736             return false;
1737         }
1738
1739         if(ace1->permission != ace2->permission)
1740         {
1741             return false;
1742         }
1743
1744         if(false == IsSameValidities(ace1->validities, ace2->validities))
1745         {
1746             return false;
1747         }
1748
1749 #ifdef MULTIPLE_OWNER
1750         if(false == IsSameEowner(ace1->eownerID, ace2->eownerID))
1751         {
1752             return false;
1753         }
1754 #endif
1755
1756         return true;
1757     }
1758
1759     return false;
1760 }
1761
1762 /**
1763  * Internal function to remove all ACL data on ACL resource and persistent storage
1764  *
1765  * @retval
1766  *     OC_STACK_RESOURCE_DELETED  - no errors
1767  *     Otherwise                  - error
1768  */
1769 static OCStackResult RemoveAllAce(void)
1770 {
1771     OCStackResult ret = OC_STACK_ERROR;
1772     uint8_t* aclBackup = NULL;
1773     size_t backupSize = 0;
1774     uint8_t* payload = NULL;
1775     size_t size = 0;
1776     OicSecAce_t* aceItem = NULL;
1777     OicSecAce_t* tempAce = NULL;
1778
1779     OIC_LOG(INFO, TAG, "IN RemoveAllAce");
1780
1781     //Backup the current ACL
1782     ret = AclToCBORPayload(gAcl, &aclBackup, &backupSize);
1783     if(OC_STACK_OK == ret)
1784     {
1785         // Remove all ACE from ACL
1786         LL_FOREACH_SAFE(gAcl->aces, aceItem, tempAce)
1787         {
1788             LL_DELETE(gAcl->aces, aceItem);
1789             FreeACE(aceItem);
1790         }
1791
1792         //Generate empty ACL payload
1793         ret = AclToCBORPayload(gAcl, &payload, &size);
1794         if (OC_STACK_OK == ret )
1795         {
1796             //Update the PS.
1797             ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size);
1798             if (OC_STACK_OK != ret)
1799             {
1800                 OIC_LOG_V(ERROR, TAG, "Error in UpdateSecureResourceInPS : %d", ret);
1801             }
1802         }
1803
1804         if(OC_STACK_OK != ret)
1805         {
1806             OIC_LOG_V(ERROR, TAG, "Error while DELETE ACE : %d", ret);
1807
1808             //If some erorr is occured, revert back.
1809             OicSecAcl_t* originAcl = CBORPayloadToAcl(aclBackup, backupSize);
1810             if( originAcl )
1811             {
1812                 ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, aclBackup, backupSize);
1813                 if (OC_STACK_OK == ret)
1814                 {
1815                     DeleteACLList(gAcl);
1816                     gAcl = originAcl;
1817                 }
1818                 else
1819                 {
1820                     OIC_LOG_V(ERROR, TAG, "Error in UpdateSecureResourceInPS : %d", ret);
1821                 }
1822             }
1823             else
1824             {
1825                 OIC_LOG(FATAL, TAG, "Error in CBORPayloadToAcl");
1826                 ret = OC_STACK_ERROR;
1827             }
1828         }
1829     }
1830
1831     OICFree(aclBackup);
1832     OICFree(payload);
1833
1834     OIC_LOG(INFO, TAG, "OUT RemoveAllAce");
1835
1836     return (OC_STACK_OK == ret ? OC_STACK_RESOURCE_DELETED : ret);
1837 }
1838
1839 static OCEntityHandlerResult HandleACLGetRequest(const OCEntityHandlerRequest *ehRequest)
1840 {
1841     OIC_LOG(INFO, TAG, "HandleACLGetRequest processing the request");
1842     uint8_t* payload = NULL;
1843     size_t size = 0;
1844     OCEntityHandlerResult ehRet;
1845
1846     OicUuid_t subject = {.id= { 0 } };
1847
1848     // In case, 'subject' field is included in REST request.
1849     if (ehRequest->query && GetSubjectFromQueryString(ehRequest->query, &subject))
1850     {
1851         OIC_LOG(DEBUG,TAG,"'subject' field is inculded in REST request.");
1852         OIC_LOG(DEBUG, TAG, "HandleACLGetRequest processing query");
1853
1854         char resource[MAX_URI_LENGTH] = { 0 };
1855
1856         OicSecAce_t *savePtr = NULL;
1857         const OicSecAce_t *currentAce = NULL;
1858         OicSecAcl_t targetAcl;
1859
1860         memcpy(&targetAcl.rownerID, &gAcl->rownerID, sizeof(OicUuid_t));
1861         targetAcl.aces = NULL;
1862
1863         // 'Subject' field is MUST for processing a querystring in REST request.
1864         GetResourceFromQueryString(ehRequest->query, resource, sizeof(resource));
1865
1866         /*
1867          * TODO : Currently, this code only provides one ACE for a Subject.
1868          * Below code needs to be updated for scenarios when Subject have
1869          * multiple ACE's in ACL resource.
1870          */
1871         while ((currentAce = GetACLResourceData(&subject, &savePtr)))
1872         {
1873             targetAcl.aces = (OicSecAce_t*)currentAce;
1874
1875             /*
1876              * If REST querystring contains a specific resource, we need
1877              * to search for that resource in ACE.
1878              */
1879             if (resource[0] != '\0')
1880             {
1881                 OicSecRsrc_t *rsrc = NULL;
1882                 LL_FOREACH(currentAce->resources, rsrc)
1883                 {
1884                     if(0 == strcmp(rsrc->href, resource) ||
1885                         0 == strcmp(WILDCARD_RESOURCE_URI, rsrc->href))
1886                     {
1887                         // Convert ACL data into CBOR format for transmission
1888                         if (OC_STACK_OK != AclToCBORPayload(&targetAcl, &payload, &size))
1889                         {
1890                             ehRet = OC_EH_ERROR;
1891                         }
1892                         goto exit;
1893                     }
1894                 }
1895             }
1896             else
1897             {
1898                 // Convert ACL data into CBOR format for transmission
1899                 if (OC_STACK_OK != AclToCBORPayload(&targetAcl, &payload, &size))
1900                 {
1901                     ehRet = OC_EH_ERROR;
1902                 }
1903                 goto exit;
1904             }
1905         }
1906     }
1907     // In case, 'subject' field is not included in REST request.
1908     else
1909     {
1910         OIC_LOG(DEBUG,TAG,"'subject' field is not inculded in REST request.");
1911         // Convert ACL data into CBOR format for transmission.
1912         if (OC_STACK_OK != AclToCBORPayload(gAcl, &payload, &size))
1913         {
1914             ehRet = OC_EH_ERROR;
1915         }
1916     }
1917 exit:
1918     // A device should always have a default acl. Therefore, payload should never be NULL.
1919     ehRet = (payload ? OC_EH_OK : OC_EH_ERROR);
1920     OIC_LOG(DEBUG, TAG, "ACL payload with GET response");
1921     OIC_LOG_BUFFER(DEBUG, TAG, payload, size);
1922
1923     //Send payload to request originator
1924     ehRet = ((SendSRMResponse(ehRequest, ehRet, payload, size)) == OC_STACK_OK) ?
1925                    OC_EH_OK : OC_EH_ERROR;
1926
1927     OICFree(payload);
1928
1929     OIC_LOG_V(DEBUG, TAG, "%s RetVal %d", __func__, ehRet);
1930     return ehRet;
1931 }
1932
1933 static OCEntityHandlerResult HandleACLPostRequest(const OCEntityHandlerRequest *ehRequest)
1934 {
1935     OIC_LOG(INFO, TAG, "HandleACLPostRequest processing the request");
1936     OCEntityHandlerResult ehRet = OC_EH_OK;
1937
1938     // Convert CBOR into ACL data and update to SVR buffers. This will also validate the ACL data received.
1939     uint8_t *payload = ((OCSecurityPayload *) ehRequest->payload)->securityData;
1940     size_t size = ((OCSecurityPayload *) ehRequest->payload)->payloadSize;
1941     if (payload)
1942     {
1943         OicSecAcl_t *newAcl = NULL;
1944         OIC_LOG(DEBUG, TAG, "ACL payload from POST request << ");
1945         OIC_LOG_BUFFER(DEBUG, TAG, payload, size);
1946
1947         newAcl = CBORPayloadToAcl(payload, size);
1948         if (newAcl)
1949         {
1950             bool isNewAce = true;
1951             OicSecAce_t* existAce = NULL;
1952             OicSecAce_t* newAce = NULL;
1953             OicSecAce_t* tempAce1 = NULL;
1954             OicSecAce_t* tempAce2 = NULL;
1955
1956             LL_FOREACH_SAFE(newAcl->aces, newAce, tempAce1)
1957             {
1958                 isNewAce = true;
1959                 LL_FOREACH_SAFE(gAcl->aces, existAce, tempAce2)
1960                 {
1961                     if(IsSameACE(newAce, existAce))
1962                     {
1963                         isNewAce = false;
1964                     }
1965                 }
1966                 if(isNewAce)
1967                 {
1968                     OIC_LOG(DEBUG, TAG, "NEW ACE dectected.");
1969
1970                     OicSecAce_t* insertAce = DuplicateACE(newAce);
1971                     if(insertAce)
1972                     {
1973                         OIC_LOG(DEBUG, TAG, "Appending new ACE..");
1974                         LL_PREPEND(gAcl->aces, insertAce);
1975                     }
1976                     else
1977                     {
1978                         OIC_LOG(ERROR, TAG, "Failed to duplicate ACE.");
1979                         ehRet = OC_EH_ERROR;
1980                     }
1981                 }
1982             }
1983             memcpy(&(gAcl->rownerID), &(newAcl->rownerID), sizeof(OicUuid_t));
1984
1985             DeleteACLList(newAcl);
1986
1987             if(OC_EH_OK == ehRet)
1988             {
1989                 size_t size = 0;
1990                 uint8_t *cborPayload = NULL;
1991
1992                 if (OC_STACK_OK == AclToCBORPayload(gAcl, &cborPayload, &size))
1993                 {
1994                     if (UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, cborPayload, size) == OC_STACK_OK)
1995                     {
1996                         ehRet = OC_EH_CHANGED;
1997                     }
1998                     OICFree(cborPayload);
1999                 }
2000
2001                 if(OC_EH_CHANGED != ehRet)
2002                 {
2003                     ehRet = OC_EH_ERROR;
2004                 }
2005             }
2006         }
2007     }
2008
2009     //Send response to request originator
2010     ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2011                    OC_EH_OK : OC_EH_ERROR;
2012
2013     OIC_LOG_V(DEBUG, TAG, "%s RetVal %d", __func__, ehRet);
2014     return ehRet;
2015 }
2016
2017 static OCEntityHandlerResult HandleACLDeleteRequest(const OCEntityHandlerRequest *ehRequest)
2018 {
2019     OIC_LOG(DEBUG, TAG, "Processing ACLDeleteRequest");
2020     OCEntityHandlerResult ehRet = OC_EH_ERROR;
2021     OicUuid_t subject = { .id= { 0 } };
2022     char resource[MAX_URI_LENGTH] = { 0 };
2023
2024     VERIFY_NOT_NULL(TAG, ehRequest->query, ERROR);
2025
2026     // If 'Subject' field exist, processing a querystring in REST request.
2027     if(GetSubjectFromQueryString(ehRequest->query, &subject))
2028     {
2029         GetResourceFromQueryString(ehRequest->query, resource, sizeof(resource));
2030
2031         if (OC_STACK_RESOURCE_DELETED == RemoveACE(&subject, resource))
2032         {
2033             ehRet = OC_EH_RESOURCE_DELETED;
2034         }
2035     }
2036     // If 'subject field not exist, remove all ACL data from ACL resource
2037     else
2038     {
2039         OIC_LOG(WARNING, TAG, "Can not find the 'subject' in querystring, All ACL list will be removed.");
2040
2041         if(OC_STACK_RESOURCE_DELETED == RemoveAllAce())
2042         {
2043             ehRet = OC_EH_RESOURCE_DELETED;
2044         }
2045     }
2046
2047 exit:
2048     //Send response to request originator
2049     ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2050                    OC_EH_OK : OC_EH_ERROR;
2051
2052     return ehRet;
2053 }
2054
2055 OCEntityHandlerResult ACLEntityHandler(OCEntityHandlerFlag flag, OCEntityHandlerRequest * ehRequest,
2056         void* callbackParameter)
2057 {
2058     OIC_LOG(DEBUG, TAG, "Received request ACLEntityHandler");
2059     (void)callbackParameter;
2060     OCEntityHandlerResult ehRet = OC_EH_ERROR;
2061
2062     if (!ehRequest)
2063     {
2064         return ehRet;
2065     }
2066
2067     if (flag & OC_REQUEST_FLAG)
2068     {
2069         // TODO :  Handle PUT method
2070         OIC_LOG(DEBUG, TAG, "Flag includes OC_REQUEST_FLAG");
2071         switch (ehRequest->method)
2072         {
2073             case OC_REST_GET:
2074                 ehRet = HandleACLGetRequest(ehRequest);
2075                 break;
2076
2077             case OC_REST_POST:
2078                 ehRet = HandleACLPostRequest(ehRequest);
2079                 break;
2080
2081             case OC_REST_DELETE:
2082                 ehRet = HandleACLDeleteRequest(ehRequest);
2083                 break;
2084
2085             default:
2086                 ehRet = ((SendSRMResponse(ehRequest, ehRet, NULL, 0)) == OC_STACK_OK) ?
2087                                OC_EH_OK : OC_EH_ERROR;
2088         }
2089     }
2090
2091     return ehRet;
2092 }
2093
2094 /**
2095  * This internal method is used to create '/oic/sec/acl' resource.
2096  */
2097 static OCStackResult CreateACLResource()
2098 {
2099     OCStackResult ret;
2100
2101     ret = OCCreateResource(&gAclHandle,
2102                            OIC_RSRC_TYPE_SEC_ACL,
2103                            OC_RSRVD_INTERFACE_DEFAULT,
2104                            OIC_RSRC_ACL_URI,
2105                            ACLEntityHandler,
2106                            NULL,
2107                            OC_SECURE);
2108
2109     if (OC_STACK_OK != ret)
2110     {
2111         OIC_LOG(FATAL, TAG, "Unable to instantiate ACL resource");
2112         DeInitACLResource();
2113     }
2114     return ret;
2115 }
2116
2117 // This function sets the default ACL and is defined for the unit test only.
2118 OCStackResult SetDefaultACL(OicSecAcl_t *acl)
2119 {
2120     gAcl = acl;
2121     return OC_STACK_OK;
2122 }
2123
2124 OCStackResult GetDefaultACL(OicSecAcl_t** defaultAcl)
2125 {
2126     OCStackResult ret = OC_STACK_ERROR;
2127     OicUuid_t ownerId = { .id = { 0 } };
2128     OicSecAcl_t *acl = NULL;
2129     OicSecAce_t *readOnlyAce = NULL;
2130     OicSecAce_t *readWriteAce = NULL;
2131     OicSecRsrc_t* resRsrc = NULL;
2132     OicSecRsrc_t* deviceRsrc = NULL;
2133     OicSecRsrc_t* platformRsrc = NULL;
2134     OicSecRsrc_t* aclRsrc = NULL;
2135     OicSecRsrc_t* doxmRsrc = NULL;
2136     OicSecRsrc_t* pstatRsrc = NULL;
2137
2138     /*
2139      * TODO In future, when new virtual resources will be added in OIC
2140      * specification, Iotivity stack should be able to add them in
2141      * existing SVR database. To support this, we need to add 'versioning'
2142      * mechanism in SVR database.
2143      */
2144
2145     if (!defaultAcl)
2146     {
2147         return OC_STACK_INVALID_PARAM;
2148     }
2149
2150     acl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
2151     VERIFY_NOT_NULL(TAG, acl, ERROR);
2152
2153     // Default ACE allowing read-only access, for discovery
2154     readOnlyAce = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
2155     VERIFY_NOT_NULL(TAG, readOnlyAce, ERROR);
2156
2157     // Subject -- Mandatory
2158     memcpy(readOnlyAce->subjectuuid.id, &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t));
2159
2160     // Resources -- Mandatory
2161     // /oic/res
2162     resRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2163     VERIFY_NOT_NULL(TAG, resRsrc, ERROR);
2164     LL_APPEND(readOnlyAce->resources, resRsrc);
2165     resRsrc->href = OICStrdup(OC_RSRVD_WELL_KNOWN_URI);
2166     VERIFY_NOT_NULL(TAG, (resRsrc->href), ERROR);
2167     resRsrc->typeLen = 1;
2168     resRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2169     VERIFY_NOT_NULL(TAG, resRsrc->types, ERROR);
2170     resRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_RES);
2171     VERIFY_NOT_NULL(TAG, resRsrc->types[0], ERROR);
2172     resRsrc->interfaceLen = 2;
2173     resRsrc->interfaces = (char**)OICCalloc(resRsrc->interfaceLen, sizeof(char*));
2174     VERIFY_NOT_NULL(TAG, resRsrc->interfaces, ERROR);
2175     resRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2176     VERIFY_NOT_NULL(TAG, resRsrc->interfaces[0], ERROR);
2177     resRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2178     VERIFY_NOT_NULL(TAG, resRsrc->interfaces[1], ERROR);
2179
2180     // /oic/d
2181     deviceRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2182     VERIFY_NOT_NULL(TAG, deviceRsrc, ERROR);
2183     LL_APPEND(readOnlyAce->resources, deviceRsrc);
2184     deviceRsrc->href = OICStrdup(OC_RSRVD_DEVICE_URI);
2185     VERIFY_NOT_NULL(TAG, (deviceRsrc->href), ERROR);
2186     deviceRsrc->typeLen = 1;
2187     deviceRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2188     VERIFY_NOT_NULL(TAG, deviceRsrc->types, ERROR);
2189     deviceRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_DEVICE);
2190     VERIFY_NOT_NULL(TAG, deviceRsrc->types[0], ERROR);
2191     deviceRsrc->interfaceLen = 2;
2192     deviceRsrc->interfaces = (char**)OICCalloc(deviceRsrc->interfaceLen, sizeof(char*));
2193     VERIFY_NOT_NULL(TAG, deviceRsrc->interfaces, ERROR);
2194     deviceRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2195     VERIFY_NOT_NULL(TAG, deviceRsrc->interfaces[0], ERROR);
2196     deviceRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2197     VERIFY_NOT_NULL(TAG, deviceRsrc->interfaces[1], ERROR);
2198
2199     // /oic/p
2200     platformRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2201     VERIFY_NOT_NULL(TAG, platformRsrc, ERROR);
2202     LL_APPEND(readOnlyAce->resources, platformRsrc);
2203     platformRsrc->href = OICStrdup(OC_RSRVD_PLATFORM_URI);
2204     VERIFY_NOT_NULL(TAG, (platformRsrc->href), ERROR);
2205     platformRsrc->typeLen = 1;
2206     platformRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2207     VERIFY_NOT_NULL(TAG, platformRsrc->types, ERROR);
2208     platformRsrc->types[0] = OICStrdup(OC_RSRVD_RESOURCE_TYPE_PLATFORM);
2209     VERIFY_NOT_NULL(TAG, platformRsrc->types[0], ERROR);
2210     platformRsrc->interfaceLen = 2;
2211     platformRsrc->interfaces = (char**)OICCalloc(platformRsrc->interfaceLen, sizeof(char*));
2212     VERIFY_NOT_NULL(TAG, platformRsrc->interfaces, ERROR);
2213     platformRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2214     VERIFY_NOT_NULL(TAG, platformRsrc->interfaces[0], ERROR);
2215     platformRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2216     VERIFY_NOT_NULL(TAG, platformRsrc->interfaces[1], ERROR);
2217
2218     readOnlyAce->permission = PERMISSION_READ;
2219     readOnlyAce->validities = NULL;
2220     LL_APPEND(acl->aces, readOnlyAce);
2221
2222     // The entire list of ACEs will be freed later, by DeleteACLList.
2223     readOnlyAce = NULL;
2224
2225     // Default ACE allowing read + write access, for ownership transfer
2226     readWriteAce = (OicSecAce_t *) OICCalloc(1, sizeof(OicSecAce_t));
2227     VERIFY_NOT_NULL(TAG, readWriteAce, ERROR);
2228
2229     // Subject -- Mandatory
2230     memcpy(readWriteAce->subjectuuid.id, &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t));
2231
2232     // Resources -- Mandatory
2233     // /oic/sec/doxm
2234     doxmRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2235     VERIFY_NOT_NULL(TAG, doxmRsrc, ERROR);
2236     LL_APPEND(readWriteAce->resources, doxmRsrc);
2237     doxmRsrc->href = OICStrdup(OIC_RSRC_DOXM_URI);
2238     VERIFY_NOT_NULL(TAG, (doxmRsrc->href), ERROR);
2239     doxmRsrc->typeLen = 1;
2240     doxmRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2241     VERIFY_NOT_NULL(TAG, doxmRsrc->types, ERROR);
2242     doxmRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_DOXM);
2243     VERIFY_NOT_NULL(TAG, doxmRsrc->types[0], ERROR);
2244     doxmRsrc->interfaceLen = 1;
2245     doxmRsrc->interfaces = (char**)OICCalloc(doxmRsrc->interfaceLen, sizeof(char*));
2246     VERIFY_NOT_NULL(TAG, doxmRsrc->interfaces, ERROR);
2247     doxmRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2248     VERIFY_NOT_NULL(TAG, doxmRsrc->interfaces[0], ERROR);
2249
2250     // /oic/sec/pstat
2251     pstatRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2252     VERIFY_NOT_NULL(TAG, pstatRsrc, ERROR);
2253     LL_APPEND(readWriteAce->resources, pstatRsrc);
2254     pstatRsrc->href = OICStrdup(OIC_RSRC_PSTAT_URI);
2255     VERIFY_NOT_NULL(TAG, (pstatRsrc->href), ERROR);
2256     pstatRsrc->typeLen = 1;
2257     pstatRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2258     VERIFY_NOT_NULL(TAG, pstatRsrc->types, ERROR);
2259     pstatRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_PSTAT);
2260     VERIFY_NOT_NULL(TAG, pstatRsrc->types[0], ERROR);
2261     pstatRsrc->interfaceLen = 1;
2262     pstatRsrc->interfaces = (char**)OICCalloc(pstatRsrc->interfaceLen, sizeof(char*));
2263     VERIFY_NOT_NULL(TAG, pstatRsrc->interfaces, ERROR);
2264     pstatRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2265     VERIFY_NOT_NULL(TAG, pstatRsrc->interfaces[0], ERROR);
2266
2267     // /oic/sec/cred
2268     resRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2269     VERIFY_NOT_NULL(TAG, resRsrc, ERROR);
2270     LL_APPEND(readWriteAce->resources, resRsrc);
2271     resRsrc->href = OICStrdup(OIC_RSRC_CRED_URI);
2272     VERIFY_NOT_NULL(TAG, (resRsrc->href), ERROR);
2273     resRsrc->typeLen = 1;
2274     resRsrc->types = (char**)OICCalloc(1, sizeof(char*));
2275     VERIFY_NOT_NULL(TAG, resRsrc->types, ERROR);
2276     resRsrc->types[0] = OICStrdup(OIC_RSRC_TYPE_SEC_CRED);
2277     VERIFY_NOT_NULL(TAG, resRsrc->types[0], ERROR);
2278     resRsrc->interfaceLen = 2;
2279     resRsrc->interfaces = (char**)OICCalloc(resRsrc->interfaceLen, sizeof(char*));
2280     VERIFY_NOT_NULL(TAG, resRsrc->interfaces, ERROR);
2281     resRsrc->interfaces[0] = OICStrdup(OC_RSRVD_INTERFACE_DEFAULT);
2282     VERIFY_NOT_NULL(TAG, resRsrc->interfaces[0], ERROR);
2283     resRsrc->interfaces[1] = OICStrdup(OC_RSRVD_INTERFACE_READ);
2284     VERIFY_NOT_NULL(TAG, resRsrc->interfaces[1], ERROR);
2285
2286     readWriteAce->permission = PERMISSION_READ | PERMISSION_WRITE;
2287     readWriteAce->validities = NULL;
2288     LL_APPEND(acl->aces, readWriteAce);
2289
2290     // The entire list of ACEs will be freed later, by DeleteACLList.
2291     readWriteAce = NULL;
2292
2293     // Device ID is the owner of this default ACL
2294     if (GetDoxmResourceData() != NULL)
2295     {
2296         ret = GetDoxmDeviceID(&ownerId);
2297         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, FATAL);
2298     }
2299     else
2300     {
2301         VERIFY_SUCCESS(TAG, OCGenerateUuid(ownerId.id), FATAL);
2302     }
2303
2304     memcpy(&acl->rownerID, &ownerId, sizeof(OicUuid_t));
2305
2306     *defaultAcl = acl;
2307     ret = OC_STACK_OK;
2308
2309 exit:
2310
2311     if (ret != OC_STACK_OK)
2312     {
2313         if (readOnlyAce != NULL)
2314         {
2315             FreeACE(readOnlyAce);
2316         }
2317
2318         if (readWriteAce != NULL)
2319         {
2320             FreeACE(readWriteAce);
2321         }
2322
2323         DeleteACLList(acl);
2324     }
2325
2326     return ret;
2327 }
2328
2329 OCStackResult InitACLResource()
2330 {
2331     OCStackResult ret = OC_STACK_ERROR;
2332
2333     uint8_t *data = NULL;
2334     size_t size = 0;
2335     ret = GetSecureVirtualDatabaseFromPS(OIC_JSON_ACL_NAME, &data, &size);
2336     // If database read failed
2337     if (OC_STACK_OK != ret)
2338     {
2339         OIC_LOG(DEBUG, TAG, "ReadSVDataFromPS failed");
2340     }
2341     if (data)
2342     {
2343         // Read ACL resource from PS
2344         gAcl = CBORPayloadToAcl(data, size);
2345         OICFree(data);
2346     }
2347     /*
2348      * If SVR database in persistent storage got corrupted or
2349      * is not available for some reason, a default ACL is created
2350      * which allows user to initiate ACL provisioning again.
2351      */
2352     if (!gAcl)
2353     {
2354         ret = GetDefaultACL(&gAcl);
2355         if (OC_STACK_OK != ret)
2356         {
2357             OIC_LOG(ERROR, TAG, "Failed to create default ACL");
2358         }
2359         // TODO Needs to update persistent storage
2360     }
2361     VERIFY_NOT_NULL(TAG, gAcl, FATAL);
2362
2363     // Instantiate 'oic.sec.acl'
2364     ret = CreateACLResource();
2365
2366 exit:
2367     if (OC_STACK_OK != ret)
2368     {
2369         DeInitACLResource();
2370     }
2371     return ret;
2372 }
2373
2374 OCStackResult DeInitACLResource()
2375 {
2376     OCStackResult ret =  OCDeleteResource(gAclHandle);
2377     gAclHandle = NULL;
2378
2379     if (gAcl)
2380     {
2381         DeleteACLList(gAcl);
2382         gAcl = NULL;
2383     }
2384     return ret;
2385 }
2386
2387 const OicSecAce_t* GetACLResourceData(const OicUuid_t* subjectId, OicSecAce_t **savePtr)
2388 {
2389     OicSecAce_t *ace = NULL;
2390     OicSecAce_t *begin = NULL;
2391
2392     if (NULL == subjectId || NULL == savePtr || NULL == gAcl)
2393     {
2394         return NULL;
2395     }
2396
2397     /*
2398      * savePtr MUST point to NULL if this is the 'first' call to retrieve ACL for
2399      * subjectID.
2400      */
2401     if (NULL == *savePtr)
2402     {
2403         begin = gAcl->aces;
2404     }
2405     else
2406     {
2407         /*
2408          * If this is a 'successive' call, search for location pointed by
2409          * savePtr and assign 'begin' to the next ACL after it in the linked
2410          * list and start searching from there.
2411          */
2412         LL_FOREACH(gAcl->aces, ace)
2413         {
2414             if (ace == *savePtr)
2415             {
2416                 begin = ace->next;
2417             }
2418         }
2419     }
2420
2421     // Find the next ACL corresponding to the 'subjectID' and return it.
2422     LL_FOREACH(begin, ace)
2423     {
2424         if (memcmp(&(ace->subjectuuid), subjectId, sizeof(OicUuid_t)) == 0)
2425         {
2426             *savePtr = ace;
2427             return ace;
2428         }
2429     }
2430
2431     // Cleanup in case no ACL is found
2432     *savePtr = NULL;
2433     return NULL;
2434 }
2435
2436 void printACL(const OicSecAcl_t* acl)
2437 {
2438     OIC_LOG(INFO, TAG, "Print ACL:");
2439
2440     if (NULL == acl)
2441     {
2442         OIC_LOG(INFO, TAG, "Received NULL acl");
2443         return;
2444     }
2445
2446     char *rowner = NULL;
2447     if (OC_STACK_OK == ConvertUuidToStr(&acl->rownerID, &rowner))
2448     {
2449         OIC_LOG_V(INFO, TAG, "rowner id = %s", rowner);
2450     }
2451     else
2452     {
2453         OIC_LOG(ERROR, TAG, "Can't convert rowner uuid to string");
2454     }
2455     OICFree(rowner);
2456
2457     const OicSecAce_t *ace = acl->aces;
2458     int ace_count = 0;
2459     while (ace)
2460     {
2461         ace_count++;
2462         OIC_LOG_V(INFO, TAG, "Print ace[%d]:", ace_count);
2463
2464         OIC_LOG_V(INFO, TAG, "ace permission = %d", ace->permission);
2465
2466         char *subjectuuid = NULL;
2467         if (OC_STACK_OK == ConvertUuidToStr(&ace->subjectuuid, &subjectuuid))
2468         {
2469             OIC_LOG_V(INFO, TAG, "ace subject uuid = %s", subjectuuid);
2470         }
2471         else
2472         {
2473             OIC_LOG(ERROR, TAG, "Can't convert subjectuuid to string");
2474         }
2475         OICFree(subjectuuid);
2476
2477         OicSecRsrc_t *res = ace->resources;
2478         int res_count = 0;
2479         while (res)
2480         {
2481             res_count++;
2482             OIC_LOG_V(INFO, TAG, "Print resources[%d]:", res_count);
2483
2484             OIC_LOG_V(INFO, TAG, "href = %s", res->href);
2485
2486             for (size_t i = 0; i < res->typeLen; i++)
2487             {
2488                 OIC_LOG_V(INFO, TAG, "if[%zu] = %s", i, res->types[i]);
2489             }
2490             for (size_t i = 0; i < res->interfaceLen; i++)
2491             {
2492                 OIC_LOG_V(INFO, TAG, "if[%zu] = %s", i, res->interfaces[i]);
2493             }
2494
2495             res= res->next;
2496         }
2497
2498         OicSecValidity_t *vals = ace->validities;
2499         int vals_count = 0;
2500         while (vals)
2501         {
2502             vals_count++;
2503             OIC_LOG_V(INFO, TAG, "Print validities[%d]:", vals_count);
2504
2505             OIC_LOG_V(INFO, TAG, "period = %s", vals->period);
2506             for (size_t i = 0; i < vals->recurrenceLen; i++)
2507             {
2508                 OIC_LOG_V(INFO, TAG, "recurrences[%zu] = %s", i, vals->recurrences[i]);
2509             }
2510             vals = vals->next;
2511         }
2512
2513         ace = ace->next;
2514     }
2515 }
2516
2517 OCStackResult AppendACL2(const OicSecAcl_t* acl)
2518 {
2519     OCStackResult ret = OC_STACK_ERROR;
2520
2521     if (!acl)
2522     {
2523         return OC_STACK_INVALID_PARAM;
2524     }
2525
2526     // Append the new ACE to existing ACE list
2527     // Can't use LL_APPEND because it sets ace->next to NULL
2528     OicSecAce_t* ace = gAcl->aces;
2529     if (ace)
2530     {
2531         while (ace->next)
2532         {
2533             ace = ace->next;
2534         }
2535         ace->next = acl->aces;
2536     }
2537     else
2538     {
2539         gAcl->aces = acl->aces;
2540     }
2541
2542     printACL(gAcl);
2543
2544     size_t size = 0;
2545     uint8_t *payload = NULL;
2546     ret = AclToCBORPayload(gAcl, &payload, &size);
2547     if (OC_STACK_OK == ret)
2548     {
2549         ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size);
2550         OICFree(payload);
2551     }
2552
2553     return ret;
2554 }
2555
2556 OCStackResult AppendACL(const uint8_t *cborPayload, const size_t size)
2557 {
2558     // Convert CBOR format to ACL data. This will also validate the ACL data received.
2559     OicSecAcl_t* newAcl = CBORPayloadToAcl(cborPayload, size);
2560
2561     return AppendACL2(newAcl);
2562 }
2563
2564 OCStackResult InstallACL(const OicSecAcl_t* acl)
2565 {
2566     OCStackResult ret = OC_STACK_ERROR;
2567
2568     if (!acl)
2569     {
2570         return OC_STACK_INVALID_PARAM;
2571     }
2572
2573     bool isNewAce = true;
2574     OicSecAce_t* existAce = NULL;
2575     OicSecAce_t* newAce = NULL;
2576     OicSecAce_t* tempAce1 = NULL;
2577     OicSecAce_t* tempAce2 = NULL;
2578     OicSecAcl_t* newInstallAcl = NULL;
2579
2580     LL_FOREACH_SAFE(acl->aces, newAce, tempAce1)
2581     {
2582         isNewAce = true;
2583         LL_FOREACH_SAFE(gAcl->aces, existAce, tempAce2)
2584         {
2585             if(IsSameACE(newAce, existAce))
2586             {
2587                 OIC_LOG(DEBUG, TAG, "Duplicated ACE dectected.");
2588                 ret = OC_STACK_DUPLICATE_REQUEST;
2589                 isNewAce = false;
2590             }
2591         }
2592         if(isNewAce)
2593         {
2594             // Append new ACE to existing ACL
2595             OIC_LOG(DEBUG, TAG, "NEW ACE dectected.");
2596
2597             OicSecAce_t* insertAce = DuplicateACE(newAce);
2598             if(insertAce)
2599             {
2600                 OIC_LOG(DEBUG, TAG, "Appending new ACE..");
2601
2602                 if (!newInstallAcl)
2603                 {
2604                     newInstallAcl = (OicSecAcl_t *) OICCalloc(1, sizeof(OicSecAcl_t));
2605                     if (NULL == newInstallAcl)
2606                     {
2607                         OIC_LOG(ERROR, TAG, "Failed to acllocate ACL");
2608                         return OC_STACK_NO_MEMORY;
2609                     }
2610                 }
2611                 LL_PREPEND(newInstallAcl->aces, insertAce);
2612             }
2613             else
2614             {
2615                 OIC_LOG(ERROR, TAG, "Failed to duplicate ACE");
2616                 DeleteACLList(newInstallAcl);
2617                 return OC_STACK_ERROR;
2618             }
2619         }
2620     }
2621
2622     if (newInstallAcl)
2623     {
2624         ret = AppendACL2(newInstallAcl);
2625         if (OC_STACK_OK != ret)
2626         {
2627             OIC_LOG(ERROR, TAG, "Failed to append ACL");
2628         }
2629         OICFree(newInstallAcl);
2630     }
2631
2632     return ret;
2633 }
2634
2635 /**
2636  * This function generates default ACE for security resource in case of owned status.
2637  *
2638  * @return Default ACE for security resource.
2639  */
2640 static OicSecAce_t* GetSecDefaultACE()
2641 {
2642     const int NUM_OF_DOXM_RT = 1;
2643     const int NUM_OF_DOXM_IF  = 1;
2644     const int NUM_OF_PSTAT_RT = 1;
2645     const int NUM_OF_PSTAT_IF = 1;
2646     const char *doxmRt[] = { OIC_RSRC_TYPE_SEC_DOXM };
2647     const char *pstatRt[] = { OIC_RSRC_TYPE_SEC_PSTAT };
2648     const char *doxmIf[] = { OC_RSRVD_INTERFACE_DEFAULT };
2649     const char *pstatIf[] = { OC_RSRVD_INTERFACE_DEFAULT };
2650     OicSecRsrc_t* doxmRsrc = NULL;
2651     OicSecRsrc_t* pstatRsrc = NULL;
2652
2653     //Generate default ACE
2654     OicSecAce_t* newAce = (OicSecAce_t*)OICCalloc(1, sizeof(OicSecAce_t));
2655     VERIFY_NOT_NULL(TAG, newAce, ERROR);
2656
2657     // Subject -- Mandatory
2658     memcpy(newAce->subjectuuid.id, &WILDCARD_SUBJECT_ID, WILDCARD_SUBJECT_ID_LEN);
2659
2660     //Resources -- Mandatory
2661     //Add doxm
2662     doxmRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2663     VERIFY_NOT_NULL(TAG, doxmRsrc, ERROR);
2664     LL_APPEND(newAce->resources, doxmRsrc);
2665     // pstat-href
2666     doxmRsrc->href = OICStrdup(OIC_RSRC_DOXM_URI);
2667     VERIFY_NOT_NULL(TAG, (doxmRsrc->href), ERROR);
2668     // pstat-rt
2669     doxmRsrc->typeLen = NUM_OF_DOXM_RT;
2670     doxmRsrc->types = (char**)OICCalloc(NUM_OF_DOXM_RT, sizeof(char*));
2671     VERIFY_NOT_NULL(TAG, (doxmRsrc->types), ERROR);
2672     for(int i = 0; i < NUM_OF_DOXM_RT; i++)
2673     {
2674         doxmRsrc->types[i] = OICStrdup(doxmRt[i]);
2675         VERIFY_NOT_NULL(TAG, (doxmRsrc->types[i]), ERROR);
2676     }
2677     // pstat-if
2678     doxmRsrc->interfaceLen = NUM_OF_DOXM_IF;
2679     doxmRsrc->interfaces = (char**)OICCalloc(NUM_OF_DOXM_IF, sizeof(char*));
2680     VERIFY_NOT_NULL(TAG, (doxmRsrc->interfaces), ERROR);
2681     for(int i = 0; i < NUM_OF_DOXM_IF; i++)
2682     {
2683         doxmRsrc->interfaces[i] = OICStrdup(doxmIf[i]);
2684         VERIFY_NOT_NULL(TAG, (doxmRsrc->interfaces[i]), ERROR);
2685     }
2686
2687     //Add pstat
2688     pstatRsrc = (OicSecRsrc_t*)OICCalloc(1, sizeof(OicSecRsrc_t));
2689     VERIFY_NOT_NULL(TAG, pstatRsrc, ERROR);
2690     LL_APPEND(newAce->resources, pstatRsrc);
2691     //pstat-href
2692     pstatRsrc->href = OICStrdup(OIC_RSRC_PSTAT_URI);
2693     VERIFY_NOT_NULL(TAG, (pstatRsrc->href), ERROR);
2694     //pstat-rt
2695     pstatRsrc->typeLen = NUM_OF_PSTAT_RT;
2696     pstatRsrc->types = (char**)OICCalloc(NUM_OF_PSTAT_RT, sizeof(char*));
2697     VERIFY_NOT_NULL(TAG, (pstatRsrc->types), ERROR);
2698     for(int i = 0; i < NUM_OF_PSTAT_RT; i++)
2699     {
2700         pstatRsrc->types[i] = OICStrdup(pstatRt[i]);
2701         VERIFY_NOT_NULL(TAG, (pstatRsrc->types[i]), ERROR);
2702     }
2703     // pstat-if
2704     pstatRsrc->interfaceLen = NUM_OF_PSTAT_IF;
2705     pstatRsrc->interfaces = (char**)OICCalloc(NUM_OF_PSTAT_IF, sizeof(char*));
2706     VERIFY_NOT_NULL(TAG, (pstatRsrc->interfaces), ERROR);
2707     for(int i = 0; i < NUM_OF_PSTAT_IF; i++)
2708     {
2709         pstatRsrc->interfaces[i] = OICStrdup(pstatIf[i]);
2710         VERIFY_NOT_NULL(TAG, (pstatRsrc->interfaces[i]), ERROR);
2711     }
2712
2713     // Permissions -- Mandatory
2714     newAce->permission = PERMISSION_READ;
2715
2716     //Period -- Not Mandatory
2717     newAce->validities = NULL;
2718
2719     return newAce;
2720 exit:
2721     FreeACE(newAce);
2722     return NULL;
2723
2724 }
2725
2726 OCStackResult UpdateDefaultSecProvACE()
2727 {
2728     OCStackResult ret = OC_STACK_OK;
2729     OicSecAce_t *ace = NULL;
2730     OicSecAce_t *tempAce = NULL;
2731
2732     if(gAcl)
2733     {
2734         int matchedRsrc = 0;
2735         bool isRemoved = false;
2736
2737         LL_FOREACH_SAFE(gAcl->aces, ace, tempAce)
2738         {
2739             //Find default security resource ACL
2740             if(memcmp(&ace->subjectuuid, &WILDCARD_SUBJECT_ID, sizeof(OicUuid_t)) == 0 &&
2741                 ((PERMISSION_READ | PERMISSION_WRITE) == ace->permission))
2742             {
2743                 matchedRsrc = 0;
2744
2745                 OicSecRsrc_t* rsrc = NULL;
2746                 LL_FOREACH(ace->resources, rsrc)
2747                 {
2748                     if(strncmp(rsrc->href, OIC_RSRC_DOXM_URI,
2749                                strlen(OIC_RSRC_DOXM_URI) + 1) == 0 ||
2750                        strncmp(rsrc->href, OIC_RSRC_CRED_URI,
2751                                strlen(OIC_RSRC_CRED_URI) + 1) == 0 ||
2752                        strncmp(rsrc->href, OIC_RSRC_ACL_URI,
2753                                strlen(OIC_RSRC_ACL_URI) + 1) == 0 ||
2754                        strncmp(rsrc->href, OIC_RSRC_PSTAT_URI,
2755                                strlen(OIC_RSRC_PSTAT_URI) + 1) == 0)
2756                     {
2757                         matchedRsrc++;
2758                     }
2759                 }
2760
2761                 //If default security resource ACL is detected, delete it.
2762                 if(NUMBER_OF_SEC_PROV_RSCS == matchedRsrc)
2763                 {
2764                     LL_DELETE(gAcl->aces, ace);
2765                     FreeACE(ace);
2766                     isRemoved = true;
2767                 }
2768             }
2769         }
2770
2771         if(isRemoved)
2772         {
2773             /*
2774              * Generate new security resource ACE as follows :
2775              *      subject : "*"
2776              *      resources :  '/oic/sec/doxm', '/oic/sec/pstat'
2777              *      permission : READ
2778              */
2779             OicSecAce_t *secDefaultAce = GetSecDefaultACE();
2780             if (secDefaultAce)
2781             {
2782                 LL_APPEND(gAcl->aces, secDefaultAce);
2783
2784                 size_t size = 0;
2785                 uint8_t *payload = NULL;
2786                 if (OC_STACK_OK == AclToCBORPayload(gAcl, &payload, &size))
2787                 {
2788                     if (UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, payload, size) == OC_STACK_OK)
2789                     {
2790                         ret = OC_STACK_OK;
2791                     }
2792                     OICFree(payload);
2793                 }
2794             }
2795         }
2796     }
2797
2798     return ret;
2799 }
2800
2801 OCStackResult SetAclRownerId(const OicUuid_t* newROwner)
2802 {
2803     OCStackResult ret = OC_STACK_ERROR;
2804     uint8_t *cborPayload = NULL;
2805     size_t size = 0;
2806     OicUuid_t prevId = {.id={0}};
2807
2808     if(NULL == newROwner)
2809     {
2810         ret = OC_STACK_INVALID_PARAM;
2811     }
2812     if(NULL == gAcl)
2813     {
2814         ret = OC_STACK_NO_RESOURCE;
2815     }
2816
2817     if(newROwner && gAcl)
2818     {
2819         memcpy(prevId.id, gAcl->rownerID.id, sizeof(prevId.id));
2820         memcpy(gAcl->rownerID.id, newROwner->id, sizeof(newROwner->id));
2821
2822         ret = AclToCBORPayload(gAcl, &cborPayload, &size);
2823         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, ERROR);
2824
2825         ret = UpdateSecureResourceInPS(OIC_JSON_ACL_NAME, cborPayload, size);
2826         VERIFY_SUCCESS(TAG, OC_STACK_OK == ret, ERROR);
2827
2828         OICFree(cborPayload);
2829     }
2830
2831     return ret;
2832
2833 exit:
2834     OICFree(cborPayload);
2835     memcpy(gAcl->rownerID.id, prevId.id, sizeof(prevId.id));
2836     return ret;
2837 }
2838
2839 OCStackResult GetAclRownerId(OicUuid_t *rowneruuid)
2840 {
2841     OCStackResult retVal = OC_STACK_ERROR;
2842     if (gAcl)
2843     {
2844         *rowneruuid = gAcl->rownerID;
2845         retVal = OC_STACK_OK;
2846     }
2847     return retVal;
2848 }