blob: 16f30284fbc4d12d65ee5410a5c82a76ced44cac [file] [log] [blame]
/*
*
* Copyright (c) 2021 Project CHIP Authors
* All rights reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "access/AccessControl.h"
#include "access/examples/ExampleAccessControlDelegate.h"
#include <lib/core/CHIPCore.h>
#include <gtest/gtest.h>
namespace chip {
namespace Access {
using namespace chip;
using namespace chip::Access;
using Entry = AccessControl::Entry;
using EntryIterator = AccessControl::EntryIterator;
using Target = Entry::Target;
AccessControl accessControl;
constexpr ClusterId kOnOffCluster = 0x0000'0006;
constexpr ClusterId kLevelControlCluster = 0x0000'0008;
constexpr ClusterId kAccessControlCluster = 0x0000'001F;
constexpr ClusterId kColorControlCluster = 0x0000'0300;
constexpr NodeId kPaseVerifier0 = NodeIdFromPAKEKeyId(0x0000);
constexpr NodeId kPaseVerifier1 = NodeIdFromPAKEKeyId(0x0001);
constexpr NodeId kPaseVerifier3 = NodeIdFromPAKEKeyId(0x0003);
constexpr NodeId kOperationalNodeId0 = 0x0123456789ABCDEF;
constexpr NodeId kOperationalNodeId1 = 0x1234567812345678;
constexpr NodeId kOperationalNodeId2 = 0x1122334455667788;
constexpr NodeId kOperationalNodeId3 = 0x1111111111111111;
constexpr NodeId kOperationalNodeId4 = 0x2222222222222222;
constexpr NodeId kOperationalNodeId5 = 0x3333333333333333;
constexpr CASEAuthTag kCASEAuthTag0 = 0x0001'0001;
constexpr CASEAuthTag kCASEAuthTag1 = 0x0002'0001;
constexpr CASEAuthTag kCASEAuthTag2 = 0xABCD'0002;
constexpr CASEAuthTag kCASEAuthTag3 = 0xABCD'0008;
constexpr CASEAuthTag kCASEAuthTag4 = 0xABCD'ABCD;
constexpr NodeId kCASEAuthTagAsNodeId0 = NodeIdFromCASEAuthTag(kCASEAuthTag0);
constexpr NodeId kCASEAuthTagAsNodeId1 = NodeIdFromCASEAuthTag(kCASEAuthTag1);
constexpr NodeId kCASEAuthTagAsNodeId2 = NodeIdFromCASEAuthTag(kCASEAuthTag2);
constexpr NodeId kCASEAuthTagAsNodeId3 = NodeIdFromCASEAuthTag(kCASEAuthTag3);
constexpr NodeId kCASEAuthTagAsNodeId4 = NodeIdFromCASEAuthTag(kCASEAuthTag4);
constexpr NodeId kGroup2 = NodeIdFromGroupId(0x0002);
constexpr NodeId kGroup4 = NodeIdFromGroupId(0x0004);
constexpr NodeId kGroup6 = NodeIdFromGroupId(0x0006);
constexpr NodeId kGroup8 = NodeIdFromGroupId(0x0008);
constexpr AuthMode authModes[] = { AuthMode::kCase, AuthMode::kGroup };
constexpr FabricIndex fabricIndexes[] = { 1, 2, 3 };
constexpr Privilege privileges[] = { Privilege::kView, Privilege::kProxyView, Privilege::kOperate, Privilege::kManage,
Privilege::kAdminister };
constexpr NodeId subjects[][3] = { {
kOperationalNodeId0,
kCASEAuthTagAsNodeId1,
kCASEAuthTagAsNodeId2,
},
{
kGroup4,
kGroup6,
kGroup8,
} };
constexpr Target targets[] = {
{ .flags = Target::kCluster, .cluster = kOnOffCluster },
{ .flags = Target::kEndpoint, .endpoint = 3 },
{ .flags = Target::kCluster | Target::kEndpoint, .cluster = kLevelControlCluster, .endpoint = 5 },
};
constexpr FabricIndex invalidFabricIndexes[] = { kUndefinedFabricIndex };
// clang-format off
constexpr NodeId validCaseSubjects[] = {
0x0000'0000'0000'0001, // min operational
0x0000'0000'0000'0002,
0x0123'4567'89AB'CDEF,
0xFFFF'FFEF'FFFF'FFFE,
0xFFFF'FFEF'FFFF'FFFF, // max operational
NodeIdFromCASEAuthTag(0x0000'0001),
NodeIdFromCASEAuthTag(0x0000'0002),
NodeIdFromCASEAuthTag(0x0000'FFFE),
NodeIdFromCASEAuthTag(0x0000'FFFF),
NodeIdFromCASEAuthTag(0x0001'0001),
NodeIdFromCASEAuthTag(0x0001'0002),
NodeIdFromCASEAuthTag(0x0001'FFFE),
NodeIdFromCASEAuthTag(0x0001'FFFF),
NodeIdFromCASEAuthTag(0xFFFE'0001),
NodeIdFromCASEAuthTag(0xFFFE'0002),
NodeIdFromCASEAuthTag(0xFFFE'FFFE),
NodeIdFromCASEAuthTag(0xFFFE'FFFF),
NodeIdFromCASEAuthTag(0xFFFF'0001),
NodeIdFromCASEAuthTag(0xFFFF'0002),
NodeIdFromCASEAuthTag(0xFFFF'FFFE),
NodeIdFromCASEAuthTag(0xFFFF'FFFF),
};
// clang-format on
// clang-format off
constexpr NodeId validGroupSubjects[] = {
NodeIdFromGroupId(0x0001), // start of fabric-scoped
NodeIdFromGroupId(0x0002),
NodeIdFromGroupId(0x7FFE),
NodeIdFromGroupId(0x7FFF), // end of fabric-scoped
NodeIdFromGroupId(0x8000), // start of universal
NodeIdFromGroupId(0x8001),
NodeIdFromGroupId(0xFFFB),
NodeIdFromGroupId(0xFFFC), // end of universal
NodeIdFromGroupId(0xFFFD), // all proxies
NodeIdFromGroupId(0xFFFE), // all non sleepy
NodeIdFromGroupId(0xFFFF), // all nodes
};
// clang-format on
// clang-format off
constexpr NodeId validPaseSubjects[] = {
NodeIdFromPAKEKeyId(0x0000), // start
NodeIdFromPAKEKeyId(0x0001),
NodeIdFromPAKEKeyId(0xFFFE),
NodeIdFromPAKEKeyId(0xFFFF), // end
};
// clang-format on
// clang-format off
constexpr NodeId invalidSubjects[] = {
0x0000'0000'0000'0000, // unspecified
0xFFFF'FFF0'0000'0000, // start reserved
0xFFFF'FFF0'0000'0001,
0xFFFF'FFF0'FFFF'FFFE,
0xFFFF'FFF0'FFFF'FFFF, // end reserved
0xFFFF'FFF1'0000'0000, // start reserved
0xFFFF'FFF1'0000'0001,
0xFFFF'FFF1'FFFF'FFFE,
0xFFFF'FFF1'FFFF'FFFF, // end reserved
0xFFFF'FFF2'0000'0000, // start reserved
0xFFFF'FFF2'0000'0001,
0xFFFF'FFF2'FFFF'FFFE,
0xFFFF'FFF2'FFFF'FFFF, // end reserved
0xFFFF'FFF3'0000'0000, // start reserved
0xFFFF'FFF3'0000'0001,
0xFFFF'FFF3'FFFF'FFFE,
0xFFFF'FFF3'FFFF'FFFF, // end reserved
0xFFFF'FFF4'0000'0000, // start reserved
0xFFFF'FFF4'0000'0001,
0xFFFF'FFF4'FFFF'FFFE,
0xFFFF'FFF4'FFFF'FFFF, // end reserved
0xFFFF'FFF5'0000'0000, // start reserved
0xFFFF'FFF5'0000'0001,
0xFFFF'FFF5'FFFF'FFFE,
0xFFFF'FFF5'FFFF'FFFF, // end reserved
0xFFFF'FFF6'0000'0000, // start reserved
0xFFFF'FFF6'0000'0001,
0xFFFF'FFF6'FFFF'FFFE,
0xFFFF'FFF6'FFFF'FFFF, // end reserved
0xFFFF'FFF7'0000'0000, // start reserved
0xFFFF'FFF7'0000'0001,
0xFFFF'FFF7'FFFF'FFFE,
0xFFFF'FFF7'FFFF'FFFF, // end reserved
0xFFFF'FFF8'0000'0000, // start reserved
0xFFFF'FFF8'0000'0001,
0xFFFF'FFF8'FFFF'FFFE,
0xFFFF'FFF8'FFFF'FFFF, // end reserved
0xFFFF'FFF9'0000'0000, // start reserved
0xFFFF'FFF9'0000'0001,
0xFFFF'FFF9'FFFF'FFFE,
0xFFFF'FFF9'FFFF'FFFF, // end reserved
0xFFFF'FFFA'0000'0000, // start reserved
0xFFFF'FFFA'0000'0001,
0xFFFF'FFFA'FFFF'FFFE,
0xFFFF'FFFA'FFFF'FFFF, // end reserved
0xFFFF'FFFB'0001'0000, // PASE with unused bits used
0xFFFF'FFFB'0001'0001, // PASE with unused bits used
0xFFFF'FFFB'0001'FFFE, // PASE with unused bits used
0xFFFF'FFFB'0001'FFFF, // PASE with unused bits used
0xFFFF'FFFB'FFFE'0000, // PASE with unused bits used
0xFFFF'FFFB'FFFE'0001, // PASE with unused bits used
0xFFFF'FFFB'FFFE'FFFE, // PASE with unused bits used
0xFFFF'FFFB'FFFE'FFFF, // PASE with unused bits used
0xFFFF'FFFB'FFFF'0000, // PASE with unused bits used
0xFFFF'FFFB'FFFF'0001, // PASE with unused bits used
0xFFFF'FFFB'FFFF'FFFE, // PASE with unused bits used
0xFFFF'FFFB'FFFF'FFFF, // PASE with unused bits used
0xFFFF'FFFC'0000'0000, // start reserved
0xFFFF'FFFC'0000'0001,
0xFFFF'FFFC'FFFF'FFFE,
0xFFFF'FFFC'FFFF'FFFF, // end reserved
0xFFFF'FFFD'0000'0000, // CAT with version 0
0xFFFF'FFFD'0001'0000, // CAT with version 0
0xFFFF'FFFD'FFFE'0000, // CAT with version 0
0xFFFF'FFFD'FFFF'0000, // CAT with version 0
0xFFFF'FFFE'0000'0000, // start temporary local
0xFFFF'FFFE'0000'0001,
0xFFFF'FFFE'FFFF'FFFE,
0xFFFF'FFFE'FFFF'FFFF, // end temporary local (used for placeholder)
0xFFFF'FFFF'0000'0000, // start reserved
0xFFFF'FFFF'0000'0001,
0xFFFF'FFFF'FFFE'FFFE,
0xFFFF'FFFF'FFFE'FFFF, // end reserved
0xFFFF'FFFF'FFFF'0000, // group 0
};
// clang-format on
// clang-format off
constexpr ClusterId validClusters[] = {
0x0000'0000, // start std
0x0000'0001,
0x0000'7FFE,
0x0000'7FFF, // end std
0x0001'FC00, // start MS
0x0001'FC01,
0x0001'FFFD,
0x0001'FFFE, // end MS
0xFFF1'FC00, // start MS
0xFFF1'FC01,
0xFFF1'FFFD,
0xFFF1'FFFE, // end MS
0xFFF4'FC00, // start MS
0xFFF4'FC01,
0xFFF4'FFFD,
0xFFF4'FFFE, // end MS
};
// clang-format on
// clang-format off
constexpr ClusterId invalidClusters[] = {
0x0000'8000, // start unused
0x0000'8001,
0x0000'FBFE,
0x0000'FBFF, // end unused
0x0000'FC00, // start MS
0x0000'FC01,
0x0000'FFFD,
0x0000'FFFE, // end MS
0x0000'FFFF, // wildcard
0x0001'0000, // start std
0x0001'0001,
0x0001'7FFE,
0x0001'7FFF, // end std
0x0001'8000, // start unused
0x0001'8001,
0x0001'FBFE,
0x0001'FBFF, // end unused
0x0001'FFFF, // wildcard
0xFFF4'0000, // start std
0xFFF4'0001,
0xFFF4'7FFE,
0xFFF4'7FFF, // end std
0xFFF4'8000, // start unused
0xFFF4'8001,
0xFFF4'FBFE,
0xFFF4'FBFF, // end unused
0xFFF4'FFFF, // wildcard
0xFFFD'0000, // start std
0xFFFD'0001,
0xFFFD'7FFE,
0xFFFD'7FFF, // end std
0xFFFD'8000, // start unused
0xFFFD'8001,
0xFFFD'FBFE,
0xFFFD'FBFF, // end unused
0xFFFD'FC00, // start MS
0xFFFD'FC01,
0xFFFD'FFFD,
0xFFFD'FFFE, // end MS
0xFFFD'FFFF, // wildcard
0xFFFE'0000, // start std
0xFFFE'0001,
0xFFFE'7FFE,
0xFFFE'7FFF, // end std
0xFFFE'8000, // start unused
0xFFFE'8001,
0xFFFE'FBFE,
0xFFFE'FBFF, // end unused
0xFFFE'FC00, // start MS
0xFFFE'FC01,
0xFFFE'FFFD,
0xFFFE'FFFE, // end MS
0xFFFE'FFFF, // wildcard
0xFFFF'0000, // start std
0xFFFF'0001,
0xFFFF'7FFE,
0xFFFF'7FFF, // end std
0xFFFF'8000, // start unused
0xFFFF'8001,
0xFFFF'FBFE,
0xFFFF'FBFF, // end unused
0xFFFF'FC00, // start MS
0xFFFF'FC01,
0xFFFF'FFFD,
0xFFFF'FFFE, // end MS
0xFFFF'FFFF, // wildcard
};
// clang-format on
// clang-format off
constexpr EndpointId validEndpoints[] = {
0x0000, // start
0x0001,
0xFFFD,
0xFFFE, // end
};
// clang-format on
// clang-format off
constexpr EndpointId invalidEndpoints[] = {
kInvalidEndpointId
};
// clang-format on
// clang-format off
constexpr DeviceTypeId validDeviceTypes[] = {
0x0000'0000, // start
0x0000'0001,
0x0000'BFFE,
0x0000'BFFF, // end
0x0001'0000, // start
0x0001'0001,
0x0001'BFFE,
0x0001'BFFF, // end
0xFFFD'0000, // start
0xFFFD'0001,
0xFFFD'BFFE,
0xFFFD'BFFF, // end
0xFFFE'0000, // start
0xFFFE'0001,
0xFFFE'BFFE,
0xFFFE'BFFF, // end
};
// clang-format on
// clang-format off
constexpr DeviceTypeId invalidDeviceTypes[] = {
0x0000'C000, // start unused
0x0000'C001,
0x0000'FFFD,
0x0000'FFFE, // end unused
0x0000'FFFF, // wildcard
0x0001'C000, // start unused
0x0001'C001,
0x0001'FFFD,
0x0001'FFFE, // end unused
0x0001'FFFF, // wildcard
0xFFFE'C000, // start unused
0xFFFE'C001,
0xFFFE'FFFD,
0xFFFE'FFFE, // end unused
0xFFFE'FFFF, // wildcard
0xFFFF'0000, // start used
0xFFFF'0001,
0xFFFF'BFFE,
0xFFFF'BFFF, // end used
0xFFFF'C000, // start unused
0xFFFF'C001,
0xFFFF'FFFD,
0xFFFF'FFFE, // end unused
0xFFFF'FFFF, // wildcard
};
// clang-format on
class DeviceTypeResolver : public AccessControl::DeviceTypeResolver
{
public:
bool IsDeviceTypeOnEndpoint(DeviceTypeId deviceType, EndpointId endpoint) override { return false; }
} testDeviceTypeResolver;
// For testing, supports one subject and target, allows any value (valid or invalid)
class TestEntryDelegate : public Entry::Delegate
{
public:
void Release() override {}
CHIP_ERROR GetAuthMode(AuthMode & authMode) const override
{
authMode = mAuthMode;
return CHIP_NO_ERROR;
}
CHIP_ERROR GetFabricIndex(FabricIndex & fabricIndex) const override
{
fabricIndex = mFabricIndex;
return CHIP_NO_ERROR;
}
CHIP_ERROR GetPrivilege(Privilege & privilege) const override
{
privilege = mPrivilege;
return CHIP_NO_ERROR;
}
CHIP_ERROR SetAuthMode(AuthMode authMode) override
{
mAuthMode = authMode;
return CHIP_NO_ERROR;
}
CHIP_ERROR SetFabricIndex(FabricIndex fabricIndex) override
{
mFabricIndex = fabricIndex;
return CHIP_NO_ERROR;
}
CHIP_ERROR SetPrivilege(Privilege privilege) override
{
mPrivilege = privilege;
return CHIP_NO_ERROR;
}
CHIP_ERROR GetSubjectCount(size_t & count) const override
{
count = mSubjectCount;
return CHIP_NO_ERROR;
}
CHIP_ERROR GetSubject(size_t index, NodeId & subject) const override
{
VerifyOrDie(index < mSubjectCount);
subject = mSubject;
return CHIP_NO_ERROR;
}
CHIP_ERROR SetSubject(size_t index, NodeId subject) override
{
VerifyOrDie(index < mSubjectCount);
mSubject = subject;
return CHIP_NO_ERROR;
}
CHIP_ERROR AddSubject(size_t * index, NodeId subject) override
{
VerifyOrDie(mSubjectCount == 0);
mSubjectCount = 1;
mSubject = subject;
return CHIP_NO_ERROR;
}
CHIP_ERROR RemoveSubject(size_t index) override
{
VerifyOrDie(mSubjectCount == 1);
mSubjectCount = 0;
return CHIP_NO_ERROR;
}
CHIP_ERROR GetTargetCount(size_t & count) const override
{
count = mTargetCount;
return CHIP_NO_ERROR;
}
CHIP_ERROR GetTarget(size_t index, Target & target) const override
{
VerifyOrDie(index < mTargetCount);
target = mTarget;
return CHIP_NO_ERROR;
}
CHIP_ERROR SetTarget(size_t index, const Target & target) override
{
VerifyOrDie(index < mTargetCount);
mTarget = target;
return CHIP_NO_ERROR;
}
CHIP_ERROR AddTarget(size_t * index, const Target & target) override
{
VerifyOrDie(mTargetCount == 0);
mTargetCount = 1;
mTarget = target;
return CHIP_NO_ERROR;
}
CHIP_ERROR RemoveTarget(size_t index) override
{
VerifyOrDie(mTargetCount == 1);
mTargetCount = 0;
return CHIP_NO_ERROR;
}
FabricIndex mFabricIndex = 1;
Privilege mPrivilege = Privilege::kView;
AuthMode mAuthMode = AuthMode::kCase;
NodeId mSubject = kOperationalNodeId0;
Target mTarget = { .flags = Target::kCluster, .cluster = kOnOffCluster };
size_t mSubjectCount = 1;
size_t mTargetCount = 1;
};
bool operator==(const Target & a, const Target & b)
{
if (a.flags != b.flags)
return false;
if ((a.flags & Target::kCluster) && a.cluster != b.cluster)
return false;
if ((a.flags & Target::kEndpoint) && a.endpoint != b.endpoint)
return false;
if ((a.flags & Target::kDeviceType) && a.deviceType != b.deviceType)
return false;
return true;
}
bool operator!=(const Target & a, const Target & b)
{
return !(a == b);
}
struct EntryData
{
static constexpr int kMaxSubjects = 3;
static constexpr int kMaxTargets = 3;
FabricIndex fabricIndex = kUndefinedFabricIndex;
Privilege privilege = Privilege::kView;
AuthMode authMode = AuthMode::kNone;
NodeId subjects[kMaxSubjects] = { 0 };
Target targets[kMaxTargets] = { { 0 } };
void Clear() { *this = EntryData(); }
bool IsEmpty() const { return authMode == AuthMode::kNone; }
size_t GetSubjectCount() const
{
size_t count = 0;
for (auto & subject : subjects)
{
if (subject == kUndefinedNodeId)
{
break;
}
count++;
}
return count;
}
void AddSubject(size_t * index, NodeId subject)
{
size_t count = GetSubjectCount();
if (count < kMaxSubjects)
{
subjects[count] = subject;
if (index)
{
*index = count;
}
}
}
void RemoveSubject(size_t index)
{
size_t count = GetSubjectCount();
if (index < count)
{
while (++index < kMaxSubjects)
{
subjects[index - 1] = subjects[index];
}
subjects[kMaxSubjects - 1] = { 0 };
}
}
size_t GetTargetCount() const
{
size_t count = 0;
for (auto & target : targets)
{
if (target.flags == 0)
{
break;
}
count++;
}
return count;
}
void AddTarget(size_t * index, const Target & target)
{
size_t count = GetTargetCount();
if (count < kMaxTargets)
{
targets[count] = target;
if (index)
{
*index = count;
}
}
}
void RemoveTarget(size_t index)
{
size_t count = GetTargetCount();
if (index < count)
{
while (++index < kMaxTargets)
{
targets[index - 1] = targets[index];
}
targets[kMaxTargets - 1] = { 0 };
}
}
};
CHIP_ERROR CompareEntry(const Entry & entry, const EntryData & entryData)
{
AuthMode authMode = AuthMode::kNone;
ReturnErrorOnFailure(entry.GetAuthMode(authMode));
ReturnErrorCodeIf(authMode != entryData.authMode, CHIP_ERROR_INCORRECT_STATE);
FabricIndex fabricIndex = kUndefinedFabricIndex;
ReturnErrorOnFailure(entry.GetFabricIndex(fabricIndex));
ReturnErrorCodeIf(fabricIndex != entryData.fabricIndex, CHIP_ERROR_INCORRECT_STATE);
Privilege privilege = Privilege::kView;
ReturnErrorOnFailure(entry.GetPrivilege(privilege));
ReturnErrorCodeIf(privilege != entryData.privilege, CHIP_ERROR_INCORRECT_STATE);
size_t subjectCount = 0;
ReturnErrorOnFailure(entry.GetSubjectCount(subjectCount));
ReturnErrorCodeIf(subjectCount != entryData.GetSubjectCount(), CHIP_ERROR_INCORRECT_STATE);
for (size_t i = 0; i < subjectCount; ++i)
{
NodeId subject = kUndefinedNodeId;
ReturnErrorOnFailure(entry.GetSubject(i, subject));
ReturnErrorCodeIf(subject != entryData.subjects[i], CHIP_ERROR_INCORRECT_STATE);
}
size_t targetCount = 0;
ReturnErrorOnFailure(entry.GetTargetCount(targetCount));
ReturnErrorCodeIf(targetCount != entryData.GetTargetCount(), CHIP_ERROR_INCORRECT_STATE);
for (size_t i = 0; i < targetCount; ++i)
{
Target target;
ReturnErrorOnFailure(entry.GetTarget(i, target));
ReturnErrorCodeIf(target != entryData.targets[i], CHIP_ERROR_INCORRECT_STATE);
}
return CHIP_NO_ERROR;
}
CHIP_ERROR LoadEntry(Entry & entry, const EntryData & entryData)
{
ReturnErrorOnFailure(entry.SetAuthMode(entryData.authMode));
ReturnErrorOnFailure(entry.SetFabricIndex(entryData.fabricIndex));
ReturnErrorOnFailure(entry.SetPrivilege(entryData.privilege));
for (size_t i = 0; i < entryData.GetSubjectCount(); ++i)
{
ReturnErrorOnFailure(entry.AddSubject(nullptr, entryData.subjects[i]));
}
for (size_t i = 0; i < entryData.GetTargetCount(); ++i)
{
ReturnErrorOnFailure(entry.AddTarget(nullptr, entryData.targets[i]));
}
return CHIP_NO_ERROR;
}
CHIP_ERROR ClearAccessControl(AccessControl & ac)
{
CHIP_ERROR err;
do
{
err = accessControl.DeleteEntry(0);
} while (err == CHIP_NO_ERROR);
return CHIP_NO_ERROR;
}
CHIP_ERROR CompareAccessControl(AccessControl & ac, const EntryData * entryData, size_t count)
{
Entry entry;
for (size_t i = 0; i < count; ++i, ++entryData)
{
ReturnErrorOnFailure(ac.ReadEntry(i, entry));
ReturnErrorOnFailure(CompareEntry(entry, *entryData));
}
ReturnErrorCodeIf(ac.ReadEntry(count, entry) == CHIP_NO_ERROR, CHIP_ERROR_INCORRECT_STATE);
return CHIP_NO_ERROR;
}
CHIP_ERROR LoadAccessControl(AccessControl & ac, const EntryData * entryData, size_t count)
{
Entry entry;
for (size_t i = 0; i < count; ++i, ++entryData)
{
ReturnErrorOnFailure(ac.PrepareEntry(entry));
ReturnErrorOnFailure(LoadEntry(entry, *entryData));
ReturnErrorOnFailure(ac.CreateEntry(nullptr, entry));
}
return CHIP_NO_ERROR;
}
constexpr size_t kNumFabric1EntriesInEntryData1 = 4;
constexpr size_t kNumFabric2EntriesInEntryData1 = 5;
constexpr EntryData entryData1[] = {
{
.fabricIndex = 1,
.privilege = Privilege::kAdminister,
.authMode = AuthMode::kCase,
.subjects = { kOperationalNodeId3 },
},
{
.fabricIndex = 1,
.privilege = Privilege::kView,
.authMode = AuthMode::kCase,
},
{
.fabricIndex = 2,
.privilege = Privilege::kAdminister,
.authMode = AuthMode::kCase,
.subjects = { kOperationalNodeId4 },
},
{
.fabricIndex = 1,
.privilege = Privilege::kOperate,
.authMode = AuthMode::kCase,
.targets = { { .flags = Target::kCluster, .cluster = kOnOffCluster } },
},
{
.fabricIndex = 2,
.privilege = Privilege::kManage,
.authMode = AuthMode::kCase,
.subjects = { kOperationalNodeId5 },
.targets = { { .flags = Target::kCluster | Target::kEndpoint, .cluster = kOnOffCluster, .endpoint = 2 } },
},
{
.fabricIndex = 2,
.privilege = Privilege::kProxyView,
.authMode = AuthMode::kGroup,
.subjects = { kGroup2 },
.targets = { { .flags = Target::kCluster | Target::kEndpoint, .cluster = kLevelControlCluster, .endpoint = 1 },
{ .flags = Target::kCluster, .cluster = kOnOffCluster },
{ .flags = Target::kEndpoint, .endpoint = 2 } },
},
{
.fabricIndex = 1,
.privilege = Privilege::kAdminister,
.authMode = AuthMode::kCase,
.subjects = { kCASEAuthTagAsNodeId0 },
},
{
.fabricIndex = 2,
.privilege = Privilege::kManage,
.authMode = AuthMode::kCase,
.subjects = { kCASEAuthTagAsNodeId3, kCASEAuthTagAsNodeId1 },
.targets = { { .flags = Target::kCluster, .cluster = kOnOffCluster } },
},
{
.fabricIndex = 2,
.privilege = Privilege::kOperate,
.authMode = AuthMode::kCase,
.subjects = { kCASEAuthTagAsNodeId4, kCASEAuthTagAsNodeId1 },
.targets = { { .flags = Target::kCluster, .cluster = kLevelControlCluster } },
},
};
constexpr size_t entryData1Count = ArraySize(entryData1);
static_assert(entryData1Count == (kNumFabric1EntriesInEntryData1 + kNumFabric2EntriesInEntryData1),
"Must maintain both fabric counts for some tests");
struct CheckData
{
SubjectDescriptor subjectDescriptor;
RequestPath requestPath;
Privilege privilege;
bool allow;
};
constexpr CheckData checkData1[] = {
// Checks for implicit PASE
{ .subjectDescriptor = { .fabricIndex = 0, .authMode = AuthMode::kPase, .subject = kPaseVerifier0 },
.requestPath = { .cluster = 1, .endpoint = 2 },
.privilege = Privilege::kAdminister,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kPase, .subject = kPaseVerifier0 },
.requestPath = { .cluster = 3, .endpoint = 4 },
.privilege = Privilege::kAdminister,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kPase, .subject = kPaseVerifier0 },
.requestPath = { .cluster = 5, .endpoint = 6 },
.privilege = Privilege::kAdminister,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kPase, .subject = kPaseVerifier1 },
.requestPath = { .cluster = 5, .endpoint = 6 },
.privilege = Privilege::kAdminister,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 3, .authMode = AuthMode::kPase, .subject = kPaseVerifier3 },
.requestPath = { .cluster = 7, .endpoint = 8 },
.privilege = Privilege::kAdminister,
.allow = true },
// Checks for entry 0
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
.requestPath = { .cluster = kAccessControlCluster, .endpoint = 0 },
.privilege = Privilege::kAdminister,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
.requestPath = { .cluster = 1, .endpoint = 2 },
.privilege = Privilege::kManage,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
.requestPath = { .cluster = 3, .endpoint = 4 },
.privilege = Privilege::kOperate,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
.requestPath = { .cluster = 5, .endpoint = 6 },
.privilege = Privilege::kView,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
.requestPath = { .cluster = 7, .endpoint = 8 },
.privilege = Privilege::kProxyView,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
.requestPath = { .cluster = 1, .endpoint = 2 },
.privilege = Privilege::kAdminister,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = kOperationalNodeId3 },
.requestPath = { .cluster = 1, .endpoint = 2 },
.privilege = Privilege::kAdminister,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
.requestPath = { .cluster = 1, .endpoint = 2 },
.privilege = Privilege::kAdminister,
.allow = false },
// Checks for entry 1
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
.requestPath = { .cluster = 11, .endpoint = 13 },
.privilege = Privilege::kView,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
.requestPath = { .cluster = 11, .endpoint = 13 },
.privilege = Privilege::kOperate,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
.requestPath = { .cluster = 11, .endpoint = 13 },
.privilege = Privilege::kView,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = kOperationalNodeId1 },
.requestPath = { .cluster = 11, .endpoint = 13 },
.privilege = Privilege::kView,
.allow = false },
// Checks for entry 2
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
.requestPath = { .cluster = kAccessControlCluster, .endpoint = 0 },
.privilege = Privilege::kAdminister,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
.requestPath = { .cluster = 1, .endpoint = 2 },
.privilege = Privilege::kManage,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
.requestPath = { .cluster = 3, .endpoint = 4 },
.privilege = Privilege::kOperate,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
.requestPath = { .cluster = 5, .endpoint = 6 },
.privilege = Privilege::kView,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
.requestPath = { .cluster = 7, .endpoint = 8 },
.privilege = Privilege::kProxyView,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
.requestPath = { .cluster = 1, .endpoint = 2 },
.privilege = Privilege::kAdminister,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kOperationalNodeId4 },
.requestPath = { .cluster = 1, .endpoint = 2 },
.privilege = Privilege::kAdminister,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
.requestPath = { .cluster = 1, .endpoint = 2 },
.privilege = Privilege::kAdminister,
.allow = false },
// Checks for entry 3
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 11 },
.privilege = Privilege::kOperate,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId2 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 13 },
.privilege = Privilege::kOperate,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 11 },
.privilege = Privilege::kOperate,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
.requestPath = { .cluster = 123, .endpoint = 11 },
.privilege = Privilege::kOperate,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 11 },
.privilege = Privilege::kManage,
.allow = false },
// Checks for entry 4
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 2 },
.privilege = Privilege::kManage,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 2 },
.privilege = Privilege::kManage,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kOperationalNodeId5 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 2 },
.privilege = Privilege::kManage,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 2 },
.privilege = Privilege::kManage,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 2 },
.privilege = Privilege::kManage,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 1 },
.privilege = Privilege::kManage,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 2 },
.privilege = Privilege::kAdminister,
.allow = false },
// Checks for entry 5
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 1 },
.privilege = Privilege::kProxyView,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 3 },
.privilege = Privilege::kProxyView,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
.requestPath = { .cluster = kColorControlCluster, .endpoint = 2 },
.privilege = Privilege::kProxyView,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = kGroup2 },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 1 },
.privilege = Privilege::kProxyView,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kGroup2 },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 1 },
.privilege = Privilege::kProxyView,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup4 },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 1 },
.privilege = Privilege::kProxyView,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
.requestPath = { .cluster = kColorControlCluster, .endpoint = 1 },
.privilege = Privilege::kProxyView,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
.requestPath = { .cluster = kColorControlCluster, .endpoint = 1 },
.privilege = Privilege::kProxyView,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 3 },
.privilege = Privilege::kProxyView,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 1 },
.privilege = Privilege::kOperate,
.allow = false },
// Checks for entry 6
{ .subjectDescriptor = { .fabricIndex = 2,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag0, kUndefinedCAT, kUndefinedCAT } },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 1 },
.privilege = Privilege::kOperate,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 1,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag0, kUndefinedCAT, kUndefinedCAT } },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 1 },
.privilege = Privilege::kOperate,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 1,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag1, kUndefinedCAT, kUndefinedCAT } },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 1 },
.privilege = Privilege::kOperate,
.allow = false },
// Checks for entry 7
{ .subjectDescriptor = { .fabricIndex = 2,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag0, kUndefinedCAT, kUndefinedCAT } },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 1 },
.privilege = Privilege::kOperate,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag0, kCASEAuthTag2, kUndefinedCAT } },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 1 },
.privilege = Privilege::kOperate,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag0, kCASEAuthTag3, kUndefinedCAT } },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 1 },
.privilege = Privilege::kOperate,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag0, kCASEAuthTag4, kUndefinedCAT } },
.requestPath = { .cluster = kOnOffCluster, .endpoint = 1 },
.privilege = Privilege::kManage,
.allow = true },
// Checks for entry 8
{ .subjectDescriptor = { .fabricIndex = 2,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag0, kCASEAuthTag3, kUndefinedCAT } },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 1 },
.privilege = Privilege::kOperate,
.allow = false },
{ .subjectDescriptor = { .fabricIndex = 2,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag0, kCASEAuthTag4, kUndefinedCAT } },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 2 },
.privilege = Privilege::kOperate,
.allow = true },
{ .subjectDescriptor = { .fabricIndex = 2,
.authMode = AuthMode::kCase,
.cats = { kCASEAuthTag1, kUndefinedCAT, kUndefinedCAT } },
.requestPath = { .cluster = kLevelControlCluster, .endpoint = 2 },
.privilege = Privilege::kOperate,
.allow = true },
};
class TestAccessControl : public ::testing::Test
{
public: // protected
void SetUp() override { ASSERT_EQ(ClearAccessControl(accessControl), CHIP_NO_ERROR); }
static void SetUpTestSuite()
{
AccessControl::Delegate * delegate = Examples::GetAccessControlDelegate();
SetAccessControl(accessControl);
VerifyOrDie(GetAccessControl().Init(delegate, testDeviceTypeResolver) == CHIP_NO_ERROR);
}
static void TearDownTestSuite()
{
GetAccessControl().Finish();
ResetAccessControlToDefault();
}
};
TEST_F(TestAccessControl, MetaTest)
{
EXPECT_EQ(LoadAccessControl(accessControl, entryData1, entryData1Count), CHIP_NO_ERROR);
EXPECT_EQ(CompareAccessControl(accessControl, entryData1, entryData1Count), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.DeleteEntry(3), CHIP_NO_ERROR);
EXPECT_NE(CompareAccessControl(accessControl, entryData1, entryData1Count), CHIP_NO_ERROR);
}
TEST_F(TestAccessControl, TestAclValidateAuthModeSubject)
{
TestEntryDelegate delegate; // outlive entry
Entry entry;
// Use prepared entry for valid cases
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetPrivilege(Privilege::kView), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { .flags = Target::kCluster, .cluster = kOnOffCluster }), CHIP_NO_ERROR);
// Each case tries to update the first entry, then add a second entry, then unconditionally delete it
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
// CASE and group may have empty subjects list
{
EXPECT_EQ(entry.RemoveSubject(0), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
}
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
for (auto subject : validCaseSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
for (auto subject : validGroupSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
// Use test entry for invalid cases (to ensure it can hold invalid data)
entry.SetDelegate(delegate);
// Operational PASE not supported
EXPECT_EQ(entry.SetAuthMode(AuthMode::kPase), CHIP_NO_ERROR);
for (auto subject : validPaseSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
for (auto subject : validGroupSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto subject : validPaseSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto subject : invalidSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
for (auto subject : validCaseSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto subject : validPaseSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto subject : invalidSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
EXPECT_EQ(entry.SetAuthMode(AuthMode::kPase), CHIP_NO_ERROR);
for (auto subject : validCaseSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto subject : validGroupSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto subject : invalidSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
EXPECT_EQ(entry.SetAuthMode(AuthMode::kNone), CHIP_NO_ERROR);
for (auto subject : validCaseSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto subject : validGroupSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto subject : validPaseSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto subject : invalidSubjects)
{
EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
// Next cases have no subject
EXPECT_EQ(entry.RemoveSubject(0), CHIP_NO_ERROR);
// PASE must have subject
{
EXPECT_EQ(entry.SetAuthMode(AuthMode::kPase), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
// None is not a real auth mode but also shouldn't work with no subject
{
EXPECT_EQ(entry.SetAuthMode(AuthMode::kNone), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
TEST_F(TestAccessControl, TestAclValidateFabricIndex)
{
TestEntryDelegate delegate; // outlive entry
Entry entry;
// Use prepared entry for valid cases
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetPrivilege(Privilege::kView), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { .flags = Target::kCluster, .cluster = kOnOffCluster }), CHIP_NO_ERROR);
// Each case tries to update the first entry, then add a second entry, then unconditionally delete it
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
for (auto fabricIndex : fabricIndexes)
{
EXPECT_EQ(entry.SetFabricIndex(fabricIndex), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
// Use test entry for invalid cases (to ensure it can hold invalid data)
entry.SetDelegate(delegate);
for (auto fabricIndex : invalidFabricIndexes)
{
EXPECT_EQ(entry.SetFabricIndex(fabricIndex), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
TEST_F(TestAccessControl, TestAclValidatePrivilege)
{
TestEntryDelegate delegate; // outlive entry
Entry entry;
// Use prepared entry for valid cases
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetPrivilege(Privilege::kView), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { .flags = Target::kCluster, .cluster = kOnOffCluster }), CHIP_NO_ERROR);
// Each case tries to update the first entry, then add a second entry, then unconditionally delete it
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
for (auto privilege : privileges)
{
EXPECT_EQ(entry.SetPrivilege(privilege), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
// Use test entry for invalid cases (to ensure it can hold invalid data)
entry.SetDelegate(delegate);
// Cannot grant administer privilege to group auth mode
{
EXPECT_EQ(entry.SetPrivilege(Privilege::kAdminister), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetSubject(0, kGroup4), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
TEST_F(TestAccessControl, TestAclValidateTarget)
{
TestEntryDelegate delegate; // outlive entry
Entry entry;
// Use prepared entry for valid cases
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetPrivilege(Privilege::kView), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { .flags = Target::kCluster, .cluster = kOnOffCluster }), CHIP_NO_ERROR);
// Each case tries to update the first entry, then add a second entry, then unconditionally delete it
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
for (auto cluster : validClusters)
{
EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kCluster, .cluster = cluster }), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto endpoint : validEndpoints)
{
EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kEndpoint, .endpoint = endpoint }), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto deviceType : validDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kDeviceType, .deviceType = deviceType }), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto cluster : validClusters)
{
for (auto endpoint : validEndpoints)
{
EXPECT_EQ(
entry.SetTarget(0, { .flags = Target::kCluster | Target::kEndpoint, .cluster = cluster, .endpoint = endpoint }),
CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto cluster : validClusters)
{
for (auto deviceType : validDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(
0, { .flags = Target::kCluster | Target::kDeviceType, .cluster = cluster, .deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
// Use test entry for invalid cases (to ensure it can hold invalid data)
entry.SetDelegate(delegate);
// Cannot target endpoint and device type
for (auto endpoint : validEndpoints)
{
for (auto deviceType : validDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(
0, { .flags = Target::kEndpoint | Target::kDeviceType, .endpoint = endpoint, .deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
// Cannot target all
for (auto cluster : validClusters)
{
for (auto endpoint : validEndpoints)
{
for (auto deviceType : validDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0,
{ .flags = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
.cluster = cluster,
.endpoint = endpoint,
.deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
}
// Cannot target none
{
EXPECT_EQ(entry.SetTarget(0, { .flags = 0 }), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto cluster : invalidClusters)
{
EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kCluster, .cluster = cluster }), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto endpoint : invalidEndpoints)
{
EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kEndpoint, .endpoint = endpoint }), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto deviceType : invalidDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kDeviceType, .deviceType = deviceType }), CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
for (auto cluster : invalidClusters)
{
for (auto endpoint : invalidEndpoints)
{
EXPECT_EQ(
entry.SetTarget(0, { .flags = Target::kCluster | Target::kEndpoint, .cluster = cluster, .endpoint = endpoint }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto cluster : invalidClusters)
{
for (auto endpoint : validEndpoints)
{
EXPECT_EQ(
entry.SetTarget(0, { .flags = Target::kCluster | Target::kEndpoint, .cluster = cluster, .endpoint = endpoint }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto cluster : validClusters)
{
for (auto endpoint : invalidEndpoints)
{
EXPECT_EQ(
entry.SetTarget(0, { .flags = Target::kCluster | Target::kEndpoint, .cluster = cluster, .endpoint = endpoint }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto cluster : invalidClusters)
{
for (auto deviceType : invalidDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(
0, { .flags = Target::kCluster | Target::kDeviceType, .cluster = cluster, .deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto cluster : invalidClusters)
{
for (auto deviceType : validDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(
0, { .flags = Target::kCluster | Target::kDeviceType, .cluster = cluster, .deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto cluster : validClusters)
{
for (auto deviceType : invalidDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(
0, { .flags = Target::kCluster | Target::kDeviceType, .cluster = cluster, .deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto endpoint : invalidEndpoints)
{
for (auto deviceType : invalidDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(
0, { .flags = Target::kEndpoint | Target::kDeviceType, .endpoint = endpoint, .deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto endpoint : invalidEndpoints)
{
for (auto deviceType : validDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(
0, { .flags = Target::kEndpoint | Target::kDeviceType, .endpoint = endpoint, .deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto endpoint : validEndpoints)
{
for (auto deviceType : invalidDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(
0, { .flags = Target::kEndpoint | Target::kDeviceType, .endpoint = endpoint, .deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
for (auto cluster : invalidClusters)
{
for (auto endpoint : invalidEndpoints)
{
for (auto deviceType : invalidDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0,
{ .flags = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
.cluster = cluster,
.endpoint = endpoint,
.deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
}
for (auto cluster : invalidClusters)
{
for (auto endpoint : invalidEndpoints)
{
for (auto deviceType : validDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0,
{ .flags = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
.cluster = cluster,
.endpoint = endpoint,
.deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
}
for (auto cluster : invalidClusters)
{
for (auto endpoint : validEndpoints)
{
for (auto deviceType : invalidDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0,
{ .flags = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
.cluster = cluster,
.endpoint = endpoint,
.deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
}
for (auto cluster : validClusters)
{
for (auto endpoint : invalidEndpoints)
{
for (auto deviceType : invalidDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0,
{ .flags = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
.cluster = cluster,
.endpoint = endpoint,
.deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
}
for (auto cluster : invalidClusters)
{
for (auto endpoint : validEndpoints)
{
for (auto deviceType : validDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0,
{ .flags = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
.cluster = cluster,
.endpoint = endpoint,
.deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
}
for (auto cluster : validClusters)
{
for (auto endpoint : invalidEndpoints)
{
for (auto deviceType : validDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0,
{ .flags = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
.cluster = cluster,
.endpoint = endpoint,
.deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
}
for (auto cluster : validClusters)
{
for (auto endpoint : validEndpoints)
{
for (auto deviceType : invalidDeviceTypes)
{
EXPECT_EQ(entry.SetTarget(0,
{ .flags = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
.cluster = cluster,
.endpoint = endpoint,
.deviceType = deviceType }),
CHIP_NO_ERROR);
EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
accessControl.DeleteEntry(1);
}
}
}
}
TEST_F(TestAccessControl, TestCheck)
{
LoadAccessControl(accessControl, entryData1, entryData1Count);
for (const auto & checkData : checkData1)
{
CHIP_ERROR expectedResult = checkData.allow ? CHIP_NO_ERROR : CHIP_ERROR_ACCESS_DENIED;
EXPECT_EQ(accessControl.Check(checkData.subjectDescriptor, checkData.requestPath, checkData.privilege), expectedResult);
}
}
TEST_F(TestAccessControl, TestCreateReadEntry)
{
for (size_t i = 0; i < entryData1Count; ++i)
{
EXPECT_EQ(LoadAccessControl(accessControl, entryData1 + i, 1), CHIP_NO_ERROR);
EXPECT_EQ(CompareAccessControl(accessControl, entryData1, i + 1), CHIP_NO_ERROR);
}
}
TEST_F(TestAccessControl, TestDeleteEntry)
{
EntryData data[entryData1Count];
for (size_t pos = 0; pos < ArraySize(data); ++pos)
{
for (size_t count = ArraySize(data) - pos; count > 0; --count)
{
memcpy(data, entryData1, sizeof(data));
EXPECT_EQ(ClearAccessControl(accessControl), CHIP_NO_ERROR);
EXPECT_EQ(LoadAccessControl(accessControl, data, ArraySize(data)), CHIP_NO_ERROR);
memmove(&data[pos], &data[pos + count], (ArraySize(data) - count - pos) * sizeof(data[0]));
for (size_t i = 0; i < count; ++i)
{
EXPECT_EQ(accessControl.DeleteEntry(pos), CHIP_NO_ERROR);
}
EXPECT_EQ(CompareAccessControl(accessControl, data, ArraySize(data) - count), CHIP_NO_ERROR);
}
}
// Test fabric removal
{
memcpy(data, entryData1, sizeof(data));
EXPECT_EQ(ClearAccessControl(accessControl), CHIP_NO_ERROR);
EXPECT_EQ(LoadAccessControl(accessControl, data, ArraySize(data)), CHIP_NO_ERROR);
// After deleting Fabric index 1, we should have the number of entries of Fabric index 2
EXPECT_EQ(accessControl.DeleteAllEntriesForFabric(1), CHIP_NO_ERROR);
size_t numEntriesForFabricIndex2 = 0;
size_t numTotalEntries = 0;
EXPECT_EQ(accessControl.GetEntryCount(2, numEntriesForFabricIndex2), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.GetEntryCount(numTotalEntries), CHIP_NO_ERROR);
EXPECT_EQ(numEntriesForFabricIndex2, kNumFabric2EntriesInEntryData1);
EXPECT_EQ(numTotalEntries, kNumFabric2EntriesInEntryData1);
// Delete fabric 2 as well, we should be at zero
numTotalEntries = 1000;
EXPECT_EQ(accessControl.DeleteAllEntriesForFabric(2), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.GetEntryCount(numTotalEntries), CHIP_NO_ERROR);
EXPECT_EQ(numTotalEntries, 0u);
}
}
TEST_F(TestAccessControl, TestFabricFilteredCreateEntry)
{
for (auto & fabricIndex : fabricIndexes)
{
for (size_t count = 0; count < entryData1Count; ++count)
{
EXPECT_EQ(ClearAccessControl(accessControl), CHIP_NO_ERROR);
EXPECT_EQ(LoadAccessControl(accessControl, entryData1, count), CHIP_NO_ERROR);
constexpr size_t expectedIndexes[][entryData1Count] = {
{ 0, 1, 2, 2, 3, 3, 3, 4, 4 },
{ 0, 0, 0, 1, 1, 2, 3, 3, 4 },
{ 0, 0, 0, 0, 0, 0, 0, 0, 0 },
};
const size_t expectedIndex = expectedIndexes[&fabricIndex - fabricIndexes][count];
Entry entry;
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(fabricIndex), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
size_t outIndex = 999;
FabricIndex outFabricIndex = 123;
EXPECT_EQ(accessControl.CreateEntry(&outIndex, entry, &outFabricIndex), CHIP_NO_ERROR);
EXPECT_EQ(outIndex, expectedIndex);
EXPECT_EQ(outFabricIndex, fabricIndex);
}
}
}
TEST_F(TestAccessControl, TestFabricFilteredReadEntry)
{
EXPECT_EQ(LoadAccessControl(accessControl, entryData1, entryData1Count), CHIP_NO_ERROR);
for (auto & fabricIndex : fabricIndexes)
{
constexpr size_t indexes[] = { 0, 1, 2, 3, 4, 5 };
for (auto & index : indexes)
{
constexpr size_t illegalIndex = entryData1Count;
constexpr size_t expectedIndexes[][ArraySize(indexes)] = {
{ 0, 1, 3, 6, illegalIndex, illegalIndex },
{ 2, 4, 5, 7, 8, illegalIndex },
{ illegalIndex, illegalIndex, illegalIndex, illegalIndex, illegalIndex, illegalIndex },
};
const size_t expectedIndex = expectedIndexes[&fabricIndex - fabricIndexes][&index - indexes];
Entry entry;
CHIP_ERROR err = accessControl.ReadEntry(index, entry, &fabricIndex);
if (expectedIndex != illegalIndex)
{
EXPECT_EQ(err, CHIP_NO_ERROR);
EXPECT_EQ(CompareEntry(entry, entryData1[expectedIndex]), CHIP_NO_ERROR);
}
else
{
EXPECT_NE(err, CHIP_NO_ERROR);
}
}
}
}
TEST_F(TestAccessControl, TestIterator)
{
LoadAccessControl(accessControl, entryData1, entryData1Count);
FabricIndex fabricIndex;
EntryIterator iterator;
Entry entry;
size_t count;
EXPECT_EQ(accessControl.Entries(iterator), CHIP_NO_ERROR);
count = 0;
while (iterator.Next(entry) == CHIP_NO_ERROR)
{
EXPECT_EQ(CompareEntry(entry, entryData1[count]), CHIP_NO_ERROR);
count++;
}
EXPECT_EQ(count, entryData1Count);
fabricIndex = kUndefinedFabricIndex;
EXPECT_EQ(accessControl.Entries(iterator, &fabricIndex), CHIP_NO_ERROR);
EXPECT_NE(iterator.Next(entry), CHIP_NO_ERROR);
fabricIndex = 1;
EXPECT_EQ(accessControl.Entries(iterator, &fabricIndex), CHIP_NO_ERROR);
size_t fabric1[] = { 0, 1, 3, 6 };
count = 0;
while (iterator.Next(entry) == CHIP_NO_ERROR)
{
EXPECT_EQ(CompareEntry(entry, entryData1[fabric1[count]]), CHIP_NO_ERROR);
count++;
}
EXPECT_EQ(count, ArraySize(fabric1));
fabricIndex = 2;
EXPECT_EQ(accessControl.Entries(iterator, &fabricIndex), CHIP_NO_ERROR);
size_t fabric2[] = { 2, 4, 5, 7, 8 };
count = 0;
while (iterator.Next(entry) == CHIP_NO_ERROR)
{
EXPECT_EQ(CompareEntry(entry, entryData1[fabric2[count]]), CHIP_NO_ERROR);
count++;
}
EXPECT_EQ(count, ArraySize(fabric2));
}
TEST_F(TestAccessControl, TestPrepareEntry)
{
Entry entry;
for (auto authMode : authModes)
{
for (auto fabricIndex : fabricIndexes)
{
for (auto privilege : privileges)
{
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
size_t subjectCount = 0;
size_t targetCount = 0;
EXPECT_EQ(entry.GetSubjectCount(subjectCount), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetTargetCount(targetCount), CHIP_NO_ERROR);
EXPECT_EQ(subjectCount, 0u);
EXPECT_EQ(targetCount, 0u);
EXPECT_EQ(entry.SetAuthMode(authMode), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(fabricIndex), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetPrivilege(privilege), CHIP_NO_ERROR);
int subjectIndex;
switch (authMode)
{
default:
case AuthMode::kCase:
subjectIndex = 0;
break;
case AuthMode::kGroup:
subjectIndex = 1;
break;
}
for (auto subject : subjects[subjectIndex])
{
EXPECT_EQ(entry.AddSubject(nullptr, subject), CHIP_NO_ERROR);
}
for (auto & target : targets)
{
EXPECT_EQ(entry.AddTarget(nullptr, target), CHIP_NO_ERROR);
}
AuthMode a;
FabricIndex f;
Privilege p;
EXPECT_EQ(entry.GetAuthMode(a), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetFabricIndex(f), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetPrivilege(p), CHIP_NO_ERROR);
EXPECT_EQ(a, authMode);
EXPECT_EQ(f, fabricIndex);
EXPECT_EQ(p, privilege);
EXPECT_EQ(entry.GetSubjectCount(subjectCount), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetTargetCount(targetCount), CHIP_NO_ERROR);
EXPECT_EQ(subjectCount, ArraySize(subjects[0]));
EXPECT_EQ(targetCount, ArraySize(targets));
for (size_t i = 0; i < ArraySize(subjects[subjectIndex]); ++i)
{
NodeId n;
EXPECT_EQ(entry.GetSubject(i, n), CHIP_NO_ERROR);
EXPECT_EQ(n, subjects[subjectIndex][i]);
}
for (size_t i = 0; i < ArraySize(targets); ++i)
{
Target t;
EXPECT_EQ(entry.GetTarget(i, t), CHIP_NO_ERROR);
EXPECT_EQ(t, targets[i]);
}
}
}
}
}
TEST_F(TestAccessControl, TestSubjectsTargets)
{
Entry entry;
size_t index;
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetPrivilege(Privilege::kAdminister), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster, 1, 0, 0 }), CHIP_NO_ERROR);
index = 999;
EXPECT_EQ(accessControl.CreateEntry(&index, entry), CHIP_NO_ERROR);
EXPECT_EQ(index, 0u);
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(2), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetPrivilege(Privilege::kManage), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId1), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { Target::kEndpoint, 0, 2, 0 }), CHIP_NO_ERROR);
index = 999;
EXPECT_EQ(accessControl.CreateEntry(&index, entry), CHIP_NO_ERROR);
EXPECT_EQ(index, 1u);
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(3), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetPrivilege(Privilege::kOperate), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddSubject(nullptr, kGroup2), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster, 2, 0, 0 }), CHIP_NO_ERROR);
index = 999;
EXPECT_EQ(accessControl.CreateEntry(&index, entry), CHIP_NO_ERROR);
EXPECT_EQ(index, 2u);
FabricIndex fabricIndex = 0;
Privilege privilege = Privilege::kView;
AuthMode authMode = AuthMode::kNone;
size_t count = 0;
NodeId subject = kUndefinedNodeId;
Target target;
EXPECT_EQ(accessControl.ReadEntry(0, entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetFabricIndex(fabricIndex), CHIP_NO_ERROR);
EXPECT_EQ(fabricIndex, 1);
EXPECT_EQ(entry.GetPrivilege(privilege), CHIP_NO_ERROR);
EXPECT_EQ(privilege, Privilege::kAdminister);
EXPECT_EQ(entry.GetAuthMode(authMode), CHIP_NO_ERROR);
EXPECT_EQ(authMode, AuthMode::kCase);
EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 0u);
EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 1u);
EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
EXPECT_EQ(target.flags, Target::kCluster);
EXPECT_EQ(target.cluster, 1u);
EXPECT_EQ(accessControl.ReadEntry(1, entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetFabricIndex(fabricIndex), CHIP_NO_ERROR);
EXPECT_EQ(fabricIndex, 2);
EXPECT_EQ(entry.GetPrivilege(privilege), CHIP_NO_ERROR);
EXPECT_EQ(privilege, Privilege::kManage);
EXPECT_EQ(entry.GetAuthMode(authMode), CHIP_NO_ERROR);
EXPECT_EQ(authMode, AuthMode::kCase);
EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 1u);
EXPECT_EQ(entry.GetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_EQ(subject, kOperationalNodeId1);
EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 1u);
EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
EXPECT_EQ(target.flags, Target::kEndpoint);
EXPECT_EQ(target.endpoint, 2);
EXPECT_EQ(accessControl.ReadEntry(2, entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetFabricIndex(fabricIndex), CHIP_NO_ERROR);
EXPECT_EQ(fabricIndex, 3);
EXPECT_EQ(entry.GetPrivilege(privilege), CHIP_NO_ERROR);
EXPECT_EQ(privilege, Privilege::kOperate);
EXPECT_EQ(entry.GetAuthMode(authMode), CHIP_NO_ERROR);
EXPECT_EQ(authMode, AuthMode::kGroup);
EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 1u);
EXPECT_EQ(entry.GetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_EQ(subject, kGroup2);
EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 1u);
EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
EXPECT_EQ(target.flags, Target::kCluster);
EXPECT_EQ(target.cluster, 2u);
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetFabricIndex(11), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetPrivilege(Privilege::kProxyView), CHIP_NO_ERROR);
EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddSubject(nullptr, 0x11111111AAAAAAAA), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddSubject(nullptr, 0x22222222BBBBBBBB), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddSubject(nullptr, 0x33333333CCCCCCCC), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster | Target::kEndpoint, 11, 22, 0 }), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster | Target::kEndpoint, 33, 44, 0 }), CHIP_NO_ERROR);
EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster | Target::kEndpoint, 0xAAAAFC01, 0x6666, 0 }), CHIP_NO_ERROR);
index = 999;
EXPECT_EQ(accessControl.CreateEntry(&index, entry), CHIP_NO_ERROR);
EXPECT_EQ(index, 3u);
EXPECT_EQ(accessControl.ReadEntry(3, entry), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetFabricIndex(fabricIndex), CHIP_NO_ERROR);
EXPECT_EQ(fabricIndex, 11);
EXPECT_EQ(entry.GetPrivilege(privilege), CHIP_NO_ERROR);
EXPECT_EQ(privilege, Privilege::kProxyView);
EXPECT_EQ(entry.GetAuthMode(authMode), CHIP_NO_ERROR);
EXPECT_EQ(authMode, AuthMode::kCase);
EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 3u);
EXPECT_EQ(entry.GetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_EQ(subject, 0x11111111AAAAAAAAu);
EXPECT_EQ(entry.GetSubject(1, subject), CHIP_NO_ERROR);
EXPECT_EQ(subject, 0x22222222BBBBBBBBu);
EXPECT_EQ(entry.GetSubject(2, subject), CHIP_NO_ERROR);
EXPECT_EQ(subject, 0x33333333CCCCCCCCu);
EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 3u);
EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
EXPECT_EQ(target.cluster, 11u);
EXPECT_EQ(target.endpoint, 22);
EXPECT_EQ(entry.GetTarget(1, target), CHIP_NO_ERROR);
EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
EXPECT_EQ(target.cluster, 33u);
EXPECT_EQ(target.endpoint, 44);
EXPECT_EQ(entry.GetTarget(2, target), CHIP_NO_ERROR);
EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
EXPECT_EQ(target.cluster, 0xAAAAFC01);
EXPECT_EQ(target.endpoint, 0x6666);
EXPECT_EQ(entry.RemoveSubject(1), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 2u);
EXPECT_EQ(entry.GetSubject(0, subject), CHIP_NO_ERROR);
EXPECT_EQ(subject, 0x11111111AAAAAAAAu);
EXPECT_EQ(entry.GetSubject(1, subject), CHIP_NO_ERROR);
EXPECT_EQ(subject, 0x33333333CCCCCCCCu);
EXPECT_NE(entry.GetSubject(2, subject), CHIP_NO_ERROR);
EXPECT_EQ(entry.RemoveTarget(1), CHIP_NO_ERROR);
EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
EXPECT_EQ(count, 2u);
EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
EXPECT_EQ(target.cluster, 11u);
EXPECT_EQ(target.endpoint, 22u);
EXPECT_EQ(entry.GetTarget(1, target), CHIP_NO_ERROR);
EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
EXPECT_EQ(target.cluster, 0xAAAAFC01);
EXPECT_EQ(target.endpoint, 0x6666);
EXPECT_NE(entry.GetTarget(2, target), CHIP_NO_ERROR);
}
TEST_F(TestAccessControl, TestUpdateEntry)
{
EntryData data[entryData1Count];
memcpy(data, entryData1, sizeof(data));
EXPECT_EQ(LoadAccessControl(accessControl, data, ArraySize(data)), CHIP_NO_ERROR);
for (size_t i = 0; i < ArraySize(data); ++i)
{
EntryData updateData;
updateData.authMode = authModes[i % ArraySize(authModes)];
updateData.fabricIndex = fabricIndexes[i % ArraySize(fabricIndexes)];
updateData.privilege = privileges[i % (ArraySize(privileges) - 1)];
updateData.AddSubject(nullptr, subjects[i % ArraySize(authModes)][i % ArraySize(subjects[0])]);
updateData.AddTarget(nullptr, targets[i % ArraySize(targets)]);
data[i] = updateData;
{
Entry entry;
EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
EXPECT_EQ(LoadEntry(entry, updateData), CHIP_NO_ERROR);
EXPECT_EQ(accessControl.UpdateEntry(i, entry), CHIP_NO_ERROR);
}
EXPECT_EQ(CompareAccessControl(accessControl, data, ArraySize(data)), CHIP_NO_ERROR);
}
}
} // namespace Access
} // namespace chip