Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement simple access control cluster persistence/storage #10251

Closed
mlepage-google opened this issue Oct 5, 2021 · 3 comments · Fixed by #12814 or #14680
Closed

Implement simple access control cluster persistence/storage #10251

mlepage-google opened this issue Oct 5, 2021 · 3 comments · Fixed by #12814 or #14680
Assignees
Labels
acl Access Control feature storage Involves NVM storage retreival/access V1.0

Comments

@mlepage-google
Copy link
Contributor

mlepage-google commented Oct 5, 2021

  • design storage format
  • implement load/save functionality
  • ensure system is robust (data integrity etc.)
  • lean and fast also important (in that order)
  • defer extensions for now, but keep them in mind (Add extension support to access control #10252)
@mlepage-google
Copy link
Contributor Author

PR #11550 adds an in-memory implementation that uses a single array of POD "storage" structs for the entry data. That format is already quite terse.

Therefore, what mainly needs to happen here:

  • in AccessControl::Init, check for any stored ACL data, and if it exists, load it into the ACL storage area in-memory
  • otherwise don't, and let the in-memory storage be the starting data
  • in AccessControl::CreateEntry, write the new entry (the last one in the in-memory ACL storage) to flash storage
  • in AccessControl::UpdateEntry, write the updated entry (just that one, could be anywhere in ACL) to flash storage
  • in AccessControl::DeleteEntry, write the entries from the deleted index to the end of the used indexes, to flash storage (since they moved to fill the hole)

Probably wise to consider some kind of mini header for the flash storage, containing a version etc.

@mlepage-google mlepage-google reopened this Jan 7, 2022
@mlepage-google mlepage-google changed the title Implement AccessControlProvider storage format Implement Access Control Cluster persistence/storage Jan 27, 2022
@mlepage-google
Copy link
Contributor Author

mlepage-google commented Jan 27, 2022

@harimau-qirex is putting the simple approach (down in access control module) in PR #14253 so we can have some persistence in the interim, then will refactor it out into the cluster with improved storage format and more use of generated code (issue #14451).

@mlepage-google mlepage-google changed the title Implement Access Control Cluster persistence/storage Implement simple access control cluster persistence/storage Jan 27, 2022
@harimau-qirex
Copy link
Contributor

The remaining work is for each platform to call chip::Access::Examples::SetAccessControlDelegateStorage (defined in src/access/examples/ExampleAccessControlDelegate.h) with a PersistentStorageDelegate implementation. Linux and MacOS call this in examples/platform/linux/AppMain.cpp with an implementation of PersistentStorageDelegate backed by the KVS manager.

The keys passed into the PersistentStorageDelegate are defined in src/lib/support/DefaultStorageKeyAllocator.h as AccessControlList and AccessControlEntry. By default there are 48 entries (numbered 0-47), but that is configurable by setting CHIP_CONFIG_MAX_DEVICE_ADMINS and CHIP_CONFIG_EXAMPLE_ACCESS_CONTROL_MAX_ENTRIES_PER_FABRIC.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
acl Access Control feature storage Involves NVM storage retreival/access V1.0
Projects
None yet
5 participants