Ashin Walpola
d107534eb2
obu-firmware builds against the vanetza-idf C-ITS library, which until now came from the colleague's microbu-esp32c5 tree beside the repository and was not tracked here, so a clone of this repository could not build the firmware it ships. The library alone is now part of obu-firmware, as obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from there by default; -DVANETZA_IDF_DIR still points the build elsewhere. The rest of the colleague's tree (their own VAM firmware, PKI tooling, station-link Python tools, the V2X2MAP bridge) stays out of this repository and gitignored; nothing is pushed to their repository. NOTES.md, docs/06, TODO.md and the pcap verifier's usage line point at the new location.
103 lines
3.2 KiB
C++
103 lines
3.2 KiB
C++
#pragma once
|
|
#include <vanetza/asn1/security_profile.hpp>
|
|
#include VANETZA_ASN1_SECURITY_HEADER(Certificate.h)
|
|
#include <vanetza/security/v3/asn1_types.hpp>
|
|
|
|
// forward declaration
|
|
struct Vanetza_Security_SequenceOfIdentifiedRegion;
|
|
|
|
namespace vanetza
|
|
{
|
|
|
|
// forward declarations
|
|
struct PositionFix;
|
|
namespace geodesy { class CountryDatabase; }
|
|
|
|
namespace security
|
|
{
|
|
namespace v3
|
|
{
|
|
|
|
/**
|
|
* LocationChecker Interface
|
|
* Abstract base class defining the interface for location validation.
|
|
*/
|
|
class LocationChecker
|
|
{
|
|
public:
|
|
// Returns true if the given PositionFix lies within the specified GeographicRegion.
|
|
virtual bool valid_at_location(const asn1::EtsiTs103097Certificate& cert, const PositionFix& location) const = 0;
|
|
virtual ~LocationChecker() = default;
|
|
};
|
|
|
|
/**
|
|
* Always allow all the requests
|
|
*/
|
|
class AllowLocationChecker : public LocationChecker
|
|
{
|
|
public:
|
|
bool valid_at_location(const asn1::EtsiTs103097Certificate& cert, const PositionFix& location) const override;
|
|
};
|
|
|
|
/**
|
|
* Always deny all the requests
|
|
*/
|
|
class DenyLocationChecker : public LocationChecker
|
|
{
|
|
public:
|
|
bool valid_at_location(const asn1::EtsiTs103097Certificate& cert, const PositionFix& location) const override;
|
|
};
|
|
|
|
/**
|
|
* Default implementation that checks whether a position lies within a certificate's GeographicRegion.
|
|
* Supports: no restriction, CircularRegion, RectangularRegion, PolygonalRegion, IdentifiedRegion
|
|
* (only ISO 3166/M49 country codes).
|
|
* For unsupported IdentifiedRegion variants, the permissive flag controls their acceptance or rejection.
|
|
* IdentifiedRegion (ISO 3166 country codes): unsupported; returns false (conservative) unless
|
|
* Entirely unknown region types are always rejected conservatively.
|
|
*/
|
|
class DefaultLocationChecker : public LocationChecker
|
|
{
|
|
public:
|
|
bool valid_at_location(const asn1::EtsiTs103097Certificate& cert, const PositionFix& location) const override;
|
|
|
|
/**
|
|
* Change permissive behaviour regarding unsupported IdentifiedRegion types.
|
|
*
|
|
* When set to true, unsupported IdentifiedRegion (country and region, country and sub-regions)
|
|
* are not checked but still accepted. These regions are only defined for the United States, i.e.
|
|
* they have no meaning for European C-ITS deployments.
|
|
* Default behaviour is conservative rejection (false), user must explicitly opt in.
|
|
*/
|
|
void set_permissive_identified_region(bool permissive)
|
|
{
|
|
permissive_identified_region_ = permissive;
|
|
}
|
|
|
|
bool permissive_identified_region() const
|
|
{
|
|
return permissive_identified_region_;
|
|
}
|
|
|
|
/**
|
|
* Register country database for IdentifiedRegion validations.
|
|
*
|
|
* If a database is registered, validation of countryOnly IdentifiedRegion takes place.
|
|
* If database is missing, validation falls back to the defined permissive behaviour.
|
|
*/
|
|
void use_country_database(const geodesy::CountryDatabase* db)
|
|
{
|
|
country_db_ = db;
|
|
}
|
|
|
|
private:
|
|
bool check_identified_region(const PositionFix& location, const Vanetza_Security_SequenceOfIdentifiedRegion& seq) const;
|
|
|
|
bool permissive_identified_region_ = false;
|
|
const geodesy::CountryDatabase* country_db_ = nullptr;
|
|
};
|
|
|
|
} // namespace v3
|
|
} // namespace security
|
|
} // namespace vanetza
|