Ashin Walpola
0e9525162d
obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but that tree was gitignored, so a clone of this repository could not build the firmware it ships. It is now committed here as ordinary files in its own folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP bridge's signature verification (--trust) used on the bench. Nothing is fetched from or pushed to the colleague's repository; this repository and its remotes carry everything. The folder's own .gitignore keeps build output, downloaded components and private key material out, as it did there; the committed file set is identical to that repository's tracked files. The ESP32-C5 is still flashed from obu-firmware/, which only takes vanetza-idf from microbu-esp32c5/, so the two stay separate folders. FLASHING.md says how to take a newer version of the colleague's tree (copy it over the folder, rebuild, test, commit).
103 lines
3.2 KiB
C++
103 lines
3.2 KiB
C++
#pragma once
|
|
#include <vanetza/asn1/security_profile.hpp>
|
|
#include VANETZA_ASN1_SECURITY_HEADER(Certificate.h)
|
|
#include <vanetza/security/v3/asn1_types.hpp>
|
|
|
|
// forward declaration
|
|
struct Vanetza_Security_SequenceOfIdentifiedRegion;
|
|
|
|
namespace vanetza
|
|
{
|
|
|
|
// forward declarations
|
|
struct PositionFix;
|
|
namespace geodesy { class CountryDatabase; }
|
|
|
|
namespace security
|
|
{
|
|
namespace v3
|
|
{
|
|
|
|
/**
|
|
* LocationChecker Interface
|
|
* Abstract base class defining the interface for location validation.
|
|
*/
|
|
class LocationChecker
|
|
{
|
|
public:
|
|
// Returns true if the given PositionFix lies within the specified GeographicRegion.
|
|
virtual bool valid_at_location(const asn1::EtsiTs103097Certificate& cert, const PositionFix& location) const = 0;
|
|
virtual ~LocationChecker() = default;
|
|
};
|
|
|
|
/**
|
|
* Always allow all the requests
|
|
*/
|
|
class AllowLocationChecker : public LocationChecker
|
|
{
|
|
public:
|
|
bool valid_at_location(const asn1::EtsiTs103097Certificate& cert, const PositionFix& location) const override;
|
|
};
|
|
|
|
/**
|
|
* Always deny all the requests
|
|
*/
|
|
class DenyLocationChecker : public LocationChecker
|
|
{
|
|
public:
|
|
bool valid_at_location(const asn1::EtsiTs103097Certificate& cert, const PositionFix& location) const override;
|
|
};
|
|
|
|
/**
|
|
* Default implementation that checks whether a position lies within a certificate's GeographicRegion.
|
|
* Supports: no restriction, CircularRegion, RectangularRegion, PolygonalRegion, IdentifiedRegion
|
|
* (only ISO 3166/M49 country codes).
|
|
* For unsupported IdentifiedRegion variants, the permissive flag controls their acceptance or rejection.
|
|
* IdentifiedRegion (ISO 3166 country codes): unsupported; returns false (conservative) unless
|
|
* Entirely unknown region types are always rejected conservatively.
|
|
*/
|
|
class DefaultLocationChecker : public LocationChecker
|
|
{
|
|
public:
|
|
bool valid_at_location(const asn1::EtsiTs103097Certificate& cert, const PositionFix& location) const override;
|
|
|
|
/**
|
|
* Change permissive behaviour regarding unsupported IdentifiedRegion types.
|
|
*
|
|
* When set to true, unsupported IdentifiedRegion (country and region, country and sub-regions)
|
|
* are not checked but still accepted. These regions are only defined for the United States, i.e.
|
|
* they have no meaning for European C-ITS deployments.
|
|
* Default behaviour is conservative rejection (false), user must explicitly opt in.
|
|
*/
|
|
void set_permissive_identified_region(bool permissive)
|
|
{
|
|
permissive_identified_region_ = permissive;
|
|
}
|
|
|
|
bool permissive_identified_region() const
|
|
{
|
|
return permissive_identified_region_;
|
|
}
|
|
|
|
/**
|
|
* Register country database for IdentifiedRegion validations.
|
|
*
|
|
* If a database is registered, validation of countryOnly IdentifiedRegion takes place.
|
|
* If database is missing, validation falls back to the defined permissive behaviour.
|
|
*/
|
|
void use_country_database(const geodesy::CountryDatabase* db)
|
|
{
|
|
country_db_ = db;
|
|
}
|
|
|
|
private:
|
|
bool check_identified_region(const PositionFix& location, const Vanetza_Security_SequenceOfIdentifiedRegion& seq) const;
|
|
|
|
bool permissive_identified_region_ = false;
|
|
const geodesy::CountryDatabase* country_db_ = nullptr;
|
|
};
|
|
|
|
} // namespace v3
|
|
} // namespace security
|
|
} // namespace vanetza
|