Changeset 6823

Timestamp:

16/04/10 10:36:08 (11 years ago)

Author:

pjkersha

Message:

Working XACML implementation with permit-overrides rule combining algorithm.

Location:

TI12-security/trunk/NDG_XACML/ndg/xacml/core

Files:

• policy.py (modified) (7 diffs)
• rule_combining_alg.py (modified) (4 diffs)

TI12-security/trunk/NDG_XACML/ndg/xacml/core/policy.py

@@ -17 +17 @@
 from ndg.xacml.core.rule import Rule
 from ndg.xacml.core.obligation import Obligation
-from ndg.xacml.core.rule_combining_alg import (RuleCombiningAlgInterface,
-                                               RuleCombiningAlgClassFactory)
+from ndg.xacml.core.rule_combining_alg import (RuleCombiningAlgClassFactory,
+                                               RuleCombiningAlgInterface)
+from ndg.xacml.core.exceptions import (UnsupportedStdFunctionError,
+                                       UnsupportedFunctionError)
 
 
@@ -43 +45 @@
     OBLIGATIONS_LOCAL_NAME = "Obligations"
     
-    # Plan to support permit overrides in a future release
-    RULE_COMBINING_ALG_IDS = (
-    "urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides",
-    "urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides",
-    )
     __slots__ = (
         '__policyId',
@@ -61 +58 @@
     )
     
-    def __init__(self):
+    def __init__(self, ruleCombiningAlgFactory=None):
+        """Customise rule combining behaviour by passing in a custom combining
+        algorithm factory.  This is invoked when the combining algorithm Id
+        property is set in order to create the corresponding combining algorithm
+        object
+        """
         super(Policy, self).__init__()
         self.__policyId = None
@@ -76 +78 @@
         self.__obligations = TypedList(Obligation)
         
-        self.__ruleCombiningAlgFactory = RuleCombiningAlgClassFactory()
+        self.__ruleCombiningAlgFactory = None
+        if ruleCombiningAlgFactory is None:
+            self.ruleCombiningAlgFactory = RuleCombiningAlgClassFactory()
+        else:
+            self.ruleCombiningAlgFactory = ruleCombiningAlgFactory
 
         self.__ruleCombiningAlg = None
@@ -94 +100 @@
                                        _setRuleCombiningAlgFactory, 
                                        doc="Rule Combining Algorithm Factory")
-    def _getRuleCombiningAlg(self):
+    
+    @property
+    def ruleCombiningAlg(self):
+        "Rule Combining algorithm"
         return self.__ruleCombiningAlg
-
-    def _setRuleCombiningAlg(self, value):
-        if (value not in (NotImplemented, None) and 
-            not issubclass(value, RuleCombiningAlgInterface)):
-            raise TypeError('Expecting %r derived type or None or '
-                            'NotImplemented for "ruleCombiningAlg" attibute; '
-                            'got %r' % (RuleCombiningAlgInterface, type(value)))
-            
-        self.__ruleCombiningAlg = value
-
-    ruleCombiningAlg = property(_getRuleCombiningAlg, _setRuleCombiningAlg, 
-                                doc="Rule Combining algorithm")
     
     @classmethod
@@ -168 +165 @@
                             'attribute; got %r' % type(value))
             
-        if value not in Policy.RULE_COMBINING_ALG_IDS:
-            raise AttributeError('%r rule combining algorithm is invalid.  '
-                                 'Only these algorithms are currently '
-                                 'supported %r' % 
-                                 (value, Policy.RULE_COMBINING_ALG_IDS))
         self.__ruleCombiningAlgId = value
-        
+        self._setRuleCombiningAlgFromId()
+        
+    def _setRuleCombiningAlgFromId(self):
+        """Set the rule combining algorithm implementation from the Id set
+        """
         # Look-up rule combining algorithm
-        self.__ruleCombiningAlg = self.__ruleCombiningAlgFactory(
+        ruleCombiningAlgClass = self.__ruleCombiningAlgFactory(
                                                     self.__ruleCombiningAlgId)
+        if not issubclass(ruleCombiningAlgClass, RuleCombiningAlgInterface):
+            raise TypeError('Expecting %r derived type for rule combining '
+                            'algorithm class; got %r' %
+                            (RuleCombiningAlgInterface, ruleCombiningAlgClass))
+            
+        self.__ruleCombiningAlg = ruleCombiningAlgClass()
+        if self.__ruleCombiningAlg is NotImplemented:
+            raise UnsupportedStdFunctionError('The rule combining algorithm %r '
+                                              'is not currently implemented' % 
+                                              self.__ruleCombiningAlgId)
+            
+        elif self.__ruleCombiningAlg is None:
+            raise UnsupportedFunctionError('%r is not recognised as a valid '
+                                           'XACML rule combining algorithm' % 
+                                           self.__ruleCombiningAlgId) 
 
     ruleCombiningAlgId = property(_getRuleCombiningAlgId, 
                                   _setRuleCombiningAlgId, None, 
                                   doc="Rule Combining Algorithm Id")
-
 
     @property
@@ -241 +251 @@
                               None, 
                               "Policy PolicyDefaults element")   
-    def parse(self):
-        """Parse the policy file set in policyFilePath attribute
-        """
-        elem = ElementTree.parse(self.policyFilePath)
-        root = elem.getroot()
-        
-        self.xmlns = QName.getNs(root.tag)
-        if not self.isValidXmlns:
-            raise InvalidPolicyXmlNsError("Namespace %r is recognised; valid "
-                                          "namespaces are: %r" %
-                                          (self.xmlns, Policy.XMLNS))
-            
-        for elem in root:
-            localName = QName.getLocalPart(elem.tag)
-            if localName == Policy.DESCRIPTION_LOCALNAME:
-                self.description = elem.text.strip()
-                
-            elif localName == Policy.TARGET_LOCALNAME:
-                self.targets.append(Target.Parse(elem))
-                
-            else:
-                raise PolicyParseError("Invalid policy attribute: %s" % 
-                                        localName)
-                
-    @classmethod
-    def Parse(cls, policyFilePath):
-        policy = cls(policyFilePath=policyFilePath)
-        policy.parse()
-        return policy
-
-
+
+

TI12-security/trunk/NDG_XACML/ndg/xacml/core/rule_combining_alg.py

@@ -50 +50 @@
 
 
-class PermitOverridesRuleCombingAlg(RuleCombiningAlgInterface):
+class PermitOverridesRuleCombiningAlg(RuleCombiningAlgInterface):
     """Implementation of permit overrides XACML rule combining algorithm"""
     
@@ -70 +70 @@
         atLeastOneDeny = False
         
-        for rule in rules:   
+        for rule in rules:
             decision = rule.evaluate(context)
             if decision == Decision.DENY:
@@ -105 +105 @@
     """Class Factory mapping Rule Combining Algorithm identifiers to their
     class implementations"""
+    
+    # All algorithms are not implemented by default(!)
     DEFAULT_MAP = {}.fromkeys(ALGORITHMS, NotImplemented)
+    
+    # Permit overrides is the only one currently implemented
     DEFAULT_MAP[
         'urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides'
-        ] = PermitOverridesRuleCombingAlg
+        ] = PermitOverridesRuleCombiningAlg
     
     def __init__(self, map=DEFAULT_MAP):
@@ -116 +120 @@
     def __call__(self, identifier):
         """Return the class for a given Rule Combining Algorithm identifier
+        @param identifier: XACML rule combining algorithm urn
+        @type identifier: basestring
+        @return: rule combining class corresponding to the given input
+        identifier
+        @rtype: RuleCombiningAlgInterface derived type or NoneType if no match 
+        is found or NotImplementedType if the identifier corresponds to a valid 
+        XACML rule combining algorithm but is not supported in this 
+        implementation
         """
-        self.__map.get(identifier)
+        return self.__map.get(identifier)