Changeset 7050 for TI12-security/trunk/NDG_XACML/ndg/xacml/core/rule_combining_alg.py

Timestamp:

21/06/10 16:38:55 (11 years ago)

Author:

pjkersha

Message:

Incomplete - task 2: XACML-Security Integration

• added deny overrides rule implementation

File:

• TI12-security/trunk/NDG_XACML/ndg/xacml/core/rule_combining_alg.py (modified) (2 diffs)

TI12-security/trunk/NDG_XACML/ndg/xacml/core/rule_combining_alg.py

@@ -48 +48 @@
         """
         return Decision.INDETERMINATE
+
+class DenyOverridesRuleCombiningAlg(RuleCombiningAlgInterface):
+    """Deny overrides rule combining algorithm"""
+    
+    def evaluate(self, rules, context):
+        """Combine the input rule results to make an access control decision.
+        Implementation taken direct from XACML 2.0 spec. pseudo code - Section
+        C.1 Deny Overrides
+        
+        @param rules: rules from the policy.  Decisions from these will be put
+        together into a single decision by this algorithm
+        @type rules: TypedList(<ndg.xacml.core.rule.Rule>)
+        @param context: request context to apply to the rules
+        @type context: ndg.xacml.core.request.Request
+        @return: resulting overall access control decision
+        @rtype: ndg.xacml.core.context.result.Decision
+        """
+        atLeastOneError = False
+        potentialDeny = False
+        atLeastOnePermit = False
+        
+        for rule in rules:
+            decision = rule.evaluate(context)
+            if decision == Decision.DENY:
+                return Decision.DENY
+
+            if decision == Decision.PERMIT:
+                atLeastOnePermit = True
+                continue
+            
+            if decision == Decision.NOT_APPLICABLE:
+                continue
+            
+            if decision == Decision.INDETERMINATE:
+                atLeastOneError = True
+    
+                if effect(rule) == Decision.DENY:
+                    potentialDeny = True
+                    
+                continue
+
+        if potentialDeny:
+            return Decision.INDETERMINATE
+
+        elif atLeastOnePermit:
+            return Decision.PERMIT
+        
+        elif atLeastOneError:
+            return Decision.INDETERMINATE
+        else:
+            return Decision.NOT_APPLICABLE
 
 
@@ -110 +161 @@
     
     # Permit overrides is the only one currently implemented
-    DEFAULT_MAP[
-        'urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides'
-        ] = PermitOverridesRuleCombiningAlg
+    DEFAULT_MAP.update({
+    'urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides':
+        DenyOverridesRuleCombiningAlg,      
+    'urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides':
+        PermitOverridesRuleCombiningAlg
+    })
     
     def __init__(self, map=DEFAULT_MAP):