source: TI12-security/trunk/NDG_XACML/ndg/xacml/core/context/pdp.py @ 6777

"""NDG Security Policy Decision Point type definition

NERC DataGrid Project
"""
__author__ = "P J Kershaw"
__date__ = "25/02/10"
__copyright__ = "(C) 2010 Science and Technology Facilities Council"
__contact__ = "Philip.Kershaw@stfc.ac.uk"
__license__ = "BSD - see LICENSE file in top-level directory"
__contact__ = "Philip.Kershaw@stfc.ac.uk"
__revision__ = "$Id: $"
import logging
log = logging.getLogger(__name__)

import traceback

from ndg.xacml.core.context.pdpinterface import PDPInterface
from ndg.xacml.core.policy import Policy
from ndg.xacml.core.context.request import Request
from ndg.xacml.core.context.response import Response
from ndg.xacml.core.context.result import Result, Decision
from ndg.xacml.core.functions import FunctionMap
from ndg.xacml.parsers import AbstractReader
                            
        
class PDP(PDPInterface):
    """A XACML Policy Decision Point implementation.  It supports the use of a 
    single policy but not policy sets
    """
    __slots__ = ('__policy',)
    TARGET_CHILD_ATTRS = ('subjects', 'resources', 'actions', 'environments')
    
    def __init__(self, policy=None):
        """
        @param policy: policy object for PDP to use to apply access control
        decisions, may be omitted.
        @type policy: ndg.xacml.core.policy.Policy / None
        """
        self.__policy = None
        if policy is not None:
            self.policy = policy
            
        self.matchFunc = FunctionMap.withLoadedMap()

        
    @classmethod
    def fromPolicySource(cls, source, readerFactory):
        """Create a new PDP instance with a given policy
        @param source: source for policy
        @type source: type (dependent on the reader set, it could be for example
        a file path string, file object, XML element instance)
        @param readerFactory: reader factory returns the reader to use to read 
        this policy
        @type readerFactory: ndg.xacml.parsers.AbstractReader derived type
        """           
        pdp = cls()
        pdp.policy = Policy.fromSource(source, readerFactory)
        return pdp
    
    @property
    def policy(self):
        """policy object for PDP to use to apply access control decisions"""
        return self.__policy
    
    @policy.setter
    def policy(self, value):
        '''policy object for PDP to use to apply access control decisions'''
        if not isinstance(value, Policy):
            raise TypeError('Expecting %r derived type for "policy" input; got '
                            '%r instead' % (Policy, type(value)))
        self.__policy = value
                    
    def evaluate(self, request):
        """Make an access control decision for the given request based on the
        policy set
        
        @param request: XACML request context
        @type request: ndg.xacml.core.context.request.Request
        @return: XACML response instance
        @rtype: ndg.xacml.core.context.response.Response
        """
        response = Response()
        result = Result()
        response.results.append(result)
        result.decision = Decision.NOT_APPLICABLE
        
        if not isinstance(request, Request):
            log.error('Expecting %r derived type for "reader" input; got '
                      '%r instead' % Request, type(request))
            result.decision = Decision.INDETERMINATE
            return response
            
        # Exception block around all rule processing in order to set
        # INDETERMINATE response from any exceptions raised
        try:
            log.debug('Checking policy target for match...')
            
            if not self.matchTarget(self.policy.target, request):
                log.debug('No match for policy target setting Decision=%s',
                          Decision.NOT_APPLICABLE_STR)
                
                result.decision = Decision.NOT_APPLICABLE
                return response
            
            # Check rules
            for rule in self.policy.rules:
                log.debug('Checking policy rule %r for match...', rule.id)
                if not self.matchTarget(rule.target, request):
                    log.debug('No match to request context for target in rule '
                              '%r', rule.id)
                    continue         
        except:
            log.error('Exception raised evaluating request context, returning '
                      'Decision=%s:%s', 
                      Decision.INDETERMINATE_STR, 
                      traceback.format_exc())
            result.decision = Decision.INDETERMINATE
            
        return response
            
    def matchTarget(self, target, request):
        """Generic method to match a <Target> element to the request context
        
        @param target: XACML target element
        @type target: ndg.xacml.core.target.Target
        @param request: XACML request context
        @type request: ndg.xacml.core.context.request.Request
        @return: True if request context matches the given target, 
        False otherwise
        @rtype: bool
        """
        if target is None:
            log.debug('No target set so no match with request context')
            return False
        
        # From section 5.5 of the XACML 2.0 Core Spec:
        #
        # For the parent of the <Target> element to be applicable to the 
        # decision request, there MUST be at least one positive match between 
        # each section of the <Target> element and the corresponding section of 
        # the <xacml-context:Request> element.       
        for i in self.__class__.TARGET_CHILD_ATTRS:
            for targetChild in getattr(target, i):
                for requestChild in getattr(request, i):
                    if self.matchTargetChild(targetChild, requestChild):
                        return True
 
        return False
    
    def matchTargetChild(self, targetChild, requestChild):
        """Match a child (Subject, Resource, Action or Environment) from the 
        request context with a given target's child
        
        @param targetChild: Target Subject, Resource, Action or Environment
        object
        @type targetChild: ndg.xacml.core.TargetChildBase
        @param requestChild: Request Subject, Resource, Action or Environment
        object
        @type requestChild: ndg.xacml.core.context.RequestChildBase
        @return: True if request context matches something in the target
        @rtype: bool
        @raise NotImplementedError: AttributeSelector processing is not 
        currently supported.  If an AttributeSelector is found in the policy,
        this exception will be raised.
        """
        if targetChild is None:
            # Default if target child is not set is to match all children
            return True
        
        for childMatch in targetChild.matches:
            # Get the match function from the Match ID
            matchFunc = self.matchFunc.get(childMatch.matchId)
            if matchFunc is NotImplemented:
                raise NotImplementedError('No match function implemented for '
                                          'MatchId="%s"' % childMatch.matchId)
                
            if matchFunc is None:
                raise Exception('Match function namespace %r is not recognised' 
                                % childMatch.matchId)
                
            matchAttributeValue = childMatch.attributeValue.value
            
            # Create a match function based on the presence or absence of an
            # AttributeDesignator or AttributeSelector
            if childMatch.attributeDesignator is not None:
                attributeId = childMatch.attributeDesignator.attributeId
                dataType = childMatch.attributeDesignator.dataType
                
                _attributeMatch = lambda requestChildAttribute: (
                    matchFunc(matchAttributeValue, 
                              requestChildAttribute.attributeValue.value) and
                    requestChildAttribute.attributeId == attributeId and
                    requestChildAttribute.dataType == dataType 
                )
                
            elif childMatch.attributeSelector is not None:
                # Nb. This will require that the request provide a reference to
                # it's XML representation and an abstraction of the XML parser
                # for executing XPath searches into that representation
                raise NotImplementedError('This PDP implementation does not '
                                          'support <AttributeSelector> '
                                          'elements')
            else:
                _attributeMatch = lambda requestChildAttribute: (
                    matchFunc(matchAttributeValue, 
                              requestChildAttribute.attributeValue.value)
                )
                
            for attribute in requestChild.attributes:
                if _attributeMatch(attribute):
                    return True
                    
        return False