source: TI12-security/trunk/NDG_XACML/ndg/xacml/core/policy.py @ 6825

"""NDG Security Policy type definition

NERC DataGrid Project
"""
__author__ = "P J Kershaw"
__date__ = "24/02/10"
__copyright__ = "(C) 2010 Science and Technology Facilities Council"
__contact__ = "Philip.Kershaw@stfc.ac.uk"
__license__ = "BSD - see LICENSE file in top-level directory"
__contact__ = "Philip.Kershaw@stfc.ac.uk"
__revision__ = "$Id: $"
import traceback
import logging
log = logging.getLogger(__name__)

from ndg.xacml.utils import TypedList
from ndg.xacml.parsers import AbstractReaderFactory, AbstractReader
from ndg.xacml.core import XacmlCoreBase
from ndg.xacml.core.policydefaults import PolicyDefaults
from ndg.xacml.core.target import Target
from ndg.xacml.core.rule import Rule
from ndg.xacml.core.obligation import Obligation
from ndg.xacml.core.rule_combining_alg import (RuleCombiningAlgClassFactory,
                                               RuleCombiningAlgInterface)
from ndg.xacml.core.exceptions import (UnsupportedStdFunctionError,
                                       UnsupportedFunctionError)

# Evaluation of a request context
from ndg.xacml.core.context.response import Response
from ndg.xacml.core.context.result import Result, Decision, StatusCode
from ndg.xacml.core.context.exceptions import XacmlContextError


class PolicyParseError(Exception):
    """Error reading policy attributes from file"""


class InvalidPolicyXmlNsError(PolicyParseError):
    """Invalid XML namespace for policy document"""


class Policy(XacmlCoreBase):
    """NDG MSI Policy.""" 
    DEFAULT_XACML_VERSION = "1.0"
    ELEMENT_LOCAL_NAME = "Policy"
    POLICY_ID_ATTRIB_NAME = "PolicyId"
    RULE_COMBINING_ALG_ID_ATTRIB_NAME = "RuleCombiningAlgId"
    VERSION_ATTRIB_NAME = "Version"

    DESCRIPTION_LOCAL_NAME = "Description"
    POLICY_DEFAULTS_LOCAL_NAME = "PolicyDefaults"
    COMBINER_PARAMETERS_LOCAL_NAME = "CombinerParameters"
    RULE_COMBINER_PARAMETERS_LOCAL_NAME = "RuleCombinerParameters"
    OBLIGATIONS_LOCAL_NAME = "Obligations"
    
    __slots__ = (
        '__policyId',
        '__version',
        '__ruleCombiningAlgId',
        '__description',
        '__policyDefaults',
        '__target',
        '__attr',
        '__obligations',
        '__ruleCombiningAlgFactory',
        '__ruleCombiningAlg'
    )
    
    def __init__(self, ruleCombiningAlgFactory=None):
        """Customise rule combining behaviour by passing in a custom combining
        algorithm factory.  This is invoked when the combining algorithm Id
        property is set in order to create the corresponding combining algorithm
        object
        """
        super(Policy, self).__init__()
        self.__policyId = None
        self.__version = None
        self.__ruleCombiningAlgId = None
        self.__description = None
        self.__target = None
        
        # Attr should eventually allow a choice of Rule, CombinerParameter, 
        # RuleCombinerParameter and VariableDefinition but only Rule type is 
        # currently supported
        self.__attr = TypedList(Rule)
        
        self.__obligations = TypedList(Obligation)
        
        self.__ruleCombiningAlgFactory = None
        if ruleCombiningAlgFactory is None:
            self.ruleCombiningAlgFactory = RuleCombiningAlgClassFactory()
        else:
            self.ruleCombiningAlgFactory = ruleCombiningAlgFactory

        self.__ruleCombiningAlg = None

    def _getRuleCombiningAlgFactory(self):
        return self.__ruleCombiningAlgFactory

    def _setRuleCombiningAlgFactory(self, value):
        if not isinstance(value, RuleCombiningAlgClassFactory):
            raise TypeError('Expecting %r derived type for '
                            '"ruleCombiningAlgFactory" attibute; got %r' % 
                            (RuleCombiningAlgClassFactory, type(value)))
            
        self.__ruleCombiningAlgFactory = value

    ruleCombiningAlgFactory = property(_getRuleCombiningAlgFactory, 
                                       _setRuleCombiningAlgFactory, 
                                       doc="Rule Combining Algorithm Factory")
    
    @property
    def ruleCombiningAlg(self):
        "Rule Combining algorithm"
        return self.__ruleCombiningAlg
    
    @classmethod
    def fromSource(cls, source, readerFactory):
        """Create a new policy from the input source parsing it using a 
        reader from the required reader factory e.g. ETreeReaderFactory to use
        ElementTree based parsing
        
        @param source: source from which to read the policy - file path,
        file object, XML node or other dependent on the reader factory selected
        @type source: string, file, XML node type
        @param readerFactory: factory class returns reader class used to parse 
        the policy
        @type readerFactory: ndg.xacml.parsers.AbstractReaderFactory
        @return: new policy instance
        @rtype: ndg.xacml.core.policy.Policy
        """
        if not issubclass(readerFactory, AbstractReaderFactory):
            raise TypeError('Expecting %r derived class for reader factory '
                            'method; got %r' % (AbstractReaderFactory, 
                                                readerFactory))
            
        reader = readerFactory.getReader(cls)
        if not issubclass(reader, AbstractReader):
            raise TypeError('Expecting %r derived class for reader class; '
                            'got %r' % (AbstractReader, reader))
            
        return reader.parse(source)
        
    def _getPolicyId(self):
        return self.__policyId

    def _setPolicyId(self, value):
        if not isinstance(value, basestring):
            raise TypeError('Expecting string type for "policyId" '
                            'attribute; got %r' % type(value))
            
        self.__policyId = value

    policyId = property(_getPolicyId, _setPolicyId, None, "Policy Id")

    def _getVersion(self):
        return self.__version

    def _setVersion(self, value):
        if not isinstance(value, basestring):
            raise TypeError('Expecting string type for "version" '
                            'attribute; got %r' % type(value))
            
        self.__version = value

    version = property(_getVersion, _setVersion, None, "Policy Version")

    def _getRuleCombiningAlgId(self):
        return self.__ruleCombiningAlgId

    def _setRuleCombiningAlgId(self, value):
        if not isinstance(value, basestring):
            raise TypeError('Expecting string type for "ruleCombiningAlgId" '
                            'attribute; got %r' % type(value))
            
        self.__ruleCombiningAlgId = value
        self._setRuleCombiningAlgFromId()
        
    def _setRuleCombiningAlgFromId(self):
        """Set the rule combining algorithm implementation from the Id set
        """
        # Look-up rule combining algorithm
        ruleCombiningAlgClass = self.__ruleCombiningAlgFactory(
                                                    self.__ruleCombiningAlgId)
        if not issubclass(ruleCombiningAlgClass, RuleCombiningAlgInterface):
            raise TypeError('Expecting %r derived type for rule combining '
                            'algorithm class; got %r' %
                            (RuleCombiningAlgInterface, ruleCombiningAlgClass))
            
        self.__ruleCombiningAlg = ruleCombiningAlgClass()
        if self.__ruleCombiningAlg is NotImplemented:
            raise UnsupportedStdFunctionError('The rule combining algorithm %r '
                                              'is not currently implemented' % 
                                              self.__ruleCombiningAlgId)
            
        elif self.__ruleCombiningAlg is None:
            raise UnsupportedFunctionError('%r is not recognised as a valid '
                                           'XACML rule combining algorithm' % 
                                           self.__ruleCombiningAlgId) 

    ruleCombiningAlgId = property(_getRuleCombiningAlgId, 
                                  _setRuleCombiningAlgId, None, 
                                  doc="Rule Combining Algorithm Id")

    @property
    def combinerParameters(self):
        raise NotImplementedError()
    
    @property
    def ruleCombinerParameters(self):
        raise NotImplementedError()
    
    @property
    def variableDefinitions(self):
        raise NotImplementedError()
    
    @property
    def rules(self):
        return self.__attr
    
    @property
    def obligations(self):
        return self.__obligations 

    def _getTarget(self):
        return self.__target

    def _setTarget(self, value):
        if not isinstance(value, Target):
            raise TypeError('Expecting Target for "target" '
                            'attribute; got %r' % type(value))
        self.__target = value

    target = property(_getTarget, _setTarget, doc="list of Policy targets")

    def _getDescription(self):
        return self.__description

    def _setDescription(self, value):
        if not isinstance(value, basestring):
            raise TypeError('Expecting string type for "description" '
                            'attribute; got %r' % type(value))
        self.__description = value

    description = property(_getDescription, _setDescription, 
                           doc="Policy Description text")

    def _getPolicyDefaults(self):
        return self.__policyDefaults

    def _setPolicyDefaults(self, value):
        if not isinstance(value, PolicyDefaults):
            raise TypeError('Expecting string type for "policyDefaults" '
                            'attribute; got %r' % type(value))
            
        self.__policyDefaults = value

    policyDefaults = property(_getPolicyDefaults, 
                              _setPolicyDefaults, 
                              None, 
                              "Policy PolicyDefaults element")   

    def evaluate(self, request):
        """Make an access control decision for the given request based on this
        policy
        
        @param request: XACML request context
        @type request: ndg.xacml.core.context.request.Request
        @return: XACML response instance
        @rtype: ndg.xacml.core.context.response.Response
        """
        response = Response()
        result = Result.createInitialised(decision=Decision.NOT_APPLICABLE)
        response.results.append(result)
            
        # Exception block around all rule processing in order to set
        # INDETERMINATE response from any exceptions raised
        try:
            log.debug('Checking policy %r target for match with request...',
                      self.policyId)
            
            target = self.target
            
            # If no target is set, ALL requests are counted as matches
            if target is not None:
                if not target.match(request):
                    # The target didn't match so the whole policy does not apply
                    # to this request
                    log.debug('No match for policy target setting %r decision',
                              Decision.NOT_APPLICABLE_STR)
                    
                    result.decision = Decision.NOT_APPLICABLE
                    return response
            
            log.debug('Request matches the Policy %r target', self.policyId)
            
            # Apply the rule combining algorithm here combining the 
            # effects from the rules evaluated into an overall decision
            result.decision = self.ruleCombiningAlg.evaluate(self.rules,
                                                             request)
        except XacmlContextError, e:
            log.error('Exception raised evaluating request context, returning '
                      '%r decision:%s', 
                      e.response.results[0].decision, 
                      traceback.format_exc())
            
            result = e.response.results[0]
            
        except Exception:
            # Catch all so that nothing is handled from within the scope of this
            # method
            log.error('No PDPError type exception raised evaluating request '
                      'context, returning %r decision:%s', 
                      Decision.INDETERMINATE_STR, 
                      traceback.format_exc()) 
                       
            result.decision = Decision.INDETERMINATE
            result.status.statusCode.value = StatusCode.PROCESSING_ERROR
            
        return response