예제 #1
0
파일: PolicySet.cs 프로젝트: zszqwe/anycmd
        /// <summary>
        /// Evaluates the policy set.
        /// </summary>
        /// <param name="context">The evaluation context instance.</param>
        /// <returns>The decission result for this policy set.</returns>
        public Decision Evaluate(EvaluationContext context)
        {
            if (context == null)
            {
                throw new ArgumentNullException("context");
            }
            context.Trace("Evaluating policySet: {0}", _policySet.Description);
            context.CurrentPolicySet = this;
            try
            {
                context.Trace("Evaluating Target...");
                context.AddIndent();

                // Evaluate the policy target
                TargetEvaluationValue targetEvaluationValue = Match(context);

                context.RemoveIndent();
                context.Trace("Target: {0}", targetEvaluationValue);

                ProcessTargetEvaluationValue(context, targetEvaluationValue);

                context.Trace("PolicySet: {0}", _evaluationValue);

                // If the policy evaluated to Deny or Permit add the obligations depending on its fulfill value.
                ProcessObligations(context);

                return(_evaluationValue);
            }
            finally
            {
                context.CurrentPolicySet = null;
            }
        }
예제 #2
0
        /// <summary>
        /// Match the target of this policy.
        /// </summary>
        /// <param name="context">The evaluation context instance.</param>
        /// <returns>The retult evaluation of the policy target.</returns>
        public TargetEvaluationValue Match(EvaluationContext context)
        {
            if (context == null)
            {
                throw new ArgumentNullException("context");
            }
            TargetEvaluationValue targetEvaluationValue = TargetEvaluationValue.Indeterminate;

            context.Trace("Evaluating Target...");
            context.AddIndent();
            try
            {
                // Evaluate the policy target
                targetEvaluationValue = TargetEvaluationValue.Match;
                if (_target != null)
                {
                    targetEvaluationValue = _target.Evaluate(context);
                }
                return(targetEvaluationValue);
            }
            finally
            {
                context.TraceContextValues();
                context.RemoveIndent();
                context.Trace("Target: {0}", targetEvaluationValue);
            }
        }
예제 #3
0
        /// <summary>
        /// Evaluates the rule contents.
        /// </summary>
        /// <param name="context">The evaluation context instance.</param>
        /// <returns>A decission for this evalauation.</returns>
        public Decision Evaluate(EvaluationContext context)
        {
            if (context == null)
            {
                throw new ArgumentNullException("context");
            }
            context.Trace("Evaluating rule: {0}", _rule.Description);
            context.AddIndent();
            context.CurrentRule = this;
            try
            {
                // Validate the Target element
                TargetEvaluationValue targetEvaluation = Match(context);

                // If the target matches the conditions ar evaluated
                EvaluationValue conditionEvaluation = EvaluationValue.True;
                if (_rule.HasCondition)
                {
                    // Evaluate the condition
                    conditionEvaluation = _condition.Evaluate(context);
                }
                else
                {
                    context.Trace("Rule does not have a condition");
                }

                // Decite the final rule evaluation value
                if (targetEvaluation == TargetEvaluationValue.Indeterminate || conditionEvaluation.IsIndeterminate)
                {
                    _evaluationValue = Decision.Indeterminate;
                }
                else if (targetEvaluation == TargetEvaluationValue.Match && conditionEvaluation.BoolValue)
                {
                    _evaluationValue = ((_rule.Effect == pol.Effect.Permit) ? Decision.Permit : Decision.Deny);
                }
                else if ((targetEvaluation == TargetEvaluationValue.NoMatch) ||
                         (targetEvaluation == TargetEvaluationValue.Match && !conditionEvaluation.BoolValue))
                {
                    _evaluationValue = Decision.NotApplicable;
                }

                // Return the value
                context.Trace("Rule: {0}", _evaluationValue);
                return(_evaluationValue);
            }
            finally
            {
                context.RemoveIndent();
                context.CurrentRule = null;
            }
        }
예제 #4
0
        /// <summary>
        /// Match the target of this policy set.
        /// </summary>
        /// <param name="context">The evaluation context instance.</param>
        /// <returns>The retult evaluation of the policy set target.</returns>
        public TargetEvaluationValue Match(EvaluationContext context)
        {
            if (context == null)
            {
                throw new ArgumentNullException("context");
            }
            // Evaluate the policy target
            TargetEvaluationValue targetEvaluationValue = TargetEvaluationValue.Match;

            if (_target != null)
            {
                targetEvaluationValue = _target.Evaluate(context);
                context.TraceContextValues();
            }
            return(targetEvaluationValue);
        }
예제 #5
0
파일: PolicySet.cs 프로젝트: zszqwe/anycmd
        /// <summary>
        /// Process the match result.
        /// </summary>
        /// <param name="context">The evaluation context instance.</param>
        /// <param name="targetEvaluationValue">The match evaluation result.</param>
        private void ProcessTargetEvaluationValue(EvaluationContext context, TargetEvaluationValue targetEvaluationValue)
        {
            if (targetEvaluationValue == TargetEvaluationValue.Match)
            {
                try
                {
                    context.Trace("Evaluating policies...");
                    context.AddIndent();

                    context.Trace("Policy combination algorithm: {0}", _policySet.PolicyCombiningAlgorithm);

                    // Evaluate all policies and apply rule combination
                    IPolicyCombiningAlgorithm pca = EvaluationEngine.CreatePolicyCombiningAlgorithm(_policySet.PolicyCombiningAlgorithm);

                    if (pca == null)
                    {
                        throw new EvaluationException("the policy combining algorithm does not exists."); //TODO: resources
                    }

                    _evaluationValue = pca.Evaluate(context, _policies);

                    // Update the flags for general evaluation status.
                    context.TraceContextValues();

                    context.Trace("Policy combination algorithm: {0}", _evaluationValue.ToString());
                }
                finally
                {
                    context.RemoveIndent();
                }
            }
            else if (targetEvaluationValue == TargetEvaluationValue.NoMatch)
            {
                _evaluationValue = Decision.NotApplicable;
            }
            else if (targetEvaluationValue == TargetEvaluationValue.Indeterminate)
            {
                _evaluationValue = Decision.Indeterminate;
            }
        }
예제 #6
0
        /// <summary>
        /// Matches this target instance using the context document.
        /// </summary>
        /// <param name="context">The evaluation context instance.</param>
        /// <returns>The results of the evaluation of this target.</returns>
        public TargetEvaluationValue Evaluate(EvaluationContext context)
        {
            if (context == null)
            {
                throw new ArgumentNullException("context");
            }
            // Set the default value.
            _evaluationValue = TargetEvaluationValue.NoMatch;

            // Resource
            context.Trace("Evaluating Resource...");
            context.AddIndent();

            TargetEvaluationValue resourceEval = _resources.Evaluate(context, context.CurrentResource);

            context.TraceContextValues();
            context.Trace("Target item result: {0}", resourceEval);
            context.RemoveIndent();

            // Action
            context.Trace("Evaluating Action...");
            context.AddIndent();

            TargetEvaluationValue actionEval = _actions.Evaluate(context, context.ContextDocument.Request.Action);

            context.TraceContextValues();
            context.Trace("Target item result: {0}", actionEval);
            context.RemoveIndent();

            context.Trace("Evaluating Subjects...");
            context.AddIndent();
            if (actionEval == TargetEvaluationValue.Match && resourceEval == TargetEvaluationValue.Match)
            {
                // Subjects
                foreach (ctx.SubjectElement ctxSubject in context.ContextDocument.Request.Subjects)
                {
                    context.Trace("Evaluating Subject: {0}", ctxSubject.SubjectCategory);

                    // Subject
                    TargetEvaluationValue subjectEval = _subjects.Evaluate(context, ctxSubject);

                    context.TraceContextValues();
                    if (subjectEval == TargetEvaluationValue.Indeterminate)
                    {
                        _evaluationValue = TargetEvaluationValue.Indeterminate;
                    }
                    else if (subjectEval == TargetEvaluationValue.Match)
                    {
                        _evaluationValue = TargetEvaluationValue.Match;
                        context.RemoveIndent();
                        context.Trace("Target item result: {0}", _evaluationValue);
                        return(_evaluationValue);
                    }
                }
                context.RemoveIndent();
                context.Trace("Target item result: {0}", _evaluationValue);
                return(_evaluationValue);
            }
            else
            {
                context.Trace("Actions or Resources does not Match so Subjects will not be evaluated");
                if (resourceEval == TargetEvaluationValue.Indeterminate || actionEval == TargetEvaluationValue.Indeterminate)
                {
                    context.RemoveIndent();
                    return(TargetEvaluationValue.Indeterminate);
                }
                else
                {
                    context.RemoveIndent();
                    return(TargetEvaluationValue.NoMatch);
                }
            }
        }
예제 #7
0
        /// <summary>
        /// Evaluates the policy.
        /// </summary>
        /// <param name="context">The evaluation context instance.</param>
        /// <returns>The decission result for this policy.</returns>
        public Decision Evaluate(EvaluationContext context)
        {
            if (context == null)
            {
                throw new ArgumentNullException("context");
            }
            context.Trace("Evaluating policy: {0}", _policy.Description);
            context.AddIndent();
            context.CurrentPolicy = this;
            try
            {
                // Evaluate the variables
                if (this._policy.SchemaVersion == XacmlVersion.Version20)
                {
                    if (_variables == null)
                    {
                        context.Trace("Evaluating variables...");
                        _variables = new Hashtable();

                        foreach (pol.VariableDefinitionElement variableDef in _policy.VariableDefinitions.Values)
                        {
                            VariableDefinition variable = new VariableDefinition(variableDef);
                            _variables.Add(variableDef.Id, variable);
                        }
                    }
                }

                // Matches the target.
                TargetEvaluationValue targetEvaluationValue = Match(context);

                // If the target matches.
                if (targetEvaluationValue == TargetEvaluationValue.Match)
                {
                    context.Trace("Rule combination algorithm: {0}", _policy.RuleCombiningAlgorithm);

                    // Evaluate all rules and apply rule combination
                    inf.IRuleCombiningAlgorithm rca = EvaluationEngine.CreateRuleCombiningAlgorithm(_policy.RuleCombiningAlgorithm);
                    _evaluationValue = rca.Evaluate(context, _rules);
                }
                else if (targetEvaluationValue == TargetEvaluationValue.NoMatch)
                {
                    _evaluationValue = Decision.NotApplicable;
                }
                else if (targetEvaluationValue == TargetEvaluationValue.Indeterminate)
                {
                    _evaluationValue = Decision.Indeterminate;
                }

                context.Trace("Policy: {0}", _evaluationValue);

                // Copy all the obligations.
                _obligations = new pol.ObligationCollection();
                if (_evaluationValue != Decision.Indeterminate &&
                    _evaluationValue != Decision.NotApplicable &&
                    _policy.Obligations != null && _policy.Obligations.Count != 0)
                {
                    foreach (pol.ObligationElement obl in _policy.Obligations)
                    {
                        if ((obl.FulfillOn == pol.Effect.Deny && _evaluationValue == Decision.Deny) ||
                            (obl.FulfillOn == pol.Effect.Permit && _evaluationValue == Decision.Permit))
                        {
                            context.Trace("Adding obligation: {0} ", obl.ObligationId);
                            _obligations.Add(obl);
                        }
                    }
                }

                return(_evaluationValue);
            }
            finally
            {
                context.RemoveIndent();
                context.CurrentPolicy = null;
            }
        }
예제 #8
0
파일: Target.cs 프로젝트: Condeti/XACML.NET
		/// <summary>
		/// Matches this target instance using the context document.
		/// </summary>
		/// <param name="context">The evaluation context instance.</param>
		/// <returns>The results of the evaluation of this target.</returns>
		public TargetEvaluationValue Evaluate( EvaluationContext context )
		{
            if (context == null) throw new ArgumentNullException("context");
			// Set the default value.
			_evaluationValue = TargetEvaluationValue.NoMatch;

			// Resource
			context.Trace( "Evaluating Resource..." );
			context.AddIndent();

			TargetEvaluationValue resourceEval = _resources.Evaluate( context, context.CurrentResource );

			context.TraceContextValues();
			context.Trace( "Target item result: {0}", resourceEval );
			context.RemoveIndent();			

			// Action
			context.Trace( "Evaluating Action..." );
			context.AddIndent();

			TargetEvaluationValue actionEval = _actions.Evaluate( context, context.ContextDocument.Request.Action );

			context.TraceContextValues();
			context.Trace( "Target item result: {0}", actionEval );
			context.RemoveIndent();

			context.Trace( "Evaluating Subjects..." );
			context.AddIndent();
			if( actionEval == TargetEvaluationValue.Match && resourceEval == TargetEvaluationValue.Match )
			{
				// Subjects
				foreach( ctx.SubjectElement ctxSubject in context.ContextDocument.Request.Subjects )
				{
					context.Trace( "Evaluating Subject: {0}", ctxSubject.SubjectCategory );

					// Subject
					TargetEvaluationValue subjectEval = _subjects.Evaluate( context, ctxSubject );

					context.TraceContextValues();
					if( subjectEval == TargetEvaluationValue.Indeterminate )
					{
						_evaluationValue = TargetEvaluationValue.Indeterminate;
					}
					else if( subjectEval == TargetEvaluationValue.Match )
					{
						_evaluationValue = TargetEvaluationValue.Match;
						context.RemoveIndent();
						context.Trace( "Target item result: {0}", _evaluationValue );
						return _evaluationValue;
					}
				}
				context.RemoveIndent();
				context.Trace( "Target item result: {0}", _evaluationValue );
				return _evaluationValue;
			}
			else
			{
				context.Trace( "Actions or Resources does not Match so Subjects will not be evaluated" );
				if( resourceEval == TargetEvaluationValue.Indeterminate || actionEval == TargetEvaluationValue.Indeterminate )
				{
					context.RemoveIndent();
					return TargetEvaluationValue.Indeterminate;
				}
				else
				{
					context.RemoveIndent();
					return TargetEvaluationValue.NoMatch;
				}
			}

		}
예제 #9
0
		/// <summary>
		/// Evaluates the target items and return wether the target applies to the context or not.
		/// </summary>
		/// <param name="context">The evaluation context instance.</param>
		/// <param name="targetItem">The target item in the context document.</param>
		/// <returns></returns>
		public TargetEvaluationValue Evaluate( EvaluationContext context, ctx.TargetItemBase targetItem )
		{
            if (context == null) throw new ArgumentNullException(nameof(context));
            if (_targetItems.IsAny)
            {
                context.Trace("IsAny");
                return TargetEvaluationValue.Match;
            }

            _evaluationValue = TargetEvaluationValue.NoMatch;

			//Match TargetItem
			foreach( pol.TargetItemBase polItem in _targetItems.ItemsList )
			{
				foreach( pol.TargetMatchBase match in polItem.Match )
				{
					_evaluationValue = TargetEvaluationValue.NoMatch;

					context.Trace( "Using function: {0}", match.MatchId );

					inf.IFunction matchFunction = EvaluationEngine.GetFunction( match.MatchId );
					if( matchFunction == null )
					{
						context.Trace( "ERR: function not found {0}", match.MatchId );
						context.ProcessingError = true;
						return TargetEvaluationValue.Indeterminate;
					}
				    if( matchFunction.Returns == null )
				    {
				        // Validates the function return value
				        context.Trace( "ERR: The function '{0}' does not defines it's return value", match.MatchId );
				        context.ProcessingError = true;
				        return TargetEvaluationValue.Indeterminate;
				    }
				    if( matchFunction.Returns != DataTypeDescriptor.Boolean )
				    {
				        context.Trace( "ERR: Function does not return Boolean a value" );
				        context.ProcessingError = true;
				        return TargetEvaluationValue.Indeterminate;
				    }
				    ctx.AttributeElement attribute = EvaluationEngine.Resolve( context, match, targetItem );

				    if( attribute != null )
				    {
				        context.Trace( "Attribute found, evaluating match function" );
				        try
				        {
				            EvaluationValue returnValue = EvaluationEngine.EvaluateFunction( context, matchFunction, match.AttributeValue, attribute );
				            _evaluationValue = returnValue.BoolValue ? TargetEvaluationValue.Match : TargetEvaluationValue.NoMatch;
				        }
				        catch( EvaluationException e )
				        {
				            context.Trace( Resource.TRACE_ERROR, e.Message ); 
				            _evaluationValue = TargetEvaluationValue.Indeterminate;
				        }
				    }

				    // Validate MustBePresent
				    if( match.AttributeReference.MustBePresent )
				    {
				        if( context.IsMissingAttribute )
				        {
				            context.Trace( "Attribute not found and must be present" );
				            _evaluationValue = TargetEvaluationValue.Indeterminate;
				        }
				    }

				    // Do not iterate if the value was found
				    if( _evaluationValue != TargetEvaluationValue.Match )
				    {
				        break;
				    }
				}

				// Do not iterate if the value was found
				if( _evaluationValue == TargetEvaluationValue.Match )
				{
					return _evaluationValue;
				}
			}

			return _evaluationValue;
		}
예제 #10
0
        /// <summary>
        /// Evaluates the target items and return wether the target applies to the context or not.
        /// </summary>
        /// <param name="context">The evaluation context instance.</param>
        /// <param name="targetItem">The target item in the context document.</param>
        /// <returns></returns>
        public virtual TargetEvaluationValue Evaluate(EvaluationContext context, ctx.TargetItemBase targetItem)
        {
            if (context == null)
            {
                throw new ArgumentNullException("context");
            }
            if (_targetItems.IsAny)
            {
                context.Trace("IsAny");
                return(TargetEvaluationValue.Match);
            }

            _evaluationValue = TargetEvaluationValue.NoMatch;

            //Match TargetItem
            foreach (TargetItemBase polItem in _targetItems.ItemsList)
            {
                foreach (TargetMatchBase match in polItem.Match)
                {
                    _evaluationValue = TargetEvaluationValue.NoMatch;

                    context.Trace("Using function: {0}", match.MatchId);

                    IFunction matchFunction = EvaluationEngine.GetFunction(match.MatchId);
                    if (matchFunction == null)
                    {
                        context.Trace("ERR: function not found {0}", match.MatchId);
                        context.ProcessingError = true;
                        return(TargetEvaluationValue.Indeterminate);
                    }
                    else if (matchFunction.Returns == null)
                    {
                        // Validates the function return value
                        context.Trace("ERR: The function '{0}' does not defines it's return value", match.MatchId);
                        context.ProcessingError = true;
                        return(TargetEvaluationValue.Indeterminate);
                    }
                    else if (matchFunction.Returns != DataTypeDescriptor.Boolean)
                    {
                        context.Trace("ERR: Function does not return Boolean a value");
                        context.ProcessingError = true;
                        return(TargetEvaluationValue.Indeterminate);
                    }
                    else
                    {
                        Context.AttributeElement attribute = EvaluationEngine.Resolve(context, match, targetItem);

                        if (attribute != null)
                        {
                            context.Trace("Attribute found, evaluating match function");
                            try
                            {
                                EvaluationValue returnValue = EvaluationEngine.EvaluateFunction(context, matchFunction, match.AttributeValue, attribute);
                                _evaluationValue = returnValue.BoolValue ? TargetEvaluationValue.Match : TargetEvaluationValue.NoMatch;
                            }
                            catch (EvaluationException e)
                            {
                                context.Trace("ERR: {0}", e.Message);
                                _evaluationValue = TargetEvaluationValue.Indeterminate;
                            }
                        }

                        // Validate MustBePresent
                        if (match.AttributeReference.MustBePresent)
                        {
                            if (context.IsMissingAttribute)
                            {
                                context.Trace("Attribute not found and must be present");
                                _evaluationValue = TargetEvaluationValue.Indeterminate;
                            }
                        }

                        if (context.ProcessingError)
                        {
                            _evaluationValue = TargetEvaluationValue.Indeterminate;
                        }

                        // Do not iterate if the value was found
                        if (_evaluationValue != TargetEvaluationValue.Match)
                        {
                            break;
                        }
                    }
                }

                // Do not iterate if the value was found
                if (_evaluationValue == TargetEvaluationValue.Match)
                {
                    return(_evaluationValue);
                }
            }

            return(_evaluationValue);
        }
예제 #11
0
        /// <summary>
        /// Process the match result.
        /// </summary>
        /// <param name="context">The evaluation context instance.</param>
        /// <param name="targetEvaluationValue">The match evaluation result.</param>
        private void ProcessTargetEvaluationValue(EvaluationContext context, TargetEvaluationValue targetEvaluationValue)
        {
            if (targetEvaluationValue == TargetEvaluationValue.Match)
            {
                try
                {
                    context.Trace("Evaluating policies...");
                    context.AddIndent();

                    context.Trace("Policy combination algorithm: {0}", _policySet.PolicyCombiningAlgorithm);

                    // Evaluate all policies and apply rule combination
                    inf.IPolicyCombiningAlgorithm pca = EvaluationEngine.CreatePolicyCombiningAlgorithm(_policySet.PolicyCombiningAlgorithm);

                    if (pca == null)
                    {
                        throw new EvaluationException("the policy combining algorithm does not exists."); //TODO: resources
                    }

                    _evaluationValue = pca.Evaluate(context, _policies);

                    // Update the flags for general evaluation status.
                    context.TraceContextValues();

                    context.Trace("Policy combination algorithm: {0}", _evaluationValue.ToString());
                }
                finally
                {
                    context.RemoveIndent();
                }
            }
            else if (targetEvaluationValue == TargetEvaluationValue.NoMatch)
            {
                _evaluationValue = Decision.NotApplicable;
            }
            else if (targetEvaluationValue == TargetEvaluationValue.Indeterminate)
            {
                _evaluationValue = Decision.Indeterminate;
            }
        }