/// <summary> /// Match the target of this policy. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The retult evaluation of the policy target.</returns> public TargetEvaluationValue Match(EvaluationContext context) { if (context == null) { throw new ArgumentNullException("context"); } TargetEvaluationValue targetEvaluationValue = TargetEvaluationValue.Indeterminate; context.Trace("Evaluating Target..."); context.AddIndent(); try { // Evaluate the policy target targetEvaluationValue = TargetEvaluationValue.Match; if (_target != null) { targetEvaluationValue = _target.Evaluate(context); } return(targetEvaluationValue); } finally { context.TraceContextValues(); context.RemoveIndent(); context.Trace("Target: {0}", targetEvaluationValue); } }
/// <summary> /// Evaluates the policy set. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The decission result for this policy set.</returns> public Decision Evaluate(EvaluationContext context) { if (context == null) { throw new ArgumentNullException("context"); } context.Trace("Evaluating policySet: {0}", _policySet.Description); context.CurrentPolicySet = this; try { context.Trace("Evaluating Target..."); context.AddIndent(); // Evaluate the policy target TargetEvaluationValue targetEvaluationValue = Match(context); context.RemoveIndent(); context.Trace("Target: {0}", targetEvaluationValue); ProcessTargetEvaluationValue(context, targetEvaluationValue); context.Trace("PolicySet: {0}", _evaluationValue); // If the policy evaluated to Deny or Permit add the obligations depending on its fulfill value. ProcessObligations(context); return(_evaluationValue); } finally { context.CurrentPolicySet = null; } }
/// <summary> /// Evaluates the rule contents. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>A decission for this evalauation.</returns> public Decision Evaluate(EvaluationContext context) { if (context == null) { throw new ArgumentNullException("context"); } context.Trace("Evaluating rule: {0}", _rule.Description); context.AddIndent(); context.CurrentRule = this; try { // Validate the Target element TargetEvaluationValue targetEvaluation = Match(context); // If the target matches the conditions ar evaluated EvaluationValue conditionEvaluation = EvaluationValue.True; if (_rule.HasCondition) { // Evaluate the condition conditionEvaluation = _condition.Evaluate(context); } else { context.Trace("Rule does not have a condition"); } // Decite the final rule evaluation value if (targetEvaluation == TargetEvaluationValue.Indeterminate || conditionEvaluation.IsIndeterminate) { _evaluationValue = Decision.Indeterminate; } else if (targetEvaluation == TargetEvaluationValue.Match && conditionEvaluation.BoolValue) { _evaluationValue = ((_rule.Effect == pol.Effect.Permit) ? Decision.Permit : Decision.Deny); } else if ((targetEvaluation == TargetEvaluationValue.NoMatch) || (targetEvaluation == TargetEvaluationValue.Match && !conditionEvaluation.BoolValue)) { _evaluationValue = Decision.NotApplicable; } // Return the value context.Trace("Rule: {0}", _evaluationValue); return(_evaluationValue); } finally { context.RemoveIndent(); context.CurrentRule = null; } }
/// <summary> /// The evaluation implementation in the pseudo-code described in the specification. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <param name="rules">The policies that must be evaluated.</param> /// <returns>The final decission for the combination of the rule evaluation.</returns> public Decision Evaluate(EvaluationContext context, RuleCollection rules) { Decision decision = Decision.Indeterminate; context.Trace("Evaluating rules..."); context.AddIndent(); try { foreach (Rule rule in rules) { decision = rule.Evaluate(context); context.TraceContextValues(); if (decision == Decision.Deny) { decision = Decision.Deny; return(decision); } if (decision == Decision.Permit) { decision = Decision.Permit; return(decision); } if (decision == Decision.NotApplicable) { continue; } if (decision == Decision.Indeterminate) { decision = Decision.Indeterminate; return(decision); } } return(Decision.NotApplicable); } finally { context.Trace("Rule combination algorithm: {0}", decision.ToString()); context.RemoveIndent(); } }
/// <summary> /// Process the match result. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <param name="targetEvaluationValue">The match evaluation result.</param> private void ProcessTargetEvaluationValue(EvaluationContext context, TargetEvaluationValue targetEvaluationValue) { if (targetEvaluationValue == TargetEvaluationValue.Match) { try { context.Trace("Evaluating policies..."); context.AddIndent(); context.Trace("Policy combination algorithm: {0}", _policySet.PolicyCombiningAlgorithm); // Evaluate all policies and apply rule combination inf.IPolicyCombiningAlgorithm pca = EvaluationEngine.CreatePolicyCombiningAlgorithm(_policySet.PolicyCombiningAlgorithm); if (pca == null) { throw new EvaluationException("the policy combining algorithm does not exists."); //TODO: resources } _evaluationValue = pca.Evaluate(context, _policies); // Update the flags for general evaluation status. context.TraceContextValues(); context.Trace("Policy combination algorithm: {0}", _evaluationValue.ToString()); } finally { context.RemoveIndent(); } } else if (targetEvaluationValue == TargetEvaluationValue.NoMatch) { _evaluationValue = Decision.NotApplicable; } else if (targetEvaluationValue == TargetEvaluationValue.Indeterminate) { _evaluationValue = Decision.Indeterminate; } }
/// <summary> /// This method overrides the ApplyBase method in order to provide extra validations /// required in the condition evaluation, for example the final return value should be a /// boolean value. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The EvaluationValue with the results of the condition evaluation.</returns> public override EvaluationValue Evaluate( EvaluationContext context ) { if (context == null) throw new ArgumentNullException("context"); EvaluationValue _evaluationValue = null; context.Trace( "Evaluating condition..." ); context.AddIndent(); try { // Get the function instance inf.IFunction function = EvaluationEngine.GetFunction( ApplyDefinition.FunctionId ); if( function == null ) { context.Trace( "ERR: function not found {0}", ApplyDefinition.FunctionId ); context.ProcessingError = true; return EvaluationValue.Indeterminate; } // Validates the function return value if( function.Returns == null ) { context.Trace( "The function '{0}' does not defines it's return value", ApplyDefinition.FunctionId ); _evaluationValue = EvaluationValue.Indeterminate; context.ProcessingError = true; } else if( function.Returns != DataTypeDescriptor.Boolean ) { context.Trace( "Function does not return Boolean a value" ); _evaluationValue = EvaluationValue.Indeterminate; context.ProcessingError = true; } else { // Call the ApplyBase method to perform the evaluation. _evaluationValue = base.Evaluate( context ); } // Validate the results of the evaluation if( _evaluationValue.IsIndeterminate ) { context.Trace( "condition evaluated into {0}", _evaluationValue.ToString() ); return _evaluationValue; } if( !(_evaluationValue.Value is bool) ) { context.Trace( "condition evaluated into {0}", _evaluationValue.ToString() ); return EvaluationValue.Indeterminate; } if( _evaluationValue.BoolValue ) { context.Trace( "condition evaluated into {0}", _evaluationValue.ToString() ); return EvaluationValue.True; } else { // If the evaluation was false, validate if there was a missin attribute during // evaluation and return an Indeterminate, otherwise return the False value. if( context.IsMissingAttribute ) { context.Trace( "condition evaluated into {0}", _evaluationValue.ToString() ); return EvaluationValue.Indeterminate; } else { context.Trace( "condition evaluated into {0}", _evaluationValue.ToString() ); return EvaluationValue.False; } } } finally { context.TraceContextValues(); context.RemoveIndent(); context.Trace( "Condition: {0}", _evaluationValue.ToString() ); } }
/// <summary> /// Evaluates the variable into a value. /// </summary> /// <param name="context">The contex of the evaluation.</param> /// <returns>The value of the function.</returns> public EvaluationValue Evaluate( EvaluationContext context ) { if (context == null) throw new ArgumentNullException("context"); context.Trace( "Evaluating variable" ); context.AddIndent(); try { if( _variableDefinition.Expression is pol.ApplyElement ) { context.Trace( "Apply within condition." ); // There is a nested apply un this policy a new Apply will be created and also // evaluated. It's return value will be used as the processed argument. Apply _childApply = new Apply( (pol.ApplyElement)_variableDefinition.Expression ); // Evaluate the Apply _value = _childApply.Evaluate( context ); context.TraceContextValues(); return _value; } else if( _variableDefinition.Expression is pol.FunctionElement ) { throw new NotImplementedException( "FunctionElement" ); //TODO: } else if( _variableDefinition.Expression is pol.VariableReferenceElement ) { pol.VariableReferenceElement variableRef = _variableDefinition.Expression as pol.VariableReferenceElement; VariableDefinition variableDef = context.CurrentPolicy.VariableDefinition[ variableRef.VariableId ] as VariableDefinition; context.TraceContextValues(); if( !variableDef.IsEvaluated ) { return variableDef.Evaluate( context ); } else { return variableDef.Value; } } else if( _variableDefinition.Expression is pol.AttributeValueElementReadWrite ) { // The AttributeValue does not need to be processed context.Trace( "Attribute value {0}", _variableDefinition.Expression.ToString() ); pol.AttributeValueElementReadWrite att = (pol.AttributeValueElementReadWrite)_variableDefinition.Expression; pol.AttributeValueElement attributeValue = new pol.AttributeValueElement( att.DataType, att.Contents, att.SchemaVersion ); _value = new EvaluationValue( attributeValue.GetTypedValue( attributeValue.GetType( context ), 0 ), attributeValue.GetType( context ) ); return _value; } else if( _variableDefinition.Expression is pol.AttributeDesignatorBase ) { // Resolve the AttributeDesignator using the EvaluationEngine public methods. context.Trace( "Processing attribute designator: {0}", _variableDefinition.Expression.ToString() ); pol.AttributeDesignatorBase attrDes = (pol.AttributeDesignatorBase)_variableDefinition.Expression; BagValue bag = EvaluationEngine.Resolve( context, attrDes ); // If the attribute was not resolved by the EvaluationEngine search the // attribute in the context document, also using the EvaluationEngine public // methods. if( bag.BagSize == 0 ) { if( _variableDefinition.Expression is pol.SubjectAttributeDesignatorElement ) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute( context, attrDes ); if( attrib != null ) { context.Trace( "Adding subject attribute designator: {0}", attrib.ToString() ); bag.Add( attrib ); } } else if( _variableDefinition.Expression is pol.ResourceAttributeDesignatorElement ) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute( context, attrDes ); if( attrib != null ) { context.Trace( "Adding resource attribute designator {0}", attrib.ToString() ); bag.Add( attrib ); } } else if( _variableDefinition.Expression is pol.ActionAttributeDesignatorElement ) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute( context, attrDes ); if( attrib != null ) { context.Trace( "Adding action attribute designator {0}", attrib.ToString() ); bag.Add( attrib ); } } else if( _variableDefinition.Expression is pol.EnvironmentAttributeDesignatorElement ) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute( context, attrDes ); if( attrib != null ) { context.Trace( "Adding environment attribute designator {0}", attrib.ToString() ); bag.Add( attrib ); } } } // If the argument was not found and the attribute must be present this is // a MissingAttribute situation so set the flag. Otherwise add the attribute // to the processed arguments. if( bag.BagSize == 0 && attrDes.MustBePresent ) { context.Trace( "Attribute is missing" ); context.IsMissingAttribute = true; context.AddMissingAttribute( attrDes ); _value = EvaluationValue.Indeterminate; } else { _value = new EvaluationValue( bag, bag.GetType( context ) ); } return _value; } else if( _variableDefinition.Expression is pol.AttributeSelectorElement ) { // Resolve the XPath query using the EvaluationEngine public methods. context.Trace( "Attribute selector" ); try { pol.AttributeSelectorElement attributeSelector = (pol.AttributeSelectorElement)_variableDefinition.Expression; BagValue bag = EvaluationEngine.Resolve( context, attributeSelector ); if( bag.Elements.Count == 0 && attributeSelector.MustBePresent ) { context.Trace( "Attribute is missing" ); context.IsMissingAttribute = true; context.AddMissingAttribute( attributeSelector ); _value = EvaluationValue.Indeterminate; } else { _value = new EvaluationValue( bag, bag.GetType( context ) ); } } catch( EvaluationException e ) { context.Trace( "ERR: {0}", e.Message ); context.ProcessingError = true; _value = EvaluationValue.Indeterminate; } return _value; } throw new NotSupportedException( "internal error" ); } finally { _isEvaluated = true; context.RemoveIndent(); } }
/// <summary> /// Evaluates the rule contents. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>A decission for this evalauation.</returns> public Decision Evaluate( EvaluationContext context ) { if (context == null) throw new ArgumentNullException("context"); context.Trace( "Evaluating rule: {0}", _rule.Description ); context.AddIndent(); context.CurrentRule = this; try { // Validate the Target element TargetEvaluationValue targetEvaluation = Match( context ); // If the target matches the conditions ar evaluated EvaluationValue conditionEvaluation = EvaluationValue.True; if( _rule.HasCondition ) { // Evaluate the condition conditionEvaluation = _condition.Evaluate( context ); } else { context.Trace( "Rule does not have a condition" ); } // Decite the final rule evaluation value if( targetEvaluation == TargetEvaluationValue.Indeterminate || conditionEvaluation.IsIndeterminate ) { _evaluationValue = Decision.Indeterminate; } else if( targetEvaluation == TargetEvaluationValue.Match && conditionEvaluation.BoolValue ) { _evaluationValue = ((_rule.Effect == pol.Effect.Permit) ? Decision.Permit : Decision.Deny); } else if( ( targetEvaluation == TargetEvaluationValue.NoMatch ) || ( targetEvaluation == TargetEvaluationValue.Match && !conditionEvaluation.BoolValue ) ) { _evaluationValue = Decision.NotApplicable; } // Return the value context.Trace( "Rule: {0}", _evaluationValue ); return _evaluationValue; } finally { context.RemoveIndent(); context.CurrentRule = null; } }
/// <summary> /// This method overrides the ApplyBase method in order to provide extra validations /// required in the condition evaluation, for example the final return value should be a /// boolean value. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The EvaluationValue with the results of the condition evaluation.</returns> public override EvaluationValue Evaluate(EvaluationContext context) { if (context == null) { throw new ArgumentNullException("context"); } EvaluationValue _evaluationValue = null; context.Trace("Evaluating condition..."); context.AddIndent(); try { // Get the function instance inf.IFunction function = EvaluationEngine.GetFunction(ApplyDefinition.FunctionId); if (function == null) { context.Trace("ERR: function not found {0}", ApplyDefinition.FunctionId); context.ProcessingError = true; return(EvaluationValue.Indeterminate); } // Validates the function return value if (function.Returns == null) { context.Trace("The function '{0}' does not defines it's return value", ApplyDefinition.FunctionId); _evaluationValue = EvaluationValue.Indeterminate; context.ProcessingError = true; } else if (function.Returns != DataTypeDescriptor.Boolean) { context.Trace("Function does not return Boolean a value"); _evaluationValue = EvaluationValue.Indeterminate; context.ProcessingError = true; } else { // Call the ApplyBase method to perform the evaluation. _evaluationValue = base.Evaluate(context); } // Validate the results of the evaluation if (_evaluationValue.IsIndeterminate) { context.Trace("condition evaluated into {0}", _evaluationValue.ToString()); return(_evaluationValue); } if (!(_evaluationValue.Value is bool)) { context.Trace("condition evaluated into {0}", _evaluationValue.ToString()); return(EvaluationValue.Indeterminate); } if (_evaluationValue.BoolValue) { context.Trace("condition evaluated into {0}", _evaluationValue.ToString()); return(EvaluationValue.True); } else { // If the evaluation was false, validate if there was a missin attribute during // evaluation and return an Indeterminate, otherwise return the False value. if (context.IsMissingAttribute) { context.Trace("condition evaluated into {0}", _evaluationValue.ToString()); return(EvaluationValue.Indeterminate); } else { context.Trace("condition evaluated into {0}", _evaluationValue.ToString()); return(EvaluationValue.False); } } } finally { context.TraceContextValues(); context.RemoveIndent(); context.Trace("Condition: {0}", _evaluationValue.ToString()); } }
/// <summary> /// Evaluates the policy. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The decission result for this policy.</returns> public Decision Evaluate( EvaluationContext context ) { if (context == null) throw new ArgumentNullException("context"); context.Trace( "Evaluating policy: {0}", _policy.Description ); context.AddIndent(); context.CurrentPolicy = this; try { // Evaluate the variables if( this._policy.SchemaVersion == XacmlVersion.Version20 ) { if( _variables == null ) { context.Trace( "Evaluating variables..." ); _variables = new Hashtable(); foreach( pol.VariableDefinitionElement variableDef in _policy.VariableDefinitions.Values ) { VariableDefinition variable = new VariableDefinition( variableDef ); _variables.Add( variableDef.Id, variable ); } } } // Matches the target. TargetEvaluationValue targetEvaluationValue = Match( context ); // If the target matches. if( targetEvaluationValue == TargetEvaluationValue.Match ) { context.Trace( "Rule combination algorithm: {0}", _policy.RuleCombiningAlgorithm ); // Evaluate all rules and apply rule combination inf.IRuleCombiningAlgorithm rca = EvaluationEngine.CreateRuleCombiningAlgorithm( _policy.RuleCombiningAlgorithm ); _evaluationValue = rca.Evaluate( context, _rules ); } else if( targetEvaluationValue == TargetEvaluationValue.NoMatch ) { _evaluationValue = Decision.NotApplicable; } else if( targetEvaluationValue == TargetEvaluationValue.Indeterminate ) { _evaluationValue = Decision.Indeterminate; } context.Trace( "Policy: {0}", _evaluationValue ); // Copy all the obligations. _obligations = new pol.ObligationCollection(); if( _evaluationValue != Decision.Indeterminate && _evaluationValue != Decision.NotApplicable && _policy.Obligations != null && _policy.Obligations.Count != 0 ) { foreach( pol.ObligationElement obl in _policy.Obligations ) { if( ( obl.FulfillOn == pol.Effect.Deny && _evaluationValue == Decision.Deny ) || ( obl.FulfillOn == pol.Effect.Permit && _evaluationValue == Decision.Permit ) ) { context.Trace( "Adding obligation: {0} ", obl.ObligationId ); _obligations.Add( obl ); } } } return _evaluationValue; } finally { context.RemoveIndent(); context.CurrentPolicy = null; } }
/// <summary> /// THe argument processing method resolves all the attribute designators, attribute /// selectors. If there is an internal Apply it will be evaulated within this method. /// </summary> /// <remarks>All the processed arguments are converted into an IFunctionParameter instance /// because this is the only value that can be used to call a function.</remarks> /// <param name="context">The evaluation context instance.</param> /// <param name="arguments">The arguments to process.</param> /// <returns>A list of arguments ready to be used by a function.</returns> private IFunctionParameterCollection ProcessArguments(EvaluationContext context, pol.IExpressionCollection arguments) { context.Trace("Processing arguments"); context.AddIndent(); // Create a list to return the processed values. IFunctionParameterCollection processedArguments = new IFunctionParameterCollection(); // Iterate through the arguments, the IExpressionType is a mark interface foreach (inf.IExpression arg in arguments) { if (arg is pol.ApplyElement) { context.Trace("Nested apply"); // There is a nested apply un this policy a new Apply will be created and also // evaluated. It's return value will be used as the processed argument. Apply _childApply = new Apply((pol.ApplyElement)arg); // Evaluate the Apply EvaluationValue retVal = _childApply.Evaluate(context); context.TraceContextValues(); // If the results were Indeterminate the Indeterminate value will be placed in // the processed arguments, later another method will validate the parameters // and cancel the evaluation propperly. if (!retVal.IsIndeterminate) { if (!context.IsMissingAttribute) { processedArguments.Add(retVal); } } else { processedArguments.Add(retVal); } } else if (arg is pol.FunctionElementReadWrite) { // Search for the function and place it in the processed arguments. pol.FunctionElement functionId = new pol.FunctionElement(((pol.FunctionElementReadWrite)arg).FunctionId, ((pol.FunctionElementReadWrite)arg).SchemaVersion); context.Trace("Function {0}", functionId.FunctionId); inf.IFunction function = EvaluationEngine.GetFunction(functionId.FunctionId); if (function == null) { context.Trace("ERR: function not found {0}", _applyBase.FunctionId); context.ProcessingError = true; processedArguments.Add(EvaluationValue.Indeterminate); } else { processedArguments.Add(function); } } else if (arg is pol.VariableReferenceElement) { pol.VariableReferenceElement variableRef = arg as pol.VariableReferenceElement; VariableDefinition variableDef = context.CurrentPolicy.VariableDefinition[variableRef.VariableId] as VariableDefinition; context.TraceContextValues(); if (!variableDef.IsEvaluated) { processedArguments.Add(variableDef.Evaluate(context)); } else { processedArguments.Add(variableDef.Value); } } else if (arg is pol.AttributeValueElementReadWrite) { // The AttributeValue does not need to be processed context.Trace("Attribute value {0}", arg.ToString()); processedArguments.Add(new pol.AttributeValueElement(((pol.AttributeValueElementReadWrite)arg).DataType, ((pol.AttributeValueElementReadWrite)arg).Contents, ((pol.AttributeValueElementReadWrite)arg).SchemaVersion)); } else if (arg is pol.AttributeDesignatorBase) { // Resolve the AttributeDesignator using the EvaluationEngine public methods. context.Trace("Processing attribute designator: {0}", arg.ToString()); pol.AttributeDesignatorBase attrDes = (pol.AttributeDesignatorBase)arg; BagValue bag = EvaluationEngine.Resolve(context, attrDes); // If the attribute was not resolved by the EvaluationEngine search the // attribute in the context document, also using the EvaluationEngine public // methods. if (bag.BagSize == 0) { if (arg is pol.SubjectAttributeDesignatorElement) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute(context, attrDes); if (attrib != null) { context.Trace("Adding subject attribute designator: {0}", attrib.ToString()); bag.Add(attrib); break; } } else if (arg is pol.ResourceAttributeDesignatorElement) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute(context, attrDes); if (attrib != null) { context.Trace("Adding resource attribute designator {0}", attrib.ToString()); bag.Add(attrib); } } else if (arg is pol.ActionAttributeDesignatorElement) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute(context, attrDes); if (attrib != null) { context.Trace("Adding action attribute designator {0}", attrib.ToString()); bag.Add(attrib); } } else if (arg is pol.EnvironmentAttributeDesignatorElement) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute(context, attrDes); if (attrib != null) { context.Trace("Adding environment attribute designator {0}", attrib.ToString()); bag.Add(attrib); } } } // If the argument was not found and the attribute must be present this is // a MissingAttribute situation so set the flag. Otherwise add the attribute // to the processed arguments. if (bag.BagSize == 0 && attrDes.MustBePresent) { context.Trace("Attribute is missing"); context.IsMissingAttribute = true; context.AddMissingAttribute(attrDes); } else { processedArguments.Add(bag); } } else if (arg is pol.AttributeSelectorElement) { // Resolve the XPath query using the EvaluationEngine public methods. context.Trace("Attribute selector"); try { BagValue bag = EvaluationEngine.Resolve(context, (pol.AttributeSelectorElement)arg); if (bag.Elements.Count == 0 && ((pol.AttributeSelectorElement)arg).MustBePresent) { context.Trace("Attribute is missing"); context.IsMissingAttribute = true; context.AddMissingAttribute((pol.AttributeReferenceBase)arg); } else { processedArguments.Add(bag); } } catch (EvaluationException e) { context.Trace(Resource.TRACE_ERROR, e.Message); processedArguments.Add(EvaluationValue.Indeterminate); context.ProcessingError = true; } } } context.RemoveIndent(); return(processedArguments); }
/// <summary> /// This method overrides the ApplyBase method in order to provide extra validations /// required in the condition evaluation, for example the final return value should be a /// boolean value. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The EvaluationValue with the results of the condition evaluation.</returns> public override EvaluationValue Evaluate(EvaluationContext context) { if (context == null) { throw new ArgumentNullException("context"); } context.Trace("Evaluating condition"); context.AddIndent(); try { // Iterate through the arguments, the IExpressionType is a mark interface foreach (inf.IExpression arg in ApplyDefinition.Arguments) { if (arg is pol.ApplyElement) { context.Trace("Apply within condition."); // There is a nested apply un this policy a new Apply will be created and also // evaluated. It's return value will be used as the processed argument. Apply _childApply = new Apply((pol.ApplyElement)arg); // Evaluate the Apply EvaluationValue retVal = _childApply.Evaluate(context); return(retVal); } else if (arg is pol.FunctionElementReadWrite) { throw new NotImplementedException("FunctionElement"); //TODO: } else if (arg is pol.VariableReferenceElement) { pol.VariableReferenceElement variableRef = arg as pol.VariableReferenceElement; VariableDefinition variableDef = context.CurrentPolicy.VariableDefinition[variableRef.VariableId] as VariableDefinition; if (!variableDef.IsEvaluated) { return(variableDef.Evaluate(context)); } else { return(variableDef.Value); } } else if (arg is pol.AttributeValueElementReadWrite) { // The AttributeValue does not need to be processed context.Trace("Attribute value {0}", arg.ToString()); pol.AttributeValueElement attributeValue = new pol.AttributeValueElement(((pol.AttributeValueElementReadWrite)arg).DataType, ((pol.AttributeValueElementReadWrite)arg).Contents, ((pol.AttributeValueElementReadWrite)arg).SchemaVersion); return(new EvaluationValue( attributeValue.GetTypedValue(attributeValue.GetType(context), 0), attributeValue.GetType(context))); } else if (arg is pol.AttributeDesignatorBase) { // Returning an empty bag, since the condition is not supposed to work with a bag context.Trace("Processing attribute designator: {0}", arg.ToString()); pol.AttributeDesignatorBase attrDes = (pol.AttributeDesignatorBase)arg; BagValue bag = new BagValue(EvaluationEngine.GetDataType(attrDes.DataType)); return(new EvaluationValue(bag, bag.GetType(context))); } else if (arg is pol.AttributeSelectorElement) { // Returning an empty bag, since the condition is not supposed to work with a bag context.Trace("Attribute selector"); pol.AttributeSelectorElement attrSel = (pol.AttributeSelectorElement)arg; BagValue bag = new BagValue(EvaluationEngine.GetDataType(attrSel.DataType)); return(new EvaluationValue(bag, bag.GetType(context))); } } throw new NotSupportedException("internal error"); } finally { context.TraceContextValues(); context.RemoveIndent(); } }
/// <summary> /// Evaluates the policy set. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The decission result for this policy set.</returns> public Decision Evaluate( EvaluationContext context ) { if (context == null) throw new ArgumentNullException("context"); context.Trace( "Evaluating policySet: {0}", _policySet.Description ); context.CurrentPolicySet = this; try { context.Trace( "Evaluating Target..." ); context.AddIndent(); // Evaluate the policy target TargetEvaluationValue targetEvaluationValue = Match( context ); context.RemoveIndent(); context.Trace( "Target: {0}", targetEvaluationValue ); ProcessTargetEvaluationValue(context, targetEvaluationValue); context.Trace( "PolicySet: {0}", _evaluationValue ); // If the policy evaluated to Deny or Permit add the obligations depending on its fulfill value. ProcessObligations(context); return _evaluationValue; } finally { context.CurrentPolicySet = null; } }
/// <summary> /// The evaluation implementation in the pseudo-code described in the specification. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <param name="rules">The policies that must be evaluated.</param> /// <returns>The final decission for the combination of the rule evaluation.</returns> public Decision Evaluate( EvaluationContext context, RuleCollection rules ) { Decision decision = Decision.Indeterminate; context.Trace( "Evaluating rules..." ); context.AddIndent(); try { foreach( Rule rule in rules ) { decision = rule.Evaluate( context ); context.TraceContextValues(); if( decision == Decision.Deny ) { decision = Decision.Deny; return decision; } if( decision == Decision.Permit ) { decision = Decision.Permit; return decision; } if( decision == Decision.NotApplicable ) { continue; } if( decision == Decision.Indeterminate ) { decision = Decision.Indeterminate; return decision; } } return Decision.NotApplicable; } finally { context.Trace( "Rule combination algorithm: {0}", decision.ToString() ); context.RemoveIndent(); } }
/// <summary> /// This method overrides the ApplyBase method in order to provide extra validations /// required in the condition evaluation, for example the final return value should be a /// boolean value. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The EvaluationValue with the results of the condition evaluation.</returns> public override EvaluationValue Evaluate( EvaluationContext context ) { if (context == null) throw new ArgumentNullException("context"); context.Trace( "Evaluating condition" ); context.AddIndent(); try { // Iterate through the arguments, the IExpressionType is a mark interface foreach( inf.IExpression arg in ApplyDefinition.Arguments ) { if( arg is pol.ApplyElement ) { context.Trace( "Apply within condition." ); // There is a nested apply un this policy a new Apply will be created and also // evaluated. It's return value will be used as the processed argument. Apply _childApply = new Apply( (pol.ApplyElement)arg ); // Evaluate the Apply EvaluationValue retVal = _childApply.Evaluate( context ); return retVal; } else if( arg is pol.FunctionElementReadWrite ) { throw new NotImplementedException( "FunctionElement" ); //TODO: } else if( arg is pol.VariableReferenceElement ) { pol.VariableReferenceElement variableRef = arg as pol.VariableReferenceElement; VariableDefinition variableDef = context.CurrentPolicy.VariableDefinition[ variableRef.VariableId ] as VariableDefinition; if( !variableDef.IsEvaluated ) { return variableDef.Evaluate( context ); } else { return variableDef.Value; } } else if( arg is pol.AttributeValueElementReadWrite ) { // The AttributeValue does not need to be processed context.Trace( "Attribute value {0}", arg.ToString() ); pol.AttributeValueElement attributeValue = new pol.AttributeValueElement( ((pol.AttributeValueElementReadWrite)arg).DataType, ((pol.AttributeValueElementReadWrite)arg).Contents, ((pol.AttributeValueElementReadWrite)arg).SchemaVersion ); return new EvaluationValue( attributeValue.GetTypedValue( attributeValue.GetType( context ), 0 ), attributeValue.GetType( context ) ); } else if( arg is pol.AttributeDesignatorBase ) { // Returning an empty bag, since the condition is not supposed to work with a bag context.Trace( "Processing attribute designator: {0}", arg.ToString() ); pol.AttributeDesignatorBase attrDes = (pol.AttributeDesignatorBase)arg; BagValue bag = new BagValue( EvaluationEngine.GetDataType( attrDes.DataType ) ); return new EvaluationValue( bag, bag.GetType( context ) ); } else if( arg is pol.AttributeSelectorElement ) { // Returning an empty bag, since the condition is not supposed to work with a bag context.Trace( "Attribute selector" ); pol.AttributeSelectorElement attrSel = (pol.AttributeSelectorElement)arg; BagValue bag = new BagValue( EvaluationEngine.GetDataType( attrSel.DataType ) ); return new EvaluationValue( bag, bag.GetType( context ) ); } } throw new NotSupportedException( "internal error" ); } finally { context.TraceContextValues(); context.RemoveIndent(); } }
/// <summary> /// Evaluates the policy. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The decission result for this policy.</returns> public Decision Evaluate(EvaluationContext context) { if (context == null) { throw new ArgumentNullException("context"); } context.Trace("Evaluating policy: {0}", _policy.Description); context.AddIndent(); context.CurrentPolicy = this; try { // Evaluate the variables if (this._policy.SchemaVersion == XacmlVersion.Version20) { if (_variables == null) { context.Trace("Evaluating variables..."); _variables = new Hashtable(); foreach (pol.VariableDefinitionElement variableDef in _policy.VariableDefinitions.Values) { VariableDefinition variable = new VariableDefinition(variableDef); _variables.Add(variableDef.Id, variable); } } } // Matches the target. TargetEvaluationValue targetEvaluationValue = Match(context); // If the target matches. if (targetEvaluationValue == TargetEvaluationValue.Match) { context.Trace("Rule combination algorithm: {0}", _policy.RuleCombiningAlgorithm); // Evaluate all rules and apply rule combination inf.IRuleCombiningAlgorithm rca = EvaluationEngine.CreateRuleCombiningAlgorithm(_policy.RuleCombiningAlgorithm); _evaluationValue = rca.Evaluate(context, _rules); } else if (targetEvaluationValue == TargetEvaluationValue.NoMatch) { _evaluationValue = Decision.NotApplicable; } else if (targetEvaluationValue == TargetEvaluationValue.Indeterminate) { _evaluationValue = Decision.Indeterminate; } context.Trace("Policy: {0}", _evaluationValue); // Copy all the obligations. _obligations = new pol.ObligationCollection(); if (_evaluationValue != Decision.Indeterminate && _evaluationValue != Decision.NotApplicable && _policy.Obligations != null && _policy.Obligations.Count != 0) { foreach (pol.ObligationElement obl in _policy.Obligations) { if ((obl.FulfillOn == pol.Effect.Deny && _evaluationValue == Decision.Deny) || (obl.FulfillOn == pol.Effect.Permit && _evaluationValue == Decision.Permit)) { context.Trace("Adding obligation: {0} ", obl.ObligationId); _obligations.Add(obl); } } } return(_evaluationValue); } finally { context.RemoveIndent(); context.CurrentPolicy = null; } }
/// <summary> /// Matches this target instance using the context document. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The results of the evaluation of this target.</returns> public TargetEvaluationValue Evaluate( EvaluationContext context ) { if (context == null) throw new ArgumentNullException("context"); // Set the default value. _evaluationValue = TargetEvaluationValue.NoMatch; // Resource context.Trace( "Evaluating Resource..." ); context.AddIndent(); TargetEvaluationValue resourceEval = _resources.Evaluate( context, context.CurrentResource ); context.TraceContextValues(); context.Trace( "Target item result: {0}", resourceEval ); context.RemoveIndent(); // Action context.Trace( "Evaluating Action..." ); context.AddIndent(); TargetEvaluationValue actionEval = _actions.Evaluate( context, context.ContextDocument.Request.Action ); context.TraceContextValues(); context.Trace( "Target item result: {0}", actionEval ); context.RemoveIndent(); context.Trace( "Evaluating Subjects..." ); context.AddIndent(); if( actionEval == TargetEvaluationValue.Match && resourceEval == TargetEvaluationValue.Match ) { // Subjects foreach( ctx.SubjectElement ctxSubject in context.ContextDocument.Request.Subjects ) { context.Trace( "Evaluating Subject: {0}", ctxSubject.SubjectCategory ); // Subject TargetEvaluationValue subjectEval = _subjects.Evaluate( context, ctxSubject ); context.TraceContextValues(); if( subjectEval == TargetEvaluationValue.Indeterminate ) { _evaluationValue = TargetEvaluationValue.Indeterminate; } else if( subjectEval == TargetEvaluationValue.Match ) { _evaluationValue = TargetEvaluationValue.Match; context.RemoveIndent(); context.Trace( "Target item result: {0}", _evaluationValue ); return _evaluationValue; } } context.RemoveIndent(); context.Trace( "Target item result: {0}", _evaluationValue ); return _evaluationValue; } else { context.Trace( "Actions or Resources does not Match so Subjects will not be evaluated" ); if( resourceEval == TargetEvaluationValue.Indeterminate || actionEval == TargetEvaluationValue.Indeterminate ) { context.RemoveIndent(); return TargetEvaluationValue.Indeterminate; } else { context.RemoveIndent(); return TargetEvaluationValue.NoMatch; } } }
/// <summary> /// Evaluates the variable into a value. /// </summary> /// <param name="context">The contex of the evaluation.</param> /// <returns>The value of the function.</returns> public EvaluationValue Evaluate(EvaluationContext context) { if (context == null) { throw new ArgumentNullException("context"); } context.Trace("Evaluating variable"); context.AddIndent(); try { if (_variableDefinition.Expression is pol.ApplyElement) { context.Trace("Apply within condition."); // There is a nested apply un this policy a new Apply will be created and also // evaluated. It's return value will be used as the processed argument. Apply _childApply = new Apply((pol.ApplyElement)_variableDefinition.Expression); // Evaluate the Apply _value = _childApply.Evaluate(context); context.TraceContextValues(); return(_value); } else if (_variableDefinition.Expression is pol.FunctionElement) { throw new NotImplementedException("FunctionElement"); //TODO: } else if (_variableDefinition.Expression is pol.VariableReferenceElement) { pol.VariableReferenceElement variableRef = _variableDefinition.Expression as pol.VariableReferenceElement; VariableDefinition variableDef = context.CurrentPolicy.VariableDefinition[variableRef.VariableId] as VariableDefinition; context.TraceContextValues(); if (!variableDef.IsEvaluated) { return(variableDef.Evaluate(context)); } else { return(variableDef.Value); } } else if (_variableDefinition.Expression is pol.AttributeValueElementReadWrite) { // The AttributeValue does not need to be processed context.Trace("Attribute value {0}", _variableDefinition.Expression.ToString()); pol.AttributeValueElementReadWrite att = (pol.AttributeValueElementReadWrite)_variableDefinition.Expression; pol.AttributeValueElement attributeValue = new pol.AttributeValueElement(att.DataType, att.Contents, att.SchemaVersion); _value = new EvaluationValue( attributeValue.GetTypedValue(attributeValue.GetType(context), 0), attributeValue.GetType(context)); return(_value); } else if (_variableDefinition.Expression is pol.AttributeDesignatorBase) { // Resolve the AttributeDesignator using the EvaluationEngine public methods. context.Trace("Processing attribute designator: {0}", _variableDefinition.Expression.ToString()); pol.AttributeDesignatorBase attrDes = (pol.AttributeDesignatorBase)_variableDefinition.Expression; BagValue bag = EvaluationEngine.Resolve(context, attrDes); // If the attribute was not resolved by the EvaluationEngine search the // attribute in the context document, also using the EvaluationEngine public // methods. if (bag.BagSize == 0) { if (_variableDefinition.Expression is pol.SubjectAttributeDesignatorElement) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute(context, attrDes); if (attrib != null) { context.Trace("Adding subject attribute designator: {0}", attrib.ToString()); bag.Add(attrib); } } else if (_variableDefinition.Expression is pol.ResourceAttributeDesignatorElement) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute(context, attrDes); if (attrib != null) { context.Trace("Adding resource attribute designator {0}", attrib.ToString()); bag.Add(attrib); } } else if (_variableDefinition.Expression is pol.ActionAttributeDesignatorElement) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute(context, attrDes); if (attrib != null) { context.Trace("Adding action attribute designator {0}", attrib.ToString()); bag.Add(attrib); } } else if (_variableDefinition.Expression is pol.EnvironmentAttributeDesignatorElement) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute(context, attrDes); if (attrib != null) { context.Trace("Adding environment attribute designator {0}", attrib.ToString()); bag.Add(attrib); } } } // If the argument was not found and the attribute must be present this is // a MissingAttribute situation so set the flag. Otherwise add the attribute // to the processed arguments. if (bag.BagSize == 0 && attrDes.MustBePresent) { context.Trace("Attribute is missing"); context.IsMissingAttribute = true; context.AddMissingAttribute(attrDes); _value = EvaluationValue.Indeterminate; } else { _value = new EvaluationValue(bag, bag.GetType(context)); } return(_value); } else if (_variableDefinition.Expression is pol.AttributeSelectorElement) { // Resolve the XPath query using the EvaluationEngine public methods. context.Trace("Attribute selector"); try { pol.AttributeSelectorElement attributeSelector = (pol.AttributeSelectorElement)_variableDefinition.Expression; BagValue bag = EvaluationEngine.Resolve(context, attributeSelector); if (bag.Elements.Count == 0 && attributeSelector.MustBePresent) { context.Trace("Attribute is missing"); context.IsMissingAttribute = true; context.AddMissingAttribute(attributeSelector); _value = EvaluationValue.Indeterminate; } else { _value = new EvaluationValue(bag, bag.GetType(context)); } } catch (EvaluationException e) { context.Trace("ERR: {0}", e.Message); context.ProcessingError = true; _value = EvaluationValue.Indeterminate; } return(_value); } throw new NotSupportedException("internal error"); } finally { _isEvaluated = true; context.RemoveIndent(); } }
/// <summary> /// The evaluation implementation in the pseudo-code described in the specification. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <param name="rules">The policies that must be evaluated.</param> /// <returns>The final decission for the combination of the rule evaluation.</returns> public Decision Evaluate( EvaluationContext context, RuleCollection rules ) { Decision decision = Decision.Indeterminate; bool atLeastOneError = false; bool potentialDeny = false; bool atLeastOnePermit = false; context.Trace( "Evaluating rules..." ); context.AddIndent(); try { foreach( Rule rule in rules ) { decision = rule.Evaluate( context ); context.TraceContextValues(); if( decision == Decision.Deny ) { decision = Decision.Deny; return decision; } if( decision == Decision.Permit ) { atLeastOnePermit = true; continue; } if( decision == Decision.NotApplicable ) { continue; } if( decision == Decision.Indeterminate ) { atLeastOneError = true; if( rule.RuleDefinition.Effect == pol.Effect.Deny ) { potentialDeny = true; } continue; } } if( potentialDeny ) { decision = Decision.Indeterminate; return decision; } if( atLeastOnePermit ) { decision = Decision.Permit; return decision; } if( atLeastOneError ) { decision = Decision.Indeterminate; return decision; } decision = Decision.NotApplicable; return decision; } finally { context.Trace( "Rule combination algorithm: {0}", decision.ToString() ); context.RemoveIndent(); } }
/// <summary> /// Verifies if the rule target matches /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The result of the Match process.</returns> public TargetEvaluationValue Match( EvaluationContext context ) { if (context == null) throw new ArgumentNullException("context"); TargetEvaluationValue targetEvaluationValue = TargetEvaluationValue.Indeterminate; context.Trace( "Evaluating rule target" ); context.AddIndent(); try { // Evaluate the policy target targetEvaluationValue = TargetEvaluationValue.Match; if( _target != null ) { targetEvaluationValue = _target.Evaluate( context ); context.TraceContextValues(); } return targetEvaluationValue; } finally { context.RemoveIndent(); context.Trace( "Target: {0}", targetEvaluationValue ); } }
/// <summary> /// THe argument processing method resolves all the attribute designators, attribute /// selectors. If there is an internal Apply it will be evaulated within this method. /// </summary> /// <remarks>All the processed arguments are converted into an IFunctionParameter instance /// because this is the only value that can be used to call a function.</remarks> /// <param name="context">The evaluation context instance.</param> /// <param name="arguments">The arguments to process.</param> /// <returns>A list of arguments ready to be used by a function.</returns> private IFunctionParameterCollection ProcessArguments( EvaluationContext context, pol.IExpressionCollection arguments ) { context.Trace( "Processing arguments" ); context.AddIndent(); // Create a list to return the processed values. IFunctionParameterCollection processedArguments = new IFunctionParameterCollection(); // Iterate through the arguments, the IExpressionType is a mark interface foreach( inf.IExpression arg in arguments ) { if( arg is pol.ApplyElement ) { context.Trace( "Nested apply" ); // There is a nested apply un this policy a new Apply will be created and also // evaluated. It's return value will be used as the processed argument. Apply _childApply = new Apply( (pol.ApplyElement)arg ); // Evaluate the Apply EvaluationValue retVal = _childApply.Evaluate( context ); context.TraceContextValues(); // If the results were Indeterminate the Indeterminate value will be placed in // the processed arguments, later another method will validate the parameters // and cancel the evaluation propperly. if( !retVal.IsIndeterminate ) { if( !context.IsMissingAttribute ) { processedArguments.Add( retVal ); } } else { processedArguments.Add( retVal ); } } else if( arg is pol.FunctionElementReadWrite ) { // Search for the function and place it in the processed arguments. pol.FunctionElement functionId = new pol.FunctionElement( ((pol.FunctionElementReadWrite)arg).FunctionId, ((pol.FunctionElementReadWrite)arg).SchemaVersion ); context.Trace( "Function {0}", functionId.FunctionId ); inf.IFunction function = EvaluationEngine.GetFunction( functionId.FunctionId ); if( function == null ) { context.Trace( "ERR: function not found {0}", _applyBase.FunctionId ); context.ProcessingError = true; processedArguments.Add( EvaluationValue.Indeterminate ); } else { processedArguments.Add( function ); } } else if( arg is pol.VariableReferenceElement ) { pol.VariableReferenceElement variableRef = arg as pol.VariableReferenceElement; VariableDefinition variableDef = context.CurrentPolicy.VariableDefinition[ variableRef.VariableId ] as VariableDefinition; context.TraceContextValues(); if( !variableDef.IsEvaluated ) { processedArguments.Add( variableDef.Evaluate( context ) ); } else { processedArguments.Add( variableDef.Value ); } } else if( arg is pol.AttributeValueElementReadWrite ) { // The AttributeValue does not need to be processed context.Trace( "Attribute value {0}", arg.ToString() ); processedArguments.Add( new pol.AttributeValueElement( ((pol.AttributeValueElementReadWrite)arg).DataType, ((pol.AttributeValueElementReadWrite)arg).Contents, ((pol.AttributeValueElementReadWrite)arg).SchemaVersion )); } else if( arg is pol.AttributeDesignatorBase ) { // Resolve the AttributeDesignator using the EvaluationEngine public methods. context.Trace( "Processing attribute designator: {0}", arg.ToString() ); pol.AttributeDesignatorBase attrDes = (pol.AttributeDesignatorBase)arg; BagValue bag = EvaluationEngine.Resolve( context, attrDes ); // If the attribute was not resolved by the EvaluationEngine search the // attribute in the context document, also using the EvaluationEngine public // methods. if( bag.BagSize == 0 ) { if( arg is pol.SubjectAttributeDesignatorElement ) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute( context, attrDes ); if( attrib != null ) { context.Trace( "Adding subject attribute designator: {0}", attrib.ToString() ); bag.Add( attrib ); break; } } else if( arg is pol.ResourceAttributeDesignatorElement ) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute( context, attrDes ); if( attrib != null ) { context.Trace( "Adding resource attribute designator {0}", attrib.ToString() ); bag.Add( attrib ); } } else if( arg is pol.ActionAttributeDesignatorElement ) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute( context, attrDes ); if( attrib != null ) { context.Trace( "Adding action attribute designator {0}", attrib.ToString() ); bag.Add( attrib ); } } else if( arg is pol.EnvironmentAttributeDesignatorElement ) { ctx.AttributeElement attrib = EvaluationEngine.GetAttribute( context, attrDes ); if( attrib != null ) { context.Trace( "Adding environment attribute designator {0}", attrib.ToString() ); bag.Add( attrib ); } } } // If the argument was not found and the attribute must be present this is // a MissingAttribute situation so set the flag. Otherwise add the attribute // to the processed arguments. if( bag.BagSize == 0 && attrDes.MustBePresent ) { context.Trace( "Attribute is missing" ); context.IsMissingAttribute = true; context.AddMissingAttribute( attrDes ); } else { processedArguments.Add( bag ); } } else if( arg is pol.AttributeSelectorElement ) { // Resolve the XPath query using the EvaluationEngine public methods. context.Trace( "Attribute selector" ); try { BagValue bag = EvaluationEngine.Resolve( context, (pol.AttributeSelectorElement)arg ); if( bag.Elements.Count == 0 && ((pol.AttributeSelectorElement)arg).MustBePresent ) { context.Trace( "Attribute is missing" ); context.IsMissingAttribute = true; context.AddMissingAttribute( (pol.AttributeReferenceBase)arg ); } else { processedArguments.Add( bag ); } } catch( EvaluationException e ) { context.Trace( Resource.TRACE_ERROR, e.Message ); processedArguments.Add( EvaluationValue.Indeterminate ); context.ProcessingError = true; } } } context.RemoveIndent(); return processedArguments; }
/// <summary> /// Matches this target instance using the context document. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <returns>The results of the evaluation of this target.</returns> public TargetEvaluationValue Evaluate(EvaluationContext context) { if (context == null) { throw new ArgumentNullException("context"); } // Set the default value. _evaluationValue = TargetEvaluationValue.NoMatch; // Resource context.Trace("Evaluating Resource..."); context.AddIndent(); TargetEvaluationValue resourceEval = _resources.Evaluate(context, context.CurrentResource); context.TraceContextValues(); context.Trace("Target item result: {0}", resourceEval); context.RemoveIndent(); // Action context.Trace("Evaluating Action..."); context.AddIndent(); TargetEvaluationValue actionEval = _actions.Evaluate(context, context.ContextDocument.Request.Action); context.TraceContextValues(); context.Trace("Target item result: {0}", actionEval); context.RemoveIndent(); context.Trace("Evaluating Subjects..."); context.AddIndent(); if (actionEval == TargetEvaluationValue.Match && resourceEval == TargetEvaluationValue.Match) { // Subjects foreach (ctx.SubjectElement ctxSubject in context.ContextDocument.Request.Subjects) { context.Trace("Evaluating Subject: {0}", ctxSubject.SubjectCategory); // Subject TargetEvaluationValue subjectEval = _subjects.Evaluate(context, ctxSubject); context.TraceContextValues(); if (subjectEval == TargetEvaluationValue.Indeterminate) { _evaluationValue = TargetEvaluationValue.Indeterminate; } else if (subjectEval == TargetEvaluationValue.Match) { _evaluationValue = TargetEvaluationValue.Match; context.RemoveIndent(); context.Trace("Target item result: {0}", _evaluationValue); return(_evaluationValue); } } context.RemoveIndent(); context.Trace("Target item result: {0}", _evaluationValue); return(_evaluationValue); } else { context.Trace("Actions or Resources does not Match so Subjects will not be evaluated"); if (resourceEval == TargetEvaluationValue.Indeterminate || actionEval == TargetEvaluationValue.Indeterminate) { context.RemoveIndent(); return(TargetEvaluationValue.Indeterminate); } else { context.RemoveIndent(); return(TargetEvaluationValue.NoMatch); } } }
/// <summary> /// The evaluation implementation in the pseudo-code described in the specification. /// </summary> /// <param name="context">The evaluation context instance.</param> /// <param name="rules">The policies that must be evaluated.</param> /// <returns>The final decission for the combination of the rule evaluation.</returns> public Decision Evaluate(EvaluationContext context, RuleCollection rules) { if (context == null) { throw new ArgumentNullException("context"); } if (rules == null) { throw new ArgumentNullException("rules"); } Decision decision = Decision.Indeterminate; bool atLeastOneError = false; bool potentialPermit = false; bool atLeastOneDeny = false; context.Trace("Evaluating rules..."); context.AddIndent(); try { foreach (Rule rule in rules) { decision = rule.Evaluate(context); context.TraceContextValues(); if (decision == Decision.Deny) { atLeastOneDeny = true; continue; } if (decision == Decision.Permit) { decision = Decision.Permit; return(decision); } if (decision == Decision.NotApplicable) { continue; } if (decision == Decision.Indeterminate) { atLeastOneError = true; if (rule.RuleDefinition.Effect == pol.Effect.Permit) { potentialPermit = true; } continue; } } if (potentialPermit) { decision = Decision.Indeterminate; return(decision); } if (atLeastOneDeny) { decision = Decision.Deny; return(decision); } if (atLeastOneError) { decision = Decision.Indeterminate; return(decision); } decision = Decision.NotApplicable; return(decision); } finally { context.Trace("Rule combination algorithm: {0}", decision.ToString()); context.RemoveIndent(); } }