1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
|
# Copyright 2015-2016, Tresys Technology, LLC
#
# This file is part of SETools.
#
# SETools is free software: you can redistribute it and/or modify
# it under the terms of the GNU Lesser General Public License as
# published by the Free Software Foundation, either version 2.1 of
# the License, or (at your option) any later version.
#
# SETools is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with SETools. If not, see
# <http://www.gnu.org/licenses/>.
#
import logging
from collections import namedtuple
modified_item_record = namedtuple("modified_item", ["left", "right"])
class Difference(object):
"""Base class for all policy differences."""
def __init__(self, left_policy, right_policy):
self.log = logging.getLogger(self.__class__.__name__)
self.left_policy = left_policy
self.right_policy = right_policy
#
# Policies to compare
#
@property
def left_policy(self):
return self._left_policy
@left_policy.setter
def left_policy(self, policy):
self.log.info("Policy diff left policy set to {0}".format(policy))
self._left_policy = policy
self._reset_diff()
@property
def right_policy(self):
return self._right_policy
@right_policy.setter
def right_policy(self, policy):
self.log.info("Policy diff right policy set to {0}".format(policy))
self._right_policy = policy
self._reset_diff()
#
# Internal functions
#
def _reset_diff(self):
"""Reset diff results on policy changes."""
raise NotImplementedError
@staticmethod
def _expand_generator(rule_list, Wrapper):
"""Generator that yields a wrapped, expanded rule list."""
# this is to delay creating any containers
# as long as possible, since rule lists
# are typically massive.
for unexpanded_rule in rule_list:
for expanded_rule in unexpanded_rule.expand():
yield Wrapper(expanded_rule)
@staticmethod
def _set_diff(left, right):
"""
Standard diff of two sets.
Parameters:
left An iterable
right An iterable
Return:
tuple (added, removed, matched)
added Set of items in right but not left
removed Set of items in left but not right
matched Set of items in both left and right. This is
in the form of tuples with the matching item
from left and right
"""
left_items = set(left)
right_items = set(right)
added_items = right_items - left_items
removed_items = left_items - right_items
# The problem here is the symbol from both policies are
# needed to build each tuple in the matched items set.
# Using the standard Python set intersection code will only result
# in one object.
#
# This tuple-generating code creates lists from the sets, to sort them.
# This should result in all of the symbols lining up. If they don't,
# this will break the caller. This should work since there is no remapping.
#
# This has extra checking to make sure this assertion holds, to fail
# instead of giving wrong results. If there is a better way to,
# ensure the items match up, please let me know how or submit a patch.
matched_items = set()
left_matched_items = sorted((left_items - removed_items))
right_matched_items = sorted((right_items - added_items))
assert len(left_matched_items) == len(right_matched_items), \
"Matched items assertion failure (this is an SETools bug), {0} != {1}". \
format(len(left_matched_items), len(right_matched_items))
for l, r in zip(left_matched_items, right_matched_items):
assert l == r, \
"Matched items assertion failure (this is an SETools bug), {0} != {1}".format(l, r)
matched_items.add((l, r))
try:
# unwrap the objects
return set(i.origin for i in added_items), \
set(i.origin for i in removed_items), \
set((l.origin, r.origin) for (l, r) in matched_items)
except AttributeError:
return added_items, removed_items, matched_items
class Wrapper(object):
"""Base class for policy object wrappers."""
origin = None
def __repr__(self):
return "<{0.__class__.__name__}(Wrapping {1})>".format(self, repr(self.origin))
def __hash__(self):
raise NotImplementedError
def __eq__(self, other):
raise NotImplementedError
def __lt__(self, other):
raise NotImplementedError
def __ne__(self, other):
return not self == other
class SymbolWrapper(Wrapper):
"""
General wrapper for policy symbols, e.g. types, roles
to provide a diff-specific equality operation based
on its name.
"""
def __init__(self, symbol):
self.origin = symbol
self.name = str(symbol)
def __hash__(self):
return hash(self.name)
def __lt__(self, other):
return self.name < other.name
def __eq__(self, other):
return self.name == other.name
|
