def test_slice_name_validation(self):
xproto = """
policy test_policy < not obj.id -> {{ obj.name.startswith(obj.site.login_base) }} >
"""
args = XOSProcessorArgs()
args.inputs = xproto
args.target = self.target
output = XOSProcessor.process(args)
obj = FakeObject()
obj.isolation = "container"
obj.kind = "not a container"
exec(output) # This loads the generated function, which should look like this:
"""
def policy_output_validator(obj, ctx):
i3 = obj.id
i4 = obj.name.startswith(obj.site.login_base)
i2 = ((not i3) or i4)
i1 = (not i2)
if (not i1):
raise ValidationError('Necessary Failure')
"""
with self.assertRaises(Exception):
policy_output_validator(obj, {})
def test_equal(self):
xproto = """
policy output < not (ctx.user = obj.user) >
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(output) # This loads the generated function, which should look like this:
"""
def policy_output_validator(obj, ctx):
i2 = (ctx.user == obj.user)
i1 = (not i2)
if (not i1):
raise Exception('Necessary Failure')
"""
obj = FakeObject()
obj.user = 1
ctx = FakeObject()
ctx.user = 1
with self.assertRaises(Exception):
policy_output_validator(obj, ctx)
def test_call_policy(self):
xproto = """
policy sub_policy < ctx.user = obj.user >
policy output < *sub_policy(child) >
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(
output, globals()
) # This loads the generated function, which should look like this:
"""
def policy_sub_policy_validator(obj, ctx):
i1 = (ctx.user == obj.user)
if (not i1):
raise ValidationError('Necessary Failure')
def policy_output_validator(obj, ctx):
i1 = policy_sub_policy_validator(obj.child, ctx)
if (not i1):
raise ValidationError('Necessary Failure')
"""
obj = FakeObject()
obj.child = FakeObject()
obj.child.user = 1
ctx = FakeObject()
ctx.user = 1
with self.assertRaises(Exception):
verdict = policy_output_enforcer(obj, ctx)
def test_call_policy(self):
xproto = """
policy sub_policy < ctx.user = obj.user >
policy output < *sub_policy(child) >
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(output, globals()) # This loads the generated function, which should look like this:
"""
def sub_policy_security_check(obj, ctx):
i1 = (ctx.user == obj.user)
return i1
def output_security_check(obj, ctx):
if obj.child:
i1 = sub_policy_security_check(obj.child, ctx)
else:
i1 = True
return i1
"""
obj = FakeObject()
obj.child = FakeObject()
obj.child.user = 1
ctx = FakeObject()
ctx.user = 1
verdict = output_security_check(obj, ctx)
self.assertTrue(verdict)
def test_slice_name_validation(self):
xproto = """
policy test_policy < not obj.id -> {{ obj.name.startswith(obj.site.login_base) }} >
"""
args = XOSProcessorArgs()
args.inputs = xproto
args.target = self.target
output = XOSProcessor.process(args)
obj = FakeObject()
obj.isolation = "container"
obj.kind = "not a container"
exec(output) # This loads the generated function, which should look like this:
"""
def policy_output_validator(obj, ctx):
i3 = obj.id
i4 = obj.name.startswith(obj.site.login_base)
i2 = ((not i3) or i4)
i1 = (not i2)
if (not i1):
raise ValidationError('Necessary Failure')
"""
with self.assertRaises(Exception):
policy_output_validator(obj, {})
def test_bin(self):
xproto = """
policy output < ctx.is_admin = True | obj.empty = True>
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(output, globals()) # This loads the generated function, which should look like this:
"""
def output_security_check(obj, ctx):
i2 = (ctx.is_admin == True)
i3 = (obj.empty == True)
i1 = (i2 or i3)
return i1
"""
obj = FakeObject()
obj.empty = True
ctx = FakeObject()
ctx.is_admin = True
verdict = output_security_check(obj, ctx)
self.assertTrue(verdict)
def test_instance_container(self):
xproto = """
policy test_policy < (obj.isolation = "container" | obj.isolation = "container_vm" ) -> (obj.image.kind = "container") >
"""
args = XOSProcessorArgs()
args.inputs = xproto
args.target = self.target
output = XOSProcessor.process(args)
obj = FakeObject()
obj.isolation = "container"
obj.kind = "not a container"
exec(output) # This loads the generated function, which should look like this:
"""
def policy_output_validator(obj, ctx):
i4 = (obj.isolation == 'container')
i5 = (self.isolation == 'container_vm')
i2 = (i4 or i5)
i3 = (obj.image.kind == 'container')
i1 = (i2 or i3)
return i1
"""
with self.assertRaises(Exception):
policy_output_validator(obj, {})
def test_bin(self):
xproto = """
policy output < (ctx.is_admin = True | obj.empty = True) | False>
"""
args = XOSProcessorArgs()
args.inputs = xproto
args.target = self.target
output = XOSProcessor.process(args)
exec(output) # This loads the generated function, which should look like this:
"""
def policy_output_validator(obj, ctx):
i2 = (ctx.is_admin == True)
i3 = (obj.empty == True)
i1 = (i2 or i3)
if (not i1):
raise Exception('Necessary Failure')
"""
obj = FakeObject()
obj.empty = False
ctx = FakeObject()
ctx.is_admin = False
with self.assertRaises(Exception):
verdict = policy_output_validator(obj, ctx)
def test_instance_container(self):
xproto = """
policy test_policy < (obj.isolation = "container" | obj.isolation = "container_vm" ) -> (obj.image.kind = "container") >
"""
args = XOSProcessorArgs()
args.inputs = xproto
args.target = self.target
output = XOSProcessor.process(args)
obj = FakeObject()
obj.isolation = "container"
obj.kind = "not a container"
exec(output) # This loads the generated function, which should look like this:
"""
def policy_output_validator(obj, ctx):
i4 = (obj.isolation == 'container')
i5 = (self.isolation == 'container_vm')
i2 = (i4 or i5)
i3 = (obj.image.kind == 'container')
i1 = (i2 or i3)
return i1
"""
with self.assertRaises(Exception):
policy_output_validator(obj, {})
def test_call_policy(self):
xproto = """
policy sub_policy < ctx.user = obj.user >
policy output < *sub_policy(child) >
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(output, globals(
)) # This loads the generated function, which should look like this:
"""
def sub_policy_security_check(obj, ctx):
i1 = (ctx.user == obj.user)
return i1
def output_security_check(obj, ctx):
if obj.child:
i1 = sub_policy_security_check(obj.child, ctx)
else:
i1 = True
return i1
"""
obj = FakeObject()
obj.child = FakeObject()
obj.child.user = 1
ctx = FakeObject()
ctx.user = 1
verdict = output_security_check(obj, ctx)
self.assertTrue(verdict)
def test_call_policy(self):
xproto = """
policy sub_policy < ctx.user = obj.user >
policy output < *sub_policy(child) >
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(output, globals(
)) # This loads the generated function, which should look like this:
"""
def policy_sub_policy_validator(obj, ctx):
i1 = (ctx.user == obj.user)
if (not i1):
raise ValidationError('Necessary Failure')
def policy_output_validator(obj, ctx):
i1 = policy_sub_policy_validator(obj.child, ctx)
if (not i1):
raise ValidationError('Necessary Failure')
"""
obj = FakeObject()
obj.child = FakeObject()
obj.child.user = 1
ctx = FakeObject()
ctx.user = 1
with self.assertRaises(Exception):
verdict = policy_output_enforcer(obj, ctx)
def test_num_constant(self):
xproto = """
policy slice_user < slice.user.age = 57 >
"""
target = XProtoTestHelpers.write_tmp_target("{{ proto.policies.slice_user }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.user = FakeObject()
slice.user.is_admin = True
expr = eval(output)
self.assertTrue(expr)
def test_function_term(self):
xproto = """
policy slice_user < slice.user.compute_is_admin() >
"""
target = XProtoTestHelpers.write_tmp_target("{{ proto.policies.slice_user }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.user = FakeObject()
slice.user.compute_is_admin = lambda: True
expr = eval(output)
self.assertTrue(expr)
def test_num_constant(self):
xproto = """
policy slice_user < slice.user.age = 57 >
"""
target = XProtoTestHelpers.write_tmp_target(
"{{ proto.policies.slice_user }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.user = FakeObject()
slice.user.is_admin = True
expr = eval(output)
self.assertTrue(expr)
def test_function_term(self):
xproto = """
policy slice_user < slice.user.compute_is_admin() >
"""
target = XProtoTestHelpers.write_tmp_target(
"{{ proto.policies.slice_user }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.user = FakeObject()
slice.user.compute_is_admin = lambda: True
expr = eval(output)
self.assertTrue(expr)
def test_bin(self):
xproto = """
policy slice_admin < slice.is_admin | obj.empty >
"""
target = XProtoTestHelpers.write_tmp_target("{{ proto.policies.slice_admin }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.is_admin = False
obj = FakeObject()
obj.empty = []
(op, operands), = eval(output).items()
expr = op.join(operands).replace("|", " or ")
self.assertFalse(eval(expr))
def test_implies(self):
xproto = """
policy implies < obj.name -> obj.creator >
"""
target = XProtoTestHelpers.write_tmp_target("{{ proto.policies.implies }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.is_admin = False
obj = FakeObject()
obj.name = "Thing 1"
obj.creator = None
(op, operands), = eval(output).items()
expr = "not " + op.join(operands).replace("->", " or ")
self.assertFalse(eval(expr))
def test_equal(self):
xproto = """
policy slice_user < slice.user = obj.user >
"""
target = XProtoTestHelpers.write_tmp_target("{{ proto.policies.slice_user }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.user = "******"
obj = FakeObject()
obj.user = "******"
(op, operands), = eval(output).items()
expr = op.join(operands).replace("=", "==")
self.assertTrue(eval(expr))
def test_equal(self):
xproto = """
policy output < ctx.user = obj.user >
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(output, globals()) # This loads the generated function, which should look like this:
"""
def output_security_check(obj, ctx):
i1 = (ctx.user == obj.user)
return i1
"""
obj = FakeObject()
obj.user = 1
ctx = FakeObject()
ctx.user = 1
verdict = output_security_check(obj, ctx)
def test_bin(self):
xproto = """
policy output < ctx.is_admin = True | obj.empty = True>
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(output, globals(
)) # This loads the generated function, which should look like this:
"""
def output_security_check(obj, ctx):
i2 = (ctx.is_admin == True)
i3 = (obj.empty == True)
i1 = (i2 or i3)
return i1
"""
obj = FakeObject()
obj.empty = True
ctx = FakeObject()
ctx.is_admin = True
verdict = output_security_check(obj, ctx)
self.assertTrue(verdict)
def test_bin(self):
xproto = """
policy output < (ctx.is_admin = True | obj.empty = True) | False>
"""
args = XOSProcessorArgs()
args.inputs = xproto
args.target = self.target
output = XOSProcessor.process(args)
exec(
output
) # This loads the generated function, which should look like this:
"""
def policy_output_validator(obj, ctx):
i2 = (ctx.is_admin == True)
i3 = (obj.empty == True)
i1 = (i2 or i3)
if (not i1):
raise Exception('Necessary Failure')
"""
obj = FakeObject()
obj.empty = False
ctx = FakeObject()
ctx.is_admin = False
with self.assertRaises(Exception):
verdict = policy_output_validator(obj, ctx)
def test_equal(self):
xproto = """
policy output < not (ctx.user = obj.user) >
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(
output
) # This loads the generated function, which should look like this:
"""
def policy_output_validator(obj, ctx):
i2 = (ctx.user == obj.user)
i1 = (not i2)
if (not i1):
raise Exception('Necessary Failure')
"""
obj = FakeObject()
obj.user = 1
ctx = FakeObject()
ctx.user = 1
with self.assertRaises(Exception):
policy_output_validator(obj, ctx)
def test_exists(self):
xproto = """
policy privilege < exists Privilege: Privilege.object_id = obj.id >
"""
target = XProtoTestHelpers.write_tmp_target("{{ proto.policies.privilege }} ")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
Privilege = FakeObject()
Privilege.object_id = 1
obj = FakeObject()
obj.id = 1
(op, operands), = eval(output).items()
(op2, operands2), = operands[1].items()
expr = op2.join(operands2).replace("=", "==")
self.assertTrue(eval(expr))
def test_implies(self):
xproto = """
policy implies < obj.name -> obj.creator >
"""
target = XProtoTestHelpers.write_tmp_target(
"{{ proto.policies.implies }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.is_admin = False
obj = FakeObject()
obj.name = "Thing 1"
obj.creator = None
(op, operands), = eval(output).items()
expr = "not " + op.join(operands).replace("->", " or ")
self.assertFalse(eval(expr))
def test_bin(self):
xproto = """
policy slice_admin < slice.is_admin | obj.empty >
"""
target = XProtoTestHelpers.write_tmp_target(
"{{ proto.policies.slice_admin }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.is_admin = False
obj = FakeObject()
obj.empty = []
(op, operands), = eval(output).items()
expr = op.join(operands).replace("|", " or ")
self.assertFalse(eval(expr))
def test_equal(self):
xproto = """
policy output < ctx.user = obj.user >
"""
args = XOSProcessorArgs(inputs=xproto, target=self.target)
output = XOSProcessor.process(args)
exec(output, globals(
)) # This loads the generated function, which should look like this:
"""
def output_security_check(obj, ctx):
i1 = (ctx.user == obj.user)
return i1
"""
obj = FakeObject()
obj.user = 1
ctx = FakeObject()
ctx.user = 1
verdict = output_security_check(obj, ctx)
def test_equal(self):
xproto = """
policy slice_user < slice.user = obj.user >
"""
target = XProtoTestHelpers.write_tmp_target(
"{{ proto.policies.slice_user }}")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
slice = FakeObject()
slice.user = "******"
obj = FakeObject()
obj.user = "******"
(op, operands), = eval(output).items()
expr = op.join(operands).replace("=", "==")
self.assertTrue(eval(expr))
def test_exists(self):
xproto = """
policy privilege < exists Privilege: Privilege.object_id = obj.id >
"""
target = XProtoTestHelpers.write_tmp_target(
"{{ proto.policies.privilege }} ")
args = XOSProcessorArgs()
args.inputs = xproto
args.target = target
output = XOSProcessor.process(args)
Privilege = FakeObject()
Privilege.object_id = 1
obj = FakeObject()
obj.id = 1
(op, operands), = eval(output).items()
(op2, operands2), = operands[1].items()
expr = op2.join(operands2).replace("=", "==")
self.assertTrue(eval(expr))