Home | History | Annotate | Download | only in diff 
      1 # Copyright 2016, Tresys Technology, LLC
      2 #
      3 # This file is part of SETools.
      4 #
      5 # SETools is free software: you can redistribute it and/or modify
      6 # it under the terms of the GNU Lesser General Public License as
      7 # published by the Free Software Foundation, either version 2.1 of
      8 # the License, or (at your option) any later version.
      9 #
     10 # SETools is distributed in the hope that it will be useful,
     11 # but WITHOUT ANY WARRANTY; without even the implied warranty of
     12 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     13 # GNU Lesser General Public License for more details.
     14 #
     15 # You should have received a copy of the GNU Lesser General Public
     16 # License along with SETools.  If not, see
     17 # <http://www.gnu.org/licenses/>.
     18 #
     19 from collections import defaultdict, namedtuple
     20 
     21 from .descriptors import DiffResultDescriptor
     22 from .difference import Difference, SymbolWrapper, Wrapper
     23 from .mls import RangeWrapper
     24 
     25 
     26 modified_mlsrule_record = namedtuple("modified_mlsrule", ["rule",
     27                                                           "added_default",
     28                                                           "removed_default"])
     29 
     30 
     31 class MLSRulesDifference(Difference):
     32 
     33     """Determine the difference in MLS rules between two policies."""
     34 
     35     added_range_transitions = DiffResultDescriptor("diff_range_transitions")
     36     removed_range_transitions = DiffResultDescriptor("diff_range_transitions")
     37     modified_range_transitions = DiffResultDescriptor("diff_range_transitions")
     38 
     39     # Lists of rules for each policy
     40     _left_mls_rules = defaultdict(list)
     41     _right_mls_rules = defaultdict(list)
     42 
     43     def diff_range_transitions(self):
     44         """Generate the difference in range_transition rules between the policies."""
     45 
     46         self.log.info(
     47             "Generating range_transition differences from {0.left_policy} to {0.right_policy}".
     48             format(self))
     49 
     50         if not self._left_mls_rules or not self._right_mls_rules:
     51             self._create_mls_rule_lists()
     52 
     53         added, removed, matched = self._set_diff(
     54                 self._expand_generator(self._left_mls_rules["range_transition"], MLSRuleWrapper),
     55                 self._expand_generator(self._right_mls_rules["range_transition"], MLSRuleWrapper))
     56 
     57         modified = []
     58 
     59         for left_rule, right_rule in matched:
     60             # Criteria for modified rules
     61             # 1. change to default range
     62             if RangeWrapper(left_rule.default) != RangeWrapper(right_rule.default):
     63                 modified.append(modified_mlsrule_record(left_rule,
     64                                                         right_rule.default,
     65                                                         left_rule.default))
     66 
     67         self.added_range_transitions = added
     68         self.removed_range_transitions = removed
     69         self.modified_range_transitions = modified
     70 
     71     #
     72     # Internal functions
     73     #
     74     def _create_mls_rule_lists(self):
     75         """Create rule lists for both policies."""
     76         # do not expand yet, to keep memory
     77         # use down as long as possible
     78         self.log.debug("Building MLS rule lists from {0.left_policy}".format(self))
     79         for rule in self.left_policy.mlsrules():
     80             self._left_mls_rules[rule.ruletype].append(rule)
     81 
     82         self.log.debug("Building MLS rule lists from {0.right_policy}".format(self))
     83         for rule in self.right_policy.mlsrules():
     84             self._right_mls_rules[rule.ruletype].append(rule)
     85 
     86         self.log.debug("Completed building MLS rule lists.")
     87 
     88     def _reset_diff(self):
     89         """Reset diff results on policy changes."""
     90         self.log.debug("Resetting MLS rule differences")
     91         self.added_range_transitions = None
     92         self.removed_range_transitions = None
     93         self.modified_range_transitions = None
     94 
     95         # Sets of rules for each policy
     96         self._left_mls_rules.clear()
     97         self._right_mls_rules.clear()
     98 
     99 
    100 class MLSRuleWrapper(Wrapper):
    101 
    102     """Wrap MLS rules to allow set operations."""
    103 
    104     def __init__(self, rule):
    105         self.origin = rule
    106         self.ruletype = rule.ruletype
    107         self.source = SymbolWrapper(rule.source)
    108         self.target = SymbolWrapper(rule.target)
    109         self.tclass = SymbolWrapper(rule.tclass)
    110         self.key = hash(rule)
    111 
    112     def __hash__(self):
    113         return self.key
    114 
    115     def __lt__(self, other):
    116         return self.key < other.key
    117 
    118     def __eq__(self, other):
    119         # because MLSRuleDifference groups rules by ruletype,
    120         # the ruletype always matches.
    121         return self.source == other.source and \
    122                self.target == other.target and \
    123                self.tclass == other.tclass
    124