diff options
| -rw-r--r-- | xacml-translation/xacml.rego | 58 |
1 files changed, 42 insertions, 16 deletions
diff --git a/xacml-translation/xacml.rego b/xacml-translation/xacml.rego index b5ba0ff..8cbeb31 100644 --- a/xacml-translation/xacml.rego +++ b/xacml-translation/xacml.rego @@ -152,8 +152,24 @@ is_indeterminate(value) if { is_null(value.value) } # Match Functions ######################################################################## -## TODO -apply_xacml_function("urn:oasis:names:tc:xacml:1.0:function:string-equal", [("http://www.w3.org/2001/XMLSchema#string", a), ("http://www.w3.org/2001/XMLSchema#string", b)]) := true_value if { +apply_xacml_function( + "urn:oasis:names:tc:xacml:1.0:function:string-equal", + [{ "kind": "primitive", + "type": "http://www.w3.org/2001/XMLSchema#string", + "value": a }, + { "kind": "primitive", + "type": "http://www.w3.org/2001/XMLSchema#string", + "value": b }]) := true_value if { + a == b +} else := false_value +apply_xacml_function( + "urn:oasis:names:tc:xacml:1.0:function:anyURI-equal", + [{ "kind": "primitive", + "type": "http://www.w3.org/2001/XMLSchema#anyURI", + "value": a }, + { "kind": "primitive", + "type": "http://www.w3.org/2001/XMLSchema#anyURI", + "value": b }]) := true_value if { a == b } else := false_value @@ -165,7 +181,7 @@ designator_matches(designator, attribute) if { attribute.category == designator.category attribute.identifier == designator.identifier attribute.value.type == designator.type - attribute.attr.issuer == null + not attribute.attr.issuer } designator_matches(designator, attribute) if { @@ -175,17 +191,20 @@ designator_matches(designator, attribute) if { attribute.attr.issuer == designator.issuer } -evaluate_designator(designator) := result if { +evaluate_designator(designator) := { "kind": "bag", "values": xs } if { + xs := [y.value | y := input.request[_]; designator_matches(designator, y)] + count(xs) > 1 +} + +evaluate_designator(designator) := xs[0] if { xs := [y.value | y := input.request[_]; designator_matches(designator, y)] - count(xs) > 0 - result := { "kind": "bag", "values": xs } + count(xs) == 1 } -evaluate_designator(designator) := result if { +evaluate_designator(designator) := { "kind": "bag", "values": xs } if { xs := [y.value | y := input.request[_]; designator_matches(designator, y)] count(xs) == 0 not designator.must_be_present - result := { "kind": "bag", "values": xs } } evaluate_designator(designator) := { "status": "missing_attribute" } if { @@ -202,30 +221,37 @@ evaluate_match(match) := { "match_result": true_value } if { designator_result := evaluate_designator(match.designator) # Designator evaluates without error. - is_array(designator_result) + designator_result - some x in designator_result - apply_xacml_function(match.fn, x).value == true + some x in designator_result.values + apply_xacml_function(match.function, [x, match.value]).value == true +} else := { "match_result": true_value } if { + designator_result := evaluate_designator(match.designator) + + # Designator evaluates without error. + designator_result + + apply_xacml_function(match.function, [designator_result, match.value]).value == true } else := { "match_result": indeterminate_value } if { designator_result := evaluate_designator(match.designator) # Designator evaluates without error. - is_array(designator_result) + designator_result some x in designator_result - is_indeterminate(apply_xacml_function(match.fn, x)) + is_indeterminate(apply_xacml_function(match.function, [x, match.value])) } else := { "match_result": false_value } if { designator_result := evaluate_designator(match.designator) # Designator evaluates without error. - is_array(designator_result) + designator_result } else := { "match_result": indeterminate_value } # Last case runs when evaluating the designator results in an error. evaluate_all_of(conj) := { "match_result": true_value } if { every x in conj { - evaluate_match(x) == true + evaluate_match(x).match_result.value == true } } else := { "match_result": "indeterminate" } if { some x in conj @@ -253,7 +279,7 @@ evaluate_target(xs) := { "match_result": true_value } if { } } else := { "match_result": false_value } if { some disj in xs - evaluate_any_of(disj).match_result.value == false + evaluate_any_of(disj).match_result == "no_match" } else := { "match_result": indeterminate_value } ######################################################################## |