1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
|
#!/usr/bin/env python3
from abc import ABC, abstractmethod
import fnmatch
import logging
import re
from typing import Any, Callable, List, Optional, Set
logger = logging.getLogger(__name__)
ACL_ORDER_ALLOW_DENY = 1
ACL_ORDER_DENY_ALLOW = 2
class SimpleACL(ABC):
"""A simple Access Control List interface."""
def __init__(
self,
*,
order_to_check_allow_deny: int,
default_answer: bool
):
if order_to_check_allow_deny not in (
ACL_ORDER_ALLOW_DENY, ACL_ORDER_DENY_ALLOW
):
raise Exception(
'order_to_check_allow_deny must be ACL_ORDER_ALLOW_DENY or ' +
'ACL_ORDER_DENY_ALLOW')
self.order_to_check_allow_deny = order_to_check_allow_deny
self.default_answer = default_answer
def __call__(self, x: Any) -> bool:
"""Returns True if x is allowed, False otherwise."""
logger.debug(f'SimpleACL checking {x}')
if self.order_to_check_allow_deny == ACL_ORDER_ALLOW_DENY:
logger.debug('Checking allowed first...')
if self.check_allowed(x):
logger.debug(f'{x} was allowed explicitly.')
return True
logger.debug('Checking denied next...')
if self.check_denied(x):
logger.debug(f'{x} was denied explicitly.')
return False
elif self.order_to_check_allow_deny == ACL_ORDER_DENY_ALLOW:
logger.debug('Checking denied first...')
if self.check_denied(x):
logger.debug(f'{x} was denied explicitly.')
return False
if self.check_allowed(x):
logger.debug(f'{x} was allowed explicitly.')
return True
logger.debug(
f'{x} was not explicitly allowed or denied; ' +
f'using default answer ({self.default_answer})'
)
return self.default_answer
@abstractmethod
def check_allowed(self, x: Any) -> bool:
"""Return True if x is explicitly allowed, False otherwise."""
pass
@abstractmethod
def check_denied(self, x: Any) -> bool:
"""Return True if x is explicitly denied, False otherwise."""
pass
class SetBasedACL(SimpleACL):
"""An ACL that allows or denies based on membership in a set."""
def __init__(self,
*,
allow_set: Optional[Set[Any]] = None,
deny_set: Optional[Set[Any]] = None,
order_to_check_allow_deny: int,
default_answer: bool) -> None:
super().__init__(
order_to_check_allow_deny=order_to_check_allow_deny,
default_answer=default_answer
)
self.allow_set = allow_set
self.deny_set = deny_set
def check_allowed(self, x: Any) -> bool:
if self.allow_set is None:
return False
return x in self.allow_set
def check_denied(self, x: Any) -> bool:
if self.deny_set is None:
return False
return x in self.deny_set
class PredicateListBasedACL(SimpleACL):
"""An ACL that allows or denies by applying predicates."""
def __init__(self,
*,
allow_predicate_list: List[Callable[[Any], bool]] = None,
deny_predicate_list: List[Callable[[Any], bool]] = None,
order_to_check_allow_deny: int,
default_answer: bool) -> None:
super().__init__(
order_to_check_allow_deny=order_to_check_allow_deny,
default_answer=default_answer
)
self.allow_predicate_list = allow_predicate_list
self.deny_predicate_list = deny_predicate_list
def check_allowed(self, x: Any) -> bool:
if self.allow_predicate_list is None:
return False
return any(predicate(x) for predicate in self.allow_predicate_list)
def check_denied(self, x: Any) -> bool:
if self.deny_predicate_list is None:
return False
return any(predicate(x) for predicate in self.deny_predicate_list)
class StringWildcardBasedACL(PredicateListBasedACL):
"""An ACL that allows or denies based on string glob (*, ?) patterns."""
def __init__(self,
*,
allowed_patterns: Optional[List[str]] = None,
denied_patterns: Optional[List[str]] = None,
order_to_check_allow_deny: int,
default_answer: bool) -> None:
allow_predicates = []
if allowed_patterns is not None:
for pattern in allowed_patterns:
allow_predicates.append(
lambda x, pattern=pattern: fnmatch.fnmatch(x, pattern)
)
deny_predicates = None
if denied_patterns is not None:
deny_predicates = []
for pattern in denied_patterns:
deny_predicates.append(
lambda x, pattern=pattern: fnmatch.fnmatch(x, pattern)
)
super().__init__(
allow_predicate_list=allow_predicates,
deny_predicate_list=deny_predicates,
order_to_check_allow_deny=order_to_check_allow_deny,
default_answer=default_answer,
)
class StringREBasedACL(PredicateListBasedACL):
"""An ACL that allows or denies by applying regexps."""
def __init__(self,
*,
allowed_regexs: Optional[List[re.Pattern]] = None,
denied_regexs: Optional[List[re.Pattern]] = None,
order_to_check_allow_deny: int,
default_answer: bool) -> None:
allow_predicates = None
if allowed_regexs is not None:
allow_predicates = []
for pattern in allowed_regexs:
allow_predicates.append(
lambda x, pattern=pattern: pattern.match(x) is not None
)
deny_predicates = None
if denied_regexs is not None:
deny_predicates = []
for pattern in denied_regexs:
deny_predicates.append(
lambda x, pattern=pattern: pattern.match(x) is not None
)
super().__init__(
allow_predicate_list=allow_predicates,
deny_predicate_list=deny_predicates,
order_to_check_allow_deny=order_to_check_allow_deny,
default_answer=default_answer,
)
class AnyCompoundACL(object):
"""An ACL that allows if any of its subacls allow."""
def __init__(self, subacls: List[SimpleACL]):
assert subacls is not None
self.subacls = subacls
def __call__(self, x: Any):
return any(acl(x) for acl in self.subacls)
class AllCompoundACL(object):
"""An ACL that allows if all of its subacls allow."""
def __init__(self, subacls: List[SimpleACL]):
assert subacls is not None
self.subacls = subacls
def __call__(self, x: Any):
return all(acl(x) for acl in self.subacls)
|
